IR 05000324/2009004

IR 05000325-09-004, 05000324-09-004; 7/01/2009 - 9/30/2009; Brunswick Steam Electric Plant, Units 1 & 2; Maintenance Risk Assessments and Emergent Work Control; Plant Modifications; Surveillance Testing; and Event Follow-up

ML093030653
Person / Time
Site:	Brunswick
Issue date:	10/30/2009
From:	Randy Musser NRC/RGN-II/DRP/RPB4
To:	Waldrep B Carolina Power & Light Co
References
IR-09-004
Download: ML093030653 (40)

Text

October 30, 2009

SUBJECT:

BRUNSWICK STEAM ELECTRIC PLANT - NRC INTEGRATED INSPECTION REPORT NOS.: 05000325/2009004 AND 05000324/2009004

Dear Mr. Waldrep:

On September 30, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Brunswick Unit 1 and 2 facilities. The enclosed integrated inspection report documents the inspection findings, which were discussed on October 14, 2009, with Mr. Ben Waldrep and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, three NRC-identified and three self-revealed findings of very low safety significance (Green) were identified. These findings were determined to involve violations of NRC requirements. Additionally, a licensee-identified violation which was determined to be of very low safety significance is listed in this report. However, because of the very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCV) consistent with Section VI.A.1 of the NRCs Enforcement Policy. If you contest any NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001, with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Brunswick Steam Electric Plant. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at the Brunswick Steam Electric Plant. The information you provide will be considered in accordance with the Inspection Manual Chapter 0305.

CP&L

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Randall A. Musser, Chief Reactor Projects Branch 4 Division of Reactor Projects

Docket Nos.: 50-325, 50-324 License Nos.: DPR-71, DPR-62

Enclosure:

Inspection Report 05000325, 324/2009004 w/Attachment: Supplemental Information

REGION II==

Docket Nos.:

50-325, 50-324

License Nos.:

DPR-71, DPR-62

Report Nos.:

05000325/2009004, 05000324/2009004

Licensee:

Carolina Power and Light (CP&L)

Facility:

Brunswick Steam Electric Plant, Units 1 & 2

Location:

8470 River Road, SE Southport, NC 28461

Dates:

July 1, 2009 through September 30, 2009

Inspectors:

P. OBryan, Senior Resident Inspector G. Kolcum, Resident Inspector J. Reece, Senior Resident Inspector, North Anna C. Welch, Senior Resident Inspector, Surry R. Clagg, Resident Inspector, North Anna J. Polickoski, Resident Inspector, Summer P. Capehart, Operations Engineer S. Rose, Senior Reactor Inspector (Section 4OA5)

Approved by:

R. Musser, Chief Reactor Projects Branch 4 Division of Reactor Projects

Enclosure

SUMMARY OF FINDINGS

IR 05000325/2009004, 05000324/2009004; 7/01/2009 - 9/30/2009; Brunswick Steam Electric

Plant, Units 1 & 2; Maintenance Risk Assessments and Emergent Work Control; Plant Modifications; Surveillance Testing; and Event Follow-up.

This report covers a three-month period of inspection by resident inspectors, an operator licensing inspector and a regional inspector. Three NRC-identified and three self-revealed findings of very low safety significance (Green) were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). The cross cutting aspects were determined using IMC 0305, Operating Reactor Assessment Program. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.

Cornerstone: Initiating Events

Green.

A self-revealing Green non-cited violation of Technical Specification (TS)5.4.1, Procedures, was identified when the licensee failed to follow procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors. During the performance of the calibration, procedural steps were not performed correctly and the E2 electrical bus was inadvertently deenergized, requiring the emergency diesel generator #2 to auto-start and reenergize the bus. Emergency diesel generator #2 auto-started and the E2 bus transferred from off-site power. After the event, the licensee halted the maintenance on the E2 bus instruments and restored off-site power to the E2 bus. The event was entered into the licensees corrective action program as NCR #344300.

The finding was determined to be more than minor because the finding was associated with the Initiating Events Cornerstone attribute of configuration control and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during power operations.

The finding affected configuration control because correct test switch alignment was not maintained. The finding also affected the cornerstone objective because loss of the E2 bus represented an upset to plant stability. The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609,

Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Initiating Events Cornerstone. The finding was determined to be of very low safety significance (Green) because the finding was a transient initiator that did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. The finding has a cross-cutting aspect in the Human Performance cross cutting area, Work Practices component, because the licensee failed to implement adequate error prevention techniques while performing plant procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors. Specifically, technicians did not utilize adequate error prevention techniques to prevent them from operating the wrong test switch when calibrating instrument 1-E2-AG6-VTR (H.4(a)) (Section 4AO3)

Cornerstone: Mitigating Systems

Green.

The inspectors identified a Green non-cited violation of 10 CFR Part 50.65 (a)(4), when the licensee removed the severe accident mitigation guideline (SAMG)diesel generators from service without considering the change in the online plant risk. Online plant risk is modeled and communicated to licensee plant personnel via the equipment out of service (EOOS) profile. The change in online risk was not reflected in the EOOS profile when the SAMG diesel generators were out of service from July 6, 2009 to July 8, 2009. Once the deficiency was identified on July 8, 2009, the EOOS profile was updated by the licensee and reflected the SAMG diesel out of service condition. This finding was entered into the licensees corrective action program as NCR #351002.

The finding was determined to be more than minor because the finding related to maintenance risk assessment and risk management issues. Specifically, the licensees risk assessment failed to consider risk significant structures, systems, or components that were unavailable during maintenance. The inspectors evaluated the finding in accordance with IMC 0609, Significance Determination Process,

Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings,

Table 3a for the Mitigating Systems Cornerstone. The finding was determined to degrade the licensees assessment and management of risk associated with performing maintenance activities under all plant operation or shutdown conditions.

In accordance with Baseline Inspection Procedure (IP) 71111.13, Maintenance Risk Assessment and Emergent Work Control, and IMC 0609, Appendix K,

"Maintenance Risk Assessment and Risk Management Significance Determination Process," the finding was determined to be a maintenance risk assessment issue.

Flowchart 1, "Assessment of Risk Deficit," requires the inspectors to determine the risk deficit associated with this issue. The finding was determined to be of very low safety significance because the incremental core damage probability deficit was less than 1 x 10E-6. The regional senior reactor analyst reviewed the information and confirmed that the system was a maintenance rule safety significant system. This finding has a cross-cutting aspect in the area of human performance, work control component, because the licensee did not plan and coordinate work activities consistent with nuclear safety. Specifically, the licensee failed to include risk significant maintenance in the EOOS profile when the SAMG diesel generators were out of service from July 6, 2009 until July 8, 2009 (H.3(a)) (Section 1R13).

Green.

A self-revealing Green non-cited violation of TS 5.4.1, Procedures, was identified for an inadequate annunciator response procedure to respond to a high level in the high pressure coolant injection (HPCI) vacuum tank when the barometric condensate pump is not operating. As a result, on January 27, 2009, the Unit 2 HPCI vacuum tank was not drained prior to the HPCI turbine exhaust drain pot filling to the point that operators could not ensure that water was not in the HPCI turbine casing. Without this assurance, the Unit 2 HPCI system was rendered inoperable because starting the HPCI pump with water in the casing could result in damage to the turbine. To correct this condition, operators later identified another valve, valve E-41-F5003, that was used to successfully lower water level in the HPCI exhaust line to below the HPCI exhaust line drain pot. Water level was above the exhaust line drain pot high level alarm, and therefore potentially in the HPCI turbine casing, for approximately two hours. Maintenance personnel later corrected the malfunction for the barometric condensate pump and restored the system to normal. This finding was entered into the licensees corrective action program as NCR #316695.

