IR 05000454/2005002

IR 05000454-05-002 (Drs); IR 05000455-05-002(DRS); 01/24/2005 - 02/11/2005; Byron Station, Units 1 and 2; Safety System Design and Performance Capability

ML051440451
Person / Time
Site:	Byron
Issue date:	05/20/2005
From:	Ann Marie Stone Division of Nuclear Materials Safety III
To:	Crane C Exelon Generation Co
References
-RFPFR
Download: ML051440451 (38)

Text

SUBJECT:

BYRON STATION, UNITS 1 AND 2 NRC BIENNIAL SAFETY SYSTEM DESIGN AND PERFORMANCE CAPABILITY BASELINE INSPECTION REPORT 05000454/2005002(DRS);

05000455/2005002(DRS)

Dear Mr. Crane:

On February 11, 2005, the Nuclear Regulatory Commission (NRC) completed a biennial baseline engineering inspection of safety system design and performance capability of selected important systems at the Byron Station, Units 1 and 2. The enclosed report documents the inspection findings which were discussed with Mr. Steve Kuczynski and other members of your staff at the inspection exit on February 11, 2005.

The inspectors examined activities conducted under your license as the activities related to safety and compliance with the Commissions rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The inspection focused on the safety system design and performance capability of the Essential Service Water and the Vital 4160V Auxiliary Power systems to assure that the selected systems were capable of performing the required safety related functions.

Based on the results of this inspection, five NRC-identified findings of very low safety significance, each of which involved violations of NRC requirements were identified. Because these violations were of very low safety significance and because the issues were entered into the licensees corrective action program, the NRC is treating these findings as Non-Cited Violations in accordance with Section VI.A.1 of the NRCs Enforcement Policy.

If you contest the subject or severity of any of these Non-Cited Violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission - Region III, 2443 Warrenville Road, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector Office at the Byron Station. In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be made available electronically for public inspection in the NRC Public Document Room or from the Publically Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Ann Marie Stone, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-454; 50-455 License Nos. NPF-37; NPF-66 Enclosure: Inspection Report 05000454/2005002(DRS); 05000455/2005002(DRS)

w/Attachment: Supplemental Information cc w/encl: Site Vice President - Byron Station Plant Manager - Byron Station Regulatory Assurance Manager - Byron Station Chief Operating Officer Senior Vice President - Nuclear Services Vice President - Mid-West Operations Support Vice President - Licensing and Regulatory Affairs Director Licensing Manager Licensing - Braidwood and Byron Senior Counsel, Nuclear Document Control Desk - Licensing Assistant Attorney General Illinois Department of Nuclear Safety State Liaison Officer, State of Illinois State Liaison Officer, State of Wisconsin Chairman, Illinois Commerce Commission B. Quigley, Byron Station

SUMMARY OF FINDINGS

IR 05000454/2005002(DRS); 05000455/2005002(DRS); 01/24/2005 - 02/11/2005; Byron

Station, Units 1 and 2; Safety System Design and Performance Capability.

The inspection was a three-week baseline inspection of the design and performance capability of the Essential Service Water and the Vital 4160V Auxiliary Power systems. The inspection was conducted by regional engineering inspectors and a mechanical engineering consultant.

Five Green findings associated with five Non-Cited Violations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

A. Inspector-Identified and Self-Revealed Findings

Cornerstone: Mitigating Systems

Green.

A finding of very low safety significance was identified by the inspectors for a violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings. After increasing the minimum required river screen house (RSH)temperature for securing a service water makeup pump from 50 degrees Fahrenheit to 70 degrees Fahrenheit in 1998, the licensee failed to revise two operating procedures.

Once identified, the licensee reviewed other procedures and initiated procedure changes.

This issue was more than minor because the licensee failed to ensure that the procedures contained the necessary precautions and steps to ensure continued operability of the SX pumps. The issue was of very low safety significance because it did not represent the actual loss of a safety function. (Section 1R21.1b1)

Green.

A finding of very low safety significance was identified by the inspectors for a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. A River Screen House (RSH) ventilation calculation assumed that only one Essential Service Water (SX) makeup pump would be running and calculated the maximum ambient temperature of the RSH to be 115 degrees Fahrenheit. Licensee personnel failed to consider that two SX makeup pumps could be in operation for up to five hours into an event. Since two pumps could be running, the calculation underestimated the heat input into the RSH from the operating pumps. Once identified, the licensee immediately performed an operability determination and concluded that based on current cooler ambient temperatures, the pumps were operable. Additional assessments will be completed prior to summer temperatures.

