IR 05000395/2011006

IR 05000395-11-006, on 01/31/2011 - 04/15/2011, Virgil C. Summer Nuclear Station, Component Design Bases Inspection

ML111250629
Person / Time
Site:	Summer
Issue date:	05/05/2011
From:	Binoy Desai Engineering Region 1 Branch 1
To:	Gatlin T South Carolina Electric & Gas Co
References
IR-11-006
Download: ML111250629 (51)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION II 245 PEACHTREE CENTER AVENUE NE, SUITE 1200 ATLANTA, GEORGIA 30303-1257 May 5, 2011 Mr. Thomas Vice President - Nuclear Operations South Carolina Electric & Gas Company Virgil C. Summer Nuclear Station P.O. Box 88 Jenkinsville, SC 29065

SUBJECT: VIRGIL C. SUMMER NUCLEAR STATION - NRC COMPONENT DESIGN BASES INSPECTION - INSPECTION REPORT 05000395/2011006

Dear Mr. Gatlin:

On, April 15, 2011, U. S. Nuclear Regulatory Commission (NRC) completed an inspection at your Virgil C. Summer Nuclear Station. The enclosed inspection report documents the inspection results, which were discussed on April 21, 2011, with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your licenses. The team reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents nine NRC-identified findings of very low safety significance (Green),

which were determined to involve violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent the NRC Enforcement Policy. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Summer. Further, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at Summer. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at

SCE&G 2 http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Binoy Desai, Chief Engineering Branch 1 Division of Reactor Safety

Enclosure:

Inspection Report 05000395/2011006, w/Attachment: Supplemental Information Docket No.: 50-395 License No.: NPF-12

REGION II==

Docket Nos.: 50-395 License Nos.: NPF-12

Report Nos.: 05000395/2011006 Licensee: South Carolina Electric & Gas (SCE&G) Company

Facility: Virgil C. Summer Nuclear Station Location: P.O. Box 88 Jenkinsville, SC 29065 Dates: January 31 - April 15, 2011

Inspectors: D. Jones, Senior Reactor Inspector (Lead) S. Sandal, Senior Reactor Inspector J. Eargle, Reactor Inspector D. Mas Penaranda, Reactor Inspector M. Yeminy, Contractor J. Nicely, Contractor Approved by: Binoy B. Desai, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000395/2011006; 01/31/2011 - 04/15/2011; Virgil C. Summer Nuclear Station; Component Design Bases Inspection.

This inspection was conducted by a team of four NRC inspectors from the Region II office, and two NRC contract inspectors. Nine Green non-cited violations (NCV) were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using the NRC Inspection Manual Chapter (IMC) 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," (ROP) Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation (NCV) of 10 CFR 50.63, "Loss of all Alternating Current Power," for failure to ensure Regulatory Guide 1.155, "Station Blackout," (SBO) requirements were implemented. Specifically, the licensee failed to develop procedures to provide starting air to the emergency diesel generators (EDG) to restore emergency AC power during the recovery from a SBO. The licensee entered this issue into their corrective action program as CR-11-00746 and CR-11-00738, and initiated compensatory measures which included the development of procedure EMP-100.011, "Restoring Power to Emergency Diesel Generator Air Start Compressor," Rev. 0.

The licensee's failure to establish procedures to provide starting air to the EDGs to restore emergency ac power in the event of a SBO was a performance deficiency. The finding was more than minor because it was associated with the Design Control attribute of the Mitigating System Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to develop procedures to provide starting air to the EDGs resulted in a lack of reasonable assurance that the licensee could provide adequate starting air to restore emergency ac power in the event of a SBO. The conditions necessary for the condition would be a loss of offsite power (LOOP), two failed start attempts of both EDGs, and failure to recover an EDG or offsite power within the four hour SBO coping period. Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," the inspectors determined the finding would represent a loss of the core heat removal safety function within the mitigating systems cornerstone conditional upon establishing these SBO circumstances. The pre-solved significance determination process (SDP) Phase 2 worksheet for VC Summer did not have an appropriate surrogate to evaluate these specific conditions, therefore an SDP phase 3 risk evaluation was performed by a regional SRA. The SDP phase 3 risk evaluation was performed using failure data from the NRC VC

Summer SPAR model using a one year exposure period. The risk was mitigated by the number and likelihood of the conditions required to establish the circumstances necessary for the performance deficiency. The result of the SDP phase 3 risk analysis was a risk increase in core damage frequency of < 1E-6/year. The performance deficiency is characterized as GREEN, a finding of very low safety significance. A cross-cutting aspect was not identified because the finding does not represent current performance. [Section 1R21.2.1]

• Green: The team identified a non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, "Design Control" involving two examples. In one example, the licensee did not properly translate the instrument uncertainties associated with the EDG low pressure alarm and pressure indicator into operating procedures (OP) and alarm response procedures (ARP). In the second example, the licensee failed to translate the minimum thermal barrier flow requirements into applicable abnormal operating procedures (AOP) and ARPs. The licensee entered these issues into their corrective action program as CR 11-00744 and CR-11-00955.

The licensee's failure to correctly translate the applicable design bases information for the EDG air start system and the thermal barrier heat exchangers setpoints into procedures was a performance deficiency. The finding was determined to be more than minor because it was associated with the Procedure Quality attribute of the Mitigating System Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to translate the appropriate values into the procedures described above adversely affected the quality of procedures for abnormal and alarm conditions that are required by Regulatory Guide 1.33, Quality Assurance Program Requirements. The inadequate procedures adversely affected operator action to assess operability and to combat deficiencies associated with risk significant equipment. The team assessed the finding using the SDP and determined that the finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality, did not represent the loss of a system safety function and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. A cross-cutting aspect was not identified because the finding does not represent current performance. [Sections 1R21.2.2]

Green.

The team identified a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to use conservative motor control center (MCC) voltage inputs or methodologies when calculating motor actuator output torque and control circuit voltages for safety-related motor operated valves (MOV) that are be required to operate during design bases events. The licensee entered these issues into their corrective action program as CR-11-00782, CR-11-00956, and CR-11-00631 and performed an evaluation to confirm the operability of affected valves.

