IR 05000341/2005016

IR 05000341-05-016(DRS); 11/14/2005 - 12/02/2005; Fermi Power Plant, Unit 2; Safety System Design and Performance Capability

ML060200574
Person / Time
Site:	Fermi
Issue date:	01/13/2006
From:	Ann Marie Stone NRC/RGN-III/DRS/EB2
To:	Cobb D Detroit Edison
References
IR-05-016
Download: ML060200574 (40)

Text

ary 13, 2006

SUBJECT:

FERMI POWER PLANT, UNIT 2 NRC BIENNIAL SAFETY SYSTEM DESIGN AND PERFORMANCE CAPABILITY INSPECTION REPORT 05000341/2005016

Dear Mr. Cobb:

On December 2, 2005, the U.S. Nuclear Regulatory Commission (NRC) completed a baseline inspection at your Fermi Power Plant, Unit 2. The enclosed report documents the results of this inspection discussed on December 2, 2005, with Mr. William OConnor, Jr. and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and to compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, performed walkdowns of equipment, observed activities, and interviewed personnel. This inspection specifically focused on the Reactor Core Isolation Cooling System and the Emergency Diesel Generators and associated support systems.

Based on the results of this inspection, three NRC-identified findings of very low safety significance were identified, which involved violations of NRC requirements. However, because these violations were of very low safety significance and because they were entered into your corrective action program, the NRC is treating the issues as Non-Cited Violations in accordance with Section VI.A.1 of the NRCs Enforcement Policy.

If you contest the subject or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S.

Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission -

Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspectors Office at the Fermi 2 facility.

D. Cobb. -2-In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Ann Marie Stone, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-341 License No. NPF-43 Enclosure: Inspection Report 05000341/2005016 w/Attachment: Supplemental Information cc w/encl: N. Peterson, Manager, Nuclear Licensing D. Pettinari, Legal Department Compliance Supervisor G. White, Michigan Public Service Commission L. Brandon, Michigan Department of Environmental Quality -

Waste and Hazardous Materials Division Monroe County, Emergency Management Division Planning Manager, Emergency Management Division MI Department of State Police

SUMMARY OF FINDINGS

IR 05000341/2005016(DRS); 11/14/2005 - 12/02/2005; Fermi Power Plant, Unit 2; Safety

System Design and Performance Capability.

The inspection consisted of a review of the Safety System Design and Performance Capability (SSDPC) of the Reactor Core Isolation Cooling System and the Emergency Diesel Generators and associated support systems. The inspection was conducted by regional engineering inspectors. Three Green Non-Cited Violations, and three Unresolved Items (URIs) were identified. The significance of most findings is indicated by their color, (Green, White, Yellow,

Red), using Inspection Manual Chapter 0609, Significance Determination Process (SDP).

Findings for which the SDP does not apply may be Green, or assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 3, dated July 2000.

A. Inspector-Identified and Self-Revealed Findings

Cornerstone: Mitigating Systems

Green.

The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to consider the effects of frequency variation on diesel generator loading. Specifically, the licensees diesel generator loading calculations failed to account for increased loading that could result from allowable frequency variations above the nominal generator frequency of 60 Hz.

The licensees corrective action was to evaluate the need for revised margin in the calculation due to frequency variations.

This issue was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a DB accident by failing to assure that the diesel generators would not inadvertently become overloaded. This finding was of very low safety significance because it screened out as Green using the SDP Phase 1 worksheet. (Section 1R21.2.b.1)

Green.

The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to translate the design basis requirements for each of the Emergency Diesel Generator starting air systems into specifications, procedures, and instructions. As a result of this failure, no objective evidence existed that the required emergency diesel generator starting air system capacity was being maintained. The licensees corrective actions were to develop a formal calculation to document the acceptability of the Technical Specifications limit for the air capacity and to implement changes to the diesel starting air system and check valve testing, the process computer alarm setpoint, and the alarm response procedures.

This issue was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a DB accident by failing to assure that the degradation of the capability of the diesel starting air system would be detected. This finding was of very low safety significance because it screened out as Green using the SDP Phase 1 worksheet.

(Section 1R21.2.b.2)

Green.

The inspectors identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for the licensees failure to establish the correct condensate storage tank temperature limit for use in the plant accident analyses and net positive suction head calculations and for the failure to translate the condensate storage tank temperature limit into plant procedures to ensure that temperature limits are not exceeded. The licensees corrective action was the implementation of a tentative maximum condensate storage tank temperature limit and an analysis to demonstrate that there was adequate margin in the accident analysis.

This issue was more than minor because it affected the Mitigating Systems Cornerstone objective of ensuring the reliability of Reactor Core Isolation Cooling, High Pressure Coolant Injection, and the Core Spray Systems because the failure to establish a temperature limit had the potential to reduce the margin of safety that the licensee believed to be available as a result of calculations. The finding was of very low safety significance because it screened out as Green using the SDP Phase 1 worksheet.

(Section 1R21.2.b.3)

Licensee-Identified Violations

No findings of significance were identified.

