IR 05000397/2010006

IR 05000397-10-006, On-site May 17 - 21, 2010, & June 1 - 10, 2010, In-office June 14 - July 30, 2010, Columbia Generation Station: Baseline Inspection, NRC Inspection Procedure 71111.21, Component Design Bases Inspection

ML102530274
Person / Time
Site:	Columbia
Issue date:	09/09/2010
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Reddemann M Energy Northwest
References
IR-10-006
Download: ML102530274 (48)

Text

September 9, 2010

SUBJECT:

COLUMBIA GENERATING STATION - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000397/2010006

Dear Mr. Reddemann:

On June 10, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed the onsite portion of a component design bases team inspection at the Columbia Generating Station.

The enclosed report documents our inspection findings. The team discussed the preliminary findings on June 10, 2010, with Mr. Scott Oxenford, Vice President - Nuclear Generation and other members of your staff. After additional in-office inspection, the team leader conducted a final telephonic exit on July 30, 2010, with Mr. Douglas Coleman, Manager of Regulatory Programs and others of your staff.

The inspection examined activities conducted under the conditions of your license as they relate to safety and compliance with the Commission's rules and regulations. The team reviewed selected procedures and records, observed activities, and interviewed cognizant plant personnel.

This report documents three NRC identified findings of very low safety significance (Green).

The findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the noncited violations or the significance of the noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E. Lamar Blvd, Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the Columbia Generating Station facility. In addition, if you disagree with the crosscutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at the Columbia Generating Station.

UNITED STATES NUCLEAR REGULATORY COMMISSION R E GI ON I V 612 EAST LAMAR BLVD, SUITE 400 ARLINGTON, TEXAS 76011-4125

Energy Northwest

- 2 -

In accordance with Code of Federal Regulations, Title 10, Part 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS)

component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Chief

Engineering Branch 1

Division of Reactor Safety

Docket: 50-397 License: NPF-21

Enclosure:

Inspection Report 05000397/2010006 w/Attachments: Supplemental Information

REGION IV==

Docket:

05000397 License:

NPF-21 Report Nos.:

05000397/2010006 Licensee:

Energy Northwest Facility:

Columbia Generating Station Location:

Richland, WA Dates:

May 17 - 21, 2010 Onsite May 24 - 28, 2010 In-Office June 1 - 10, 2010 Onsite June 14 - July 30, 2010 In-Office Team Leader:

W. Schmidt, Senior Reactor Analyst NRC Region I Inspectors:

S. Makor, Reactor Inspector, Engineering Branch 1 B. Larson, Senior Operations Engineer, Operations Branch M. Young, Reactor Inspector, Engineering Branch 1 J. Nicely, NRC Contractor, Beckman and Associates W. Sherbin, NRC Contractor, Beckman and Associates Approved By:

Thomas R. Farnholtz, Branch Chief Engineering Branch 1

- 2 -

Enclosure

SUMMARY OF FINDINGS

IR 05000397/2010006; On-site May 17 - 21, 2010, and June 1 - 10, 2010; In-office June 14 -

July 30, 2010, Columbia Generation Station: baseline inspection, NRC Inspection Procedure 71111.21, Component Design Bases Inspection.

The report covers an announced inspection by a team of four regional inspectors and two contractors. Three violations of significance were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609,

Significance Determination Process, and the crosscutting aspect was determined using Inspection Manual Chapter 0310, Components within the Crosscutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which requires, in part, measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures and instructions. Further required, in part, is that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, the licensee failed to establish measures to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures and instructions. Specifically, prior to June 5, 2010, the licensees measures established to assure that applicable regulatory requirements and the design basis, relative to the licensing basis duration for a volcanic ashfall generated loss of offsite power was not correctly translated into specifications, drawings, procedures and instructions. Also, the licensees design control measures failed to verify or check the adequacy of design for the potential effects of volcanic ashfall loading on emergency diesel generator intake pre-filters and combustion air and room ventilation outside air supply filters, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. This finding was entered into the licensees corrective action program as condition reports 219289, 219342, 219362, 219363, 219364, 219365, 219388, and 219394.

The team determined that failing to properly incorporate the licensing basis for an ashfall event and an inadequate design analysis of emergency diesel generator intake combustion air and room cooling air filter loading during an ashfall event was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a Phase 1 screening, in accordance with Inspection Manual Chapter 0609.04,

"Phase 1 - Initial Screening and Characterization of Findings," and determined that the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in loss of operability or functionality.

Specifically, the licensees revised calculation demonstrated that the emergency diesel generators would remain functional during the licensing basis ashfall generated two-hour duration loss of offsite power. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance (Section 1R21.2.5).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which requires, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, the licensee failed to provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, as of July 30, 2010, the licensees design control measures failed to verify or check the adequacy of design voltages to safety-related emergency core cooling system equipment powered from the 4160 Vac, 480 Vac, 120 Vac, and 125 Vdc distribution systems during a loss-of-coolant accident with offsite power available. This finding was entered into the licensees corrective action program as condition reports 219208, 219122, 219267, 219277, 219335, 219122, 219328, 219170, 220268, 220317, and 222419.

The team determined that the failure to verify and assure adequate voltages to safety-related emergency core cooling system equipment powered from the 4160 Vac, 480 Vac, 120 Vac, and 125 Vdc distribution systems during a design basis loss-of-coolant accident with offsite power available was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a Phase 1 screening, in accordance with Inspection Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," determining that the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in loss of operability or functionality. Specifically, the licensees interim calculation and operability determination demonstrated the operability of offsite power during a loss-of-coolant accident with offsite power available, in that the emergency core cooling system components would be operable and able to perform their safety function. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance (Section 1R21.2.11).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, which requires, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Where a test program is used to verify the adequacy of a specific design feature in lieu of other verifying or checking processes, it shall include suitable qualifications testing of a prototype unit under the most adverse design conditions. Contrary to the above, the licensee failed to provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, as of June 10, 2010, the licensees design control measures failed to verify or check the adequacy of design for the extension of qualified life for safety-related Tyco/Agastat E7000-series timing relays from 10 years to 40 years, by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. The licensee did not perform suitable qualifications testing of a prototype unit under the most adverse design conditions. Specifically, the licensee did not follow their station procedures for extending the service life and changing preventive maintenance frequencies; did not account for some known modes of degradation; did not account for normal and abnormal operating conditions; and did not maintain a trending program to monitor for indication of impending end-of-life relay failures. This finding was entered into the licensees corrective action program as condition reports 218559, 219436, and 218799.

The team determined that extending the qualified life of safety-related Agastat E7000-series relays without having an adequate technical basis was a performance deficiency.

This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a Phase 1 screening, in accordance with Inspection Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," and determined that the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in loss of operability or functionality. Specifically, no relay failures had occurred beyond the recommended 10-year service life and this did not result in the failure of multiple redundant trains of safety-related equipment. This finding has a cross-cutting aspect in the area of problem identification and resolution because the licensee did not effectively incorporate pertinent industry operating experience into the preventive maintenance program for Agastat E7000-series relays. Specifically, Energy Northwest failed to incorporate industry operating experience and site guidance when they extended their relay replacement preventive maintenance tasks from 10 years to 40 years P.2(b) (Section 1R21.3.1).

Licensee-Identified Violations

None.