The team determined that that the licensee's use of non-conservative MCC voltage/current inputs in safety-related calculations was a performance deficiency. The performance deficiency was more than minor because it adversely affected the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC IMC 0609.04,"Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality, did not represent the loss of a system safety function and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. A cross-cutting aspect was not identified because the finding does not represent current performance. [Section 1R21.2.3]

Green.

The team identified a non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to establish design control measures to verify or check the adequacy of design inputs used to determine the required suction lift of the EDGs fuel oil transfer pumps. Specifically, the licensee used non-conservative pressure drops and atmospheric pressure values to determine the available suction lift required at the pump's suction in order to transfer the fuel oil from the bottom of the underground fuel storage tanks to the day tanks. The licensee entered these issues into their corrective action program as CR-11-00565 and performed an evaluation to confirm the ability of the pumps to transfer the required volume of fuel.

The licensee's failure to adequately account for pressure losses, flow rates and atmospheric conditions in a safety-related calculation was a performance deficiency. The performance deficiency was more than minor because it adversely affected the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the deficiencies in Calculation DC06630-004 resulted in a reasonable doubt that the fuel oil transfer pump could deliver the TS required volume of 48,500 gallons; because, if the maximum allowed differential pressure of 2.5 psig had been realized, and combined with the uncertainties associated with the measuring equipment, the pump would have been unable to transfer the required volume of fuel. In accordance with NRC IMC 0609.04, "Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality. A cross-cutting aspect was not identified because the finding does not represent current performance. [Section 1R21.2.4.1]

Green.

The team identified a NCV of Technical Specification 6.8, "Procedures and Programs", for the licensee's failure to develop a procedure to ensure an EDG alarm device was properly calibrated or tested. Specifically, the component validating the "full" status of the EDG fuel header lines had never been calibrated, nor tested. The licensee entered these issues into their corrective action program as CR-11-00984 The team determined that the licensee's failure to develop and implement a procedure that ensured the EDG ultrasonic alarm device was properly calibrated or tested was a performance deficiency. This performance deficiency is more than minor because it affected the mitigating systems cornerstone attribute of ensuring the availability, reliability, and capability of safety systems that respond to initiating events. Specifically, the lack of calibration and testing of a non safety-related device could adversely affect the capability of the EDG to start and load within 10 seconds as required by TS. In accordance with NRC IMC 0609.04, "Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was not a design issue resulting in loss of function, it did not represent an actual loss of a system safety function, it did not result in exceeding a TS allowed outage time, and it did not affect external event mitigation. A review of the most recent EDG tests demonstrated that the EDGs started within the required 10 seconds thereby indicating that the fuel line header was not empty at the time of the test. A cross-cutting aspect was not identified because the finding does not represent current performance.

[Section 1R21.2.4.2]

Green.

The team identified a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control" for the licensee's failure to establish a test program that demonstrated the operability of EFW pump discharge check valves. The test procedure was inadequate to provide reasonable assurance that the check valves would (1) not allow reverse flow sufficient to rotate its pump backwards, (2) not allow reverse flow that would overpressurize its pump's suction piping and, (3) not allow reverse flow that would lower the forward flow to a value below the required flow to the steam generators. This issue was entered into the licensee's corrective action program as CR-11-00556.

The team determined that the licensee's development of an inadequate procedure to test safety-related check valves was a performance deficiency. This performance deficiency is more than minor because it affected the mitigating systems cornerstone attribute of ensuring the availability, reliability, and capability of safety systems that respond to initiating events. Specifically, the licensee failed to develop a test procedure that would reliably ascertain that the steam generators were not deprived of design bases flow via a leaking check valve. In accordance with NRC IMC 0609.04, "Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was not a design issue resulting in loss of function, it did not represent an actual loss of a system safety function, it did not result in exceeding a Technical Specification allowed outage time, and it did not affect external event mitigation. A cross-cutting aspect was not identified because the finding does not represent current performance. [Section 1R21.2.5]

Green.

The team identified a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control" for the licensee's failure to use the most limiting design inputs in an electrical calculation associated with determining settings for the degraded voltage relays to ensure that adequate voltages would be available to safety-related emergency core cooling system equipment during a design basis loss of coolant accident with offsite power available. Specifically, the team identified nine deficiencies in Calculation DC08200-001, "ESF Undervoltage Logic and Settings." The licensee entered this issue into the corrective action program as condition report CR-11-01045.

The team determined that the use of non-conservative inputs and methodologies in electrical calculation DC08200-001 was a performance deficiency. Specifically, the nine examples of deficiencies in the calculation resulted in a reasonable doubt that a spurious separation from offsite power would occur and that adequate voltages would be available to safety-related emergency core cooling system equipment during a design basis loss of coolant accident with offsite power available. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding affected the availability of the offsite power feed from Transformer XTF-4 and/or XTF-5, and with XTF-6 voltage regulator not in service under specific minimum grid voltage conditions. These transformers are the normal offsite power supply to Safety Bus 1DA and the alternate supply to Safety Bus 1DB. Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," the inspectors determined that the finding represented a potential loss of core decay heat removal safety function under the mitigating systems cornerstone conditional upon specific offsite power grid system voltage circumstances. The VC Summer SDP phase 2 pre-solved Worksheet did not have a suitable surrogate for this finding therefore a phase 3 SDP analysis was performed by a regional SRA. The phase 3 SDP analysis utilized the latest VC Summer NRC SPAR risk model and an exposure period of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> per year. The dominant sequence was a loss of DC Bus B with a failure of emergency feedwater and a failure to implement feed and bleed leading to core damage. The risk was mitigated by equipment available from Safety Bus 1DB and the short exposure period. The SDP phase 3 risk analysis result was an increase in core damage frequency of <1E-6 per year. The finding was characterized as GREEN, a finding of very low safety significance. A cross-cutting aspect was not identified because the finding does not represent current performance. [Section 1R21.2.10]

Green.