This issue was more than minor because exceeding the temperature ratings for components could impact the ability of the diesel-driven pump to perform its safety function. The issue was of very low safety significance because it did not represent an actual loss of a safety function. (Section 1R21.1b2)

Green.

A finding of very low safety significance was identified by the inspectors for a Non-Cited Violation of 10 CFR 50.55a. The licensee did not ensure that the essential service water (SX) system contained pressure relief devices or had administrative controls to relieve excessive system pressure as required by Article ND-7110 of the American Society of Mechanical Engineers (ASME) Code,Section III. Once identified, the licensee immediately initiated actions to strengthen the administrative controls to prevent overpressure. This issue also impacted the cross-cutting aspect of problem identification and resolution because the licensee had opportunities to identify the condition in October 2003.

This issue was more than minor because failing to provide overpressure protection to the Unit 0 Component Cooling Heat Exchanger served by SX could result in inoperability of the component or diverted SX flow. The issue was of very low safety significance because it was not a design issue or an actual loss of the systems safety function.

(Section 1R21. 2b2)

Green.

A finding of very low safety significance was identified by the inspectors for a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control. The thermostats that control the essential service water (SX) system 1/2SX168 valves were non-safety related and their failure could affect the SX cooler flow to the diesel driven auxiliary feedwater (AFW) pump rooms. The original design review of the component classification failed to address all failure modes. Once identified, the licensee immediately performed an operability determination and based on engineering judgment, concluded that the valves were operable This issue was more than minor because failing to ensure proper room cooling could impact the function of temperature sensitive equipment and could result in inoperability of a diesel driven AFW pump. The issue was of very low safety significance because it was a design issue which did not result in loss of function per Generic Letter GL 91-18.

(Section 1R21.2b3)

Cornerstone: Barrier Integrity

Green.

A finding of very low safety significance was identified by the inspectors for a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions,

Procedures, and Drawings. The acceptance criteria for the minimum service water flow through a reactor containment fan cooler (RCFC) as specified in 1/2BOSR 6.6.2-1,

Reactor Containment Fan Cooler Monthly Surveillance, was based on a higher system pressure than expected during the limiting design basis accident. Therefore, the licensee did not ensure that the TS required flow would be achieved at the lower pressure conditions. Once identified, the licensee performed an operability determination and concluded the fan coolers were operable. Additional actions including revising the procedures were being considered.

This issue was more than minor because reduced service water flow through the RCFC could impact the heat removal capability of the RCFCs. The issue was of very low safety significance because it did not represent a reduction in defense in depth with respect to the physical integrity of the reactor containment. (Section 1R21.2b1)

Licensee-Identified Violations

• No findings of significance were identified.

REPORT DETAILS

1R21 Safety System Design and Performance Capability

Introduction:

Inspection of safety system design and performance capability verifies that the initial design and subsequent modifications were designed to requirements and provide monitoring of the ability of the selected systems to perform design bases functions. As plants age, the design bases may be lost and important design features may be altered or disabled. The plants risk assessment model was based on the capability of the as-built safety system to perform the intended safety functions successfully. Inspection of this area verifies aspects of the mitigating systems cornerstone for which there are no indicators to measure performance.

The objective of the this inspection is to assess the adequacy of calculations, analyses, other engineering documents, and operational and testing practices that were used to support the performance of the selected systems during normal, abnormal, and accident conditions.

The systems and components selected for the inspection were the Essential Service Water (SX) and the Vital 4160V Auxiliary Power (AP) systems. These systems were selected for review based upon:

• having a high probabilistic risk analysis ranking;

• having had recent significant issues;

• not having received recent NRC review; and

• being interacting systems.

The inspection focused on system requirements (initial design, installation and subsequent modifications); system condition and capability (performance under normal and accident conditions, consistency with design basis); and components (qualifications, protection). The criteria used to determine the acceptability of the systems performance was found in documents such as applicable technical specifications; applicable updated final safety analysis report (UFSAR) sections; and the systems' design documents. Additional documents reviewed are listed in the Attachment.

.1 System Requirements

a. Inspection Scope

The inspectors reviewed the UFSAR, technical specifications, system descriptions, drawings, and available design basis information to determine the performance requirements for the SX and the AP systems. The reviewed system attributes included process medium, energy sources, control systems, operator actions and heat removal.

The rationale for reviewing each of the attributes was:

Process Medium: This attribute required review to ensure that the selected systems flow paths would be available and unimpeded during and following design basis events.

