IR 05000305/2006007

IR 05000305-06-007 on 05/1/2006 - 05/24/2006; Kewaunee Power Station. Supplemental Inspection 95002, Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area

ML061860453
Person / Time
Site:	Kewaunee
Issue date:	07/03/2006
From:	Pederson C Division of Reactor Safety III
To:	Christian D Dominion, Dominion Energy Kewaunee
References
EA-05-157, EA-05-176
Download: ML061860453 (62)

Text

uly 3, 2006

SUBJECT:

KEWAUNEE POWER STATION - NRC SUPPLEMENTAL INSPECTION REPORT 05000305/2006007

Dear Mr. Christian:

On May 24, 2006, the U.S. Nuclear Regulatory Commission (NRC) completed a supplemental inspection pursuant to Inspection Procedure 95002, Inspection For One Degraded Cornerstone or any Three White Inputs in a Strategic Performance Area, at your Kewaunee Power Station. The enclosed inspection report documents the inspection findings, which were discussed on May 24, 2006, with yourself and other members of your staff.

As discussed in our annual end-of-cycle assessment letter dated March 4, 2006, plant performance for Kewaunee was categorized within the Degraded Cornerstone column of the NRCs Action Matrix based on performance deficiencies in the Mitigating Systems cornerstone.

The findings involved: (1) a performance issue having substantial safety significance (Yellow)

related to the potential for flooding of safety-related systems, components, or structures; and (2) a performance issue having low to moderate safety significance (White) related to the potential for air entrainment into the auxiliary feedwater pumps. These performance deficiencies were previously described in NRC Inspection Reports 05000305/2005014 and 05000305/2005018, respectively. The NRC performed this supplemental inspection as prescribed by the Action Matrix based on this performance.

The specific purposes of this inspection, as described in Inspection Procedure 95002, were to:

(1) provide assurance that the root causes and contributing causes for the violations, which resulted in the degraded cornerstone, were understood; (2) independently assess the extent of condition and extent of cause for the violations; and (3) provide assurance that your planned corrective actions were sufficient to address the root causes and contributing causes for the violations, and to prevent their recurrence. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

As further detailed in the enclosed report, the NRC concluded that, for both of the identified performance deficiencies, your staff had not conducted the root cause evaluation to a level of detail commensurate with the significance of the problem. Furthermore, the NRC determined that not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. Finally, the NRC concluded that your staff had not established either qualitative or quantitative measures for determining the effectiveness of the corrective actions to prevent recurrence. Consequently, the NRC did not have assurance that your planned corrective actions were sufficient to address the causes for the performance deficiencies associated with the violations. We request that you inform us in writing once you have completed steps to assure that your cause evaluation and corrective actions are of sufficient scope and breadth to address the subject performance deficiencies.

The NRC will then perform additional inspections as necessary to assess the effectiveness of your actions. Pending completion of this followup inspection activity, the violations associated with the Yellow flooding performance deficiency, and the White auxiliary feedwater performance deficiency, both in the Mitigating Systems Cornerstone, will remain open.

Based on the results of this inspection, five NRC-identified findings of very low safety significance (Green) were identified, all of which involved violations of NRC requirements.

Because of their very low safety significance and because the issues were entered into your corrective action program, the NRC is treating these issues as Non-Cited Violations, in accordance with Section VI.A.1 of the NRC Enforcement Policy. If you contest any Non-Cited Violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator - Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Kewaunee Power Station.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA by Anne T. Boland Acting For/

Cynthia D. Pederson, Director Division of Reactor Safety Docket No. 50-305 License No. DPR-43 Enclosure: Inspection Report 05000305/2006007 w/Attachment: Supplemental Information See Attached Distribution

SUMMARY OF FINDINGS

IR 05000305/2006007; 5/1/2006 - 5/24/2006; Kewaunee Power Station. Supplemental

Inspection 95002, Inspection for One Degraded Cornerstone or any Three White Inputs in a Strategic Performance Area.

This report documents a supplemental inspection by a team of four NRC inspectors. The inspection identified five Non-Cited Violations having very low safety significance. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management's review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

A. Assessment of the Licensees Evaluation of Root Causes Associated with the Degraded Mitigating System Cornerstone The U.S. Nuclear Regulatory Commission (NRC) performed this supplemental inspection, in accordance with Inspection Procedure 95002, to assess the licensees evaluations associated with a degraded cornerstone, due to two findings characterized as having low to moderate (White) and substantial (Yellow) risk significance. The findings involved: (1) a performance deficiency having substantial safety significance (Yellow) related to the potential for flooding of safety-related systems, components or structures; and (2) a performance deficiency having low to moderate safety significance (White) related to the potential for air entrainment into the auxiliary feedwater pumps.

These performance deficiencies were previously described in NRC Inspection Reports 05000305/2005014 and 05000305/2005018, respectively.

For the Yellow flooding performance deficiency, the inspectors determined that the licensee identified a root cause, a direct cause, and a contributing cause. The licensee developed seven corrective actions to prevent recurrence and five recommended corrective actions; some of these were common with the corrective actions to prevent recurrence or recommended corrective actions for the auxiliary feedwater issue. The inspectors found the licensees methods of evaluation to be appropriate. However, the NRC concluded that the licensee had not conducted the root cause evaluation to a level of detail commensurate with the significance of the problem. Furthermore, the inspectors determined that not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. Finally, the inspectors concluded that the licensee had not established either qualitative or quantitative measures for determining the effectiveness of the corrective actions to prevent recurrence. (Section 02)

For the White auxiliary feedwater issue, the inspectors determined that the licensee identified three root causes, and a contributing cause. The licensee developed six corrective actions to prevent recurrence and eight recommended corrective actions; some of which were common with the corrective actions to prevent recurrence or recommended corrective actions for the flooding issue. While the methods of evaluation used by the licensee were acceptable, the inspectors found the licensee failed to use the methods to ensure a systematic review of the auxiliary feedwater issue. The NRC concluded that the licensee had not conducted the root cause evaluation to a level of detail commensurate with the significance of the problem. Furthermore, the inspectors determined that not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. Finally, the inspectors concluded that the licensee had not established either qualitative or quantitative measures for determining the effectiveness of the corrective actions to prevent recurrence. (Section 03)

The inspectors determined that the licensee also performed a common cause evaluation, from which the licensee identified five common causes. The inspectors found the licensees methods of evaluation to be appropriate. However, the NRC concluded that the licensee had not initially conducted the common cause evaluation to a level of detail commensurate with the significance of the problem. Furthermore, the inspectors determined that the common causes could not always be logically drawn from the two performance deficiencies which comprised the degraded cornerstone. The inspectors ascertained that not all the corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. Finally, the inspectors concluded that the licensee had not established either qualitative or quantitative measures for determining the effectiveness of the corrective actions to prevent recurrence. (Section 04)

Consequently, the inspectors concluded that both the Yellow and White findings (VIO 05000305/2004009-03 and VIO 05000305/2005002-05) will remain open for further NRC review.

NRC Identified Findings

Initiating Events Cornerstone

Green.

The NRC inspectors identified a finding of very low safety significance that involved a violation of 10 CFR Part 50, Appendix B, Criterion XVI,

Corrective Actions. Specifically, for the turbine building flooding and auxiliary feedwater air entrainment performance deficiencies, which were significant conditions adverse to quality, the licensee failed to identify the causes, and to determine corrective actions to preclude repetition.

The finding was greater than minor because the failure to identify the cause and corrective actions to preclude repetition of significant conditions adverse to quality, which led to a degraded cornerstone could result in the NRC needing to take more significant action. The finding was determined to be of very low safety significance based on management review, and the determination that no additional instances of significant conditions adverse to quality have actually occurred due to the failure to identify the causes and corrective actions for the previous performance deficiencies. The cause of the finding was related to the evaluation aspect of the cross-cutting element of problem identification and resolution. (Section 05.02)

Mitigating Systems Cornerstone

Green.

The NRC inspectors identified a finding of very low safety significance that involved a violation of 10 CFR Part 50, Appendix B, Criterion V,

Instructions, Procedures, and Drawings. Specifically, the licensee failed to incorporate appropriate acceptance criteria for assessing operability of the auxiliary feedwater pump following identification of a piping obstruction.

The finding was greater than minor because the finding was associated with the Mitigating Systems cornerstone attribute of procedure quality which affected the cornerstone objective. Specifically, the relevant procedure was not adequate to ensure the availability, reliability, and capability of the auxiliary feedwater system to respond to initiating events. The finding was determined to be of very low safety significance because subsequent evaluation of the pipe occlusions, using appropriate acceptance criteria, supported past operability of the pump. The cause of the finding was related to the evaluation aspect of the cross-cutting element of problem identification and resolution. (Section 06.02)

Green.

The NRC inspectors identified a finding of very low safety significance that involved a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Specifically, the licensee failed to ensure that design basis calculations correctly translated the containment sump volume at the time of the switch over from the refueling water storage tank to the containment sump to ensure adequate available net positive suction head and vortex suppression for the residual heat removal pumps.

The finding was greater than minor because the finding was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective because the inadequate calculation impacted the design requirements for the new containment strainers being installed to resolve Generic Safety Issue 191. The finding was determined to be of very low safety significance because (1) the licensee normally kept the refueling water storage tank at a level above the Technical Specification minimum; (2) new strainers were not yet installed; and (3) inspector-independent calculations indicated that the pumps had adequate net positive suction head and vortex suppression, with the additional non-conservatisms incorporated. The cause of the finding was related to the corrective action aspect of the cross-cutting element of problem identification and resolution. (Section 07.02.a)

Green.

The NRC inspectors identified a finding of very low safety significance that involved a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Specifically, the licensee failed to properly evaluate the minimum flow requirements of the high head safety injection pumps.

The finding was greater than minor because the finding was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective as providing inadequate minimum flow to the SI pumps could result in the pumps failing under certain accident scenarios. The finding was determined to be of very low safety significance because both the licensee and the inspectors determined that the safety injection pumps remained operable with the 47 gpm minimum flow rate. The cause of the finding was related to the corrective action of the cross-cutting element of problem identification and resolution. (Section 07.02.b)

Barrier Integrity Cornerstone

Green.

The NRC inspectors identified a finding of very low safety significance that involved a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Specifically, the licensee failed to ensure that design basis calculations correctly translated the internal containment spray flow requirements into the Technical Specification allowed number of blocked internal containment spray nozzles.

The finding was greater than minor because the containment spray system could have been inoperable with the allowable pump degradation and allowable number of blocked containment spray nozzles. The finding was determined to be of very low safety significance because the internal containment spray system was determined to be operable. The cause of the finding was related to the evaluation aspect of the cross-cutting element of problem identification and resolution. (Section 07.02.c)

REPORT DETAILS

INSPECTION SCOPE

This inspection was conducted in accordance with Inspection Procedure 95002, Inspection for One Degraded Cornerstone or Any Three White Inputs in a Strategic Performance Area, to assess the licensees evaluation of one White and one Yellow inspection findings in the Mitigating Systems cornerstone. The inspection objectives were to:

• Verify that the licensee understood the root causes and contributing causes for the individual and collective performance issues which resulted in the degraded cornerstone;

• Verify that the corrective actions sufficiently addressed the root causes and contributing causes for the individual and collective performance issues and would prevent their recurrence; and

• Independently assess the extent of condition and the extent of cause for the individual and collective performance issues which resulted in the degraded cornerstone.

