IR 05000395/2004009

IR 05000395-04-009 on 10/04/2004 - 10/08/2004, 10/25/2004 - 10/29/2004 and 11/08/2004 - 11/19/2004 for Virgil C. Summer Nuclear Station; Temporary Instruction 2515/158, Function Review of Low Margin/Risk Significant Components and Operator

ML050060203
Person / Time
Site:	Summer
Issue date:	12/22/2004
From:	Ogle C Division of Reactor Safety II
To:	Archie J South Carolina Electric & Gas Co
References
IR-04-009
Download: ML050060203 (58)

Text

ber 22, 2004

SUBJECT:

VIRGIL C. SUMMER NUCLEAR STATION - NRC INSPECTION REPORT 05000395/2004009

Dear Mr. Archie:

On November 19, 2004, the U. S. Nuclear Regulatory Commission (NRC) completed an engineering team inspection at your Virgil C. Summer Nuclear Station. The inspection was conducted using Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions and examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. In conducting the inspection, the team examined the adequacy of the facilitys design and design implementation for selected risk significant components and operator actions. The enclosed inspection report documents the inspection findings, which were discussed on November 19, 2004, with you and other members of your staff. Following completion of additional review in the Region II office, a final exit was held by telephone with you and other members of your staff on December 22, 2004, to provide an update on changes to the preliminary inspection findings.

The team concluded that, in general, the components and systems reviewed would be capable of performing their intended safety functions and that for the most part, sufficient design controls had been implemented for engineering work performed at your V. C. Summer Nuclear Station. However, the team did identify several deficiencies during the course of the inspection which are discussed in the enclosed report. The team noted that for most of these deficiencies, the engineering solutions initially provided by your staff were not always comprehensive or timely.

The report documents one NRC-identified finding involving a violation of NRC requirements, which could potentially have more than very low safety significance. The final safety significance has not yet been determined. This finding does not present an immediate safety concern because you instituted compensatory measures as described in the enclosed report.

This report also documents two NRC-identified findings of very low safety significance (Green)

involving violations of NRC requirements. However, because of their very low safety significance and because they are entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with Section VI.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the United States Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC

SCE&G 2 20555-0001, with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Virgil C. Summer Nuclear Station.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety Docket No.: 50-395 License No.: NPF-12

Enclosure:

Inspection Report 05000395/2004009 w/Attachment: Supplemental Information

REGION II==

Docket No.: 50-395 License No.: NPF-12 Report No.: 05000395/2004009 Licensee: South Carolina Electric & Gas (SCE&G) Company Facility: Virgil C. Summer Nuclear Station Location: P. O. Box 88 Jenkinsville, SC 29065 Dates: October 4, 2004 - November 19, 2004 Inspectors: J. Moorman, Chief, Operator Licensing Branch - Team Leader N. Merriweather, Senior Reactor Engineer R. Schin, Senior Reactor Engineer M. King, Resident Inspector, V. C. Summer C. Baron, NRC Contract Inspector O. Mazzoni, NRC Contract Inspector G. Skinner, NRC Contract Inspector Approved by: Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

ii

SUMMARY OF FINDINGS

IR 05000395/2004009; 10/04/2004 - 10/08/2004, 10/25/2004 - 10/29/2004, 11/08/2004 -

11/19/2004; Virgil C. Summer Nuclear Station; Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions.

This inspection was conducted by a team of four NRC inspectors and three NRC contract inspectors. The team identified three findings. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 3, dated July 2000.

A. Integrated Assessment

• The components and systems reviewed were found to be capable of performing their intended safety functions. Generally, design controls were sufficient in areas examined by the team. The licensees historical response to some conditions adverse to quality was not adequate. Specifically, the engineering solutions to potential emergency feedwater control valve plugging (Section 4OA5.2.1.1), inadequate emergency diesel generator testing (Section 4OA5.2.1.19), and potential inadequacies in the operator response timeline to an inadvertent ECCS actuation (Section 4OA5.3.1) were not comprehensive or timely.

Cornerstone: Mitigating Systems

• TBD. The team identified a violation of 10 CFR 50, Appendix B, Criterion III,

Design Control and 10 CFR 50, Appendix B, Criterion XVI, Corrective Action.

The violation involves a potential design vulnerability for the emergency feedwater (EFW) flow control valves to become plugged by tubercles and other debris from service water, which could result in a common mode failure of the EFW system. Historical licensee corrective actions have not adequately resolved this issue.

This finding is unresolved pending completion of a significance determination.

This finding is greater than minor because it affected the Mitigating System Cornerstone objective of equipment reliability, in that potential plugging of the EFW flow control valves could result in a common mode failure of the EFW system. This finding could potentially have more than very low safety significance. However, it does not present an immediate safety concern because the licensee instituted compensatory measures including operator actions to install temporary hoses to bypass the EFW flow control valves if they become plugged. This finding has been entered into the licensees corrective action program as condition evaluation report (CER) 0-C-04-3416. This finding iv has cross-cutting aspects related to problem identification and resolution.

(Section 4OA5.2.1.1)

Green.

The team identified a non-cited violation (NCV) of TS 6.8.1.c,

Procedures and Programs, for failure to include the proper testing methodology in procedures to meet Technical Specification Surveillance Requirement 4.8.1.1.2.g.6.c. Technical Specification 4.8.1.1.2.g.6.c required testing to demonstrate that all emergency diesel generator trips other than overspeed, generator differential, and low lube oil pressure were automatically bypassed upon loss of voltage on the associated emergency bus concurrent with a safety injection signal. Procedures STP-0125-010 and STP-0125-011 did not provide for adequate testing of the bypass function as intended, and no other procedures were identified that satisfied the requirement. This resulted in the failure to test the bypass function since November 1996, when a similar test deficiency was discovered by the licensee and addressed by a temporary procedure change.

The licensee performed testing, subsequent to the inspection, which demonstrated this feature operated properly and entered it into the corrective action program.

This finding is greater than minor because it is associated with the procedure quality attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring reliable, available, and capable systems that respond to initiating events. This finding is of very low safety significance because no loss of safety function occurred and it is not related to an event external to the plant. This finding has been entered into the licensees corrective action program as CER 0-C-04-3626. This finding has cross-cutting aspects related to problem identification and resolution. (Section 4OA5.2.1.19)

Green.

The team identified a non-cited violation of 10 CFR 50, Appendix B,

Criterion XVI, Corrective Action. The licensee failed to take timely action to correct the inability of plant operators to terminate safety injection after an inadvertent emergency core cooling system (ECCS) actuation at power within the time assumed in the plant design and licensing basis. This issue was initially identified in 1993 and had not been corrected as of the date of this inspection.

This finding is greater than minor because the inability to meet the design basis timeline is associated with the procedure quality and design control attributes of the mitigating systems cornerstone and affects the cornerstone objective of ensuring the capability that operators would be able to properly respond to an initiating event to prevent undesirable consequences. This finding was determined to be of very low safety significance because the design or qualification deficiency did not result in a loss of function per Generic Letter 91-18, Information to Licensees Regarding NRC Inspection Manual Section on Resolution of Degraded and Nonconforming Conditions, Rev. 1. This finding has been entered into the licensees corrective action program as CER 0-C-04-3250.

This finding has cross-cutting aspects related to problem identification and resolution. (Section 4OA5.3.1)

Licensee-Identified Violations

None.

REPORT DETAILS

OTHER ACTIVITIES

4AO2 Problem Identification and Resolution (PI&R)

.1 Cross-Reference to PI&R Findings Documented Elsewhere in this Report

Section 4OA5.2.1.1

(b) describes a finding for failure to promptly identify and correct a condition adverse to quality which had the potential to result in a common mode failure of the emergency feedwater (EFW) system if the system used the service water (SW)backup as a suction source.

