IR 05000338/2012007

IR 05000338-12-007 & 05000339-12-007, 05/21/2012 - 08/15/2012; North Anna Power Station - NRC Component Design Bases Inspection

ML12269A465
Person / Time
Site:	North Anna
Issue date:	09/25/2012
From:	Nease R NRC/RGN-II/DRS/EB1
To:	Heacock D Virginia Electric & Power Co (VEPCO)
References
IR-12-007
Download: ML12269A465 (51)

Text

UNITED STATES ber 25, 2012

SUBJECT:

NORTH ANNA POWER STATION - NRC COMPONENT DESIGN BASES INSPECTION - INSPECTION REPORT 05000338/2012007 AND 05000339/2012007

Dear Mr. Heacock:

On, August 15, 2012, U. S. Nuclear Regulatory Commission (NRC) completed an inspection at your North Anna Power Station, Units 1 and 2. The enclosed inspection report documents the inspection results, which were discussed on August 15, 2012, with Mr. Oppenhimer and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your licenses. The team reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents five NRC identified findings of very low safety significance (Green),

which were determined to involve violations of NRC requirements. The NRC is treating these violations as non-cited violations consistent the NRC Enforcement Policy. If you contest these non-cited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at North Anna. Further, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at North Anna. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its Enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Rebecca L. Nease, Chief Engineering Branch 1 Division of Reactor Safety Docket No. 50-338 and 50-339 License No. NPF-4 and NPF-7

Enclosure:

Inspection Report 05000338/2012007 and 05000339/2012007,w/Attachment:

Supplemental Information

REGION II==

Docket Nos: 05000338, 05000339 License Nos: NPF-4 & NPF-7 Report Nos: 05000338/2012007 and 05000339/2012007 Licensee: Virginia Electric and Power Company (VEPCO)

Facility: North Anna Power Station, Units 1 & 2 Location: 1022 Haley Drive Mineral, Virginia 23117 Dates: May 21 - August 15, 2012 Inspectors: Jason Eargle, Senior Reactor Inspector (Lead)

Patrick Heher, Senior Construction Project Inspector Alejandro Alen, Reactor Inspector Rodney Fanner, Reactor Inspector Kenneth Schaaf, Operations Engineer T.C. Su, Reactor Inspector (Training)

George Skinner, Accompanying Personnel Terry Tinkel, Accompanying Personnel Approved by: Rebecca Nease, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000338, 339/2012007; 05/21/2012 - 08/15/2012; North Anna Power Station, Units 1 & 2;

Component Design Bases Inspection.

This inspection was conducted by a team of six Nuclear Regulatory Commission (NRC)inspectors from Region II, and two NRC contract personnel. Five Green non-cited violations (NCV) were identified. The significance of most findings is indicated by their color (Green,

White, Yellow, Red) using the NRC Inspection Manual Chapter (IMC) 0609, Significance Determination Process, (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, (ROP) Revision 4, dated December 2006.

NRC identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of 10 CFR 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings for the licensees failure to develop an adequate test procedure which demonstrated that the quench spray and outside recirculation spray pumps discharge check valves were capable of performing their design basis function. The licensee entered this issue into their corrective action program as condition report 479661.

The licensees failure to develop an adequate test procedure which demonstrated that the quench spray and outside recirculation spray pumps discharge check valves were capable of performing their design bases functions was a performance deficiency. This performance deficiency was more than minor because it was associated with the procedure quality attribute of the mitigating system cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to measure the torque required to cycle the check valves and compare these with established limits could result in the failure to detect degraded valve performance and prevent it from performing as designed. In accordance with Nuclear Regulatory Commission Inspection Manual Chapter 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance Determination Process screening and determined the finding to be of very low safety significance (Green) because it was not a design deficiency, did not represent the loss of a system safety function, did not result in exceeding a Technical Specification allowed outage time, and did not screen as potentially risk-significant due to a seismic, flooding, or severe weather initiating event. The team identified a cross-cutting aspect in the decision making component of the human performance area H.1(b). [Section 1R21.2.3]

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to implement design control measures involving two examples. In the first example, the licensee failed to translate the updated final safety analyses report single failure design bases criteria into the service water (SW) air system specifications. In the second example, the licensee failed to verify the SW air system receiver capacity was adequate to support its design basis function. The licensee entered these issues into their corrective action program as condition reports 477213, 478531, 478957, and 478137.

The licensees failure to establish design control measures to translate the updated final safety analyses report single failure design basis criteria into SW air system specifications and failure to verify or check the adequacy of the SW air receiver capacity was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, if the screen wash system was required to mitigate the effects of a severe weather initiating event, the performance deficiency could have resulted in a common mode failure of the SW system. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance Determination Process screening and determined that a Phase 3 assessment was required because the finding screened as potentially risk-significant due to a severe weather initiating event which could plug the SW traveling screens requiring the screen wash function. A bounding Significance Determination Process Phase 3 analysis was performed by a regional senior risk analyst which determined the performance deficiency was a Green finding of very low safety significance. The finding was reviewed for cross-cutting aspects and none were identified since the performance deficiency was not indicative of current licensee performance. [Section 1R21.2.9]

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, for the licensees failure to test the Service Water (SW) air subsystem capability to perform its design bases function. Specifically, the licensee was not testing the air receiver inlet valves (1-SW-343 and 1-SW-105), or system integrity to ensure the systems capability to maintain header pressure without crediting the non-safety related air compressors. The licensee entered this issue into their corrective action program as condition report 478568.