Kewaunee entered the Degraded Cornerstone column of the NRCs Action Matrix in the fourth quarter of 2005 as a result of a Yellow inspection finding related to turbine building flooding. At the time, the licensee was in the Regulatory Response column of the action matrix due to a White inspection finding related to possible air entrainment in the auxiliary feedwater pumps. These findings are discussed in detail in Inspection Reports 05000305/2005010 (Auxiliary Feedwater) and 05000305/2005011 (Flooding),and the final regulatory significance was documented in Inspection Reports 05000305/2005014 (Auxiliary Feedwater) and 05000305/2005018 (Flooding).

The licensee had been in the Regulatory Response column since the first quarter of 2005, also due to a White inspection finding affecting the Barrier Integrity cornerstone.

This White inspection finding, related to an inability to close the containment hatch during a refueling outage, was previously inspected using Inspection Procedure 95001, Inspection for One or Two White Inputs in a Strategic Performance Area and was closed in October 2005.

02.

EVALUATION OF INSPECTION REQUIREMENTS Yellow Finding: Turbine Building Flooding of Safety and Risk Significant Components 02.01 Problem Identification a.

Determination Whether the Licensees Root Cause Evaluation Specified Who Identified the Issue and Under What Conditions The licensees root cause evaluation specified who identified the issue and under what conditions the issue was identified. Specifically, in Section 2.2.1 of the flooding root cause evaluation, Row 18 of the Sequence of Events table documented that event discovery was by the NRC and occurred on February 14, 2005, with the opening of an unresolved item in Inspection Report 05000305/2004009. This area was considered satisfactory.

b.

Determination Whether the Licensees Root Cause Evaluation Documented How Long the Issue Existed, and Whether There Were Any Prior Opportunities for Identification The licensees root cause evaluation documented how long the issue existed and the prior opportunities for identification. Specifically, in Section 2.2.1, the Sequence of Events table documented that the licensee had previously identified flooding issues since at least 1982. The evaluation identified six missed opportunities for prior identification, including the actual flooding of a safety-related equipment room in 2003.

This area was considered satisfactory.

c.

Determination Whether the Licensees Root Cause Evaluation Documented the Plant-Specific Risk Consequences and Compliance Concerns Associated with the Issue The licensees root cause evaluation documented the plant specific risk consequences individually associated with the flooding event. It did not originally address compliance concerns. Upon questioning by NRC during the 95002 inspection, the licensee revised the root cause evaluation. Revision 2 of the evaluation addressed the flooding issue compliance concerns. This area was considered satisfactory.

02.02 Root Cause and Extent of Condition Evaluation a.

Determination Whether the Licensees Root Cause Evaluation Applied Systematic Methods in Evaluating the Issue in Order to Identify Root Causes and Contributing Causes.

The licensees root cause evaluation applied systematic methods in evaluating the issue. Specifically, in Section 2.2.3 of the flooding root cause evaluation (Revision 1),the licensee listed the following methods as being used:

• Event and Causal Factor Analysis;

• Failure Mode Analysis of Human Performance Failure Modes;

• Process Failure Modes;

• Organizational/Management Failure Modes; and

• Stream

Analysis.

These methods were slightly rearranged in Revision 2 of the root cause evaluation to note that the middle three items were one method, applied to different processes.

Additionally, two other methods were used: a Cause Analysis Map and a Why Staircase; the latter being added in Revision 2.

The methods were generally considered to be systematic as they employed root cause methods which were recognized and discussed in either the Nuclear Management Company or the Dominion root cause guidance documents.

This area was considered satisfactory in regard to the methods employed. The quality of the application of those methods is discussed below.

b. Determination Whether the Licensees Root Cause Evaluation Was Conducted to a Level of Detail Commensurate with the Significance of the Problem The licensees root cause evaluation was not conducted to a level of detail commensurate with the significance of the problem. The licensee identified the root cause as Low level of knowledge in engineering related to design basis. The licensee identified a contributing cause of Operating Experience (OE) assessments for flooding resulted in missed opportunities to correct the flawed PRA/Flooding studies used for decisionmaking. Finally, the licensee identified a direct cause as the probabilistic risk assessment (PRA) model for internal flooding was flawed resulting in inaccurate significance when used for decisionmaking.

Through performance of a limited-scope independent root cause evaluation, interviews of licensee employees, and review of engineering documents, the inspectors ascertained that the licensee did not probe the root cause to a sufficient depth to determine why a low level of knowledge related to the design basis existed in engineering and whether that truly was the root cause.

The inspectors noted that the licensees root cause guidance document provided information on how to determine human error causes, such as lack of engineering knowledge. The root cause guidance document noted that Knowledge Based Errors were very dependent on the level of training, experience, and knowledge by the task participants. Furthermore, the root cause guidance document addressed what information was needed to successfully assess how management, organizational, and process problems contributed to the event. The inspectors noted that systematic root cause methods, such as those described in Section 02.02.a above, should have driven the licensee to more fully evaluate the following types of issues:

• Accountability of engineering personnel;

• Qualifications and training of engineering personnel;

• Schedule pressures and budget constraints;

• Management oversight and expectations; and

• Site-wide acceptance of minimum regulatory compliance.

The inspectors ascertained that the licensees procedures did not always require independent verification of engineering products such as calculations and operability determinations. Additionally, the licensee frequently relied upon personnel who did not have demonstrated engineering knowledge, training, or abilities to perform engineering tasks. Finally, the inspectors determined that schedule and budget pressures frequently played a role in engineering decisions.

In regard to the contributing cause, the inspectors determined that the licensee did not probe why the operating experience assessments for flooding, or any other issue, failed to identify the issue. The evaluation did not explore what deficiencies in the operating experience program resulted in opportunities to identify issues being missed. Rather the evaluation assumed that the operating experience process must have contributed to the issue because there were missed opportunities to identify the flooding issue, without supporting why a process failure was at fault. For example, the inspectors noted that the root cause evaluation stated that the licensee had been aware, since mid-1992 that the flooding study contained inaccuracies. However, the root cause evaluation did not address why the inaccuracies were repeatedly identified without corrective actions being taken and why the 2004 PRA still used flawed information.

Additionally, the inspectors ascertained that the licensee did not review the corrective action program (CAP) document (CAP 016375) for the 2003 safeguards alley flooding event to determine why the actual flooding event failed to identify the larger problem.

While the inspectors confirmed that the licensee did not adequately use the available operating experience, there was insufficient information for the inspectors to confirm that the cause was an operating experience process failure versus the licensee failing to act upon known problems. Therefore, the inspectors determined that any perceived inadequacies in the operating experience program were overshadowed by the other contributing causes which were not identified by the licensee.

Based on the above, the inspectors concluded that, even with better engineering knowledge of design basis, the licensee probably would not have identified the flooding issue because of an underlying philosophy that issues did not need resolution unless required to maintain plant operations or to specifically comply with NRC requirements.

The inspectors further concluded that perceived schedule and budget pressures likely reinforced this expectation.

Based on the above, this area was determined to be unsatisfactory. The inspectors determined that further licensee action was necessary to identify the root cause of the significant condition adverse to quality and that further NRC inspection would be needed to evaluate the acceptability of the licensees root cause determination for the Yellow finding.

c. Determination Whether the Licensees Root Cause Evaluation Included Consideration of Prior Occurrences of the Problem and Knowledge of Prior Operating Experience The licensees root cause evaluation did include an after-the-fact consideration of prior occurrences of the problem and did acknowledge prior operating experience, both internal and external. Specifically, in Section 2.4 of the evaluation, the licensee documented prior occurrences of the problem and knowledge of prior operating experience and provided some discussion as to why the licensee failed to identify the flooding issue from these prior opportunities. This area was considered satisfactory.

d. Determination Whether the Licensees Root Cause Evaluation Addressed Extent of Condition and Extent of Cause of the Problem The inspectors determined that the licensee had addressed the extent of condition, that is, the extent to which other safety-related systems, structures, and components were protected from flooding. Although the licensee documented the review of extent of condition under a different heading, the inspectors concluded that the licensee performed a reasonably thorough review of other areas in the plant which could be susceptible to flooding.

The licensee evaluated the extent to which other decisions were made based upon the flawed PRA or the flawed flooding study. The licensee documented in Section 2.5.2 of the root cause evaluation that it was possible that decisions were made, including Technical Specification amendments, based on the flawed study. However, the licensee determined that this issue was outside the scope of the root cause evaluation and initiated a different corrective action document for followup. The inspectors reviewed the followup actions taken for CAP 032809 and determined that the issue (potential that decisions were made with a flawed PRA) raised in the root cause report were not addressed in the followup actions. Through interviews, the inspectors deemed that a lack of engineering rigor combined with a schedule pressure to complete the corrective action assignment by the prescribed due date led to the issues not being evaluated thoroughly.

The licensee also performed an evaluation regarding the identified root cause of a low level of engineering knowledge related to design basis. The inspectors noted that the licensee provided several previously identified examples of other instances of a low level of design-basis knowledge in engineering outside of flooding, other types of engineering knowledge deficiencies, and other events resulted from the low level of knowledge.

However, the inspectors could not ascertain that the licensees extent of cause looked further than previously identified problems to identify new issues resulting from the low level of engineering design basis knowledge.

Based on the above, the extent of cause was determined to be unsatisfactory.

However, no additional inspection is necessary, based on the inspectors independent extent of cause evaluation allowing assessment of the licensees performance in this area. No additional issues were identified.

02.03. Corrective Actions a.

Determine Whether the Licensee Specified Appropriate Corrective Actions for Each Common or Root Cause or That the Licensee Evaluated Why No Actions Were Necessary The licensee took a number of immediate corrective actions to resolve the physical flooding operability issue, including installation of physical barriers. These corrective actions were reviewed prior to the plant restarting in mid 2005.

In terms of the corrective actions to preclude repetition, appropriate corrective actions did not appear to have been originally specified for the root cause identified in the root cause evaluation. The licensee identified the following corrective actions to prevent recurrence for the root cause in Revision 1 of the root cause evaluation:

• Develop and implement a human performance document to be used by engineering personnel to develop quality engineering products;

• Conduct training to reinforce corporate principles of professionalism such as expectations regarding engineering product quality;

• Ensure engineering quality is built into the process,

(1) by flagging steps currently existing within process procedures that ensure quality and rigor go into the product and provide for rigorous independent review, or

(2) by adding and flagging the necessary guidance to the procedures and

(3) by making a tie to the human performance document; and

• Train site management on at-power and shutdown risk models to ensure understanding of high-risk scenarios, evolutions, plant configurations, and components/systems and assess the need for continuing training.

The inspectors noted that the first three corrective actions to prevent recurrence addressed an issue of ensuring rigor in engineering products, which was not identified as either a root or contributing cause. The fourth one addressed an issue of management awareness of risk models, which also was not an identified root or contributing cause. The licensees corrective actions to prevent recurrence did not directly address the stated root cause of a low level of knowledge in engineering related to design basis.

During the mid-week of the inspection, the licensee revised the root cause evaluation and added two additional corrective actions to prevent recurrence as a result of the inspectors observations. These corrective actions appeared to more directly address the stated root cause. The new corrective actions to prevent recurrence were:

• Conduct training for engineering personnel on current design and licensing bases; and

• Provide required initial and continuing training for engineering in accessing and using design basis document (DBD) topical and system documents.