Section 4OA5.2.1.19

(b) describes a finding for not performing Technical Specification (TS) Surveillance Requirement 4.8.1.1.3.g.6.c since 1996. This test deficiency was discovered by the licensee in 1996 and documented in condition evaluation report (CER) 0-C-96-0336. The corrective action taken as a result of the CER did not rectify the original procedure deficiency and the CER was subsequently closed.

Section 4OA5.3.1

(b) describes a finding for failure to promptly correct a condition adverse to quality. The licensee had identified challenges to the operators ability to mitigate an inadvertent emergency core cooling system actuation within the design basis timeline in 1993 and had not adequately addressed the deficiency as of the date of the inspection.

4OA5 Other Activities

Temporary Instruction (TI) 2515/158, Functional Review of Low Margin/Risk Significant Components and Operator Actions.

.1 Inspection Sample Selection Process

In selecting samples for review, the team focused on the most risk significant components and operator actions. The team selected these components and operator actions by using the risk information contained in the licensees Probabilistic Risk Assessment (PRA). The team also used an assessment of design margin conducted by the licensees engineering department. An initial sample was chosen from these components and operator actions that had a risk achievement worth factor greater than two. These components and operator actions are important to safety since their failure would result in at least a doubling in the plants baseline core damage frequency.

Many of the samples selected were located within the EFW, SW, component cooling water (CCW), emergency diesel generator (EDG), and off-site power systems. In addition, inspection samples were added based upon operational experience reviews.

The samples were reviewed to determine whether any low margin concerns existed.

For the purpose of this inspection, margin concerns included original design issues, margin reductions due to modification, or margin reductions identified as a result of material condition issues. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins. An overall summary of the reviews performed and the specific inspection findings identified are included in the following sections of the report.

.2 Results of Detailed Reviews

The team performed detailed reviews on the components, operator actions, and operating experience issues selected. For components, the team reviewed the adequacy of the original design, modifications to the original design, maintenance and corrective action program histories, and associated operating and surveillance procedures. As practical, the team also performed walkdowns of the selected components. For operator actions, the team reviewed the adequacy of the operating procedures and compared design basis time requirements against actual demonstrated timelines. For the operating experience issues chosen for detailed review, the team assessed the applicability of the issue to the Summer Nuclear Station and the licensees disposition of the issue. The following sections of the report provide a summary of the detailed reviews, including any findings identified by the inspection team.

.2.1.1 Service Water Supply to Emergency Feedwater - Mechanical Design

a. Inspection Scope

The team reviewed the mechanical aspects of the SW system supply to the EFW pump suctions to verify the capability of the EFW system to take suction from the SW system for an indefinite period of time, as stated in Final Safety Analysis Report (FSAR) Section 10.4.9.2. This review included the related FSAR and TS sections, as well as all available documentation related to the condition of the interfacing piping system. This documentation included drawings, equipment specifications, and previous evaluations of the piping condition. The team also reviewed various photos and video of the interior of this piping, provided by the licensee. The team also performed a walkdown of the accessible port of the piping.

The team also reviewed the FSAR, TS, design basis document (DBD), piping &

instrumentation drawings, and corrective action documents for reducing silt, clams, and tubercles in the piping, to verify that the licensee was maintaining the SW supply to EFW piping sufficiently clean to assure that it could perform its design function as a safety-related supply to EFW. In addition, the team observed the condition of the SW intake and SW pond. Further, the team walked down the operating procedures for filling and venting the SW piping to the EFW pumps to verify that the procedures would not leave air pockets in the pipes.

b. Findings

Potential for Emergency Feedwater Flow Control Valves to be Plugged by Tubercles and Other Debris from Service Water

Introduction.

The team identified a finding involving a violation of 10 CFR 50, Appendix B, Criterion III, Design Control, and also of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action. The finding involves the potential for EFW flow control valves to be plugged by tubercles and other debris from SW, potentially resulting in a common mode failure of the EFW system. Historical licensee corrective actions have not adequately resolved this issue. This issue is unresolved pending NRC determination of the safety significance.

Description.

The normal water supply to the three EFW pumps was provided from a single condensate storage tank (CST). However, as discussed in the FSAR, the CST contained a limited volume of water and was not designed to withstand the effects of a design basis tornado, including tornado missiles. Therefore, an alternate source of water was provided from the SW system. The EFW suction from SW was designed to be safety-related and to automatically actuate when low pressure is sensed in the EFW suction pipe from the CST.

The FSAR stated that the plant can operate indefinitely, if required, without normal feedwater because the EFW system can take suction from the SW system for an indefinite period of time. The FSAR also stated that the minimum required usable volume for the CST is sufficient to maintain the plant at hot standby conditions for 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Further, this CST volume is also sufficient to cool down the plant to hot shutdown conditions assuming the plant is maintained at hot standby for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and then cooled down to hot shutdown in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The team concluded that the SW supply to EFW was relied upon for tornado mitigation and also for other design basis events where the CST water could be depleted.

The SW to EFW system interface included approximately 20 feet of eight-inch piping between each of the Train A and Train B SW loops and each of the normally closed SW supply isolation valves (XVG-1037A-EF and XVG-1037B-EF) to the EFW pump suctions. This piping was normally filled with stagnant service water. The licensee had not periodically flushed, cleaned, or inspected most of this piping on a regular basis. The entire lengths of this piping were last cleaned in 1993. Since then, the licensee had performed some limited inspections of the piping immediately adjacent to the SW supply to EFW isolation valves. Then, in response to NRC Finding 05000395/2003003-01, Incomplete Inspections of Portions of the Service Water System, the licensee inspected about 20 feet and cleaned about 10 feet of the train A SW piping to EFW in 2003.

Licensee photos and videos from the 2003 inspection showed that portions of the SW piping immediately upstream of the SW supply valves to the EFW system valves were coated with tubercles, a form of micro-biologically influenced corrosion. The coating occluded only about 10 percent of the cross-sectional area of the piping. The tubercles were small mounds about one inch in diameter and about 1/2 inch high with a hard iron oxide shell and soft interior. The licensee had concluded that the tubercles were not blocking most of the flow path, would not impede SW flow to EFW, and as observed were acceptable to leave in the SW to EFW piping during the next plant operating cycle.

The team was concerned that if the SW suction source to EFW were used, parts of the tubercles could become dislodged, flow into the EFW system, and potentially plug any flow-restricting passages. The teams review of industry operating experience determined that debris from SW systems at other plants had entered auxiliary feedwater (AFW) systems and created this sort of problem. For example, in 1988, an inadvertent actuation of SW flow to the AFW system at the Catawba nuclear plant resulted in clamshells from the SW system plugging the AFW flow control valves.

Similarly, in 2002, the Point Beach nuclear plant discovered that corrosion products from the SW system could potentially plug the AFW pump mini-flow orifices. The NRC team sampled some tubercles that were on the V. C. Summer SW intake traveling screen, which was accessible while the plant was operating. Licensee personnel stated that these tubercles appeared to be similar to those that were in the SW piping to EFW. The team found that some of the tubercles were very sturdy and not easy to break, while others were very easy to break by hand and others were already partially broken.

