IR 05000400/2011008

IR 05000400-11-008, on March 21 - April 21, 2011, Shearon Harris Nuclear Power Plant - Component Design Bases Inspection

ML112220337
Person / Time
Site:	Harris
Issue date:	08/09/2011
From:	Binoy Desai NRC/RGN-II/DRS/EB1
To:	Jefferson W Carolina Power & Light Co
References
IR-11-008
Download: ML112220337 (47)

Text

UNITED STATES August 9, 2011

SUBJECT:

SHEARON HARRIS NUCLEAR PLANT - COMPONENT DESIGN BASES INSPECTION - NRC INSPECTION REPORT 05000400/2011008

Dear Mr. Jefferson:

On April 21, 2011, U. S. Nuclear Regulatory Commission (NRC) completed an inspection at your Shearon Harris Nuclear Power Plant. The enclosed inspection report documents the inspection results, which were discussed on June 30, 2011 with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents ten NRC-identified findings of very low safety significance, nine of which were determined to be violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the NRC Enforcement Policy because of their very low safety significance and because they were entered into your corrective action program. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Shearon Harris Nuclear Power Plant. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at the Shearon Harris Nuclear Power Plant.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of

CP&L 2 the NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Binoy B. Desai, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos.: 50-400 License Nos.: NPF-63

Enclosure:

Inspection Report 05000400/2011008, w/Attachment: Supplemental Information

REGION II==

Docket Nos.: 50-400 License Nos.: NPF-63 Report Nos.: 05000400/2011008 Licensee: Carolina Power and Light Company Facility: Shearon Harris Nuclear Power Plant Location: 5421 Shearon Harris Road New Hill, NC 27562-9998 Dates: March 21 - April 21, 2011 Inspectors: S. Walker, Senior Reactor Inspector (Lead)

P. Higgins, Senior Reactor Inspector D. Mas-Penaranda, Reactor Inspector R. Patterson, Reactor Inspector C. Baron, Contractor G. Skinner, Contractor D. Terri-Ward, Trainee (one week)

Approved by: Binoy B. Desai, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000400/2011008; 3/21/2011 - 4/21/2011; Shearon Harris Nuclear Power Plant;

Component Design Bases Inspection.

This inspection was conducted by a team of four NRC inspectors from the Region II office, and two NRC contract inspectors. Ten findings of very low significance (Green)were identified during this inspection. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609,

Significance Determination Process (SDP). The cross-cutting aspects were determined using IMC 0310, Components Within the Cross Cutting Areas. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.

Cornerstone: Initiating Events

Green.

The team indentified a Green finding for licensees failure to take adequate corrective action for the inadvertent closing of MOV 1CC-252 (Reactor Coolant Pump (RCP) Thermal Barrier Return Flow Isolation Valve) following the start of the standby Component Cooling Water (CCW) pump. As interim corrective action, the licensee revised operating procedures to reflect the issue and initiated compensatory measures which included Standing Instruction 11-0012 to explain that during conditions where the standby CCW pump starts, a transient high flow can be expected that causes 1CC-252 to automatically close.

Permanent corrective actions are still being evaluated by the licensee. The licensee entered this issue into the corrective action program (CAP) as NCR 460686.

The licensees failure to take adequate corrective action for the inadvertent closing of MOV 1CC-252 following the start of the standby CCW pump was a performance deficiency. The finding was more than minor because it was affected the Equipment Performance attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensee failed to evaluate the potential for the RCP thermal barrier to isolate following safety injection (SI) or de-energization of a safety bus upon the auto start of the standby CCW pump.

The finding was considered to be of very low safety significance because assuming worst case degradation, the finding would not result in exceeding the Technical Specification (TS) limit for any reactor coolant system (RCS) leakage, result in the total loss of a safety function, did not contribute to both the likelihood of a reactor trip or the likelihood that mitigating equipment or functions would not be available, and did not increase the likelihood of a fire or internal/external flooding. Because the licensee failed to thoroughly evaluate problems such that the resolution(s) address causes and extent of conditions, as necessary, this finding is assigned a crosscutting aspect in the corrective action program of the Problem Identification and Resolution area. P.1(c) (Section 1R21.2.17)

Cornerstone: Mitigating Systems

• SLIV. The team identified a Severity Level IV violation of 10 CFR 50.73 for the licensees failure to include all required information in licensing event report (LER) 2010-002-00. The licensee submitted a supplemental LER to include all required information. The licensee entered this issue into the CAP as NCR 458636.

The licensees failure to include all pertinent information in LER 2010-002-00 was a performance deficiency. This finding was considered a severity level IV violation in accordance with traditional enforcement as outlined in the NRC enforcement policy. 10 CFR Part 50.73, states in part that the LER shall contain the failure mode, mechanism, and effect of each failed component, if known.

Contrary to this, the licensee failed to include specific information related to the main steam isolation valve failure in the LER. The finding was considered to be of low safety significance because it was not repetitive or willful, and was entered into the licensees corrective action program. The team determined that no cross cutting aspect was applicable to this performance deficiency because traditional enforcement violations are not screened for cross cutting attributes. (Section 1R21.2.1)

Green.

The team identified a Green, NCV with two examples of 10 CFR Part 50,

Appendix B, Criterion III, Design Control, for the licensees failure to properly control degraded voltage time delay setpoints. The licensee is evaluating changing the TS and field limits for the relays. Permanent corrective actions are still being evaluated by the licensee. The licensee entered these issues into the CAP as NCR 458376 and NCR 460601.

The failure to properly analyze the degraded voltage time delay setpoints was a performance deficiency. The finding was considered more than minor because it affected with the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee had not analyzed whether electrical equipment needed to respond to an accident would be energized by the emergency diesel generators within the time considered in the accident analysis if a degraded voltage condition existed concurrent with an accident. In addition, there was reasonable doubt as to whether the permanently connected safety-related loads would remain available to respond to a LOOP following a non-accident degraded voltage condition, for the duration of the time delay chosen for the degraded voltage relay. The finding was of very low safety significance since it was a design or qualification deficiency confirmed not to result in loss of operability or functionality. The inspectors did not identify a cross cutting aspect for this finding because this finding was not indicative of current licensee performance. (Section 1R21.2.3)

Green.

The team identified a Green, NCV of 10 CFR 50.49 for the licensees failure to maintain its Environmental Qualification (EQ) program requirements on the Steam Generator Power Operated Relief Valves (S/G PORVs). While no immediate operability issues were identified, the licensee entered this issue into the CAP as NCR 459807. The licensee plans to properly place the components in the appropriate program.

The licensees failure to maintain its EQ program requirements on the S/G PORVs was a performance deficiency. This finding was considered more than minor because it affected the Mitigating Systems cornerstone attribute of equipment performance to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences. Specifically, the S/G PORVs are required as per the steam line break analysis in Updated Final Safety Analyses Report (UFSAR) Chapter 15 to mitigate the radiological consequences of a steam line break by allowing the RCS to be cooled to the point where the residual heat removal (RHR) system can be placed in service within eight hours and be brought to cold shutdown within 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> after the accident. Removing the S/G PORVs from the EQ program reduced the reliability such that these valves would remain functional following a steam line break, which can subject them to a harsh environment.

The finding was of very low safety significance because it was a qualification deficiency confirmed not to result in the loss of operability or functionality. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance. (Section 1R21.2.5)

Green.

The team identified a Green, NCV of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, involving the licensees failure to perform adequate calculations for Motor Control Center (MCC) control circuit voltage. Immediate actions included testing the MCC contactors to address operability concerns.

Permanent corrective actions are still being evaluated by the licensee. The licensee entered this issue into the CAP as NCR 460895.

The failure to perform adequate calculations for MCC control circuit voltage was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, there was reasonable doubt as to whether safety-related contactors associated with the MCCs would have adequate voltage to operate under degraded voltage conditions. The finding was of very low safety significance since this was a design deficiency confirmed not to have resulted in a loss of operability or functionality. The inspectors did not identify a cross cutting aspect for this finding because this finding was not indicative of current licensee performance. (Section 1R21.2.8)

Green.

The team identified a Green, NCV of 10 CFR Part 50, Appendix B,

Criterion III, "Design Control," for the licensees failure to control design limits for Essential Services Chilled Water System (ESCW) flow balancing. Immediate corrective actions included flow balance testing to address operability concerns.

Permanent corrective actions are still being evaluated by the licensee. The licensee entered this issue into the CAP as NCR 458046.