The finding was determined to be more than minor because it is associated with procedure quality attribute of the Mitigating Systems Cornerstone. It also adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the incorrect HPCI annunciator response procedure led to an unplanned period of unavailability of the Unit 2 HPCI pump. Using NRC Inspection Manual Chapter 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, the inspectors determined that the finding required a phase two evaluation because the finding represents a loss of system safety function. Using the significance determination phase two pre-solved worksheet, loss of HPCI function for less than three days, the increase in core damage frequency was determined to be less than 1E-6. Therefore, the finding is of very low safety significance (Green). The finding affects the cross-cutting area of human performance, resources component, complete and accurate documentation aspect because the licensee did not incorporate adequate guidance for draining the HPCI vacuum tank when the HPCI pump is in standby and the barometric condensate pump is unavailable in plant procedures (H.2(c)) (Section 4OA3).

Green.

The inspectors identified a Green non-cited violation of 10 CFR Part 50,

Appendix B, Criterion III, Design Control, for the failure to specify an appropriate quality standard for the installation of the control units on the emergency diesel generator jacket water heat exchanger inlet and outlet expansion joints. As a result, threaded fasteners on emergency diesel generators #1 and #4 loosened, creating a potential vulnerability to expansion joint failure. The licensee tightened the control unit bolts on all the emergency diesel generator service water expansion joints and initiated an engineering change to prevent the fasteners from loosening. This finding was entered into the licensees corrective action program as NCR #346113.

The finding was determined to be more than minor because the finding, if left uncorrected, would have the potential to lead to a more significant safety concern.

Specifically, over time, the hex nuts on the expansion joint control units could loosen to the point of expansion joint failure, leading to a loss of service water to the emergency diesel generators and failure of the emergency diesel generators. The inspectors evaluated the finding in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Mitigating Systems Cornerstone. The finding was determined to be of very low safety significance (Green) because the finding was a design or qualification deficiency confirmed not to result in loss of operability or functionality. This finding has no cross-cutting aspect because the design deficiency occurred in 2005 and is not indicative of current licensee performance. (Section 1R18)

Green.

A self-revealing Green non-cited violation of TS 5.4.1, Procedures, was identified when the licensee failed to follow work order instructions contained in work order 1280322. This work order directed technicians to perform testing on the B loop of the Unit 1 residual heat removal (RHR) system according to procedure 1MST-RHR28R, RHR Time Delay Relay Channel Calibration. Contrary to these work order instructions, portions of the procedure affecting Loop A were performed instead of Loop B. After the technicians completed the A loop section of the procedure, they reported to the control room where operators recognized the error.

Once the error was recognized, the maintenance was stopped and B loop of RHR was returned to operable. This finding was entered into the licensees corrective action program as NCR #344233.

The finding was determined to be more than minor because the finding was associated with the Mitigating Systems Cornerstone attribute of configuration control and affected the cornerstone objective of to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, as a result of this error on the Loop A RHR relay channels, for a short time, safety interlocks were bypassed on both the low pressure injection coolant (LPCI) outboard injection valve and the RHR heat exchanger bypass valve, and the position of the RHR pump minimum flow bypass valve was changed out of its normal position. The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Mitigating Systems Cornerstone. The finding was determined to be of very low safety significance (Green) because the finding was not a design or qualification deficiency which resulted in loss of operability or functionality, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train for greater than its TS allowed outage time, and did not represent potentially risk significant due to a seismic, flooding, or severe weather initiating event. The finding has a cross-cutting aspect in the Human Performance cross cutting area, Work Practices component, because the licensee failed to ensure surveillance instructions (work order 1280322) were implemented correctly. This resulted in performing a surveillance test on the A loop of the RHR system while the B loop of the RHR system was disabled (H.4(b)) (Section 1R22).

Green.

The inspectors identified a Green non-cited violation (NCV) of 10 CFR 50,

Appendix B, Criterion III, Design Control, for failure to translate a key analytical assumption related to operation of the emergency diesel building back draft and check dampers into specifications and ultimately into the installed hardware. This issue was entered into the licensees corrective action program as NCR 00259088 with actions to evaluate the ability of the EDGs actual installed equipment to satisfy the intended safety function during and following the design basis tornado event.

Compensatory measures were established to eliminate the concern pending the licensees determination of the systems capability to mitigate the effects of a tornado event.

This finding was determined to be more than minor because the finding was associated with the Mitigating Systems Cornerstone attribute of Design Control, i.e.

initial design. It impacted the cornerstone objective of ensuring the availability, reliability, and capability of the emergency diesel building ventilation to protect the EDG building structure during a design basis tornado event. Due to the deficiencies between the installed hardware and the assumptions in the calculation, the calculation did not ensure the capability of emergency diesel building ventilation system to perform the safety function. This was determined to be a failure to ensure the availability, reliability, and capability of a safety system that responds to an initiating event to prevent undesirable consequences. The licensee subsequently determined from analysis through modeling and testing that the emergency diesel building ventilation system could perform the safety function during a design basis tornado event with the existing hardware installed. The NRC reviewed this analysis and the results that determined that the existing condition did not result in the loss of the system safety function. The inspectors assessed the finding using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Mitigating Systems Cornerstone. The finding was determined to be of very low safety significance (Green) because there was not an actual loss of safety system function based upon the inspectors verification of the Progress Energy analysis of the emergency diesel building ventilation system. The cause of the finding is not related to a cross-cutting aspect because the occurrence was greater than three years ago and is not indicative of current licensee performance. (Section 4OA5)

Licensee-Identified Violations

A violation of very low safety significance that was identified by the licensee has been reviewed by inspectors. Corrective actions planned or taken by the licensee have been entered into the licensees corrective action program. This violation and its corrective action tracking number is listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

Unit 1 began the inspection period operating at rated thermal power. Power was reduced to 81 percent to change the 1A condensate deep-bed demineralizer resin on July 11, 2009, and then returned to rated thermal power on July 12, 2009. Power was reduced to 90 percent for a steam leak in the 1A feed pump room on August 28, 2009, and then returned to rated thermal power on August 31, 2009. The unit was shutdown on September 20, 2009 for an unplanned outage as required by TS due to a malfunction of emergency diesel generator #4 (EDG). Unit 1 was started on September 30, 2009, and power ascension was in progress at the end of this inspection period.

Unit 2 began the inspection period operating at rated thermal power. Power was reduced to 70 percent for scheduled valve testing and control rod improvement on July 31, 2009, and then returned to rated thermal power on August 1, 2009. Power was reduced to 88 percent on August 2, 2009, and then returned to rated thermal power on August 3, 2009. The unit was shutdown on September 21, 2009 for an unplanned outage as required by TS due to a malfunction of EDG #4. Unit 2 was started on September 30, 2009 and power ascension was in progress at the end of this inspection period.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

==1R01 Adverse Weather Protection

==

.1 Seasonal Readiness Preparations

a. Inspection Scope

The inspectors reviewed the licensees preparations of the EDGs for severe weather conditions prior to hurricane season.

During the inspection, the inspectors focused on plant specific design features and the licensees procedures used to mitigate or respond to adverse weather conditions.

Additionally, the inspectors reviewed the Updated Final Safety Analysis Report (UFSAR)and performance requirements for systems selected for inspection, and verified that operator actions were appropriate as specified by plant specific procedures. Specific documents reviewed during this inspection are listed in the Attachment. The inspectors also reviewed corrective action program items to verify that the licensee was identifying adverse weather issues at an appropriate threshold and entering them into their corrective action program in accordance with station corrective action procedures.

b. Findings

No findings of significance were identified.

==1R04 Equipment Alignment

Quarterly Partial System Walkdowns

a. Inspection Scope

==

The inspectors performed three partial system walkdowns of the following risk-significant systems:

• EDGs 1, 2, 3 and 4 automatic start line-up after an unexpected alarm was received during calibration of EDG #2 jacket water temperature switch on July 7, 2009.

• Unit 1 RHR loop A and B after maintenance was performed on the wrong loop of RHR on July 8, 2009.

• E1, E2, E3 and E4 switchgear after a maintenance error during instrument calibrations on the E2 bus on July 8, 2009.

