IR 05000331/2008006

IR 05000331-08-006(DRS), on 02/11/2008 - 03/14/2008, Duane Arnold Energy Center; Component Design Bases Inspection (CDBI)

ML081160218
Person / Time
Site:	Duane Arnold
Issue date:	04/24/2008
From:	Ann Marie Stone NRC/RGN-III/DRS/EB2
To:	Richard Anderson Duane Arnold
References
IR-08-006
Download: ML081160218 (38)

Text

April 24, 2008

SUBJECT:

DUANE ARNOLD ENERGY CENTER

NRC COMPONENT DESIGN BASES INSPECTION (CDBI)

INSPECTION REPORT 05000331/2008006(DRS)

Dear Mr. Anderson:

On March 14, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed a component design bases inspection at your Duane Arnold Energy Center. The enclosed report documents the inspection results, which were discussed on March 14, 2008, with yourself and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, three NRC-identified findings of very low safety significance were identified. The findings involved violations of NRC requirements. However, because of their very low safety significance, and because the issues were entered into your corrective action program, the NRC is treating the issues as Non-Cited Violations (NCVs) in accordance with Section VI.A.1 of the NRC Enforcement Policy.

If you contest the subject or severity of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S.

Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission - Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector Office at the Duane Arnold Energy Center. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)

component of NRC's Agencywide Documents Access and Management System (ADAMS),

accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Ann Marie Stone, Chief Engineering Branch 2

Division of Reactor Safety Docket No.

50-331 License No. DPR-49 Enclosure:

Inspection Report 05000331/2008006 (w/Attachment: Supplemental Information)

cc w/encl:

M. Nazar, Senior Vice President and Chief

Operating Officer

J. Stall, Senior Vice President, Nuclear and Chief

Nuclear Officer

R. Helfrich, Senior Attorney

M. Ross, Managing Attorney

R. Kundalkar, Vice President, Nuclear Engineering

J. Bjorseth, Site Director

D. Curtland, Plant Manager

S. Catron, Manager, Regulatory Affairs

Chief Radiological Emergency Preparedness Section,

Dept. Of Homeland Security

M. Rasmusson, State Liaison Officer

SUMMARY OF FINDINGS

IR 05000331/2008006(DRS); 02/11/2008 - 03/14/2008; Duane Arnold Energy Center;

Component Design Bases Inspection (CDBI).

The inspection was a 3-week onsite baseline inspection that focused on the design of components that are risk significant and have low design margin. The inspection was conducted by regional engineering inspectors and two consultants. Three findings of very low safety significance were identified, all with associated Non-Cited Violations (NCVs). The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green, or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, was identified by the inspectors for the failure to assure and verify that adequate control voltage was available for the close and open coils of the 4160VAC [volts alternating current] safety-related breakers. The licensee entered this performance deficiency into its corrective action program, performed a simplified evaluation to determine the worst case available close coil voltage at the worst case breaker fed from the 4160VAC essential switchgear, and conducted testing to demonstrate a reasonable assurance of operability.

The finding was determined to be more than minor because the failure to assure and verify that adequate control voltage was available to close and open the 4160VAC breakers could have affected the capability of emergency diesel generators and other safety-related equipment to respond to initiating events. The issue was of very low safety significance because the inspectors determined it was a design deficiency that did not result in actual loss of safety function. The inspectors determined there was no cross-cutting aspect associated with this finding. (Section 1R21.3.b.(1))

Green.

A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, was identified by the inspectors for the failure to assure that thermal overload relays (TOLs) on safety-related motor-operated valve (MOV) circuits were sized properly and periodically tested. The licensee entered this issue into its corrective action program and was able to demonstrate operability in that the TOLs would not prevent any MOVs from performing their safety function.

The finding was determined to be more than minor because the failure to assure that TOLs were properly sized and periodically tested could have affected the ability for MOVs to respond to initiating events. The issue was of very low safety significance because the inspectors determined it was a design deficiency that did not result in actual loss of safety function. The inspectors determined there was no cross-cutting aspect associated with this finding. (Section 1R21.3.b.(2))

Green.