The failure to control design limits for ESCW System flow balancing was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of the safety-related ventilation system to respond to initiating events to prevent undesirable consequences. Specifically, an operability limit was added to the ESCW flow balance procedure, based on information from a previous operability evaluation for an identified degraded/non-conforming condition. However, the operability limits established were not integrated into the plants design basis prior to being incorporated into the procedure and resulted in loss of margin and potentially affected the operability of the system. The finding was of very low safety significance because the finding did not result in a loss of safety function. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance. (Section 1R21.2.9)

Green.

The team identified a Green, NCV of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the failure to maintain the qualification bases for safety-related molded case circuit breakers (MCCBs). Immediate corrective actions included review of the MCCB testing and maintenance to validate current status. Permanent corrective actions are still being pursued by the licensee. The licensee entered this issue into the CAP as NCR 460900.

The team determined that the failure to extend the qualified life of the installed Westinghouse MCCBs which were over 20 years old was a performance deficiency. The finding was more than minor because it affected the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not maintaining qualified components in safety-related SSCs could lead to the inability to respond to design basis events. The finding was of very low safety significance because the finding was a design or qualification deficiency confirmed not to result in loss of operability or functionality. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance. (Section 1R21.2.13)

Green.

The team identified a Green, NCV of 10 CFR Part 50, Appendix B,

Criterion XI, Test Control, involving the licensees failure to include 79 safety-related MCCBs in the circuit breaker test program. Immediate corrective actions included review of breaker performance history to address operability concerns.

Permanent corrective actions are still being pursued by the licensee. The licensee entered this issue into the CAP as NCR 460953.

The inspectors determined that the failure to periodically test safety related MCCBs was a performance deficiency. The finding was more than minor because it affected the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, not confirming satisfactory performance of safety-related MCCBs could lead to the inability of equipment to respond to design basis events. The finding was of very low safety significance because it was a test deficiency confirmed not to result in loss of operability or functionality.

The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance. (Section 1R21.2.13)

Green.

The team identified a Green, NCV of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to establish measures to ensure safety related components had adequate voltage. The licensee entered this issue into the CAP as NCR 458640, NCR 458648 and NCR 460930, and initiated compensatory measures which included Standing Instruction 11-08 to explain that the alternate power supply to the safety related inverters could be subject to inadequate voltage. Permanent corrective actions are still being evaluated by the licensee.

The licensees failure to perform an analysis to demonstrate that safety related components would have adequate voltage to operate during a design basis accident or transients was a performance deficiency. The finding was more than minor because it affected the Mitigating System Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to perform an analysis that demonstrated that the loads connected to Instrument Distribution Panels (IDPs) S-I, S-II, S-III and S-IV would have adequate voltage when the IDPSs are aligned to the output of their respective 7.5kVA safety related inverter or to their respective alternate sources. The finding was of very low safety significance because it was a design issue confirmed not to result in a loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a TS allowed outage time, and did not affect external event mitigation. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance. (Section 1R21.2.15)

Green.

The team identified a Green, NCV of TS 6.8.1 for the failure to implement an adequate preventative maintenance procedure to ensure reliable operation of the plants safety-related tornado dampers. Immediate corrective actions included procedure changes, testing of all dampers, and necessary corrective maintenance. In addition, the licensee submitted LER 2011-001 to address a discovered inoperable damper. Additional corrective actions are still being evaluated by the licensee. The licensee entered this issue into the CAP as NCRs 457949 and 458237.

The licensees failure to implement an adequate preventative maintenance procedure to ensure reliable operation of the plants safety-related tornado dampers was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of the safety-related ventilation system to respond to initiating events to prevent undesirable consequences and the cornerstone attribute of Protection against External Events, i.e. seismic, weather.

Specifically, the failure of the dampers to function properly would impact the ability to maintain required ventilation during an external event. The inspectors assessed the finding using a Phase I SDP screening which determined a Phase III SDP evaluation was required due to the fact that the finding involved the loss or degradation of equipment specifically designed to mitigate a severe weather initiating event (e.g., tornado doors). A Phase III SDP evaluation was performed in accordance with NRC Inspection Manual Chapter 0609 Appendix A by a regional SRA using the NRC SPAR model. The analysis determined that the performance deficiency resulted in a core damage frequency (CDF) risk increase less than 1E-6/year. Therefore, the finding was characterized as having very low safety significance. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance. (Section 1R21.4)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the licensees Probabilistic Risk Assessment (PRA). In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1 X10-6. The sample included 17 component reviews, seven related operator actions, and seven operating experience items.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases had been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Regulatory Issue Summary (RIS)05-020 (formerly GL 91-18) conditions, NRC resident inspector input of problem equipment, System Health Reports, industry operating experience, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified are included in the following sections of the report.

.2.1 Main Steam Isolation Valves (MSIV)

a. Inspection Scope

The team reviewed the MSIVs to verify their capability to perform the required design function. The review included the licensing and design basis of the valves, review of recent corrective actions, review of recent test procedures and test results, review of associated operating procedures, walkdowns of the valves and related equipment, and interviews conducted with responsible engineering personnel. The team reviewed the test procedures associated with the valves to verify the valve controls and components were being completely tested. The team reviewed the results of recent valve tests to verify the results were acceptable, and reviewed the response to a recent valve failure to verify the condition was appropriately resolved. The team also conducted walkdowns of the valves and associated equipment to verify the material condition of the components.

b. Findings

Introduction:

The team identified a Severity Level IV, non-cited violation (NCV) of 10 CFR 50.73(b)(2)(ii) for the licensees failure to include all required information in licensing event report (LER) 2010-002-00. This LER was submitted as a result of the manual actuation of the reactor protection system on November 15, 2009 due to a hydrogen oil seal leak. However, the LER did not include the required information associated with the failure of the B MSIV to close on demand. The licensee entered this issue into the corrective action program (CAP) as NCR 458636.

Description:

The team reviewed past corrective action documents associated with the MSIVs. One of the documents reviewed was NCR 366175, which addressed the failure of the B MSIV to fully close on demand on November 15, 2009. Following the reactor trip, the B MSIV failed to fully close on demand; it was closed by manually isolating its air supply several minutes later.

The licensee submitted LER 2010-002-00, Manual Actuation of the Reactor Protective System due to Hydrogen Seal Oil Leak, on January 14, 2010. The LER referred to 10 CFR 50.73(a)(2)(iv)(A) and included a detailed description of the oil leak and plant shutdown. The LER did state that the MSIV failed to close fully on demand, but did not include a description of all component or system failures that contributed to the event and significant corrective action taken or planned to prevent recurrence as required by 50.73.

Specifically, the LER did not include the cause, failure mode, mechanism, effect, method of discovery, or corrective actions associated with the MSIV failure as required by 10 CFR 50.73(b)(2)(ii). In response to this concern, the licensee initiated NCR 458636 and submitted a revised supplemental LER 2010-002-01 in accordance with 10 CFR 50.73(a)(2)(i)(B), because the MSIV was likely inoperable for a period of time longer than allowed by TS; 10 CFR 50.73(a)(2)(v)(C), due to the MSIV inability to isolate and mitigate a radioactive release; and 10 CFR 50.73(a)(2)(v)(D), a condition which could have prevented the fulfillment of a safety function to mitigate the consequences of an accident.

Analysis:

The licensees failure to include all pertinent information in LER 2010-002-00 was a performance deficiency. This issue was dispositioned as traditional enforcement as outlined in the NRC enforcement policy, rather than the Significance Determination Process, because it had the potential for impacting the NRCs ability to perform its regulatory function. The NRC has characterized the significance of this violation as a Severity Level IV NCV in accordance with section 2.3.2 of the NRC Enforcement Policy.

The team determined that no cross cutting aspect was applicable to this performance deficiency because traditional enforcement violations are not screened for cross cutting attributes.

Enforcement:

10 CFR Part 50.73, states, in part, that the LER shall contain: A brief abstract describing the major occurrences during the event, including all component or system failures that contributed to the event and significant corrective action taken or planned to prevent recurrence the failure mode, mechanism, and effect of each failed component, if known or submit a supplemental report when the information is determined. Contrary to this, the licensee failed to include specific information related to the MSIV failure in the LER or submit a supplemental LER once the information had been determined. Because this finding was of very low safety significance, was not repetitive or willful, and was entered into the licensees CAP, this violation is being treated as an NCV, consistent with the NRC Enforcement Policy and designated as NCV05000400/2011008-01, Failure to Report Required Information Related to MSIV Failure.