The team also determined that the most flow-restricting passages in the system were in the flow control valves (IFV-3531-EF, IFV-3541-EF, IFV-3551-EF, IFV-3536-EF, IFV-3546-EF, and IFV-3556-EF). The flow control valves contained a cylindrical trim with several hundred orifices through which the EFW flow to each steam generator passed. The team inspected a spare flow control valve trim and observed that the orifices were widened with a countersink to about 0.125 inches in diameter on the flow entry side and narrowed to 0.049 inches in diameter on the flow exit side. The total flow area of the orifices in a single valve trim was about 0.91 square inches. The team determined that there were no strainers in the V. C. Summer EFW system that would prevent particles larger than the these flow-restricting passages from entering the system. The team physically agitated samples of tubercles by rapidly shaking them in a container, to simulate turbulent flow through an EFW pump, and found that most of the tubercle pieces did not pulverize but instead broke into small solid pieces approximately 0.125 to 0.25 inches in diameter. The tubercle pieces were larger than the orifices and therefore could potentially plug the orifices. The team calculated that, with an operating differential pressure across a flow control valve of about 100 pounds per square inch, the differential pressure across each orifice would be about 0.2 pounds. The team found that the sample tubercle pieces were resistant to compressive forces, so that if they became wedged into the orifices, they would likely be able to withstand much more than 0.2 pounds of compressive forces without breaking up.

The team also determined that the original purchase specification for the EFW flow control valves (SP-620-044461-000, dated October 16, 1974) had identified the process fluid as "cold condensate." The team determined that these EFW valves had been specified for use with clean condensate water and not for use with comparatively unclean SW which could contain silt and other debris from the SW pond plus clam shells, tubercles, and other debris from the SW piping. The team concluded that the mis-application of the purchased EFW flow control valves, which were designed for clean condensate, to handle unclean SW in the plant represented inadequate design control.

In response to NRC team concerns, the licensee initiated CER 0-C-04-3416 on October 29, 2004, to address the potential of plugging the EFW flow control valves with debris from the SW system. The licensees operablity evaluation, which was documented in the CER, concluded that the EFW system could perform its safety function. This conclusion was primarily based on the assumptions that the tubercles were unlikely to come loose from the SW pipe wall upon initiation of flow and that any debris that did pass through the EFW pumps would be pulverized by turbulent flow in the pumps so that it would be able to pass through the flow control valves.

The team was concerned that the licensees operability evaluation did not provide reasonable assurance that the system could perform its design function. This concern was based on the fact that a relatively small amount of tubercle debris (about a handfull) could be sufficient to plug the six EFW flow control valves, and could result in a common mode failure of the EFW system. The licensees evaluation did not provide quantitative or empirical data to support the assumptions that significant tubercle pieces or other material would not come loose from the SW pipe wall and be transported from SW into the EFW system. In fact, periodic flushing of the SW piping to auxiliary feedwater (AFW) in another plant revealed that pieces of tubercles did come loose and were flushed out. The licensee also did not have quantitative or empirical data to support the assumption that any debris that did pass through the EFW pumps would be pulverized so that it would be able to pass through the flow control valves.

In response to the teams concerns, the licensee initiated interim compensatory measures to address potential plugging of the valves. The compensatory measures included procuring and staging high pressure hoses, with appropriate fittings, to be used as jumpers around the flow control valves. Procedures and operator training were implemented to ensure the hoses could be installed, if required, under accident conditions. These actions were added to CER 0-C-04-3416 and implemented during the inspection. Based on the implementation of these compensatory measures, the team concluded that the system would be capable of performing its design function.

The team reviewed the licensees historical corrective actions related to this issue.

The team determined that the licensee had identified a potential for SW debris plugging the EFW flow control valves in 1986 (Independent Safety Engineering Group (ISEG) Activity Form No. 11-18-86/GAR, titled Potential for Common Mode Failure -

Emergency Feedwater System.) Plant records indicated that various potential solutions to this concern were evaluated, but most were not implemented. In response to the 1988 Catawba flow control valve plugging event, the licensee had initiated chemical treatment of the SW system to eliminate clam shells from the system. However, due to the stagnant conditions, chemical treatment did not preclude tubercle formation in a section of the SW to EFW piping connection. The ISEG activity was subsequently closed on May 1, 1992, based in part on an engineering evaluation (CGSS-225-GMES, dated April 9, 1992) that concluded that loss of the CST was not a credible event. The NRC team determined that evaluating a loss of the CST to be a low probability event was not an acceptable basis for having a SW supply to EFW that lacked assurance of its ability to function as described in the FSAR and as required by TS. The closure of the ISEG activity also relied, in part, on a corrective action item to conduct periodic inspections and cleaning, as necessary, of the SW supply piping to EFW. This corrective action was implemented as a partial visual inspection that was conducted by removing the bonnets from Valves XVG-1037A-EF and XVG-1037B-EF and observing only the portion of the piping that was visible in this condition. This partial inspection was the subject of NRC finding 05000395/2003003-01, Incomplete Inspections of Portions of the Service Water System. In addition, the licensee had subsequently evaluated two recent operating experience CERs related to the Point Beach recirculation line orifice clogging event (0-C-03-4441, dated December 18, 2003 and 0-C-04-0460, dated February 18, 2004).

The licensee closed CER 0-C-03-4441 based on the design of the V. C. Summer EFW recirculation line orifice without consideration of the design of the flow control valves, which contained the most flow-restricting passages and were more limiting components. The licensee also closed CER 0-C-04-0460 based on the resolution of CER 0-C-03-4441. Further, during the licensees 2003 inspection of tubercles in the SW piping, the licensee had not recognized the potential for tubercle pieces to plug the EFW flow control valves. The team concluded that the licensees lack of adequate consideration that tubercles or other debris from the SW system could potentially plug the EFW flow control valve orifices represented inadequate corrective action for a degraded condition.

Analysis.

The team determined that this issue constituted a performance deficiency because the licensees design control incorrectly specified the EFW flow control valves process fluid as clean cold condensate and not comparatively unclean SW. It was also a performance deficiency because the licensees historical corrective actions did not adequately deal with degraded conditions of tubercles and other debris in the SW supply to the EFW system that could potentially plug the flow control valves.

Consequently, the licensee had operated the plant for years with the potential for debris from SW to cause a common mode failure of the EFW system. This issue was greater than minor because it affected the Mitigating System Cornerstone objective of equipment reliability, in that potential plugging of the EFW flow control valves could result in a common mode failure of the EFW system. The risk significance of this issue is unresolved pending completion of the NRC Significance Determination Process. This issue screened as potentially greater than green by the Phase 1 significance determination process. This conclusion was reached because the finding involved the degradation of equipment designed to mitigate a severe weather initiating event and, if the safety function were assumed to be completely unavailable, degradation of two or more trains of the multi-train EFW system would result. The final risk significance will be determined by a Phase 3 significance determination. In addition, the finding involved a cross-cutting aspect of problem identification and resolution, that being ineffective and untimely corrective actions.

Enforcement.

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to this requirement, the licensee did not establish measures to ensure that the EFW flow control valves could handle relatively unclean SW without plugging. The design control aspect of this violation occurred prior to plant licensing in 1982 and existed through 2004, as described above. Also, 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, requires that conditions adverse to quality are promptly identified and corrected. Contrary to this requirement, the licensee did not promptly identify and correct a condition wherein the EFW flow control valves were vulnerable to being plugged by tubercles and other debris from the SW system. The corrective action aspect of this violation occurred during 1986 through 2004, as described above. This violation was identified by the NRC team at the exit meeting for this inspection on November 19, 2004.

This finding could potentially have more than very low safety significance. However, it does not present an immediate safety concern because the licensee instituted compensatory measures, including operator actions to install temporary hoses to bypass the EFW flow control valves if they become plugged. The licensee has entered the issue into the corrective action program in CER 0-C-04-3416. Because the safety significance has not yet been determined, this issue is identified as URI 05000395/2004009-01, Potential for Emergency Feedwater Flow Control Valves to be Plugged by Tubercles and Other Debris from Service Water.

.2.1.2 Emergency Feedwater Check Valve XVK-1020, Stop Check to Steam Generators

a. Inspection Scope

The team reviewed records of completed surveillance tests and corrective action reports for EFW check valve XVK-1020, to verify that the valve was being adequately tested to ensure that it could perform its design function.

b. Findings

No findings of significance were identified.

