IR 05000361/2006009

From kanterella
Jump to navigation Jump to search
IR 05000361-06-009 & IR 362-06-009 on 06/26/06 - 11/30/06 for San Onofre Nuclear Generating Station: Baseline Inspection, NRC Inspection Procedure 71111.21, Component Design Basis Inspection
ML063420342
Person / Time
Site: San Onofre  Southern California Edison icon.png
Issue date: 12/08/2006
From: Clark J
Division of Reactor Safety IV
To: Rosenblum R
Southern California Edison Co
References
EA-06-245, FOIA/PA-2011-0221, FOIA/PA-2011-0157 IR-06-009
Download: ML063420342 (50)
v • d • e


Text

ber 8, 2006

SUBJECT:

SAN ONOFRE NUCLEAR GENERATING STATION - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000361;362/2006009

Dear Mr. Rosenblum:

On November 30, 2006, the US Nuclear Regulatory Commission (NRC) completed a component design bases inspection at your San Onofre Nuclear Generating Station. The enclosed report documents our inspection findings. The preliminary findings were discussed on July 20, 2006, with Mr. B. Katz and other members of your staff. After additional in-office inspection, a final telephonic exit meeting was conducted on November 30, 2006, with Mr. B. Katz and others of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed cognizant plant personnel.

Based on the results of this inspection, the NRC has identified five findings that were evaluated under the risk significance determination process. Violations were associated with all of the findings. All five of the findings were found to have very low safety significance (Green) and the violations associated with these findings are being treated as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. In addition, a licensee identified violation which was determined to be of very low safety significance is described in the report. If you contest any of the noncited violations, or the significance of the violations you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the US Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, US Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the San Onofre Nuclear Generating Station.

Southern California Edison Company -2-In accordance with Code of Federal Regulations, Title 10, Part 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS)

component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Jeffrey A. Clark, Chief Engineering Branch 1 Division of Reactor Safety Dockets: 50-361;50-362 License: NPF-10; NPF-15

Enclosure:

Inspection Report 05000361;362/2006009 w/Attachments: 1 - Supplemental Information 2 - Final Determination of Significance, Foreign Material in Condensate Storage Tank Enclosure

REGION IV==

Docket: 50-361, 50-362 License: NPF-10, NPF-15 Report Nos.: 05000361/2006009 and 05000362/2006009 Licensee: Southern California Edison Company (SCE)

Facility: San Onofre Nuclear Generating Station, Units 2 and 3 Location: 5000 S. Pacific Coast Hwy.

San Clemente, California Dates: June 26 through November 30, 2006 Team Leader: G. Replogle, Senior Reactor Inspector, Engineering Branch 1 Inspectors: J. Drake, Operations Examiner, Operations Branch J. Reynoso, Reactor Inspector, Engineering Branch 1 M. Sitek, Resident Inspector, San Onofre Nuclear Generating Station Accompanying L. Ellershaw, PE, Consultant Personnel: G. Skinner, Electrical Engineer, Beckman and Associates W. Sherbin, Mechanical Engineer, Beckman and Associates Others: D. P. Loveless, Senior Reactor Analyst D. G. Passehl, Senior Reactor Analyst Approved By: J. Clark, PE, Chief Engineering Branch 1-1- Enclosure

SUMMARY OF FINDINGS

IR 05000361;362/2006009; June 26 through November 30, 2006; San Onofre Nuclear

Generating Station: baseline inspection, NRC Inspection Procedure 71111.21,

Component Design Basis Inspection.

The report covers an announced inspection by a team of three regional inspectors, three contractors and one resident inspector. Five findings were identified. All of the findings were of very low safety significance. The final significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609,

Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

NRC-Identified Findings

Cornerstone: Mitigating Systems; Barrier Integrity

Green.

The team identified a noncited violation of Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion V, Procedures, for the failure to follow procedural requirements and establish the Units 2 and 3 CST-120 condensate storage tank enclosures as foreign material exclusion areas. The team found several pieces of foreign material in each enclosure. Foreign materials in these areas could have caused auxiliary feedwater system operational problems following a seismic event. In addition, the licensee failed to properly address industry operating experience related to foreign materials in auxiliary feedwater system water sources. Finally, a related condensate storage tank sizing calculation failed to consider the potential for reactor vessel head void formation during the cooldown to shutdown cooling conditions. The licensee captured this finding in their corrective action program as Action Requests 060700471 and 0601000172.

The failure to follow plant procedures was a performance deficiency. This finding is more than minor because it affected the mitigating system cornerstone objective (equipment performance attribute) of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined that a Phase 3 significance determination was required because the finding screened as potentially risk significant due to a seismic initiating event.

Region IV senior risk analysts performed a Phase 3 significance determination and determined that the issue represents a finding of very low safety significance (Section 1R21.b.1).

Green.

The team identified a noncited violation of Technical Specification 5.5.1.a for an inadequate emergency diesel generator ground fault alarm response procedure. Specifically, the procedure had operators check for grounds associated with the emergency diesel generator itself but did not specify actions to address the more likely ground locations, which included components on the 4.16kV bus. Since other plant procedures permit cross-tying the safety-related buses on the opposite unit in the event of a loss of an emergency diesel generator, the failure to properly consider grounds in other locations could result in additional equipment failures. The licensee captured this finding in their corrective action program as Action Request 060700753.