.2.2 Condensate Storage Tank

a. Inspection Scope

The team reviewed the condensate storage tank, including level instrumentation, to verify its capability to perform the required design function. The review included the licensing and design basis of the tank and instrumentation, review of design calculations, review of recent corrective actions, review of recent test procedures and test results, review of associated operating procedures, walkdowns of the tank and instrumentation, and interviews with responsible engineering personnel. The team reviewed the calibration procedures associated with the level instrumentation and the most recent inspection of the tank diaphragm to verify the components were capable of performing their functions.

The team reviewed design calculations associated with the usable volume of the tank to verify adequate water volume would be available. The team also conducted walkdowns of the tank and associated equipment to verify the material condition of the components.

b. Findings

No findings were identified.

.2.3 Motor Driven Auxiliary Feedwater Pumps

a. Inspection Scope

The team reviewed the motor-driven auxiliary feedwater pumps to verify their capability to perform the required design function. The review included the licensing and design basis of the pumps and associated components, review of design calculations, review of recent corrective actions, review of recent test procedures and test results, review of associated operating procedures, walkdowns of the pumps and associated equipment, and interviews with responsible engineering personnel. The team reviewed the design capacity and net positive suction head (NPSH) calculations to verify the components were capable of performing their functions. The team reviewed the design of the minimum flow path to verify that the pumps would be adequately protected under low flow conditions. The team reviewed the electrical power supplies to the pressure control valves and flow control valves associated with the pumps to verify that no common mode single failure could result in a loss of system function. The team reviewed the design of the backup water supply from the emergency service water (ESW) system to verify the availability of that source. The team also conducted walkdowns of the pumps and associated equipment to verify the material condition of the components.

The team reviewed the undervoltage protection and load sequencing schemes to determine whether the pump motors would have adequate motive power under postulated degraded voltage conditions, and whether time delays were consistent with the maximum delays assumed in the Updated Final Safety Analyses Report (UFSAR)accident analysis.

b. Findings

The inspectors identified a Green, NCV with two examples of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure adequately control degraded voltage time delay setpoints.

Example 1: Potentially Non-Conservative Degraded Voltage Time Delay and Loss of Voltage (LOV) Relay Settings

Introduction:

The team identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to have appropriate analyses for the LOV relay setpoints and the second level undervoltage (degraded voltage) relay timer settings.

Specifically, Harris Nuclear Plant (HNP) calculations for the degraded voltage relay time delay setpoints and the LOV relays failed to address the ability of the permanently connected safety-related loads to continue to operate for 60 seconds without sustaining damage during a worst case, non-accident degraded voltage condition, when bus voltage was still above the LOV relay setpoint.

Description:

Branch Technical Position PSB-1 Position B.1(a)(2) states that the second time delay for the degraded voltage relays should be selected such that permanently connected loads will not be damaged, and that bases and justifications must be provided in support of the actual delay chosen. UFSAR 8.3.1.1.3 states that motors can operate at 75% voltage for one minute without damage. Technical Specification (TS) Table 3.3-4 establishes the setpoint for the Secondary Loss of Offsite Power (degraded voltage) relay non-accident time delay as 60 seconds. It also established the setpoint for the Primary Loss of Offsite Power relay as 4692V (68% of 6900V). This scheme would allow motors to be subjected to voltage below 75% for up to one minute, which is in excess of the capability claimed in the UFSAR. HNP was not able to provide a calculation to justify this condition.

In response to the teams concerns, the licensee initiated NCR 460601. The operability evaluation for the NCR stated that this issue did not present an operability concern because motors would trip due to action of overcurrent protective devices before being damaged. The team inquired whether such motors would be locked out or would subsequently be available for restarting on the emergency diesel generators (EDGs)without manual operator action. The licensee indicated that certain safety related motors would be locked out and would not subsequently be available for immediate restart on the EDGs, in the case of a LOOP due to the degraded voltage condition, but could be recovered by resetting the overcurrent trip device.

Analysis:

The inspectors determined that the failure to perform adequate analysis to demonstrate that permanently connected safety-related loads will not be damaged for the duration of the time delay for a worst case, non-accident degraded voltage condition was a performance deficiency. The finding was more than minor because it affected the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, there was reasonable doubt as to whether the permanently connected safety-related loads would remain operable during a worst case, non-accident degraded voltage condition for the duration of the time delay chosen. The finding was of very low safety significance (Green) since this was a design deficiency confirmed not to result in loss of operability or functionality. Specifically, if plant loads tripped on overcurrent, it was likely that they could be recovered by resetting their overload trip devices in sufficient time to perform their function. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of suitable testing program. Contrary to the above, the licensees design control measures failed to verify the adequacy of the degraded voltage relay setpoint and time delay design. Specifically, the licensee failed to analyze that the permanently connected safety-related loads would have adequate voltage to continue to run without sustaining damage during a worst case, non-accident degraded voltage condition. Because this violation was of very low safety significance and because the issue was entered into the licensees CAP as NCR 460601, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and designated as NCV 05000400/2011008-02, Inadequate Control of Degraded Voltage Time Delay Settings.

Example 2: Degraded Voltage Time Delay Not Analyzed for Consistency with Accident Analysis

Introduction:

The inspectors identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to properly analyze the time delay setpoint for the Secondary Undervoltage Relay (degraded voltage relay) timer settings.

Specifically, the licensee had failed to determine whether the time delay for the Secondary Undervoltage Relay was greater than the time delay considered in the design basis accident analysis.

Description:

Branch Technical Position PSB-1 Position B.1(b) states that two separate time delays shall be selected for the degraded voltage relays; one that is in effect when a safety injection actuation signal (SIAS) is present, and another that is in effect in the absence of a SIAS. PSB-1 also requires that the selection of undervoltage and time delay setpoints be based on an analysis of the voltage requirements of Class 1E loads.

TS Table 3.3-4 establishes the Allowable Value for the Secondary Loss of Offsite Power (degraded voltage) relay time delay with Safety Injection as 18 seconds. (Note that the Allowable Value is the acceptable as-found value during a surveillance and that the actual time delay during an event could be longer than 18 seconds, considering errors such as M&TE accuracy).

UFSAR 8.3.1.1.2.11 states that the time delay associated with the undervoltage relays will be consistent with the maximum time delay considered in the design basis accident analysis. The UFSAR statement is consistent with guidance provided to HNP by the NRC in a letter to J.A. Jones (CP&L) dated 11/21/1978. CP&L Letter M.A. McDuffie to NRC dated August 31, 1982 stated, The time delay associated with the undervoltage relays shall be consistent with the maximum time delay considered in the design basis accident analysis and shall prevent spurious tripping due to short time transient conditions.

J of Calculation E2-0005.09, which analyzed the time delays for the degraded voltage relays, provided several timelines for ECCS response times. These timelines included 10 seconds for EDG start time but did not consider the time delay associated with the degraded voltage relays that provide the permissive for the EDG supply breaker for the safety buses to close. The team noted that UFSAR Table 15.6.5-3 indicated that for a large break Loss of Coolant Accident (LOCA), high pressure safety injection (HPSI)and low pressure safety injection (LPSI) were assumed to occur at 29 seconds after the SIAS signal. The team was concerned that, considering an approximately 18+ seconds time delay before the safety buses were transferred to the EDGs, in addition to sequencer time delays (i.e., 5.5 seconds for RHR pumps), and pump acceleration time, the accident analysis assumptions may not be satisfied. In response to the teams inquiries, the licensee was not able to provide formal analysis that demonstrated that the time delay specified in TS Table 3.3-4 was consistent with 29 seconds for HPSI and LPSI assumed in the accident analysis.

In response to this concern the licensee initiated NCR 458376. The NCR evaluation stated that preliminary data indicated that the response times used in the accident analysis would likely be met, even considering a degraded voltage time delay setpoint of 18 seconds. The team further noted that the time delay setpoint specified provided margin with respect to the TS value, so this finding did not present an immediate operability concern.

Analysis:

The inspectors determined that the failure to perform adequate analysis to demonstrate that the degraded voltage relay time delay with an SIAS was consistent with the maximum time delay considered in the design basis accident analysis was a performance deficiency. The finding was more than minor because it affected the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of electrical systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee had not evaluated the impact of the time delay of the degraded voltage protection relay timer on the ECCS systems needed for accident mitigation, when on the onside power source. The finding was determined to be of very low safety significance (Green) since it was a design deficiency confirmed not to result in loss of operability or functionality. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures ensure that the applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensees design control measures had failed to verify the adequacy of the degraded voltage relay time delay design. Specifically, the licensee had failed to determine whether the time delay for the degraded voltage relays provided in TS Table 3.3-4 was consistent with the maximum time delay considered in the design basis accident analysis. Because this violation was of very low safety significance and because the issue was entered into the licensees CAP as NCR 458376, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and designated as NCV 05000400/2011008-02, Inadequate Control of Degraded Voltage Time Delay Settings.