.2.1.3 Service Water Supply to Emergency Feedwater - Interlocks

a. Inspection Scope

The team reviewed calculations, procedures, and drawings to determine whether the SW supply to the EFW pumps was available as required by TS Tables 3.3-3 and 3.3-4, and as described in FSAR Section 10.4.9.

The team reviewed elementary drawings, setpoint accuracy calculations, alarm response procedures, and surveillance procedures for the EFW pump suction pressure instrument loop to verify that the range, accuracy, and setpoints of the instruments were in accordance with the design bases.

The team also reviewed actuation logic for the service water isolation valves to verify that they would open automatically on low pressure from the CST. The team also reviewed actuation logic for the service water pumps to verify that they would start automatically upon opening of the service water isolation valves in conjunction with an engineered safeguards feature (ESF) signal.

In addition, the team reviewed the adequacy of the design margin in the instrumentation and controls that automatically transfers the EFW system to the backup service water source upon depletion of the CST supply. The team reviewed system piping and instrumentation drawings, electrical schematic diagrams, instrument setpoint calculations, instrument scaling documents, as well as calibration procedures and calibration test records to verify that adequate margin was available in the instrumentation and control circuit (i.e., instrument setpoints) to protect the EFW pumps from damage on low suction pressure.

The team reviewed calibration test records for the EFW pump suction pressure instrument channels (IPT-3632, 3633, 3634, 3635). The last two completed calibration test records for each channel were reviewed to verify that the procedure acceptance criteria were satisfied or that appropriate corrective actions had been taken. The team also verified that any out of tolerance conditions were documented, evaluated, and corrected. The specific calibration records reviewed are listed in the attachment to this report. The team also reviewed the past 4 years of maintenance records to determine if any recurring equipment problems or out of tolerance conditions had been identified with these instrument loops.

b. Findings

No findings of significance were identified.

.2.1.4 Temperature Limits of Service Water System

a. Inspection Scope

The team reviewed the ultimate heat sink TS and station order limitations regarding the SW system temperature limits that were in place at the time of the inspection to verify the capability of the system to perform its safety function under the most limiting accident conditions. The team also reviewed various SW heat exchanger performance tests and visual inspections, as well as engineering evaluations that had been performed to evaluate the performance of the CCW heat exchangers with elevated service water temperatures.

b. Findings

No findings of significance were identified.

.2.1.5 Service Water System Piping Degradation

a. Inspection Scope

The team reviewed portions of the licensees program to monitor and control corrosion of the SW system, in accordance with the stations response to NRC Generic Letter 89-13. This included a review of the program procedure and a sample of corrosion related CERs. In addition, the team reviewed a summary of SW piping wall thickness data.

b. Findings

No findings of significance were identified.

.2.1.6 Service Water Pumps and Motors

a. Inspection Scope

The team reviewed all CERs that had been generated on the SW pump motors over the past four years to assess whether the operability evaluations were justified. The specific CERs reviewed are listed in the attachment to the report.

The team reviewed the SW system hydraulic analysis to verify the capability of the system to provide the required cooling water flow to components after an accident as required by FSAR Section 9.2.1. In addition, the team reviewed selected CERs and surveillance test results related to the performance of the SW pumps and motors. The team also performed a walkdown of the pumps and motors.

b. Findings

No findings of significance were identified.

.2.1.7 Service Water System Silting and Traveling Screens

a. Inspection Scope

The team performed a limited review of the potential for silt buildup within the SW system to impact the capability of the system to provide the required cooling water flow to components, as required by FSAR Section 9.2.1. Also, the team reviewed the licensees project plan to verify that appropriate monitoring was being performed. The team also reviewed the design of the SW system traveling screens to verify that they would not fail in such a way that the capability of the SW system to perform its design function could be degraded. This review included the original seismic qualification of the screens, recent repair work that had been performed by the licensee, and a team walkdown of the screens.

b. Findings

No findings of significance were identified.

.2.1.8 Component Cooling Water Pumps and Motors

a. Inspection Scope

The team reviewed the CCW system hydraulic analysis to verify the capability of the system to provide the required cooling water flow to components after an accident as required by FSAR Section 9.2.2. In addition, the team reviewed selected CERs and surveillance test results related to the performance of the CCW pumps and motors.

The team performed a walkdown of the pumps and motors. In addition, the team observed a loss of CCW system scenario on the plant simulator.

b. Findings

No findings of significance were identified.

.2.1.9 Component Cooling Water Surge Tank Level Control

a. Inspection Scope

The team reviewed calculations, procedures, and drawings to determine whether the SW supply to the CCW system was available as described in FSAR Section 9.2.2.

The team reviewed instrument setpoint calculations and surveillance procedures for the CCW surge tank level loop, and setpoint documents for the non-essential CCW system leak detection flow switches, to verify that the range, accuracy, and setpoints of the instruments were in accordance with the design bases.

The team also reviewed elementary drawings to verify that the actuation logic for closing the non-essential CCW system header isolation valves, and opening the valves for the safety related SW system makeup were in accordance with the design bases.

The team reviewed calculation DC09650-024 to verify the adequacy of the SW system makeup to the CC system surge tanks, in accordance with FSAR Section 9.2.2. In addition, the team reviewed the selected surveillance test procedure acceptance criteria related to critical valve stroke times.

b. Findings

No findings of significance were identified.

.2.1.1 0 Refueling Water Storage Tank Level Instrumentation, Swap to Cold Leg Recirculation

a. Inspection Scope

The team reviewed calculations, procedures, and drawings to determine whether the semi-automatic emergency core cooling system (ECCS) switchover from injection to cold leg recirculation was available as required by TS Tables 3.3-3 and 3.3-4, and as described in FSAR Section 6.3.2.2.7.

The team reviewed instrument setpoint and scaling calculations, as well as surveillance procedures for the refueling water storage tank (RWST) level instrument loop, to verify that the range, accuracy, and setpoints of the instruments were in accordance with the design bases.

The team reviewed RWST level instrument isometrics to verify agreement of installed configuration with setpoint and scaling calculations.

The team reviewed elementary drawings to verify that the RWST lo-lo level signal would automatically open the reactor building sump isolation valves and would provide annunciation in the control room to notify operators to manually realign the charging pumps for the recirculation mode. The team reviewed elementary drawings for manually operated valves to verify the absence of interlocks that would prevent operator actions required for the switchover.

The team reviewed surveillance results for the four RWST level loops for the last two operating cycles to verify that the instruments had been calibrated in accordance with setpoint documents and to determine whether there were adverse calibration trends.

The team visually inspected the as-built configuration of the RWST level transmitters (LT- 990, -991, -992, and -993) to verify that the visible material condition of the impulse lines, instruments, supports, and connections was adequate with no components degraded (e.g., rusting, missing parts, or leaking fluids). The team also verified that the instruments were mounted at the elevation required by design for instrument scaling accuracy and that they were protected by physical separation from redundant channels. The team also verified that cold weather protection was provided for the instruments and sensing lines. The team reviewed problem reports related to the RWST level instruments over the past 4 years to identify any recurring equipment problems.

b. Findings

No findings of significance were identified.

.2.1.1 1 Pressurizer Pressure Transmitters - Safety Injection Function

a. Scope

The team reviewed calculations, procedures and drawings to determine whether the pressurizer low pressure-safety injection instrument loop design was in accordance with TS Tables 3.3-3 and 3.3-4, and FSAR Table 7.3-1.

The team reviewed setpoint accuracy calculations, insulation resistance calculations, surveillance procedures, and vendor correspondence for the pressurizer low pressure-safety injection instrument loops to verify that the range, accuracy, and setpoints of the instruments were in accordance with the design bases.