The team identified a non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control" for the licensee's failure to adequately account for the in-rush current of the 7.2 kV breaker spring charging motors in a safety-related calculation. Specifically, the licensee used the steady-state current instead of the more limiting in-rush current in battery voltage drop calculation. The licensee entered the issue into their corrective action program as CR 11-00989 and performed testing to confirm the ability of the breaker to close with reduced voltage.

The failure of the licensee to use the more limiting in-rush current in the safety-related calculation is a performance deficiency. The performance deficiency was more than minor because it adversely affected the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the deficiencies in Calculation DC08320-010 resulted in a reasonable doubt that the B service water pump breaker would not have reliably closed during a design bases event. The performance deficiency resulted in the breakers not being tested with the lower voltage (71.04vdc) that would be available during an event. In accordance with NRC IMC 0609.04,"Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 Significance Determination Process (SDP) screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality, did not represent the loss of a system safety function and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. A cross-cutting aspect was not identified because the finding does not represent current performance. [Section 1R21.2.13]

Cornerstone: Barrier Integrity

Green.

The team identified a non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action", for the licensee's failure to implement prompt corrective actions to ensure that SG primary to secondary break flow could be terminated within the accident analysis assumptions used for a design basis SGTR event. The licensee entered this concern into the corrective action program as CR-11-01031.

The licensee's failure to implement prompt and effective corrective actions to ensure that primary to secondary steam generator tube rupture (SGTR) break flow could be terminated within the timeframes established by the FSAR accident analysis of record was a performance deficiency. The performance deficiency was greater than minor because it adversely affected the SSC/barrier performance, procedure quality, and human performance attributes of the barrier integrity cornerstone objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, the failure to complete timely corrective actions to ensure the adequacy of system design, emergency operating procedures, and/or licensing basis SGTR accident analyses challenged the assurance that those attributes would demonstrate sufficient protection for the consequences associated with a design basis SGTR event. The significance of the finding was screened using the barrier integrity column of IMC 0609, "Significance Determination Process", Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," and determined to be of very low safety significance (Green) because the finding did not represent (1) the degradation of only the radiological barrier function provided for the control room/auxiliary building/spent fuel pool, (2) the degradation of the barrier function of the control room against toxic atmosphere or smoke, (3) an actual open pathway in the integrity of reactor containment or heat removal components, or (4) an actual reduction in function of hydrogen igniters in the reactor containment. The finding directly involved a cross-cutting aspect in the resources component of the human performance area H.2(a). [Section 1R21.2.11]

B. Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the licensee's Probabilistic Risk Assessment (PRA). In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1 X10

-6. The sample included fifteen components including one associated with containment, and five operating experience (OE) items.

The team performed a margin assessment and a detailed review of the selected risk-significant components to verify that the design bases had been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for a detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule status, Regulatory Issue Summary (RIS)05-020 (formerly Generic Letter (GL) 91-18) conditions, NRC resident inspector input of problem equipment, System Health Reports, industry OE, and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2.1 EDG Auxiliaries - Air Start System

a. Inspection Scope

The team reviewed the plant's Final Safety Analysis Report (FSAR), Technical Specification (TS), design bases documents (DBD), and piping and instrumentation drawings (P&ID) to establish an overall understanding of the design bases of the emergency diesel generator (EDG) air start system. Design calculations and site procedures were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the component's performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design bases function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Test procedures and results were reviewed against DBDs to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with inservice/equipment qualification life.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR 50.63, "Loss of all Alternating Current Power," for failure to ensure Regulatory Guide 1.155, "Station Blackout," (SBO) requirements were implemented. Specifically, the licensee failed to develop procedures to provide starting air to the EDGs to restore emergency ac power during the recovery from a SBO.

Description:

10 CFR 50.2 defines a SBO as the complete loss of ac power to the essential and nonessential switchgear buses in a nuclear power plant. Essentially, this would involve the loss of the offsite power sources as well as the loss of emergency onsite ac power sources. The licensee is committed to coping with the SBO for a duration of four hours, and recovery there from.

The EDG air start system provides compressed air to start the EDGs. The compressed air is provided by non safety-related air compressors, and is stored in safety-related air receiver tanks between 415 and 375 psig. The EDG air start system is equipped with check valves (XVC10977A/B-DG and XVC10978A/B-DG) to maintain the integrity of the safety-related portion of the air start system. The licensee declares the EDG inoperable at pressures below 275 psig as this is the manufacturer's value at which EDG starting and achieving rated speed and voltage has been demonstrated by testing.

The team noted that the leak rate acceptance criteria was 2.4 psig/minute for the EDG air start check valves. At this allowable leak rate, the EDG air start pressure could fall below 275 psig within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after a SBO and completely depressurize the air receiver within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after a SBO. This would not support the capability of the EDGs to start at the end of the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> SBO coping period.

In addition to the concerns about the check valve leak rate acceptance criteria, the team noted that postulated failed start attempts during an SBO event adversely impacted the amount of air that would be available at the end of the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period. Specifically, the initial failure of the onsite power sources would consist of a failure of both onsite EDGs to start which would result in a SBO. The licensee's procedures then direct operators to attempt to start the EDGs a second time in the first few minutes of the SBO. The first and second start attempts are postulated to be unsuccessful during a SBO. The loss of offsite and onsite emergency ac power would prevent the air start compressors from recharging the tanks after the failed start attempts.

The concerns related to the allowable check valve leakage and the amount of air used during the multiple failed start attempts led the team to conclude that the licensee did not have reasonable assurance that adequate starting air pressure would exist to reliably start the EDG in order to recover from a SBO after the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period. The team also concluded that the licensee had not developed procedural guidance to provide adequate air pressure to reliably start the EDG in order to recover from a SBO after the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period. The licensee captured these concerns in CR-11-00746 and CR-11-00738, and initiated compensatory measures which included the development of procedure EMP-100.011, "Restoring Power To Emergency Diesel Generator Air Start Compressor," Rev. 0.