The licensees failure to test the safety related SW air systems capability to maintain adequate header pressure when the SW air compressors are not available was a performance deficiency. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to perform testing of the SW air system resulted in a lack of reasonable assurance of the systems capability to maintain adequate header pressure and could have resulted in a premature or complete loss of the screen wash system. If the screen wash system was required to mitigate the effects of a severe weather initiating event, the performance deficiency could have resulted in a common mode failure of the SW system. In accordance with Nuclear Regulatory Commission Inspection Manual Chapter 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance

Determination Process screening and determined that a Phase 3 assessment was required because the finding screened as potentially risk-significant due to a severe weather initiating event which could plug the SW travelling screens requiring the screen wash function. A bounding Significance Determination Process Phase 3 analysis was performed by a regional senior risk analyst which determined the performance deficiency was a Green finding of very low safety significance. The finding was reviewed for cross-cutting aspects and none were identified since the performance deficiency was not indicative of current licensee performance. [Section 1R21.2.9]

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to verify the adequacy of thermal overload relay settings for motor operated valves and continuous duty motors. The licensee entered this issue into their corrective action program as condition reports 479217, 479281, 479535, 479552, and 480755.

The licensees failure to verify or check the adequacy of thermal overload relay settings for motor operated valves and continuous duty motors was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, there was reasonable doubt as to whether safety related motors would continue to operate without tripping during design basis conditions. In accordance with Nuclear Regulatory Commission Inspection Manual Chapter 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance Determination Process screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to have resulted in the loss of operability or functionality. The team identified a crosscutting aspect in the corrective action program component of the problem identification and resolution area P.1(c). [Section 1R21.3]

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, involving two examples. In the first example, the licensee failed to ensure that appropriate acceptance criteria was included in procedures for testing motor control center thermal overload relays. In the second example, the licensee failed to ensure that testing was accomplished in accordance with the procedures. The licensee entered these issues into their corrective action program as condition reports 479217, 479281, 479535, 479552, and 480755.

The licensees failure to ensure that appropriate criteria was included in procedures for testing motor control center thermal overload relays, and the failure to ensure that testing was accomplished in accordance with the procedures was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Procedure Quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, there was reasonable doubt as to whether safety related motors would continue to operate without tripping during design basis conditions. In accordance with Nuclear Regulatory Commission Inspection Manual Chapter 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance Determination Process screening and determined the finding to be of very low safety significance (Green) because it was not a design deficiency, did not represent the loss of a system safety function, did not result in exceeding a TS allowed outage time, and did not screen as potentially risk-significant due to a seismic, flooding, or severe weather initiating event. The team identified a crosscutting aspect in the work practices component of the human performance area H.4(b). [Section 1R21.3]

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk significant components and related operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1 X10-6. The sample included 14 components, including two associated with containment large early release frequency, and six operating experience items.

The team performed a margin assessment and a detailed review of the selected risk-significant components and operator actions to verify that the design bases had been correctly implemented and maintained. Where possible, this margin was determined by the review of the design basis and Updated Final Safety Analysis Report (UFSAR)response times associated with operator actions. This margin assessment also considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Regulatory Issue Summary 05-020 (formerly Generic Letter 91-18) conditions, NRC resident inspector input regarding problem equipment, system health reports, industry operating experience, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2.1 Thermal Barrier Heat Exchanger (1-RC-P-1A/B/C)

a. Inspection Scope

The team reviewed the plant Technical Specifications (TS), Updated Final Safety Analyses Report (UFSAR), System Design Bases Documents (SDBDs), and Piping And Instrumentation Drawings (P&IDs) to establish an overall understanding of the design bases of the thermal barrier heat exchangers for the Unit 1 Reactor Coolant Pumps A, B and C. The team reviewed system modifications over the life of the component to verify that they did not degrade the performance capability of the component. Design calculations and site procedures were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Operating procedures and alarm response procedures were reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions.

Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings were identified.

.2.2 Inside Recirculation Spray (IRS) Pumps (1-RS-P-1A and 1-RS-P-1B)

a. Inspection Scope

The team reviewed the plants TS, UFSAR, SDBDs, electrical drawings, and P&IDs to establish an overall understanding of the design bases of the Unit 1 IRS pumps. Design calculations (i.e., short-circuit analyses, net positive suction head (NPSH), vortex formation and prevention, and minimum pump performance requirements versus system total dynamic head) were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with inservice/equipment qualification life. The protective relaying schemes and calculations were reviewed to verify that the motor was adequately protected and verify that it was not susceptible to spurious tripping. The control circuits were reviewed to verify that the appropriate design requirements had been translated into the controls and interlocks for the pumps.

b. Findings

No findings were identified.

.2.3 Outside Recirculation Spray (ORS) Pumps (1-RS-P-2A and 1-RS-P-2B)

a. Inspection Scope

The team reviewed the plants TS, UFSAR, SDBDs, electrical drawings, and P&IDs to establish an overall understanding of the design bases of the Unit 1 ORS pumps. Design calculations (i.e., short-circuit analyses, NPSH, vortex formation and prevention, and minimum pump performance requirements versus system total dynamic head) were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Modifications were reviewed to verify that the subject modifications did not degrade the components performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with inservice/equipment qualification life. The protective relaying schemes and calculations were reviewed to verify that the motor was adequately protected and verify that it was not susceptible to spurious tripping. The control circuits were reviewed to verify that the appropriate design requirements had been translated into the controls and interlocks for the pumps.

b. Findings

Introduction:

The team identified a green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to establish an adequate test procedure to demonstrate that the quench spray (QS) and ORS pumps discharge check valves were capable of performing their design bases functions. Specifically, the test procedure failed to measure the torque required to cycle the check valves and compare these with established limits, which could result in the failure to detect degraded valve performance and prevent it from performing as designed.

Description:

Units 1 and 2 QS and ORS systems have check valves 1/2-QS-11, 1/2-QS-19, 1/2-RS-18, and 1/2-RS-27 on the pumps discharge. These valves have both open and close safety-related functions. The valves open to provide the flow paths from the QS and ORS pumps to the respective spray ring header, and close to prevent back leakage and maintain containment integrity when the pumps are not running during design bases events. The check valves are located inside containment and are of the swing type with a weight-loaded balance arm design, which attaches weight-loaded levers (balance arms) on either side the valves hinge pin (external to the valve body).

The balance arms are installed at an angle that assists the close function of the valves.