The team reviewed work orders to determine the version of Barton transmitters installed, and reviewed vendor correspondence relating to setpoint errors applicable to Barton transmitters that had not been re-compensated for high temperature environments.

The team interviewed maintenance personnel and reviewed procedures and work records relating to the repair of Westinghouse 7300 System electronic boards to determine whether proper quality controls, repair techniques, and post-maintenance testing were employed to assure that original design and qualification requirements were being maintained. The team specifically reviewed work records for a card used in the pressurizer pressure instrument loops.

The team reviewed calibration test records for the pressurizer pressure instrument channels (IPT-444, 445, 455,455A,456, 457). The last two completed calibration test records for each channel were reviewed to determine if the procedure acceptance criteria were satisfied or that appropriate corrective actions had been taken. This review also was performed to determine if any out of tolerance conditions were documented, evaluated, and corrected. The team also reviewed the past 4 years of maintenance records to determine if any recurring equipment problems or out of tolerance conditions had been identified with these instrument loops.

b. Findings

No findings of significance were identified.

.2.1.1 2 Emergency Feedwater Pumps

a. Inspection Scope

The team reviewed the TS, FSAR, DBD, hydraulic analyses for the EFW system, and periodic testing of the one turbine-driven and two motor-driven EFW pumps to verify that the testing was consistent with the design analyses and in accordance with TS requirements. Also, the team reviewed the results of completed in-service testing of the pumps for the last two years and witnessed an in-service pump test of the turbine-driven EFW pump and an in-service test of a motor-driven EFW pump to observe whether the pumps appeared to be operating properly and to verify that the tests were being correctly accomplished. Additionally, the team walked down the EFW system and observed the installation and physical condition of the pumps, suction sources, pipes, and valves. Further, the team reviewed records of corrective actions and maintenance accomplished during the last two years to verify that the pumps were being appropriately maintained. Documents reviewed in detail are listed in the

.

b. Findings

Tornado Missile Vulnerabilities of Outdoor Components

Introduction.

An unresolved item (URI) was opened for further NRC review of the licensing basis for tornado missile vulnerabilities of outdoor components that are relied upon for safe shutdown of the unit.

Description.

During a walkdown of the EFW system, the team observed that some components that were relied upon for safe shutdown of the unit following a tornado were not physically protected from damage that could be caused by tornado missiles.

Those components included: 1) the turbine-driven EFW pump steam exhaust pipe, 2)the three EFW pumps combined minimum flow pipe at the condensate storage tank (CST), 3) the three EFW pumps combined suction pipe at the CST, 4) both EDG fuel oil storage tanks vent pipes, and 5) both EDGs exhaust pipes. The team observed that if tornado missiles were to pinch closed any of these pipes, the operation of equipment relied upon to safely shut down the unit following a tornado could potentially be affected. The team also determined that only one of these components, the EDGs exhaust pipes, was discussed in FSAR Section 3.5, Missile Protection, and was included in the FSAR Table 3.5-6 list of safety-related components located outdoors. The licensee had no specific analyses for tornado missile protection for the other components, but stated that because each was small they were not required to be protected from tornado missiles because the risk of being hit by a tornado missile was very low. FSAR Section 3.5.1.4, Missiles Generated by Natural Phenomena, stated that systems and components required to ensure the integrity of the reactor coolant pressure boundary and to maintain safe shutdown conditions or to provide the capability to prevent accidents which could result in exceeding offsite radiation exposure limits, are provided missile protection through location within Seismic Category I structures, missile barriers, or probability analysis. However, the team questioned whether it was acceptable for the licensee to have a number of safety-related components outside of buildings and not physically protected from tornado missiles (e.g., those components observed by the team and listed above). In response to this concern, the licensee initiated CER 0-C-04-3637 to address the omission of certain outdoor components from FSAR Table 3.5-6.

The team also found that the licensee had performed a plant modification in 1993 to move the safety-related chilled water system expansion tank from inside the control building to the roof of the control building where it could be vulnerable to damage from tornado missiles. A licensee analysis had concluded that the chill water expansion tank was not required to be physically protected from tornado missiles because it was small and consequently the risk of it being damaged by a tornado missile was very low (less than 1.0 E-7 per year). The licensee analysis concluded that anything smaller than 196 square feet in size (about the size of a mini-van) was not required to be physically protected from tornado missiles. Also, the analysis did not sum or consider the cumulative damage probabilities for all exposed components. The licensee analysis had used an equation from FSAR Section 3.5.1.4 that was for calculating the probability of a tornado missile penetrating an opening (e.g., a doorway) in a Seismic Category I building and striking a critical component inside the building. The team questioned whether the FSAR equation had been appropriately applied to a component that was not inside a building.

In addition, the team observed that the FSAR equation appeared to be incorrect. For example, the equation implicitly assumed that a design basis tornado would generate only one missile. Also, the equation assumed that the one missile had to strike with a certain orientation, which had only a 10% probability of occurring. However, the team considered that a tornado had the potential to generate many missiles and that a missile could strike an outdoor component with multiple orientations and still cause damage. The team questioned whether the equation in the FSAR was acceptable for determining if physical protection from tornado missiles was required for safety-related components located outdoors or even for components located inside a Seismic Category I building.

The team determined that the FSAR equation had been added to the Safety Analysis Report (SAR) in 1979, before the SAR was approved by the NRC in 1981. In 1979, the SAR identified only two components that were needed for safe shutdown and were outside where they were not physically protected from tornado missiles - the two EDGs exhaust pipes. The SAR stated that physical protection of the EDGs exhaust was not required because of the very low probability of damage due to tornado missiles (less than 1.0 E-7 per year). However, the 1981 NRC Safety Evaluation Report (SER) approving the V. C. Summer nuclear plant design stated the following about protection from tornado missiles: All safety-related systems and components, with the exception of the condensate storage facility, are located within structures designed to afford protection from tornado missiles. The team determined that there was a conflict between the words in the SAR and the 1981 NRC SER approving the SAR with regard to protection from tornado missiles.

The licensee entered this issue into the corrective action program in CER 0-C-04-3637 and in CER 0-C-04-3778. This issue remains unresolved pending further NRC review of the licensing basis for tornado missile protection: URI 05000395/2004009-02; Tornado Missile Vulnerabilities of Outdoor Components.

.2.1.1 3 Emergency Feedwater Flow Control Valve IFV-3536

a. Inspection Scope

The team reviewed FSAR and DBD information related to air-operated valve IFV-3536, the flow control valve for EFW flow from the turbine-driven EFW pump to steam generator A. The team also reviewed an analysis supporting the automatic isolation of a faulted steam generator with this valve as well as an analysis for the sizing of the instrument air accumulator for the valve to verify that the analysis was consistent with the FSAR and DBD. During an EFW system walkdown, the team inspected IFV-3536 and the other EFW flow control valves to observe the physical conditions around the valves. The team also reviewed corrective actions and maintenance work on this valve for the last two years to verify that the valve was being appropriately tested and maintained. The team reviewed operator procedures and job performance measures for local manual closing of the valve in the event that the air operator failed, to verify that they were appropriate. In addition, the team reviewed licensee plans to install another air-operated valve in series with IFV-3536 (and each of the other EFW flow control valves) to eliminate the need for the local manual operator action to mitigate a single failure. The team also reviewed the purchase specification for this valve (and the other five flow control valves) to determine if they were specified to handle relatively unclean SW.

The team reviewed calculation DC09610-024 to verify the lower and upper process limits of the EFW high flow setpoints. The team determined that the calculated setpoint was adequate to ensure the EFW flow would isolate only when required.

b. Findings

One finding was identified related to the EFW flow control valves. The finding is described in Section 4OA5.2.1.1.