Analysis:

The licensee's failure to establish procedures to provide starting air to the EDGs to restore emergency ac power in the event of a SBO was a performance deficiency. The finding was more than minor because it was associated with the Design Control attribute of the Mitigating System Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to develop procedures to provide starting air to the EDGs resulted in a lack of reasonable assurance that the licensee could provide adequate starting air to restore emergency ac power in the event of a SBO. The conditions necessary for the condition would be a loss of offsite power (LOOP), two failed start attempts of both EDGs, and failure to recover an EDG or offsite power within the four hour SBO coping period. Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," the inspectors determined the finding would represent a loss of the core heat removal safety function within the mitigating systems cornerstone conditional upon establishing these SBO circumstances. The pre-solved SDP Phase 2 worksheet for VC Summer did not have an appropriate surrogate to evaluate these specific conditions, therefore an SDP phase 3 risk evaluation was performed by a regional SRA. The SDP phase 3 risk evaluation was performed using failure data from the NRC VC Summer SPAR model using a one year exposure period. The risk was mitigated by the number and likelihood of the conditions required to establish the circumstances necessary for the performance deficiency. The result of the SDP phase 3 risk analysis was a risk increase in core damage frequency of < 1E-6/year. The performance deficiency is characterized as GREEN, a finding of very low safety significance. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

10 CFR 50.63, "Loss of all Alternating Current Power," requires, in part, that "light-water-cooled nuclear power plants must be able to withstand and recover from a station blackout." Also, RG 1.155, "Station Blackout," Section 1.3 "Procedures for Restoring Emergency AC Power," of which the licensee is committed, requires, in part, that "Guidelines and procedures for actions to restore emergency ac power when the emergency ac power system is unavailable should be integrated with plant specific technical guidelines and emergency operating procedures." Contrary to the above, since circa 1993, the licensee failed to develop procedures to provide starting air to the EDGs to restore emergency ac power in the event of a SBO. Because the violation is of very low safety significance and has been entered into the licensee's corrective action program (CR-11-00746 and CR-11-00738), this violation is being treated as a green non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-01, "Failure to Develop Procedures to Provide Starting Air to EDGs During a SBO Event."

.2.2 Component Cooling Water Booster Pumps (XPP-58A/B/C-CC)

a. Inspection Scope

The team reviewed the plant's TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of the component cooling water booster pumps.

Design calculations and site procedures were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that the component replacement was consistent with inservice/equipment qualification life. The team also verified by review of control diagrams, that the operations of the component cooling water booster pump motor was consistent with the design bases and operational requirements. The team reviewed the alternating current

(ac) voltage calculations to assure satisfactory voltage to the motor under worst case conditions. The team reviewed the results of the load flow to determine whether sufficient power was available to start the motor during worst case degraded voltage and service conditions. The team reviewed short circuit calculations to verify that the duty did not exceed the system breaker ratings. In addition, the team reviewed the motor protection setting calculations to verify adequate protection during design bases scenarios.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, Design Control involving two examples. In one example, the licensee did not properly translate the instrument uncertainties associated with the EDG low pressure alarm and pressure indicator into operating procedures (OP) and alarm response procedures (ARP). In the second example, the licensee failed to translate the minimum thermal barrier flow requirements into applicable abnormal operating procedures (AOP) and ARPs.

Description:

The team identified two examples of the licensee not translating the design of components into procedures required by Regulatory Guide 1.33, Quality Assurance Program Requirements (Operation). The following examples were identified.

EDG Air Start Low Pressure Alarm and Setpoint Uncertainty - Procedure SOP-306, Emergency Diesel Generator, Rev. 18, states that EDG A and B are operable when the air receiver tank is pressurized greater than or equal to 275 psig. The licensee uses local gauges to verify pressure in the air receiver tanks to make this operability determination. The team determined that the licensee failed to account for the instrument uncertainties associated with these gauges. Additionally, procedure ARP-004-XCX-5201 and -5202, Diesel Generator A and B, Rev. 6, states that the low starting air pressure setpoint is 275 psig decreasing for the alarm received in the control room. The team determined that the licensee failed to account for the +/- 5.5 psig allowable calibration tolerance for the pressure switch associated with the low starting air pressure alarm. The team determined that these deficiencies, if left uncorrected could result in the air pressure being below the operability limit (275 psig) before the EDG is declared inoperable, or before the alarm is annunciated in the control room. The licensee entered these issues into their corrective action program as CR-11-00744.

Thermal Barrier Heat Exchanger Design Flow Requirements - Component cooling water provides water to the three reactor coolant pump (RCP) thermal barrier heat exchangers to protect the RCP seals. Low flow alarms are provided for the total flow on the supply line, and are also provided for individual flow on the return lines. These alarms are received in the control room.

The minimum design flows required by Westinghouse documentation is 35 gpm for each thermal barrier heat exchanger. This equates to a minimum total design flow of 105 gpm for all three thermal barrier heat exchangers. The inspectors noted that the licensee established low flow alarm setpoints of 90 gpm for the minimum total flow to all three thermal barrier heat exchangers, and setpoints of 32 gpm for the each of the individual thermal barrier heat exchanger. These setpoints were then translated into the following procedures: AOP-118.1, Total Loss of Component Cooling Water, Rev. 2; AOP-102.2, Loss of Charging, Rev. 0; and ARP-001-XCP-601, -602, -602, Revisions 5. The team determined that the setpoints in these procedures were non-conservative (low) as compared to Westinghouse design requirements and if left uncorrected could result in

(1) inadequate flow to the thermal barrier heat exchangers without receiving the low flow alarms, and

(2) the failure to enter into applicable AOPs when design flows are not met.

Specifically, the non-conservative setpoints could result in the failure of operators to trip the reactor if charging is lost and inadequate thermal barrier cooling existed.

The licensee entered these issues into their corrective action program as CR-11-00955.