To achieve this function, the inspectors verified that the systems would be aligned and maintained in an operable condition as described in the plant UFSAR, technical specifications and design bases.

Energy Sources: This attribute required review to ensure that the selected systems motive/electrical source would be available/adequate and unimpeded during and following design basis events, that appropriate valves and system control functions would have sufficient power to change state when required. To achieve this function, the inspectors verified that the interactions between the systems and their support systems were appropriate such that components would operate properly when required.

Controls: This attribute required review to ensure that the automatic controls for operating the systems and associated systems were properly established and maintained. Additionally, review of alarms and indicators was necessary to ensure that operator actions would be accomplished in accordance with design requirements.

Operations: This attribute was reviewed because the operators perform a number of actions during normal, abnormal, and emergency operating conditions that have the potential to affect the selected systems operation. In addition, the emergency operating procedures require the operators to manually realign systems flow paths during and following design basis events. Therefore, operator actions play an important role in the ability of the selected systems to achieve their safety-related functions.

Heat Removal: This attribute was reviewed to ensure that there was adequate and sufficient heat removal capability for the selected systems. Operating procedures were reviewed to verify that instructions to operators were consistent with design assumptions. Information was reviewed to verify that the actual system condition and tested capability was consistent with the identified design bases. Specifically, the inspectors reviewed the installed configuration, the system operation, the detailed design, and the system testing, as described below.

b. Findings

Two findings of very low safety significance and associated Non-Cited Violations were identified in this area.

b1. Failure to Properly Review and Revise Procedures to Reflect Temperature Limits

Introduction:

The inspectors identified a finding of very low safety significance and associated Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion V, for the licensees failure to revise two procedures when new information related to the Service Water (SX) makeup pumps was received.

Description:

Prior to February 1998, the licensee established 50 degrees Fahrenheit as the minimum ambient temperature at which the diesel driven SX makeup pumps could be stopped without an impact on the diesels ability to restart. This temperature limitation was in place because the jacket water heaters would be de-energized on a loss of power to the river screen house. In February 1998, the licensee performed an operability determination due to an inoperable jacket water heater and concluded that the minimum ambient temperature required prior to securing a SX makeup pump should be 70 degrees Fahrenheit instead of the previous 50 degrees Fahrenheit. This higher temperature was needed to ensure subsequent restart capability of the associated diesel. As a result, the licensee initiated several procedure changes to reflect this new minimum temperature.

During this inspection effort, the inspectors identified that procedure 1/2BOA ELEC-4, Loss of Offsite Power, Unit 1, was not changed and still stated that a pump could be secured at an ambient temperature of 50 degrees Fahrenheit. Upon this discovery, the licensee notified the control room operators and reviewed other procedures. The licensee also noted that BOP SX-10, Essential Service Water Make-up Pump Shutdown, also contained the 50 degrees Fahrenheit limit. The licensee also noted that current procedures focused on shutting down a running pump but did not address starting of a pump when temperatures were below 70 degrees Fahrenheit.

Analysis:

The inspectors determined that failing to have appropriate procedures in place was a performance deficiency warranting a significance evaluation per IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the finding was more than minor because it involved the procedure quality attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective of ensuring the availability of the SX makeup pumps. Specifically, the licensee failed to ensure that the procedures contained the necessary precautions and steps to ensure the pumps could be restarted if necessary.

The inspectors completed a significance determination of this issue using IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At Power Situations, Phase 1 screening and determined that the lack of accurate procedures was not a design issue resulting in a loss of function per Generic Letter (GL) 91-18, did not represent an actual loss of a systems safety function, and did not result in exceeding a Technical Specification (TS) allowed outage time. The inspectors determined that the finding was of very low safety significance (Green).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion V required, in part, that activities affecting quality be prescribed by documented procedures of a type appropriate to the circumstances and shall be accomplished in accordance with these procedures.

Contrary to the above, licensee personnel failed to maintain the adequacy of two procedures with respect to shutting down the SX makeup pumps. Specifically, 1/2BOA ELEC-4, Loss of Offsite Power, Unit 1, and BOP SX-10, Essential Service Water Make-up Pump Shutdown, were not updated with new temperature requirements which would ensure starting reliability for the SX make-up pumps. Because this violation was of very low safety significance and because the issue was entered into the licensees corrective action program (AR 00299774), the issue is being treated as a Non-Cited Violation, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000454/2005002-01; NCV 05000455/2005002-01).