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. As plants age, their design bases may be difficult to determine and important design features may be altered or disabled during modifications. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully.

This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Bases Inspection

To assess the ability of Columbia Generating Station plant equipment and operators to perform their required safety functions, the team inspected risk significant components, operator actions, and the licensees (Energy Northwests) responses to industry operating experience. The team selected risk significance components and operator actions for review, using information contained in the Columbia Generating Station Probabilistic Safety Assessment, draft 7.1 and the U. S. Nuclear Regulatory Commissions (NRC) standardized plant analysis risk model for the Columbia Generating Station. In general, the selection process focused on components and operator actions that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and non-safety related systems including pumps, circuit breakers, heat exchangers, transformers, and valves. The team selected the risk significant operating experience to be inspected based on its collective past experience.

a. Inspection Scope

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed

performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 20 to 30 total samples, including 10 to 20 risk-significant and low design margin components, 3 to 5 relatively high-risk operator actions, and 4 to 6 operating experience issues. The sample selection for this inspection was 20 components, 5 operator actions, and 5 operating experience items.

The selected inspection items supported risk significant functions as follows:

1) High Pressure Injection:

a) High pressure core spray system designed to maintain reactor vessel inventory after small breaks, which do not depressurize the reactor vessel, but which supplies water over the entire range of reactor coolant system operating pressures. The high pressure core spray system is designed to operate from normal power, off-site auxiliary power, or a dedicated standby diesel generator power supply if off-site power is not available. As such the team selected:

• The electrical aspects of the high pressure core spray system pump (HPCS-P-1) and the associated high pressure core spray system Division III emergency diesel generator lockout relay.

• The mechanical aspects of motor operated valves, including the injection valve (HPCS-V-4) need to open to allow flow to the reactor coolant system and the suppression pool suction valve (HPCS-V-15). HPCS-V-15 needs to open when condensate storage tank level is lowering to supply adequate flow to the pump; and the high pressure core spray system emergency diesel generator service water pump (HPCS-P-2), which supplies cooling water to the high pressure core spray system emergency diesel generator.

b) The team selected mechanical aspects of the reactor building condensate pump (COND-P-3), which provides a backup cooling water supply to the control rod drive pumps, which are a source of high pressure water to the reactor coolant system through the control rod drive system.

2) Electrical power to mitigation systems. The team selected several components in the offsite and onsite electrical power distribution systems to verify operability to supply alternating current (AC) and direct current (DC) power to risk significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and

a loss-of-coolant accident with offsite power available. As such the team selected:

a) The electrical aspects of the 230 kilo-volt alternating current (kVac) to 4160 Vac station service transformer (E-TR-S), 4160 Vac Switchgear Buses (E-SM-1 and E-SM-7), and the Division II emergency diesel generator (DG-ENG-DG2).

b) The mechanical aspects of the Division I emergency diesel generator (DG-ENG-DG1).

c) The static switch which automatically transfers and supplies power to 120 Vac power to Regulatory Guide 1.97, Category 1 instruments (E-ATS-IN/2) from the alternate source if the online inverter fails.

d) Division II DC Power Distribution Panels (E-DP-S1/2D) which supports safety-related loads.

e) For station blackout response: the non-safety related 125 volt direct current (Vdc) battery charger (E-C1-7), needed to supply control power to the in-plant non-safety switchgear circuit breakers; the operator actions needed to align and operate the portable 400 kilo-watt Division IV emergency diesel generator, which could support reactor core isolation cooling system operation and the operator action to crosstie the high pressure core spray system Division III emergency diesel generator to either the Division I or Division II safety busses, which could support operation of emergency core cooling system equipment.

f) Recent operating experience with offsite power capability related to the timing of secondary grid protection relays with respect to a loss-of-coolant accident with offsite power available.

3) Initiating events minimization:

a) The main steam safety relief valves, to ensure that they close following operation to prevent a stuck open safety relief valve, which is similar to a small loss-of-coolant accident.

b) The potential for an internal flood in the Control Building structure relative to ensuring adequate identification of normal service water leakage prior to a potential pipe break, which could lead to core damage due to flooding of electrical equipment.

c) The non-safety circuit breaker (E-CB-CTA) that supplies cooling tower loads, because spurious opening could result in a loss of the condenser heat sink and an unplanned plant shutdown.

4) Isolation of high energy pipe breaks outside of primary containment, which could lead to a significant leak from the reactor coolant system that bypasses the primary containment:

a) The outboard feed water containment isolation check valve.

b) The operator action to isolate a main steam line break.

5) Decay heat removal:

a) Service water pump discharge valve (SW-V-2B) and a pump room fan cooler (PRA-FC-1B) provide cooling water flow to remove decay heat and to keep the service water pump area cool to support service water pump operation, respectively.

6) Low pressure injection:

a) Recent operating experience issues concerning residual heat removal system safety functions of low pressure injection, suppression pool cooling, and shutdown cooling. Specifically, damage to the residual heat removal system that could be done due to vapor void collapse if the system restarted automatically following a loss of offsite power, if the system had been operating in the suppression pool cooling or test mode prior to the loss of offsite power.

7) Safety system actuation and control. Recent operating experience issues concerning:

a) Agastat relays failures to operate properly could lead to system failures.

b) Motor operated valve stem lubrication issues, which could lead to motor operated valve failures.

.2.1 High Pressure Core Spray Injection Valve (HPCS-V-4)

a. Inspection Scope

The team reviewed the design bases documents, calculations, corrective and preventative maintenance, and testing of the high pressure core spray system injection valve. Specifically, the team reviewed:

• Motor operated valve in-service testing, developed thrust testing, weak-link analysis, and differential pressure calculations

• The design and testing of the valve motor brake

• Local leak rate testing of the valve to ensure containment integrity was not compromised by the valve exceeding its administrative leak limit

• Piping and instrumentation diagrams, the vendor manual, and a sample of condition reports for the valve

• Calculations for the degraded voltage at the motor operated valve terminals, to ensure the proper voltage was utilized in motor operated valve torque calculations

• The calculations that establish control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing, application, testing and bypass

b. Findings

No findings were identified.

.2.2 High Pressure Core Spray Suppression Pool Suction Valve (HPCS-V-15)

a. Inspection Scope

The team reviewed the design bases documents, calculations, corrective and preventative maintenance, and testing of the high pressure core spray suppression pool suction valve. Specifically, the team reviewed:

• Motor operated valve in-service testing, developed thrust testing, weak link, and differential pressure calculations

• A modification of the control logic relied upon for opening the valve during a seismic event upon failure of the non-seismically designed condensate storage tank suction line

• Local leak rate testing of the valve to ensure containment integrity was not compromised by the valve exceeding its administrative leak limit

• Piping and instrumentation diagrams, the vendor manual, and a sample of condition reports for the valve

• Calculations for the degraded voltage at the motor operated valve terminals, to ensure the proper voltage was utilized in motor operated valve torque calculations

• The calculations that establish control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing, application, testing and bypass

b. Findings

The finding associated with this component was described as an example in Section

==1R21.2.12.b.1.4.