Analysis:

The licensee's failure to correctly translate the applicable design bases information for the EDG air start system and the thermal barrier heat exchangers setpoints into procedures was a performance deficiency. The finding was determined to be more than minor because it was associated with the Procedure Quality attribute of the Mitigating System Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to translate the appropriate values into the procedures described above adversely affected the quality of procedures for abnormal and alarm conditions that are required by Regulatory Guide 1.33, Quality Assurance Program Requirements. The inadequate procedures adversely affected operator action to assess operability and to combat deficiencies associated with risk significant equipment. The team assessed the finding using the SDP and determined that the finding was of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality, did not represent the loss of a system safety function and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, "Design Control," requires, in part, that "Measures shall be established to assure that the design basis is correctly translated into procedures." Contrary to the above, the licensee failed to correctly translate the applicable design bases information for the EDG air start system, and the thermal barrier heat exchangers into procedures. Specifically, prior to 2002, the licensee failed to translate the instrument uncertainties associated with the EDG low pressure alarm and pressure indicator into OPs and ARPs, and failed to translate the minimum thermal barrier flow requirements into applicable AOPs and ARPs. Because the violation is of very low safety significance and has been entered into the licensee's corrective action program as CR-11-00955 and CR-11-00744, this violation is being treated as a green non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-02, "Failure to Correctly Translate the Design Basis into Procedures for Low EDG Air Pressure and Low Thermal Barrier Heat Exchanger Flow."

.2.3 Containment Isolation Valves (XVG-9605/6-CC) (Containment Related Sample)

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of containment isolation motor operated valves (MOV) XVG-9605-CC and XVG-9606-CC. Design calculations (i.e., differential pressure and required torque/thrust) and site procedures were reviewed to verify that the design bases and design assumptions had been appropriately translated into these documents. Component walkdowns were conducted to verify that the installed configurations would support their design bases function under accident conditions and had been maintained to be consistent with design assumptions. Operating procedures were reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Test procedures and recent test results were reviewed against design bases documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and analyses served to validate component operation under accident conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that the component replacement was consistent with inservice/equipment qualification life. The team also reviewed the calculations for degraded voltage at the MOV terminals to ensure that the proper voltage was utilized in the MOV torque calculations. The team reviewed the calculations that establish control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing and application to verify adequate protection during design bases scenarios.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to use conservative motor control center (MCC) voltage inputs or methodologies when calculating motor actuator output torque and control circuit voltages for safety-related MOV motors that are required to operate during design bases events.

Description:

Design electrical calculations (DC08200-001, ESF Undervoltage Logic and Settings, DC08200-003, Class 1E 460V Motor Operated Valve Starting Voltages at Degraded Voltage Conditions, and DC08760-007, Motor Control Center Control Circuit Analysis) used the 7.2kV switchgear (1DA and 1DB) "steady-state" degraded voltage relay setpoints when determining the available voltage at MOV motor terminals and control circuits. The team determined that the licensee should have used the "transient" voltages instead of the steady-state voltages. During a safety-injection signal and the subsequent sequencing of emergency core cooling system (ECCS) loads, transient voltages are more limiting because the available bus voltage will experience a voltage depression until the upstream starting motors accelerate. For transient conditions, the licensee's calculations failed to determine if approximately 44 MOVs would have adequate motive or control voltages to meet plant safety analyses response time requirements, failed to provide assurance that the MOVs would not be damaged, and failed to confirm that the MOVs would not trip on protective devices.

Additionally, when the licensee calculated terminal voltages to the MOVs, the team noted that the locked-rotor currents were non-conservative (low). The licensee used worst case (higher) post-accident room temperatures which resulted in lower calculated current requirements for the MOVs. The team determined that lowering the locked rotor currents was non-conservative because the extreme environmental conditions would not exist for all accident scenarios.

The licensee's use of steady-state MCC voltages and non-conservative starting currents resulted in higher terminal voltages than would actually exist at the MOVs. Following the team's identification of these issues, the electrical voltage calculations and mechanical thrust and torque calculations were re-evaluated to ascertain operability of the affected safety-related MOVs. As a result of the re-evaluation, all of the 44 MOVs lost available margin. MOVs XVG3003A and XVG3003B had negative margin, which required further evaluation to determine the impact of incurring a delay of up to 5.5 seconds while the MOV terminal voltage recovered to a level greater than the minimum required voltage.

The licensee's evaluations determined that the delayed stroking of these valves would not adversely impact the mitigation of design bases accidents. The licensee initiated corrective action reports CR-11-00782, CR-11-00956, and CR-11-00631 to address these issues.

Analysis:

The team determined that that the licensee's use of non-conservative MCC voltage/current inputs in safety-related calculations was a performance deficiency. The performance deficiency was more than minor because it was similar to Inspection Manual Chapter (IMC) 0612, "Power Reactor Inspection Reports," Appendix E, "Examples of Minor Issues", Example 3j, which states that if "the engineering calculation error resulted in a condition where there was a reasonable doubt on the operability of a system" the performance deficiency is not minor; and was more than minor because the performance deficiency adversely affected the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. In accordance with NRC IMC 0609.04,"Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality, did not represent the loss of a system safety function and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. By the end of the inspection, the licensee was able to demonstrate operability of the MOVs through additional analyses. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control" requires, in part, that design control measures provide for verifying or checking the adequacy of design. Contrary to the above, in March 1993 the licensee failed to verify the adequacy of design in safety-related calculations used to provide assurance that MOVs would have adequate power to operate during design bases accidents. Specifically, the licensee used steady state MCC voltages instead of more limiting transient voltages and used non-conservative starting currents when determining the adequacy of electrical power to operate safety-related MOVs during design bases load sequencing. Because this finding is of very low safety significance and because it was entered into the licensee's corrective action program as CR-11-00782, CR-11-00956, and CR-11-00631, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. NCV 05000395/2011006-03, "Failure to Adequately Calculate Motor Actuator Output Torque and Control Circuit Voltages for MOVs"