The failure to provide an adequate alarm response procedure was a performance deficiency. This issue was more than minor because the procedure deficiency affected the mitigating system cornerstone objective (procedure quality attribute) of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Specifically, under certain circumstances, the emergency diesel generators may not have functioned following a seismic event. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the issue screened as having very low safety significance because the finding was not a design or qualification deficiency, did not result in a loss of safety function, and did not screen as potentially risk significant due to external events (Section 1R21.b.2).

Green.

The team identified a noncited violation of Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion III, Design Control, for the failure to properly calculate control circuit voltages associated with the Unit 3 motor-driven auxiliary feedwater Pump 3P504 breaker. Correcting the error used approximately 1/3 of the available design margin. The licensee captured this finding in their corrective action program as Action Request 060700765.

The failure to properly implement proper design controls was a performance deficiency. This issue was more than minor because, if left uncorrected, it could become a more significant safety concern.

Specifically, the noted calculations are used for operability determinations and plant modifications. Uncorrected errors could mask equipment operability issues. This issue was similar to non-minor violation Example 3.j in NRC Inspection Manual Chapter 0612, Appendix E, Examples of Minor Issues, because there was a reasonable doubt of the operability of the pump breaker. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the issue screened as having very low safety significance because it was a design deficiency confirmed not to result in loss-of-operability in accordance with NRC Manual Chapter Part 9900, Technical Guidance, Operability Determination Process for Operability and Functional Assessment (Section 1R21.b.3).

Green.

The team identified a noncited violation of the Code of Federal Regulations, Title 10, Part 50, Appendix B, Criterion XVI, Corrective Actions, for the failure to promptly identify a condition adverse to quality (trapped air in the safety injection suction lines). Each suction line contained approximately 11.5 cubic feet of trapped air, but the licensee's official design calculations assumed the lines were full of water.

Additionally, industry operating experience notified the licensee that air in the safety injection system suction lines could cause operational problems (a condition adverse to quality) but the licensee failed to promptly identify the condition at San Onofre Nuclear Generating Station. The licensee's engineering evaluation erroneously determined that San Onofre Nuclear Generating Station was not vulnerable to the condition identified in the operating experience. The licensee captured this finding in their corrective action program as Action Request 060700747.

The failure to promptly identify and correct a condition adverse to quality in response to applicable operating experience was a performance deficiency. This finding was more than minor because it affected the mitigating system cornerstone objective (equipment performance attribute)to ensure the reliability and capability of equipment needed to respond to initiating events. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the finding was of very low safety significance because it was a design deficiency confirmed not to result in loss-of-operability in accordance with NRC Manual Chapter Part 9900, Technical Guidance, Operability Determination Process for Operability and Functional Assessment. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that the licensee failed to thoroughly evaluate applicable industry operating experience concerning air voids in recirculation piping suction lines (Section 1R21.b.4).

Green.

The team identified a Code of Federal Regulations, Title 10, Part 50, Appendix B, Criterion XVI, Corrective Actions, violation for the failure to promptly identify a condition adverse to quality (Train A emergency diesel generators lost seismic qualification). The licensee had identified that a ground fault on a nonsafety-related uninterruptible power supply could cause the emergency diesel generator to trip during a fire but failed to further determine that the same scenario could occur during a seismic event. The licensee captured this finding in their corrective action program as Action Request 060600500.

The failure to promptly identify a condition adverse to quality was a performance deficiency. This finding is more than minor because it affected the mitigating system cornerstone objective (equipment performance attribute) of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, Train A emergency diesel generator operability was not assured for seismic events. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the internal events portion of the worksheet did not apply, because the finding only involved an external seismic event with a loss of offsite power.

Additionally, for external events, the finding screened as have very low safety significance because it did not involve the loss or degradation of equipment or function specifically designed to mitigate an external event (e.g., seismic snubbers, flooding barriers, tornado doors) and the safety function was not considered completely failed or unavailable, as the Train B emergency diesel generators were unaffected by the issue. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that engineers failed to perform an appropriate extent of condition review and promptly identify the nonconforming emergency diesel generators, a condition adverse to quality (Section 1R21.b.5).

Licensee-Identified Violations

.

A violation of very low safety significance, which was identified by the licensee, has been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensee's corrective action program. This violation and the applicable corrective actions are listed in Section 4OA7.

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. As plants age, their design bases may be difficult to determine and important design features may be altered or disabled during modifications. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Bases Inspection

Main article: IP 71111.21

The team selected risk-significant components and operator actions for review using information contained in the licensees probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than two or a Birnbaum value greater than 1E-6.

a. Inspection Scope

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists.

Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15-20 risk-significant and low design margin components, 3 to 5 relatively high-risk operator actions, and 4 to 6 operating experience issues. The sample selection for this inspection was 20 components, 5 operator actions, and 5 operating experience items.

The components selected for review were:

  • Unit 2, Battery 2D1, 125Vdc safety-related control power battery
  • Unit 2, (Center) component cooling water pump
  • Unit 2, 4kV safety-related Bus 20A4
  • Unit 2, Valve 2HV6212, Train A air-operated component cooling water system discharge valve to the non-critical loop
  • Unit 2, Valve 2HV6497, Train A motor-operated saltwater cooling discharge valve
  • Unit 3, condensate storage Tank CST-120
  • Unit 3, Train A, recirculation actuation signal circuitry
  • Unit 3, Train A, component cooling water heat exchanger
  • Unit 3, Train A, high pressure safety injection pump
  • Unit 3, Train A, Valve 3HV6500, air operated shutdown cooling heat exchanger discharge valve
  • Unit 3, Train B, charging pump
  • Unit 3, under-voltage relays
  • Unit 3, Valve 3HV6500, Train A air operated component cooling water shutdown cooling heat exchanger discharge valve
  • Unit 3, Valve 3HV9330, Train A motor-operated high pressure safety injection system valve to reactor coolant system Loop 2A
  • Unit 3, Valve 3HV9304, Train B, motor-operated safety injection suction valve, inboard containment isolation valve The selected operator actions were:
  • Provide makeup to condensate storage Tank CST-121 from demineralizer water tanks.
  • Provide makeup to condensate storage Tank CST-121 from condensate storage Tank CST-120.