As stated above, the licensee performed an extent of condition to determine if other procedures required revisions. Changes will be made as necessary.

b2. Inadequate River Screen House Ventilation Calculation

Introduction:

The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, for failing to verify the adequacy of design for the maximum River Screen House (RSH) temperature. The finding was considered to be of very low safety significance (Green).

Description:

The original specification F-2891 to which the SX makeup pump diesel engine and the driver components were procured, had a design required environmental temperature of 115 degrees Fahrenheit. Design calculation VH-400, Temperature-time Profile for River Screen House, demonstrated that the maximum RSH temperature was projected to be 115 degrees Fahrenheit with an assumed outside temperature of 99 degrees Fahrenheit, and with one SX makeup pump running. The licensee assumed only one SX makeup pump would be operating because the design bases required one SX makeup pump to be capable to provide makeup to the ultimate heat sink.

However, the inspectors noted that during accident conditions, both of the SX makeup pumps would receive a start signal and could be operating simultaneously until manually stopped by control room operators. Dual operation would increase the temperature of the room above the calculated 115 degrees Fahrenheit. The licensee determined that both SX makeup pumps could be in simultaneous operation for as much as five hours before one of the pumps would be shutdown.

Based on the current low ambient temperatures (winter) and other conservatisms in the calculation, the licensee determined that the additional heat load from the second running pump would not exceed the 115 degree Fahrenheit limit. Therefore, based on this engineering judgment, the pumps were currently operable. Additional assessment will be conducted prior to summer temperatures.

Analysis:

The inspectors determined that failing to ensure appropriate assumptions in the room heat up calculation was a performance deficiency warranting a significance evaluation per IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the finding was more than minor because it involved the Design Control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the reliability of the SX makeup pumps. Specifically, exceeding the temperature ratings for components could impact the ability of the diesel-driven pump from performing its safety function.

The inspectors completed a significance determination of this issue using IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At Power Situations, Phase 1 screening and determined that the lack of accuracy in this calculation was a design issue that did not result in a loss of function per Generic Letter (GL) 91-18; therefore, the inspectors determined that this finding was of very low safety significance (Green).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III required, in part, that design measures provide for verifying or checking the adequacy of design, such as by the use of alternate or simplified calculational methods. Contrary to the above, licensee personnel did not verify an assumption contained in design calculation VH-400, Temperature-time Profile for River Screen House, and failed to consider the heat load contribution of a second running SX makeup pump. Because this violation was of very low safety significance and licensee personnel entered the finding into the corrective action program (IR00297542), the finding is being treated as a Non-Cited Violation consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000454/2005002-02; NCV 05000455/2005002-02).

Additional immediate actions were not required because of the current cooler ambient temperatures. Licensee personnel stated that actions were planned to resolve both the calculation error and evaluate the program to test vent louvers for adequacy prior to the onset of summer weather

.2 System Condition and Capability

a. Inspection Scope

The inspectors reviewed design basis documents and plant drawings, abnormal and emergency operating procedures, requirements, and commitments identified in the UFSAR and technical specifications (TS). Information in these documents was compared to applicable electrical, instrumentation and control, and mechanical calculations, setpoint changes and plant modifications. The inspectors also reviewed operational procedures to verify that instructions to operators were consistent with design assumptions.

Information was reviewed to verify that the actual system condition and tested capability was consistent with the identified design bases. The reviewed system attributes included installed configuration, the system operation, the detailed design, and the system testing, as described below.

Installed Configuration: The inspectors confirmed that the installed configuration of the SX and the AP systems met the design basis by performing detailed system walkdowns. The walkdowns focused on the installation and configuration of piping, components, and instruments; the placement of protective barriers and systems; the susceptibility to flooding, fire, or other environmental concerns; physical separation; provisions for seismic and other pressure transient concerns; and the conformance of the currently installed configuration of the systems with the design and licensing bases.

Operation: The inspectors performed reviews of selected operating procedures to confirm that the operators had the knowledge and tools necessary to accomplish actions required to maintain compliance with the design basis.

Design: The inspectors reviewed the mechanical, electrical, and instrumentation design of the SX and the AP systems to verify that the systems and subsystems would function as required under accident conditions. The review included a review of the design basis, design changes, design assumptions, calculations, boundary conditions, and models as well as a review of selected modification packages. Instrumentation was reviewed to verify appropriateness of applications and set-points based on the required equipment function. Additionally, the inspectors performed limited analyses in several areas to verify the appropriateness of the design values.