.2.1.1 4 Class 1E Station Batteries

a. Inspection Scope

The team reviewed the Class 1E station battery calculations to verify that the battery sizing would satisfy the requirements at the loads and that the minimum possible voltage was taken into account.

The team reviewed battery surveillance test results on Train A and B station batteries to verify that applicable test acceptance criteria and test frequency requirements specified in TS for the batteries were met. The test records that were reviewed are listed in the attachment to this report. The team also visually inspected each battery bank and each individual cell in each bank for signs of degradation such as excessive terminal corrosion, electrolyte leaks, plate buckling or excessive plate growth, and plate discoloration. The battery chargers were observed to be energized with acceptable indicated voltage and current present. The battery ground detection system was checked to verify that no detectable grounds were present on the direct current

(dc) system. The battery room temperatures were also observed to be within specified design temperature ranges as demonstrated by local temperature monitors.

The team reviewed the Class 1E battery calculations to verify that they were in compliance with the requirement for a four-hour coping duration as stated in the station blackout analysis.

b. Findings

No findings of significance were identified.

.2.1.1 5 Switchyard - Maintenance

a. Inspection Scope

The team interviewed plant and transmission department personnel to get an overview of the maintenance program being implemented on switchyard equipment and to understand the industry standards that were used to develop the program. The team also reviewed the applicable industry guideline documents to determine if the tests and inspections that were being performed on the switchyard equipment were reasonably consistent with the industry recommendations. The team performed a general walkdown of the switchyard areas and visually inspected switchyard busses, disconnects, oil circuit breakers, bushings, transformers, and batteries for signs of degradation or damage (e.g., low oil levels in transformers, oil leaks on breakers and transformers, cracked insulator bushings, and corrosion on battery terminals). The team reviewed a sample of the licensees predictive and preventive maintenance records (e.g., visual inspections, infrared thermography, Corona camera/partial discharge detection, oil analysis, and diagnostic tests) on such items as oil circuit breakers, disconnects, and transformers to determine if problems identified such as hot spots were being reported to the plant and corrected. The team also reviewed CERs on switchyard equipment to verify that equipment problems were being identified and corrected. The specific documents reviewed are listed in the attachment to this report.

b. Findings

No findings of significance were identified.

.2.1.1 6 Emergency Diesel Generators

a. Inspection Scope

The team reviewed the TS, FSAR, flow diagrams, corrective action documents, and work orders for the last two years for diesel generator fuel oil equipment, to verify that the diesel fuel oil equipment was being maintained in a condition to be able to perform its design safety function.

b. Findings

No findings of significance were identified.

.2.1.1 7 Diesel Generator Fuel Oil Day Tank Sizing and Level Monitoring

a. Inspection Scope

The team reviewed EDG fuel oil day tank sizing, including corrective action and design change documents, to verify that any issues were appropriately resolved.

The team reviewed calculations, procedures and drawings to determine whether the EDG day tank level instrumentation design was in accordance with TS 3.8.1.1 and 4.8.1.1.2.

The team reviewed elementary drawings and setpoint accuracy calculations for the EDG level instrumentation to verify that the range, accuracy, and setpoints of the instruments were in accordance with the design bases.

The team reviewed elementary drawings for the day tank level switches and fuel oil transfer pumps to verify that the pumps would start automatically at the normal and standby pump ON setpoints.

b. Findings

No findings of significance were identified.

.2.1.1 8 Potential for Silt Deposition in Diesel Engine Coolers

a. Inspection Scope

The team reviewed tests, inspections, and work orders related to the diesel engine coolers to verify that the licensee was ensuring that the coolers remained capable of performing their design function.

b. Findings

No findings of significance were identified.

.2.1.1 9 Emergency Diesel Generator - Loading and Protective Relays

a. Inspection Scope

The team reviewed the sequential starting of loads, to determine if the EDG had sufficient capability to accelerate the loads within the specified time periods. The team reviewed the emergency diesel generator surveillance test and analysis of results to determine consistency with requirements. Specifically, the team conducted this review to verify that the EDG tested condition under a safety injection actuation signal (SIAS)/

loss of offsite power (LOOP) test verified compliance with requirements for actual conditions of loading present under a design basis event as outlined in the FSAR, there was assurance against overlapping of loading steps, and that there was assurance of operability between test periods.

The team reviewed the strip charts from 18-month and monthly surveillance tests, and the associated calculation, to verify that testing was in accordance with the calculations and with the accepted values for the following:

• motor accelerating time

• motor starting time

• maximum voltage during acceleration

• minimum voltage during acceleration

• voltage recovery time during acceleration

• maximum frequency during acceleration

• minimum frequency during acceleration

• frequency recovery time during acceleration

• minimum acceptable voltage at motor control centers The team reviewed surveillance procedures and elementary drawings to determine if the diesel generator protective relaying was designed as described in FSAR Section 8.3.1.1.2.8 and Table 8.3-3a, and tested in accordance with the requirements of TS 4.8.1.1.2.g.6.c.

The team reviewed diesel generator control elementary drawings and the integrated safeguards test procedure to verify that EDG trips, with the exception of the engine overspeed, low lube oil pressure, and generator differential trips, were bypassed during emergency operation, and that the bypass function was tested on an 18-month frequency as required by TS. The team also reviewed corrective action documents and procedures pertaining to a testing deficiency discovered by the licensee in regards to this function in 1996.

b. Findings

Introduction.

The team identified a Green, Non-Cited Violation (NCV) of TS 6.8.1.c, Procedures and Programs, for failure to include the proper testing methodology in Procedures STP-125.010 and STP-125.11 to meet the requirements of TS Surveillance Requirment 4.8.1.1.2.g.6.c.

Description.

TS 4.8.1.1.2.g.6.c required testing to demonstrate that all EDG trips, with the exception the overspeed, generator differential, and low lube oil pressure trips, were automatically bypassed upon loss of voltage on the associated emergency bus concurrent with a safety injection (SI) signal. The non-emergency diesel engine trips were blocked by an open contact of the test start relay (TSR), while the non-emergency generator trips are blocked by an open contact of the test start auxiliary relay (TSA). Procedure STP-125.010, Integrated Safeguards Test, Step 6.18 was intended verify the required trip bypass for EDG A. However, instead of checking that the appropriate TSR and TSA contacts were open, the procedure checked that a contact on the emergency start auxiliary relay (ESA) was open. The state of the ESA relay contact checked in the procedure does not provide direct evidence that either the TSR or TSA has actuated or that the trips are blocked.

CER 0-C-96-0336 had previously identified a similar deficiency in the testing method for this circuit. As part of the corrective action for this CER, a restricted (temporary)procedure change was made to a monthly surveillance, STP-125.002, Diesel Generator Operability Test, which correctly tested the required contacts in 1996.

However, this was not properly translated into a permanent procedure change and as a result, the revision of the 18-month surveillance procedure, STP-125.010, which was in effect at the time of this inspection, did not correctly test the required contacts.

The licensee verified that Procedure STP-125.010 did not perform the test required by TS and also that no other procedure accomplished the required test for EDG A. (A similar deficiency existed in Procedure STP-125.011 for EDG B.) The licensee issued CER 0-C-04-3626 to document these deficiencies and prepared temporary procedure changes in order to perform prompt testing of the bypass functions. This testing showed that the bypass function was operating properly on both EDGs.

The trip bypass function is intended to increase the reliability of the emergency standby power source by disabling certain non-critical engine and generator trips during emergency operation, which could be generated by spurious signals. Failure of the bypass function would not, by itself, cause an EDG trip, but could allow a spurious trip from one of several non-critical protective devices during emergency operation.

Analysis.