The operating experience issues were:

  • Nuclear Safety Advisory Letter NSAL-04-7, Containment Sump Line Fluid Inventory, dated November 15, 2004

b. Findings

b.1 Failure to Follow Foreign Material Exclusion Controls

Introduction.

The team identified a Green noncited violation of the Code of Federal Regulations, Title 10, Part 50, Appendix B, Criterion V, Procedures, for the failure to follow procedural requirements and establish Units 2 and 3 CST-120 condensate storage tank enclosures as foreign material exclusion areas. Foreign materials in these areas could cause auxiliary feedwater system operational problems following a seismic event. In addition, the licensee failed to properly address industry operating experience related to foreign materials in auxiliary feedwater system water sources. Finally, a related condensate storage tank sizing calculation failed to address the potential for the formation of reactor vessel head voids during the cooldown to shutdown cooling conditions.

Description.

Each unit has two safety-related condensate storage tanks. The primary tanks (CST-121 on each unit) contain at least 144,000 gallons while the secondary tanks (CST-120) contain at least 360,000 gallons. The water is dedicated for use by the auxiliary feedwater system and the steam generators for accident mitigation. The two tanks combined provide sufficient water to mitigate design basis accidents and events and allow operation under hot standby conditions for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following a plant trip.

The team noted that the CST-120 condensate storage tanks were not seismically qualified. Instead, a seismically qualified concrete enclosure surrounds each tank.

The enclosures are open at the top. Following a seismic event, water from the CST-120 tanks is assumed to flow into the enclosures. Operators can gravity feed

water from the enclosures to the seismically qualified CST-121 condensate storage tanks. The team noted that any foreign materials left in the enclosures had the potential of being entrained in the auxiliary feedwater supply.

During plant walkdowns on July 11 and 12, 2006, the team identified several foreign material objects in the condensate storage Tank CST-120 enclosures for both units, as described below:

Unit 2

  • Two approximately 15 by 18 inch plastic signs tie wrapped to metal posts
  • Two cloth rags
  • Several loose nylon tie wraps
  • A small loose plastic bag Unit 3
  • Two approximately 15 by 18 inch plastic signs tie wrapped to metal posts
  • A loose nylon tie wrap
  • A small loose plastic bag The team determined that the licensee had not followed procedures related to foreign material controls. Specifically, Procedure SO123-FO-1, Site Foreign Material Exclusion Control Program, Revision 3, states, in part:

Foreign Material Exclusion Program provisions are to be applied to important-to-safety plant systems and components when exposed during . . . operation . . . Controls for foreign material exclusion SHALL be implemented to prevent the introduction of foreign material into mechanical or electrical equipment, components, or systems . . . foreign material exclusion controls SHALL provide for positive physical control and accountability of material, equipment, and tools to prevent their introduction into mechanical . . .

components or systems. . . .

Contrary to the above, prior to July 12, 2006, no foreign material controls were implemented for the condensate storage Tank CST-120 enclosures for Units 2 and

3. The failure to provide controls would allow foreign materials to be left in the

safety-related condensate storage tank enclosures and potentially block flow to and/or enter the auxiliary feedwater systems.

The team had two safety concerns:

  • The plastic signs were of sufficient size to block the sump openings, potentially restricting the flow of water to the auxiliary feedwater pumps.

The sump openings were approximately 19 inches square.

  • The auxiliary feedwater pump minimum flow lines have very small orifices (11/64 inch diameter). Some of the material could get into these lines and block one or more of the openings. Pump operability could be challenged during periods when the discharge to the steam generators is isolated or the pumps are running at shutoff head.

In addition to the above, the team identified that the licensee had not adequately evaluated operating experience associated with these types of issues. NRC Information Notice 2004-01, Auxiliary Feedwater Pump Recirculation Line Orifice Fouling - Potential Common Cause Failure, dated January 21, 2004, provided operating experience information to licensees, including San Onofre Nuclear Generating Station, regarding the potential for foreign materials to foul auxiliary feedwater minimum flow line orifices. Although the licensee utilized minimum flow line orifices similar (small holes, but not exactly the same size) as those specified in the information notice, the licensees evaluation (Action Request 040101393-1, dated March 23, 2004) of Information Notice 2004-01 inappropriately determined that the notice did not apply to San Onofre Nuclear Generating Station. The licensee reasoned that, because they used pure demineralized water in their condensate storage tanks, no foreign material could enter the system and foul the orifices. The licensee failed to properly consider all credited operating conditions, including those where water from the Tank CST-120 enclosures could be used for accident mitigation. Following a seismic event, foreign material in the San Onofre Nuclear Generating Station CST-120 enclosures could be transported to the auxiliary feedwater system and potentially foul the auxiliary feedwater minimum flow line orifices.

