IR 05000325/2009009
| ML091680060 | |
| Person / Time | |
|---|---|
| Site: | Brunswick  |
| Issue date: | 06/17/2009 |
| From: | Kennedy K Division of Reactor Safety II |
| To: | Waldrep B Carolina Power & Light Co |
| References | |
| EA-09-121 IR-09-009 | |
| Download: ML091680060 (13) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION June 17, 2009
SUBJECT:
BRUNSWICK STEAM ELECTRIC PLANT, NRC INSPECTION REPORT 05000325/2009009 AND 05000324/2009009 AND PRELIMINARY WHITE FINDING
Dear Mr. Waldrep:
On May 13, 2009, the Nuclear Regulatory Commission (NRC) completed an in-office inspection of an unresolved item (URI) associated with the Brunswick Steam Electric Plant which was identified in NRC Inspection Report 05000325/2008010 and 05000324/2008010 (ADAMS Accession Number ML083470550) forwarded to you on December 12, 2008. Specifically, URI 05000325, 324/2008010-001, Verify cable routing locations affected by a design change error which resulted in a loss of emergency diesel generator (EDG) local control function, was identified as unresolved pending review of the EDG control wire routing to verify what areas were affected. The enclosed inspection report documents the inspection results, which were discussed on May 28, 2009, with you and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and compliance with the NRCs rules and regulations and with the conditions of your license. Based on the results of this inspection, a finding was identified involving the failure to correctly translate the design basis into Engineering Change (EC) 66274 to replace control relays on all four EDGs.
Specifically, termination points for linking control power to the EDG lockout relay reset circuitry were incorrectly designated in EC 66274. This resulted in the wiring for the control relays being installed such that the EDGs could not be operated locally as required by the Safe Shutdown Analysis Report. On August 19, 2008, EC 66274 was revised to correct the wiring error. On August 21, 2008, all four EDGs were rewired, tested to demonstrate local control capability, and returned to service. Therefore, this finding does not represent an immediate safety concern.
This finding was assessed, based on the best available information, including influential assumptions, using the applicable Significance Determination Process (SDP). The dominant accident sequences involved are initiated by a fire situated such as to cause both a loss of offsite power and a forced main control room evacuation. For these dominant accident sequences, the performance deficiency will result in a station blackout to either or both Units. CP&L 2 The exposure period for this condition was one year. As a result, the finding was preliminarily determined to be a low to moderate safety significance (White). The preliminary Phase 3 SDP analysis is included as Enclosure 2.
The finding is an apparent violation of 10 CFR 50, Appendix B, Criterion III, Design Control, for failure to correctly translate the design basis into specifications, drawings, procedures and instructions, and is being considered for escalated enforcement in accordance with the NRCs Enforcement Policy. In addition, this finding is considered to have a cross-cutting aspect related to accurate design documentation H.2(c), as described in the resources component of the human performance cross-cutting area. Accordingly, for administrative purposes, URI 05000325, 324/2008010-001 is considered closed. The current Enforcement Policy can be found on the NRCs website at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.
In accordance with Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The SDP encourages an open dialogue between the staff and the licensee; however, the dialogue should not impact the timeliness of the NRCs final determination. Before we make a final decision on this matter, we are providing you an opportunity to: (1) present your perspectives on the facts and assumptions used by the NRC to arrive at the finding and its significance at a regulatory conference; or (2) submit your position on the finding to the NRC in writing. If you request a regulatory conference, it should be held within approximately 30 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a regulatory conference is held, it will be open for public observation. The NRC will also issue a press release to announce the conference. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of the receipt of this letter. If you decline to request a regulatory conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of Inspection Manual Chapter 0609.
Please contact Ms. Rebecca Nease at (404) 562-4530 within 10 business days of the date of your receipt of this letter to notify the NRC of your intentions. If we have not heard from you within 10 business days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberations on this matter.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation may change as a result of further NRC review. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and Enclosure 1 will be made available electronically for public inspection in the NRC Public CP&L 3 Document Room or from the NRC=s document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. However, because of the security-related information contained in Enclosure 2, and in accordance with 10 CFR 2.390, a copy of Enclosure 2 will not be available for public inspection.
Sincerely,
/RA/
Kriss M. Kennedy, Director Division of Reactor Safety Docket Nos.: 50-325, 50-324 License Nos.: DRP-71, DRP-62
Enclosures:
1. NRC Inspection Report 05000325/2009009 and 05000324/2009009 w/Attachment: Supplemental Information 2. SDP Phase 3 Summary ( SECURITY-RELATED INFORMATION)
REGION II==
Docket No.: 05000325, 05000324 License No.: DPR-71 and DRP-62 Report No.: 05000325/2009009 and 05000324/2009009 Licensee: Progress Energy - Carolina Power and Light (CP&L)
Facility: Brunswick Steam Electric Plant, Units 1 & 2 Location: 8470 River Road SE Southport, NC 28461 Dates: September 2008 - June 5, 2009 Inspectors: R. Rodriguez, Senior Reactor Inspector G. MacDonald, Senior Reactor Analyst Approved by: Rebecca L. Nease, Chief Engineering Branch 2 Division of Reactor Safety Enclosure 1
SUMMARY OF FINDINGS
IR 05000325, 324/2009-009; 9/2008-5/22/2009; Brunswick Steam Electric Plant; Units 1 & 2;
Other Activities.