REPORT DETAILS

1R21 Safety System Design and Performance Capability

Inspection of safety system design and performance capability (SSDPC) verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected systems to perform design basis functions. As plants age, the design basis may be lost and important design features may be altered or disabled. The plant risk assessment model is based on the capability of the as-built safety system to perform the intended safety functions successfully. This inspectable area verifies aspects of the Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

The objective of the SSDPC inspection is to assess the adequacy of calculations, analyses, other engineering documents, and operational and testing practices that were used to support the performance of the selected systems during normal, abnormal, and accident conditions. Specific documents reviewed during the inspection are listed in the attachment to the report.

The systems selected for inspection were the Reactor Core Isolation Cooling System (RCIC), the Emergency Diesel Generators (EDGs), and associated support systems.

These systems were selected for review based upon the following criteria:

• having high probabilistic risk analysis rankings;

• having design basis overlap; and

• not having received recent NRC review.

The criteria used to determine the acceptability of the systems performance was found in the following documents:

• licensee Technical Specifications (TS);

• applicable Updated Final Safety Analysis Report (UFSAR) sections; and

• the systems' design documents.

.1 System Requirements

a. Inspection Scope

The inspectors reviewed the UFSAR, TS, system design basis documents, system descriptions, drawings, and other available design basis information, to determine the performance requirements of the RCIC system and the EDGs and associated support systems. The reviewed systems attributes included process medium, energy sources, control systems, operator actions, and heat removal. The rationale for reviewing each of the attributes was:

Process Medium: This attribute required review to ensure that the RCIC system was capable of providing cooling during Design basis events. The inspectors reviewed the net positive suction head calculations and verified alternate water source capacity. For the Emergency Diesel Generators and associated support systems, the inspectors verified the EDGs were capable of providing emergency power during Design basis events through review of design calculations.

Energy Sources: This attribute required review to ensure that the power source for major electrical equipment in the RCIC system was adequate for the proper functioning of the valves and other components. For the Emergency Diesel Generators and associated support systems, this attribute was reviewed by verifying power to required equipment. This review concentrated on EDG loading and reliability and battery sizing.

Controls: This attribute required review to ensure that required instrumentation calculations and surveillances for the RCIC and EDG systems were adequate. For both systems, the controls necessary for implementation of the necessary operating procedures and the swap over function of the condensate storage tank (CST) to the Torus upon low inventory of the CST were also reviewed.

Heat Removal: This attribute required a detailed review of the heat removal systems associated with the RCIC and EDG systems. The inspectors reviewed room cooling, lube oil cooling, and service water flow calculations.

b. Findings

No significant findings were identified. Two unresolved items (URIs) were identified.

b.1 Capability of RHR Complex Structure and Components to Withstand a Tornado

Introduction:

The inspectors identified an Unresolved Item involving the lack of analyses to demonstrate the capability of the Residual Heat Removal (RHR) Complex structure and its enclosed components to withstand a tornado. This issue is unresolved, pending further review of Fermis licensing basis by the NRC.

Description:

The licensee was not able to provide an analysis or other documentation to demonstrate that the RHR Complex and its enclosed components were capable of withstanding the depressurization effects that could occur if a tornado passed directly over the building. The RHR Complex enclosed the EDGs, the EDG support systems, and ventilation systems. Each of the four EDGs was located in a separate room within the RHR Complex and was equipped with a ventilation system consisting of two supply fans, automatic modulating intake dampers, and a gravity exhaust damper.

The inspectors postulated that a tornado could pass directly over the RHR Complex.

The intake dampers in each room would normally be closed when their associated EDG was not operating. If the EDG started (due to the tornado disabling offsite power), the intake dampers would remain closed, and the system would operate in a recirculation mode until the room temperature reached a predetermined level, at which time the intake dampers would fully or partially open. The gravity exhaust dampers appeared to provide an effective one way path for air to escape from the EDG rooms when the depressurization zone of a tornado would pass over the RHR Complex, thereby equalizing the air pressure inside the EDG rooms with the lower outside pressure.

However, when the tornado depressurization zone would pass by the RHR Complex, the outside air pressure would be higher than the reduced pressure inside the diesel generator rooms, thereby closing the gravity exhaust dampers. The inspectors postulated that this phenomenon could result in a maximum pressure differential of 3 psid between the normal outside atmospheric pressure and the reduced inside atmospheric pressure. This differential pressure could develop across both the ventilation system intake and exhaust dampers as well as across the building structural components such as the roof.

The inspectors were concerned that the EDG support systems or the structure that enclosed the EDGs could be damaged as follows:

• First, the intake and exhaust dampers could be damaged and jammed so that they would not be able to perform their function when the EDGs started. The licensee indicated that the ventilation dampers were rated for approximately 6@ of water plus seismic loads which were not specified. The approximately 3 psid postulated by the inspectors equated to 83@ of water, which was considerably greater than the damper ratings.

• Second, the differential pressure across the roof would have added to the weight of the roof. The licensee was not able to demonstrate that this phenomenon had been analyzed.

• Finally, un-vented enclosures within the diesel rooms such as Motor Control Centers could be subjected to substantial forces due to the reduced ambient pressure within the rooms and the normal atmospheric pressure within the enclosures. The differential pressure could cause deformation of the enclosures, failed fasteners, and generation of missiles, which could degrade the enclosed equipment and other nearby equipment.