The inspectors selected these systems based on their risk significance relative to the reactor safety cornerstones at the time they were inspected. The inspectors attempted to identify any discrepancies that could impact the function of the system, and, therefore, potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, UFSAR, TS requirements, outstanding work orders, condition reports, and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable of performing their intended functions. The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable. The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies. The inspectors also verified that the licensee had properly identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the corrective action program with the appropriate significance characterization. Documents reviewed are listed in the attachment.

b. Findings

No findings of significance were identified.

==1R05 Fire Protection - Quarterly Resident Inspector Tours

a. Inspection Scope

==

The inspectors conducted six fire protection walkdowns which were focused on availability, accessibility, and the condition of firefighting equipment in the following risk-significant plant areas:

• E5 Switchgear Room 23' Elevation 1PFP-DG-6

• E6 Switchgear Room 23 Elevation 1PFP-DG-7

• E7 Switchgear Room 23' Elevation 2PFP-DG-8

• E8 Switchgear Room 23' Elevation 2PFP-DG-9

• Unit 1 South RHR Room -17 Elevation 1PFP-RB1-1d

• Unit 1 HPCI Room -17 Elevation 1PFP-RB1-2

The inspectors reviewed areas to assess if the licensee had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant, effectively maintained fire detection and suppression capability, maintained passive fire protection features in good material condition, and had implemented adequate compensatory measures for out of service, degraded or inoperable fire protection equipment, systems, or features in accordance with the licensees fire plan.

The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plants Individual Plant Examination of External Events with later additional insights, their potential to impact equipment which could initiate or mitigate a plant transient, or their impact on the plants ability to respond to a security event. Using the documents listed in the attachment, the inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use; that fire detectors and sprinklers were unobstructed, that transient material loading was within the analyzed limits; and fire doors, dampers, and penetration seals appeared to be in satisfactory condition. The inspectors also verified that minor issues identified during the inspection were entered into the licensees corrective action program.

b. Findings

No findings of significance were identified.

.2 Annual Fire Protection Drill Observation

a. Inspection Scope

On August 25, 2009, the inspectors observed a fire brigade activation for a planned drill.

Based on this observation, the inspectors evaluated the readiness of the plant fire brigade to fight fires. The inspectors verified that the licensee staff identified deficiencies; openly discussed them in a self-critical manner at the drill debrief, and took appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient firefighting equipment brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other plant areas;

(7) smoke removal operations;

(8) utilization of pre planned strategies; (9)adherence to the pre planned drill scenario; and

(10) drill objectives.

b. Findings

No findings of significance were identified.

==1R11 Licensed Operator Requalification Program

a. Inspection Scope

==

On August 18, 2009, the inspectors observed a crew of licensed operators in the plants simulator during licensed operator requalification examinations to verify that operator performance was adequate, evaluators were identifying and documenting crew performance problems, and training was being conducted in accordance with licensee procedures. The inspectors evaluated the following areas:

• licensed operator performance;

• crews clarity and formality of communications;

• ability to take timely actions in the conservative direction;

• prioritization, interpretation, and verification of annunciator alarms;

• correct use and implementation of abnormal and emergency procedures;

• control board manipulations;

• oversight and direction from supervisors; and

• ability to identify and implement appropriate TS actions and Emergency Plan actions and notifications.

The crews performance in these areas was compared to pre-established operator action expectations and successful critical task completion requirements.

b. Findings

No findings of significance were identified.

==1R12 Maintenance Effectiveness

a. Inspection Scope

==

The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the two issues listed below. In addition, the inspectors verified maintenance effectiveness issues were entered into the corrective action program with the appropriate significance characterization. Documents reviewed are listed in the Attachment.

The inspectors evaluated degraded performance issues involving the following risk significant components:

• Elevated copper content in routine oil monitor sample for the 1C RHR service water booster pump on August 12, 2009

• Failure of the differential pressure test for the 1A conventional service water pump on August 13, 2009 The inspectors focused on the following attributes:

• Implementing appropriate work practices;

• Identifying and addressing common cause failures;

• Scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;

• Characterizing system reliability issues for performance;

• Charging unavailability for performance;

• Trending key parameters for condition monitoring

• Ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification;

• Verifying appropriate performance criteria for structures, systems; and components (SSCs)/functions classified as (a)(2) or appropriate and adequate goals and corrective actions for systems classified as (a)(1).

b. Findings

No findings of significance were identified.

==1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

==

The inspectors reviewed the licensee's evaluation and management of plant risk for the six maintenance and emergent work activities affecting risk-significant equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:

• Unit 1 RHR loop B maintenance in Yellow risk on July 7, 2009.

• SAMA/SAMG Diesel maintenance during the week of July 6, 2009.

• Unit 1 RHR loop A maintenance in Yellow risk during the week of August 3, 2009.

• 1C RHR service water booster pump planned maintenance with failure of 1A conventional service water pump on August 13, 2009.

• Unit 1 RHR loop B maintenance in Yellow risk during the week of August 17, 2009.

• Unit 1 Rx level control with main steam isolation valves (MSIVs) shut on September 21, 2009 These activities were selected based on their potential risk significance relative to the reactor safety cornerstones. As applicable for each activity, the inspectors verified that risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate and complete. When emergent work was performed, the inspectors verified that the plant risk was promptly reassessed and managed. The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical advisor, and verified plant conditions were consistent with the risk assessment. The inspectors also reviewed TS requirements and walked down portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met.

b. Findings

Failure To Include Risk Significant Maintenance In EOOS Profile

Introduction:

The inspectors identified a Green non-cited violation of 10 CFR Part 50.65 (a)(4), when the licensee removed the severe accident mitigation guideline (SAMG)diesel generators from service without considering the change in the online plant risk.

Online plant risk is modeled and communicated to licensee plant personnel via the equipment out of service (EOOS) profile. The change in online risk was not reflected in the EOOS profile when the SAMG diesel generators were out of service from July 6, 2009, to July 8, 2009.

Description:

SAMG diesel generators were installed to provide emergency power to the Unit 1 safety-related batteries during a sustained loss of emergency power and to mitigate the stations risk during a station blackout. Unit 2 battery back-up power is supplied by severe accident mitigation alternatives (SAMA) diesels. On July 6, 2009, the SAMG and the SAMA diesel generators were taken out of service for a plant modification. When completed, the modification would remove the SAMG diesels and provide for SAMA diesel generators to be used for back-up battery power in the both units. Although the work was planned under Work Order 1164503-31, it was not included in the station EOOS profile for either unit during the week that the maintenance occurred. The EOOS profile is used by the licensee to show the effect on plant risk of risk significant activities. The NRC inspectors questioned the licensee about the maintenance and the licensee took immediate corrective actions by adding the SAMG and the SAMA diesel generators to the EOOS profile on July 8, 2009 and entering the issue into their corrective action program (AR 351002351002. Station personnel were also provided additional guidance for accounting for the SAMA emergency diesel generators in the EOOS profile. When the maintenance was added to the EOOS profile, the risk condition remained Green for the out-of-service duration with the exception of a planned RHR maintenance window in Unit 1, which remained in the Yellow risk category.

Analysis:

The inspectors determined that failure to include the maintenance on the SAMG diesel generators in the EOOS profile from July 6, 2009, until July 8, 2009 was a performance deficiency. The finding was determined to be more than minor because the finding related to maintenance risk assessment and risk management issues.