.2.4 Emergency Service Water Return Valves, 1SW-270 & 1SW-271

a. Inspection Scope

The team reviewed the ESW return valves, 1SW-270 and 1SW-271, to verify their capability to perform the required design function. The review included the licensing and design basis of the tank and instrumentation, review of design calculations, review of a design change, review of recent corrective actions, review of recent test procedures and test results, review of associated operating procedures, walkdowns of the tank and instrumentation, and interviews with responsible engineering personnel. The team reviewed the motor-operated valve (MOV) calculations and test data to verify the valves were capable of performing their functions under the most limiting conditions. The team also conducted walkdowns of the valves and associated equipment to verify the material condition of the components.

b. Findings

No findings were identified.

.2.5 Steam Generator Power Operated Relief Valves (S/G PORV)

a. Inspection Scope

The team reviewed the S/G PORVs to verify their capability to perform the required design function under the most limiting design conditions. The review included the licensing and design basis of the valves and associated limit switches, review of design calculations, review of recent corrective actions, review of recent test procedures and test results, review of associated operating procedures, walkdowns of the valves, and interviews with responsible engineering personnel. The team reviewed the status of the environmental qualification (EQ) of the valves and associated limit switches to verify the components were capable of performing their functions under the most limiting post-accident conditions. The team reviewed the capability of local, manual operation of these valves under post-accident conditions to verify the required shutdown conditions could be obtained. The team reviewed the electrical power supplies to these valves to verify that they would be able to perform their design function considering a single failure of an electrical power supply. The team also conducted walkdowns of the valves and associated equipment to verify the material condition of the components.

b. Findings

Introduction:

The team identified a Green, NCV of 10 CFR 50.49(b) for the licensees failure to maintain its EQ program requirements on the S/G PORVs. Specifically, in 1987, the licensee removed the S/G PORVs from its EQ list and ceased to maintain full EQ requirements for these valves. These valves are required to remain functional following a steam line break which could subject them to a harsh environment.

Description:

During performance of the inspection, the team noted that several bolts were missing from covers on the S/G PORVs. The team questioned the licensee regarding the EQ status of the S/G PORVs and the effect of the missing bolts on that qualification. The licensee responded that the PORVs had been removed from the EQ list in 1987 based upon the licensee conclusion that the EQ status for these valves was not required in that they could be operated locally in the event of an accident. The team questioned the ability of the licensee to operate these valves locally in the event of a steam line break in the vicinity of the valves, in view of the UFSAR Chapter 15 requirement that the plant be cooled to allow initiation of residual heat removal (RHR)cooling within eight hours and be brought to cold shutdown within 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> following a steam line break. The team was concerned that a small steam line break in the vicinity of these valves may preclude local operation in a time frame consistent with UFSAR requirements. In addition, the team questioned the licensees ability to operate these valves following a steam line break which could subject these valves to a harsh environment, and be damaged such that they would not perform their intended safety function. As a result of the teams questions, the licensee reviewed the decision to remove the S/G PORVs from the EQ program. During that review the licensee noted that the PORV limit switches had also been removed from the EQ program which is inconsistent with their post accident monitoring function. The licensee entered the issue into their CAP as NCR 459807.

The team also questioned the licensee regarding current operability of these valves related to their ability to function following a steam line break accident. The licensee provided the team with a written basis for operability which described in detail the current maintenance program being applied to the valves. The team reviewed the licensee basis for operability and concluded that even though there was concern that the valve would have not been able to properly operate following an accident or be operated manually during a harsh environment; operability was not immediately challenged based on the service and testing records.

Analysis:

The licensees failure to maintain its EQ program requirements for the S/G PORVs, resulting in a condition where these valves may not function during a design basis accident, was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems cornerstone attribute of Equipment Performance to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences. Specifically, the S/G PORVs are required, as per the steam line break analysis in UFSAR Chapter 15, to mitigate the radiological consequences of a steam line break by allowing the reactor coolant system (RCS) to be cooled to the point where the residual heat removal system can be placed in service within eight hours and be brought to cold shutdown within 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> after the accident. Removing these valves from the EQ program reduced the reliability that these valves would remain functional following a steam line break, which can subject them to a harsh environment, and therefore reduces assurance that the conditions specified in UFSAR Chapter 15 can be met. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green) because it was a qualification deficiency confirmed not to result in loss of operability or functionality. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR Part 50.49, states, in part, that licensees shall establish a program for qualifying electric equipment that is relied upon to remain functional during and following design basis events. Contrary to this, the licensee removed the S/G PORVs from its EQ program for qualifying electric equipment that is relied upon to remain functional following a steam line break. Because this finding is of very low safety significance and was entered into the licensees CAP as NCR 459807, this violation is being treated as a non-cited violation, consistent Section 2.3.2 of the NRC Enforcement Policy and designated as NCV 05000400/2011008-03, Failure to Maintain Environmental Qualification on Steam Generator Power Operated Relief Valves.

.2.6 Component Cooling Water (CCW) Pumps

a. Inspection Scope

The team reviewed the plant TS, UFSAR, design basis documents (DBDs), and piping and instrumentation drawings (P&IDs) to establish an overall understanding of the design bases of the CCW pumps. Design calculations (i.e. minimum flow and NPSH) and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the components performance capability and were appropriately incorporated into relevant drawings and procedures. System walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained consistent with design assumptions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was being monitored.

b. Findings

No findings were identified.

.2.7 Charging/Safety Injection Pump (CSIP) Volume Control Tank Suction Source, MOVs

1CS-165 & 1CS-166

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of the valves 1CS-165 and 1CS-166. The team examined system health reports, records of surveillance testing, maintenance activities, and applicable corrective actions to verify that potential degradation was being monitored and prevented or corrected. The team also conducted interviews with plant personnel to discuss the history of the valve testing, maintenance, and details of the corrective actions that had been completed. The team also conducted a visual inspection of both valves to verify that any degraded material conditions were being appropriately addressed. In addition, the team verified that the power demand requirements for the valves were captured in electrical load and degraded voltage calculations. The team also verified that the worst case/highest differential pressure (dP) was used to determine the maximum valve opening and/or closing requirements to ensure that the valve would perform its intended safety-related design basis function. A review was conducted of the licensees testing procedures and results from actual diagnostic valve testing that was performed to verify that both MOVs were tested in a manner that would detect a malfunctioning valve and verify compliance with GL 89-10 program plan requirements.

b. Findings

No findings were identified

.2.8 CSIP Refueling Water Storage Tank Suction Source MOVs 1CS- 291 & 1CS- 292; and

Check Valve 1CS-294

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of MOVs 1CS- 291, 1CS- 292; and check valve 1CS-294. The team examined system health reports, records of surveillance testing, maintenance activities, and applicable corrective actions to verify that potential degradation was being monitored and prevented or corrected. The team also conducted interviews with plant personnel to discuss the history of the valve testing, maintenance, and details of the corrective actions that had been completed. The team also conducted a visual inspection of all valves to verify that any degraded material conditions were being appropriately addressed. In addition, the team verified that the power demand requirements for valves 1CS- 291 and 1CS- 292 were captured in the electrical load and degraded voltage calculations. The team also verified that the worst case/highest dP was used to determine the maximum valve opening and/or closing requirements to ensure that the valve would perform its intended safety-related design basis function. A review was conducted of the licensees testing procedures and results from actual diagnostic valve testing that was performed to verify that both MOVs were tested in a manner that would detect a malfunctioning valve and verify compliance with GL 89-10 program plan requirements. The team also examined maintenance rule documentation to verify that the check valves were properly scoped, and monitored. In addition, the team reviewed voltage drop calculations to determine whether MOVs would have adequate motive and control circuit voltage during postulated degraded voltage conditions.

b. Findings

Introduction:

The inspectors identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to perform adequate design calculations for Motor Control Center (MCC) control circuit voltage. Specifically, HNP calculations for MCC control circuit voltage used non-conservative values for contactor pickup voltage when determining minimum required voltage for loads at the MCCs.