A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, was identified by the inspectors for the failure to test reactor protection system (RPS) key locked bypass switches. The licensee entered this issue into its corrective action program and initiated procedural changes to require periodic testing of the RPS bypass switches.

This finding was more than minor because the licensee did not ensure the operability and functional performance of the key lock switches used bypass automatic protection circuits in the RPS. The issue was of very low safety significance because the inspectors determined that it did not result in actual loss of safety function. The inspectors determined there was no cross-cutting aspect associated with this finding.

(Section 1R21.6.b.(1))

Licensee-Identified Violations

No violations of significance were identified.

REPORT DETAILS

1R21 Component Design Bases Inspection (CDBI)

.1 Introduction

The objective of the CDBI is to verify that design bases have been correctly implemented for the selected risk significant components and that operating procedures and operator actions are consistent with design and licensing bases. As plants age, their design bases may be difficult to determine and an important design feature may be altered or disabled during a modification. The Probabilistic Risk Assessment (PRA)model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

Specific documents reviewed during the inspection are listed in the attachment to the report.

.2 Inspection Sample Selection Process

The inspectors selected risk significant components and operator actions for review using information contained in the licensees PRA and the Duane Arnold Standardized Plant Analysis Risk (SPAR) Model, Revision 3.31. In general, the selection was based upon the components and operator actions having a risk achievement worth of greater than 1.3 and/or a risk reduction worth greater than 1.005. The operator actions selected for review included actions taken by operators both inside and outside of the control room during postulated accident scenarios. In addition, the inspectors selected operating experience issues associated with the selected components.

The inspectors performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design reductions caused by design modification, or power uprates, or reductions due to degraded material condition. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as performance test results, significant corrective action, repeated maintenance activities, Maintenance Rule (a)(1) status, components requiring an operability evaluation, NRC resident inspector input of problem areas/equipment, and system health reports. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins. A summary of the reviews performed and the specific inspection findings identified are included in the following sections of the report. A total of 29 inspection samples were reviewed.

.3 Component Design

a. Inspection Scope

The inspectors reviewed the Updated Final Safety Analysis Report (UFSAR), Technical Specifications (TS), design basis documents, drawings, calculations and other available design basis information, to determine the performance requirements of the selected components. The inspectors used applicable industry standards, such as the American Society of Mechanical Engineers (ASME) Code, Institute of Electrical and Electronics Engineers (IEEE) Standards and the National Electric Code, to evaluate acceptability of the systems design. The NRC also evaluated licensee actions, if any, taken in response to NRC issued operating experience, such as Bulletins, Generic Letters (GLs)

Regulatory Issue Summaries (RISs), and Information Notices (INs). The review was to verify that the selected components would function as designed when required and support proper operation of the associated systems. The attributes that were needed for a component to perform its required function included process medium, energy sources, control systems, operator actions, and heat removal. The attributes to verify that the component condition and tested capability was consistent with the design bases and was appropriate may include installed configuration, system operation, detailed design, system testing, equipment and environmental qualification, equipment protection, component inputs and outputs, operating experience, and component degradation.

For each of the components selected, the inspectors reviewed the maintenance history, system health reports, operating experience-related information and licensee corrective action program documents. Field walkdowns were conducted for all accessible components to assess material condition and to verify that the as-built condition was consistent with the design. Other attributes reviewed are included as part of the scope for each individual component.

The following 19 components were reviewed:

• High Pressure Coolant Injection (HPCI) Turbine/Pump (1P216, 216A): The inspectors reviewed the HPCI system to verify that the pump and associated peripherals could meet the design basis requirements. The inspection included a review of required flows for design basis accidents, as well as minimum flow provisions. This included the automatic initiation logic and the control of the associated automatic injection and minimum flow valves. The inspectors also evaluated calculations, pump curve calculations and inservice test (IST) data to ensure that TS and design basis requirements were met, and that IST acceptance criteria including instrument uncertainties were appropriate. The inspectors reviewed governor and flow controller tuning procedures and test results to verify that they implemented vendor requirements. Finally, the inspectors reviewed HPCI instrumentation surveillances to ensure proper instrument setpoints were maintained.