==

.2.3 Reactor Building Condensate Supply Pump (COND-P-3)

a. Inspection Scope

The team reviewed the updated final safety analysis report, design bases documents, calculations, and recent corrective and preventive maintenance of the reactor building

condensate supply pump. The team verified the pumps ability to provide flow at specified pressure, when relied upon to provide alternate cooling to the control rod drive pumps. Specifically, the team reviewed:

• Hydraulic calculations, and discussion with the system engineer about the capability of the pump to provide cooling water to the control rod drive pumps

• Piping and instrumentation diagrams, the vendor manual, a sample of condition reports

The team also conducted a walkdown of the pump area to assess the configuration and material condition of the pump, piping, and valves that are relied upon to line up cooling water to the control rod drive pumps.

b. Findings

No findings were identified.

.2.4 Main Steam Relief Valves (MS-RV-1A, 1B, etc.)

a. Inspection Scope

The team evaluated the main steam relief valves regarding the ability of the valves to reseat after opening so that there would be no suppression pool heat-up due to seat leakage. A Boiling Water Reactor Owners Group safety relief valve leakage committee was formed to address main steam relief valve seat leakage. Regarding the Crosby

6R10 valves that were installed at the Columbia Generating Station, the Boiling Water

Reactor Owners Group recommended that the valves be upgraded with a new Flexidisc-2 design, which made the valve more resistant to leakage following Heatup/Cooldown cycles and manual actuations. The resulting reduction in valve leakage made suppression pool heatup manageable without significant station impact. Additionally, the history of valve leakage for the Crosby 6R10 shows that the operability of the main steam relief valve is not affected by valve leakage. The team reviewed the licensees program for addressing main steam relief valve seat leakage, and confirmed that the valves were modified in 1999 with the new Flexidisc-2 seat design. No appreciable main steam relief valve seat leakage has been observed since the modification was installed at the Columbia Generating Station.

b. Findings

No findings were identified.

.2.5 Division I Emergency Diesel Generators (DG-ENG-DG1)

a. Inspection Scope

The team reviewed the updated final safety analysis report, technical specifications, design bases documents, calculations, corrective maintenance, surveillance testing and post-maintenance testing of the emergency diesel generator. The team performed several detailed walkdowns of the emergency diesel generator rooms and essential

support systems to determine whether design or operational conditions existed that would compromise the performance of the emergency diesel generator.

Specifically, the team reviewed the following emergency diesel generator support subsystems design and operation:

• Fuel oil system, including recent oil sample results and consumption calculations to ensure technical specification requirements were met

• Lube oil system, including verification of sufficient lube oil supplies onsite to support extended operation, if required

• Jacket water to verify sufficient cooling capacity

• Combustion air and room outside air ventilation including the intake pre-filters that filter the outside air prior to the combustion air filters and emergency diesel generator room ventilation outside air supply filters. This air filtration system design was specifically reviewed with respect to a potential ashfall event and resulting postulated loss of offsite power, which was part of the Columbia Generating System licensing basis as a result of the 1980 eruption of Mount Saint Helens

• Starting air, including the design specification, starting air test results, in-service testing and non-destructive testing of the starting air accumulator tanks, normal operating pressure band, and air compressor actuation setpoints, to verify appropriate capacity for consecutive starts

The inspection team also performed walkdowns and performed interviews with design and system engineering personnel to ensure the capability of this component to perform its required safety function.

b. Findings

b.1 Inadequate Assessment of Emergency Diesel Generator Air Filters During Ashfall Event

Introduction.

The team identified a finding of very low safety significance (Green)involving a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, because Energy Northwest did not properly incorporate the licensing basis duration of a volcanic ashfall generated loss of offsite power into the design basis and associated calculations. As such, design calculations failed to adequately evaluate the potential effects on emergency diesel generator operation of volcanic ashfall loading on the intake pre-filters and the combustion air and room ventilation outside air supply filters. Ash loading on these filters could result in a common cause failure of the emergency diesel generators due to insufficient combustion and/or room cooling air flow.

Description.

The team found that the licensing basis with respect to the duration of an ashfall generated loss of offsite power event had not been well documented. The team reviewed updated final safety analysis report Section 2.5, which incorporates by reference Technical Memorandum (TM)-2143, Geology, Seismology, and Geotechnical Engineering Report. Based upon the 1980 eruption of Mount Saint Helens, this report describes the duration and ash density for an ashfall event lasting 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Columbia Generating Station calculation number ME-02-87-95, Calculation for Filter Loading for

DG HVAC and Combustion Air, Revision 1, assumed that one of the two emergency diesel generators needed to be operating to support emergency core cooling system loads for the entire 20 hour2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> ashfall event. This calculation referenced TM-1250, WNP-2 Volcanic Ash Study, Revision 1, which estimated the emergency diesel generators would run eight hours during the 20-hour ashfall event. This eight-hour duration was not incorporated into any design calculations.

The team found that calculation number ME-02-87-95, Revision 1, along with calculation modification record number 91-0312, 92-0467, 93-0953, 94-0168, and 6592 associated with the calculation (as of June 5, 2010) did not demonstrate the ability to maintain one of the two emergency diesel generators in operation for the assumed 20-hour ashfall generated loss of offsite power event. Specifically:

• Prior to the start of the inspection, calculation modification record number 6592 was the latest version, and was dated December 13, 2007. This calculation modification record established that the intake pre-filters for an operating emergency diesel generator would clog after 2.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. It stated on page 6, in part thatAlternate running of the Division I and Division II diesels will allow for changing of the prefilters during 2.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> runtime. The team reviewed procedure number ABN-ASH, Ashfall, Revision 11, which is entered upon a major volcanic eruption in the Pacific Northwest. There were no instructions in procedure ABN-ASH for operators to alternate running of the Division I and Division II emergency diesel generators

• Calculation modification record number 6592 determined the filter change-out time for the emergency diesel generator heating, ventilation, and air conditioning filters (Riga Flow 15) as 6.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to 7.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. These filters are located in the flow path after the pre-filters. The team determined that the calculation of filter change-out time was not conservative due to the use of the wrong filter efficiency. When the licensee performed a re-analysis, it was determined that the filters would need to be changed in 3.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />

Upon subsequent review, Energy Northwest determined and the team confirmed that the licensing basis was a 20-hour ashfall with a concurrent two-hour loss of offsite power, as stated in letter GO2-82-825, dated October 4, 1982, and Supplement 3 to NUREG-0892 (May 1983). This licensing basis had never appeared in the updated final safety analysis report or design basis calculations for filter loading.

Energy Northwest performed, calculation modification record number 9248 to ME-02-87-95, dated June 6, 2010. The team reviewed this calculation and determined that the air intake pre-filter, the combustion air filters and room ventilation outside air supply filters would remain functional during the licensing basis ashfall generated two-hour duration loss of offsite power event.

Analysis.

The team determined that the failure to properly incorporate the licensing basis for an ashfall event and an inadequate design analysis of emergency diesel generator intake combustion air and room cooling air filter loading during an ashfall event was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and

affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a Phase 1 screening, in accordance with Inspection Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," and determined that the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in loss of operability or functionality.