Specifically, the licensees risk assessment failed to consider risk significant structures, systems, or components that were unavailable during maintenance. The inspectors evaluated the finding IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 3a for the Mitigating Systems Cornerstone. The finding was determined to degrade the licensees assessment and management of risk associated with performing maintenance activities under all plant operation or shutdown conditions. In accordance with Baseline Inspection Procedure (IP) 71111.13, Maintenance Risk Assessment and Emergent Work Control, and IMC 0609, Appendix K, "Maintenance Risk Assessment and Risk Management Significance Determination Process," the finding was determined to be a maintenance risk assessment issue. Flowchart 1, "Assessment of Risk Deficit," requires the inspectors to determine the risk deficit associated with this issue. This finding was determined to be of very low safety significance because the incremental core damage probability deficit was less than 1 x 10E-6 for this maintenance rule safety significant system. The regional senior reactor analyst reviewed the information and confirmed that the system was a maintenance rule safety significant system. This finding has a cross-cutting aspect in the area of human performance, work control component, because the licensee did not plan and coordinate work activities consistent with nuclear safety.

Specifically, the licensee failed to include risk significant maintenance in the EOOS profile when the SAMG diesel generator was out of service from July 6, 2009, until July 8, 2009 (H.3(a)).

Enforcement:

10 CFR Part 50.65 (a)(4) requires that, before performing maintenance activities (including but not limited to surveillance, post-maintenance testing, and corrective and preventative maintenance), the license shall assess and manage the increase in risk that may result from the proposed maintenance activity. Contrary to the above, from July 6, 2009, until July 8, 2009, the licensee failed to include risk significant maintenance in the EOOS profile when the SAMG diesel generators were out of service.

Because this violation is of very low safety significance and was entered into the licensees corrective action program as NCR #351002, this violation is being treated as an NCV, consistent with the NRC Enforcement Policy. The violation is therefore designated as NCV 05000324, 325/2009004-05, Failure to Include Risk Significant Maintenance in the Site Risk Profile.

==1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the following six issues:==

• Operability of EDG #2 after diesel out of service alarm received during calibration of EDG #2 jacket water temperature switch on July 7, 2009;

• Operability of off-site power after the loss of the E2 emergency bus on July 8, 2009 due to a maintenance error during instrument calibrations;

• Operability of the Unit 1 A loop of RHR while it was incorrectly tested during 1MST-RHR28R, RHR Time Delay Relays Channel Calibration on July 8, 2009;

• Operability of EDG service water expansion joints and tie rods on July 20, 2009;

• Left bank starting air solenoid valve (2-DG2-SV-6553-2) failure on EDG #2 on August 3, 2009 and

• Degraded service water building cable tray support system on August 13, 2009.

The inspectors selected these potential operability issues based on the risk significance of the associated components and systems. The inspectors evaluated the technical adequacy of the evaluations to ensure that TS operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the TS and UFSAR to the licensees evaluations, to determine whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Additionally, the inspectors also reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations. Documents reviewed are listed in the attachment.

b. Findings

No findings of significance were identified.

==1R18 Plant Modifications

a. Inspection Scope

==

The following modification was reviewed and selected aspects were discussed with engineering personnel:

• Replacement of the emergency diesel generators service water expansion joints (permanent modification EC 62707).

This document and related documentation were reviewed for adequacy of the associated 10 CFR 50.59 safety evaluation screening, consideration of design parameters, implementation of the modification, post-modification testing, and relevant procedures, design, and licensing documents were properly updated. The inspectors observed ongoing and completed work activities to verify that installation was consistent with the design control documents.

b. Findings

Failure to Establish Adequate Installation Instructions for Emergency Diesel Generator Service Water Expansion Joint Control Units

Introduction:

The inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to specify an appropriate quality standard for the installation of the control units on the emergency diesel generator jacket water heat exchanger inlet and outlet expansion joints. As a result, threaded fasteners on emergency diesel generators #1 and #4 loosened, creating potential vulnerability to expansion joint failure.

Description:

On July 20, 2009, NRC inspectors conducted a walkdown of the emergency diesel generators and observed that control rods were loose on the emergency diesel generator #1 jacket water heat exchanger inlet expansion joint and the emergency diesel generator #4 jacket water heat exchanger outlet expansion joint. All four emergency diesel generator jacket water coolers, and their service water expansion joints, were replaced in 2005.

The original equipment manufacturer (Garlock) Installation and Maintenance Manual, dated November 24, 2003, states on page 7 that, Once the control units are installed and set, it is critical that the setting is not altered during the service life of the joint.

Vibration of the piping system can often loosen and gradually turn the hex nuts, changing the critical setting of the control units. To prevent the turning of the hex nuts, the threads of the tie rods are staked on each side of the hex nut. The licensees installation procedure, 0CM-ENG521, Perfex Cooler Inspection and Repair, was updated on May 25, 2005 under Revision 7. Step 7.4.29 of the procedure does not require any means to prevent rotation of the hex nut on the control units after installed. The vibrations that occur during emergency diesel operation can lead to the hex nuts loosening and exceeding the expansion joint tolerance of one half inch. Once the expansion joint tolerance is exceeded, the expansion joint is susceptible to failure.

Expansion joint failure would cause a loss of service water to the jacket water cooler, loss of cooling to the engine, and engine overheating. Upon subsequent review, none of the expansion joints were found in a configuration where the joint tolerance limit of one half inch was exceeded. Inspectors determined that this procedural inadequacy is a design control error because when procedure 0CM-ENG521 was revised in May, 2005, the licensee did not incorporate readily available information from the vendor regarding the susceptibility of the hex nuts on the control units to loosen due to vibration.

Therefore, the installation procedure did not provide assurance that the hex nuts installed on the control units would stay in their original snug tight position. The licensee has inspected all of the hex nuts to ensure that none are loose and have initiated NCR

1. 346113.

Analysis:

The inspectors determined that the licenses failure to incorporate readily available vendor information into procedure 0CM-ENG521, Perfex Cooler Inspection and Repair was a performance deficiency. The finding was determined to be more than minor because, if left uncorrected, it would have the potential to lead to a more significant safety concern. Specifically, over time, the hex nuts on the expansion joint control units could loosen to the point of expansion joint failure, leading to a loss of service water to the emergency diesel generators and failure of the emergency diesel generators. The inspectors evaluated the finding in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Mitigating Systems Cornerstone. The finding was determined to be of very low safety significance (Green) because the finding was a design or qualification deficiency confirmed not to result in loss of operability or functionality. This finding has no cross-cutting aspect because the design deficiency occurred in 2005 and is not indicative of current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, since May 25, 2005, when a change was made to the expansion joint installation procedure, 0CM-ENG521, Perfex Cooler Inspection and Repair, the licensee failed to establish an adequate procedure for the installation of the control units on the emergency diesel generator jacket water heat exchanger inlet and outlet expansion joints. Specifically, the licensee failed to include instructions to prevent loosening of the control unit hex nuts. Because this violation was of very low safety significance and was entered into the licensees corrective action program as NCR #346113, this violation is being treated as an NCV, consistent with NRC Enforcement Policy. This violation is therefore designated as NCV 05000324,325/2009004-04, Failure to Establish Adequate Installation Instructions for Emergency Diesel Generator Service Water Expansion Joint Control Units.

==1R19 Post Maintenance Testing

a. Inspection Scope

==

The inspectors reviewed the following five post-maintenance (PM) activities to verify that procedures and test activities were adequate to ensure system operability and functional capability:

• 1OP-17, Residual Heat Removal System Operating Procedure on July 8, 2009 after the return to service of Unit 1 RHR loop B;

• 0PT-12.2A, No. 1 Diesel Generator Monthly Load Test, on June 4, 2009 after replacement of the EDG #1 jacket water cooler;

• 0PT-10.1.8, Reactor Core Isolation Cooling (RCIC) System Valve Operability Test on July 21, 2009 after replacement of the overload relay on the RCIC steam supply outboard isolation valve;

• 0PT-12.2B, No. 2 Diesel Generator Monthly Load Test, on August 4, 2009 after replacement of the left bank starting air solenoid valve (2-DG2-SV-6553-2);

• 0PT-08.1.4a, RHR Service Water System Operability Test - Loop A, on August 15, 2009 after replacement of the pump;

These activities were selected based upon the structure, system, or component's ability to impact risk. The inspectors evaluated these activities for the following: the effect of testing on the plant had been adequately addressed; testing was adequate for the maintenance performed; acceptance criteria were clear and demonstrated operational readiness; test instrumentation was appropriate; tests were performed as written in accordance with properly reviewed and approved procedures; equipment was returned to its operational status following testing, and test documentation was properly evaluated. The inspectors evaluated the activities against TS and the UFSAR to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements. In addition, the inspectors reviewed corrective action documents associated with post-maintenance tests to determine whether the licensee was identifying problems and entering them in the corrective action program and that the problems were being corrected commensurate with their importance to safety.