• Standby Liquid Control Pump (SBLC) (1P230A): The inspectors reviewed the pump calculations including the required flow rate and discharge pressure to ensure the pump was capable of performing its function under design conditions.

Test procedures and results for IST and TS surveillance were also reviewed to verify acceptance criteria were met and performance degradation would be identified. In addition, the inspectors reviewed pump motor electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running, protective device/thermal overload relay settings to ensure that adequate margin existed, and cable sizing to ensure adequate ampacity.

• HPCI Steam Supply Inboard Isolation Valve (MO2238): The inspectors reviewed motor-operated valve (MOV) calculations and analysis to ensure the valve was capable of functioning under design conditions. This included the mechanical calculations for required thrust, maximum differential pressure, and valve weak link analysis. In addition, the inspectors reviewed valve AC [alternating current]

motor electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running, protective device/thermal overload relay settings to ensure that adequate margin existed, and cable sizing to ensure adequate ampacity. Diagnostic and IST results were reviewed to verify acceptance criteria were met and performance degradation would be identified.

• HPCI Minimum Flow Valve (MO2318): The inspectors reviewed MOV calculations and analysis to ensure the valve was capable of functioning under design conditions. This included the mechanical calculations for required thrust, maximum differential pressure, and valve weak link analysis. In addition, the inspectors reviewed valve DC [direct current] motor electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running, protective device/thermal overload relay settings to ensure that adequate margin existed. The inspectors reviewed the control logic diagrams to verify the proper functionality was implemented.

Diagnostic and IST results were reviewed to verify acceptance criteria were met and performance degradation would be identified. The inspectors also reviewed a noise suppression modification on this valve.

• HPCI Injection Valve (MO-2312): The inspectors reviewed MOV calculations and analysis to ensure the valve was capable of functioning under design conditions.

This included the mechanical calculations for required thrust, maximum differential pressure, and valve weak link analysis. In addition, the inspectors reviewed valve DC motor electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running, protective device/thermal overload relay settings to ensure that adequate margin existed. The inspectors reviewed the control logic diagrams to verify the proper functionality was implemented. Diagnostic and IST results were reviewed to verify acceptance criteria were met and performance degradation would be identified. The inspectors also reviewed a noise suppression modification on this valve.

• Torus Hard Pipe Vent Valve (CV-4357): The inspectors reviewed the air-operated valve (AOV) calculations, including required torque and maximum differential pressure, to ensure the valve was capable of performing its function under design conditions. Diagnostic and surveillance test results were also reviewed to verify acceptance criteria were met and performance degradation would be identified. The inspectors also reviewed the calculations addressing the capacity of the associated air accumulator to ensure there was sufficient capacity to operate the valve under certain accident conditions. In addition, the inspectors reviewed the maintenance history on the air accumulator and the procedures and results for leak testing the associated air check valve.

• 4160VAC Emergency Diesel Generator (EDG) (1G021): The inspectors reviewed the electrical portions of the EDG and associated supply breaker to verify the adequacy of the equipment to respond to design basis events. The inspectors reviewed EDG starting logic and output breaker control logic to verify the appropriate functionality was implemented. Completed surveillances were reviewed to verify that the TS requirements were met. The inspectors reviewed protection/coordination and short-circuit calculations to verify the EDG was adequately protected by protective devices during test mode and emergency operation. Additionally, the inspectors reviewed calculations and technical evaluations to verify that steady-state and transient loading were within design capabilities, adequate voltage would be present to start and operate connected loads, and operation at maximum allowed frequency would be within the design capabilities. The review included determining the bases for brake horsepower loading values, and verifying that design bases and design assumptions had been appropriately translated into the design calculations and procedures. The inspectors reviewed the basis for the EDG load sequence time delay setpoints.

The inspectors reviewed the EDG feeder breaker maintenance and control voltage to verify that the components would function when required.

• Residual Heat Removal Service Water (RHRSW) Loop A Heat Exchanger Outlet Isolation Valve (MO2046): The inspectors reviewed MOV calculations and analysis to ensure the valve was capable of functioning under design conditions.