In response to the inspectors concerns, the licensee provided an evaluation to the NRC on August 27, 2006 that specified, in part, that Tank CST-120 was not necessary for accident mitigation because Tank CST-121 provided all the water necessary to respond to design basis accidents. In other words, the identification of foreign materials in the Tank CST-120 enclosure was not significant because operators could cool down the plant to shutdown cooling entry conditions without relying on the water in Tank CST-120. The licensee based this assertion on the Updated Final Safety Analysis Report, Section 9.2.6.1, which states, in part:

The Seismic Category I Condensate Storage Tank CST-121 has sufficient storage capacity to maintain a hot standby condition for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and to provide enough water to remove decay heat and to cooldown the reactor to 400E F, the temperature at which the shutdown cooling system can be used to remove decay heat.

Further, the licensee noted that Calculation M-0050-018, Evaluation of T-121 Requirements, dated February 4, 2000, concluded that Tank CST-121 could supply all the necessary water demands for design basis accidents, considering a 2-hour period of hot standby conditions followed by an immediate cooldown to 400E F. The calculation assumed a 75 EF per hour reactor coolant system cooldown rate.

The team identified that Calculation M-0050-018 did not demonstrate that Tank CST-121 could provide all necessary water following a design basis earthquake.

Specifically, the calculation did not address reactor vessel head steam voids that will occur (under natural circulation conditions) if operators cool down and depressurize the reactor vessel at the specified cooldown rate. While, post accident, it was possible to initially cooldown at the 75E F per hour cooldown rate, initiation of shutdown cooling was also dependent on reactor coolant system pressure. Operators could not cooldown at the specified cooldown rate and initiate shutdown cooling as indicated in the calculation without violating plant procedures.

For example, when operators attempted to cool down the plant at a sustained rate of 75E F per hour in the plant simulator (natural circulation conditions), reactor vessel steam voids formed. Operators were required by Emergency Operating

Instruction SO23-12-7, Loss of Forced Circulation/Loss of Offsite Power, Revision 19, Step 17.a to stop the cooldown and collapse the voids. This extended the simulator run time significantly, but the calculation did not account for this delay.

The initial recommended cooldown rate, as specified in Emergency Operating Instruction Support Document SO23-14-11, Attachment 1, Emergency Operating Instruction Supporting Attachments Bases and Deviation Justification, Revision 1, was only 35 to 40E F per hour for natural circulation conditions. This document also recommended a maximum cooldown rate of 50E F per hour during natural circulation.

The team also noted that the calculation did not properly consider operating experience related to reactor vessel head voiding. Generic Letter 81-21, Natural Circulation Cooldown, dated May 5, 1981, addressed the potential for steam voids to form under natural circulation cooldown conditions. The generic letter recommended that licensee procedures contain specific actions to avoid the formation of reactor vessel steam voids and to mitigate steam voids if they did occur. The licensee's response to the generic letter, dated October 21, 1981, stipulated, in part, that plant procedures would include precautions delineating the maximum cooldown rate to avoid head voiding.

Calculation M-0050-018 concluded that operators would take 5.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to achieve shutdown cooling conditions and that approximately 143,000 gallons of the 144,000 gallon Tank CST-121 capacity would be used. Since the calculation had virtually no margin for error, the inspectors concluded that the licensee did not have a reasonable basis to assume that Tank CST-121 could meet all design basis accident cooling needs.

In response to NRC concerns regarding the noted calculation and licensee's evaluation, the licensee revised their evaluation to specify that they could only achieve shutdown cooling initiation temperature (but not pressure) and wrote Action Request 0601000172 to evaluate the adequacy of Calculation M-0050-018.

Analysis.

The failure to follow plant procedures was a performance deficiency.

This finding is more than minor because it affected the mitigating system cornerstone objective (equipment performance attribute) of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined that a Phase 3 significance determination was required because the finding screened as potentially risk significant due to a seismic initiating event. Region IV senior reactor analysts performed a Phase 3 significance determination, which is included as Attachment 2 to this report. The senior reactor analysts found the issue to be of very low safety significance.

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion V, Procedures, requires, in part, that "Activities affecting quality shall be prescribed by documented . . . procedures . . . and shall be accomplished in accordance with these instructions." The exclusion of foreign materials from the condensate storage Tank CST-120 enclosures is an activity affecting quality.

Procedure SO123-FO-1, requires, in part, "Foreign Material Exclusion Program provisions are to be applied to important-to-safety plant systems and components when exposed during . . . operation . . . Controls for foreign material exclusion SHALL be implemented to prevent the introduction of foreign material into mechanical or electrical equipment, components, or systems . . . foreign material exclusion controls SHALL provide for positive physical control and accountability of

material, equipment, and tools to prevent their introduction into mechanical . . .

components or systems. . ." Contrary to the above, prior to July 12, 2006, the condensate storage Tank T-120 enclosures, on each unit, were exposed during plant operation to foreign materials, which could block flow to safety-related equipment and/or be transported into mechanical safety-related equipment and cause damage. The licensee failed to implement foreign material exclusion controls for the enclosures. The licensee captured this issue in their corrective action program as Action Request 060700471. Because this finding was of very low safety significance and has been entered into the licensees corrective action program (Action Request 060700765), it is considered a noncited violation consistent with Section VI.A.1 of the NRC Enforcement Policy:

NCV 05000361;362/2006009-01, Failure to Follow Procedures Addressing Foreign Material Exclusion.

b.2 Inadequate Procedure for Emergency Diesel Generator Ground Alarm

Introduction.