Description:

Calculation E-6000 analyzed the adequacy of the degraded voltage relay setpoints. This calculation relied on MCC voltage criteria developed in the E-5518.xxx series calculations that analyzed required MCC voltage to assure operability of MCC control circuits. The E-5518.xxx series calculations used pickup voltage criteria of 56%

and 52% of 110V rated voltage for Size 2 and Size 4 contactors, respectively. These values were based on a letter from the vendor, BBC, dated May 14,1982. However, Vendor Manual PQL identified that the required pick up voltage, consistent with National Electrical Manufacturers Association (NEMA) standards, to be 85%. In response to the teams inquiries, the licensee determined that the voltages cited in the BBC letter were actually the test values where the contactor would just start to pick up, and not the values where it was guaranteed to pick up and seal in. This error resulted in an approximately 29% to 33% (non-conservative) error in the voltage required at the MCC determined in the E-5518.xxx series calculations. The licensee issued NCR 460895 to address this concern. The initial operability evaluation relied on tests performed on two Size 2 contactors stored in the warehouse that showed pick up voltage of approximately 68V (approximately 62%). Subsequent testing showed more limiting results for some contactors but the licensee concluded, based on minimum expected grid voltage, that there was reasonable assurance of operability pending full evaluation and resolution. In addition, the licensee reviewed operations logs and determined that there were no instances where the minimum switchyard voltage requirements were exceeded in the last three years, establishing reasonable assurance of past operability.

Analysis:

The inspectors determined that the failure to perform adequate design calculations for MCC control circuit voltage was a performance deficiency. The finding was more than minor because it affected the Mitigating Systems Cornerstone attribute of Design Control, and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, there was reasonable doubt as to whether the safety related contactors would have adequate voltage to perform their safety function during a degraded voltage condition. The finding was considered to be of very low safety significance (Green) since this was a design deficiency confirmed not to have resulted in a loss of operability or functionality. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of suitable testing program. Contrary to the above, the licensees design control measures failed to verify the adequacy of the safety-related MCC control circuits to perform their required functions under degraded voltage conditions. Specifically, the licensee used non-conservative contactor pick up voltage in calculations to determine minimum required MCC voltage. Because this violation was of very low safety significance and because the issue was entered into the licensees CAP as NCR 460895, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and designated as NCV 05000400/2011008-04, Non-conservative Calculations for Motor Control Center Control Circuit Voltage.

.2.9 CSIP Heating, Ventilation and Air Conditioning (HVAC)

a. Inspection Scope

The team reviewed the TS, UFSAR, and DBDs to identify the component design basis functions and related accident analysis assumptions. Calculations supporting the installed system capability were reviewed to verify that design bases and assumptions were appropriately translated and that conclusions supported overall system capability.

Electrical diagrams and selected preventative maintenance history were reviewed to verify that energy sources, including those used for control functions would be available and unimpeded during accident/event conditions. A component and system walkdown was performed in order to verify that the components installed configuration supported its design function under accident/event conditions. Selected corrective action documents and work orders were reviewed by the team in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with in-service/equipment qualification life. Operating procedures were reviewed to verify that operator actions were consistent for accident/event conditions.

Test procedures and recent test results were reviewed against DBDs to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions.

b. Findings

Introduction:

The team identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to control design limits for Essential Services Chilled Water System (ESCW) flow balancing. Specifically, the licensee changed the operability limits of the ESCW system flow balancing without proper integration into the design basis.

Description:

The ESCW System circulates chilled water to the safety related cooling coils of the air handling units serving their respective HVAC systems for transfer of the thermal loads generated in the various areas of the plant to the Service Water System. The ESCW flow throughout each system is maintained at a constant rate to minimize system pressure fluctuation and to provide stable temperature control of the HVAC air handling systems.

During a review of EPT-054, Essential Services Chilled Water Flow Balancing, Rev. 14, the team identified a discrepancy between the ESCW design flow rate for air handling units AH-9 and AH-10 as required by calculation 9-RAB-7CP, Reactor Building Cooling Loads Elevation 236, and the acceptance criteria/operability limit listed in procedure EPT-054. Air handling units AH-9 and AH-10 provide cooling to the charging pump areas on the 236 elevation level. The ESCW required design flow rate (corresponding to the pressure measured in inches water column (InWC)) for both AH-9 and AH-10 is calculated in 9-RAB-7CP as 6.4 InWC . The ESCW design flow rates in EPT-054 for operability were changed and listed as 0.63 InWC.

The operability limit in EPT-054 was added per Procedure Revision Request (PRR)211449 based on information from previous operability evaluation ESR 96-00286, Low ESCW Flows, which was conducted in 1996 in response to the licensees failure to meet the design flow requirements for multiple air handling units. However, the less conservative limiting values from ESR 96-00286 were not properly integrated into the design basis prior to revision of EPT-054 and were consequently less than the design basis limits, which resulted in a significant loss of design margin. During the inspectors review of past test results ranging from 1996 to 2008, it was identified that the licensee consistently failed to meet the established design flow rate of 6.4 InWC for a number of air handling units as required by calculation 9-RAB-7CP. On two instances, the flow rate was found two be outside of the operability limit of 0.63 InWC as specified in EPT-054.

In response to the inspectors questioning, a partial test per EPT-054 was completed on 04/08/2011 to validate that AH-10A had adequate chilled water flow to maintain component operability. In addition, AH-5A, AH-11A, AH-24A, and AH-28A were also tested because they are in parallel with AH-10A in the chilled water system; thus, adjustment of AH-10A would likely affect those air handlers. The licensee confirmed that the observed flow to each of the tested air handlers was above the value specified in EPT-054; however, they were still below their respective design limits. As a result, NCR 458856 was initiated. According to a bounding analysis conducted per ESR 96-00286, this condition did not result in a reportable condition.

Analysis:

The failure to control design limits for ESCW System flow balancing was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of the safety-related ventilation system to respond to initiating events to prevent undesirable consequences. Specifically, an operability limit was added to EPT-054 Essential Services Chilled Water System Flow Balancing Rev. 14, based on information from a previous operability evaluation for an indentified degraded/non-conforming condition. However, the operability limits were not properly integrated into the plants design basis prior to being incorporated into EPT-054. Consequently, this resulted in a significant reduction in margin and placed the ESCW System outside of its design basis and on two occasions air handler AH-10 was found to be outside of its operability limit.

The inspectors performed a Phase I SDP analysis and determined the finding was of very low safety significance (Green) because the finding did not result in an actual loss of safety function. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. These measures shall include provisions to assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled. Contrary to the above, the licensee failed to control design limits for ESCW flow balancing which ensures that all safety-related air handling units are able to perform their intended safety function. Specifically, an operability limit, which was less conservative than the established design basis limit, was added to EPT-054. This limit was not properly integrated into the plants design basis, and resulted in a significant loss of margin and consequently, instances of inoperability of AH-10. Because this finding was of very low safety significance and was entered into the licensees CAP as NCR 458046, this finding is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and designated as NCV 05000400/2011008-05, Failure to Control Design Limits for ESCW Flow Balancing.

.2.10 Startup Transformer (SUT) 1A

a. Inspection Scope

The team reviewed load flow calculations to determine whether the capacity of the transformer was adequate to supply worst-case accident loads. The team reviewed protective relaying schemes and calculations to determine whether the transformer was adequately protected, and whether it was subject to spurious tripping. The team reviewed the scheme for fast transfer of buses between the Unit Auxiliary Transformer (UAT) and SUT, including elementary wiring diagrams and breaker timing test results to determine whether the transfer would take place reliably and without spurious tripping of protective devices, or damage to equipment. The team reviewed maintenance schedules, procedures, and completed work records to determine whether the transformer was being properly maintained. The team reviewed corrective action histories to determine whether there had been any adverse operating trends. In addition, the team performed a visual inspection of the Startup Transformer to assess observable material condition and the presence of hazards.

b. Findings

No findings of were identified.

.2.11 Dedicated Shutdown/Alternate Seal Injection (DS/ASI) Diesel

a. Inspection Scope

The team reviewed loading calculations to determine whether the capacity of the DS/ASI diesel was adequate to supply worst-case loads. The team reviewed protective relaying schemes and calculations to determine whether the DS/ASI diesel and its associated cables and buses were adequately protected, and whether the diesel was subject to spurious tripping. The team reviewed corrective action histories to determine whether there had been any adverse operating trends. In addition, the team performed a visual inspection of the DS/ASI diesel to assess observable material condition and the presence of hazards.

b. Findings

No findings of were identified.

.2.12 6.9 kV Breaker 102 (Supply to Bus 1D)

a. Inspection Scope

The team reviewed bus load flow calculations to determine whether the 6.9 kV breaker was applied within its specified capacity ratings under worst case accident loading and grid voltage conditions. The team reviewed schematic diagrams and calculations for the breaker to determine whether equipment operation was consistent with the design basis.