This included the mechanical calculations for required thrust, maximum differential pressure, and valve weak link analysis. In addition, the inspectors reviewed valve AC motor electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running, protective device/thermal overload relay settings to ensure that adequate margin existed, and cable sizing to ensure adequate ampacity. The inspectors reviewed valve operating logic to verify the appropriate functionality was implemented including automatic closure on loss of RHRSW. Diagnostic and IST results were reviewed to verify acceptance criteria were met and performance degradation would be identified.

• Essential Service Water (ESW) Pump A (1P099A): The inspectors reviewed system hydraulics calculations including resistance calculations to determine the total head requirements for the pump based on actual estimated losses. In addition, the inspectors reviewed surveillances completed on the pump to make sure that actual performance was acceptable and conditions of the test represented, or could be correlated to, conditions during design basis accidents.

The inspectors reviewed vendor manuals, specifications and pump curves to make sure that these parameters had been correctly translated into calculations.

The inspectors also reviewed the seismic adequacy of the discharge piping and its interface with non-safety-related piping to ensure system reliability during an earthquake. In addition, the inspectors reviewed pump motor electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running, protective device/thermal overload relay settings to ensure that adequate margin existed, and cable sizing to ensure adequate ampacity.

• ESW Pump A Discharge Strainer (1S089A): The inspectors reviewed the estimated resistance added by the strainer on the overall ESW system resistant calculation. The inspectors also reviewed completed surveillances to ensure operation within the expected values. The inspectors reviewed control logic for the strainer backwash system to verify the automatic functionality was implemented.

• Heating, Ventilation, and Air-Conditioning (HVAC) for ESW Pump House: The inspectors reviewed calculations to ensure the HVAC system would maintain room temperature within the prescribed limits during a design basis accident. In addition, the inspectors reviewed these calculations to verify that the most limiting conditions were taken into account. The inspectors also reviewed the components specifications to make sure these parameters have been correctly translated into the calculations.

• 250VDC Battery (1D4): The inspectors reviewed electrical calculations for the safety-related 250VDC station battery. These included battery sizing and loading calculations for safety-related DC loads to verify that adequate battery capacity was available during a design bases event and for a station blackout event. The inspectors also reviewed the battery surveillance tests and performance history to verify acceptance criteria were met and performance degradation would be identified. The minimum and maximum battery room temperatures and hydrogen buildup calculations were reviewed for consistency with design basis requirements. The inspectors reviewed battery charger sizing calculations and verified that battery charger capacitors were periodically replaced to ensure proper operation. Operating procedures associated with the battery were also reviewed.

• 250VDC Motor Control Center (1D41): The inspectors reviewed electrical calculations for the safety-related 250VDC motor control center. These included short circuit, loading, and voltage drop calculations for safety-related DC loads to verify that adequate voltage was available at these loads during a design basis event and for a station blackout event. The inspectors reviewed the ratings on fuses and circuit breakers to ensure that they were properly selected for the application.

• 4160VAC Essential Switchgear (1A3): The inspectors reviewed the 4kV essential switchgear to verify it would operate during design basis events. The inspectors reviewed selected calculations for electrical distribution system, including load flow/voltage drop, degraded voltage protection, short-circuit, and electrical protection and coordination. This review was conducted to assess the adequacy and appropriateness of design assumptions, and to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. Additionally, the switchgears protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst-case, short-circuit conditions. The inspectors also reviewed the automatic and manual transfer schemes between alternate offsite sources and the EDG to verify that adequate voltage was maintained for safety-related loads before, and after the transfers. Additionally, bus operating procedures were reviewed to determine if adequate guidance was given to the operators to ensure design basis assumptions were maintained. The inspectors reviewed degraded and loss of voltage relays to verify settings were in accordance with design calculations and associated calibration procedures were consistent with calculation assumptions. To determine if breakers were maintained in accordance with industry and vendor recommendations, the inspectors reviewed the preventive maintenance inspection and testing procedures. The inspectors reviewed breaker opening and closure logic to verify the appropriate functionality was implemented. The 125VDC voltage calculations were reviewed to determine if adequate voltage would be available for the breaker open and close coils and spring charging motors.