The team identified a Green noncited violation of Technical Specification 5.5.1.a for an inadequate emergency diesel generator ground fault alarm response procedure. Specifically, the procedure only had operators check for grounds associated with the emergency diesel generator itself and did not specify actions to address the more likely ground locations, which included components on the 4.16kV bus. Since other plant procedures permit cross-tying the safety-related buses on the opposite unit in the event of a loss-of-an emergency diesel generator, the failure to properly consider grounds in other locations could result in additional equipment failures.

Description.

In accordance with the Updated Final Safety Analysis Report, one of the non-essential emergency diesel generator trips is an electrical ground fault trip.

This trip is bypassed during a loss-of-coolant accident but is left intact for other events, including a loss-of-offsite power event.

On the safety-related 4.16kV buses, the licensee uses a high impedance grounding scheme. With this grounding configuration, a ground fault would not normally generate exceptionally high electrical currents but would, instead, increase the voltage across two phases of the emergency diesel generator by a factor of 1.73. The purpose of the ground fault trip is to limit generator exposure to this higher voltage, which could cause damage. Individual feeder breakers on the 4.16kV bus are not coordinated to isolate ground faults that might occur on individual components, so a ground fault anywhere on a 4.16kV train would result in tripping the associated emergency diesel generator.

The team identified that Alarm Response Instruction SO23-5-2.35.2, Diesel Generator Local Annunciator Panel L161 Alarm Response, Revision 5, was inadequate because it failed to provide appropriate instructions to operators in response to indication of a phase to ground fault on a 4.16kV bus. The procedural guidance was inappropriate because it only identified two causes for a ground fault: 1) generator phase to ground fault; and 2) generator leads phase to ground fault. Contrary to this guidance, when the diesel is supplying the 4.16kV bus, a ground anywhere on the supplied 4.16kV system can cause the emergency diesel to trip, not just on the generator itself. For example, a phase to ground fault associated with any of the emergency core cooling system pump motors, breakers and feeder cables could cause the associated emergency diesel generator to trip.

Furthermore, these alternative ground locations were much more likely to occur than those specified in the alarm response instruction.

The team was further concerned because plant procedures permit cross-tying the loads on one unit (due to a lost power source) to an energy source on the opposite unit. For example, an operating bases earthquake could cause a loss-of-offsite power on both Units 2 and 3. If the Unit 2, Train A emergency diesel generator tripped on a ground fault, operators could power the Unit 2, Train A loads from the Unit 3, Train A bus. If the ground fault actually existed on a Unit 2, Train A load, versus on the diesel generator itself, this would cause the Unit 3, Train A emergency diesel generator to trip unnecessarily.

Technical Specifications 5.5.1.a requires, in part, procedures recommended by Regulatory Guide 1.33, Appendix A. Section 5 of this appendix recommends procedures for abnormal, offnormal, or alarm conditions. Additionally, the appendix specifies for these types of procedures that the procedure contain, in part, the immediate operator actions and the long-range actions. These operator actions, in this case, were inadequate.

Analysis.

The failure to provide an adequate alarm response procedure was a performance deficiency. This issue was more than minor because the procedure deficiency affected the mitigating system cornerstone objective (procedure quality attribute) of ensuring availability, reliability, and capability of systems needed to respond to initiating events to prevent undesired consequences. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the issue screened as having very low safety significance because the finding was not a design or qualification deficiency, did not result in a loss of safety function, and did not screen as potentially risk significant due to external events.

Enforcement.

San Onofre Nuclear Generating Station, Units 2 and 3, Technical Specifications 5.5.1.a, requires, in part, procedures recommended by Regulatory Guide 1.33, Appendix A. Section 5 of this document specifies procedures for abnormal, offnormal, or alarm conditions. For these types of procedures, the appendix specifies that the procedure contain, in part, the immediate operator actions and the long-range actions. Contrary to the above, prior to July 20, 2006, Alarm Response Instruction SO23-5-2.35.2 was inadequate, in that, it failed to provide appropriate immediate and long-range operator actions.

Specifically, the procedural instructions did not specify the most likely causes of the ground fault condition or provide suitable actions for responding to the condition. Since this finding was of very low safety significance and has been entered into the licensees corrective action program (Action Request 060700753),it is considered a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000361/2006009-02, Inadequate Diesel Ground Alarm Procedure.

b.3 Failure to Follow Correct Methodology for 125Vdc Calculations

Introduction.

The team identified a Green noncited violation of Code of Federal Regulations, Title 10, Part 50, Appendix B, Criterion III, Design Control, for the failure to properly calculate control circuit voltages associated with the Unit 3 motor-driven auxiliary Pump 3P504 breaker. The magnitude of the error used about 1/3 of the available design margin.

Description.

Per Technical Specification Bases 3.8.4, DC Sources-Operating, the licensee sized the safety-related 125Vdc batteries in accordance with Institute of Electrical and Electronic Engineers (IEEE) Standard 485 - 1983, Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications. The results

from the sizing calculations are also used to determine available control circuit voltage. For circuits that use 125Vdc control power, including Class 1E 4kV circuit breakers, the licensee performed voltage drop calculations and verified that the voltage available to breaker controls circuits was greater than 90Vdc under worst case design basis accident conditions (Calculation E4C-131, 125VDC Control Circuit Analysis for Class 1E4KV and 480V Circuit Breaker Operation, Revision 0).