This issue was entered into the licensees corrective action program as Condition Assessment Resolution Document (CARD) 05-26492 on November 17, 2005. The licensees original corrective action was to perform a detailed analysis of the postulated tornado event to support the licensees assertion that the RHR Complex was capable of withstanding the effects of a tornado. On December 15, 2005, the licensee updated this CARD to stop the development of this analysis. The licensee stated in the CARD that the specific issue of individual components located within the RHR Complex withstanding the effects of a tornado was not within Fermi 2's current licensing basis, and therefore, the calculation was not required.

The licensee stated in CARD 05-26492 that Tornado design basis requirements were limited to the effect ... on safety related structures and the protection from tornado missile effects. Building internals are not subject to direct tornado differential pressure loading design and are protected by virtue of being housed within the Category I Structures. Section 2.3.1.3.2.2 of the Fermi 2 UFSAR stated, Category I structures housing the systems required for a safe shutdown of the plant in the event of a tornado are designed to withstand the effects of a tornado by providing either sufficiently strong structures or appropriate venting. The design parameters of the Fermi 2 design basis tornado are: a) a rotational wind velocity of 300 mph, b) a translational wind velocity of 60 mph, c) an external pressure drop of 3 psi at the rate of 1 psi/sec.

The inspectors believed that an analyses to demonstrate that the RHR Complex structure, its ventilation systems and diesel generator support equipment would remain operable following the depressurization effects of a design basis tornado was necessary.

The inspectors noted that concerns similar to those raised at the Fermi station had been recently raised at another nuclear station and were currently under review by the NRC for generic applicability. This issue is considered an unresolved item pending further review of Fermi 2's licensing basis by the NRC. (URI 05000341/2005016-01)b.2 Potential Bypass of Secondary Containment via CST

Introduction:

The inspectors identified an Unresolved Item concerning a potential radioactive release path via the CST following a loss of coolant accident (LOCA). This issue is unresolved pending clarification of the design basis with respect to the secondary containment bypass.

Description:

The CST and the suppression pool serve as suction sources for the RCIC system. In standby condition, the system is normally aligned to the CST through a check valve E5150F011 (F011) and normally open motor operated valve (MOV) E5150F010 (F010). When the level in the CST decreases to a predetermined setpoint or when the level in the suppression pool increases to a predetermined setpoint, the suction path switches to the suppression pool as the normally closed MOVs E5150F029 (F029) and E5150F031 (F031) open and MOV F010 closes.

The HPCI system functions in a similar manner with CST suction check valve E4150F019 (F019) and normally open MOV E4150F004 (F004) and the suppression pool suction valves, normally closed MOVs E4150F041(F041) and E4150F042 (F042).

The inspectors were concerned that the licensee did not leak test the CST suction or the suppression pool suction valves. The inspectors postulated that following a design basis LOCA and a range of intermediate break LOCAs, the pressure differential between the suppression pool and CST could cause potentially contaminated, radioactive water to be transferred from the suppression pool to the CST through the MOVs and check valves.

The inspectors noted that the minimum (protected) CST level was approximately 592 feet, and the nominal suppression pool level was 557 feet. Under these circumstances, the CST could have a hydraulic overpressure of approximately 35 feet (592 feet minus 557 feet) or 15.14 psid over the nominal suppression pool level. The inspectors postulated that during an accident condition, the suppression pool level would rise due to a spill from the reactor coolant system break as the CST level decreases until the suction path is transfered to the suppression pool. This would result in a higher differential pressure (greater than 15.14 psid) between the suppression pool and CST.

The inspectors noted that UFSAR Figure 6.2-11 illustrated a primary containment pressure response following a design basis LOCA. The graphical representation of data on this figure ended at approximately 6x104 seconds (16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> and 40 minutes). The corresponding suppression pool (wetwell airspace) pressure at that time was approximately 18 psig. Because the licensee did not leak test the F011/MOV F010 and F019/MOV F004 pathways, the potential for leakage across these valves existed.

Therefore, the increased pressure difference postulated during an accident scenario could result in the transfer of contaminated, radioactive water from the suppression pool to the CST. The radioactive iodine and other radioactive gases could come out of solution (Daltons Law) once the solution reaches the CST, and escape into the environment. The amount of transfer and subsequent release would depend on an actual valve leakage and pressure differential. The release of radioactivity out of the CST could be outside of the current 10 CFR Part 100 and General Design Criteria 19 requirements. It should be noted that a failure of MOVs F010 and F004 to close could result in higher releases.