Documents reviewed are listed in the attachment.

b. Findings

No findings of significance were identified.

==1R20 Outage Activities

==

.1 Other Outage Activities

a. Inspection Scope

The inspectors evaluated outage activities for an unplanned outage that began on September 20, 2009 for Unit 1 and September 21, 2009 for Unit 2. Both outages continued through September 30, 2009, when both units were restarted. Units 1 and 2 were shutdown on for an unplanned outage as required by TS due to a malfunction of EDG #4. The inspectors reviewed activities to ensure that the licensee considered risk in developing, planning, and implementing the outage schedule.

During this inspection period, the inspectors monitored licensee controls over the outage activities listed below. Documents reviewed during the inspection are listed in the attachment.

• Licensee configuration management, including maintenance of defense-in-depth for key safety functions and compliance with the applicable TS when taking equipment out of service;

• Installation and configuration of reactor coolant pressure, level, and temperature instruments to provide accurate indications, accounting for instrument error;

• Controls over the status and configuration of electrical systems to ensure that TS and outage safety plan requirements were met, and controls over switchyard activities;

• Monitoring of decay heat removal processes, systems, and components;

• Reactor water inventory controls including flow paths, configurations, and alternative means for inventory addition, and controls to prevent inventory loss;

• Controls over activities that could affect reactivity;

• Maintenance of secondary containment as required by TS;

• Startup and power ascension, tracking of startup prerequisites, walkdown of the drywell (primary containment) to verify that debris had not been left which could block emergency core cooling system suction strainers; and

• Licensee identification and resolution of problems related to outage activities.

b. Findings

No findings of significance were identified.

==1R22 Surveillance Testing

==

.1 Routine Surveillance Testing

a. Inspection Scope

The inspectors either observed surveillance tests or reviewed the test results for the following four activities to verify the tests met TS surveillance requirements, UFSAR commitments, inservice testing requirements, and licensee procedural requirements.

The inspectors assessed the effectiveness of the tests in demonstrating that the SSCs were operationally capable of performing their intended safety functions.

• 1MST-RHR28R, RHR Time Delay Relays Channel Calibration on July 7, 2009;

• 0PT-15.6, Unit 2, Standby Gas Treatment System Operability on July 7, 2009;

• 0PM-ANN002B, DG-2 Annunciator Verification and Temperature Switch Calibration on July 15, 2009; and

• 0MST-HPCI22Q, Unit 1, (HPCI) Steam Line Low Press Instrument Channel Calibration on July 15, 2009.

b. Findings

Surveillance Test Performed On Wrong Loop of RHR

Introduction:

A self-revealing Green non-cited violation of TS 5.4.1, Procedures, was identified when the licensee failed to follow work order instructions contained in work order 1280322. This work order directed technicians to perform testing on the B loop of the Unit 1 residual heat removal (RHR) system according to procedure 1MST-RHR28R, RHR Time Delay Relay Channel Calibration. Contrary to these work order instructions, portions of the procedure affecting Loop A were performed instead of Loop B.

Description:

On July 8, 2009, work order 1280322 was planned for Unit 1 RHR Loop B in preparation for performing surveillance test procedure 1MST-RHR28R, RHR Time Delay Relay Channel Calibration. This procedure contains calibration instructions for both the A and the B loop RHR relay channels. The station work schedule directed that only the B loop portion of the procedure be performed, and licensee personnel confirmed in the pre-job brief that only the B loop relay channels were to be affected. Also in preparation for performing the relay channel calibrations, the B loop RHR pumps were placed under clearance. However, licensee maintenance personnel performed the sections of the surveillance procedure for relay channel calibrations on the Loop A relay channels, instead of Loop B relay channels. This error occurred because the technicians started at the beginning of the procedure, which was the A loop portion of the procedure, rather than forwarding to the B loop section of the procedure. After the technicians completed the A loop section of the procedure, they reported to the control room where operators recognized the error.

While the A loop relay channels were being calibrated, the following valves were affected:

• The A loop RHR pump minimum flow bypass valve opened from its normally shut position.

• The A loop RHR heat exchanger bypass valve stayed in its normally open position, but its closure inhibit interlock was bypassed.

• The A loop outboard low pressure coolant injection (LPCI) isolation valve stayed in its normally open position, but its closure inhibit interlock was bypassed.

Although the A loop RHR pump minimum flow bypass valve was out of its normal position and the closure inhibit interlocks were bypassed on the A loop RHR heat exchanger bypass valve and the A loop outboard low pressure coolant injection (LPCI)isolation valve, this would not have been a loss of safety function because the A loop of RHR in LPCI mode would have been available to respond to an auto initiation signal.

The licensee restored both loops of RHR to operable status, and entered this issue into their corrective action program as NCR #344233.

Analysis:

The inspectors determined that the licensees failure to follow WO 1280322 was a performance deficiency. The finding was determined to be more than minor because the finding was associated with the Mitigating Systems Cornerstone attribute of configuration control and affected the cornerstone objective of to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, as a result of this error on the Loop A RHR relay channels, for a short time, safety interlocks were bypassed on both the LPCI outboard injection valve and the RHR heat exchanger bypass valve, and the position of the RHR pump minimum flow bypass valve was changed from its normal position. The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Mitigating Systems Cornerstone. The finding was determined to be of very low safety significance (Green)because the finding was not a design or qualification deficiency which resulted in loss of operability or functionality, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train for greater than its TS allowed outage time, did not represent an actual loss of safety function of one or more non-TS trains of equipment designated as risk-significant per 10 CFR 50.65, for greater than 24 hrs, and did not represent potentially risk significant due to a seismic, flooding, or severe weather initiating event. The finding has a cross-cutting aspect in the Human Performance cross cutting area, Work Practices component, because licensee failed to ensure surveillance instructions (work order 1280322) were implemented correctly. This resulted in performing a surveillance test on the A loop of the RHR system while the B loop of the RHR system was disabled (H.4(b)).

Enforcement:

Technical Specification Section 5.4.1.a, Administrative Control (Procedures), states, in part, that written procedures shall be established, implemented, and maintained, covering applicable procedures recommended in Regulatory Guide 1.33, Appendix A, November 1972 (Safety Guide 33, November 1972). Safety Guide 33, section H.2. states, in part, that specific procedures for surveillance tests, inspections, and calibrations should be written. The licensee established WO 1280322 as the implementing procedure for the surveillance test, 1MST-RHR28R, RHR Time Delay Relay Channel Calibration. Contrary to the above, on July 8, 2009, the licensee failed to correctly implement work order instructions in work order 1280322, which required the performance of procedure 1MST-RHR28R for the Loop B relay channels only. Because this violation was of very low safety significance and it was entered into the licensees corrective action program as NCR #344233, this violation is being treated as an NCV, consistent with the NRC Enforcement Policy. This violation is therefore designated as NCV 05000325/2009004-03, Surveillance Test Performed on Incorrect Loop of RHR.

.2 Inservice Testing (IST) Surveillance

a. Inspection Scope

The inspectors reviewed the performance of 0PT-08.2.4, Unit 2, RHR Service Water System Component Test on August 5, 2009, to evaluate the effectiveness of the licensees American Society of Mechanical Engineers (ASME)Section XI testing program for determining equipment availability and reliability. The inspectors evaluated selected portions of the following areas: 1) testing procedures, 2) acceptance criteria, 3) testing methods, 4) compliance with the licensees IST program, TS, selected licensee commitments, and code requirements, 5) range and accuracy of test instruments, and 6) required corrective actions.

b. Findings

No findings of significance were identified.