The report transmits the results of the NRCs preliminary assessment of the failure to correctly translate the design basis into Engineering Change (EC) 66274 to replace control relays on all four Emergency Diesel Generators (EDGs). One apparent violation with potentially low to moderate safety significance (White) was identified. Additionally, this finding is considered to have a cross-cutting aspect related to accurate design documentation H.2(c), as described in the resources component of the human performance cross-cutting area. The significance of most findings is indicated by its color (Green, White, Yellow, or Red) using Inspection Manual Chapter (IMC) 0609, ASignificance Determination Process@ (SDP). Findings for which the SDP does not apply may be Green or assigned a severity level after management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, AReactor Oversight Process.
Cornerstone: Mitigating Systems
TBD. An apparent violation of 10 CFR 50, Appendix B, Criterion III, Design Control, was identified for failure to correctly translate the design basis into EC 66274 to replace control relays on all four EDGs. Specifically, termination points for linking control power to the EDG lockout relay reset circuitry were incorrectly designated in the EC. This resulted in the wiring for control relays being installed such that the EDGs could not be operated locally as required by the Safe Shutdown Analysis Report. Upon discovery, the licensee initiated Action Request (AR) 292232 and re-wired and tested each affected EDG. The local control function was restored to all EDGs on August 21, 2008.
The failure to correctly translate the design basis into EC66274 is a performance deficiency.
This finding is more than minor because it is associated with the reactor safety mitigating system cornerstone attribute of protection against external events, i.e., fire. It also affects the cornerstone objective of ensuring the availability of systems that respond to events in that the EDGs could not be operated locally as required by the Safe Shutdown Analysis Report. This finding was assessed using the applicable SDP, which resulted in a calculated core damage frequency (CDF) risk increase over the base case between 1E-5 and 1E-6 per year. The dominant accident sequences involved are initiated by a fire situated such as to cause both a loss of offsite power (LOOP) and a forced main control room evacuation. For these dominant accident sequences, the performance deficiency will result in a station blackout (SBO) to either or both units. The exposure period for this condition was one year. As a result, the finding was preliminarily determined to be a low to moderate safety significance (White). The cause of the finding is considered to have a cross-cutting aspect related to accurate design documentation
H.2(c), as described in the resources component of the human performance cross-cutting area.
1
REPORT DETAILS
OTHER ACTIVITIES
4OA5 Other
(Opened) Apparent Violation (AV) 05000325, 324/2009009-001, Inability to Operate the EDGs Locally as Required by the Safe Shutdown Analysis Report
a. Inspection Scope
The inspectors conducted a review and significance evaluation of the licensees inability to operate the EDGs locally after implementation of EC 66274.
b. Findings
Introduction.
An apparent violation of 10 CFR 50, Appendix B, Criterion III, Design Control, was identified for failure to correctly translate the design basis into EC 66274 to replace control relays on all four EDGs. Specifically, termination points for linking control power to the EDG lockout relay reset circuitry were incorrectly designated in EC 66274.
This resulted in the wiring for control relays being installed such that the EDGs could not be operated locally as required by the Safe Shutdown Analysis Report. Upon discovery, the licensee re-wired and tested each affected EDG. The local control function was restored to all EDGs on August 21, 2008.
Description.
On August 18, 2008, EDG #4 failed to start during surveillance test 0PT-12.14.L, DG4 Local Control Operability Test. The failure resulted from an inability to reset a lockout condition while the Alternative Safe Shutdown (ASSD) key switch was in the LOCAL position. Troubleshooting activities performed in response to this failure determined that this inability was due to the reset relay (LOCR) being configured (wired)such that it was isolated from control power when the ASSD key switch was operated.
This configuration was the unintended consequence of EC 66274 under which it was installed in June 2007.
At the Brunswick Steam Electric Plant, the EDGs are considered a safe shutdown system and must be capable of being controlled from both the Control Room and a remote location. The EDGs are required to power the electrical distribution system upon loss of power from the balance of plant buses. The AC emergency power system is equipped with key-locked isolation switches located on the local EDG control panels and on each emergency bus section. These switches allow isolation of the EDGs and emergency buses from the control circuit conductors routed through the control building.
In the event that a fire forces an evacuation of the main control room or in any way affects control of the diesel generators and emergency buses from the main control room, safe shutdown equipment can be operated locally by placing these NORMAL/LOCAL switches in the LOCAL position.