The team identified: 1) that the licensee did not follow IEEE 485 when calculating the available battery voltage and 2) the calculated control circuit voltage for circuit Breaker 3A0612 (breaker to motor-driven auxiliary feedwater Pump 3P504) was adversely impacted by the error. IEEE Standard 485 described acceptable techniques for calculating the load during the battery duty cycle. One technique involved segregating the duty cycle into several discrete time intervals and determining the peak current within each interval. The peak current was then used to determine battery voltage for the interval. IEEE 485 specifies the minimum acceptable time interval as 1 minute. For the subject breaker, the licensee deviated from this method by using the non-peak battery current that occurred during the first minute of battery loading. This deviation resulted in increasing the calculated voltage. Based on the improper calculation method, the voltage available to the control circuit was 94.6Vdc. When corrected (including the removal of other conservatisms), the voltage was 93.1Vdc. While the ultimate change in voltage was not large, 1.5Vdc, the problem was considered more significant because of the small amount of margin available (94.6 - 90.0Vdc acceptance limit = 4.6Vdc margin). The magnitude of the error used about 1/3 of the available margin. Considering that these calculations would be used to support plant modifications and operability determinations, this issue could be more significant if left uncorrected.

Analysis.

The failure to properly implement design controls was a performance deficiency. This issue was more than minor because, if left uncorrected, it could become a more significant safety concern. Specifically, the noted calculations are used for operability determinations and plant modifications. Uncorrected errors could mask equipment operability issues. This issue was similar to non-minor violation Example 3.j in NRC Inspection Manual Chapter 0612, Appendix E, Examples of Minor Issues, because there was a reasonable doubt of the operability of the pump breaker. Using the Manual Chapter 0609, Phase 1 screening worksheet, the issue screened as having very low safety significance because it was a design deficiency confirmed not to result in loss-of-operability in accordance with NRC Manual Chapter Part 9900, Technical Guidance, Operability Determination Process for Operability and Functional Assessment.

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion III, Design Control, requires, in part, "Measures shall be established to assure that the applicable regulatory requirements and the design basis, as defined in - 50.2 and as specified in the license application . . . are correctly translated into specifications, drawings, procedures and instructions. . . . The design control measures shall provide for verifying or checking the adequacy of design, such as . . . by the use of alternate or simplified calculational methods . . .

." The San Onofre Nuclear Generating Station Units 2 and 3 Technical Specifications Bases, Section B 3.8.4, specified IEEE 485-1983 as the applicable standard for battery sizing. Additionally, San Onofre Nuclear Generating Station Procedure E4C-017 states, in part, "the methodology used to analyze and validate the DC system as meeting its safety-related requirements is from IEEE Standard 485-1983." IEEE 485-1983 specified, in part, the minimum time interval assumed

for analysis purposes as being 1 minute. Further, the standard states: ". . . if a discrete sequence can be established, the load for the period should be assumed to be the maximum load at any instant." Contrary to the above, prior to July 20, 2006, in Calculation E4C-131, the licensee used the non-maximum load during the first minute of post-accident battery operation. Because this finding was of very low safety significance and has been entered into the licensees corrective action program (Action Request 060700765), it is considered a noncited violation consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000362/2006009-03, Incorrect Methodology for 125Vdc Calculations.

b.4 Failure to Properly Address Industry Information Regarding Air in Safety Injection lines

Introduction.

The team identified a Green noncited violation of Code of Federal Regulations, Title 10, Part 50, Appendix B, Criterion XVI, Corrective Actions, for the failure to promptly identify a condition adverse to quality (trapped air in the safety injection suction lines). Each suction line contained approximately 11.5 cubic feet of trapped air but the licensee's official design calculations assumed the lines were full of water. Additionally, industry operating experience notified the licensee that air in the safety injection system suction lines could cause operational problems (a condition adverse to quality), but the licensee failed to promptly identify the condition at San Onofre Nuclear Generating Station. The licensee's engineering evaluation erroneously determined that San Onofre Nuclear Generating Station was not vulnerable to the condition identified in the operating experience.

Description.

Westinghouse Service Advisor Letter NSAL-04-7, Containment Sump Line Fluid Inventory, dated November 15, 2004, notified the licensee of a potential generic problem with Combustion Engineering plants. The letter stated, in part:

The containment emergency core cooling system suction lines between the sump isolation valve and the sump check valve at two Combustion Engineering sites were found to contain trapped air. Upon receipt of a recirculation actuation signal following a postulated loss-of-coolant accident, such trapped air would be drawn into the operating emergency core cooling system pumps . . . Ingestion of the trapped air by an operating emergency core cooling system pump may create hydraulic instabilities that could result in damage and possible loss of pump operability . . .

Internal clearances are such that air ingestion into an operating high pressure (multi-stage) centrifugal pump could result in damage due to contact between rotating and stationary internal components . . . The rate of influx of water from the containment sump when the isolation valves open to initiate the recirculation/long term core cooling mode of operation may be sufficient to sweep any trapped air into the emergency core cooling system pumps.

The licensee evaluated the operating experience via Action Request 041101570, dated November 24, 2004. The response stated, in part:

During normal operation the closed valves assure that the pipe will stay filled and not evaporate . . .

With the containment sump filled above the suction strainers, the line would readily vent whenever the isolation valves were open.

The issue raised by Westinghouse in NSAL-04-7 is applicable to San Onofre Nuclear Generating Station, but Units 2 and 3 are not vulnerable to the problem because the existing piping layout and operating procedures preclude the accumulation of significant quantities of air trapped in the containment sump lines. No further action is required regarding NSAL-04-

The team identified that the licensees evaluation was inadequate for the following reasons:

  • The piping was not full of water. Operating Instruction SO23-3-2.7.2, 7, Filling the Containment Emergency Sump Suction Lines, Revision 12, directs operators to establish level in the suction piping lines at a point where a portion of the piping would remain voided. In response to the team questions, the licensee determined that approximately 11.5 cubic feet of air would remain in each train.
  • The licensee had no engineering evaluation or other justification that would support the position that, "with the containment sump filled above the suction strainers, the line would readily vent whenever the isolation valves were open." Contrary to this assertion, the Westinghouse advisory letter stated:

The rate of influx of water from the containment sump when the isolation valves open to initiate the recirculation/long term core cooling mode of operation may be sufficient to sweep any trapped air into the emergency core cooling system pumps.