.2.4 Emergency Diesel Generators Fuel Oil Supply and Delivery

a. Inspection Scope

The inspection team reviewed the capacity of the fuel oil storage tank; the capacity of the fuel oil day tank; the design of the fuel oil transfer pumps, including their suction and discharge piping and components to verify the pumps' capability of lifting the fuel oil from the bottom of the storage tank and delivering it to the day tank. The inspectors also reviewed the design and routing of the fuel oil piping from the day tank to the diesel cylinders including the fuel line headers to verify that the as-built configuration was consistent with design bases requirements. The review included the equipment design specifications, system flow diagrams, isometric drawings, calculations, applicable sections of the UFSAR, applicable sections of the TS, and a license amendment. The team also reviewed operating procedures, test procedures, operator rounds, vendor documents and inspection and maintenance records. The team walked down the fuel oil transfer pump, day tank, the above-ground fuel oil storage tank fill and vent connections, and all exposed fuel lines up to the EDGs' cylinders. This included the pumps' suction and discharge piping, valves and strainers. The team ascertained that installation of the exposed (not buried) fuel delivery system was as shown in design documents, and evaluated the material condition of the components and piping.

b.

.1 Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to establish design control measures to verify or check the adequacy of design inputs used to determine the required suction lift of the EDGs fuel oil transfer pumps.

Specifically, the licensee used non-conservative pressure drops and atmospheric pressure values to determine the available suction lift required at the pump's suction in order to transfer the fuel oil from the bottom of the underground fuel storage tanks to the day tanks.

Description:

Technical Specification, 3/4.8.1 and

.2 , Electrical Power Systems, states that at a minimum, a fuel storage system containing a minimum of 48,500 gallons of fuel and a fuel transfer pump is required for operability of the onsite electrical power supply.

Each redundant EDG fuel oil storage and transfer system consists of an underground storage tank, two electrically driven fuel oil transfer pumps, a day tank, and associated valves and pipes. The safety function of the fuel oil transfer pumps is to deliver fuel oil from the larger capacity underground storage tank to the day tank. As the EDG consumes the fuel oil in the day tank, the transfer pumps maintain level by pumping fuel oil from the underground storage tank.

The licensee's calculation, DC06630-004, "EDG Fuel Oil Transfer Pump NPSH Requirements and System Pressure Loss" (approved 9/6/95), determined the capability of the fuel oil transfer pumps to lift the required volume of oil (48,500 gallons) from the underground storage tank.

The team identified the following non-conservatisms in DC06630-004 regarding the capability of the fuel oil transfer pumps to transfer fuel as level in the tank reaches its minimum:

• The licensee failed to incorporate a pressure drop of 2.5 psig associated with a strainer positioned at the suction of the fuel oil transfer pumps. Procedural guidance states the strainers are to be replaced when the differential pressure

(dp) across them exceeds 2.5 psig. DC06630-004 did not account for the dp criteria nor did it account for uncertainties associated with the measuring equipment used to determine when the strainers need replacement.

• The licensee failed to incorporate actual operating flow rates for the fuel oil transfer pumps to determine the available NPSH and the required suction lift for the pumps. The licensee used a flow rate of 9.0 gpm when the most recent test results (9/8/2010 and 12/3/2010) indicated pump flows at greater than 17.0 gpm (17.39 and 17.12 gpm, respectively).

• The licensee failed to consider the vertical orientation of a check valve located at the suction pipe opening.

• The licensee failed to incorporate the actual ground elevation of 436 ft and the possibility of low pressure weather conditions when determining the most limiting atmospheric pressure used in the calculation.

Based on the above, the team asked the licensee if the pumps had been tested for their capability to lift oil from the bottom of the storage tank. Successful testing at these limiting conditions would provide assurance that the pumps would be capable of operating at minimum tank levels. The licensee indicated that the tests have always been conducted with the storage tank being either full or near full.

The licensee entered the issue into their corrective action program as CR-11-00565. During the inspection, the licensee performed an evaluation to account for the team's observations and determined that the previously available margin of about 9.5 feet (head of oil) was reduced to almost zero.

Analysis:

The licensee's failure to adequately account for pressure losses, flow rates and atmospheric conditions in a safety-related calculation was a performance deficiency. The performance deficiency was more than minor because it was similar to Inspection Manual Chapter (IMC) 0612, "Power Reactor Inspection Reports," Appendix E, "Examples of Minor Issues", Example 3j, which states that if "the engineering calculation error results in a condition where there is now a reasonable doubt on the operability of a system or component" the performance deficiency is not minor. Further, the deficiency was more than minor because the performance deficiency adversely affected the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the deficiencies in Calculation DC06630-004 resulted in a reasonable doubt that the fuel oil transfer pump could deliver the TS required volume of 48,500 gallons; because, if the maximum allowed differential pressure of 2.5 psig had been realized and combined with the uncertainties associated with the measuring equipment, the pump would have been unable to transfer the required volume of fuel. In accordance with NRC IMC 0609.04, "Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 SDP screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality. Specifically, during the inspection, the licensee completed an evaluation that demonstrated that the fuel oil transfer pumps would perform their design bases function. A cross-cutting aspect was not identified because the finding does not represent current performance as the design calculation was performed in 1995.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control" requires, in part, that design control measures provide for verifying or checking the adequacy of design. Contrary to the above, on September 6, 1995, the licensee failed to verify the adequacy of design inputs used to determine the available suction lift to the EDG fuel oil transfer pumps. Specifically, the licensee failed to incorporate significant pressure drops in the suction lines of the transfer pumps and, used non-conservative flow rates and atmospheric pressure values when determining the available suction lift to the pumps in calculation DC06630-004, Rev. 1. Because this finding is of very low safety significance and because it was entered into the licensee's corrective action program as CR-11-00565, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-04, "Failure to Verify Adequacy of the Suction Lift for the Fuel Oil Transfer Pumps."