However, as discussed in Section 02.02.b, the inspectors were unable to conclude that the licensee had arrived at a reasonable root cause for the Yellow finding. Because the inspectors were unable to conclude that the stated root cause was correct, the inspectors were also unable to conclude that the stated corrective actions to prevent repetition would actually prevent recurrence of the problem.

Based on the above, this area was determined to be unsatisfactory. The inspectors determined that further NRC inspection was needed to evaluate whether the licensee had adequately identified the corrective actions to prevent repetition of the Yellow finding.

b. Determine Whether the Licensee Prioritized the Corrective Actions with Consideration of the Risk Significance and Regulatory Compliance The corrective actions appeared to be prioritized with consideration of the risk significance and regulatory compliance in that those corrective actions necessary to reduce risk and restore compliance were implemented immediately.

The corrective actions to prevent repetition were all categorized as Priority 2" commitments. This area was considered satisfactory, in regard to those corrective actions identified.

c. Determine Whether the Licensee Established a Schedule for Implementing and Completing the Corrective Actions The licensee established a schedule for implementing and completing the corrective actions; although one piece of a corrective action to prevent repetition was scheduled as to be determined in Revision 1 of the root cause evaluation. This problem was corrected and a scheduled date was included in Revision 2. This area was considered satisfactory.

d. Determine Whether the Licensee Developed Quantitative or Qualitative Measures of Success for Determining Effectiveness of Corrective Actions to Prevent Recurrence In some cases, the licensee did not develop either quantitative or qualitative measures to determine the effectiveness of the corrective actions to prevent recurrence. For example, no specific qualitative or quantitative effectiveness review measures were established for determining the effectiveness of the human performance document or the flagged procedure steps in actually ensuring improved engineering rigor. Instead, as discussed in Section 03.03.d, effectiveness would be based on other factors which were not directly related to the corrective actions to prevent recurrence.

For the corrective actions which involved training, the stated effectiveness review measures appeared inadequate. For example, in one case, the stated effectiveness measurement was to merely verify attendance records for training. The inspectors concluded that this action did not measure the knowledge transfer or retention of the information.

Based on the above, this area was determined to be unsatisfactory. The inspectors determined that further NRC inspection was needed to determine the effectiveness of the corrective actions to prevent recurrence.

03 EVALUATION OF INSPECTION REQUIREMENTS White Finding: Auxiliary Feedwater (AFW) Pumps Susceptible to Damage from Air Entrainment 03.01. Problem Identification a.

Determination Whether the Licensees Root Cause Evaluation Specified Who Identified the Issue and Under What Conditions The licensee formally stated that the issue was identified by the NRC in Section 1.1 of the AFW root cause evaluation, Revision 5. However, Revision 4, which was the approved revision provided to the inspectors at the beginning of the inspection, did not contain a similar clear statement. Additionally, information in the sequence of events table, in Section 2.2.1 of both revisions of the root cause evaluation appeared to contradict the above statement and instead contained information that appeared to indicate that the licensee believed that it identified the issue prior to NRC asking questions and independently of any NRC prompting.

Based on review of NRC inspection reports related to the issue, and discussions with both licensee and NRC personnel involved in the issues, the inspectors determined that the issue would be more accurately characterized as NRC-identified because NRC intervention was necessary to ensure that the issue was evaluated appropriately. The inspectors also ascertained that licensee management acknowledged and agreed with this characterization. However, the inspectors also determined that some licensee personnel did not entirely agree with this characterization and that the root cause evaluation reflected this disagreement.

Based on the above, this area was determined to be unsatisfactory. Although additional licensee action may be appropriate in this area, the inspectors determined that sufficient information was available outside the root cause evaluation such that no further inspection of this area was necessary to support NRC decisionmaking regarding the finding.

b.

Determination Whether the Licensees Root Cause Evaluation Documented How Long the Issue Existed, and Whether There Were Any Prior Opportunities for Identification The root cause evaluation clearly described the length of time that the AFW condition existed.

In regard to prior opportunities for identification, the licensee listed only two missed opportunities. However, the inspectors identified that there were at least four generic communications (Generic Letter 81-14, Information Notices 87-34, 87-53, and 02-18)and two external operating experience (including a 2002 Callaway issue and a 2003 Byron issue), which related to AFW pumps performance. One of the communications specifically related to the possibility of air entrainment into the pumps. The licensees root cause evaluation did not address the generic communications or any other operating experience.

The inspectors also determined that the AFW root cause evaluation did not discuss why licensee processes such as peer review, supervisory oversight, self assessments, or quality assurance activities did not identify the problem. The inspectors determined that the licensee failed to identify all prior opportunities to identify the issue. Based on the above, this area was determined to be unsatisfactory. As the NRC independently determined that there were prior opportunities for identification, the inspectors concluded that there was no need for further NRC inspection into this area.

c.

Determination Whether the Licensees Root Cause Evaluation Documented the Plant-Specific Risk Consequences and Compliance Concerns Associated with the Issue The AFW root cause evaluation adequately described the plant-specific risk significance of the issue in Section 2.3. Specifically, the evaluation acknowledged that a White finding was assessed by the NRC. The licensee also documented a plant-specific risk evaluation which concluded that the issue was of low safety significance.

Similar to the flooding root cause evaluation, the AFW root cause evaluation did not originally address compliance concerns. Upon questioning by NRC during the 95002 inspection, the licensee revised the root cause evaluation. Revision 5 of the evaluation addressed the AFW issue compliance concerns. This area was considered satisfactory.

03.02. Root Cause and Extent of Condition Evaluation a.

Determination Whether the Licensees Root Cause Evaluation Applied Systematic Methods in Evaluating the Issue in Order to Identify Root Causes and Contributing Causes.

The licensees root cause evaluation did not totally apply systematic methods in evaluating the issue. Specifically, in Revision 4 of the AFW root cause evaluation, Section 2.2.3, the licensee listed a number of analysis techniques which were not systematic methods of evaluating the issue. After questioning by the inspectors, the licensee revised the list to only contain the following two root cause methods:

• Event and Causal Factor Analysis; and

• Why Staircase.

While the event and causal factor analysis is generally a systematic method of performing a root cause evaluation, the licensees cause evaluation manual noted that using an event and causal factor chart by itself had limitations. The cause evaluation manual also stated that the Why Staircase was more of a thought process than a systematic method.

The inspectors noted that the licensee originally evaluated the issue as a failure occurring in the early 1990's and stopped the root cause evaluation at that time period.

Specifically, the event and causal factor analysis had a gap from January 4, 1994 until January 24, 2005. This led to the licensee not evaluating inappropriate actions and issues occurring between 1994 and 2005. For example, as documented in Inspection Report 0-305/97002, a Severity Level III Violation related to the discharge pressure switch setpoint was issued. Although the licensee documented this issue in the sequence of events table, the licensee did not evaluate the significance of the violations nor the problems identified during that 1997 inspection, specifically, the lack of engineering rigor with respect to maintaining the design basis performance of safety-related pumps. After questioning by the inspectors, the licensee added an additional table to the Why Staircase addressing some of the 2005 issues; however, the licensee still failed to address other missed opportunities to identify the issue, such as the generic communications mentioned in Section 03.01.b and the 1997 finding.

Based on the above, this area was determined to be unsatisfactory. The failure to use systematic methods did not, by itself, warrant further NRC inspection. However, the licensee failed to identify the root cause or causes for the White finding and the inspectors ascertained that the licensees failure to systematically evaluate the finding contributed to the inability to derive the root cause(s). Therefore, the inspectors determined that additional inspection - into why the licensee failed to use a systematic root cause method - was appropriate.

b. Determination Whether the Licensees Root Cause Evaluation Was Conducted to a Level of Detail Commensurate with the Significance of the Problem The licensees root cause evaluation was not conducted to a level of detail commensurate with the significance of the problem. The licensee initially identified two root causes in Revision 4 of the root cause evaluation:

• Previous revisions of the design modification program did not contain the necessary requirements to ensure the appropriate rigor, detailed analysis, and review were performed. Also, the engineers lacked the knowledge and understanding of what constituted proper engineering rigor for analysis, review, and documentation when resolving issues related to design basis for the AFW pumps; and

• Corrective actions were ineffective. The commitment-tracking program was ineffective as a tracking mechanism to ensure that the commitment made to the NRC was fulfilled and due dates were not given or enforced for the identified problem.

In Revision 5 of the evaluation, the first root cause was split into two items and the third root cause was clarified:

• Previous revisions of the design modification program did not contain the necessary requirements to ensure the appropriate rigor, detailed analysis, and review were performed;

• Engineers lacked knowledge and understanding of what constituted proper engineering rigor for analysis, review, and documentation when resolving issues related to design basis for the AFW pumps; and

• Commitments were not tracked in the corrective action program.

The inspectors noted that the root causes were narrowly focused on the engineering department in the 1990's time frame, or at least prior to 2003 when major changes were made to the engineering modification process and the corrective action program. The root cause focused on an inadequate modification and, as such, failed to look at continuing lack of engineering rigor when the AFW issue was discovered by the NRC in 2005. Furthermore, the inspectors were unable to determine how or why tracking a commitment in the corrective action process would have prevented an inadequate modification being installed, much less why it would have ensured that the AFW pumps were protected from air entrainment.

After questioning by the inspectors, the licensee added a Why Staircase to address the 2005 performance deficiencies (in that the licensee failed to recognize all problems with the AFW suction without prompting by the NRC). However, the conclusions of this Why Staircase were not factored back into the root causes.

The inspectors acknowledged the difficulties in determining why an inappropriate modification was designed, approved, and implemented in the early 1990s. However, the inspectors noted that, because the root cause evaluation limited its scope to an inadequate modification rather than to the issue of why were the AFW pumps not protected against air entrainment, the licensee did not address whether a poor modification process was indeed a root cause.

While the inspectors deemed that a lack of engineering rigor did contribute to the event, the inspectors ascertained that the licensee did not probe the root cause to a sufficient depth to determine why the engineers lacked rigor. For example, the inspectors ascertained that the licensee did not evaluate whether management accepted low engineering standards or whether the engineers lacked appropriate training or qualifications to perform the job. Other areas assessed by the inspectors were schedule pressure, especially in regard to operability evaluations, and budget constraints on performing modifications. The inspectors deduced that the lack of engineering rigor was more likely a symptom of a more fundamental root cause such as a management philosophy which accepted low engineering rigor.

Finally, the licensee provided no justification why failure to track a commitment in the corrective action program was a root cause for failing to provide adequate AFW pump protection. Based on the inspectors independent review of the issue, this seemed to be a minor contributing cause.

The licensee also identified one contributing cause in that there was difficulty in locating and understanding documented design basis. The licensee stated that this contributing cause allowed the inadequate modification to exist from 1993 until discovered in 2005.

The inspectors agreed that difficulty in locating design basis information had previously been identified as an issue at Kewaunee, and that it likely contributed to the AFW problem, especially towards the resolution of the problem in 2005. However, the inspectors noted that the contributing cause also stated there was difficulty understanding the design basis. The inspectors deemed that the root cause evaluation appeared to state that, even if the engineers had sufficient access to design basis information, the engineers would not be able to effectively apply the information.

Thus the statement appeared to confirm the lack of engineering rigor was at least partially due to site reliance on personnel who did not have the demonstrated engineering knowledge, training, or abilities to perform engineering tasks.