The licensee documented this issue as CARD 05-26699. The licensee believed that the secondary containment bypass leakage postulated in the above scenario was not part of plant design and licensing basis. The licensee based this position in part on the response to the Three Mile Island Question H.III.1.1.1, which stated that the CST was identified as isolated from highly contaminated systems. The licensee also stated that the plant design and licensing basis assumed ECCS liquid leakage occurred within the secondary containment boundary and was limited to a rate of 5 gpm. Furthermore, UFSAR Section 6.2.1.2.2.3 identified that the HPCI and RCIC CST suction lines were excluded as bypass leakage paths on the basis that they were sealed with water. The seal water is assumed to be the water in the HPCI and RCIC piping and in the CST. The inspectors concluded that the CST would be isolated from contaminated sources if the valves in question were shown to be leak-tight. Because this has not been demonstrated, the inspectors believed that licensee may not be meeting their licensing and design basis. Therefore, this issue is considered an unresolved item pending receipt of clarification of the design basis with respect to the secondary containment bypass. (URI 05000341/2005016-02)

.2 System Condition and Capability

a. Inspection Scope

The inspectors reviewed design basis documents, plant drawings, abnormal and emergency operating procedures, requirements, and commitments identified in the UFSAR and TS. The inspectors compared the information in these documents to applicable plant modifications and electrical, instrumentation and control, and mechanical calculations. The inspectors used applicable industry standards, such as the American Society of Mechanical Engineers (ASME) Code and the Institute of Electrical and Electronics Engineers, to evaluate acceptability of the systems design. Select operating experience was reviewed to ensure issues were adequately evaluated and corrective actions were implemented, as necessary. The inspectors also reviewed operational procedures to verify that instructions to operators were consistent with design assumptions.

The inspectors reviewed information to verify that actual system condition and tested capability were consistent with the identified design basis. Specifically, the inspectors reviewed the installed configuration, system operation, detailed design, and system testing, as described below.

Installed Configuration: This attribute required detailed system walkdowns of the installed configuration of the RCIC System and the EDGs and associated support systems and their components necessary to perform the Normal Operating Procedures (NOPs) and Emergency Operating Procedures (EOPs). The walkdowns focused on the configuration of piping, components, and instruments as well as the environmental conditions in the areas and the potential vulnerabilities in regard to flooding and seismic events. The walkdowns also verified the installed configuration of components with design and licensing bases assumptions and design input values.

Operation: The inspectors verified that the RCIC system and the EDGs and associated support systems were consistent with design and licensing basis documents.

Additionally, the inspectors verified that these design and license basis attributes were translated properly into the plants operating procedures and EOPs.

Design: The inspectors reviewed the mechanical and electrical design of the RCIC System and the EDGs and associated support systems during design basis events to verify that the systems and subsystems would function as required. This included a review of the design basis, license basis, design assumptions, calculations, boundary conditions, and a review of selected modification packages.

Testing: The inspectors reviewed records of selected periodic testing and calibration procedures as well as surveillance procedures to verify that the design requirements of calculations, drawings, and procedures were incorporated in the system and were adequately demonstrated by test results. Test results were also reviewed to ensure that testing was consistent with design basis information.

b. Findings

Three findings of very low safety significance and one Unresolved Item were identified.

b.1 Non Conservative Calculation for Diesel Generator Loading

Introduction:

The inspectors identified a finding involving a Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for the licensees failure to consider the effects of frequency variation on diesel generator loading. Specifically, the licensees diesel generator loading calculations failed to account for increased loading that could result from allowable frequency variations above the nominal generator frequency of 60 Hz.

Description:

The Surveillance test acceptance criteria given in Technical Specification 3.8.1 allowed diesel generator frequency to vary from its nominal value of 60 Hz by +/-1.2 Hz (approximately 2 percent). This variance could cause the rotational speed of the connected induction motors to increase by approximately the same value (2 percent).

Affinity laws for rotating equipment such as centrifugal pumps and fans showed that the equipment would do more work and consume more power as their rotational speeds increased. For instance, the hydraulic output power of a centrifugal pump would vary by the cube of its speed so that a 2 percent increase in speed would result in an approximately 8 percent increase in power consumed. The diesel generator loading during an emergency consisted predominantly of induction motors that could have increased speed as a result of frequency variations, and therefore could consume more power than the nominal values calculated at 60 Hz.

The Fermi Updated Final Safety Analysis Report (UFSAR) Section 8.3.1.1.8.3 stated, in part, For all conditions calculated, the loads are within the short-time rating of the diesel generator in compliance with paragraph C.2 of Regulatory Guide 1.9, Revision 2. The short time (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) rating of the diesel generators was given as 3135 kiloWatts (kW) in Fermi Design Calculation DC-5003, Emergency Diesel Generator Loads Calculation, which calculated diesel generator loading. The inspectors noted that the automatically applied loads during the first ten minutes of an accident for Diesel Generator 14 were calculated to be 3133 kW versus the acceptance criteria of 3135 kW. The calculation had not considered additional loading that could result from frequency variations. Since there was only a 2 kW margin between the calculated and the permissible loading, the inspectors were concerned that allowable variations in frequency could cause inadvertent overloading of the diesels during an emergency. The inspectors noted, however, that recent surveillance test results showed diesel generator frequency was generally very close to the nominal value of 60 Hz, so that this did not present an immediate operability concern. The licensee entered this issue into their corrective action program as CARD 05-26681 to evaluate the need for revised margin in the calculation due to frequency variations.