The licensee used procedures, 1-PT-66.1, Weight-Loaded Check Valves, Rev 17 and 2-PT-66.1, Weight-Loaded Check Valves, Rev 16, to demonstrate the opening and closure functions of the check valves. The open function of the check valves is verified by having two operators pull on each side of the balance arms (mechanically exercising)to confirm the valves cycle through its full travel motion. Typically, the open function of check valves is verified under minimum design bases flow conditions to ensure the valves will perform their intended function, however, these valves are not part of the pumps test-loop flowpath and their open function is verified by mechanical exercitation.

The team identified the following deficiencies in the test procedure:

The team noted that the American Society of Mechanical Engineers Operation and Maintenance Code (code that establishes the in-service test requirements for mechanical components used in nuclear power plants) requires, for check valves that are mechanically exercised, measuring the force(s) or torque(s) needed to cycle the valves disc to fulfill its safety function (subsection ISTC-5220 Check Valves). Further, it states that the acceptance criteria shall be established by the licensee and shall detect, in part, binding of the disc throughout its full travel. The current test procedures did not establish limits nor measure the forces or torques required by the operators to successfully exercise the valves throughout its full motion of travel.

The team also noted the licensee had used another test procedure 1/2-PT-211.3, Valve In-Service Inspection for 1/2-QS-11, 1/2-QS-19, 1/2-RS-18, and 1/2-RS-27, in conjunction with 1/2-PT-66.1 up until August 2009, when it was superseded. This procedure provided instructions to measure the torques required to manually exercise the check valves and compare them with established limits, which met the Code requirements. On August 5, 2009, the licensee eliminated the use of 1/2-PT-211.3 on the assumption that 1/2-PT-66.1 met the same in-service test requirements, however, the licensee had no technical basis or evaluation that supported this assumption. The team concluded that the procedure for the QS and ORS discharge check valves was inadequate because verification of valve disc cycling without measuring the required torques could result in the failure to detect degraded valve performance and prevent it from supporting the design flow rates assumed in the safety analyses. This issue was entered into the licensees corrective action program (CAP) as condition report (CR)479661.

The licensee performed operability determination (OD) 000175, to review the work order history of 1/2-PT-211.3 back to 1994 (including most recent results prior to removal of the procedure). The review results indicated satisfactory valve performance with no evidence of negative trends. This provided reasonable assurance that, at the time of the inspection, the function of the check valves was not degraded.

Analysis:

The licensees failure to develop an adequate test procedure which demonstrated that the QS and ORS pumps discharge check valves were capable of performing their design bases functions was a performance deficiency. This performance deficiency was more than minor because it was associated with the procedure quality attribute of the mitigating system cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems to respond to initiating events to prevent undesirable consequences. Specifically, the failure to measure the torque required to cycle the check valves and compare these with established limits could result in the failure to detect degraded valve performance and prevent it from performing as designed. In accordance with Nuclear Regulatory Commission (NRC) Inspection Manual Chapter (IMC) 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance Determination Process (SDP) screening, and determined the finding to be of very low safety significance (Green) because it was not a design deficiency, did not represent the loss of a system safety function, did not result in exceeding a TS allowed outage time, and did not screen as potentially risk-significant due to a seismic, flooding, or severe weather initiating event. The team identified a cross-cutting aspect in the decision making component of the human performance area because the licensee failed to verify the validity of the assumption that procedure 1/2-PT-66.1 satisfied the same test requirements as the superseded procedure, 1/2-PT-211.3. H.1(b).

Enforcement:

Appendix B of 10 CFR Part 50, Criterion V, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances. Contrary to the above, since August 2009, the licensee failed to provide a procedure appropriate to the circumstances for testing the QS and ORS pumps discharge check valves. Specifically, the failure to measure the torques required to cycle the check valves and compare these with established limits could result in the failure to detect degraded valve performance and prevent the valves from performing as designed. Because this violation was determined to be of very low safety significance and has been entered into the licensees CAP as CR 479661, it is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000338 & 339/2012007-01, Failure to Develop an Adequate Procedure to Test the Quench Spray and Outside Recirculation Spray Pump Discharge Check Valves.

.2.4 High Head Safety Injection/Charging Pumps (2-CH-P-1A/B/C)

a. Inspection Scope

The team reviewed the plants TS, UFSAR, SDBDs, electrical drawings, and P&IDs to establish an overall understanding of the design bases of the Unit 2 High Head Safety Injection/Charging Pumps. Design calculations (i.e., short-circuit analyses, NPSH, vortex formation and prevention, and minimum pump performance requirements versus system total dynamic head) were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Modifications were reviewed to verify that the subject modifications did not degrade the components performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Operating procedures and alarm response procedures were reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Vendor documentation, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with inservice/equipment qualification life. The protective relaying schemes and calculations were reviewed to verify that the motor was adequately protected and verify that it was not susceptible to spurious tripping. The control circuits were reviewed to verify that the appropriate design requirements had been translated into the controls and interlocks for the pumps.

b. Findings

No findings were identified.

.2.5 Unit 2 Emergency Diesel Generator (EDG) Jacket Cooling Water System

a. Inspection Scope

The team reviewed the plants TS, UFSAR, SDBDs, and P&IDs to establish an overall understanding of the design bases of the Unit 2 EDG jacket cooling water system. In the absence of analytical analyses supporting parameter requirements, purchase specifications and test studies performed by the manufacturer were reviewed in order to verify the system would adequately remove heat from the EDG under accident conditions. Modifications were reviewed to verify that the subject modifications did not degrade the components performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions.

Operating and maintenance procedures in preparation for cold and warm weather conditions were reviewed to verify that system alignments and cooling medium properties were consistent with design and licensing bases assumptions. Test procedures and cooling parameters trending data results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings were identified.