Testing: The inspectors reviewed records of selected periodic testing and calibration procedures and results to verify that the design requirements of calculations, drawings, and procedures were incorporated in the system and were adequately demonstrated by test results. Test results were also reviewed to ensure automatic initiations occurred within required times and that testing was consistent with design basis information.

b. Findings

Three findings of very low safety significance and associated NCVs were identified. In addition, two unresolved items are also discussed.

b1. Inadequate Acceptance Criteria for Flow Test

Introduction:

The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for failure to ensure adequate acceptance criterion for the operability of the reactor containment fan coolers (RCFC) as determined during the monthly surveillance procedure 1/2BOSR 6.6.2-1, Reactor Containment Fan Cooler Monthly Surveillance. The finding was considered to be of very low safety significance (Green).

Description:

Reactor containment fan cooler (RCFC) monthly surveillance procedure 1/2BOSR 6.6.2-1, Reactor Containment Fan Cooler Monthly Surveillance, was performed monthly to monitor the degradation of the SX system and verify the compliance with Technical Specifications. This procedure established a minimal acceptable flow through the RCFC of greater than or equal to 2,660 gpm plus 5 percent instrument tolerance for the ultrasound flow meter. This was consistent with TS surveillance requirement 3.6.6.3.

The test was performed at an SX discharge header pressure of 94 +/- 2 psig; however, the inspectors noted that the system could be operating at a lower pressure (the SX system discharge pressure low alarm was set to actuate at 90 psig). Furthermore, postulated design basis accident limiting conditions (failure of one SX pump, SX flow to supply the auxiliary feedwater pumps, use of the Unit 0 component cooling heat exchanger, a drop in cooling tower basin level, and maximum allowable pump degradation) could reduce the post-accident SX system header pressure below 90 psig and reduce the SX flow to the RCFCs below the TS value. The inspectors were concerned that because the test was performed at a pressure higher than the expected pressure during a design basis accident, TS operability was not confirmed.

The licensee performed an immediate operability determination and concluded that the SX system remained operable due to expected operator actions to restore header pressure during postulated events. Although the operability evaluation was acceptable, the inspectors noted that these actions were based extensively on operator training as specific instructions to increase pressure were not provided in the post-accident response procedures.

Analysis:

The inspectors determined that failing to establish appropriate acceptance criteria for a TS required test was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the finding was more than minor because it involved the Design Control attribute of the Barrier Integrity cornerstone and affected the cornerstone objective of ensuring the capability of the RCFC system. Specifically, reduced SX flow through the RCFC could impact the heat removal capability of the RCFCs.

The inspectors completed a significance determination of this issue using IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At Power Situations, Phase 1 screening and determined that the inadequate acceptance criteria in the surveillance test did not impact the reactor coolant system or fuel barriers, did not represent a degradation of the radiological barrier, did not impact the control room, and did not represent a reduction in defense in depth with respect to the physical integrity of the reactor containment. Therefore, the inspectors determined that this finding was of very low safety significance (Green).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that instructions, procedures, or drawings include appropriate quantitative or qualitative acceptance criteria for determining that important activities had been satisfactorily accomplished.

Contrary to this requirement, inspectors identified that the acceptance criterion for the reactor containment fan cooler monthly surveillance procedure (1/2BOSR 6.6.2-1) did not account for system pressure differences between the as-tested SX alignment and the expected conditions during the limiting design basis accident. The licensee performed an operability determination and concluded the RCFCs were operable. The licensee was evaluating additional corrective actions including possibly revising the test procedure. Because the violation was of very low safety significance and licensee personnel entered the finding into the corrective action program (IR 297542), this violation is being treated as a Non-Cited Violation consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000454/2005002-03; NCV 05000455/2005002-03).

b2. Lack of Heat Exchanger Overpressure Protection

Introduction:

The inspectors identified a Non-Cited Violation of 10 CFR 50.55a for failing to ensure that the SX system contained pressure relief devices to relieve excessive system pressure as required by Article ND-7110 of the American Society of Mechanical Engineers (ASME) Code,Section III. The issue was considered to be of very low safety significance (Green).

Description:

Article ND-7110 of the ASME Code of Construction (1974 Edition through Summer 1975 Addenda) stated that individual components which are isolable from normal system overpressure protection shall be reviewed to determine whether additional individual overpressure protection is necessary. The inspectors noted that the SX system was not equipped with thermal relief valves on some of the SX heat exchangers. The licensee presented calculation SX-MP-01, Verification of Service Water (SX) System Overpressure Protection, which indicated that overpressure protection was not necessary because a flow path to the cooling towers would always exist. The licensee stated that all heat exchangers had a normally open valve on at least one side of the heat exchanger (inlet or outlet) and that this satisfied the intent of Article ND-7110.