Analysis:

The inspectors concluded that the failure to perform adequate calculations to demonstrate that the diesel generators operated within their required ratings was a performance deficiency warranting a significance evaluation. This finding was considered more than minor in accordance with Inspection Manual Chapter (IMC) 0612, Power Reactor Inspection Reports because it affected the Mitigating System Cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a design basis accident. The licensee failed to assure that the diesel generators would not inadvertently become overloaded as a result of not considering the effects of frequency variation on diesel generator loading. In accordance with IMC 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, Attachment 1, the inspectors performed an SDP Phase 1 screening by answering the questions in the Mitigating Systems Cornerstone Column.

The inspectors determined that the finding was a design deficiency that was confirmed not to result in a loss of operability per Part 9900, Technical Guidance, Operability Determination: Process for Operability and Functional Assessment. Therefore, the finding was determined to be of very low safety significance (Green).

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control requires that measures shall provide for verifying or checking the adequacy of design. Technical Specification 3.8.1 stated that the steady state frequency for the EDGs shall be between 58.89 Hz and 61.2 Hz. Contrary to this requirement, the licensees calculations did not adequately verify or check the adequacy of diesel generator loading within the TS 3.8.1 limits. Specifically, calculation DC-5003 did not account for variations in diesel generator frequency that could cause loading in excess of the ratings of the diesel engines. Since this finding is of very low safety significance and was entered into the licensees corrective action program as CARD 05-26681, it is considered a NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000341/2005016-03)b.2 Adequate Leakage Criterion Not Established for the EDG Air Start System

Introduction:

The inspectors identified a finding involving a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for the licensees failure to translate the design basis requirements for each of the Emergency Diesel Generator starting air systems into specifications, procedures, and instructions. Specifically, the licensee did not provide objective evidence that the required emergency diesel generator EDG starting air system capacity was being maintained without the aid of the air compressors.

Description:

The inspectors reviewed the surveillance tests for the EDG air start system (Procedure 24.307.34/35/36/37; DGSW, DFOT and Starting Air Operability Test -

EDG 11/12/13/14) and identified the following concerns:

1) The surveillance test measured the leakage of the check valve, which was the in-service test (IST) program requirement. The acceptance criterion required a final pressure in the accumulator to be equal to or greater than the TS surveillance 3.8.3.3 required value of 215 psig after about one minute following closure of the compressor control cutoff valves and compressor venting. The inspectors reviewed 19 completed surveillances and determined that in some cases, the accumulator pressure prior to isolation was as high as 255 psig.

Therefore, a large leak rate of 40 psid per minute or over 15 percent per minute of pressure decay would result in a satisfactory test result of the IST check valve.

The inspectors noted that TS Bases for the SR 3.8.3.3 stated, this surveillance

[verifying tank pressure is greater than 215 psig] ensures that, without the aid of the refill compressor, sufficient air start capacity for each EDG is available. The system design requirements provide for a minimum of five engine start cycles without recharging. The pressure specified in this SR is intended to reflect the lowest value at which the five starts can be accomplished. Although the surveillance test verifies pressure is greater than 215 psig, the inspectors determined that the test does not demonstrate that the air receivers are capable of holding that pressure without the aid of the compressors as stated in the TS bases.

2) In 2004, this surveillance procedure was modified to add a requirement to initiate a CARD if the pressure drop exceeded 10 psid. This pressure drop, however, was not an IST requirement nor a condition to fail the surveillance. Depending on the starting pressure of the tank, a pressure drop of 10 psid would result in EDG inoperability within a few seconds; however, this condition would result in a successful surveillance.

3) During the surveillance test, the normally open valve from each air receiver to a common shuttle valve on the compressor was isolated. The tubing downstream of the normally open valve and the remaining pressure retaining components were non-safety related. By closing this normally open valve, air leakage from the non-safety related pressure retaining components was not monitored.

4) The accumulator pressure low-pressure alarm had a nominal set point of 220 psig. The alarm response procedure for this alarm (ARP 1A13-RHR, Starting Air Pressure Low) required the operators to start or verify that the air compressor was running. With a large leak, the pressure in the system would likely drop below the TS requirement prior to operator actions. In addition, depending on the time required to respond to this alarm and the actual leakage rate, the accumulator pressure could be lower than the minimum pressure required for a single start.

The licensee entered the above concerns into the licensees corrective action program as CARD 05-26451. The licensees corrective actions included changes to:

(a) the EDG starting air system and check valve testing,

(b) the process computer alarm set point, and

(c) alarm response procedures.

Analysis:

The inspectors concluded that the failure to establish adequate acceptance criterion for the system surveillance was a performance deficiency. This finding was considered more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, because the finding could have affected the Mitigating System Cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a design basis accident. Specifically, undetected degradation of the air receiver check could effected the starting capability of the EDGs.

In accordance with IMC 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, the inspectors performed an SDP Phase 1 screening by answering the questions in the Mitigating Systems Cornerstone Column.

The inspectors determined that the EDGs remained operable because air receiver pressure was greater than the minimum TS requirement; therefore answered no to the five questions presented in the SDP worksheet. In addition, the inspectors could not postulate a credible scenario that could remove all 4 air starting compressors without a simultaneous start signal to the EDGs. Therefore, the finding was determined to be of very low safety significance (Green).