4OA1 Performance Indicator (PI) Verification

a. Inspection Scope

To verify the accuracy of the PI data reported to the NRC, the inspectors compared the licensees basis in reporting each data element to the PI definitions and guidance contained in Nuclear Energy Institute (NEI) Document 99-02, Regulatory Assessment Indicator Guideline.

Mitigating Systems Cornerstone

• Mitigating Systems Performance Index, Residual Heat Removal System

The inspectors sampled licensee submittals for the Mitigating Systems Performance Index (MSPI) performance indicators listed above for the period from the third quarter of 2008 through the second quarter of 2009. The inspectors reviewed the licensees operator narrative logs, issue reports, MSPI derivation reports, event reports and NRC Integrated Inspection reports for the period to validate the accuracy of the submittals.

The inspectors reviewed the MSPI component risk coefficient to determine if it had changed by more than 25 percent in value since the previous inspection, and if so, that the change was in accordance with applicable NEI guidance. The inspectors also reviewed the licensees issue report database to determine if any problems had been identified with the PI data collected or transmitted for this indicator and none were identified. Specific documents reviewed are described in the Appendix to this report.

Barrier Integrity Cornerstone

• Reactor Coolant System (RCS) Specific Activity The inspectors reviewed licensee submittals for the Reactor Coolant System Specific Activity performance indicator for the period from third quarter of 2008 through the second quarter of 2009. The inspectors reviewed the licensees RCS chemistry samples, TS requirements, issue reports, and event reports for the period to validate the accuracy of the submittals. In addition to record reviews, the inspectors observed a chemistry technician obtain and analyze a reactor coolant system sample. Specific documents reviewed are described in the Appendix to this report.

• Reactor Coolant System Leakage

The inspectors sampled licensee submittals for the Reactor Coolant System Leakage performance indicator for the period from the third quarter of 2008 through the second quarter of 2009. The inspectors reviewed the licensees operator logs, RCS leakage tracking data, issue reports, and event reports for the period to validate the accuracy of the submittals. Specific documents reviewed are described in the Appendix to this report.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

Routine Review of Items Entered Into the Corrective Action Program

a. Scope

To aid in the identification of repetitive equipment failures or specific human performance issues for follow-up, the inspectors performed frequent screenings of items entered into the licensees corrective action program. The review was accomplished by reviewing daily action request reports.

b. Findings

No findings of significance were identified.

.2 Annual Sample:

Review of Operator Workarounds (OWAs)

a. Scope

The inspectors evaluated the licensees implementation of their process used to identify, document, track, and resolve operational challenges. Inspection activities included, but were not limited to, a review of the cumulative effects of the OWAs on system availability and the potential for improper operation of the system, for potential impacts on multiple systems, and on the ability of operators to respond to plant transients or accidents.

The inspectors performed a review of the cumulative effects of OWAs. The documents listed in the attachment were reviewed to accomplish the objectives of the inspection procedure. The inspectors reviewed both current and historical operational challenge records to determine whether the licensee was identifying operator challenges at an appropriate threshold, had entered them into their corrective action program and proposed or implemented appropriate and timely corrective actions which addressed each issue. Reviews were conducted to determine if any operator challenge could increase the possibility of an Initiating Event, if the challenge was contrary to training, required a change from long-standing operational practices, or created the potential for inappropriate compensatory actions. Daily plant and equipment status logs, degraded instrument logs, and operator aids or tools being used to compensate for material deficiencies were also assessed to identify any potential sources of unidentified operator workarounds.

b. Findings

No findings of significance were identified.

4OA3 Event Follow-up

.1 (Closed) Licensee Event Report (LER) 05000324/2009-001, High Pressure Coolant

Injection (HPCI) System Inoperable Due To Water In The HPCI Turbine Casing

a. Inspection Scope

The inspectors reviewed the licensees response to the events surrounding the HPCI system inoperability due to water in the HPCI turbine casing on January 27, 2009, when the barometric condenser condensate pump failed to run and required the use of an annunciator response procedure that had inadequate guidance. A finding of very low safety significance was identified for this event as NCV 05000324/2009004-01, Inadequate Annunciator Response Procedure for HPCI Vacuum Tank High Level. This LER is closed.

b. Findings

Inadequate Annunciator Response Procedure for HPCI Vacuum Tank High Level

Introduction:

A self-revealing Green non-cited violation of TS 5.4.1, Procedures, was identified for an inadequate annunciator response procedure to respond to a high level in the high pressure coolant injection (HPCI) vacuum tank when the barometric condensate pump is not operating. As a result, on January 27, 2009, the Unit 2 HPCI vacuum tank was not drained prior to the HPCI turbine exhaust drain pot filling to the point that operators could not ensure that water was not in the HPCI turbine casing. Without this assurance, the Unit 2 HPCI system was rendered inoperable because starting the HPCI pump with water in the casing could result in damage to the turbine.

Description:

The HPCI vacuum tank collects condensate from the HPCI turbine when the turbine is not in operation. Water is normally removed from the vacuum tank automatically by the barometric condensate pump, which pumps the water to the equipment drain system. If the barometric condensate pump does not start, annunciator response procedure APP-A-01, section 5-3, directs operators to open valves E41-V13 and E41-V14 to manually drain the vacuum tank. Valve E41-F058 is also in the drain path upstream E41-V13 and E41-V14. However, E41-F058 is a spring-loaded stop check valve that requires several pounds of fluid differential pressure to open. Because the water level in the vacuum tank is insufficient to open E41-F058, even if the vacuum tank is full, this drain path cannot drain the vacuum tank. The licensee discovered that this drain path did not adequately drain the vacuum tank previously when a failure of the barometric condensate pump occurred in 2003, but did not change the procedure.

On January 27, 2009, the barometric condensate pump failed to start when a Unit 2 HPCI high vacuum tank level alarm was received in the main control room. Using procedure APP-A-01, section 5-3, operators lined up a drain path through valves E41-F058, E41-V13 and E41-V14. Since this drain path is not effective in lowering vacuum tank level, water continued to accumulate in the HPCI turbine exhaust line until the HPCI turbine exhaust line drain pot high level alarm sounded in the main control room. Since water level in the HPCI exhaust line continued to accumulate and was above the drain pot high level alarm, operators could not be assured that water level had not reached the turbine casing and declared the HPCI system inoperable. To correct this condition, operators later identified valve E-41-F5003, that was used to successfully lower water level in the HPCI exhaust line to below the HPCI exhaust line drain pot. Water level was above the exhaust line drain pot high level alarm, and therefore potentially in the HPCI turbine casing, for approximately two hours. Maintenance personnel later corrected the malfunction for the barometric condensate pump and restored the system to normal.

Analysis:

The failure to implement an adequate HPCI vacuum tank high level annunciator response procedure is a performance deficiency. The finding was determined to be more than minor because it is associated with procedure quality attribute of the Mitigating Systems Cornerstone. It also adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the incorrect HPCI annunciator response procedure led to an unplanned period of the Unit 2 HPCI pump. Using NRC Inspection Manual Chapter 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, the inspectors determined that the finding required a phase two evaluation because the finding represents a loss of system safety function. Using the significance determination phase two pre-solved worksheet, loss of HPCI function for less than three days, the increase in core damage frequency was determined to be less than 1E-6. Therefore, the finding is of very low safety significance (Green). The finding affects the cross-cutting area of human performance, resources component, complete and accurate documentation aspect because the licensee did not incorporate adequate guidance for draining the HPCI vacuum tank when the HPCI pump is in standby and the barometric condensate pump is unavailable in plant procedures (H.2(c)).