Failing to include the proper testing methodology in Procedures STP-125.010 and STP-125.01 is a performance deficiency. This was reasonably within the licensees ability to control and could have been prevented. This is greater than minor because it is related to the procedure quality attribute of the Mitigating Systems cornerstone and affects the objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Because there was no actual loss of the safety system function, as demonstrated by subsequent testing, this finding is of very low safety significance.

This finding also represents a cross-cutting issue in the area of problem identification and resolution, in that the same test deficiency discovered by the team had been previously discovered by the licensee and documented in CER 0-C-96-0336. The corrective action taken as a result of the CER did not rectify the original procedure deficiency and the CER was subsequently closed.

Enforcement.

TS 6.8.1.c. requires, in part, that written procedures shall be established, implemented and maintained covering surveillance and test activities of safety-related equipment including the emergency diesel generators. TS Surveillance Requirement 4.8.1.1.2.g.6.c requires testing to demonstrate that all EDG trips other than overspeed, generator differential, and low lube oil pressure were automatically bypassed upon loss of voltage on the associated emergency bus concurrent with an SI signal. Procedures STP-0125-010 and STP-0125-011 were written, in part, to fulfill this requirement. Contrary to the above, Procedures STP-0125-010 and STP-0125-011 did not provide for adequate testing of the bypass function as intended, and no other procedures were identified that satisfied the requirement. The lack of adequate procedures has resulted in the failure to test the bypass function since November 1996, when a similar test deficiency was discovered by the licensee and addressed by a temporary procedure change. Subsequent testing demonstrated that the bypass function operated properly. Because the bypass function has been shown to be operating properly, and this item has been entered into the licensees corrective action program (CER 0-C-04-3626), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy, and is identified as NCV 05000395/2004009-03, Inadequate Procedures to Test Non-Emergency Diesel Generator Trip Bypass Relays.

.2.1.2 0 Offsite Power Supply and High Voltage Switchyard

a. Scope

The team reviewed the electrical power systems DBD to determine the margin between the allowable ranges of off-site voltages and the values of voltage acceptable for operation. The team reviewed two-year records of system voltages from the system operator to verify that voltage was properly maintained and alarms were provided for off-voltage conditions.

The team reviewed the loss of 115 kV offsite source event of June 12, 2004, when the 115kV Parr ESF line was temporarily lost during a thunderstorm resulting in loss of offsite power to the 1D bus and start of the EDG A (unplanned safety system actuation), to determine if the licensee should have performed an extent of condition review.

The team reviewed the licensees report for the loss of 115 kV offsite source event of June 12, 2004, and the associated digital fault recorder information, as well as the Parr substation relaying protection in order to determine the sequence of events and to find out if proper fault coordination was present in accordance with the system design.

The team reviewed the electrical power systems DBD to determine if the method of protection against ground faults on the 115 kV off site source line from Parr complied with the applicable requirements.

The team reviewed the modification for the replacement of the 125 VDC battery in the switchyard, to determine if it provided for four-hour coping duration as required by the SBO analysis.

The team reviewed the modification that installed the 7.2 kV voltage regulator to verify it had been performed in accordance with plant requirements. The team focused on whether the modification was properly performed and provided a valid contribution to the stabilization of the steady state voltage for the off site source. Limitations on the application of the voltage regulator were also reviewed.

b. Findings

No findings of significance were identified.

.2.1.2 1 7.2 kilo-Volt Class 1E Switchgear

a. Inspection Scope

The team reviewed the licensing commitments contained in the FSAR to determine the requirements for the settings of the degraded and loss of voltage relays. The team reviewed the basis for the setpoint, whether the settings allow for proper operation of all loads, and whether all required loads were analyzed to operate successfully during the period of set time delay. The team reviewed the surveillance procedures for the loss of voltage relays to determine compliance with the pick up and drop out limits. The team reviewed the protective relaying calculations for the 7.2 kV Class 1E service water pump motors to determine if the protection and coordination were within the motor allowable thermal limits and operating conditions. The team inspected the room layout for the 7.2 kV Class 1E switchgear Train B, to determine if the general arrangement was consistent with requirements of independence and proper equipment protection.

The team reviewed 4 years of maintenance history records on the 7.2 kilo-Volt (kV)

EDG output circuit breakers and EFW pump motor feeder breakers to identify any recurring equipment problems. The team also walked down and inspected the 7.2 kV and 480 volt switchgear to verify that the protective relay settings for the degraded voltage and loss of voltage relays as well as the overcurrent relays for the EFW and service water pump motors were in accordance with design setpoint documents and calibration procedures. The team also recorded fuse information from fuses installed in Compartment 08 of the 7.2KV undervoltage relaying panel to verify that fuses installed were consistent with type and size specified by the fuse data base.

b. Findings

No findings of significance were identified.

.3.1. Review of Low Margin Operator Actions

a. Inspection Scope

The team reviewed risk significant, time critical operator actions that presented little margin between the time required and time available to complete the action. To determine the scope and subsequently perform a detailed review of critical operator actions, the team utilized risk information contained in the licensees FSAR, Probabilistic Risk Assessment (PRA), Operator Timeline Validation of Required Operator Actions (OAP-101.3), Job Performance Measures (JPMs), Emergency Operating Procedures (EOPs), Abnormal (AOPs) and System Operating Procedures (SOPs), and issues in the licensees CER Database. The team performed a detailed review of the following potentially time critical and low margin operator actions:

• Operator actions to install back-up cooling to the charging pumps

• Isolating EFW (local actions) to a faulted steam generator

• Operator actions to perform emergency boration

• Swapping CCW pumps from slow to fast speed

• Swapping to cold leg recirculation (scenario observed on simulator)

• Operator response for a total loss of CCW (scenario observed on simulator)

• Operator response for total loss of SW

• Operator actions to perform feed and bleed of the reactor coolant system

• Corrective action response for CER 0-C-99-1026, Operator response times listed in the FSAR have not been verified. This includes operator actions for safety injection (SI) termination for an inadvertent SI; actions to isolate a EFW during a steam line break event outside containment; and operator isolation response for a steam generator tube rupture event.

For all the above operator action scenarios, the team verified that operating procedures were consistent with operator actions for a given event or accident condition and that the operators had been adequately trained and evaluated for each action. Control room instrumentation and alarms were also reviewed by the team to verify their functionality and to verify alarm response procedures were accurate to reflect current plant configuration. Additionally, the team performed a walkdown of accessible field portions of the reviewed systems to assess material condition and to verify that field actions could be performed by the operators as described in plant procedures and job performance measures. Timeliness of the licensee corrective action responses for operator time line issues were reviewed through a CER database search. Documents reviewed are listed in the Attachment.

b. Findings

Introduction.

The team identified a Green NCV of 10 CFR 50, Appendix B, Criterion XVI for the licensees failure to take timely corrective action to address the potential inability of plant operators to terminate safety injection after an inadvertent ECCS actuation at power within the time assumed in the plant design basis.

Description.

In 1993, V.C. Summer was notified of a concern by Westinghouse through the issuance of Nuclear Safety Advisory Letter (NSAL)93-013, Inadvertent ECCS Actuation at Power. This concern was based on an analysis by Westinghouse which indicated the pressurizer would fill to a water-solid condition as the result of an inadvertent ECCS actuation with the reactor at power. This would then result in the pressurizer safety valve lifting under solid-water conditions, a mode for which it is not designed. A review by V.C. Summer of this concern at the time concluded that the pressurizer safety valves would lift and reseat under solid water conditions and thus continue to operate reliably. Based on this determination the licensees evaluation recommended that this issue be closed with no further action required. However, this evaluation was conducted by licensing personnel and did not have a detailed engineering analysis performed to address actual safety valve inlet and outlet conditions, the impact on valve performance (potential for sticking open) and effects on downstream piping / supports. Additionally, time restraints on operator actions were not addressed and required updates of the FSAR analyses were not considered.