Inspector Note: When the containment sump isolation valves open, the pressure in containment is much higher than the pressure in the piping. When the valves open, flow would travel into the piping, versus outward.

  • The existence of air in the safety injection piping was an unanalyzed condition for San Onofre Nuclear Generating Station. Calculation A-SG-FE-0090, Post Loss of Coolant Accident Long-Term Cooling, Revision 0, assumed the piping lines were full of water.

In response to the team's concerns, the licensee evaluated current operability.

The licensee concluded that, based on engineering judgement, the air would settle in high portions of the piping system and would not likely reach the pumps.

Therefore, the trains remained operable. As a long-term corrective measure, the licensee planned to perform an analysis to demonstrate acceptability of the suction piping air voids.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion XVI, requires the licensee, in part, to promptly identify and correct conditions adverse to quality. Air voids in the safety injection suction lines, a condition outside the systems design, was a condition adverse to quality. The licensee failed to promptly identify and correct the condition adverse to quality following the notification of a generic problem from a reputable vendor.

Analysis.

The failure to promptly identify and correct a condition adverse to quality in response to applicable operating experience was a performance deficiency.

This finding was more than minor because it affected the mitigating system cornerstone objective (equipment performance attribute) to ensure the reliability and capability of equipment needed to respond to initiating events. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the finding was of very low safety significance because it was a design deficiency confirmed not to result in loss-of-operability in accordance with Part 9900, Technical Guidance. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that the licensee failed to thoroughly evaluate applicable industry operating experience concerning air voids in recirculation piping suction lines.

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion XVI, requires, in part, that "measures shall be established to assure that conditions adverse to quality, such as . . . nonconformances are promptly identified and corrected." Trapped air in the safety injection suction lines was a nonconformance (condition adverse to quality) because the condition was outside the safety injection system design. The design assumed that the lines were full of water. Contrary to the above, as of July 20, 2006, the licensee was notified of the potential condition adverse to quality on approximately November 15, 2004, but failed to promptly identify and correct the problem. Because this violation was of very low safety significance and has been entered into the licensees corrective action program as Action Request 060700747, this violation is being treated as a noncited violation consistent with Section VI.A.1 of the NRC Enforcement Policy:

NCV 05000361;362/2006009-04, Failure to Identify Air Voids in Safety Injection Suction Piping.

b.5 Failure to Promptly Identify Nonconforming Emergency Diesel Generators

Introduction.

The team identified a Code of Federal Regulations, Title 10, Part 50, Appendix B, Criterion XVI, violation for the failure to promptly identify a condition adverse to quality (Train A emergency diesel generators were no longer seismically qualified). The licensee had identified that a ground fault on a nonsafety-related uninterruptible power supply circuit could cause the emergency diesel generator to trip during a fire but failed to further determine that the same scenario could occur during a seismic event (with a loss-of-offsite power).

Discussion. On January 28, 2005, as documented in Action Request 05101702, the licensee identified that a ground fault on a nonsafety-related uninterruptible power supply, powered from the Train A Class 1E 4.16kV bus, could cause the associated emergency diesel generator to trip during a fire scenario. The emergency diesel generators were equipped with a ground fault relay that would trip the diesels in response to a line to ground fault anywhere on the diesel supplied 4.16kV system. The trip signal is bypassed for a loss-of-coolant accident but is intact for a loss-of-offsite power event. This condition existed on both units since initial construction.

The licensee established a fire watch as a short-term measure and completed a circuit modification on March 2, 2005, on Unit 2 and May 25, 2005, on Unit 3. The modification established proper coordination between the breaker and the 4.16kV bus so that a ground fault on the uninterruptible power supply circuit would trip the associated breaker and not the emergency diesel generator.

The team identified that the same type of ground fault could trip the Train A emergency diesel generator during a seismic event. The licensee should have identified this problem as part of the extent of condition evaluation for the original concern. Further, the team concluded that, at the time, operability of the Train A emergency diesel generators on each unit was not assured. The Code of Federal Regulations, Title 10, Part 50, Appendix A, Criterion 2, Protection Against Natural Phenomena, states, in part, Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes . . . without loss of capability to perform their safety functions.

The licensee was committed to Criterion 2 in Section 3.1.1.2.2 of their Updated Final Safety Analysis Report. The failure to maintain seismic qualification would, at minimum, be a nonconforming condition. In accordance with the NRC Manual Chapter Part 9900 Technical Guidance, the licensee should have identified the nonconforming condition and evaluated emergency diesel generator operability.

Failure to meet the conditions required for operability would have driven the licensee to follow the applicable technical specification requirements. The failure to identify the condition adverse to quality bypassed this process and operability for seismic events was not evaluated. The team noted that because the licensee had corrected the condition by the time of the inspection, current emergency diesel generator operability was not a concern.

Analysis.