During this inspection, the inspectors determined that the conclusion that overpressure protection was not necessary was incorrect because open flow paths to the towers do not always exist. Two events demonstrated that additional overpressure protection was needed. Specifically:

• In October of 2002, a high temperature alarm for the component cooling water system was received when the Unit 0 component cooling system (U0 CC) heat exchanger was placed in service. The SX inlet valves to the U0 CC heat exchanger (1/2SX005) and the SX outlet valves (0SX146, 0SX147), which were normally closed (isolated flow path to the cooling towers), were not opened when the heat exchanger was placed in service. In the apparent cause evaluation, causal factors, and all related concerns and investigations, the licensee focused on the effects of the elevated CC temperature but did not recognize that this alignment did not comply with Article ND-7110.

• In October 2003, the plant experienced over-pressurization of the containment chiller unit (a non-safety related component) when the SX inlet and outlet valves to the containment chiller units (1/2SX11B, 1/2SX114B) failed closed but the chiller continued to run. The SX pressure increased in this case because of the continued heat input from the containment chilled water system. The licensee determined that an overpressure protection device for the chiller was necessary because the SX inlet and outlet valves were expected to fail closed. At the time of this inspection, the modification was not completed; however, the licensee had not established administrative controls to ensure protection.

Analysis:

The inspectors determined that failing to provide required overpressure protection to heat exchangers was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the finding was more than minor because it involved design control attributes of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capacity of the SX system.

Specifically, failing to provide overpressure protection to various components served by SX could result in inoperability of the component or diverted SX flow.

The inspectors evaluated this finding using IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At Power Situations, Phase 1 screening and determined that the lack of overpressure protection to the U0 CC heat exchanger was not a design issue resulting in loss of function per GL 91-18, did not represent an actual loss of a systems safety function, and did not result in exceeding a TS allowed outage time. The inspectors determined that this finding was of very low safety significance (Green).

In addition, this finding impacted the cross-cutting aspect of problem identification and resolution. While investigating the October 2003 event, the licensee should have identified the broader implication of overpressure protection.

Enforcement:

Title 10 CFR 50.55a required, in part, that systems and components of pressurized water-cooled nuclear power reactors must meet the requirements of the applicable sections of the ASME Boiler and Pressure Vessel Code.Section III, Article ND-7000, Paragraph ND-7110 of the ASME code required, in part, that individual components, which could be isolated from normal system overpressure protection, shall be reviewed to determine whether additional individual overpressure was necessary.

Contrary to the above, the licensee did not properly evaluate and therefore, did not provide overpressure devices or positive administrative controls for a heat exchanger served by SX. Specifically, administrative controls were not effective in preventing an overpressure event due to normally isolated SX flow to the U0 CC heat exchanger. The licensee initiated corrective actions to strengthen the administrative controls to prevent recurrence. Because this violation was of very low safety significance and it was entered into the licensees corrective action program (IR 00296093), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000454/2005002-04; NCV 05000455/2005002-04).

b3. Non-Safety Related Thermostats Used for Auxiliary Feedwater Pump Rooms

Introduction:

The inspectors identified a Non-Cited Violation of 10 CFR 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for using a non-safety thermostat to control a safety related flow control valve.

Description:

The Auxiliary Feedwater (AFW) pump room coolers which received cooling water from the SX system, were designed to maintain the temperature in the diesel-driven AFW pump rooms. Room cooling had a safety function since the qualification of some components in the room required temperatures to be below their environmental qualification limits. Flow through the room coolers was controlled through the air-operated flow control valve 1/2SX168 located at the discharge of the cooler.

The inspectors identified that the thermostats controlling these valves were not safety related. The licensee stated that in the original design, a loss of instrument air was considered the limiting condition and that since instrument air was not safety related, the thermostats did not need to be safety related. On a loss of instrument air, the valves would fail open. However, the inspectors surmised that the thermostat could fail in such a way that the valves would close, thus isolating cooling water to the room coolers.

Under these circumstances, the temperature in the room would increase above the environmental qualification limits.

The licensee performed an operability determination and based on engineering judgment, concluded that the valves were operable.

In addition, the inspectors noted that although these valves were required to open to fulfill its safety function, the valves were classified as passive in the UFSAR. The licensee initiated AR 002999058 to resolve this discrepancy.