1 4 Upon identification of this condition, AR 292232 was initiated and EC 66274 was revised to correct the responsible design flaw (Revisions 5 and 6). Work activities were undertaken to implement the necessary configuration changes on all four EDGs. These modifications consisted of re-wiring the LOCR relays such that they do not lose power when the ASSD key switches are operated. All four EDGs were successfully modified, tested and returned to service on August 21, 2008.
As previously stated, this condition was discovered during surveillance test 0PT-12.14.L which was performed a little over a year after EC 66274 was implemented. The inspectors reviewed and assessed the post-modification testing completed after the implementation of the EC to determine why the testing did not identify the inability of the EDGs to perform their alternate safe shutdown function. The inspectors concluded that the inadequate post-modification testing was not a cause of the event, but a missed opportunity to detect the inadequate design change. A conceptual design error was transferred from the design modification package (EC 66274) into the post-modification testing process which resulted in the post-modification test not identifying the wiring error. The inspectors concluded that the post-modification testing issue did not constitute a separate performance deficiency.
Analysis.
The failure to correctly translate the design basis into EC 66274 is a performance deficiency. This finding is more than minor because it is associated with the reactor safety mitigating system cornerstone attribute of protection against external events, i.e., fire. It also affects the cornerstone objective of ensuring the availability of systems that respond to events, in that the EDGs could not be operated locally as required by the licensees Safe Shutdown Analysis Report. In addition, this finding is considered to have a cross-cutting aspect related to accurate design documentation
H.2(c), as described in the resources component of the human performance cross-cutting area. Specifically, the licensee did not ensure that complete, accurate and up-to-date design documentation was available to assure nuclear safety.
Because the finding affects fire protection, its significance was assessed in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process.
However, IMC 0308, Attachment 3, Appendix F, Technical Basis for Fire Protection Significance Determination Process for at Power Operations, states that IMC 0609, Appendix F, does not currently include explicit treatment of fires in the main control room.
Therefore, a Phase 3 analysis was performed using the applicable sections of IMC 0609, Appendix F and NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities.
The CDF risk increase over the base case was calculated to be between 1E-5 and 1E-6 per year. The dominant accident sequences involved are initiated by a fire situated such as to cause both a LOOP and a forced main control room evacuation. For these dominant accident sequences, the performance deficiency will result in a SBO to either or both units. The exposure period for this condition was one year. As a result, the finding was preliminarily determined to be a low to moderate safety significance (White).
The preliminary Phase 3 SDP analysis is included as Enclosure 2.
1 5
Enforcement.
Appendix B of 10 CFR 50, Criterion III, Design Control, requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures and instructions. Section 9.5.1 of the Updated Final Safety Analysis Report states, in part, that the effects of fire on safe shutdown systems have been evaluated in the Safe Shutdown Analysis Report. The Safe Shutdown Analysis Report, Calculation BNP-E-9.004, states, The AC Emergency Power System is equipped with key-locked isolation switches located on the local diesel generator electrical panel and on each emergency bus section. These switches allow isolation of the diesel generators and emergency buses from the control circuit conductors routed through the Control Building. In the event that a fire forces an evacuation of the Control Room or in any way affects control of the diesel generators and emergency buses from the Control Room, safe shutdown equipment can be operated locally by placing these NORMAL/LOCAL switches in the LOCAL position.
Contrary to the above, on June 7, 2007, the licensee failed to correctly translate the design basis into specifications, drawings, procedures and instructions. Specifically, termination points for linking control power to the EDG lockout relay reset circuitry were incorrectly designated in EC 66274. This resulted in the wiring for control relays being installed such that the EDGs could not be operated locally. Upon discovery, the licensee initiated AR 292232 and re-wired and tested each affected EDG. The local control function was restored to all EDGs on August 21, 2008. URI 05000325, 324/2008010-001, which was opened during NRC Inspection Report 05000325, 324/2008010 is considered closed. Pending final significance determination, this finding is identified as Apparent Violation (AV) 05000325,324/2009009-01, Inability to Operate the EDGs Locally as Required by the Safe Shutdown Analysis Report.
4OA6 Meetings, Including Exit
On May 28, 2009, the NRC presented the inspection results to Mr. Benjamin Waldrep who acknowledged the findings.
ATTACHMENT:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
- B. Waldrep, Vice President
- M. Annacone, Director of Site Operations
- P. Mentel, Manager of Site Support Services
- T. Sherrill, Licensing
- B. McCabe, Corporate Licensing Supervisor
- A. Pope, Recovery Manager
- S. Hardy, Fire Protection
NRC Personnel
- P. OBryan, Brunswick Senior Resident Inspector
- J. Circle, Senior Reliability and Risk Analyst
LIST OF REPORT ITEMS
Opened
- 05000325, 324/2009009-01 AV Inability to Operate the EDGs Locally as Required by the Safe Shutdown Analysis Report. (Section 4OA5)
Closed
- 05000325, 324/2008010-01 URI Verify cable routing locations affected by a design change error which resulted in a loss of Emergency Diesel Generator local control function.
Discussed
None.