Enforcement:

TS 5.4.1, Procedures, requires that written procedures shall be implemented covering applicable procedures recommended in Regulatory Guide 1.33, Appendix A, November 1972 (Safety Guide 33, November 1972). Regulatory Guide 1.33, section E (Safety Guide 33, November 1972) requires written procedures for correcting abnormal, offnormal, or alarm conditions. Contrary to the above, on January 27, 2009 annunciator response procedure APP-A-01, section 5-3 did not contain adequate guidance for lowering the Unit 2 HPCI vacuum tank water level when the barometric condensate pump was not available. Because the finding is of very low safety significance and has been entered into the CAP (NCR #316695), this violation is being treated as a non-cited violation, consistent with the NRC Enforcement Policy. This violation is therefore designated as NCV 05000324/2009004-01, Inadequate Annunciator Response Procedure for HPCI Vacuum Tank High Level.

.2 (Closed) Licensee Event Report (LER) 05000324/2009-001 Valid System Actuations Due

To Loss Of Power To Emergency Bus E2

a. Inspection Scope

The inspectors reviewed the licensees response to the events surrounding the loss of power to Emergency Bus E2 on July 8, 2009 when performing a calibration of instruments associated with the E2 bus. A finding of very low safety significance was identified for this event as NCV 05000325,324/2009004-02, Failure To Follow Plant Procedure Caused Loss Of E2 Bus. This LER is closed.

b. Findings

Failure To Follow Plant Procedure Caused Loss Of E2 Bus

Introduction:

A self-revealing Green non-cited violation of TS 5.4.1, Procedures, was identified when the licensee failed to follow procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors. During the performance of the calibration, procedural steps were not performed correctly and the E2 electrical bus was inadvertently deenergized, requiring the emergency diesel generator #2 to auto-start and reenergize the bus.

Description:

On July 8, 2009, work was planned for calibration of instruments on the E2 bus per procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors. During the calibration, a bus lockout occurred when the incorrect test switch was manipulated, resulting in temporarily deenergizing the bus, auto-starting emergency diesel generator #2, and transferring the E2 bus to emergency diesel generator #2 from off-site power.

The maintenance procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors provides for calibration of voltage and current instruments on the E2 bus. The instruments are calibrated by first isolating the instrument with a test switch, then connecting a test device to the instrument for calibration input. When technicians prepared to calibrate the E2 bus undervoltage instrument 1-E2-AG6-VTR, they opened the wrong test switch. Since instrument 1-E2-AG6-VTR was not isolated, when the test voltage was applied to the instrument, it caused the instrument to actuate and lockout the E2 bus. Emergency diesel generator #2 auto-started and the E2 bus transferred from off-site power. After the event, the licensee halted the maintenance on the E2 bus instruments and restored off-site power to the E2 bus.

Analysis:

The inspectors determined that the failure to follow the procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors, was a performance deficiency. The finding was determined to be more than minor because the finding was associated with the Initiating Events Cornerstone attribute of configuration control and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during power operations. The finding affected configuration control because correct test switch alignment was not maintained. The finding also affected the cornerstone objective because loss of the E2 bus represented an upset to plant stability. The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the Initiating Events Cornerstone. The finding was determined to be of very low safety significance (Green) because the finding was a transient initiator that did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. The finding has a cross-cutting aspect in the Human Performance cross cutting area, Work Practices component, because the licensee failed to implement adequate error prevention techniques while performing plant procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors. Specifically, technicians did not utilize adequate error prevention techniques to prevent them from operating the wrong test switch when calibrating instrument 1-E2-AG6-VTR (H.4(a)).

Enforcement:

Technical Specification Section 5.4.1.a, Administrative Control (Procedures), states, in part, that written procedures shall be established, implemented, and maintained, covering applicable procedures recommended in Regulatory Guide 1.33, Appendix A, November 1972 (Safety Guide 33, November 1972). Section H.2 of Regulatory Guide 1.33, Appendix A, November 1972, (Safety Guide 33, November 1972) states, in part, that specific procedures for surveillance tests, inspections, and calibrations should be written for those calibrations required by technical specifications.

The licensee established procedure 0PIC-CNV023, Calibration of Westinghouse &

Scientific Columbus Teleductors, as the implementing procedure for the calibration.

Contrary to the above, on July 8, 2009, the licensee failed to follow procedure 0PIC-CNV023, Calibration of Westinghouse & Scientific Columbus Teleductors, when calibrating bus E2 instrument 1-E2-AG6-VTR, which lead to a bus lockout, an emergency diesel generator #2 auto-start, and an E2 bus transfer from off-site power. All operations were verified to occur by design and Emergency Diesel #2 provided the power to the E2 bus. Because this violation was of very low safety significance and it was entered into the licensees corrective action program as NCR #344300, this violation is being treated as an NCV, consistent with the NRC Enforcement Policy. This violation is therefore designated as NCV 05000325, 324/2009004-02, Failure to Follow Plant Procedure Caused Loss of E2 Bus.

.3 (Closed) Licensee Event Report (LER) 05000324/2007002 and 05000324/2007002

Supplement 1: Mode Change Made with Reactor Core Isolation Cooling (RCIC) System Inoperable.

On April 16, 2007 with unit 2 in mode 2 after a refueling outage, steam dome pressure exceeded 150# and TS 3.5.3, RCIC System, became applicable. On April 18, 2007, during operability testing at 1000# steam pressure, the RCIC pump tripped due to low suction pressure. The low suction pressure trip was caused by a pressure transient in the RCIC piping. The pressure transient was caused by an air void left in the injection piping due to inadequately filling and venting the system after the refueling outage, and due to improperly sloped suction piping. The licensee conducted troubleshooting for several days after the trip. On April 27, 2007, a hydraulic dampener was installed in the suction pressure instrument line in order to eliminate the susceptibility of the trip instrumentation to the pressure oscillations, the RCIC pump was run successfully, and RCIC was declared operable. TS 3.0.4 prohibits entry into a plant condition where TS equipment is required to be operable, unless that equipment is operable (with certain exceptions). Since the RCIC system was not operable when steam dome pressure exceeded 150#, the RCIC pump failure is a violation of TS 3.0.4. This technical specification violation is more than minor because it affects the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent core damage, and is associated with the cornerstone attribute of equipment performance. The enforcement aspects of this finding are discussed in Section 4OA7 of this report. This LER is closed.

4OA5 Other Activities

.1 Quarterly Resident Inspector Observations of Security Personnel and Activities

a. Inspection Scope

During the inspection period the inspectors conducted observations of security force personnel and activities to ensure that the activities were consistent with licensee security procedures and regulatory requirements relating to nuclear plant security.

These observations took place during both normal and off-normal plant working hours.

These quarterly resident inspector observations of security force personnel and activities did not constitute any additional inspection samples. Rather, they were considered an integral part of the inspectors' normal plant status reviews and inspection activities.

b. Findings

No findings of significance were identified.

.2 (Closed) URI 05000324, 325/2007006-001:

Capability of Emergency Diesel Generators to Meet Design and Licensing Requirements

Introduction.

The inspectors identified a finding of very low safety significance (Green)involving a violation of 10 CFR 50, Appendix B, Criterion III, Design Control. The licensees failure to verify a key analytical assumption related to operation of the emergency diesel building back draft and check dampers prior to translating it into specifications and ultimately into the installed hardware is a performance deficiency.

Due to the deficiencies between the installed hardware and the assumptions in the calculation, the calculation did not ensure the capability of emergency diesel building ventilation system to perform the safety function of protecting the structure during a design bases tornado event.

Description.

During the component design bases inspection (CDBI) conducted November 5 to December 14, 2007, an unresolved issue (URI) was identified related to the failure to translate a key analytical assumption (assumption 7 below) related to operation of the back draft and check dampers into specifications and ultimately into the installed hardware. This item was unresolved pending NRC review of the of the licensees analysis of the effects of the as-built configuration on the EDG building ventilation systems ability to satisfy the intended safety function during and following a design basis tornado event. Based on the assumption errors in the existing calculations, the capability of the EDG building ventilation system to protect against a tornado event was called into question. This URI was discussed in NRC Report No. 05000324, 325/2007-006.