.2.6 Alternate Alternating Current (AAC) Diesel

a. Inspection Scope

The team reviewed the plant TS, Technical Requirements Manual, UFSAR, SDBDs, electrical drawings, and P&IDs to establish an overall understanding of the design bases of the air start, fuel oil, heat removal systems, and electrical systems of the AAC Diesel Generator (DG). Design calculations (i.e., fuel oil day tank volume, and electrical loading) were reviewed to verify the design bases and design assumptions had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. Operating procedures were reviewed to verify that component operation and alignment were consistent with design and licensing bases assumptions. Test procedures and results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life. Maintenance rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current MR status. Completed alignment procedures were reviewed to verify elementary schematic positions were consistent with control switch development drawings and the AAC design requirements. A walkthrough of the procedure to place the AAC DG in parallel with the various transfer busses was performed, and various operations of the AAC DG on the plant reference simulator were reviewed to verify that required operator actions could be completed within specified times.

b. Findings

No findings were identified.

.2.7 Unit 1 Pressurizer Power Operated Relief Valves (1-RC-PCV-1456 and 1-RC-PCV-

1455C)

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, and P&IDs to establish an overall understanding of the design bases of the Unit 1 pressurizer power operated relief valves.

Design calculations (i.e. valve stem thrust, air operated valve (AOV) actuator capability, and accumulator sizing) were reviewed to verify the design bases and design assumptions had been appropriately translated into these documents. Operating procedures were reviewed to verify that component operation and alignment were consistent with design and licensing bases assumptions. Test procedures and results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life. Walkdowns of the main control room were completed to verify the adequacy of the indicators and control switches used to operate the valves.

b. Findings

No findings were identified.

.2.8 Unit 2 Low Head Safety Injection Pumps (2-SI-P-1A and 2-SI-P-1B)

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, electrical drawings, and P&IDs to establish an overall understanding of the design bases of the Unit 2 LHSI pumps.

Design calculations (i.e., short-circuit analyses, NPSH, vortexing, and system head loss)were reviewed to verify the design bases and design assumptions had been appropriately translated into these documents. Operating procedures were reviewed to verify that component operation and alignment were consistent with design and licensing bases assumptions. Test procedures and results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions.

The protective relaying schemes and calculations were reviewed to verify that the motor was adequately protected and verify that it was not susceptible to spurious tripping. The control circuits were reviewed to verify that the appropriate design requirements had been translated into the controls and interlocks for the pumps.

b. Findings

No findings were identified.

.2.9 Unit 1 and 2 Service Water (SW) Screen Wash Subsystem including Screen Wash

Pump 1-SW-P-2, Screen Wash Strainer 1-SW-S-3, and Traveling Screen 1-SW-S-1A

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, electrical drawings, and P&IDs to establish an overall understanding of the design bases of the Unit 1 and 2 SW Screen Wash Subsystem. Design calculations (i.e., NPSH) were reviewed to verify the design bases and design assumptions had been appropriately translated into these documents.

Operating procedures were reviewed to verify that component operation and alignment were consistent with design and licensing bases assumptions. Test procedures and results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

Maintenance rule information was reviewed to verify that the component was properly scoped, and that appropriate preventive maintenance was being performed to justify current maintenance rule status. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. A walkdown of selected procedures was performed with plant operators to verify the adequacy and timeliness of operator actions to provide an alternate method of washing the SW traveling screens.

b.1 Findings

Introduction:

The team identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to implement design control measures involving two examples. In the first example, the licensee failed to translate the UFSAR single failure design bases criteria into the SW air system specifications. In the second example, the licensee failed to verify the SW air system receiver capacity was adequate to support its design basis function.

Description:

The team identified two examples of a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control:

Example 1: Failure to translate the UFSAR single failure design bases criteria into the SW air system specifications North Annas Units 1 and 2 SW system has a safety-related screen wash subsystem with the function to wash the SW traveling water screens that filter the reservoir water before it enters the SW pumps suction bays. The SW system has four pumps, and each has a dedicated traveling screen and suction bay. The screen wash system consists of two pumps that take suction from its associated unit SW pump suction bay.

The pumps discharge into a common header that supplies four lines, with each line leading to one of four spray nozzles used to wash the screens. Water to the spray nozzle is isolated by AOVs (1-SW-TV-100A/B and 2-SW-TV-200A/B) that requires air to open. The air is provided by the SW air subsystem, which also provides air to the traveling water screen differential level instrumentation. The level instrumentation controls automatic operation of the screen wash system and feeds a differential level alarm in the main control room.

The team noted that UFSAR Section 9.2.1.1, stated, The SW system is design to support a design-bases-accident, while remaining capable of withstanding a single active component failure without requiring operator action. The team also noted that the SW air system supply header is common to all screen wash system AOVs and that a single failure of any one of multiple SW air subsystem components (i.e. check valves and solenoid valves throughout the system) would result in the failure of the air system.

As a result of the teams observations, the licensee initiated CR 477213 and 478531 and determined that a single active failure of multiple components in the SW air system could result in a failure of the SW screen wash system. The licensee performed OD 000484 and determined that a loss of air pressure would be alarmed in the main control room and the associated alarm response procedure (1-AR-K-G5, Rev 2) called for swapping service water pumps in the event of a clogged screen. The licensee also indicated that operating procedure, 0-OP-49.9, Use of FP-P-2 to Wash Service Water Screens, Rev 0, provided instructions to manually wash the traveling screens using a combination of fire hoses and the non-safety related diesel-driven fire pump located adjacent to the screens inside the service water pump house.

The team noted the following regarding the ARP and OP:

(1) no direct means were available to determine if the screens were clogged;

(2) indications of a debris-loaded reservoir and cavitation of the SW pumps would be the only means of determining if a screen was clogged (this could be too late to prevent pump damage);

(3) swapping to a different SW pump will not preclude eventual clogging of its screen; and

(4) procedure 0-OP-49.9 was not referenced in the ARP. The licensee revised the initial OD and modified procedure 1-AR-K-G5 to include operator actions to rotate and inspect the traveling screens for debris, to use procedure 0-OP-49.9 to wash debris from the traveling screens, and to monitor SW system parameters for evidence of reduced flow and the SW reservoir for an increase in debris. The team determined that a severe weather initiating event of high wind conditions (i.e. tornado) that deposits sufficient debris in the reservoir coincident with a loss of SW air (due to a single active failure)could have resulted in a common mode failure of the SW system.