Specifically, the licensees revised calculation demonstrated that the emergency diesel generators would remain functional during the licensing basis ashfall generated two-hour duration loss of offsite power. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which requires, in part, measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures and instructions. Further required, in part, is that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, the licensee failed to establish measures to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures and instructions. Specifically, prior to June 5, 2010, the licensees measures established to assure that applicable regulatory requirements and the design basis, relative to the licensing basis duration for a volcanic ashfall generated loss of offsite power were not correctly translated into specifications, drawings, procedures and instructions. Also, the licensees design control measures failed to verify or check the adequacy of design for the potential effects of volcanic ashfall loading on emergency diesel generator intake pre-filters and combustion air and room ventilation outside air supply filters, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. This finding was entered into the licensees corrective action program as condition reports 219289, 219342, 219362, 219363, 219364, 219365, 219388, and 219394. Because this finding was determined to be of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with Section V1.A.1 of the NRC Enforcement Policy: NCV 05000397/2010006-01, Inadequate Assessment of Emergency Diesel Generator Air Filters During an Ashfall Event.

.2.6 Turbine Service Water Break Floods Vital Island

a. Inspection Scope

The team reviewed the probabilistic safety assessment model notebook for internal flooding and performed system walk downs in the areas that would be impacted by the break to verify the probabilistic safety assessment assumptions. The team reviewed calculations including time to flood the vital island if the three inch turbine service water piping in equipment access room (C502) ruptured.

b. Findings

No findings were identified.

.2.7 Service Water Pump 2 Discharge Motor Operated Throttle Butterfly Valve

(SW-V-2B)

a. Inspection Scope

The team reviewed the updated final safety analysis report, design bases documents, calculations, corrective maintenance and post-maintenance tests of the service water pump 2B discharge motor operated throttle butterfly valve to ensure that the equipment was capable of meeting design requirements. Specifically the team reviewed:

• Calculations including the weak link analysis and the maximum expected differential pressure

• Stroke sequence timing information to ensure that a water hammer condition does not exist in the service water system

• Piping and instrumentation diagrams, in-service test results, vendor manuals, associated condition reports and evaluation of the valve to assess the configuration and material condition

• Calculations for degraded voltage at the motor operated valve terminals, to ensure proper voltage values utilized in the associated motor operated valve torque calculations

• The calculations that establish control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing, application, testing, and bypass

b. Findings

No findings were identified.

.2.8 Reactor Feedwater Containment Outboard Isolation Valve (RFW-V-32A)

a. Inspection Scope

The team reviewed the design bases documents, calculations, corrective and preventative maintenance, and testing of the reactor feedwater containment outboard isolation valve. Specifically, the team reviewed:

• A modification package that installed a vent line at the valve to ensure adequate local leak rate testing capability

• Corrective maintenance for the seating surface was performed in accordance with vendor recommendations

• Local leak rate test results of the valve to ensure containment integrity was not compromised by the valve exceeding its administrative leak limit

• Piping and instrumentation diagrams, the vendor manual, and a sample of condition reports for the valve

b. Findings

No findings were identified.

.2.9 High Pressure Core Spray Diesel Generator Service Water Pump (HPCS-P-2)

a. Inspection Scope

The team reviewed the updated final safety analysis report, design bases documents, calculations, corrective maintenance, and post-maintenance tests of the high pressure core spray emergency diesel generator service water pump. The team verified the pumps ability to provide design basis flow rate at specified pressures. Specifically, the team reviewed:

• In-service test results, system flow balance test data and the associated calculation

• Material condition of seismic support rings, suction screen, and pump submergence requirements during all conditions

• Piping and instrumentation diagrams, vendor manual, a sample of condition reports and conducted a walkdown of the pump to assess the configuration and material condition of the pump

• Calculations that establish voltage drop, protection and coordination, motor brake horsepower requirements, and short circuit analysis for the motor power supply and feeder cable to verify that design bases and design assumptions were appropriately translated into design calculations

b. Findings

No findings were identified.

.2.10 Service Water Pump Room Cooler (PRA-FC-1B)

a. Inspection Scope

The team reviewed the design bases documents, calculations, corrective and preventative maintenance, of the service water pump room cooler (PRA-FC-1B). These reviews were conducted to verify the adequacy of design for the room cooler, and to verify that heat will be adequately removed during operation of the equipment in the room. The team also conducted a walkdown of the room cooler area to ensure adequate equipment physical condition. Specifically, the team reviewed:

• Heat load and heat removal calculations, including service water temperature and flow requirement calculations for the room coolers

• Recent thermal performance test results, which included measurement of air and water flow rates, and a calculation of as-found heat exchanger fouling factors

• Seismic calculations for the room cooler to ensure that integrity would not be compromised during a seismic event

• Piping and instrumentation diagrams, vendor manual, and a sample of condition reports for the room cooler

b. Findings

No findings were identified.

.2.11 High Pressure Core Spray Pump (HPCS-P-1)

a. Inspection Scope

The team reviewed the updated final safety analysis report, system design criteria, the current system health report, selected drawings, operating procedures, in-service tests and condition reports. This review included the licensees design basis documentation as well as various calculations, procedures, test results, and operability determinations.

Specifically, the team reviewed:

• Motor surveillance test results

• Control circuit voltage drop and coordination calculations

• Motor data sheets

• Emergency diesel generator loading calculations

• AC load flow and motor sizing calculations

• The vendor manual

b. Findings

No findings were identified.

.2.12 4

kVac Switchgear Buses (E-SM-1 and E-SM-7) (two electrical and one operating experience samples)

a. Inspection Scope

The team inspected the non-safety related and safety-related portions of a 4160 Vac switchgear division to verify its operation to supply electrical power to safety-related loads. As a worst case situation, the team assessed the electrical support role during a design basis event of a loss-of-coolant accident with offsite power available. Finally, the team performed a visual non-intrusive inspection to assess the installation configuration, material condition, and potential vulnerability to hazards. Specifically, the team reviewed:

• System health reports, component maintenance history and licensee corrective action program reports, to verify the monitoring and correction of potential degradation

• Calculations for electrical distribution system load flow/voltage drop, short-circuit, and electrical protection and coordination; to assess the adequacy and appropriateness of design assumptions, and to verify that bus capacity was not

exceeded and bus voltages remained above minimum acceptable values to support transmission of power to downstream safety-related 4160 Vac

• The protective device settings and circuit breaker ratings; to ensure adequate selective protection coordination of connected equipment during worst-case, short-circuit conditions to ensure continuity of power to downstream safety-related buses

• Circuit breaker preventive maintenance inspection and testing procedures; to determine adequacy relative to industry and vendor recommendations

• Offsite power degraded and loss of voltage relay protection scheme and circuit breaker control logics that initiate automatic bus transfers between the normal generation supply and the preferred offsite power supplies and between offsite power supplies and the associated emergency diesel generator

• Portions of the licensee response to NRC Generic Letter (GL) 2006-02, Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power, dated February 1, 2006

• The stations interface and coordination with the transmission system operator for plant voltage requirements and notification set points were reviewed

• Recent industry operating experience from the Diablo Canyon Nuclear Station concerning offsite power capability related to the timing of secondary grid protection relays with respect to a loss-of-coolant accident with offsite power available

• The 125 Vdc voltage calculations to determine if adequate voltage would be available for the circuit breaker open/close coils and spring charging motors

b. Findings

b.1 Inadequate Evaluation of Offsite Electrical Power Capability to Safety-Related Emergency Core Cooling System Equipment During a Design Basis Event with Offsite Power Available

Introduction.