Based on the above, this area was determined to be unsatisfactory. The inspectors determined that further licensee action was necessary to identify the root cause of the significant condition adverse to quality and that further NRC inspection would then be needed to evaluate the acceptability of the licensees root cause determination for the White finding.

c. Determination Whether the Licensees Root Cause Evaluation Included Consideration of Prior Occurrences of the Problem and Knowledge of Prior Operating Experience The root cause evaluation did include limited consideration of previous occurrences of the problem or knowledge of prior operating experience. The licensee did not identify any other prior occurrence of the problem.

The licensee briefly discussed three external operating experience reviews, but did not address why the operating experience reviews did not identify the AFW issue. Instead, the evaluation only briefly listed how the site had responded to the operating experience information, without reexamining whether the reviews were adequate. Furthermore, the inspectors noted that the operating experience review was limited to only industry events involving the AFW pumps and did not consider NRC generic communications or related industry experience on other safety-related pumps.

Based on the above, this area was determined to be unsatisfactory. Although additional licensee action may be appropriate in this area, the inspectors determined that based on the NRCs independent assessment, no further inspection of this area was necessary to support NRC decisionmaking regarding this finding.

d. Determination Whether the Licensees Root Cause Evaluation Addressed Extent of Condition and Extent of Cause of the Problem The licensee addressed the extent of condition in the root cause evaluation. The licensee conducted focused high energy line break reviews and a review of other risk significant pumps that could be susceptible to issues related to inadequate pressure switches or suction concerns. Additionally, the licensee performed a review of other safety related systems from the perspective of whether there were other existing issues that would prevent a system important to safety from performing its safety function. The inspectors reviewed the breadth and depth of the licensees extent of condition and determined that it was of sufficient scope to adequately address the extent of condition.

In contrast, the inspectors concluded that the extent of cause was not adequately performed. The identified root causes were a lack of an adequate design change program, a lack of engineering rigor and a failure to track commitments in the corrective action tracking program. Based on interviews with licensee personnel, the inspectors determined that the licensee relied on an assumed step improvement in performance based on changes to these processes in 2003. The scope of the licensees extent of cause was limited almost entirely to previously-identified issues and concerns from around the 2000 to 2003 time period. With few exceptions, the corrective action database was reviewed for issues only back as far as 2000, whereas the issues related to this event occurred ten to twenty years prior to then. Therefore, the licensee did not specifically review engineering products from the 1990's to ensure that those products were acceptable and that the engineering decisions based on those products were still valid.

The inspectors noted that as part of the extent of cause review for the AFW pump issue, the licensee reviewed the internal containment spray system pump performance-related design basis information which included, among other factors, review of system hydraulic calculations related to system flow requirements, pump net positive suction head, and pump runout. The licensee did not identify any concerns. However, as discussed in Section 07.02.a, the inspectors identified that the flow through the internal containment spray nozzles had been miscalculated and that the Technical Specification allowance for the number of blocked containment spray nozzles was non-conservative.

Based on the above, the extent of cause was determined to be unsatisfactory. Although additional licensee action may be appropriate in this area, the inspectors determined that based on the NRCs independent extent of cause evaluation, no further inspection of this area was necessary to support NRC decisionmaking regarding the finding.

03.03 Corrective Actions a.

Determine Whether the Licensee Specified Appropriate Corrective Actions for Each Common or Root Cause or That the Licensee Evaluated Why No Actions Were Necessary The licensee took a number of immediate corrective actions to resolve the AFW operability issue, including installation of suction pressure trips and rerouting of the suction lines. These corrective actions were reviewed prior to the plant restarting in 2005.

In terms of the corrective actions to preclude repetition, appropriate corrective actions did not appear to have been originally specified for the root cause. In Revision 4 of the root cause evaluation, the licensee identified the following corrective actions to prevent recurrence:

• For Root Cause 1: Develop and implement a human performance document to be used by engineering personnel to develop quality engineering products;

• For Root Cause 1: Conduct training to reinforce corporate principles of professionalism such as expectations regarding engineering product quality;

• For Root Cause 1: Ensure engineering quality is built into the process

(1) by flagging steps currently existing within process procedures that ensure that quality and rigor go into the product and that provide for a rigorous independent review, or

(2) by adding and flagging the necessary guidance to the procedures and

(3) by making a tie to the human performance document;

• For Root Cause 2: Implemented the corrective action due date extension process as delineated in DNAP-1604; and

• For Root Cause 2: Developed or enhanced processes since 1993 that ensure the appropriate level of review and understanding for safety significant issues is performed.

During the middle week of the inspection, the licensee revised the root cause evaluation to rearrange the corrective actions to align them with the separated root causes. The licensee also added a corrective action which justified why no further actions were necessary in regard to improving the calculation and modification process.

• For Root Cause 1: Ensure engineering quality is built into the process;

(1) by flagging steps currently existing within process procedures that ensure that quality and rigor go into the product and that provide for a rigorous independent review or;

(2) by adding and flagging the necessary guidance to the procedures and;

(3) by making a tie to the human performance document;

• For Root Cause 1: The modification and calculation processes have been enhanced over time and improvements in design inputs related to scope determination, review of industry experience and design basis documentation have been developed and implemented. No additional corrective actions are required to address the root cause; (New)

• For Root Cause 2: Develop and implement a human performance document to be used by engineering personnel to develop quality engineering products;

• For Root Cause 2: Conduct training to reinforce corporate principles of professionalism such as expectations regarding engineering product quality;

• For Root Cause 3: Implemented the corrective action due date extension process as delineated in DNAP-1604; and

• For Root Cause 3: Developed or enhanced processes since 1993 that ensure the appropriate level of review and understanding for safety significant issues is performed.

With the separation of the root causes and realignment of the corrective actions, the corrective actions appear to be focused on the root causes identified by the licensee.

The inspectors did note that both the corrective actions for the last root cause were taking credit for processes implemented prior to the AFW issue being identified. In regard to these items, the inspectors ascertained that the licensee did not justify why these activities met the definition of a corrective action to prevent recurrence nor why the processes were acceptable with no further change. The inspectors were especially concerned with the last root cause relating to commitments not being tracked in the corrective action program. One of the processes, NAD 5.25, Commitment Tracking, allowed commitments to not be entered into the corrective action program, provided a record was maintained as to why a corrective action process document was not initiated.

This created the potential for the root cause of commitments not being tracked in the corrective action program to recur.

The licensee also identified a number of recommended corrective actions to address the contributing cause identified by the licensee. These included:

• Validate and improve the documentation of the design basis for internal flooding, high energy line breaks, station blackout, tornados, and seismic events;

• Complete documentation of the design and licensing basis for the safety functions of the most risk significant safety systems: auxiliary feedwater, service water, residual heat removal, component cooling water, emergency diesel generators, 4KV switchgear, and direct current systems;

• Complete documentation and validation of the license basis for the safety functions of other safety significant systems;

• Develop or revise existing procedures or guidance documents to include administrative controls and requirements for updating and maintaining the design basis document topical and system documents;

• Conduct training for engineering personnel on current design and licensing bases;

• Provide required initial and continuing training for engineering in accessing and using Portal and design basis document topical and system documents;

• Determine the additional population beyond the engineering support personnel population for the training being conducted; and

• Improve retrievability and control of calculations of record.

The inspectors noted that two of the recommended corrective actions for the AFW issue were considered corrective actions to prevent recurrence for the flooding issue.

While the above corrective actions appeared reasonable, the inspectors were unable to assess whether they would prevent recurrence of this issue. This was primarily due to the inspectors determination that the stated root causes lacked sufficient depth.

Because the root cause determination lacked depth, the corrective actions to preclude repetition could not be validated.

Based on the above, this area was determined to be unsatisfactory. Further NRC inspection is necessary to evaluate this area once the root cause or causes are determined.

b. Determine Whether the Licensee Prioritized the Corrective Actions with Consideration of the Risk Significance and Regulatory Compliance The corrective actions appeared to be prioritized with consideration of the risk significance and regulatory compliance in that those corrective actions necessary to reduce risk and restore compliance were implemented immediately.

The corrective actions to prevent recurrence were all categorized as Priority 2 commitments and all have been completed; several before the issue was identified.

In regard to the recommended corrective actions, the inspectors deemed that the licensee had appropriately prioritized the corrective actions. This area was considered satisfactory c. Determine Whether the Licensee Established a Schedule for Implementing and Completing the Corrective Actions The licensee established a schedule for implementing the recommended corrective actions. As stated above, this schedule appeared to be appropriately based on the risk significance of the issues.

All identified corrective actions to prevent recurrence have been completed. This area was considered satisfactory.

d. Determine Whether the Licensee Developed Quantitative or Qualitative Measures of Success for Determining Effectiveness of Corrective Actions to Prevent Recurrence The licensee developed qualitative measures for determining the effectiveness of the corrective actions to prevent recurrence. However, none of the effectiveness reviews have been completed, even though several of the corrective actions were implemented prior to the issue being identified.

Furthermore, the inspectors determined that the qualitative measures were not adequate to ensure that the corrective actions taken were effective. Specifically, the licensee had three documented requirements for the corrective actions to be effective.

• No repeat INPO findings in engineering or configuration management.

The inspectors were unable to determine the justification for relying on outside sources as a measure to determine if the corrective actions were effective.

• The 2007 engineering effectiveness assessment does not find issues with current products related to inadequate level of rigor.

The inspectors deemed this measure to be too broad to accurately evaluate the effectiveness of the corrective actions to prevent recurrence. Specifically, the measure does not specify the scope of review to be performed, the type of engineering documents to be reviewed, or what constitutes an inadequate level of rigor.

• Implementation of quality grading scale/criteria for engineering products indicates that engineering level of quality and rigor has improved.

The inspectors determined that this measure actually required implementation of a corrective action not otherwise identified: develop, and implementation of a quality grading scale or criteria to judge engineering products. As there was no effectiveness measure for the development and implementation of the quality grading scale or criteria, the inspectors were unable to determine how this could be used to determine the effectiveness of engineering quality and rigor.

Based on the above, this area was determined to be unsatisfactory. The inspectors determined that further NRC inspection was needed to determine the effectiveness of the corrective actions to prevent recurrence.

04 EVALUATION OF INSPECTION REQUIREMENTS Common Cause Evaluation for Degraded Cornerstone For the purposes of identifying possible common issues, causes, and corrective actions, the licensee performed common cause evaluation, RCE K - 2005 - 0701. The licensee reviewed root cause evaluations 668, containment hatch closure interference, 677, auxiliary feedwater pumps susceptible to damage from air entrainment, and 685, flooding mitigation/control systems for this purpose. Collective significance analysis was the method the licensee used to determine common elements within the root and common causes.

04.01 Problem Identification a.

Determination Whether the Licensees Root Cause Evaluation Specified Who Identified the Issue and under What Conditions This objective was not applicable to the common cause evaluation. The evaluation of who, and under what condition each assessed issue was identified, was discussed in the individual root cause evaluation reports and is addressed in the above report sections. This area was considered satisfactory.

b.

Determination Whether the Licensees Root Cause Evaluation Documented How Long the Issue Existed, and Whether There Were Any Prior Opportunities for Identification.

This objective was not applicable to the common cause evaluation. The evaluation of how long the issues existed, and any prior opportunities for identification, was discussed in the individual root cause evaluation reports and is addressed in the above report sections. This area was considered satisfactory.

c.

Determination Whether the Licensees Root Cause Evaluation Documented the Plant-specific Risk Consequences and Compliance Concerns Associated with the Issue.