During the CDBI, the inspectors reviewed design Calculation 0VA-0033, Tornado Analysis of Diesel Generating Building, Rev. 1 and identified the following concerns:

• Assumption 7 of this calculation stated that the back draft/check dampers were assumed open in the normal outward flow direction during an atmospheric depressurization event associated with a tornado. The assumption also stated that during the subsequent atmospheric repressurization associated with a tornado, the back draft/check dampers would open in the reverse direction to allow reverse inward flow when the Differential Pressure (dP) across the damper exceeds 80 psi.

The installed back draft and check dampers were verified not to be able to open in the reverse direction. Therefore, conclusions of the Calculation 0VA-0033 about the maximum dPs for the structures and the ductwork were not accurate.

• During the development of Calculation 0VA-0033 in 1992, design input from MISC-00104, UE&C Memo from M.J. DiDonato to J.H. Crowly, Tornado Venting of Diesel Generator Building, dated 5/1/72, was used without validation. This inappropriate act introduced the above invalid assumption into the design record.

• The calculation and the design specification also failed to address any potential lifting or wind milling effects of increased air flow through the ventilation system fans caused by the high dP predicted in this calculation.

This finding was entered into the licensees corrective action program as NCR 00259088 with actions to evaluate the ability of the EDG building ventilation systems actual installed equipment to satisfy the intended safety function during and following a design basis tornado event. In the interim, compensatory measures were established to eliminate the concern pending the licensees analysis of the existing condition.

The licensee performed an extensive analysis to evaluate the above concerns in order to ensure the availability, reliability, and capability of the emergency diesel building ventilation system to protect the EDG building structure during a design basis tornado event. The licensee concluded the following:

• The fan motors and associated electrical controls will not be affected by the brief increase in air flow through the ventilation during the leading edge of a tornado.

• Adequate protection exists to prevent damage to the EDG building structure from the atmospheric depressurization and subsequent repressurization during a design bases tornado event with the currently installed equipment.

Analysis.

The licensees failure to verify a key analytical assumption related to operation of the back draft and check dampers prior to translating it into specifications and ultimately into the installed hardware is a performance deficiency. This finding was determined to be more than minor because the finding was associated with the Mitigating Systems Cornerstone attribute of Design Control, i.e. initial design. It impacted the cornerstone objective of ensuring the availability, reliability, and capability of the emergency diesel building ventilation system to protect the EDG building structure during a design basis tornado event. Due to the deficiencies between the installed hardware and the assumption in the calculation, the calculation did not ensure the capability of emergency diesel building ventilation system to perform the intended safety function. This was determined to be a failure to ensure the availability, reliability, and capability of a safety system that responds to an initiating event to prevent undesirable consequences. The team assessed this finding for significance in accordance with NRC Manual Chapter 0609, Appendix A, Attachment 1, Significance Determination Process (SDP) for Reactor Inspection Findings for At-Power Situations, and determined that it was of very low safety significance (Green), in that no actual loss of safety system function was identified. The team reviewed the licensees recently performed calculations and analyses to ensure the capability of the ventilation system to perform its function. This finding was reviewed for cross-cutting aspects and none were identified since the performance deficiencies have existed since initial operation and are not indicative of current licensee performance.

Enforcement.

10 CFR 50, Appendix B, Criterion III, Design Control states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee did not correctly translate the actual installed hardware configuration into the specifications. During the development of Calculation 0VA-0033 in 1992, design input from a June 7, 1972 UE&C memo (misc-00105) was used without validation therefore; this design deficiency was established in an original plant design and has existed for the past 37 years. Because this finding is of very low safety significance and was entered into the licensees corrective action program as NCR #00259088, this violation is being treated as an NCV, consistent with the NRC Enforcement Policy. This violation is therefore designated as NCV 05000324, 325/2009004-06, Capability of Emergency Diesel Generator Ventilation System to Meet Design and Licensing Requirements.

4OA6 Management Meetings

Exit Meeting Summary

On October 14, 2009 the inspector presented the inspection results to Mr. Ben Waldrep and other members of the licensee staff. The inspectors confirmed that proprietary information was not provided or examined during the inspection period.

An interim exit was conducted on October 19, 2009, to discuss the results of the URI 05000324, 325/2007006-001 inspection.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements which meet the criteria of the NRC Enforcement Policy for being dispositioned as an NCV.

.1 Technical Specification Limiting Condition for Operation TS 3.5.3 RCIC System, requires

the RCIC system to be operable when steam dome pressure exceeds 150#. TS 3.0.4 prohibits entry into a plant condition where TS equipment is required to be operable, unless that equipment is operable (with certain exceptions). Contrary to the above, on April 18, 2007 during surveillance testing at approximately 1000#, the unit 2 RCIC pump tripped due to low suction pressure and was declared inoperable. It was later determined that the trip was caused by air that was left in the RCIC system piping after venting the RCIC piping prior to reactor startup on April 16, 2007. Therefore, the system was not operable when steam pressure was raised above 150#, and the licensee violated TS 3.0.4. The finding is of very low safety significance (Green) because, after assigning credit for manual operator recovery, the change in core damage probability was less than 1E-6. Because the finding is of very low safety significance and has been entered into the CAP (AR 203139203139, this finding is being treated as an NCV, consistent with of the Enforcement Policy.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Annacone, Director Site Operations

L. Beller, Superintendent, Operations Training

W. Brewer, Manager-Maintenance

A. Brittain, Manager - Security

B. Davis, Manager - Engineering

P. Dubrouillet, Supervisor - Plant Support Group

S. Gordy, Manager - Operations

L. Grzeck, Lead Engineer - Technical Support

S. Howard, Manager - Outage and Scheduling

R. Ivey, Manager - Nuclear Oversight Section

J. Johnson, Manager - Environmental and Radiological Controls

P. Mentel, Manager - Nuclear Support Services

W. Murray, Licensing Specialist

A. Pope, Supervisor - Licensing and Regulatory Affairs

T. Sherrill, Engineer - Technical Support

J. Titrington, Superintendent - Design Engineering

M. Turkal, Lead Engineer - Technical Support

J. Vincelli, Superintendent - Environmental and Radiological Controls

B. Waldrep, Site Vice President

M. Williams, Training Manager

E. Wills, Plant General Manager

NRC Personnel

Randall

A. Musser, Chief, Reactor Projects Branch 4, Division of Reactor Projects Region II

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000324/2009004-01 NCV Inadequate Annunciator Response Procedure for HPCI Vacuum Tank High Level (Section 4OA3)

05000324,325/2009004-02 NCV Failure to Follow Plant Procedure Caused Loss of E2 Bus (Section 4OA3)

05000325/2009004-03 NCV Surveillance Test Performed on Incorrect Loop of RHR (Section 1R22 )

05000324,325/2009004-04 NCV Failure to Establish Adequate Installation Instructions for Emergency Diesel Generator Service Water Expansion Joint Control Units (Section 1R18)

05000324,325/2009004-05 NCV Failure to Include Risk Significant Maintenance in the Site Risk Profile (Section 1R13)

05000324,325/2009004-06 NCV Capability of Emergency Diesel Generator Ventilation System to Meet Design and Licensing Requirements (Section 4OA5)

Closed

05000324/2009-001 LER High Pressure Coolant Injection (HPCI) System Inoperable Due to Water in the HPCI Turbine Casing

05000324,325/2009-002 LER Valid System actuations Due to Loss of Power to Emergency Bus E2

05000324/2007002 and

05000324/2007002 Supplement 1

LER Mode Change Made with Reactor Core Isolation Cooling (RCIC) System Inoperable

05000324, 325/2007006-

001 URI Capability of Emergency Diesel Generators to Meet Design and Licensing Requirements