• 480VAC Essential Load Center (1B03): The inspectors inspected the 480V load center to verify it would operate during design basis events. The inspectors reviewed selected calculations for electrical distribution system load flow, voltage drop, short-circuit, and electrical protection and coordination. The adequacy and appropriateness of design assumptions and calculations were reviewed to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. The load center protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst-case short-circuit conditions. The inspectors reviewed the voltage protection scheme and the adequacy of available instrumentation/alarms. To ensure that breakers were maintained in accordance with industry and vendor recommendations, the inspectors reviewed the preventive maintenance inspection and testing procedures. The inspectors reviewed the operating procedures for normal, abnormal, and emergency conditions. The inspectors reviewed breaker opening and closure logic to verify the appropriate functionality was implemented. The 125VDC voltage calculations were reviewed to determine if adequate voltage would be available for the breaker open and close coils, and spring charging motors.

• 161/4.16kV Startup Transformer (1X003) and 34.5/4.16kV Standby Transformer (1X004): The inspectors reviewed the transformers to verify they would respond as described in the UFSAR and the design basis document. The inspectors reviewed the system one-line diagrams, nameplate data, electrical load flow calculations, and loading requirements to determine the adequacy of the transformers to supply required power to the associated 4160VAC essential switchgear. The inspectors reviewed corrective action program issues, operability evaluations, and licensee event reports issued since November 2007 that led to inoperability and non-conforming issues with offsite power circuits at Duane Arnold.

• Fuel Oil Storage and Day Tanks (Division 2): The inspectors reviewed design basis documentation, the UFSAR, TS and associated bases, and system drawings for the EDG fuel oil storage and day tank components. Included in this review were the calculations establishing the fuel oil consumption requirements for the 7-day TS supply volume for the EDG; the results of these calculations were independently verified by the inspectors using vendor supplied startup test data. Further, calculations using the schematics providing details on the geometry of the tank, level instrumentation settings, and surveillances used to verify required fuel capacities to demonstrate operability were reviewed.

• HPCI Room Cooler (1VAC14A/B): The inspectors reviewed the design basis documentation, and system drawings for the HPCI room cooler and associated fans. The calculations addressing the maximum potential room temperatures under accident and station blackout conditions were also reviewed. The inspectors also reviewed calculations addressing potential ESW temperatures and corresponding required ESW flows, in addition to surveillances and air balance test results of the fan units.

b. Findings

(1) Inadequate Calculations/Analyses for Essential 4160VAC Circuit Breaker Close/Open Coils

Introduction:

A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, was identified by the inspectors for the failure to assure and verify that adequate control voltage was available for the close and open coils of the 4160VAC safety-related breakers.

Description:

At the start of the inspection, the licensee did not have calculations or analyses to determine the voltages available at the breaker close and open coils during a loss-of-offsite-power/loss-of-coolant (LOOP/LOCA) event. The inspectors identified that existing calculations for the 125VDC electrical power distribution systems only calculated voltage drops to the switchgear and not to the connected loads. According to the calculations, control wiring beyond the switchgear was considered negligible. During the inspection, the licensee performed a simplified evaluation to determine the worst case available close and open coil voltage at the worst case breaker fed from the 4160VAC essential switchgear. The EDG feeder breaker was estimated to be the circuit with the longest control cable run and the largest control circuit voltage drop. The evaluation determined that the voltage could be as low as 74VDC conservatively assuming the DC voltage after a 4-hour design bases battery discharge.

Vendor documentation established a requirement for 90VDC and 70VDC for proper operation of the breaker close and open coils respectively. The licensee breaker preventive maintenance program verified every 4 years, that the breaker open and close and open coils would operate at 70VDC, but this testing was performed after breaker maintenance had been completed and no as-found testing was conducted. Neither the licensee nor the inspectors could determine if the breaker maintenance performed would have an effect on what voltage that the coils would operate at.