In Section 2.3 of the evaluation, the licensee evaluated the collective risk consequences for the flooding and AFW events along with a previously reviewed barrier integrity finding. The licensee concluded that the combined risk for the three events would not exceed the risk significance of the individual Yellow flooding issue.

The common cause evaluation did not discuss any compliance concerns associated with collective evaluation of the issues. During the first on-site inspection week, the inspectors questioned the absence of this information for all three root cause evaluations. The inspectors noted that both the flooding and AFW findings involved NRC-identified violations of Title 10 of the Code of Federal Regulations (10 CFR),

Part 50, Appendix B, Criterion III, Design Control. Therefore, the inspectors deemed it reasonable for the licensee to collectively evaluate the issues to determine if there were particular compliance aspects which applied to both. The objective of this effort was not to identify new regulatory violations, but to obtain a better understanding of the compliance issues. During review of the individual root cause reports, the inspectors identified a possible root or contributory cause for both the flooding and AFW issues:

site-wide acceptance of minimal regulatory compliance. The inspectors viewed the licensees failure to collectively assess the compliance aspects of the flooding and AFW events as a continued example of this cause.

Based on the above, this area was determined to be unsatisfactory. However, because the licensee performed a collective significance review as part of the flooding root cause evaluation, the inspectors determined that no additional inspection of this area was necessary to support NRC decisionmaking regarding the finding.

04.02 Root Cause and Extent of Condition Evaluation a.

Determination Whether the Licensees Root Cause Evaluation Applied Systematic Methods in Evaluating the Issue in Order to Identify Root Causes and Contributing Causes The licensee used a Collective Significance Analysis to determine the common causes identified in the individual root cause evaluations. However, the inspectors noted that the licensees root cause guidance document identified a collective significance analysis as one designed to identify a trend from lower-level issues/events to preclude the occurrence of a higher-level event. The collective cause evaluation did not address why this method was acceptable for use when the initiating issues were high level and the reason for doing the evaluation was to determine common themes across the events.

During discussions, the licensee stated that the collective significance analysis was believed to be the most appropriate method within the root cause guidance document because it enabled the evaluators to look at behaviors common to each issue, regardless of the significance of the issue. The licensee also acknowledged that this was the first time that the licensee had to perform a common cause evaluation for multiple-greater-than-Green regulatory issues.

Overall, the inspectors determined that the collective significance analysis was a reasonable method to collectively assess the common causes apparent in the individual root cause evaluations. This area was considered satisfactory.

b.

Determination Whether the Licensees Root Cause Evaluation Was Conducted to a Level of Detail Commensurate with the Significance of the Problem The licensee identified the following common causes:

• Engineering processes were less than adequate in defining the necessary attributes and checks for completing a quality product;

• Engineers knowledge of design basis and licensing basis information was less than adequate;

• Design and licensing basis information quality was low and availability was limited;

• Implementation of the operating experience program was less than adequate; and

• The site had low standards for recognizing and resolving deficiencies that were not regulatory driven.

The licensee did not make any distinction between whether these were root or contributing causes in the individual root cause evaluations and whether they should be considered root or contributing common causes.

The inspectors determined that the problem statement for the common cause evaluation was to review the greater-than-Green NRC inspection findings that led to the licensee entering the degraded cornerstone. However, the report cumulatively reviewed the root and contributing causes and the causal factors for three findings: the White containment hatch issue (Inspection Report 05000305/2004009 dated February 14, 2005), the White AFW issue, and the Yellow turbine building flooding.

The inspectors noted that the containment hatch issue affected the Barrier Integrity cornerstone, rather than the degraded Mitigating Systems cornerstone and was not required to be reviewed. However, the inspectors determined that, had the containment hatch issue not been included, it would have been difficult for the licensee to reach the same common causes because of the inadequate root cause evaluations for the AFW and flooding issues. For example, without inclusion of the containment hatch issue, the only commonality between the flooding and AFW events was the theme of engineering knowledge, and each of the individual root causes specified the engineering knowledge causes in such a way that it was difficult to assess whether there were any common features.

Furthermore, in Revision 0 of the common cause evaluation, the licensee did not effectively make a tie between the results of the common cultural and behavioral causal factors and the last common cause, the site had low standards for recognizing and resolving deficiencies that were not regulatory driven. Following inspector questioning during the first onsite inspection week, the licensee revised the common cause evaluation to more effectively describe and document the thought process of the common cause evaluation. This revision addressed many of the inspectors concerns in this area.

The common cause evaluation appeared to effectively probe the behavioral and cultural issues discussed in the individual in-scope root cause evaluations. The common cause evaluation was shown to be a relatively detailed method to summarize the behaviors within each individual in-scope root cause evaluation, and the associated common causes were then logically drawn from this information. Overall, this area was considered satisfactory.

c. Determination Whether the Licensees Root Cause Evaluation Included Consideration of Prior Occurrences of the Problem and Knowledge of Prior Operating Experience The operating experience section in the common cause evaluation report was essentially a summary of operating experience from the individual in-scope root cause evaluations. The common cause evaluation acknowledged that numerous opportunities existed for the station to take actions in response to internal and external operating experience for each root cause evaluation within scope. The common cause evaluation described an operating experience gap analysis that determined inadequate use of operating experience at Kewaunee had existed for a number of years. In the common cause evaluation, after determining that operating experience existed associated with each individual root cause evaluation, the licensee determined that implementation of operating experience at the plant was less than adequate. However, the inspectors noted that this was primarily based on the flooding and hatch contributing causes; although there was narrative within the AFW root cause evaluation, that evaluation did not identify implementation of operating experience as an issue. Overall, following the revision, this area was considered satisfactory.

d.

Determination Whether the Licensees Root Cause Evaluation Addressed Extent of Condition and Extent of Cause of the Problem The extent of condition section in the common cause evaluation report essentially summarized the extent of condition results from the individual in-scope root cause evaluations.

For the extent of cause evaluation, the licensee used the identified common root causes as search criteria to determine if any historical root cause evaluations had the same or similar causes within the engineering department and other departments. The extent of cause evaluation provides a synopsis of each identified root cause evaluation that had causes that were the same or similar to the common causes, but did not provide a direct tie to how they specifically related to the common causes. The report only had an anecdotal narrative of how each common root cause was being addressed. The report acknowledged that actions were in place to address each common root cause, but not how the extent of cause results might indicate that the common causes may not have been appropriately addressed. This area was considered satisfactory.

04.03 Corrective Actions a.

Determine Whether the Licensee Specified Appropriate Corrective Actions for Each Common or Root Cause or That the Licensee Evaluated Why No Actions Were Necessary During the first onsite inspection week, the inspectors reviewed corrective actions associated with the common causes identified in Revision 0 of the common cause evaluation. The evaluation identified a new common cause based on common behaviors and causal factors from the three root cause evaluations reviewed by the licensee. In Revision 0 of the common cause report, the licensee credited the individual root cause evaluations for the necessary corrective actions to prevent recurrence and concluded that no additional actions to prevent recurrence were necessary. The report further listed recovery actions from the Kewaunee Improvement Initiatives that were either completed or in-progress to address the new common cause. One new corrective action (CA) 023098 was generated, which requested modification to a procedure; however, the changes were not clear and the inspectors were unable to verify whether the changes would address the intent of the corrective action.

The inspectors questioned whether an evaluation was performed to determine if the final common cause was actually a common root cause to the collective significant conditions adverse to quality. The licensee held a Corrective Action Review Board (CARB)meeting on May 10, 2006, during the inspectors offsite week to review this issue. The CARB determined that the common cause evaluation should be revised to upgrade the final common cause to a common root cause, requiring corrective actions to prevent recurrence per 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action and Dominion Nuclear Administrative Procedure DNAP-1604, Cause Evaluation Program.

The inspectors questioned whether the licensee prepared a CAP to document the initial mis-classification of the final common root cause and the initial lack of corrective actions to prevent recurrence. During the second onsite week, the inspectors again questioned the licensee about the lack of a CAP. Following this further questioning, the licensee wrote CAP 033870 which stated that revisions to the root cause evaluations were made. The CAP addressed the fact that several recommendations from a pre-95002 inspection performed by the licensee were rejected by Dominion corporate Organizational Effectiveness personnel and Kewaunees CARB. According to the CAP, the rejection by these groups resulted in narrowly focused root cause reports. However, the CAP did not specifically address the failure to identify that the final common cause was actually a common root cause requiring corrective actions to prevent recurrence; nor did the CAP acknowledge that NRC intervention was required to ensure the CAP was written.

In Revision 1 of the common cause evaluation, the licensee significantly revised the overall conclusion of the common cause evaluation to focus discussion of the licensees actions to address the cultural components of the common causes. The licensee added 3 Failure Modes Correlation and Action Chart to summarize the common behaviors which generated the final common root cause; to list the applicable safety culture components, and to document the associated corrective actions and corrective actions to prevent recurrence. The inspectors noted that this Attachment included over 60 items, with 10 corrective actions to prevent recurrence scattered amongst the remaining recommended corrective actions. The inspectors were unable to review all of these newly added corrective actions in detail and were unable to assess whether the corrective actions and corrective actions to prevent recurrence were appropriate to address the cause. In some cases, the corrective actions were newly generated and there was no additional information for the inspectors to review.

Based on the above, this area was determined to be unsatisfactory. Additional NRC inspection is deemed necessary to assess the acceptability of the additional corrective actions added midway through the inspection.

b. Determine Whether the Licensee Prioritized the Corrective Actions with Consideration of the Risk Significance and Regulatory Compliance Because several of the corrective actions and corrective actions to prevent recurrence for the final common root cause were newly generated during the inspection, the due dates ranged from previously completed items to items not due until the end of 2007.

The licensee stated that the due dates for the corrective actions and corrective actions to prevent recurrence were selected based on schedule, priority, and other factors.

The inspectors were unable to determine whether the corrective actions were prioritized appropriately; however, the inspectors agreed that some of the corrective actions and corrective actions to prevent recurrence would take time to complete based on their wide scope of actions. Nevertheless, this area was considered satisfactory and no further inspection is necessary.

c.

Determine Whether the Licensee Established a Schedule for Implementing and Completing the Corrective Actions The licensee did establish a schedule for implementation and completion of corrective actions. As discussed above, the inspectors were unable to evaluate whether the schedule was appropriate. However, the inspectors were satisfied with the progress and further inspection is not necessary.

d.

Determine Whether the Licensee Developed Quantitative or Qualitative Measures of Success for Determining Effectiveness of Corrective Actions to Prevent Recurrence The inspectors ascertained that six of ten corrective actions to prevent recurrence for the last common root cause did not yet have effectiveness review plans in place or scheduled. The inspectors attributed this lack to the corrective actions midway through the inspection. The licensee acknowledged that effectiveness reviews were required for corrective actions to prevent recurrence and stated that they would be created and completed within 6-12 months of the corrective actions to prevent recurrence generation. Because the effectiveness reviews were not yet created, the inspectors could not review whether the measures of success would be appropriately quantitative or qualitative in scope.

Based on the above, this area was determined to be unsatisfactory. The inspectors determined that further NRC inspection was needed to determine the effectiveness of the corrective actions to prevent recurrence.

05.