Example 2: Failure to verify or check the adequacy of the SW air receiver capacity The team requested the licensees calculation or analysis that verified the capacity of the SW air receiver tank (1-SW-TK-2) was sufficient to support a specific design bases mission time. The licensee was unable to locate a sizing calculation and could not provide additional design bases information with regards to the SW air system mission time.

During normal operations the SW air system is maintained pressurized by two non-safety-related air compressors, which cannot be credited to maintain SW air system header pressure during an accident. The team noted that while the licensee was not able to identify any documented mission time for the SW screen wash system specifically, the FSAR stated that the SW reservoir is adequate to provide sufficient cooling for at least 30 days. The team determined that the accumulators would not have sufficient capacity to ensure that the performance deficiency would not challenge the ability of the SW screen wash system to support the mission time of the ultimate heat sink.

As in example #1, the loss of the SW air system would render the screen wash system non-functional. The inadequate sizing of the SW screen wash system air receiver and loss of SW screen wash during a severe weather initiating event could represent a common mode failure vulnerability of the SW system. The licensee entered this issue into their corrective action program as CR 478137 and used OD 000484 as a basis for SW system operability.

Analysis:

The licensees failure to establish design control measures to translate the UFSAR single failure design basis criteria into SW air system specifications and failure to verify or check the adequacy of the SW air receiver capacity was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, if the screen wash system was required to mitigate the effects of a severe weather initiating event, the performance deficiencies could have resulted in a common mode failure of the SW system. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 SDP screening and determined that a phase 3 assessment was required because the finding screened as potentially risk-significant due to a severe weather initiating event which could plug the SW travelling screens requiring the screen wash function.

A bounding SDP Phase 3 analysis was performed by a regional senior risk analyst (SRA) using the latest North Anna Standardized Plant Analyses Risk model. An initiating event assessment was run for a weather-related loss of offsite power with loss of all SW traveling screens and circulating water (CW) due to debris plugging from severe weather storm debris. The failure probability of the SW screen wash system was set at 1E-1 and no recovery of SW was assumed. The severe weather initiator with potential for generating storm debris was set at 1E-4/year. The dominant sequence was a severe weather condition which was assumed to cause debris loading of the reservoir and plug the SW traveling screens and cause a loss of CW as well as a weather-related loss of offsite power. The sequence progressed to a loss of reactor coolant pump seal integrity leading to a small loss of coolant accident, with subsequent failure of decay heat removal leading to core damage. The increase in core damage frequency due to the performance deficiency was less than 1E-6/year, a Green finding of very low safety significance. The finding was reviewed for cross-cutting aspects and none were identified since the performance deficiency was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures shall be established to assure that the design bases are correctly translated into specifications, and that measures shall provide for verifying or checking the adequacy of design. Contrary to the above, since initial plant operation, the licensee failed to establish design control measures to 1) assure the single failure design basis criteria, as stated in the UFSAR, was correctly translated into design specifications of the SW air system, and 2) verify the adequacy of the SW air receiver capacity to ensure its capability of supporting the systems design basis function. Because this violation was determined to be of very low safety significance (Green) and has been entered into the licensees CAP as CRs 477213, 478137, 478531, and 478957 it is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000338, 339/2012007-02, Failure To Implement Design Control Measures For The Service Water Air Subsystem.

b.2 Findings

Introduction:

The team identified a green NCV of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to test the SW air subsystem capability to perform its design bases function. Specifically, the licensee was not testing the air receiver inlet valves (1-SW-343 and 1-SW-105), or system integrity to ensure the systems capability to maintain header pressure without crediting the non-safety related air compressors.

Description:

North Annas Units 1 and 2 SW system has a, safety-related, screen wash subsystem with the function to wash the SW traveling water screens which filter the reservoir water before it enters the SW pumps suction bays. The SW air system is provided to support operation of the screen wash system. Specifically, the SW air system supplies air to the air operated valves (1-SW-TV-100A/B and 2-SW-TV-200A/B)that isolate the screen wash water flowpath to the spray nozzles that backwash the screens. These valves are spring closed and require air to open. If they failed to open, no safety-related means of washing the screens would be available. The SW air system consists of two air compressors, two air dryers, one air tank receiver, and associated valves, piping, and fittings. The SW air system is safety-related, except for the compressor and dryer portion of the system. A check valve (1-SW-343) and a solenoid valve (1-SW-105), installed in parallel at the inlet of the air receiver, provide the safety-related/non safety-related interface of the system. These valves were designed to close and maintain adequate header pressure without being recharged by the air compressors.

While reviewing the tests performed on the SW air system the team identified that the licensee was not performing any testing of system integrity with the compressors isolated. This would be required to determine the performance capabilities of valves 1-SW-343 and 1-SW-105 to isolate and maintain system pressure, in addition to providing assurance of the system pressure boundary integrity. The inspectors determined the lack of testing resulted in a lack of reasonable assurance that the system could perform its design function of supporting screen wash system capability. Additionally, the team determined that the SW reservoir system could be vulnerable to debris loading during severe weather events. As a result of the teams observations the licensee initiated CR 478568 to determine the test requirements needed to demonstrate the systems capability of performing its design bases function.

The licensee performed OD 000484 and determined that a loss of air pressure would be alarmed in the main control room and the associated alarm response procedure (1-AR-K-G5, Rev 2) called for swapping service water pumps in the event of a clogged screen.

The licensee also indicated that it had an operating procedure, 0-OP-49.9, Use of FP-P-2 to Wash Service Water Screens, Rev 0, that provided instructions to manually wash the traveling screens using a combination of fire hoses and the non-safety related diesel-driven fire pump located adjacent to the screens inside the SW pump house.