The team reviewed calculations for protective device settings to determine whether the breaker was subject to spurious tripping, and whether the breaker was selectively coordinated with upstream devices. The team reviewed maintenance schedules, vendor data, and procedures for breaker routine maintenance and overhauls to determine whether scheduled maintenance activities were consistent with vendor recommendations.

The team reviewed recent corrective action documents and completed maintenance and testing records to determine whether there were any adverse operating trends. In addition, the team performed a visual inspection of the breaker to assess observable material condition and the presence of hazards.

b. Findings

No findings of were identified.

.2.13 Safety Related Circuit Breaker Issues

a. Inspection Scope

The team reviewed maintenance schedules, vendor data, and procedures for medium and low voltage breaker routine maintenance and overhauls to determine whether scheduled maintenance activities were consistent with vendor recommendations. The team reviewed recent corrective action documents and completed maintenance and testing records to determine whether testing was being performed and if there were any adverse operating trends. In addition, the team conducted interviews with engineering personnel to assess knowledge of industry trends and operating experience.

b. Findings

(Two) Failure to Extend the Design Life for Molded-Case Circuit Breakers

Introduction:

The team identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to maintain the qualifying design bases for safety-related equipment. Specifically, the licensee failed to extend the design life of the Westinghouse molded case circuit breakers (MCCBs) after the manufacturers qualifications ended at 20 years.

Description:

Westinghouse Technical Bulletin TB-06-02 stated that the design life for Westinghouse supplied MCCBs for mild environment applications is 20 years. It stated that the design life could be extended using a combination of a preventive maintenance program and aging analysis based on actual plant conditions. The licensee evaluated TB-06-02 in NCR 188820, but this evaluation did not directly address the aging and design life concerns raised in the TB. Instead, the evaluation referred to a statement in NMAC Circuit Breaker Maintenance Volume 3: Molded Case Circuit Breaker, Revision 1, as follows: periodic replacement is not recommended. A breaker should only be replaced if a problem is encountered. The licensee confirmed during the inspection the continued reliance on this statement for the run to failure approach to circuit breaker design life that was a feature of the preventive maintenance program for Westinghouse molded case circuit breakers. The inspectors noted that this statement was not based on officially published guidance from the breaker manufacturers, as was provided in TB-06-02. The inspectors concluded that relying on the 1993 statements made by manufacturers representatives during a conference in 1993 in lieu of the explicit guidance provided by Westinghouse in 2006, resulted in an inadequate evaluation of TB-06-02. Although Westinghouse prescribed a combination of periodic testing and maintenance as well as an aging analysis to extend the design life of MCCBs, the licensee confirmed that Westinghouse breakers in excess of 20 years of age were installed in the plant, and that no aging analysis had been performed to extend the design life. This finding was entered into the licensees CAP as NCR 460900. The NCR noted that the circuit breakers in question were included in the stations preventive maintenance program which included periodic cycling and testing so that no operability concerns existed at the present time.

Analysis:

The inspectors determined that the failure to extend the qualified life of the Westinghouse MCCBs for installed circuit breakers over 20 years old was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems cornerstone attribute of Equipment Performance and affected the cornerstone objective of ensuring the availability of multiple safety-related systems and components to respond to initiating events to prevent undesirable consequences. Specifically, not maintaining qualified components in safety-related SSCs could lead to the inability to respond to design basis events. The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a for the Mitigating Systems cornerstone. The finding screened as of very low safety significance (Green) because the finding was a design or qualification deficiency confirmed not to result in loss of operability or functionality. Specifically, no actual loss of function could be attributed to operating with MCCBs greater than 20 years old. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, requires in part, that measures shall be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems, and components. Contrary to the above, as of April 20, 2011, the licensee failed to review the suitability of the components essential to the design basis specifications. Specifically, the licensee failed to extend the qualified life of the MCCBs after the manufacturers qualifications ended at 20 years. Because this violation was of very low safety significance and because the issue was entered into the licensees CAP as NCR 460900, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and designated as NCV 05000400/

2011008-06, Failure to Extend the Design Life for Molded-Case Circuit Breakers.

Failure to Test Safety-Related Molded Case Circuit Breakers

Introduction:

The inspectors identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion XI, Test Control, for the licensees failure to include approximately 79 safety-related MCCBs in the circuit breaker test program.

Description:

The inspectors noted that the licensee had failed to include 79 safety-related circuit breakers in the test program. This population constituted approximately 10% of the total population of approximately 783 safety-related circuit breakers. The licensee had established separate programs to test different classes of MCCBs including breakers credited for protecting Containment electrical penetrations (MST-E0006) or for providing coordination of Safe-Shutdown common power supplies (MPT-E0024.) The licensee stated that the circuit breakers in question were not required to be included in those programs. Since the trip setpoints of molded case circuit breakers can change due to aging and wear, testing is necessary to ensure satisfactory performance including maintaining continuity of service for normal and accident loading, to limit damage in case of overcurrent conditions, and to limit the loss of service to unfaulted circuits.

Analysis:

The inspectors determined that the failure to periodically test safety related molded case circuit breakers was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems cornerstone attribute of Equipment Performance and affected the cornerstone objective of ensuring the availability of multiple safety-related systems and components to respond to initiating events to prevent undesirable consequences. Specifically, not confirming satisfactory performance of safety-related MCCBs could lead to the inability of equipment to respond to design basis events. The inspectors determined the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a for the Mitigating Systems cornerstone. The finding screened as of very low safety significance (Green)because the finding was a design or qualification deficiency confirmed not to result in loss of operability or functionality. Specifically, no actual loss of function could be attributed to failure to test the 79 circuit breakers identified as outside the established testing programs. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion XI, Test Control, requires, in part, that a test program shall be established to ensure that all testing required that SSCs will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents, including operational tests during nuclear power plant operation. Contrary to the above, the licensees test procedures failed to include in their scope, approximately 10% of the total population of safety-related circuit breakers.

Because this violation was of very low safety-significance and because the issue was entered into the licensees CAP as NCR 460953, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy and designated as NCV 05000400/2011008-07, Failure to Test Safety-Related Molded Case Circuit Breakers.

.2.14 Safety Related 125 VDC System

a. Inspection Scope

The team reviewed battery sizing and loading calculations to verify that loads do not exceed battery bank capacity. The team verified that the load profile bounded all accident scenarios. Also, for SBO and LOCA scenarios, the team verified that all control circuit breaker loads were accounted for in the loading calculation. In addition, the team reviewed short circuit calculations to verify that the duty cycle does not exceed the equipment protection ratings. The team reviewed performance tests to verify that the minimum voltage at the end of the test is the minimum voltage required by the most limiting component that has to actuate. Also, a review of the service test for LOCA was performed to verify that for the required current, the battery can provide the adequate voltage during an accident. Selective one-line and schematic diagrams were reviewed to verify proper configuration of the 125 VDC electrical distribution system.

The team reviewed battery charger sizing calculations to verify that the chargers are capable of carrying the continuous load after a Design Basis Accident (DBA) and will charge the batteries to full capacity within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Also, the team reviewed the last two tests of the battery chargers to look for signs of degradation due to aging. A review of the ac voltage calculation was performed to assure satisfactory voltage to the chargers under worst-case conditions. In addition, the team verified that the ampere-hours returned to the battery were greater than the ampere hours removed plus the charging losses. The single battery cell charging procedure was reviewed to verify proper electrical separation between non-safety related and safety related components and power sources. The team reviewed equalizing procedures for the batteries to verify proper voltage. The team performed a walkdown to verify material condition of the DC System and reviewed a sample of NCRs to confirm that the licensee adequately identifies, evaluates, and dispositions adverse conditions.

b. Findings

No findings were identified.

.2.15 Uninterruptible Power Supply (UPS)

a. Inspection Scope

The team reviewed loading and short circuit calculations to verify that the load does not exceed the UPS capacity and that the current duty does not exceed the equipment protection ratings. Also, AC and DC voltage calculations were reviewed to assure satisfactory voltage was available to the UPS under worst case conditions. Tests for protection equipment, power sources for the UPS, and UPS monitoring systems and alarms were reviewed to verify consistency with operational requirements. In addition, a review of configuration procedures was performed to verify the different alignments for the input power to the associated UPS. A review of operational procedures was performed to verify mechanical interlock between the associated UPS and power panels are properly accounted for. The team reviewed maintenance and corrective action documents to determine whether the equipment exhibited adverse performance trends.