INDEPENDENT EVALUATION OF LICENSEE ROOT CAUSE AND EXTENT OF CAUSE Independent Root Cause Evaluation 05.01. Inspection Scope The inspectors performed an independent, limited-scope review of the root causes for the degraded cornerstone. This independent review relied upon results of the licensees root cause evaluations, review of NRC inspection reports, interviews with personnel and review of licensee records. The inspectors used the Management Oversight and Risk Tree (MORT) process as it provided a systematic methodology for the inspectors to independently review the licensees evaluations. The NRCs evaluation looked at the independent root cause evaluations for the Yellow flooding significant condition adverse to quality and the White AFW significant condition adverse to quality and at the combined common cause evaluation.

The NRC previously determined, in Inspection Report 05000305/2005018, that the failure to protect safety-related systems, structures and components from the consequences of an internal flood was a performance deficiency which had substantial importance to safety (Yellow). A performance deficiency with substantial importance to safety is a significant condition adverse to quality.

Similarly, in Inspection Report 05000305/2005014, the NRC determined that the failure to protect the AFW pumps, equipment important to safety, from air entrainment or runout during various design basis events was a performance deficiency which had low to moderate importance to safety (White). A performance deficiency with low to moderate importance to safety is also a significant condition adverse to quality.

In accordance with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, licensees are required to establish measures which shall assure, for significant conditions adverse to quality, that the cause of the condition is identified and that corrective action is taken to preclude repetition. Criterion XVI also requires, in part, that licensees document and report to appropriate levels of management the identification of significant conditions adverse to quality, the cause of the condition and the corrective actions taken.

05.02. Findings Introduction The inspectors identified a Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, having very low safety significance (Green) for the failure to assure that the causes for two separate significant conditions adverse to quality were identified and for failure to assure that corrective actions to preclude repetition were taken for a common root cause of the significant conditions adverse to quality.

Description a.

Failure to Identify the Cause for a Significant Condition Adverse to Quality Related to Flooding During the 95002 inspection, as described in Section 02.02.b above, the inspectors evaluated the adequacy of the licensees root cause determinations for the flooding performance deficiency.

The licensee concluded that the root cause for this performance deficiency was a low level of design basis knowledge in engineering. The inspectors assessed whether the flooding performance deficiency would still have occurred if the engineers had a higher level of design basis knowledge. During interviews, the inspectors learned that there was resistance from multiple levels when flooding issues were raised, not only due to a perception that flooding was outside the design basis but also due to a belief that NRC had accepted that flooding was outside the design basis (i.e., that internal flooding was also not part of the licensing basis). In addition, the perceived risk significance played a role in downplaying or dismissing flooding issues. The licensee, in Attachment 5 of the root cause evaluation, Event Narrative and Failure Scenario, stated that the first thing that affected most responses to Kewaunee flooding issues was the belief that the licensing basis had adequately addressed flooding such that further analysis was unnecessary. It appeared that even when inaccuracies surfaced or events happened, the licensee did not question whether the licensing basis remained accurate or was affected but rather used the licensing basis as a rationale to not take action on flooding issues.

Therefore, the inspectors concluded that even with a higher level of design basis knowledge related to flooding, the licensee would likely still have not identified the flooding issues due to the sites limiting understanding of the licensing basis. Under the MORT process, the inspectors noted that this could likely be traced to an issue with Concepts and Requirements in that the licensees processes to define the goals and tolerable risks associated with flooding were less than adequate. The inspectors concluded that this area was less than adequate because the licensee was willing to accept the flawed flooding PRA and the inadequate design and licensing basis information without questioning it, even when new material arose which challenged whether the goals and risks were accurate.

As discussed in Section 02.02.b, the licensee did not probe why the engineering organization had a low level of knowledge. The inspectors determined that factors such as lack of engineering accountability, lack of training and qualification, and schedule and budget constraints were not evaluated by the licensee, and that these factors may have contributed to the lack of engineering design basis knowledge.

The inspectors concluded that the NRC independent evaluation arrived at a cause for the significant condition adverse to quality which substantially differed from the licensees root cause. The NRC noted that the cause reached by the NRC independent evaluation appeared to more appropriately explain the reason for the performance deficiency. The independent evaluation cause also appeared to encompass the licensees root cause.

The inspectors noted that the licensees failure to identify the cause of the significant condition adverse to quality also resulted in the corrective actions to preclude repetition not being appropriate.

The licensees failure to determine the cause of the flooding performance deficiency, a significant condition adverse to quality, is considered an example of a violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions.

b. Failure to Identify the Cause for a Significant Condition Adverse to Quality Related to AFW Pump Protection During the 95002 inspection, as described in Section 03.02.b above, the inspectors evaluated the adequacy of the licensees root cause determinations for the AFW pump protection performance deficiency.

The inspectors noted that the licensee limited the root cause evaluation for the AFW pump protection performance deficiency to an issue of why the pressure switches installed on the discharge side of the AFW pumps were not sufficient to protect the pumps from credible failure modes and why the installation of the switches were untimely from 1982 to 1993. The inspectors determined that the licensees focus on the adequacy and timeliness of the 1993 modification prevented it from identifying other aspects that contributed to the significant condition adverse to quality. Specifically, the licensee did not identify and address the broader performance deficiency identified by the NRC in Inspection Report 05000305/2005014: failure to protect the AFW pumps, equipment important to safety, from credible natural events, and other design, and licensing basis scenarios. Because the licensee failed to identify and address the performance deficiency, it failed to determine the cause and the corrective actions to prevent repetition.

The licensee concluded that there were three root causes for this performance deficiency: a) an inadequate past modification process; b) an engineering lack of knowledge and understanding of what constituted proper engineering rigor for analysis, review, and documentation when resolving issues related to design basis for the AFW pumps; and c) a failure to track commitments in the corrective action process. The inspectors assessed whether the AFW performance deficiency would still have occurred if all of these root causes did not exist. As described in Section 03.02.a, using the 1997 escalated enforcement issue relating to the pressure switch as a data point, the inspectors determined that the performance deficiency was not limited to the 1983-1993 time frame, as the NRC determined that the 1997 engineering efforts lacked rigor in maintaining the design basis performance of safety-related pumps. Additionally, during interviews, the inspectors determined that the licensee desired to separate the AFW issue from the overall plant improvement issues.

The inspectors concluded that the 1994 modification and corrective action processes played only a limited role in the cause of the AFW pump performance deficiency. The inspectors reached the conclusion that the level of engineering rigor was most likely a cause for the performance deficiency. The inspectors noted that the licensees wording of the root cause was not just that engineering rigor was lacking but that the engineers lacked knowledge and understanding of what constituted proper engineering rigor.

As discussed in Section 03.02.b, the licensee did not probe why the engineering organization lacked knowledge and understanding of what constituted proper engineering rigor. The inspectors determined that factors such as low management expectations, lack of engineering accountability, lack of training and qualification, and schedule and budget constraints were not evaluated by the licensee, and these factors may have contributed to the lack of engineering rigor. Of these factors, the NRC ascertained that the one most likely to drive a lack of engineering rigor was management acceptance of products which lacked engineering rigor. Under the MORT process, the inspectors determined that the Implementation of the site policies was lacking heading was appropriate. Under this heading, the inspectors noted that the following areas applied:

(1) management rigor and example being less than adequate;

(2) accountability being less than adequate; and

(3) staff responsibility being less than adequate.

The inspectors concluded that the NRC independent evaluation arrived at a cause for the significant condition adverse to quality which substantially differed from the licensees root cause. The inspectors noted that the cause reached by the NRC independent evaluation appeared to more appropriately explain the reason for the entire performance deficiency rather than the small portion assessed by the licensee. The independent evaluation cause also appeared to encompass the licensees root cause.

The licensees failure to determine the cause of the AFW performance deficiency, a significant condition adverse to quality, is considered an example of a violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions.

c. Failure to Identify Corrective Actions to Preclude Repetition for a Cause Common to Two Significant Conditions Adverse to Quality During the 95002 inspection, as described in Section 04.02.b above, the inspectors evaluated the adequacy of the licensees common cause evaluation. The inspectors noted that the licensee had listed as a common cause that the site had low standards for recognizing and resolving deficiencies that were not regulatory driven. The licensee stated that this common cause was not identified in any of the individual root cause evaluations and was created to address common behavioral and cultural causal factors identified from the common significance evaluation performed for the degraded cornerstone. In the common cause evaluation, the licensee stated that no corrective actions to prevent recurrence were necessary for the newly-identified common cause.

Following inspector questioning, the licensee determined that this common cause was actually a common root cause. The licensee further determined that ten additional corrective actions to prevent recurrence were necessary. The ten corrective actions addressed site behavioral and cultural issues. After further questioning, the licensee prepared CAP 033870, which addressed the need for revision of all three root cause evaluation reports as a result of inspector questioning of the evaluations. Furthermore, the CAP stated that the site did not comprehensively identify causes and corrective actions from all related causal factors identified in the root cause data analysis.

The inspectors noted that the common cause identified as a result of the collective significance evaluation addressed aspects of the causes for the individual root cause evaluations discussed in Sections 02.02b and 03.02b.

The licensees failure to identify corrective actions to preclude repetition for a cause common to the flooding issue and the AFW pump protection issue, both of which were significant conditions adverse to quality, is considered an example of a violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions.

Analysis The inspectors determined that the failure to identify the root causes for the individual significant conditions adverse to quality and the failure to identify corrective actions to prevent recurrence for the common root cause were examples of a performance deficiency, because the licensees cause evaluation handbook and 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions require that, for significant conditions adverse the quality, the causes are to be determined and corrective actions to preclude repetition are to be taken.

The inspectors further determined that the issues were within the licensees ability to foresee and correct, and it could have been prevented because the licensee specifically was performing root cause evaluations to arrive at the causes and the corrective actions to prevent recurrence. The inspectors noted that the licensee had also performed a self-assessment prior to the inspection which identified these issues, and the licensee then did not implement actions to correct the deficiency.

The inspectors determined that the finding did not have actual safety consequences, that the finding did not impact the NRCs ability to perform its regulatory function, and there were no willful aspects to the violation.

The inspectors determined the performance deficiency was more than minor because the failure to identify the cause and corrective actions to preclude repetition of significant conditions adverse to quality which led to a degraded cornerstone could result in the NRC needing to take more significant action.

The inspectors determined that the issue affected the Initiating Events cornerstone because it increased the likelihood that additional significant conditions adverse to quality would occur. However, the inspectors determined that the finding could not be evaluated using the significance determination process because the issue involved the failure of a licensee process. The finding has been reviewed by NRC management, and has been determined to be a finding of very low safety significance because no additional instances of significant conditions adverse to quality have actually occurred.

The inspectors determined that the failure to identify the causes for the two individual root cause evaluations and the failure to identify corrective actions to preclude repetition for the collective significance common cause affected the cross-cutting issue of problem identification and resolution. Specifically, the inspectors determined that the performance deficiency demonstrated attributes related to evaluation of the significant conditions adverse to quality.

Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures be established to assure that, for significant conditions adverse to quality, the cause of the condition is determined, and corrective action is taken to preclude repetition. Licensee procedure GNP-11.08.01, Action Request Process, dated April 6, 2006 defines the process to ensure potentially adverse to quality conditions are promptly identified, evaluated and corrected. A significant condition adverse to quality is defined in the Corrective Action Program as a Level A issue and includes any NRC identified higher than Green finding.