.2 Findings

Introduction:

The team identified a Green NCV of Technical Specification 6.8, Procedures and Programs, for the licensee's failure to develop a procedure to ensure an emergency diesel generator (EDG) alarm device was properly calibrated or tested.

Specifically, the component validating the "full" status of the EDG fuel header lines had never been calibrated, nor tested.

Description:

The fuel header of the EDG is equipped with a fuel accumulator positioned above the high point of the header piping. The purpose of the accumulator is

(1) to provide assurance that the fuel header is full of fuel, and

(2) to provide early indications of degraded safety-related check valves. The design function of these check valves is to prevent the draining of the fuel header. A full fuel header provides assurance that the EDG will start and load within the TS requirement of 10 seconds. The accumulator is equipped with a non safety-related ultrasonic alarm device designed to distinguish between a "dry" and a "wet" accumulator. The device continually validates the "wet" status of the accumulator by an ultrasonic signal transmitted to a wall mounted box equipped with status (wet and dry) lights. By observing the wall mounted lights, the operators record the accumulator's status once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (operator rounds). This validation process is done in lieu of performing inservice tests on the four safety-related ASME III check valves that could drain the fuel header if not "checking" adequately. The team determined that the ultrasonic device was never calibrated, nor was the electronic signal and the downstream "wet" and "dry" lights ever tested to ascertain that they indicate the correct status of the fuel oil accumulator.

Additionally, to augment the ultrasonic alarm device testing, the licensee's preventive maintenance program required that the EDG A and B check valves (four) be subjected to preventive maintenance including disassembly, inspection and replacement of parts (as required) once every 10 years. The team determined that one of the four check valves, XVC-20956A-DG, had never undergone the required preventive maintenance for lack of spare parts from the manufacturer, Henry Vogt. The issue was entered into the licensee's corrective action program as CR-11-00565.

Analysis:

The team determined that the licensee's failure to develop and implement a procedure that ensured the EDG ultrasonic alarm device was properly calibrated or tested was a performance deficiency. This performance deficiency is more than minor because it affected the mitigating systems cornerstone attribute of ensuring the availability, reliability, and capability of safety systems that respond to initiating events.

Specifically, the lack of calibration and testing of a non safety-related device could adversely affect the capability of the EDG to start and load within 10 seconds as required by TS. In accordance with NRC IMC 0609.04, "Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 Significance Determination Process (SDP) screening and determined the finding to be of very low safety significance (Green) because it was not a design issue resulting in loss of function, it did not represent an actual loss of a system safety function, it did not result in exceeding a TS allowed outage time, and it did not affect external event mitigation. A review of the most recent EDG tests demonstrated that the EDGs started within the required 10 seconds thereby indicating that the fuel line header was not empty at the time of the test. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

TS 6.8.1.a states that written procedures shall be established, implemented, and maintained covering the activities recommended in Appendix A of Regulatory Guide 1.33, Rev. 2, February 1978. The Regulatory Guide states in part that "procedures of a type appropriate to the circumstances should be provided to ensure that tools, gauges, instruments, controls and other measuring and testing devices are properly controlled, calibrated and adjusted at specified periods to maintain accuracy.

Specific examples of such equipment to be calibrated and tested are readout instruments, interlock permissive and prohibit circuits, alarm devices, sensors, signal controllers, controls, protective circuits, and laboratory equipment. Contrary to this requirement, the licensee failed to develop and implement a procedure to ensure an alarm device maintained its accuracy. Specifically, since initial plant operation, the licensee failed to provide appropriate procedural guidance for the testing and calibration of the EDGs ultrasonic alarm devices that monitored a safety-related function. Because this finding is of very low safety significance and because it was entered into the licensee's corrective action program as CR-11-00984, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-05, "Failure to Develop a Procedure to Ensure an Emergency Diesel Generator Alarm Device was Calibrated or Tested."

.2.5 Emergency Feedwater (EFW) Motor Driven Pumps

a. Inspection Scope

The team reviewed the UFSAR, PI&Ds, test data, system health, vendor manual, as well as operating and surveillance procedures to identify design, maintenance, and operational requirements related to pump flow rate, developed head, achieved system flow, net positive suction head (NPSH), vortex formation and prevention, minimum flow requirements, and runout protection. These requirements were reviewed for pump operation with the source of water originating from the condensate storage tank. Design calculations as well as documentation of periodic surveillance tests were reviewed to verify that design performance requirements were met. Maintenance, in-service testing, corrective action documents, and design change histories were reviewed to assess the potential for component degradation and the resulting impact on design margins and performance. The team also evaluated the adequacy of the suction piping of the pump with respect to its low design pressure and its vulnerability to over pressurization due to back flow from a leaking discharge check valve. The team concentrated its efforts on the pump's capability of performing its safety function, i.e., delivering the required flow rate to the steam generators at the prescribed design pressure. In addition, the team walked down portions of the EFW system to verify that the installed configuration was consistent with design bases information and to visually inspect the material condition of the pumps.

The team reviewed calculations that establish voltage drop, protection and coordination, motor brake horsepower (BHP) requirements, and short circuit protection for the motor power supply and feeder cable to verify the adequacy of power and protection during design bases scenarios.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control" for the licensee's failure to establish a test program that demonstrated the operability of EFW pump discharge check valves. The test procedure was inadequate to provide reasonable assurance that the check valves would

(1) not allow reverse flow sufficient to rotate its pump backwards,

(2) not allow reverse flow that would overpressurize its pump's suction piping and,

(3) not allow reverse flow that would lower the forward flow to a value below the required flow to the steam generators.

Description:

The licensee uses procedure, STP-220.001, "Motor Driven Emergency Feedwater Pump and Valve Test," Rev. 9 to test the EFW pump discharge check valve 1048A(B) of the redundant train. The function of the check valves is to prevent reverse flow sufficient to rotate its pump backwards, prevent reverse flow that would overpressurize its pump's suction piping and, prevent reverse flow that would lower the forward flow to a value below the required flow to the steam generators. The team identified the following deficiencies in the test procedure:

• The procedure had an in-service testing acceptance limit of up to a 5 psig increase at pressure gauge PI-3506 which is located upstream of check valve 1048A(B). The team determined that the licensee did not have an adequate bases for determining that the acceptance criteria was adequate for determining that the check valve functions properly, nor was there an adequate bases for translating the pressure increase to a reverse flow rate through the check valve.