The licensee entered this performance deficiency into its corrective action program (CAP055981). To substantiate a reasonable assurance for operability, the licensee performed additional coil voltage pickup testing on a spare 4160VAC breaker. The testing demonstrated that the close and open coils would pickup at voltages as low as 50VDC. The licensee planed to review testing practices and include control circuit voltage drops to components during their ongoing calculation conversion project to Electronic Transient Analysis Program (ETAP) PowerStation, which was scheduled to be completed this calendar year.

Analysis:

The inspectors determined that failing to verify the adequacy of the design of the essential 4160VAC circuit breaker controls was a performance deficiency warranting a significance evaluation. The inspectors concluded that the finding was greater than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on September 20, 2007. The finding involved the attribute of design control and could have affected the mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors determined the failure to assure and verify that adequate control voltage was available to close and open the 4160VAC breakers could have affected the capability of EDGs and other safety-related equipment to respond to initiating events. By the end of the inspection, the licensee was able to demonstrate operability, however, at the time of discovery there was reasonable doubt on the operability of the essential 4160VAC circuit breakers.

The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a for the Mitigating Systems Cornerstone. The finding screened as Green because it was a design deficiency that did not result in actual loss of safety function. The inspectors determined there was no cross-cutting aspect associated with this finding.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of February 11, 2008, the licensee failed to ensure design control measures were in place for verifying or checking the adequacy of the design of the essential 4160VAC circuit breaker controls. Specifically, the licensee failed to assure, that the minimum available control voltage to the close and open coils at the 4160VAC breakers was adequate to meet requirements. The licensee entered this performance deficiency into its corrective action program (CAP055981), calculated the available voltage for an assumed worst case circuit, and conducted limited testing to assure the breakers were operable. Because this violation was of very low safety significance and it was entered into the licensees corrective action program, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000331/2008006-01).

(2) Inadequate Calculations/Analyses and Testing for Thermal Overload Relays (TOLs) on Safety-Related MOVs

Introduction:

A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, was identified by the inspectors for the failure to assure that TOLs on safety-related MOV circuits were sized properly and periodically tested.

Description:

Regulatory Guide 1.106, Revision 1, Thermal Overload Protection For Electric Motors On Motor-Operated Valves, specified methods acceptable to the NRC staff for complying with Appendix B, Criterion III. The guide allowed the licensee to either bypass the TOL during a design basis event or leave the TOL in the MOV circuit continuously, provided that they were sized properly and periodically tested. These methods would ensure that the TOL devices would not needlessly prevent the motor from performing its safety-related function. The licensee chose to leave the TOLs in the MOV circuits continuously, but failed to demonstrate by calculations or analyses that the TOLs were sized properly and periodically test them to ensure continued functional reliability and the accuracy of the trip point. The inspectors identified that the licensee had established an acceptable criteria for properly sizing TOLs for safety-related MOVs, but had not followed through with the required calculations or analyses to assure proper sizing.

In 1990, the licensee received a Notice of Violation (NRC Inspection Report 1990-05-11)for failure to control TOL sizing and not having configuration controls in place to determine which TOLs were installed in the plant. The licensee initiated a Thermal Overload Project as a result of the violation and performed walkdowns to document the installed TOLs. A contractor performed an As-built review of the Generic Letter 89-10, Safety-Related Motor-Operated Valve Testing and Surveillance, MOV TOLs to determine if the sizing met the current industry guidelines as recommended in IEEE 741-1990, IEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations. The licensee failed to take action based on the contractor review to ensure that the TOLs installed were acceptable to meet the intent of RG 1.106 The inspectors identified that, as of February 11, 2008, the licensee had no program to periodically test TOLs to ensure continued functional reliability and the accuracy of the trip point.

Analysis:

The inspectors determined that failing to assure that TOLs on safety-related MOV circuits were sized properly and periodically tested was a performance deficiency warranting a significance evaluation. The inspectors concluded that the finding was greater than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on September 20, 2007. The finding involved the attribute of design control and could have affected the mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors determined that the failure to assure that TOLs were properly sized and periodically tested could have affected the ability for MOVs to respond to initiating events. By the end of the inspection, the licensee was able to demonstrate operability in that the TOLs would not prevent any MOVs from performing their safety function; however at the time of discovery there was reasonable doubt on the operability of the safety-related MOVs.