Contrary to this requirement, as of May 10, 2006, the licensees established measures did not assure that:

• the cause for the Yellow flooding issue, a significant condition adverse to quality, was identified;

• the cause for the White AFW pump protection issue, a significant condition adverse to quality, was identified; and

• corrective actions to preclude repetition for a common root cause identified for both the above significant conditions adverse to quality were taken.

Because this violation was of very low safety significance, because it was entered into the licensees corrective action program as CAP 33870, this violation is being treated as a Non-Cited Violation, consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2006007-01).

06.

INDEPENDENT EVALUATION OF LICENSEE ROOT CAUSE AND EXTENT OF CAUSE Independent Extent of Condition Evaluation 06.01. Inspection Scope The inspectors performed an independent extent of condition evaluation for the Yellow flooding performance deficiency and the White AFW pump protection performance deficiency. For the Yellow flooding issue, the inspectors determined that inspection report 05000305/2005011 described actions taken by the licensee to identify the extent of the flooding issue. For the White AFW pump protection issue, the inspectors determined that inspection report 05000305/2005010 described actions taken by the licensee to identify the extent of issues related to AFW pump protection.

The inspectors reviewed operating experience reports, NRC generic communications and licensee corrective action documents to assess other areas where flooding could occur or where safety-related pumps might not be adequately protected against air entrainment or pump runout. For selected issues, the inspectors reviewed licensee corrective action documents, calculations and modifications. The inspectors also interviewed licensee employees.

06.02. Findings Flushing of the A AFW Pump Suction Line from the Service Water System Introduction The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, having very low safety significance (Green) for the failure to incorporate appropriate acceptance criteria for assessing operability of the AFW pump following identification of a piping obstruction.

Description On August 16, 2002, during radiography of the service water piping to the suction of the A AFW pump, the licensee identified significant silting in the pipe. This was entered into the corrective action program as CAPs 12616 and 12617. Operations subsequently declared the pumps inoperable and the lines were flushed. To flush the line, the licensee routed the flushing hose to a 1000 gallon tank. Using a stopwatch, the licensee determined that the flow rate during the flushing operation was 328 gpm but did not consider either service water header pressure or line pressure downstream of all obstructions. Radiography after the flush determined that the line was clear. Because the observed flow rate was greater than the nominal pump design flow rate of 260 gpm, the licensee determined that the obstruction would not have prevented the pump from fulfilling its intended safety function.

On November 10, 2003, the licensee again found significant silting in the pipe and documented the issue as CAP18869. A similar flushing operation was performed with similar results leading to a final determination that the pump remained operable.

The inspectors questioned the basis of the operability determinations and noted that the licensee had no formal calculations to determine the effects that silting, (i.e., flow obstruction), would have on available pump net positive suction head (NPSH). The inspectors noted that the licensees program for performing flushing operations would only verify that the lines were not completely obstructed and would not verify that sufficient flow was available at the required pressure to ensure that the respective pump did not cavitate. For the two examples cited, the licensee did not consider the service water header pressure at the time of the flush as it related to assumed post-accident pressures and there was no attempt to determine actual pressure drop past all obstructions to ensure it did not exceed an acceptable value.

Once this programmatic weakness in the licensees service water inspection program was identified, the licensee entered this issue into their corrective action program as CAP034012 on May 19, 2006. The licensee performed a calculation that concluded that past operability was justified. Initial recommendations in the CAP are to revise the guidance for evaluation of pipe blockage found in procedure FP-PE-SW-01, Service Water and Fire Protection Inspection Program.

Analysis The inspectors determined that the failure to have adequate procedures to control flushing operations used to justify operability of safety-related equipment with obstructed pipes within the service water inspection program was a performance deficiency. The finding was associated with the Mitigating Systems cornerstone attribute of procedure quality which affected the cornerstone objective because the relevant procedure was not adequate to ensure the availability, reliability, and capability of the AFW system to respond to initiating events.

The inspectors further determined that the issues were within the licensees ability to foresee and correct and it could have been prevented because the licensee performed procedure FP-PE-SW-01 numerous times in the past and failed to identify the issue until prompted by the inspectors.

The inspectors determined that the finding did not have actual safety consequences, that the finding did not impact the NRCs ability to perform its regulatory function and there were no willful aspects to the violation.

The inspectors determined the performance deficiency was more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B Issue Screening dated September 30, 2005, because the finding was associated with the Mitigating Systems cornerstone attribute of procedure quality which affected the cornerstone objective because the relevant procedure was not adequate to ensure the availability, reliability, and capability of the AFW system to respond to initiating events.

The finding screened as having very low safety significance (Green) using IMC 0609, Appendix A, because subsequent evaluation of the pipe occlusions, using appropriate acceptance criteria, supported past operability of the pump.

The inspectors determined that the primary cause of the finding was related to the cross-cutting aspect of problem identification and resolution (evaluation) because the licensee failed to perform a proper evaluation of the flow obstruction in the suction piping to ensure that the AFW pump remained operable.

Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures or drawings. Criterion V further requires that the instructions, procedures, or drawings contain quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished.

Contrary to the above, on August 16, 2002, and on November 10, 2003, the licensee failed to ensure that determinations to assess operability of the A AFW pump, an activity affecting quality, contained either quantitative or qualitative acceptance criteria for justifying past operability of the AFW pump. Specifically, the licensee failed to ensure that adequate NPSH would have been available to the pump during a design basis event.

Because this violation was of very low safety significance, because it was entered into the licensees corrective action program as CAP 034012, this violation is being treated as a Non-Cited Violation, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000305/2006007-02).

07.

INDEPENDENT EVALUATION OF LICENSEE ROOT CAUSE AND EXTENT OF CAUSE Independent Extent of Cause Evaluation 07.01. Inspection Scope The inspectors performed an independent extent of cause evaluation for the Yellow flooding performance deficiency and the White AFW pump protection performance deficiency. The inspectors ability to perform this evaluation was hampered by the licensees failure to adequately define the root cause of the events. Therefore, the inspectors broadly defined the cause for the Yellow finding as inadequate site knowledge of the design basis. Similarly, the inspectors broadly defined the cause for the White finding as inadequate site rigor in engineering processes.

The inspectors reviewed operating experience reports, NRC generic communications and licensee corrective action documents to assess other areas where flooding could occur or where safety-related pumps might not be adequately protected against air entrainment or pump runout. For selected issues, the inspectors reviewed licensee corrective action documents, calculations and modifications. The inspectors also interviewed licensee employees. In some cases, documents which were reviewed for the extent of condition evaluation were also reviewed for the extent of cause evaluation.

07.02 Findings a.

Independent Review Group Failed to Identify Error in Residual Heat Removal Net Positive Suction Head Calculation Introduction The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for the failure to ensure that design basis calculations correctly translated the containment sump volume at time of the switch over from the refueling water storage tank (RWST) to the containment sump to ensure adequate available NPSH and vortex suppression for the residual heat removal (RHR) pumps.

Description The inspectors reviewed the licensees assessment of a 2004 Palo Verde event regarding air entrainment in the residual heat removal (RHR) system piping when the RHR pumps were obtaining suction from the containment sump. The inspectors determined that the licensee had recognized that the Kewaunee design also started with the RHR piping being dry; however, unlike the Palo Verde design, the Kewaunee design had less than three cubic feet of piping between the two closed valves. The licensee was evaluating the effects of the dry piping and whether the manual switch over sequence would ensure that the piping properly filled prior to the RHR pump taking suction; however, no formal operability evaluation had been completed.

During review of this issue, the inspectors evaluated the inputs and assumptions to calculation 11023, Revision 1, July 2005, as well as Revision 0, Addendum A, June 2005. Assumption 3.3, which was revised in Revision 1, provided information regarding the containment sump level at the time of switch over. Further review by the inspector determined that the calculation referenced by Assumption 3.3 (C10984) was non-conservative, in that it failed to account for the approximately 3470-gallon volume of the RHR sump pit and the initially dry RHR piping. This was despite calculation 11023 being performed in order to assess whether there was adequate sump submergence upon switch over from the RWST to ensure adequate NPSH and to prevent air vortexing. The inspectors noted that both Revision 1, Revision 0, and Addendum A, were independently reviewed by the independent review group. The independent review group was put into place as a short term corrective action measure for the White AFW finding.

The licensee produced CAP 029113 from September 2005, as evidence that the licensee was already aware of non-conservatisms in calculation C10984. The inspectors noted that the non-conservatisms mentioned in the CAP were using an initial RWST level which was greater than the Technical Specification value and loss of water to sump as a result of the refueling cavity standpipe modification. The inspectors noted that these two non-conservatisms amounted to approximately 1750 gallons. This CAP used the results of calculation 11023 to justify that the listed non-conservatisms were acceptable.

During interviews, the inspectors also learned that there were inaccuracies in both the RWST and the containment sump level indicators. The inspectors independently calculated the reduction in containment sump level, given all the non-conservatisms noted above and assuming a two percent uncertainty for the combined the level indicators. The inspectors noted this assumption was extremely conservative as the licensee verbally indicated that the containment sump level indicator could be off by as much as a foot. The inspectors arrived at a value of approximately 39 inches for the containment sump level at the time of switch over from the RWST. The inspectors noted that, based on information in CAP 029113, this was less than the specified minimum submergence level for the new strainers to be installed to resolve Generic Safety Issue 191.

Analysis The inspectors determined that calculation 11023 containing a non-conservative error regarding the actual containment sump level was a performance deficiency because the licensee failed to meet the requirements of 10 CFR Part 50, Appendix B, Criterion III, Design Control.

The inspectors further determined that the issue was within the licensees ability to foresee and correct, and it could have been prevented because the calculation was revised following completion of corrective actions for the White and Yellow findings to improve the quality and rigor of engineering products. The inspectors noted that calculation 11023 was independently reviewed by the IRG, a review group put in place as a short-term corrective measure to the White AFW finding in order to improve the quality of engineering reviews.

The inspectors determined that the finding did not have actual safety consequences, that the finding did not impact the NRCs ability to perform its regulatory function, and there were no willful aspects to the violation.

The inspectors determined the performance deficiency was more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Screening dated September 30, 2005, because the finding was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective because the inadequate calculation was used as an input to other design documents including to-be-installed containment strainers.

The finding screened as having very low safety significance (Green) using IMC 0609, Appendix A, because the licensee normally kept the RWST at a level above the Technical Specification minimum, the new strainers were not yet installed, and inspector independent calculations which indicated that the pumps had adequate NPSH and vortex suppression, with the additional non-conservatisms incorporated.

The inspectors determined that the primary cause of the finding was related to the cross-cutting aspect of problem identification and resolution (corrective action), because the licensee failed to perform an adequate review of the calculations when they were revised due to errors found in the original calculation.

Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that applicable regulatory requirements and the design basis be correctly translated into specifications, drawings, procedures and instructions, for those systems, structures and components covered under Appendix B.

Contrary to the above, on June 11, 2005, and again on July 19, 2005, the design basis containment sump level available at the time of switch over from the RWST following a design basis accident was not correctly translated into licensee calculations. A minimum containment sump level is necessary to ensure operation of the RHR system, a system covered under Appendix B.

Because this violation was of very low safety significance, because it was entered into the licensees corrective action program as CAP 033997, this violation is being treated as a Non-Cited Violation, consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2006007-03).

b. Failure to Adequately Review Safety Injection Minimum Flow Requirements Introduction The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for the failure to properly evaluate the minimum flow requirements of the high head safety injection (SI) pumps.