The team identified a finding of very low safety significance (Green)involving a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. Specifically, Energy Northwest failed to verify and assure, in design basis calculations, that adequate voltages would be available to safety-related emergency core cooling system equipment powered from the 4160 Vac, 480 Vac, 120 Vac, and 125 Vdc distribution systems during a design basis loss-of-coolant accident with offsite power available.

Description.

The team identified nine examples of non-conservative inputs and methodologies in electrical calculations that contributed to the failure of the licensee to verify and assure adequate voltages to safety-related emergency core cooling system equipment during a design basis event with offsite power available. The following examples contributed to the identified performance deficiency:

1. Electrical calculation E/I-02-87-07, Load Flow & Voltage Analysis for the Plant

Main Buses AC Distribution Systems, evaluated starting 4160 Vac emergency core cooling system loads during a design basis event at steady-state voltages on the 4160 Vac safety-related buses associated with nominal 230 kVac grid

voltage. However, electrical calculation 2.14.01, Fast Transfer Analysis, predicted voltages as low as 60 to 84 percent of nominal resulting from the transfer on a unit trip of safety-related buses from their normal generator supplied source to the preferred offsite power supply. The licensee failed to account for the lower transient voltages that could be present when the emergency core cooling system loads are required to start. As a result, the voltage calculated at the motor terminals of accident initiated emergency core cooling system loads may not be the worst case. After identification, the licensee entered this issue into the corrective action program as condition report 219208.

2. Electrical calculation E/I-02-87-07 was non-conservative because it did not

include starting of 460 Vac motors and motor operated valves concurrent with starting of large 4160 Vac emergency core cooling system motors during a design basis event. As a result, the voltage calculated at the motor terminals during an accident for 460 Vac motors and motor operated valves may not be the worst case predicted in electrical calculation E/I-02-90-01, Low Voltage System Loading and Voltage Calculations. Calculation E/I-02-90-01 incorrectly evaluated starting voltages to 480 Vac loads with their associated motor control centers operating at steady-state voltages associated with the 4160 Vac buses at the degraded voltage relay analytical limit. After identification, the licensee entered this issue into the corrective action program as condition report 219122.

3. Electrical calculation E/I-02-87-07 analyzed running voltage for 4160 Vac

emergency core cooling system motors during steady-state post-accident operation following load sequencing, based on minimum voltage associated with the degraded voltage relay analytical limit. The calculation did not address starting voltage capability for motors that may be started after load sequencing is completed when voltages on the bus could be as low as slightly above the degraded voltage dropout setting. After identification, the licensee entered this issue into the corrective action program as condition report 220317.

4. Electrical calculation E/I-02-90-01 was non-conservative because it used a lower

locked rotor power factor of 67 percent for high pressure core spray injection valve HPCS-V-4 instead of 89 percent as indicated on Limitorque/Reliance Data Sheet. The high starting torque of motor operated valves requires a high rotor resistance, which results in an elevated locked rotor power factor. Use of a non-conservative locked rotor power factor causes an under-estimation of the cable voltage drop and may result in the over-estimation of motor operated valve capability under design basis conditions. After identification, the licensee entered this issue into the corrective action program as condition report 219267.

5. Electrical calculation E/I-02-90-01 was non-conservative because it used cable

resistance at 90°C for motor operated valves that are located in harsh environments. For those motor operated valves, the cable resistance would be higher therefore resulting in under-estimation of the cable voltage drop and may result in the over-estimation of motor operated valve capability under design basis conditions. After identification, the licensee entered this issue into the corrective action program as condition report 219277.

6. Electrical calculation E/I-02-89-02, Evaluation of the Design of 120 Vac Starter

Control Circuits for 480 Vac Motors, used steady-state voltages at the motor control centers associated with the 4160 Vac buses at the degraded voltage relay analytical limit. As a result, the licensee failed to evaluate the worst-case control circuit voltage drop for the control circuits for 480 Vac motors and motor operated valves that were required to change state at the onset of a design basis event. The use of steady-state voltages instead of transient voltages would predict higher control circuit voltages than would actually exist, therefore the control circuit contactors may not have adequate voltage to energize until after the upstream 4160 Vac starting motors have accelerated. The licensee also failed to evaluate the potential time delay impact for affected motor operated valves on the updated final safety analysis report accident analyses. After identification, the licensee entered this issue into the corrective action program as condition report 219335.

7. Electrical calculation E/I-02-90-01 failed to evaluate the capability of HPCS-MO-4

230 Vac motor brake to operate and release for motor operated valve HPCS-V-4 to perform its safety function for a design basis event during worst-case motor starting transient voltages. The motor brake vendor requires a minimum voltage of 207 Vac, but electrical calculation E/I-02-90-01 calculated a requirement of 194 Vac based on steady-state motor control center voltages. One-time test procedure 8.3.354, performed in 1995, evaluated the operation of the motor brake at a minimum voltage of 184 Vac. During a design basis event with resulting voltages lower than steady-state conditions, the motor brake may not have adequate voltage to operate and release during stroking of high pressure core spray injection valve HPCS-V-4. Additionally, the motor brake is not in a periodic maintenance and test program to address aging concerns of continued operability. After identification, the licensee entered this issue into the corrective action program as condition reports 219122 and 219328.

8. The licensee failed to evaluate the impact of a sustained degraded voltage for

the selected time delay of 8.7 seconds on the protective relaying/devices for running motors during the event. For a sustained degraded voltage, motors may stall and trip out on overcurrent conditions, potentially resulting in unavailability of required safety loads during an event and may required operator actions to reset those protective devices. After identification, the licensee entered this issue into the corrective action program as condition report 220268.

9. Electrical calculation 2.05.01, Battery Sizing, Voltage Drop, and Charger Studies

- Division I and II, did not correctly calculate the voltage drop for the breaker close coil and spring charging motors for emergency diesel generator breakers E-CB-7/DG1 and E-CB-DG1/7. As a result, the breaker spring charging motors may not have adequate voltage when supplied by the 125 Vdc batteries in order to function as designed under certain conditions such as subsequent breaker cycling. The breakers would be able to close once to allow their respective emergency diesel generators to power their respective safety buses, and therefore the breakers were operable but degraded. After identification, the licensee entered this issue into the corrective action program as condition report 219170.

At the end of the on-site inspection on June 10, 2010, Energy Northwest was in the process of completing an operability evaluation of the voltage available to safety-related loads following a loss-of-coolant accident with offsite power available. Energy Northwest completed the evaluation on July 9, 2010. This evaluation stated that this was only an interim evaluation until a full dynamic model was built and design verified. The team determined that the operability evaluation and associated calculation, completed with an initial 4160 Vac bus voltage similar to that experienced during past reactor scrams, provided an adequate justification for operability, even with several potential minor non-conservatisms. However, the team concluded that the licensee should complete a more comprehensive transient model of the fast bus transfer and perform periodic testing to determine and ensure that the actual fast bus transfer time remains within the bounds of the analyzed design basis. The licensee entered this issue into the corrective action program as condition report 222419.

Analysis.