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, Design Control states, in part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, the acceptance criteria for air receiver check valve leakage as stated in procedure 24.307.34/35/36/37; DGSW, DFOT and Starting Air Operability Test-EDG 11/12/13/14 was inadequate as it did not demonstrate that the required emergency diesel generator EDG starting air system capacity was being maintained without the aid of the air compressors. Because this finding is of very low safety significance and was entered into the licensees corrective action program as CARDs 05-26451 and 05-26642, it is considered an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000341/2005016-04)b.3 Failure to Translate CST Temperature Limit into Design Documents and Procedures

Introduction:

The inspectors identified a finding of very low safety significance involving a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance for the licensees failure to establish the correct CST temperature limit for use in the plant accident analyses and net positive suction head (NPSH) calculations and for the failure to translate this CST temperature into plant procedures to ensure that the temperature limit was not exceeded.

Description:

During the inspection, the inspectors noted that although the CST temperature was monitored on operator logs, the licensee had not established a maximum temperature limit for the CST. The licensee assumed a CST temperature limit of 100 °F in their NPSH calculations. However, the inspectors noted that during the summer months, the CST temperature could be as high as 120 °F, due to recirculation of hotwell water.

Based on inspectors concerns, the license issued CARD 05-26671 and also instituted a tentative maximum CST temperature limit of 120°F, which was the maximum design temperature for the CST structure. The licensee did an analysis to demonstrate that there was adequate margin in the accident analysis to keep the water above the top of the nuclear fuel at the higher CST temperature with a RCIC pump meeting its required water injection flow of 600 gallons per minute at 50 seconds.

The inspectors reviewed the input parameters to the NPSH calculation for the RCIC pump and determined that because of conservatism in other aspects of the calculation, the RCIC pumps would still have adequate NPSH to remain operable. The licensee had not completed an extent-of-condition review of all calculations, drawings, and inputs to the accident analyses assuming a new 120 °F temperature limit. On initial review, there appeared to be sufficient margins; however, these calculations would need to be revised for the new temperature limitation.

Analysis:

The inspectors determined the failure to use the correct CST temperature in the plant accident analysis and NPSH calculations and the failure to translate the CST temperature limit into the station procedures was a performance deficiency warranting a significance evaluation. This issue was more than minor because it was associated with the Mitigating Systems Cornerstone attribute of Equipment Performance and affected the cornerstone objective of ensuring the reliability of the RCIC, HPCI, and Core Spray Systems. Specifically the inspectors determined that a higher initial CST temperature could lead to an increase in the suppression pool temperature, and a reduced NPSH for the RCIC, HPCI, and Core Spray Pumps. The failure to establish a temperature limit had the potential to reduce the margin of safety that the licensee believed to be available as a result of calculations.

In accordance with IMC 0609, Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, the inspectors performed an SDP Phase 1 screening by answering the questions in the Mitigating Systems Cornerstone Column.

The inspectors determined that the finding was a design deficiency that was confirmed not to result in a loss of operability per Part 9900, Technical Guidance, Operability Determination: Process for Operability and Functional Assessment. There was significant margin in the accident analysis and NPSH to the pumps to account for the higher temperature in the CST. Therefore, the finding was determined to be of very low safety significance (Green).

Enforcement:

10 CFR Part 50 Appendix B, Criterion III, Design Control, requires, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions.

Contrary to the above, the licensee had neither established the correct CST temperature limit for use in the plant accident analyses and NPSH calculations nor translated the CST temperature limit into plant procedures. Because this finding is of very low safety significance and has been entered into the licensee's corrective action program, this finding is being treated as a non-cited violation consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000341/2005016-05).

b.4 Inadequate Time Delay for Degraded Voltage Relays

Introduction:

The inspectors identified an Unresolved Item regarding the adequacy of the time delay settings of the offsite power undervoltage relays. Specifically, the existing relay time delay settings were greater than the time allowed by the licensees 10 CFR 50.46 LOCA sequential loading analysis.

Description:

The inspectors reviewed the 4160V voltage system to assess vulnerabilities due to a potential loss of the preferred offsite source and the stand by onsite sources (emergency diesel generators). The inspectors evaluated the adequacy of the licensees undervoltage protection scheme. During this review, the inspectors questioned the adequacy of the time delay settings of the offsite power undervoltage relays. Technical Specifications Table 3.3.8.1-1, Loss of Power Instrumentation, listed the allowable values for the 4.16 kV emergency bus undervoltage (degraded voltage) relay time delays. These values were determined from Design Calculation DC-0919, Undervoltage Relay Setpoints, and were listed in the TS as follows:

Bus Undervoltage Values:

Division I: 3873.0 V and 4031.0 V Division II: 3873.0 V and 3776.0 V Time Delay Values:

Division I: 41.8 seconds and 46.2 seconds Division II: 20.33 seconds and 22.47 seconds The duration of the undervoltage relay time delays would last from the detection of a sustained degraded voltage condition until the vital busses were transferred from offsite power to the EDGs. The Division I time delays of 41.8 seconds and 46.2 seconds were intended to allow sufficient time to start two RHR pumps and two Core Spray pumps and to allow the automatic load tap changer on transformer S.S. #64 to sufficiently improve voltage to prevent separation from the offsite source. The Division II time delays of 20.33 seconds and 22.47 seconds were intended to allow sufficient time to start two RHR pumps and two Core Spray pumps without causing separation from the offsite source.