Description During review of canceled design change DCR-2548, the inspectors noted that the basis for cancellation did not include sufficient information to technically justify the cancellation.

The SI pump vendor originally recommended a minimum flow of 47 gpm; however, they later revised that value to 70 gpm due to their re-analysis of the pumps as a result of NRC Bulletin 88-04. Because the SI pumps had a constant flow orifice that ensured an SI flow of at least 47 gpm, the licensee determined that increasing the minimum flow would require a revision to the accident analysis to account for 23 gpm less cooling water flow in the event of a design basis accident. Because the vendor's revised minimum flow requirement was based more on generic pump performance as opposed to a detailed review of the operation of the licensee's actual pumps, the licensee requested that the vendor re-evaluate their recommendation and determine if the minimum flow could remain unchanged at 47 gpm.

The inspectors reviewed the letters between the licensee and the pump vendor and determined that the licensee did not provide the vendor with all relevant information on how the pumps were operated. Specifically, there was no procedural guidance in the emergency operating procedures limiting minimum flow operation of the SI pumps to 30 minutes, although the vendor had been told that procedures limited minimum flow operation to 30 minutes. Moreover, inspectors ascertained that various accident scenarios could require the pump to operate at minimum flow for greater than 30 minutes and the licensee did not perform an evaluation of flow rates that would be established in all post-accident conditions. Because the pump vendor did not consider these aspects when agreeing that the minimum flow did not need to be increased, the inspectors concluded that the licensee did not adequately evaluate the minimum flow requirements of the SI pumps prior to canceling the modification.

The licensee entered this issue into their corrective action program as CAP 034000 and completed operability recommendation OPR-150 to justify current operability of the SI pumps with a minimum flow of 47 gpm. The inspectors determined that the licensees completion of OPR-150 lacked sufficient engineering rigor to justify operability in that it relied upon verbal interactions with the vendor, only looked at pump impeller cavitation, and accepted the results of a 1995 cause evaluation into the failure of the B SI pump thrust bearings without question, although one of the findings in the AFW root cause report was that pre-2003 engineering products lacked rigor.

The inspectors independently evaluated the effects of using a minimum flow rate of 47 gpm, based on new vendor information, review of the thrust bearing design, internal pump design, impeller arrangement, hydraulic thrust balancing method, and review of the pump head curve and concluded that there was reasonable assurance that pump operability would not be challenged without increasing the minimum flow to 70 gpm.

Analysis The inspectors determined that the failure to properly evaluate the SI pump minimum flow requirements was a performance deficiency because the licensee failed to meet the requirements of 10 CFR Part 50, Appendix B, Criterion III, Design Control.

Additionally, due to poor human performance, the licensee failed to adequately re-evaluate the basis for cancellation while responding to the inspectors questions during this inspection.

The inspectors further determined that the issue was within the licensees ability to foresee and correct, and it could have been prevented because the licensee specifically reviewed the SI system during its extent of cause evaluation for the AFW pump protection White finding.

The inspectors determined that the finding did not have actual safety consequences, that the finding did not impact the NRCs ability to perform its regulatory function and there were no willful aspects to the violation.

The inspectors determined the performance deficiency was more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B Issue Screening dated September 30, 2005, because the finding was associated with the Mitigating Systems cornerstone attribute of design control and affected the cornerstone objective as providing inadequate minimum flow to the SI pumps could result in the pumps failing under certain accident scenarios.

The finding screened as having very low safety significance (Green) using IMC 0609, Appendix A, because, upon further evaluation, both the licensee and the inspectors determined that the SI pumps remained operable with the 47 gpm minimum flow rate.

The inspectors determined that the primary cause of the finding was related to the cross-cutting aspect of problem identification and resolution (corrective action) because the licensee failed to perform an adequate review of the minimum flow rate prior to canceling DCR 2548.

Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures be established to provide for verifying or checking the adequacy of design, such as by the performance of design reviews.

Contrary to the above, on January 31, 1994, the licensee failed to consider all relevant SI pump design bases before canceling DCR 2548 and therefore failed to verify or check the adequacy of the design.

Because this violation was of very low safety significance, because it was entered into the licensees corrective action program as CAP 034000, this violation is being treated as a Non-Cited Violation, consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2006007-04.)

c. Inadequate Calculation to Support Technical Specification Information Regarding Allowable Numbers of Blocked Containment Spray Nozzles Introduction The inspectors identified a Non-Cited Violation of 10 CFR, Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for the failure to ensure that design basis calculations correctly translated the internal containment spray flow requirements into the Technical Specification allowed number of blocked internal containment spray (ICS) nozzles.

Description The inspectors reviewed calculation 1179.M9, Internal Containment Spray System Flow Calculation. The purpose of the calculation was to verify ICS pump design flow during various accident conditions and to determine the maximum number of spray nozzles that could be plugged while still ensuring that ICS flow to containment would exceed the design value of 1300 gallons per minute. The licensee used this calculation to support a Technical Specification amendment request to change the number of allowable blocked nozzles from zero to eight; license amendment 114 was granted on November 30, 1994, and included the request for allowance of blocked ICS nozzles.

The inspectors determined that the calculation contained several non-conservative assumptions. For example, although the licensees program allowed for a nominal ten percent head degradation before corrective action was required, the calculation assumed no head degradation. Also the calculation made an incorrect assumption regarding header branch flows and pressure drops which resulted in gross overestimation of the ICS flow rate The inspectors performed an informal calculation and determined, with zero clogged nozzles, and maximum allowable pump degradation, the minimum ICS flow would have been below the 1300 gallons per minute design value.

The licensee produced Westinghouse Electric Company calculation CN-SEE-02-22, Kewaunee 7.4 percent Power Uprate Minimum Injection and Recirc Flows for Containment Analysis, completed on October 14, 2002, which concluded that 1170 gpm would be sufficient to ensure containment integrity. Using both this calculation and 1179.M9, the licensee concluded that, at 1170 gpm, there was a twenty-five percent head margin which would more than cover ten percent pump head degradation; however, the inspectors noted that the licensees response did not adequately reconcile differences between the two calculations. For example, calculation CN-SEE-02-22 stated the results were conservative up to 15.5 minutes post-accident whereas calculation 1179.M9 determined that the worst-case head conditions would occur 35 minutes post-accident.

The licensee performed a prompt operability determination and concluded that, with eight blocked nozzles and ten percent pump degradation, approximately 1180 gpm would be delivered. While the inspectors deemed this value to be rather optimistic, the inspectors noted that pump degradation at the time of the inspection was approximately seven percent and the licensee had no knowledge of any blocked nozzles. Therefore, the inspectors determined that the licensee had reasonable assurance of current operability.

Analysis The inspectors determined that the Technical Specifications having a value for the allowable number of blocked ICS nozzles which was not supported by the design basis was a performance deficiency because the licensee failed to meet the requirements of 10 CFR, Part 50, Appendix B, Criterion III, Design Control.

The inspectors further determined that the issues were within the licensees ability to foresee and correct and it could have been prevented because the licensee specifically reviewed the ICS system hydraulic calculations related to system flow requirements, pump net positive suction head, and pump runout during its extent of cause evaluation for the AFW pump protection White finding.

The inspectors determined that the finding did not have actual safety consequences and there were no willful aspects to the violation. The inspectors noted the pump flow value was documented in a Technical Specification Amendment request and subsequent Amendment 114; however, the incorrect information resulted from an inadequate calculation. The inspectors concluded traditional enforcement was not appropriate.

The inspectors determined the performance deficiency was more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B Issue Screening dated September 30, 2005, because the inaccurate calculation would have allowed the containment spray system to be inoperable with the allowable pump degradation and allowable number of blocked containment nozzles.

The inspectors determined that the issue affected the Barrier Integrity cornerstone. The finding screened as having very low safety significance (Green) using IMC 0609, Appendix H, because the ICS system had been shown to be operable.

The inspectors determined that the primary cause of the finding was related to the cross-cutting aspect of problem identification and resolution (evaluation) because the licensee failed to perform an adequate extent of cause evaluation for as part of the root cause evaluation for the White AFW pump finding.

Enforcement Title 10 of the CFR, Part 50, Appendix B, Criterion III, Design Control, requires, in part, that applicable regulatory requirements and the design basis be correctly translated into specifications, drawings, procedures and instructions, for those systems, structures and components covered under Appendix B.

Contrary to the above, from November 30, 1994, and continuing at least until May 24, 2006, the design basis for the ICS system, a system covered under Appendix B, was not correctly translated into the Technical Specifications.

Because this violation was of very low safety significance, because it was entered into the licensees corrective action program as CAP 033998, this violation is being treated as a Non-Cited Violation, consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2006007-05).

The inspectors determined that the primary cause of the finding was related to the cross-cutting aspect of problem identification and resolution (evaluation) because the licensee failed to perform an adequate extent of cause evaluation for as part of the root cause evaluation for the White AFW pump finding.

OTHER ACTIVITIES

Review of Previously Identified Items 08.01 (Open) VIO 05000305/2004009-03: Potential Flooding in the Turbine Building Basement. The causes and corrective actions for this violation are reviewed in Section 02 of this report. As concluded there, the licensee had not conducted the root cause evaluation to a level of detail commensurate with the significance of the problem.

Furthermore, the inspectors determined that not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. Finally, the inspectors concluded that the licensee had not established either qualitative or quantitative measures for determining the effectiveness of the corrective actions to prevent recurrence. Therefore, this violation will remain open pending further inspection.

08.02 (Open) VIO 05000305/2005002-05: Potential Common Mode Failure of Auxiliary Feedwater Pumps. The causes and corrective actions for this violation are reviewed in Section 03 of this report. As concluded there, the licensee had not conducted the root cause evaluation to a level of detail commensurate with the significance of the problem.

Furthermore, the inspectors determined that not all corrective actions were sufficiently developed to ensure that the identified performance deficiencies were adequately addressed. Finally, the inspectors concluded that the licensee had not established either qualitative or quantitative measures for determining the effectiveness of the corrective actions to prevent recurrence. Therefore, this violation will remain open pending further inspection.

Exit Meeting The inspectors presented the inspection results to Mr. D. Christian and other members of licensee management on May 24, 2006. The licensee acknowledged the findings presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

W. Matthews, Senior Vice-President - Nuclear Operations

L. Hartz, Site Vice-President

K. Hoops, Site Operations Director

L. Armstrong, Site Engineering Director

T. Breene, Regulatory Affairs Manager

W. Hunt, Maintenance Manager

Nuclear Regulatory Commission

G. Grant, Deputy Regional Administrator

J. Lara, Chief, Engineering Branch 3

S. Burton, Senior Resident Inspector

P. Higgins, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000305/2006007-01 NCV Criterion XVI: Failed to Identify Causes and Corrective Actions to Preclude Repetition for Significant Conditions Adverse to Quality (Section 05.02)

05000305/2006007-02 NCV Criterion V: Failed to Incorporate Appropriate Acceptance Criteria for Assessing Operability of the AFW Pump (Section 06.02)

05000305/2006007-03 NCV Criterion III: Failed to Correctly Translate Containment Sump Volume into Design (Section 07.02.a)

05000305/2006007-04 NCV Criterion III: Failed to Verify or Check the Adequacy of the Design Canceling Design Change Request 2548 (Section 07.02.b)

05000305/2006007-05 NCV Criterion III: Failed to Properly Translate the ICS Design Basis into the Technical Specifications (Section 07.02.c)

Attachment