Analysis:

The inspectors determined that the failure to assess the impact of the non-safety related thermostats was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports. The inspectors determined that the finding was more than minor because it involved design control attributes of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability and reliability of the AFW system. Specifically, failing to ensure proper room cooling could impact the function of temperature sensitive equipment and could result in inoperability of a diesel driven AFW pump.

The inspectors evaluated this finding using IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At Power Situations, Phase 1 screening and determined that the use of a non-safety related thermostat was a design issue which did not result in loss of function per GL 91-18; therefore, this finding was of very low safety significance (Green).

Enforcement:

Title 10 CFR 50 Appendix B, Criterion III states, in part, that measures shall be established for the selection and review for suitability of application of equipment that are essential to the safety-related function of components.

Contrary to the above, the licensee did not fully assess the suitability of using a non-safety related thermostat to control the position of the safety-related AFW room cooler flow control valves, 1/2SX168. In the design, the licensee considered only a loss of air event and did not consider events which would result in the valves closing. The licensee performed an operability determination and concluded the 1/2SX168 valves were operable. Because this violation was of very low safety significance and it was entered into the licensees corrective action program (IR 00300149), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy.

(NCV 05000454/2005002-05; NCV 05000455/2005002-05).

b4. Concerns with Single Failure Assumptions

Introduction:

The inspectors identified an unresolved item concerning single active failures assumptions in the licensees analysis for the service water system.

Description:

During review of the UFSAR and other design documents, the inspectors identified concerns with respect to the single active failures assumed in the licensees analysis for the service water system. The concerns are as follows:

• Cooling Tower Fans: The inspectors noted that in the Safety Evaluation for TS Amendment 95, the most limiting single active failure is the loss of a cooling tower fan. This was based on the fact that the feed breakers for the service water cooling tower fans did not automatically open on a loss of offsite power load sequence. Therefore, it was believed that the breaker remained in its safe position for the accident and the failure of this breaker was not postulated.

Failures of active breakers or switches in the 4160V service water cooling tower bus (bus 131Z, for example) would only result in a single fan failing. During a walkdown, the inspectors notes that a 480 Vac feed breaker between the 4160/480 Vac transformer and bus 131Z had not been addressed in the correspondences associated with Amendment 95. The inspectors noted that the failure of this breaker could de-energize a bus that supplied two cooling tower fans; thus, making possible a single active failure impacting two cooling tower fans, not one. A similar breakers existed in the other division as well as in Unit 2.

• Cooling Water Bypass Valve: The inspectors noted that Table 9.2-16 in the UFSAR stated that with one service water cooling tower hot water bypass valve (valves 0SX162 A-D) unable to close, the remaining available cooling tower rise flow would provide adequate cooling of the essential service water. The licensee provided calculation NED-M-MSD-11 to support this statement. The calculation assumed winter conditions (loads) because when service water temperature is greater than 74 degrees Fahrenheit, the licensee closes the service water cooling tower hot water bypass valves. Therefore, a failure to close a bypass valve during summer months was not considered an active failure and therefore, not analyzed. However, the inspectors noted that the 480 Vac feed breakers described above each provided power to one of the bypass valves. A failure of the 480 Vac breaker could result in an inadvertent opening of a bypass valve which would impact the towers capacity to remove heat. Therefore, the licensee did not have an analysis to demonstrate the capability to remove heat under these conditions assuming summer loads.

These concerns are considered an unresolved item (URI 05000454/2005002-06; URI 05000455/2005002-06) pending a determination on whether the loss of the 480 feed breaker should have been considered as the single failure.

b5. Discrepancies with Tornado Analysis

Introduction:

The inspectors identified an unresolved item concerning the ability for the service water system to perform its safety function during a tornado.

Description:

The inspectors identified a discrepancy with respect to the design basis.

Specifically, sections 3.5.4.1 and 9.2.5.3.2 describe the capability of the service water cooling towers to support shutdown loads for both units with diesel cooling loads and with no fans available due to tornado missile damage susceptibility. Under these conditions, the projected service water temperature will not exceed 110 degrees Fahrenheit. Although this would exceed the normal maximum temperature of 100 degrees Fahrenheit, the licensee concluded that there would be no adverse impact on safety related equipment. The inspectors reviewed the analysis and noted that the assumed total heat load was 150x106 BTU/hr instead of the current value of 485x106 BTU/hr (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after shutdown). With this higher heat load, the maximum temperature (assuming tornado damage to all eight service water cooling tower fans) could be greater than 110 degrees Fahrenheit if the current heat load was assumed.