The team performed a walkdown to the UPS and the control room to verify material condition of the UPS and applicable alarm response procedures were consistent with design basis.

b. Findings

Introduction:

The team identified a Green, NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to establish measures to ensure safety-related components had adequate voltage. Specifically, the licensee failed to perform an analysis to demonstrate that the loads connected to the safety-related Instrument Distribution Panels (IDPs) S-I, S-II, S-III and S-IV would have adequate voltage to operate during a DBA or transient.

Description:

During the inspection, the team identified that that the licensee failed to perform an analysis to demonstrate that the safety-related loads connected to the IDPs S-I, S-II, S-III and S-IV would have adequate voltage when the IDPs are aligned to the output of their respective 7.5kVA safety-related inverter or their alternate sources (PP-1A211-SA, PP-1B211-SB, PP-1A311-SA and PP-1B311-SB). As a result of the teams questions, the licensee performed a voltage drop calculation for the IDPs S-I, S-II, S-III and S-IV, being fed from the inverters, and demonstrated that all components would have sufficient voltage to operate except for some indicating lights that would need 112.1Vdc and were found to have only 108.05Vdc. It was determined that the indicating lights would be dim due to low voltage but still be available. The licensee entered these issues into the CAP as NCRs 458640, 458648 and 460930.

Analysis:

The licensees failure to perform an analysis to demonstrate that safety-related components would have adequate voltage to operate during a DBA or transient was a performance deficiency. The finding was more than minor because it affected the Mitigating System Cornerstone attribute of Design Control attribute and the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to perform an analysis that demonstrated that the loads connected to IDPs S-I, S-II, S-III and S-IV would have adequate voltage when the IDPs are aligned to the output of their respective 7.5KVA safety related inverter or to their respective alternate sources. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding a TS allowed outage time, and did not affect external event mitigation. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures provide for verifying or checking the adequacy of design for safety related components. Contrary to the above, since the operation of the plant, the licensee failed to perform an analysis to provide assurance that safety-related components would have adequate voltage to operate during DBA or transient.

Specifically, the licensee failed to perform an analysis to demonstrate that the loads connected to the IDPs SI, SII, SIII and SIV will have adequate voltage to operate during a design basis accident (DBA) or transients. Because this finding was of very low safety significance and because it was entered into the licensees CAP, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and is being designated as NCV 05000400/2011008-08, Failure to Ensure Adequate Voltage for Safety Related Components.

.2.16 Emergency Service Water (ESW) Exhaust Fan

a. Inspection Scope

The team verified by review of control diagrams, that the operation of ESW Exhaust Fan motor was consistent with the design basis and operational requirements. Also, the team reviewed ac voltage calculations to assure satisfactory voltage to the motor under worst case conditions. In addition, the team reviewed the motor protection setting calculations to determine whether there was adequate protection for short circuit conditions. The team reviewed maintenance and corrective action documents to determine whether the equipment had exhibited adverse performance trends; and performed visual inspection of the motor to assess material condition. A review of the associated corrective action history was performed to verify that degraded conditions were being appropriately addressed. Also, review of testing and calibration results for the monitoring instruments, automatic signals, and alarms was performed to verify consistency with the design basis and operational requirements.

b. Findings

No findings were identified.

.2.17 Reactor Coolant Pump (RCP) Thermal Barrier Return Flow Isolation Valve, 1CC-252

a. Inspection Scope

The team reviewed the MOV calculations, including required thrust, structural, and maximum differential pressure, to ensure the valve was capable of functioning under design conditions. In-service testing results were reviewed to verify that acceptance criteria were met and performance degradation would be identified. Associated electrical calculations were reviewed to confirm that the design basis minimum voltage at the MOV motor terminals was consistent with the design inputs used in the MOV thrust calculations, and that the thermal overload heaters protecting the motors would not prematurely trip. The team verified by review of control diagrams, that the operation of the MOV is consistent with the design basis and operational requirements. Also, the team verified testing and calibration of instruments related to the valve. In addition, the team reviewed the maintenance history to verify actions were taken to correct and prevent problems. A sample of NCRs were reviewed to confirm that the licensee adequately identifies, evaluates and dispositions adverse conditions related to the exhaust fan. The team performed a walkdown to verify material condition of the valve motor.

b. Findings

Introduction:

The team identified a Green Finding for the licensees failure to perform adequate corrective action for the inadvertent closing of MOV 1CC-252, RCP Thermal Barrier Return Flow Valve, following the start of the standby CCW pump.

Description:

During the inspection, the team performed a corrective action history review for 1CC-252. It was discovered that a proper extent of condition evaluation was not performed by the licensee when they discovered during testing, that MOV 1CC-252 would inadvertently close due to high flow transients experienced after the start of the standby CCW pump. The licensee wrote several NCRs to address the issue, but they only focused on the testing aspect of the issue; only making changes to the testing procedures to prevent the closure of the MOV during testing. These NCRs (395304, 398182, 403506, 403715) failed to address the potential for the MOV 1CC-252 to close following a safety injection (SI) or de-energization of a safety bus, when the CCW standby pump is expected to auto-start.

When the standby CCW pump starts it causes a high flow transient that generates a momentary flow that exceeds the setpoint of 198 gpm for the flow transmitter 1-FT-685, which in turn sends a closing signal to MOV 1CC-252. The inadvertent closure of 1CC-252 would isolate the thermal barrier flow affecting all three RCP seals; however, cooling to the seals would still be available through seal injection. If 1CC-252 closes upon start of the standby CCW pump due to a transient, the operators will have an alarm in the control room that will let them know they have low thermal barrier flow. Annunciator Panel Procedure, APP-ALB-005, provided directions to re-establish thermal barrier flow to the seals; though, operator identification of the condition could be challenged due to competing alarms and priorities.

As a result of the inspection, the licensee generated standing order 11-012, addressed to the MCR staff, to explain that during an Engineered Safety Feature actuation when the standby CCW Pump is expected to auto-start or during testing, when the standby CCW pump is placed in service, a transient high flow can be expected to cause 1CC-252 to automatically close. The licensee entered this issue in their corrective action program as NCR 460686.

Analysis:

The licensees failure to perform adequate corrective action on the inadvertent closing of MOV 1CC-252 following the start of the standby CCW pump was a performance deficiency. The finding was more than minor because it was associated with the Equipment Performance attribute of the Initiating Events cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, the licensee failed to evaluate the potential for the RCP thermal barrier to isolate upon the auto-start of the standby CCW pump, following a SI or de-energization of a safety bus. In accordance with NRC IMC 0609.04, Initial Screening and Characterization of Findings, the team conducted a Phase 1 Significance Determination Process (SDP) screening and determined the finding to be of very low safety significance (Green) because assuming worst case degradation, the finding would not result in exceeding the TS limit for any RCS leakage, the finding did not result in the total loss of an affected mitigating system safety function, the finding did not contribute to the likelihood of a reactor trip or the likelihood that mitigating equipment or functions will not be available, and the finding did not increase the likelihood of a fire or internal/external flooding. Because the licensee failed to thoroughly evaluate problems such that the resolutions address causes and extent of conditions, as necessary, this finding is assigned a crosscutting aspect in the corrective action program of the Problem Identification and Resolution area. P.1(c)

Enforcement:

Because 1CC-252 is a non-safety related component, enforcement action does not apply, thus the performance deficiency did not involve a violation of regulatory requirements. Because the finding was of very low safety significance and the issue was addressed in the corrective action program as NCR 460686, this issue is being designated as FIN 05000400/2011008-08, Inadequate Corrective Action For Inadvertent Loss of Thermal Barrier HX Flow.

.3 Review of Low Margin Operator Actions

a. Inspection Scope

The team performed a margin assessment and detailed review of seven risk significant and time critical operator actions. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times. For the selected operator actions, the team performed a walkthrough of associated End Path Procedures (EPPs), Abnormal Operating Procedures (AOPs), Annunciator Panel Procedures (APPs), Operating Procedures(OPs), Corrective Maintenance Procedures (CMs), and other operations procedures with plant operators, maintenance personnel and engineers to assess operator knowledge level; adequacy of procedures; availability of special equipment when required; and the conditions under which the procedures would be performed. Detailed reviews were also conducted with operations and training department leadership to further understand and assess the procedural rationale and approach to meeting the design basis and UFSAR response and performance requirements. Operator and maintenance personnel actions were observed during plant walkdowns and during simulated performance of risk significant and time critical actions.