The team noted the following regarding the ARP and OP:

(1) no direct means were available to determine if the screens were clogged;

(2) indications of a debris-loaded reservoir and cavitation of the SW pumps would be the only means of determining if a screen was clogged (this could be too late to prevent pump damage);

(3) swapping to a different SW pump will not preclude eventual clogging of its screen; and

(4) procedure 0-OP-49.9 was not referenced in the ARP. The licensee revised the initial OD and modified procedure 1-AR-K-G5 to include operator actions to rotate and inspect the traveling screens for debris, to use procedure 0-OP-49.9 to wash debris from the traveling screens, and to monitor SW system parameters for evidence of reduced flow and the SW reservoir for an increase in debris. The team determined that a severe weather initiating event of high wind conditions (i.e. tornado) that deposits sufficient debris in the reservoir coincident with a loss of SW air (due to a single active failure)could have resulted in a common mode failure of the SW system.

Analysis:

The licensees failure to test the safety related SW air systems capability to maintain adequate header pressure when the SW air compressors are not available was a performance deficiency. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to perform testing of the SW air system resulted in a lack of reasonable assurance of the systems capability to maintain adequate header pressure and could have resulted in a premature or complete loss of the screen wash system. If the screen wash system was required to mitigate the effects of a severe weather initiating event, the performance deficiency could have resulted in a common mode failure of the SW system. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 SDP screening and determined that a Phase 3 assessment was required because the finding screened as potentially risk-significant due to a severe weather initiating event which could plug the SW travelling screens requiring the screen wash function.

A bounding SDP Phase 3 analysis was performed by a regional SRA using the latest North Anna SPAR model. An initiating event assessment was run for a weather-related loss of offsite power with loss of all SW traveling screens and CW due to debris plugging from severe weather storm debris. The failure probability of the SW screen wash system was set at 1E-1 and no recovery of SW was assumed. The severe weather initiator with potential for generating storm debris was set at 1E-4/year. The dominant sequence was a severe weather condition which was assumed to cause debris loading of the reservoir and plug the SW traveling screens and cause a loss of CW as well as a weather-related loss of offsite power. The sequence progressed to a loss of reactor coolant pump seal integrity leading to a small loss of coolant accident, with subsequent failure of decay heat removal leading to core damage. The increase in core damage frequency due to the performance deficiency was less than 1E-6/year, a Green finding of very low safety significance. The finding was reviewed for cross-cutting aspects and none were identified since the performance deficiency was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion XI, Test Control, requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures. Contrary to the above, since initial plant operation the licensee failed to identify and perform testing to assure the SW air subsystem was capable of performing its design bases function. Specifically, the failure to perform testing of the SW air system boundary valves and system integrity resulted in a lack of reasonable assurance in the systems capability to maintain header pressure and could have resulted in a premature or complete loss of the screen wash system. Because this violation was determined to be of very low safety significance (Green) and was entered into the licensees CAP as CR 478568 it is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000338, 339/2012007-03, Inadequate Testing of the SW Air System.

.2.10 Motor Driven Auxiliary Feedwater Pressure Control Valves (1-FW-PCV-159A/B)

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, and P&IDs to establish an overall understanding of the design bases of the Unit 1 Auxiliary Feed Water system PCVs.

Design calculations (i.e., total dynamic head, actuator/air bottle sizing, differential pressure, and containment integrity analysis for main steam line break) were reviewed to verify that the design bases and design assumptions associated with the pressure control valves had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. Operating procedures were reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented.

b. Findings

No findings were identified.

.2.11 125Vdc Vital Batteries Unit 1 and Unit 2

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, electrical drawings, and electrical standards to establish an overall understanding of the design bases of the Unit 1 and 2 125Vdc vital batteries. Design calculations (i.e. voltage drop calculations and battery loading calculations) were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. Operating procedures were reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented.

b. Findings

No findings were identified.

.2.12 4160V Buses 2H and 2J

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, electrical drawings, and electrical standards to establish an overall understanding of the design bases of the 2H and 2J 4160V Buses. Design calculations (i.e. bus loading calculations, degraded voltage setpoint calculations) were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. The degraded voltage protection scheme, fast bus transfer scheme, and overcurrent protection scheme were reviewed to verify their ability to meet the design and licensing bases assumptions. Vendor documentation, system health reports, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented.

b. Findings

No findings were identified.

.2.13 4160V to 480V Substation Transformers 2H and 2J

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, electrical drawings, and electrical standards to establish an overall understanding of the design bases of the 2H and 2J 4160V to 480V transformers. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions.

Protective relaying schemes and calculations were reviewed to whether the transformer was adequately protected and whether it was susceptible to spurious tripping. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented.

b. Findings

No findings were identified.

.2.14 480V Buses 2H, 2H1, 2J, and 2J1

a. Inspection Scope

The team reviewed the plant TS, UFSAR, SDBDs, electrical drawings, and electrical standards to establish an overall understanding of the design bases of the 2H, 2H1, 2J and 2J1 480V Buses. Design calculations (i.e. bus loading calculations, degraded voltage setpoint calculations) were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases functions under accident conditions and had been maintained to be consistent with design assumptions. The degraded voltage protection scheme and overcurrent protection scheme were reviewed to verify their ability to meet the design and licensing bases assumptions Vendor documentation, system health reports, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented.

b. Findings

No findings were identified.

.3 Corrective Actions

a. Inspection Scope

The team reviewed four issues identified during previous CDBIs to assess the effectiveness of the licensees corrective actions. The issues that received a detailed review by the team included:

• NCV05000338/2009007-01, Failure to Perform Periodic TOL Testing on Unit 1

• CR358489, MOV Spreadsheet Requires Control Enhancements

• CR358933, GL 89-10 MOV Calculation Methodology

• CR358809, EDG Tornado Calculation Error b.1 Findings

Introduction:

The team identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to verify the adequacy of thermal overload (TOL) relay settings for motor operated valves (MOVs) and continuous duty motors.

Description:

The team identified examples of design control issues involving TOL settings for continuous duty motors, and TOL settings for MOVs. Each will be discussed separately below.