The team determined that the failure to verify and assure adequate voltages to safety-related emergency core cooling system equipment powered from the 4160 Vac, 480 Vac, 120 Vac, and 125 Vdc distribution systems during a design basis loss-of-coolant accident with offsite power available was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a Phase 1 screening, in accordance with Inspection Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," determining that the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in loss of operability or functionality. Specifically, the licensees interim calculation and operability determination demonstrated the operability of offsite power during a loss-of-coolant accident with offsite power available, in that the emergency core cooling system components would be operable and able to perform their safety function. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which requires, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, the licensee failed to provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, as of July 30, 2010, the licensees design control measures failed to verify or check the adequacy of design voltages to safety-related emergency core cooling system equipment powered from the 4160 Vac, 480 Vac, 120 Vac, and 125 Vdc distribution systems during a loss-of-coolant accident with offsite power available. This finding was entered into the licensees corrective action program as condition reports 219208, 219122, 219267, 219277, 219335, 219122, 219328, 219170, 220268, 220317, and 222419. Because this finding was determined to be of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a noncited

violation consistent with Section V1.A.1 of the NRC Enforcement Policy: NCV 05000397/2010006-02, Inadequate Evaluation of Offsite Electrical Power Capability to Safety-Related Emergency Core Cooling System Equipment During a Design Basis Event with Offsite Power Available.

.2.13 4160 Vac Division II Emergency Diesel Generator (DG-GEN-DG2)

a. Inspection Scope

The team reviewed the updated final safety analysis report, system design criteria, the current system health report, selected drawings, operating procedures, and corrective action documents. This review included the licensees design basis documentation as well as various calculations, condition reports, procedures, test results, control circuit permissives used to close breaker, protective circuit logic tests, instrument uncertainty calculations, and operability determinations. The inspection team also performed walkdowns and performed interviews with design and system engineering personnel to ensure the capability of this component to perform its required safety function.

The team reviewed loading and voltage regulation calculations, including the bases for brake horsepower values used, to verify that design bases and design assumptions have been appropriately translated into the design calculations and procedures. The team reviewed protection/coordination and short-circuit calculations to verify that the emergency diesel generator was adequately protected including short-circuit capability of the output breaker under worst fault conditions. The team reviewed analyses and surveillance testing to assess emergency diesel generator operation under required operating conditions. The team reviewed calculations and technical evaluations to verify that: 1) steady-state and transient loading are within design capabilities; 2) adequate voltage would be present to start and operate connected loads; 3) operation at maximum allowed frequency would be within the design capabilities; and 4) engine derating for high ambient air and turbo-charger operation were within the design capabilities. The team performed a visual non-intrusive inspection of observable portions of the emergency diesel generator to assess the installation configuration, material condition, and potential vulnerability to hazards. Specifically, the team reviewed:

• The DC control circuit loop analysis associated with the emergency diesel generator breaker trip/close circuits and spring charging motors to ensure adequate control voltage would be available

• The interfaces and interlocks associated with 4160 Vac Switchgear Bus E-SM-8, including voltage protection schemes that initiate connection to the emergency diesel generator

• Modifications to the system against design documents to verify that performance capabilities of selected components had not been degraded

• Selected operating experience and any plant actions to address the applicable issues to ensure that applicable insights have been applied

• System health reports, component maintenance history and licensee corrective action program reports to verify that potential degradation was monitored or prevented

b. Findings

No findings were identified.

.2.14 125 Vdc Battery Charger (E-C1-7)

a. Inspection Scope

The team reviewed the system one-line diagrams, nameplate data, and loading requirements to determine the adequacy of the charger to supply required power to the associated 125 Vdc buses and batteries. The team reviewed system health reports, component maintenance history and condition reports to verify that potential degradation was monitored or prevented. Specifically, the team reviewed:

• The team reviewed the risk significant function of battery charger E-C1-7 to ensure the function can be performed including applicable plant operating procedures

• Calculations for charger sizing to ensure adequate capability to supply required power to the associated 125 Vdc buses and charge its associated batteries within required times

• Preventative maintenance inspection and testing procedures to ensure that the charger was maintained in accordance with industry and vendor recommendations The team performed a visual non-intrusive inspection of observable portions of the charger to assess the installation configuration, material condition, and the potential vulnerability to hazards.

b. Findings

No findings were identified.

.2.15 120 Vac Vital power Static Switch (E-ATS-IN/2)

a. Inspection Scope

The team reviewed system health reports, one-line diagrams, component maintenance history, and condition reports to verify that potential degradation was monitored or prevented. Specifically, the team reviewed:

• The risk significant function of static switch E-ATS-IN/2 to ensure the safety function can be performed including applicable plant operating procedures

• Periodic maintenance and testing practices to ensure the equipment was maintained in accordance with industry practices The team performed a visual non-intrusive inspection of observable portions of the charger to assess the installation configuration, material condition, and the potential vulnerability to hazards.

b. Findings

No findings were identified.

.2.16 4160 Vac SM-1 Bus Circuit Breaker (E-CB-CTA)

a. Inspection Scope

The team reviewed the updated final safety analysis report, system design criteria, the current system health report, selected drawings, and operating procedures. Specifically, the team reviewed:

• Protection coordination calculations

• Breaker maintenance program procedures and relay settings

• Monitoring and trending documentation, test results, protective relaying maintenance records

• Condition reports and operability determinations

The inspection team also performed walkdowns and conducted interviews with design and system engineering personnel to ensure the capability of this component to perform its required safety function.

b. Findings

No findings were identified.

.2.17 125 Vdc Division II Distribution Panel (E-DP-S1/2D)

a. Inspection Scope

The team reviewed the updated final safety analysis report, system design criteria, the current system health report, selected drawings, operating procedures, and condition reports. Specifically, the team reviewed:

• Relevant calculations

• Maintenance scope and basis

• Thermography

• Work orders and preventive maintenance items

• Operability determinations

The inspection team also performed walkdowns and conducted interviews with design and system engineering personnel to ensure the capability of this component to perform its required safety function.

b. Findings

No findings were identified.

.2.18 Offsite Power Transformer (E-TR-S)

a. Inspection Scope

The team reviewed the updated final safety analysis report, system design criteria, the current system health report, selected drawings, operating procedures and condition reports. This review included the licensees design basis documentation as well as various calculations, procedures, test results, and operability determinations.

Specifically, the team reviewed:

• Periodic maintenance, surveillance testing and Doble test results

• Oil quality and dissolved gas trending and transformer oil samples

The inspection team also performed walkdowns and conducted interviews with design and system engineering personnel to ensure the capability of this component to perform its required safety function.

b. Findings

No findings were identified.

.2.19 High Pressure Core Spray Emergency Diesel Generator Lock-Out Relay (HPCS-RLY-

E22B)

a. Inspection Scope

The team reviewed the updated final safety analysis report, system design criteria, the current system health report, selected drawings, operating procedures and condition reports. Specifically, the team reviewed:

• Various calculations

• Connection diagrams

• Test results, work orders and preventive maintenance items

• Root cause evaluations and operability determinations

The inspection team also performed walkdowns and conducted interviews with design and system engineering personnel to ensure the capability of this component to perform its required function.

b. Findings

No findings were identified.