The failure to promptly identify a condition adverse to quality was a performance deficiency. This finding is more than minor because it affected the mitigating system cornerstone objective (equipment performance attribute) of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Using the Manual Chapter 0609, Significance Determination Process, Phase 1 screening worksheet, the internal events portion of the worksheet did not apply, because the finding only involved an external seismic event with a loss of offsite power. Specifically, Train A emergency diesel generator operability was not assured for seismic events.

Additionally, for external events, the finding screened as have very low safety significance because it did not involve the loss or degradation of equipment or function specifically designed to mitigate an external event (e.g., seismic snubbers, flooding barriers, tornado doors) and the safety function was not considered completely failed or unavailable, as the Train B emergency diesel generators were unaffected by the issue. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that engineers failed to perform an appropriate extent of condition review and promptly identify the nonconforming emergency diesel generators, a condition adverse to quality.

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion XVI, requires, in part, that "measures shall be established to assure that conditions adverse to quality, such as . . . nonconformances are promptly identified and corrected." Contrary to the above, from January 28, 2005 until March 2, 2005 (Unit 2) and May 25, 2005 (Unit 1), the licensee failed to promptly identify a nonconforming condition, non-seismic qualification of Train A emergency diesel generators. Because this violation was of very low safety significance and has been entered into the licensees corrective action program as Action Request 060600500, this violation is being treated as a noncited violation consistent with

Section VI.A.1 of the NRC Enforcement Policy: NCV 05000361;362/2006009-05, Failure to Identify Diesel Generator Seismic Nonconformance.

OTHER ACTIVITIES

4OA2 Identification and Resolution of Problems

The team reviewed actions requests associated with the selected components, operator actions and operating experience notifications. In addition, this report contains the following issue that has problem identification cross-cutting aspects.

Section 1R21.b.4 documents an issue where engineers failed to perform an adequate evaluation of recent operating experience.

They had failed to address air voiding in the San Onofre Nuclear Generating Station safety injection suction lines.

Section 1R21.b.5 documents a finding where engineers failed to perform an adequate extent of condition review in response to a fire protection related problem, where an emergency diesel generator could trip unexpectedly. Consequently, the engineers failed to promptly identify a related condition adverse to quality, in that the same problem also affected the emergency diesel generators during seismic events.

4OA3 Event Followup

(Closed) Licensee Event Report 05000361;362/2005-003-00. Technical Specification Violation for Inoperable Offsite Sources On March 14, 2005, the licensee identified that the undervoltage relays on both units were set such that the offsite transmission network may not have provided the necessary voltage to the Class 1E system under certain circumstances. This issue is addressed in Section 4OA7 of this report.

4OA6 Meetings, Including Exit

On July 20, 2006, the team leader presented the preliminary inspection results to Mr. B. Katz, Vice President, Nuclear Oversight and Regulatory Affairs, and other members of the licensees staff. On November 30, 2006, the Engineering Branch 1 Chief conducted a telephonic final exit meeting with Mr. B. Katz and other members of the licensee's staff. The licensee acknowledged the findings during each meeting. While some proprietary information was reviewed during this inspection, no proprietary information was included in this report.

4OA7 Licensee Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements which meets the criteria of Section VI of the NRC Enforcement Policy, NUREG-16000, for being dispositioned as a licensee identified noncited violation.

Licensee Event Report 2005-003-00: Technical Specification 3.8.1, AC Sources - Operating, requires that two qualified circuits between the offsite transmission network and onsite Class 1E AC electrical power distribution system shall be operable in Modes 1 through 4.

Contrary to this requirement, since 1995 until March 14, 2005, the licensee identified that the undervoltage relays on both units were set such that the offsite transmission network may not have provided the necessary voltage to the Class 1E system under certain circumstances. The undervoltage relays were set to trip at 218kV when they should have been set to 222.2kV to ensure operability. This issue was entered into the licensee's corrective action program as Action Requests 050301091 and 050500092.

s: 1 - Supplemental Information 2 - Preliminary Determination of Significance, Foreign Material in Condensate Storage Tank Enclosure

ATTACHMENT 1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

D. Breig, Station Manager
B. Katz, Vice President, Nuclear Oversight and Regulatory Affairs
M. Love, Manager, Maintenance
N. Quigley, Manager, Mechanical/Nuclear Maintenance Engineering
L. Pressey, Nuclear Regulatory Affairs
A. Scherer, Manager, Nuclear Regulatory Affairs
M. Short, Manager, Systems Engineering
T. Vogt, Manager, Operations
R. Waldo, Vice President, Nuclear Generation
D. Wilcockson, Manager, Plant Operations
C. Williams, Manager, Compliance
T. Yackle, Manager, Maintenance Engineering

NRC personnel

C. Osterholtz, Senior Resident Inspector
M. Sitek, Resident inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000361;362/2006009-01 NCV Failure to Follow Procedures Addressing Foreign Material Exclusion (Section 1R21.b.1)
05000361;362/2006009-02 NCV Inadequate Diesel Ground Alarm Procedure (Section 1R21.b.2)
05000362/2006009-03 NCV Incorrect Methodology for 125VDC Calculations (Section 1R21.b.3)
05000361;362/2006009-04 NCV Failure to Identify Air Voids in Safety Injection Suction Piping (Section 1R21.b.4)
05000361;362/2006009-05 NCV Failure to Identify Diesel Generator Seismic Nonconformance (Section 1R21.b.5)

Closed

05000361;362/2005-003-00 LER Inoperable Offsite Power Sources (Section 4OA7)

LIST OF DOCUMENTS REVIEWED

Retrieved from "https://kanterella.com/w/index.php?title=IR_05000361/2006009&oldid=2286300"