TOL settings for continuous duty motors: The team requested the design calculation or other verified information that documented the settings or the adequacy of the design of the TOLs for continuous duty motors. The licensee provided Engineering Transmittal CEE 01-0013, which was performed to provide a quantitative analysis of the TOL settings for continuous duty motors for lower operating voltages. Additionally, the licensee stated that actual TOL settings were recorded in various work orders associated with routine motor control center scheduled maintenance. The team noted that the Engineering Transmittal only evaluated the overcurrent protection for bus 2H and was not intended to document the design for the entire station, or to be maintained in current state. This concern was partially addressed when the licensee performed reevaluations as a result of CR 463721 (written to investigate whether North Anna was susceptible to TOL setting deficiencies found during a recent CDBI at Surry).

The team observed that the re-evaluations done as a result of CR 463721 were incomplete because they did not evaluate motors for tripping when subjected to voltage afforded by the loss of voltage relays, and did not evaluate the potential for increased current under maximum load conditions. Additionally, the team observed that the licensee used a non-conservative current multiplier to account for voltage afforded by the degraded voltage relays for motors with a 1.0 service factor. Based on these observations, the team determined that the licensees design control measures to verify the adequacy of the design of the TOLs for continuous duty motors was inadequate. In response to the teams concerns, the licensee issued CRs 479535, 479552, 479658, 480754, initiated apparent cause evaluation (ACE) 019183, and performed additional evaluations to provide reasonable assurance of operability pending resolution.

TOL settings for MOVs: The team determined that Calculations EE-0557 and EE-0506 for MOV TOL sizing did not adequately address the potential for tripping of TOLs at the onset of an accident under degraded voltage conditions, and did not take into account tolerances associated with relay tripping characteristics. The licensee is committed to Regulatory Guide (RG) 1.106, Revision 1, Thermal Overload Protection For Electric Motors On Motor-Operated Valves. This RG specified methods acceptable to the NRC staff to ensure, that TOLs would not needlessly trip, thus preventing the MOVs from performing their safety-related functions. The RG allowed the licensee to either bypass the TOLs during a design basis event or leave the TOLs in the MOV circuits continuously, provided that they were sized properly and periodically tested. The licensee chose to leave the TOLs in the MOV circuits continuously and prepared Calculations EE-0557 and EE-0506 for sizing the TOLs. The team noted that these calculations did not evaluate whether the TOLs could trip if voltage was too low to start the MOVs at the onset of an accident. If the MOVs stalled, they could draw locked rotor current for the duration of the degraded voltage time delay (9 seconds maximum) before the safety buses were transferred to the emergency diesel generators. In addition, the calculation did not consider the effect of the tolerances on TOL tripping times. These were specified in vendor manual NA-VTM-000-59-K408-F0003 as 105% to 115% of trip setting for long term minimum tripping current, and +/- 20% of expected tripping time for higher currents. In response to the teams concerns, the licensee initiated CRs 479281 and 479664, and performed evaluations for several MOVs to determine whether they would be susceptible to spurious tripping, considering the factors identified by the team.

Based on these preliminary evaluations, the licensee concluded that the MOVs would either not stall based on minimum bus voltage afforded by the undervoltage scheme, or would not trip within the maximum time delays of the undervoltage protection scheme before transfer of the safety buses to the emergency diesel generators, thereby providing reasonable assurance of operability.

Analysis:

The team determined that the failure to verify or check the adequacy of thermal overload relay settings for MOVs and continuous duty motors was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Design Control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, there was reasonable doubt whether safety related motors would continue to operate without tripping during design basis conditions. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to have resulted in the loss of operability or functionality.

The team identified a crosscutting aspect in the corrective action program component of the problem identification and resolution area because the licensee failed to thoroughly evaluate the problem when similar issues were identified when North Anna performed corrective actions as a result of a finding on the 2011 Surry CDBI P.1(c).

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, since February 2012, the licensees design control measures failed to verify the adequacy of the design of TOL settings for continuous duty motors and MOVs.

Because this violation was determined to be of very low safety significance (Green) and has been entered into the licensees CAP as CRs 479664, 479658, 479535, 479552, 480754, and 480755 it is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000338, 339/2012007-04, Inadequate Design Control Measures for Thermal Overload Relays.

b.2 Findings

Introduction:

The team identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, involving two examples. In the first example, the licensee failed to ensure that appropriate acceptance criteria was included in procedures for testing motor control center TOL relays. In the second example, the licensee failed to ensure that testing was accomplished in accordance with the procedures.

Description:

The team identified two examples of procedural violations:

Example 1: Inadequate Criteria in Thermal Overload Relay (TOL) Test Procedures:

Test methods and criteria for TOLs are provided in preventive maintenance procedure 0-EPM-0307-01, Testing of Thermal Overloads, and corrective maintenance procedure 0-ECM-0307-01, Replacement of Thermal Overload Devices. The procedures provide for two types of tests for TOLs; a trip avoidance test based on full load current, and a trip time test at 300% of full load current.

For continuous duty motors, the procedures direct the test crew to calculate the required test currents by multiplying the nameplate full load current by either 1.19 for motors with service factors of 1.15 and above, and by 1.07 for motors with service factors below 1.15. These multipliers were based on guidance in engineering standard STD-EEN-0011, Standard for Protective Device Settings, and were intended to account for increased current during degraded voltage conditions. The team noted that since current increases proportionally with a decrease in voltage, a multiplier of 1.07 was not adequate to account for the minimum voltage typically allowed for running motors, 90%

of rated voltage. The team further noted that calculation EE-0373, 4160V Degraded Voltage and Loss of Voltage Relay Safety Limits, identified that some motors could be subjected to voltage as low as 84%, which would result in even larger increases in motor running current, so that even if a TOL relay passed the full load current test, it could still trip under postulated degraded voltage or maximum load conditions. In response to this concern, the licensee initiated CRs 479535, 479552, and 480755, and performed an evaluation of 8 safety related motors with a service factor of 1.0 for which the 1.07 multiplier had been applied when determining the TOL settings. Although two travelling screen wash motors were determined to be close in margin and warranting consideration as margin management issues, all were found to be acceptable (i.e., not likely to trip).