The licensee determined that the analysis was not been updated to reflect changes to heat loads made during design basis reconstitution activities in the 1990s. In addition, section 9.2.5.3.1 stated that section 9.2.5.3.2 presented the analysis for a more severe tornado than the design basis tornado. This section also stated that the design basis for the ultimate heat sink was a loss of coolant accident concurrent with a loss of offsite power on one unit and concurrent orderly shutdown of the other unit with a single active failure. Reference to a tornado missile event were deleted. Therefore, the analysis and description in section 9.2.5.3.2 was beyond design basis. The inspectors noted that position C.2 of Regulatory Guide 1.27 required licensee to mitigate the effects of the most severe natural phenomena expected.

This issue is considered an unresolved item (URI 05000454/2005002-07; URI 05000455/2005002-07) pending receipt of clarification of the design basis with respect to tornados.

.3 Components

a. Inspection Scope

The inspectors examined the Essential Service Water and the Vital 4160V Auxiliary Power systems to ensure that component level attributes were satisfied. Power systems reviewed: Component Degradation. The inspectors reviewed component records and schedules to verify that potential degradation was monitored or prevented, that component replacement is monitored consistent with inservice/equipment qualification life, and that the numbers of cycles (when applicable) are appropriately tracked for operating cycle sensitive components.

Equipment/Environmental Qualification: Inspection of this attribute verified that the components were qualified to operate under the environment in which they were expected to be subjected under normal and accident conditions. The inspectors reviewed design information, specifications, and documentation to ensure that these system components were qualified to operate within the temperatures and radiation fields specified in the environmental qualification documentation.

Equipment Protection: Inspection of this attribute verified that the Essential Service Water and the Vital 4160V Auxiliary Power system components were adequately protected from natural phenomenon and other hazards, such as high energy line breaks, floods, or missiles. The inspectors reviewed design information, specifications, and documentation to ensure that the Essential Service Water and the Vital 4160V Auxiliary Power system components were adequately protected from the hazards identified in the UFSAR which could impact their ability to perform safety related functions.

Component Inputs/Outputs: Inspection of this attribute verified that the Essential Service Water and the Vital 4160V Auxiliary Power system component inputs and outputs were suitable for application and would be acceptable under accident/event conditions.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

Routine Review of Identification and Resolution of Problems

a. Inspection Scope

The inspectors reviewed corrective action reports written on the AP and SX systems and components selected for the inspection. During this inspection, 39 condition reports were reviewed on licensee-identified problems prior to the inspection, and 26 condition reports were written on issues identified during this inspection. The corrective action documents reviewed are listed in the Attachment.

b. Findings

No findings of significance were identified.

4OA6 Meetings

.1 Exit Meeting

The inspectors presented the inspection results to Mr. Kuczynski and other members of licensee management at the conclusion of the inspection on February 11, 2005. The inspectors noted that no materials examined or items discussed during the inspection were identified as proprietary and requested identification of any proprietary information if discovered during the exit discussions. No proprietary information was identified.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

S. Kuczynski, Site Vice President

B. Adams, Engineering Manager

E. Blondin, Mechanical Design Manager

D. Chrzanowski, Corporate Licensing

T. Fluck, Regulatory Assurance

B. Grundmann, Regulatory Assurance Manager

D. Hoots, Plant Manager

M. Justice, 4160V Auxiliary Power Systems Engineer

P. Knarr, Nuclear Oversite Manager

R. Randels, Engineering Design Manager

M. Robinson, Essential Service Water Systems Engineer

S. Stimac, Operations Director

J. Strasser, Electrical Design Engineer

Nuclear Regulatory Commission

R. Skokowski, Senior Resident Inspector

C. Pederson, Director, Division of Reactor Safety

A. M. Stone, Chief, Engineering Branch 2

Attachment

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000454/2005002-06; URI Concerns with Single Failure Assumptions

05000455/2005002-06

05000454/2005002-07; URI Discrepancies with Tornado Analysis

05000455/2005002-07

Opened and Closed

05000454/2005002-01; NCV Failure to Properly Review and Make Procedure

05000455/2005002-01 Changes

05000454/2005002-02; NCV Inadequate River Screen House (RSH) Ventilation

05000455/2005002-02 Calculation

05000454/2005002-03; NCV Inadequate Acceptance Criteria for Flow Test

05000455/2005002-03

05000454/2005002-04; NCV Lack of Heat Exchanger Over Pressure Protection

05000455/2005002-04

05000454/2005002-05; NCV Non-Safety Related Thermostats Used for Auxiliary Feed

05000455/2005002-05 Water Pump Room Coolers

Discussed

None