The inspectors were concerned that the existing time delays were longer than the time allowed by the licensees 10 CFR 50.46 LOCA analysis sequential loading time of

<13 seconds following receipt of a LOCA signal, as specified in Fermi 2 UFSAR Table 6.3-7.

Fermi 2 UFSAR Table 6.3-7, Operation Sequence for Emergency Core Cooling Systems For Design Basis Accident, listed the plant response (timing of the starting and loading of the EDGs and core cooling initiation) during the first ten minutes of a LOCA concurrent with a Loss of Offsite Power (LOOP). According to the Fermi 2 UFSAR, Section 8.3.1.1.8.1, On occurrence of a LOCA and on receipt of an automatic signal from the power plant relays, each unit [EDG] automatically fast-starts, comes to rated voltage and synchronous speed, and is capable of operating as an isolated source to start the loads sequentially.... If a loss of system power has occurred, the EDG is automatically connected to the bus. If bus voltage is normal, the EDG stands by at synchronous speed and rated voltage.

The inspectors postulated that a degraded voltage condition could exist concurrent with a LOCA Safety Injection Actuation Signal. The inspectors were concerned that if a degraded voltage condition existed concurrent with a LOCA, the voltage would be too low to power the ECCS equipment (motors) but high enough to prevent the EDGs from connecting to the safety-related buses. In addition, the undervoltage relay time delays would initiate which could delay the connection of the EDGs to the safety-related buses and thus delay low pressure core spray and coolant injection until the relay time delays timed-out (46.2 seconds for Division I and 22.47 seconds for Division II).

NRC Branch Technical Position PSB-1 Section B.1 stated that a second level of undervoltage protection should be provided with two separate time delays. Position B.1.b.1 required that the first time delay be of short duration (but longer than a motor starting transient) with a subsequent LOCA signal causing separation from the offsite source. The inspectors believed that in order to meet this requirement, the licensees degraded voltage scheme should have been capable of protecting safety-related equipment if a LOCA signal initiated at the same time that a degraded voltage condition existed. In addition, the inspectors reviewed an NRC letter dated June 2, 1977 (sent to all operating plants at that time) which stated that the allowable time delay for the degraded voltage protection scheme, including margin, shall not exceed the maximum time delay that is assumed in the UFSAR accident analysis.

The licensee was unable to demonstrate that during a LOCA concurrent with degraded voltage conditions, the 13-second time delay limit for the availability of power from the diesel generators could be met. During this delay, ECCS pumps may fail to start, and the MOVs may fail to move to their required positions, thus delaying water injection into the core. The licensee acknowledged the apparent discrepancy and initiated CARD 03-11847 to address the discrepancy. The resolution of CARD 03-11847 concluded that Fermi 2 was not committed to BTP PSB-1, Position B.1.b.1, citing various communications with the NRC. The inspectors did not note any exceptions to Position B.1.b.1 in these communications. NUREG-0798, issued on July, 1981, stated that the Fermi 2 undervoltage protection scheme meets the Position 1 requirements and is acceptable. The inspectors believe BTP PSB-1 and the June 2, 1977 letter established the requirement for the degraded voltage scheme to respond to a degraded voltage condition concurrent with a LOCA.

The inspectors determined that applying a potentially non-conservative acceptance limit for the time delay relay did not assure the availability of the vital buses required to respond to an accident. The undervoltage relay time delay setpoint requirements needed appropriate evaluations and resolution of the design and licensing basis to ensure compliance with 10 CFR 50, General Design Criterion 17. This issue was initially raised during the Fermi 2003 SSDPC and documented as URI 05000341/2003007-02. The 2003 URI was closed in Inspection Report 05000341/2004004 based on the inspectors judgment that the licensees planned corrective actions, as stated in CARD 03-11847 and which had not been implemented at the time of the inspectors follow-up activities, appeared to be adequate.

After reviewing additional information during this inspection, the inspectors concluded that the resolution to CARD 03-11847 was inadequate and that the issue should be reopened as a separate URI in this inspection report. This issue is considered an unresolved item pending further NRC review to determine whether Fermi 2 is in compliance with their licensing basis for degraded voltage protection as provided in Branch Technical Position PSB-1. (URI 05000341/2005016-06)

.3 Components

a. Inspection Scope

The inspectors examined the RCIC System and the EDGs and associated support systems to ensure that component level attributes were satisfied. The inspectors specifically focused on EDG loading, the EDG service water pump and check valve, and the EDG fuel oil pump. The inspectors also reviewed the RCIC pump and the RCIC min flow, discharge and lube oil cooler MOVs. Specifically, the inspectors reviewed component degradation, component inputs/outputs, equipment and environmental qualification, equipment protection, and operating experience as described below.

Component Degradation: This attribute was reviewed to ensure that components were being maintained consistent with the design basis. The inspectors reviewed RCIC surveillance tests to ensure that equipment degradation, if present, was within allowable limits. Additionally, the inspectors performed a selective review to determine if the licensee was performing inservice testing in accordance with applicable requirements. Selected testing of the EDGs was also reviewed. Maintenance history was also reviewed for various components to ensure that there was not excessive degradation present.