The team also noted that the time delay acceptance criteria for the 300% current test did not agree with the characteristic curves provided for some TOLs in vendor manual NA-VTM-000-59-K408-F0003, which stipulated a tripping time tolerance of +/-20% of the curve values. For example, the tripping time acceptance criteria for the Z00-10 type relay given in procedure 0-ECM-0307-01 was 16 to 38 seconds whereas the expected tripping time based on the curve in the vendor manual was approximately 23 to 34 seconds. The team was concerned that test results outside the expected +/-20%

tolerance provided by the vendor would indicate a malfunctioning relay and that the wide range of tripping time variation allowed in the procedure could result in spurious tripping under maximum load or degraded voltage conditions, and had not been accounted for in design calculations. In response to the teams concerns, the licensee initiated CR479281and evaluated test results for several MOVs to determine whether they could trip faster than expected, as determined in the design calculations. The licensee concluded that three MOV circuits would trip faster than determined in the calculations, but were still acceptable from an operability standpoint.

Example 2: Procedure Compliance The team determined that the 300% current tripping time test result for the charging pump suction from the refueling water storage tank isolation valve (CH-MOV-1115B),reported in work order 59102073031 performed on 8/12/10 was outside the acceptance band of the maintenance procedure, but the result was marked SAT (satisfactory).

The valve is required to open during safety injection and to close during accident recovery. Procedure 0-ECM-0307-01, Replacement of Thermal Overload Devices, Rev. 23 required a tripping time of 16 to 90 seconds for the Z00 type relay, but the actual test time was 13.4 seconds. This was below the procedure criteria of 16 seconds which was non-conservative with respect to spurious tripping vulnerability. As noted above, the tripping time criteria in maintenance procedures was also non-conservative but the failure to meet even this criteria raised concerns regarding the susceptibility of the MOV to spurious tripping under design basis conditions, such as degraded voltage that could cause the MOV to stall while the degraded voltage relay timed out for 9 seconds maximum. In response to this concern, the licensee initiated CR 479217, ACE 019179, and OD 000487 to evaluate this condition. The OD determined that, based on preliminary torque calculations, the MOV was not likely to stall and draw locked rotor current, even at the very low voltage afforded by the Loss of Voltage relays. The licensee therefore determined that the MOV was degraded but operable and required replacement of the relay to restore full qualification.

Analysis:

The licensees failure to ensure that appropriate criteria was included in procedures for testing motor control center TOL relays, and the failure to ensure that testing was accomplished in accordance with the procedures was a performance deficiency. The performance deficiency was determined to be more than minor because it was associated with the Procedure Quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, there was reasonable doubt as to whether safety related motors would continue to operate without tripping during design basis conditions. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was not a design deficiency, did not represent the loss of a system safety function, did not result in exceeding a TS allowed outage time, and did not screen as potentially risk-significant due to a seismic, flooding, or severe weather initiating event. The team identified a crosscutting aspect in the work practices component of the Human Performance area, because the licensee did not define and effectively communicate expectations regarding procedural compliance and personnel did not follow procedures H.4(b).

Enforcement:

10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings, and that instruction procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Contrary to the above, since August 2010, the licensee failed to ensure that appropriate acceptance criteria was included in procedures for testing motor control center TOL relays, and failed to ensure that testing was accomplished in accordance with the procedures. Because this violation was determined to be of very low safety significance (Green) and has been entered into the licensees CAP as CRs 479217, 479281, 479535, 479552, and 480755, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000338, 339/2012007-05, Inadequate Procedures and Procedure Compliance For Thermal Overload Relay Testing.

.4 Operating Experience (Six Samples)

a. Inspection Scope

The team reviewed six operating experience issues for applicability at North Anna Power Station. The team performed an independent review for these issues and where applicable, assessed the licensees evaluation and dispositioning of each item. The issues that received a detailed review by the team included:

• NRC Regulatory Issue Summary 2000-005, Resolution of Generic Safety Issue 165, Spring-Actuated Safety and Relief Valve Reliability

• NRC Information Notice 2006-22, New Ultra-Low-Sulfur Diesel Fuel Oil Could Adversely Impact Diesel Engine Performance

• NSAL-09-8, Presence of Vapor in Emergency Core Cooling System/Residual Heat Removal System in Modes 3 and 4 Loss-of-Coolant Accident Conditions

• NRC Information Notice 87-08, Degraded Motor Leads in Limitorque DC Motor Operators

• NRC Information Notice 97.21, Availability of Alternate AC Power Source Designated for Station Blackout Event

• NRC Information Notice 2009-10, Transformer Failures - Recent Operating Experience

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

On August 15, 2012, the team presented the inspection results to Mr. Oppenhimer and other members of the licensees staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed in accordance with prescribed controls.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

G. Bischof, Site Vice President

M. Crist, Plant Manager

D. Taylor, Supervisor, Station Licensing

J. Leberstien, Technical Consultant Licensing

R. Garver, Manager, Design Engineering

M. Oppenhimer, Manager, System & Component Engineering

NRC personnel

R. Nease, Chief, Engineering Branch Chief 1, Division of Reactor Safety, Region II

G. McCoy, Chief, Project Branch 5, Division of Reactor Project, Region II

J. Eargle, Senior Reactor Inspector, Division of Reactor Safety, Region II

G. Kolcum, Senior Resident Inspector, Division of Reactor Projects, North Anna Resident Office

R. Clagg, Resident Inspector, Division of Reactor Projects, North Anna Resident Office

LIST OF ITEMS

Opened and Closed

05000338, 339/2012007-01 NCV Failure to Develop an Adequate Procedure to Test the Quench Spray and Outside Recirculation Spray Pump Discharge Check Valves (Section 1R21.2.3)

05000338, 339/2012007-02 NCV Failure To Implement Design Control Measures For The Service Water Air System (Section 1R21.2.9)

05000338, 339/2012007-03 NCV Inadequate Testing of the SW Air System (Section 1R21.2.9)

05000338, 339/2012007-04 NCV Inadequate Design Control Measures for Thermal Overload Relays (Section 1R21.3)

05000338, 339/2012007-05 NCV Inadequate Procedures and Procedure Compliance For Thermal Overload Relay Testing (Section 1R21.3)