The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a for the Mitigating Systems Cornerstone. The finding screened as Green because it was a design deficiency that did not result in actual loss of safety function. The inspectors determined there was no cross-cutting aspect associated with this finding.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, required, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of February 11, 2008, the licensee failed to ensure design control measures were in place for verifying or checking the adequacy of the design of the thermal overload relays for the safety-related MOVs. Additionally, the licensee failed to assure the trip setpoint of the TOLs had not changed after being in service by establishing a periodic testing program for the TOLs. The licensee entered this issue into its corrective action program (CAP055807 and CAP055893). Because this violation was of very low safety significance and was entered into the licensees corrective action program, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000331/2008006-02).

.4 Operating Experience

a. Inspection Scope

The inspectors reviewed six operating experience issues to ensure that NRC generic concerns had been adequately evaluated and addressed by the licensee. The operating experience issues listed below were reviewed as part of this inspection:

• IN 1991-51, Inadequate Fuse Control Programs;

• IN 2006-26, Failure of Magnesium Rotors in MOV Actuators;

• IN 2006-31, Inadequate Fault Interrupting Rating of Breakers;

• GL 2006-02, Grid Reliability;

• Bulletin 88-04, Potential Safety-Related Pump Loss; and

• General Electric Safety Information Communication (SC)06-01, Worst Single Failure for Suppression Pool Temperature

b. Findings

No findings of significance were identified.

.5 Modifications

a. Inspection Scope

The inspectors reviewed four permanent plant modifications related to selected risk significant components to verify that the design bases, licensing bases, and performance capability of the components had not been degraded through modifications. The modifications listed below were reviewed as part of this inspection effort:

• ECP-1703, Install Noise Suppression in 250VDC MOVs;

• EMA-1122936, ESW Pump Replacement;

• DCP-1524, Containment Hard Vent Modification; and

• EMA-A44296, SBLC High-level and Low-level Alarm Setpoint Change.

b. Findings

No findings of significance were identified.

.6 Risk Significant Operator Actions

a. Inspection Scope

The inspectors performed a margin assessment and detailed review of four risk significant, time critical operator actions. These actions were selected from the licensees PRA rankings of human action importance based on risk achievement worth values. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times and performance times documented by job performance measures results. For the selected operator actions, the inspectors performed a detailed review and walk through of associated procedures, including observing the performance of some actions in the stations simulator and in the plant for other actions, with an appropriate plant operator to assess operator knowledge level, adequacy of procedures, and availability of special equipment where required.

The following operator actions were reviewed:

• Lowering Reactor Water Level to Top of Active Fuel following an Anticipated Transient Without Scram (ATWS);

• Inhibiting Automatic Depressurization following an ATWS;

• Injection of Standby Liquid Control following an ATWS; and

• Bypassing Main Steam Line Automatic Isolation following an ATWS.

b. Findings

(1) Failure to Periodically Test Reactor Protection System Key Lock Bypass Switches

Introduction:

A finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, was identified by the inspectors for the failure to test reactor protection system (RPS) key locked bypass switches. The licensee entered this issue into its corrective action program and initiated procedural changes to require periodic testing of the RPS bypass switches.

Description:

On February 12, 2008, following a walkdown of procedures used to mitigate an ATWS, the inspector questioned if key locked bypass switches used to defeat automatic protection circuits were periodically tested. The response obtained was that while most of the defeats were periodical tested as part of surveillance testing, two of the defeats were not tested. In particular four key lock switches that bypass automatic scrams to allow reset and repeat control rod scrams in an ATWS situation (DEFEAT 3) were not periodically tested or exercised. The bypass switches in question where installed in 1990 as a human factors improvement to facilitate implementation of emergency procedures. The switches were tested following their installation and then every 24 months until 1998 when a surveillance procedure change removed them from testing.