Component Inputs/Outputs: The inspectors reviewed selected components in the RCIC and the EDG systems to ensure proper operation and input assumptions. Additionally, the inspectors verified selected component operation to ensure that the expected output/operation was consistent with desired outcomes.

Equipment/Environmental Qualification: This attribute was reviewed to ensure that the equipment was qualified to operate under the environment in which it is expected to be subjected to under normal and accident conditions.

Equipment Protection: The inspectors reviewed design information, specifications, and documentation to ensure that the RCIC and the EDG systems were adequately protected from those hazards identified in the UFSAR which could impact their ability to perform their safety function. Additionally, the inspectors verified adequate heating ventilation and air conditioning and freeze protection.

Operating Experience: This attribute ensures that applicable industry and site operating experience has been considered and applied to the components or systems. To verify this attribute, the inspectors reviewed licensee evaluations of operating experience including regulatory operability evaluations (OEs) and site OE (Corrective action documents and maintenance history) to ensure that the licensee had appropriately applied applicable insights to the systems and components reviewed.

b. Findings

No findings of significance were identified.

4OA2 Problem Identification and Resolution

Review of Condition Reports

a. Inspection Scope

The inspectors reviewed a sample of RCIC System and the EDGs and associated support systems that were identified by the licensee and entered into the corrective action program.

The inspectors reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions related to design issues. In addition, issue reports written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action program. The specific corrective action documents that were sampled and reviewed by the inspectors are listed in the attachment to this report.

b. Findings

No findings of significance were identified.

4OA5 Other Activities

Closed: (URI 05000341/2005014-02) Evaluation of EDG 12 High Bearing Temperature. An unresolved item was written on this item pending review of the RHR heating ventilation and air conditioning (HVAC) calculation and associated bearing temperature impacts.

Specifically, the resident inspectors questioned the operability of EDG 12 for design conditions based on the outboard bearing temperature reaching 190o F during the 24-hour run. The issue was unresolved because the resident inspectors were concerned that the RHR HVAC may be ineffective at maintaining room temperatures. The resident inspectors were also concerned that at ambient temperatures above 80o F, the ability of RHR HVAC to keep system temperatures below the 195o F bearing shutdown limit and the required 202o F minimum viscosity limit was inconclusive.

During this inspection, the inspectors reviewed calculation DC-5489 and several CARDs written on bearing oil temperature concerns and concluded that room temperature had little effect on the bearing temperature, and that the generator load had the primary effect on the bearing temperature.

The inspectors did not identify any concerns with the licensees calculations, or with the licensees resolution of the resident inspectors issue. Therefore, no performance deficiency or violation was identified, and this URI is closed.

4OA6 Meetings, Including Exits

.1 Exit Meeting

The inspectors presented the inspection results to Mr. W. OConnor and other members of licensee management at the conclusion of the inspection on December 2, 2005. The licensee acknowledged the inspection results presented. The inspectors acknowledged that during the inspection some information provided by licensee personnel was identified as proprietary and will be treated appropriately. During the exit discussions no additional information was identified as proprietary.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

W. OConner, Vice President Nuclear Generation

D. Cobb, Director - Manager of Nuclear Generation

S. Berry, System Engineering Supervisor

E. Cavey, IST Engineer/Performance Engineer

R. Gaston, Licensing Manager

R. Johnson, Supervisor/Compliance

D. Kusumawati, Licensing Engineer

R. Libre, Director - Nuclear Engineering

A. Lim, Plant Support Engineering Supervisor

D. Noetzel, Manager - Plant Support Engineering

J. Pendergast, Principal Engineer/Licensing

P. Roelent, System Engineer, SDGs

S. Stasek, Director Nuclear Projects

L. Tremonti, System Engineering

Nuclear Regulatory Commission

C. Pederson, Director, Division of Reactor Safety

A. Stone, Chief, Engineering Branch 2, Division of Reactor Safety

M. Morris, Senior Resident Inspector

T. Steadham, Resident Inspector

L. Kozak, Senior Reactor Analyst

Attachment 1

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000341/2005016-01 URI Analyses to demonstrate the capability of RHR Complex Structure and Components to Withstand a Tornado not Available (Section 1R21.1.b.1)

05000341/2005016-02 URI Potential Bypass of Secondary Containment via CST (Section 1R21.1.b.2)

05000341/2005016-06 URI Inadequate Time Delay for Degraded Voltage Relays (Section 1R21.2.b.4)

Opened and Closed

05000341/2005016-03 NCV Non Conservative Calculation for Diesel Generator Loading (Section 1R21.2.b.1)

05000341/2005016-04 NCV Adequate Leakage Criterion Not Established for the EDG Air Start System (Section 1R21.2.b.2)

05000341/2005016-05 NCV Failure to Translate CST Temperature Limit into Design Documents and Procedures (Section 1R21.2.b.3)

Closed

05000341/2005014-02 URI Evaluation of EDG 12 High Bearing Temperature (Section 4OA5)

Discussed

None.

Attachment 1