In 1998, the licensee captured this concern in CER 0-C-98-0262. In August of 1999 the station issued Operations Administrative Procedure OAP-101.3 Timeline Validation of Required Operator Actions, to define the process and provide direction to ensure the operator timelines assumed in the design basis and FSAR could be accomplished by the operators and to provide a process for validating any future procedure or protocol changes in operator actions.

A CER conversion from the paper version, CER 0-C-98-0262, to an electronic version, CER 0-C-99-1026, was completed in July 1999. CER 0-C-99-1026 addressed several operator response times listed in the FSAR that had not been verified (including response to inadvertent ECCS actuation at power). Action 12 of CER 0-C-99-1026 transferred this issue to a CER 0-C-02-3291 in November 2002. This new CER was to address all inadvertent ECCS actuation operator time-line issues and any additional actions necessary to show that a Condition II event (Faults of Moderate Frequency)would not result in a Condition III event. (Infrequent Faults) (i.e., inadvertent SI would not result in a loss of coolant accident (LOCA) due to a stuck open safety valve or could be handled safely). CER 0-C-02-3291 was to develop an engineering change request which would credit use of the pressurizer safety valve for water relief to mitigate an inadvertent safety injection (in lieu of the termination of SI flow and maintaining pressurizer level less than 100 percent as described in FSAR Section 15.2.14.1).

On November 2, 2004, during this inspection, the operability section for CER 0-C-02-3291 was updated to reflect an operability assessment which concluded the plant response to an inadvertent ECCS actuation condition was operable but degraded. This is based on operator simulator response timelines that indicated termination of an inadvertent ECCS actuation would take between 10 to 17 minutes and that a potential existed for water relief through the pressurizer safety valves assuming no credit for automatic pressurizer PORV actuation. (The FSAR had assumed 10 minutes for terminating ECCS flow in order to preclude pressurizer overfill with no PORV actuation being credited.)

The stations current response to NSAL-93-013 is incomplete and more evaluation and approvals are required to demonstrate that a Condition II event acceptance criterion is met (i.e., safety valves can handle a water relief condition without sticking which would result in a Condition III event, LOCA). The licensees current schedule is to complete the Westinghouse evaluation for safety valve water relief and piping evaluation for water relief by end of June 2005 and complete licensing submittal changes to the NRC in 2006. The licensee has failed to promptly and effectively evaluate / correct this condition adverse to quality which was first identified in 1993.

Analysis.

This issue is a performance deficiency because the licensee failed to take prompt corrective actions to correct a condition adverse to quality as required by 10 CFR 50, Appendix B. This was reasonably within the licensees ability to foresee and correct and could have been prevented. This issue is greater than minor because the inability to meet the design basis timeline is associated with the procedure quality and design control attributes of the mitigating systems cornerstone and affects the cornerstone objective of ensuring the capability that operators would be able to properly respond to an initiating event to prevent undesirable consequences. This finding was determined to be of very low safety significance (Green) because it did not result in an actual loss of safety function (i.e. per licensee evaluations and NRC review it was determined the issue represented a condition that was degraded but operable).

Enforcement.

10 CFR 50, Appendix B, Criterion XVI, requires that conditions adverse to quality be promptly identified and corrected. Contrary to the above, the licensee failed to take prompt action to correct the inability of plant operators to terminate safety injection after an inadvertent ECCS actuation at power within the time assumed in the plant design basis. Because this finding is of very low safety significance and has been entered into the corrective action program as CER 0-C-04-3250 this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000395/2004009-04, Failure to Take Timely Corrective Action to Address Operator Timeline Response Deficiencies.

.4.1 Review of Industry Operating Experience

a. Inspection Scope

The team reviewed selected operating experience issues that had occurred at other facilities for their possible applicability to Summer. Several issues that appeared to be applicable to Summer were selected for a more in-depth review. The issues that received a detailed review by the team included:

• A previous NRC inspection finding at the Point Beach Nuclear Power Station concerning a red finding associated with clogging of recirculation flow orifice in the emergency feedwater system, NRC Information Notice 2004-001, Auxiliary Feedwater Pump Recirculation Line Orifice Fouling - Potential Common Cause Failure.

• Byron Station, Braidwood, River Bend, St. Lucie and Salem/Hope Creek stations where the licensees had exceeded their licensed maximum power level due to inaccuracies in feedwater ultrasonic flow measurement systems documented in V.C. Summer CER 0-C-04-2000.

• Potential loss of CCW due to improper setting of relief valve nozzle rings, NRC Information Notice 92-64, Nozzle Ring Settings in Low Pressure Water-Relief Valves.

• Various industry issues with turbine driven emergency feedwater pump operation including:

a) Entry into Mode 3 with TDEFW pump inoperable b) A missed post-maintenance test and c) Turbine driven auxiliary feedwater pump trip and throttle valve latch sticking

• Operating Experience related to safety injection/charging pump gas binding issues NRC IN 88-23, NRC Information Notice 88-23, (Supplements 1-5): Potential for Gas Binding of High Pressure Safety Injection Pumps During a Loss-of-Coolant Accident, reviewed under CER 02-2850 and 02-3176 responses.

b. Inspection Findings No findings of significance were identified. However, Section 4OA5.2.1.1 (b)documents a finding related to a limited extent of condition review for NRC Information Notice 2004-001, Auxiliary Feedwater Pump Recirculation Line Orifice Fouling -

Potential Common Cause Failure.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The lead inspector presented the inspection results to Mr. J. Archie, Site Vice President, and other members of the licensee staff on November 19, 2004. No information provided to the team was identified as proprietary. Following completion of additional review in the Region II office, a final exit was held by telephone with Mr.

J. Archie and other members of the licensee staff on December 22, 2004, to provide an update on changes to the preliminary inspection findings.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

J. Archie, Site Vice President

F. Bacon, Manager, Chemistry Services

D. Baker, Operations Plant Supervisor

M. Browne, Manager, Quality Systems

T. Clark, Supervisor, Plant Support Engineering

R. Clary, Manager, Nuclear Licensing and Operating Experience

M. Fowlkes, General Manager, Engineering Services

S. Furstenberg, Manager, Nuclear Operations Training

D. Gatlin, General Manager, Nuclear Plant Operations

B. Herwig, Supervisor, Design Engineering

M. Kammer, Design Supervisor

G. Lippard, Manager, Operations

K. Nettles, General Manager, Nuclear Support Services

G. Moffatt, Manager INPO Preps

A. Paglia, Engineering Supervisor

B. Stokes, Manager, Design Engineering

W. Stuart, Manager, Plant Support Engineering

B. Wasely, Manager

R. White, South Carolina Public Service Authority

B. Williamson, Supervisor, Emergency Services

S. Zarandi, Manager, Maintenance Services

NRC

C. Casto, Director, Division of Reactor Safety, Region II

J. Jacobson, Project Manager, Inspection Program Branch, Office of Nuclear Reactor

Regulation

C. Ogle, Chief, Engineering Branch 1, Region II

J. Zieler, Senior Resident Inspector, V.C. Summer

Attachment

ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000395/2004009-01 URI Potential for Emergency Feedwater Flow Control Valves to be Plugged by Tubercles and Other Debris from Service Water (Section 4OA5.2.1.1)

05000395/2004009-02 URI Tornado Missile Vulnerabilities of Outdoor Components (Section 4OA5.2.1.12)

Opened and Closed

05000395/2004009-03 NCV Inadequate Procedures to Test Non-

Emergency Diesel Generator Trip Bypass Relays (Section 4OA5.2.1.19)

05000395/2004009-04 NCV Failure to Take Timely Corrective Action to Address Operator Timeline Response Deficiencies (Section 4OA5.3.1)

Attachment