Per the Duane Arnold UFSAR, the RPS and the modification that installed the DEFEAT 3 key lock switches was designed to meet the intent of IEEE-279, Proposed Criteria for Nuclear Power Plant Protection Systems. Periodic testing of RPS was required by the surveillance requirements of TS 3.3.1.1. NRC regulations and guidance documents identify the level of testing required for the RPS. These include: Title 10 CFR 50.55a, Codes and Standards, Paragraph (h), which referenced IEEE-297; Appendix A to 10 CFR Part 50, General Design Criterion 21, Protection System Reliability and Testability; Appendix B to 10 CFR Part 50, Criterion XI, Test Control; and Regulatory Guide 1.118, Periodic Testing of Electric Power and Protection Systems.

The licensee reviewed past surveillance results and did not identify any failures of this type of switch at the plant. A review of operating experience did identify a failure of a similar switch at another facility, although a single cycling of the switch restored its function. The apparent cause was assumed to be dirty contacts, which was easily cleaned by cycling the switch. Although the licensee cannot test these switches at this time, there was no indication that the switches would not function when called upon.

Analysis:

The inspectors determined that failing to periodically test key lock switches used to bypass automatic scrams was contrary to the testing requirement for the RPS and was a performance deficiency. The inspectors concluded that the finding was greater than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on September 20, 2007. The finding was determined to be more than minor because it involved the attribute of equipment performance and could have affected the mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee did not ensure the operability and functional performance of the key lock switches used to bypass automatic protection circuits in the RPS.

The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a for the Mitigating Systems Cornerstone. Although the licensee was not able to test the switches during the inspection, there was no indication based on the licensees review of plant testing or through operating experience that the switches would not function when called upon. As such, the finding screened as Green because it did not result in actual loss of safety function and all five questions in Table 4a were answered no. The inspectors determined there was no cross-cutting aspect associated with this finding.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion XI, Test Control, required, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptable limits contained in applicable design documents.

Contrary to the above, from 1998 to the present, the licensee failed to test bypass switches in the RPS. Specifically, in 1999 the surveillance procedure that previously included testing of the RPS bypass switches was revised, which eliminated the testing of the bypass switches. The licensee entered this issue into its corrective action program (CAP055494) and initiated procedural changes to require periodic testing of the RPS bypass switches. Because this violation was of very low safety significance and it was entered into the licensees corrective action program, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000331/2008006-03).

4OA2 Identification and Resolution of Problems

.1 Review of items Entered Into the Corrective Action Program

a. Inspection Scope

The inspectors reviewed a sample of the selected component problems that were identified by the licensee and entered into the corrective action program. The inspectors reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions related to design issues. In addition, corrective action documents written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action program. The specific corrective action documents that were sampled and reviewed by the inspectors are listed in the attachment to this report.

b. Findings

No findings of significance were identified.

4OA6 Meeting(s)

Exit Meeting Summary

On March 14, 2008, the inspectors presented the inspection results to Mr. R. Anderson, and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. Several documents reviewed by the inspectors were considered proprietary information and was either returned to the licensee or handled in accordance with NRC policy on proprietary information.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

R. Anderson, Site Vice President

M. Baldwin, Electrical Design Engineer

D. Curtland, Plant Manager

S. Catron, Licensing Manager

J. Cadogan, Engineering Director

C. Dieckmann, Operations Manager

M. Lingenfelter, Design Engineering Manager

S. Huebsch, System Engineering Supervisor

R. Mayhugh, Motor-operated Valve Program Owner

B. Murrell, Licensing Engineer

S. Myres, Plant Engineering

D. Pint, Senior Electrical Design Engineer

J. Swales, Design Engineering Supervisor

K. Kleinheinz, Program Engineering Manager

J. Swales, Supervisor, Mechanical Design

E. Sorenson, Supervisor, Programs Engineering

L. Swenzinski, Licensing Engineer

Nuclear Regulatory Commission

R. Orlikowski, Senior Resident Inspector

R. Baker, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

05000331/2008006-01 NCV Inadequate Calculations/Analyses for Essential 4160 VAC Circuit Breaker Close/Open Coils (1R21.3.b.(1))

05000331/2008006-02 NCV Inadequate Calculations/Analyses and Testing for TOLs on Safety-Related MOVs (1R21.3.b.(2))

05000331/2008006-03 NCV Failure to Periodically Test Reactor Protection System Key Lock Bypass Switches (1R21.6.b.(1))