.3.1 Recent Agastat Relay Operational Issues

a. Inspection Scope

The team reviewed the licensees assessment of recent operating experience and 10 CFR Part 21 reports relating to Tyco/Agastat relays. This included a situation at the Oyster Creek nuclear plant where an emergency diesel generator output circuit breaker failed to close due to a relay failure and issues at the Waterford nuclear plant where Tyco/Agastat series E7000 time-delay relays did not function properly. As a result of this operating experience and because of the large number such relays installed at the Columbia Generating Station, the team focused on the history, qualified life, maintenance, and replacement of the E7000 relays in safety-related systems. The team interviewed key station personnel regarding the sites relay program, assessed the adequacy of the program, and the effectiveness of the licensees actions to identify and solve problems. This review specifically addressed corrective action documents, trending and monitoring, root cause evaluation reports, procedures, maintenance records, and surveillance tests.

b. Findings

b.1 Inappropriate Extension of Qualified Service Life of Agastat Relays

Introduction.

The team identified a finding of very low safety significance (Green)involving a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, because Energy Northwest inappropriately extended the service life and preventive maintenance replacement frequency for safety-related Tyco/Agastat series E7000 time-delay relays from 10 years to 40 years without having an adequate evaluation and associated change to the preventive maintenance basis procedure.

Description.

Columbia Generating Station site procedure 1.5.13, Preventive Maintenance, provides the overall preventive maintenance program guidance including the evaluations needed to change a preventive maintenance frequency and defines which relays have a critical function. Procedure BID-RELAY-1, Protective Relays, Revision 0, and procedure BID-RELAY-2, Control Relays, Revision 1 in conjunction with the Excel spreadsheet preventive maintenance templates (MOT-RELAY-1 and MOT-RELAY-2, respectively) provide the basis, background, issues, and specific preventive maintenance frequencies for the safety-related control and protective relays, respectively. Specific to these two documents are the maintenance requirements of protective relays and timing and control relays with a criticality of Critical and Non-critical, as determined by the criticality project.

Site procedure 1.5.13, Preventive Maintenance, defined critical as equipment considered necessary for nuclear safety or power production Non-critical was defined as a classification of equipment between Critical and No-Preventive Maintenance Required for which cost effective preventive maintenance make sense.

Failures of Non-Critical equipment are less consequential than failures of Critical equipment. Non-Critical does not mean No-Preventive Maintenance Required.

The preventive maintenance activities and their associated frequencies, from these two documents, are then entered into the licensees database called PASSPORT and serve to notify site personnel of upcoming preventive maintenance tasks. During the inspection, site personnel provided a summary of their preventive maintenance practices, which involved calibration and replacement activities of critical relays based on a combination of industry and plant experience for coil status and environment, as indicated below:

Coil Status/Environment Harsh Mild Normally energized NOTE 1 None Installed Replacement Preventive Maintenance Not energized Calibration Preventive Maintenance with 40 year Qualified Life per QID 283013-01 Calibration Preventive Maintenance

NOTE 1: A 1996 root cause evaluation (RCE 294-0700) performed for a relay failure, specifically stated that a relay energized greater than 25 percent of the time would be considered normally energized.

The team observed that station procedures BID-RELAY-1 and BID-RELAY-2 conflicted with the environmental qualification and practices that were in place by specifically noting that for duty cycle and service conditions for control relays normally energized, There is no influence of duty cycle on maintenance task interval cycles because the relays remain good for 140,000 cycles. They are typical replacement after 10 years, but only because of the original equipment manufacturer decision to keep records for only 10 years.

The station procedure continued by noting that not energized should be treated as if they have a high duty cycle, because they are then subject to failure caused from binding and sticking contacts.

The team requested a list of all of the installed safety-related Agastat relays. The list included the model number, date installed, whether the relay was normally energized or not energized, and the preventive maintenance last performed and the preventive maintenance frequency. After reviewing several iterations of the lists provided, for the 124 safety-related E7000 relays installed in various systems, the team identified:

• The preventive maintenance frequency indicated on the list was not consistent with the licensees preventive maintenance templates MOT-RELAY-1 for Protective Relays and MOT-RELAY-2 for Control Relays or with the PASSPORT database which required 10-year replacement for all critical safety-related E7000 relays, no matter the environment or if they were energized or not

• A total of 44 out of 124 safety-related relays missed their replacement preventive maintenance tasks and exceeded their 10-year qualified life. These were

examples of relays that had exceeded their preventive maintenance replacement frequency

• Four relays, originally identified as not energized, met the criteria in root cause evaluation 294-0700 for being normally energized

• Six relays that provided the degraded grid voltage protection time delay were incorrectly categorized as non-critical Relay RHRC/62/2 missed its scheduled replacement and was deferred from Refueling Outage 19 to Refueling Outage 20 without an evaluation as required by station procedure 1.20.2, Refueling Outage Scope Identification and Control and procedure 1.5.13, Preventative Maintenance

As a result of these deficiencies and inconsistencies, the team requested the justification for exceeding the 10-year replacement preventive maintenance frequency and was provided the licensees environmental qualification for Agastat relays titled Environmental, QID 28301-3, Revision 11. The team reviewed this evaluation and compared it to the licensees committed design standard of IEEE 323-1974, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations.

This standard states that during testing to determine qualified service life, electromechanical equipment such as relays shall be operated to simulate the expected mechanical wear and electrical contact degradation. NUREG-0588, Interim Staff Position on Environment Qualification of Safety-Related Electrical Equipment, states that the degrading influences discussed in this IEEE Standard and the electrical and mechanical stresses associated with cyclic operation of equipment should be considered and included as part of the aging programs. This IEEE Standard goes on to state that equipment located in general plant areas outside containment, where equipment is not subjected to a design basis accident environment, should be qualified to the normal and abnormal range of environmental conditions postulated to occur at the equipment location.

The team concluded that the licensee did not have an adequate technical basis to demonstrate that they could safely extend the qualified life of safety-related Agastat E7000-series relays from 10 to 40 years. Specifically:

• The change in preventive maintenance replacement frequency had not been pre-evaluated and had not been incorporated into the preventive maintenance basis included in preventive maintenance templates MOT-RELAY-1 and MOT-RELAY-2, as required by procedure 1.20.2, Refueling Outage Scope Identification and Control, and procedure 1.5.13, Preventative Maintenance

• The equipment qualification evaluation was inadequate to justify the preventive maintenance change because the calculated service or expected design life was based solely on temperature-related aging of the relays. Other environmental conditions which may occur during normal and abnormal conditions at the installed equipment location and the expected operating duty cycle of the relays were not considered

The team also questioned the licensee about their trending and monitoring program and identified that the licensee did not have a formal program in place and relied upon their database PASSPORT to identify trends with the relays. The team questioned the

acceptability of this practice given that this system only identified when a relay was replaced and did not trend as-found setpoints or when relays experienced setpoint drift.

Analysis.

The team determined that extending the qualified life of safety-related Agastat E7000-series relays without having an adequate technical basis was a performance deficiency. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a Phase 1 screening, in accordance with Inspection Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," and determined that the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in loss of operability or functionality. Specifically, no relay failures had occurred beyond the recommended 10-year service life and this did not result in the failure of multiple redundant trains of safety-related equipment. This finding has a cross-cutting aspect in the area of problem identification and resolution because the licensee did not effectively incorporate pertinent industry operating experience into the preventive maintenance program for Agastat E7000-series relays. Specifically, Energy Northwest failed to incorporate industry operating experience and site guidance when they extended their relay replacement preventive maintenance tasks from 10 years to 40 years P.2(b).