Selected operator actions associated with the following events/evolutions were reviewed:

• Operator actions to manually start an AFW pump

• Operator actions to fill the ASI tank

• Operator actions to connect ASI power to a battery charger

• Operator/ maintenance actions to align spare pump for CCW operation

• Operator actions to align spare battery charger

• Operator actions to operate TDAFP locally

• Operator actions to operate steam generator PORVs

.4 Review of Industry Operating Experience

a. Inspection Scope

The team reviewed selected operating experience issues that had occurred at domestic and foreign nuclear facilities for applicability at the Harris Nuclear Plant. The team performed an independent applicability review for issues that were identified as applicable to the Harris Nuclear Plant and were selected for a detailed review. The issues that received a detailed review by the team included:

• IN 87-09, EDG Room Cooling Design Deficiency

• IN 96-06, Design and Testing Deficiencies of Tornado Dampers at Nuclear Power Plants

• IN 2008-02, Findings Identified During Component Design Bases Inspections

• RIS-06-023, Post-tornado Operability of Ventilating and Air-conditioning Systems Housed in Emergency Diesel Generator Rooms

• Review of potential breaker issues at Harris Nuclear Plant

• Robinson AIT Report 05000261/2010009 OE, Failure of Thermal Barrier Isolation Valve

• Robinson AIT Report 05000261/2010009 OE, Failure of Inverter and Instrument Bus

b. Findings

Introduction:

The inspectors identified a Green, NCV of TS 6.8.1 for the failure to implement an adequate preventative maintenance (PM) procedure to ensure reliable operation of the plants safety-related tornado dampers. Specifically, procedure CL-ME0023, HVAC AND TORNADO DAMPERS failed to provide proper guidance to maintain the tornado dampers operable in accordance with design and vendor requirements. The significance of this violation was determined using Phase III of the SDP.

Description:

During a CDBI inspection walkdown of the auxiliary building, control building, and EDG buildings, it was observed that three safety related tornado dampers (CZ-Z1SN-1, CZ-X4SN-1, and AC-X4SN-1) located in the auxiliary building had counterweights that were extended beyond what was shown on the applicable drawings.

Two of the dampers (CB-Z1SN-1 and CB-Z2SN-1) had damper counterweights that were modified in shape from that on the drawings. The licensees initial investigation of this discrepancy indicated that although the drawing showed a maximum extension length, the damper vendor manual had specific instructions for setting the counterweight but did not refer to any maximum extension length. The licensee initiated follow-up testing and inspection to validate that the dampers had been adjusted per vendor manual guidance and were still capable of performing their intended safety function. The function of the tornado dampers is to close in 0.2 seconds or less under conditions of a 2 psi/sec pressure decrease causing flow out of the structure, and to re-open after pressure conditions have normalized. The tornado dampers have a routine PM procedure which provides guidance to inspect, lubricate, and verify each damper operates smoothly with no binding.

The testing and inspection concluded that the current PM did not verify the damper was properly set up in accordance with the vendor manual guidance. An extent of condition review was initiated prompting work-orders for testing to be conducted for all 16 of the tornado dampers to ensure proper operation and set up per the vendor manual guidance. As a result, nine dampers where found to be defective. Of the nine, two of the dampers were found to be inoperable and would not have functioned when called upon during a tornado event. The remaining dampers exhibited some degradation to free movement, but would have been expected to close during passage of a tornado.

Upon discovery, the licensee immediately performed corrective maintenance on each of the dampers in accordance with the vendor manual to ensure proper operation during an event and ensured each dampers safety function was restored.

The licensee reviewed the condition of each degraded damper for reportability and determined that, the condition of damper CB-Z2SN-1 may have existed since May of 1999 as a result of incorrectly performed maintenance on the damper. As a result, the licensee submitted LER 2011-001-00 in accordance with 10 CFR 50.73 (a)(2)(i)(B)because the condition existed longer than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> as permitted by TS 3/4.6.5. The licensee plans to implement a new Plant Operating Manual procedure for tornado damper maintenance and test as their corrective action to prevent recurrence.

Analysis:

The licensees failure to implement an adequate preventative maintenance procedure to ensure reliable operation of the plants safety-related tornado dampers was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of the safety-related ventilation system to respond to initiating events to prevent undesirable consequences and the cornerstone attribute of Protection against External Events, i.e. seismic, weather. Specifically, the failure of the dampers to function properly would impact the ability to maintain required ventilation during an external event. The inspectors assessed the finding using a Phase I SDP screening which determined a Phase III SDP evaluation was required due to the fact that the finding involved the loss or degradation of equipment specifically designed to mitigate a severe weather initiating event (e.g., tornado doors). The loss of this equipment by itself, during the external initiating event it was intended to mitigate, would degrade one or more trains of a system that supports a safety system or function. A Phase III SDP evaluation was performed in accordance with NRC Inspection Manual Chapter 0609 Appendix A by a regional SRA using the NRC SPAR model. The analysis determined that the performance deficiency resulted in a core damage frequency (CDF) risk increase less than 1E-6/year. Therefore, the finding was characterized as having very low safety significance (Green). The large early release frequency (LERF) result was less than 1E-7/year which would not override the CDF risk characterization. The initiator was a tornado which caused a non-recoverable loss of offsite power (LOOP), resulted in loss of the dedicated shutdown diesel generator (DSDG) and caused a failure of the ductwork supplying the B train switchgear cooling fans which would lead to loss of the B train safety related AC and DC electrical distribution system. The dominant sequence was a tornado generated LOOP with resultant failure of B train electrical distribution system and the DSDG, failure of the A train EDG, failure to recover offsite power or an EDG leading to loss of core heat removal capability and subsequent core damage. The risk was mitigated by the availability of the A train equipment and the low frequency of tornado required to cause damage to the damper and ductwork. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

TS 6.8.1, states that written procedures shall be established, implemented, and maintained covering the activities in Appendix A of Regulatory Guide 1.33, Quality Assurance Program Requirements (Operation), Revision 2. The Regulatory Guide, Section 9.a states, in part, that maintenance that can affect the performance of safety-related equipment should be properly preplanned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to the above, the licensee failed to provide a proper preventative maintenance procedure in CL-ME0023, HVAC AND TORNADO DAMPERS, to assure that the tornado dampers would be able maintain their safety function and ensure the operability of the safety-related ventilation system during a tornado event. This deficiency has existed since initial development of the PM procedure. Because this finding was of very low safety significance and was entered into the licensees corrective action program as AR 457949 and 458237, this finding is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy and being designated as NCV 05000400/2011008-09, Failure to Implement an Adequate Preventative Maintenance Procedure to Ensure Reliable Operation of the Plants Safety-Related Tornado Dampers.

4OA6 Meetings, Including Exit

On April 20, 2011, the team presented preliminary inspection results to members of the licensees staff. Proprietary information that was reviewed during the inspection was returned to the licensee.

A final review of information provided to the team was performed and on June 30, 2011 the results of open inspection items were presented to John Caves and other members of the licensees staff.

ATTACHMENT: SUPPPLEMENTAL INFORMATION

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

D. Corlett, Licensing Supervisor

D. Schroeder, Design Engineering Manager

J. Price, Engineering

D. Hooten, Engineering

K. Dixon, Licensing

J. Caves, Licensing

J. Doorhy, Licensing

NRC personnel

J. Austin, Senior Resident Inspector, Harris

P. Lessard, Resident Inspector, Harris

LIST OF ITEMS

Opened and Closed

05000400/2011008-01 NCV Failure to Report Required Information Related to MSIV Failure (Section 1R21.2.1)

05000400/2011008-02 NCV Inadequate Control of Degraded Voltage Time Delay Settings - Two Examples (Section 1R21.2.3)

05000400/2011008-03 NCV Failure to Maintain Environmental Qualification on Steam Generator Power Operated Relief Valves (Section 1R21.2.5)

05000400/2011008-04 NCV Non-conservative Calculations for Motor Control Center Control Circuit Voltage (Section 1R21.2.8)

05000400/2011008-05 NCV Failure to Control Design Limits for ESCW Flow Balancing (Section 1R21.2.9)

05000400/2011008-06 NCV Failure to Extend the Design Life for Molded-

Case Circuit Breakers (Section 1R21.2.13)

05000400/2011008-07 NCV Failure to Test Safety-Related Molded Case Circuit Breakers (Section 1R21.2.13)

05000400/2011008-08 NCV Failure to Ensure Adequate Voltage for Safety Related Components (Section 1R21.2.15)

05000400/2011008-09 FIN Inadequate Corrective Action Inadvertent Loss of Thermal Barrier HX Flow (Section 1R21.2.17)

05000400/2011008-10 NCV Failure to Establish Adequate Preventative Maintenance Procedure for Safety-Related Tornado Dampers (Section 1R21.4)