Enforcement.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, which requires, in part, design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Where a test program is used to verify the adequacy of a specific design feature, in lieu of other verifying or checking processes, it shall include suitable qualifications testing of a prototype unit under the most adverse design conditions. Contrary to the above, the licensee failed to provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, as of June 10, 2010, the licensees design control measures failed to verify or check the adequacy of design for the extension of qualified life for safety-related Tyco/Agastat E7000-series timing relays from 10 years to 40 years, by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. The licensee did not perform suitable qualifications testing of a prototype unit under the most adverse design conditions. Specifically, the licensee did not follow their station procedures for extending the service life and changing preventive maintenance frequencies; did not account for some known modes of degradation; did not account for normal and abnormal operating conditions; and did not maintain a trending program to monitor for indication of impending end-of-life relay failures. This finding was entered into the licensees corrective action program as condition reports 218559, 219436, and 218799. Because this finding was determined to be of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a noncited violation consistent with Section V1.A.1 of the NRC Enforcement Policy: NCV 05000397/2010006-03, Inappropriate Extension of Qualified Service Life of Agastat Relays.

.3.2 Minimizing the Potential for Residual Heat Removal Water Hammer Following Loss of

Offsite Power While in Suppression Pool Cooling or Test Mode

a. Inspection Scope

The team reviewed the licensees evaluation of Boiling Water Reactor Owner Group General Electric Document number NEDO-33150-NP, Boiling Water Reactor Residual Heat Removal System Potential for Water Hammer, dated July 2004, to verify that the licensee reviewed industry operating experience in accordance with procedures. The General Electric document contained several recommendations to limit the probability of a water hammer event while operating the residual heat removal system following a loss of offsite power while in suppression pool cooling or test mode. The licensee stated in report EC Number 7525, Assessment of Design and Licensing Basis for Emergency Core Cooling System Water Hammer, dated December 11, 2008, that they would implement the Boiling Water Reactor Owners Group recommendations. However, at the time of the inspection, Energy Northwest had not implemented the recommendations.

The team reviewed interim actions taken by Energy Northwest, such as declaring the residual heat removal system inoperable while in the suppression pool cooling or test mode, and found these actions to be appropriate.

b. Findings

No findings were identified.

.3.3 NRC Information Notice 2010-03, Failures of Motor Operated Valves Due to Degraded

Stem Lubricant

a. Inspection Scope

The team reviewed the licensees response to NRC Information Notice 2010-03 to verify that the licensee reviewed industry operating experience in accordance with procedures.

The team verified that the licensee was performing two-year preventative maintenance on critical valves, which included cleaning and replacing stem lubricant. The team also verified that the licensee was using appropriate lubricant. The team reviewed in-service tests of several valves to verify that the valve stems were operating as designed to ensure the proper stroke time of the valves. The team performed a walkdown of several motor operated valves to verify the material condition of the stem lubricant.

b. Findings

No findings were identified.

.3.4 Operator Operating Experience Review

a. Inspection Scope

The team reviewed the licensees actions in response to NRC Information Notice 2010-06, Inadvertent Control Rod Withdrawal Event While Shutdown, which discussed an issue at Dresden Unit 3 where activity to isolate the water side of the control rod drive

hydraulic control units caused an inadvertent control rod withdrawal and an earlier Energy Northwest initiated problem evaluation request (207-0199) in response to similar industry information.

b. Findings

No findings were identified.

.3.5 Diablo Canyon Offsite Power Capability

a. Inspection Scope

The inspection scope associated with this component was described in Section

==1R21.2.12.

b. Findings

No findings were identified.

==

.4 Results of Reviews for Operator Actions

a. Inspection Scope

The team reviewed five risk significance operator actions as follows:

• Operator Fails to Align Division 4 Emergency Diesel Generator as Portable Battery Charger Power Supply. The team performed a field walkdown of emergency diesel generator 4, and field job performance measures to start the emergency diesel generator using procedure SOP-DG4-START, Diesel Generator 4 Start, and to align it to electrical bus MC-7A using ABN-ELEC-DG4-CROSSTIE / MC-7A, Sections 4.1.6 through 4.1.12

• Operator Fails to Align Alternate Cooling to Control Rod Drive Pumps. The team observed in-plant job performance measures to align temporary cooling to one control rod drive pump using condensate transfer water in accordance with ABN-RCC, Temporary Cooling to Control Rod Drive Pumps, Section 7.1, including validating the location of temporary hoses.

• Operator Fails to Properly Line-up Control Air System Crosstie to Containment Instrument Air. The team observed in-plant job performance measure to align the containment air system non-automatic depressurization system loads to control air system in accordance with SOP-CIA-OPS, Containment Instrument Air System Operation, Section 5.3.1.

• Operator Fails to Align Division 3 Emergency Diesel Generator to Supply Division 1 or Division 2. The team observed a simulator job performance measure to align Division 3 to Division 1 using ABN-ELEC-DG3-CROSSTIE/SM7, DG3 Crosstie to SM-7, Sections 7.3 and 7.4.

• Operator Fails to Isolate Moderate Main Steam Leak Outside Containment. The team observed a licensed operator crew perform a modified version of simulator scenario LR001727, Core Damage with Offsite Release. Observed a licensed operator crew perform a simulator scenario of main steam leak in the turbine building with failure of the main steam isolation valves to automatically close

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

On June 10, 2010, the team leader presented the preliminary inspection results to Mr. Scott Oxenford, Vice President Nuclear Generation and Chief Nuclear Officer, Columbia Generating Station, and other members of the licensees staff.

On July 30 2010, the team leader conducted a telephonic final exit meeting with Mr. Douglas Coleman, Manager of Regulatory programs and other members of the licensees staff. The licensee acknowledged the findings during each meeting. While some proprietary information was reviewed during this inspection, no proprietary information was included in this report.

4OA7 Licensee-Identified Violations

None.

s: Supplemental Information

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Oxenford, Vice President Nuclear Generation/Chief Nuclear Officer

S. Gambhir, Vice President Technical Support

J. Bekhazi, Plant general Manager

D. Swank, Engineering General Manager

B. Boyum, Assistant Engineering General Manager

W. Laframboise, Design Engineering Manager

G. Strong, Design Engineering Supervisor

D. Coleman, Manager Regulatory Programs

J. Browers, Design Engineering Supervisor

T. Morales, Design Engineering

R. Garcia, Licensing Engineer

R. Hermann, Systems Engineering

F. Schill, Licensing Engineer

J. Cantrell, Systems Engineering

C. Sonoda, Design Engineering

M. Hummer, Operations

D. Gregoire, Licensing Supervisor

R. Sherman, Nuclear Engineer, BPA

D. Hiller, Design Engineering

B. Smith, PSA Engineer

M. Rice, Design Engineering

NRC Personnel

R. Cohen, Senior Resident Inspector

M. Hayes, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000397/2010-006-01 NCV Inadequate Assessment of Emergency Diesel

Generator Air Filters During an Ashfall Event

05000397/2010-006-02 NCV

Inadequate Evaluation of Offsite Electrical Power Capability to Safety-Related Emergency Core Cooling System Equipment During a Design Basis Event with Offsite Power Available

05000397/2010-006-03 NCV

Inappropriate Extension of Qualified Service Life of Agastat Relays

- 2 -