As a result of the team's determination, the licensee performed an informal analysis that analyzed pressure drops and flow rates throughout the EFW system. The study determined that a pressure increase of 5 psig at the PI-3506 gauge resulted in a significant loss of flow

[reverse flow through check valve 1048A(B)] such that two steam generators were deprived of receiving the full flow of 380 gpm credited in the safety analysis. Assuming a new (not degraded) EFW motor driven pump, the informal analysis determined that the steam generators would receive 187.5 and 188.5 gpm rather than 190 gpm, as credited in the safety analysis.

• When testing check valve 1048A(B), if the A EFW pump suction check valve 1034A(B) leaks, it would disguise the severity of the reverse leakage through check valve 1048A(B).

• A reverse flow through the 1048A(B) check valve would be split between the piping on which the test pressure gauge is located and the normally open minimum flow piping. Therefore, some of the reverse flow through the check valve would not contribute to the pressurization of the test pressure gauge.

• The test also measures the flow rates to the steam generators and uses this data as an indication of the check valves capability to prevent reverse flow. This measurement was disguised by the modulating EFW flow control valves that would open to permit more flow to the steam generators, thereby compensating for a degraded check valve and disguising its leakage.

This issue was entered into the licensee's corrective action program as CR-11-00556.

Analysis:

The team determined that the licensee's development of an inadequate procedure to test safety-related check valves was a performance deficiency. This performance deficiency is more than minor because it affected the mitigating systems cornerstone attribute of ensuring the availability, reliability, and capability of safety systems that respond to initiating events. Specifically, the licensee failed to develop a test procedure that would reliably ascertain that the steam generators were not deprived of design bases flow via a leaking check valve. In accordance with NRC IMC 0609.04, "Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 Significance Determination Process (SDP) screening and determined the finding to be of very low safety significance (Green) because it was not a design issue resulting in loss of function, it did not represent an actual loss of a system safety function, it did not result in exceeding a Technical Specification allowed outage time, and it did not affect external event mitigation. The team noted that recent maintenance activities records did not identify any degradation that would have questioned the past operability of the check valves. A cross-cutting aspect was not identified because the finding does not represent current performance as the acceptance criteria was established circa 1990's.

Enforcement:

10 CFR Part 50, Appendix B, Criterion XI states in part that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to this requirement, since circa 1990's, the licensee failed to establish a test program demonstrating that safety-related check valves would perform satisfactorily in service.

Specifically, the testing methodology and acceptance limits in procedure STP-220.001, "Motor Driven Emergency Feedwater Pump and Valve Test," Rev. 9 were inadequate to assure the proper functioning of EFW check valve 1048A(B). Because this finding is of very low safety significance and because it was entered into the licensee's corrective action program as CR-11-00556, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-06, "Failure to Properly Test Emergency Feedwater Pump Discharge Check Valves."

.2.6 Charging (SI) Pumps - Operation for 10 Minutes without Cooling Water

a. Inspection Scope

The team reviewed Calculation DC04370-002, Allowable Operating Time of Charging Pumps Without Cooling Water, Rev. 4, which is a Westinghouse evaluation using system thermal masses, normal system parameters, heat rejection surface areas, and oil temperature limits in order to determine the maximum allowable time for the charging pump to operate without component cooling water flow. The calculation was reviewed to verify the adequacy of the conclusions of the evaluation. The inspectors also validated that the results of this calculation were translated to operating procedures.

b. Findings

No findings were identified.

.2.7 Service Water (SW) Pump C

a. Inspection Scope

The team reviewed DBDs and P&IDs to determine design requirements such as pump line up, pump capacity, and number of pumps required for accident mitigation. The team verified the correlation between calculated requirements, test acceptance criteria and test results. Also, the inspectors reviewed calculations related to pump flow, pump head, and net positive suction head calculations and compared them to requirements to verify that the pump was capable of functioning as required. For loss of offsite power events with electrical power supplied from the EDGs, the team verified that the licensee appropriately considered the range of EDG frequency allowed by TS for unrestricted plant operation. The inspectors also walked down the service water pump house including all of the service water pumps and associated equipment to verify that the installed configuration was consistent with the design bases and plant drawings. The team also reviewed control diagrams to verify that the operation of SW pump C motor was consistent with the design bases and operational requirements. The team reviewed the ac voltage calculation to assure satisfactory voltage to the pump motor under worst case conditions. The team reviewed the results of the load flow to determine whether sufficient power was available to start the motor during worst case degraded voltage and service conditions. In addition, the team reviewed the motor protection setting calculations to verify that adequate protection was available during design basis scenarios. The team reviewed the pump performance and brake horsepower requirement to verify that the motor was adequately sized for the worst case load condition. The team reviewed short circuit calculations to verify that the duty does not exceed the breaker ratings. The team reviewed maintenance and corrective action documents to determine whether the equipment had exhibited adverse performance trends and performed a visual inspection of the motor to assess material condition and to verify the motor nameplate data. Review of associated corrective action history was performed to verify that degraded conditions were being appropriately addressed.

b. Findings

No findings were identified.

.2.8 Emergency Diesel Generator B [Electrical]

a. Inspection Scope

The inspectors reviewed system health reports, DBDs, and licensing bases documents to determine the design bases and limiting operating parameters. TS surveillances were reviewed to ensure that the licensing and regulatory commitments were being satisfactorily implemented. The inspectors reviewed corrective action documents to verify that appropriate and timely corrective actions were taken in response to component degradation. Loading and voltage calculations were reviewed to ensure the EDG was being operated within its ratings and capabilities. Protective relaying and relaying control schemes were reviewed to ensure that the equipment was being protected from damaging short circuit currents and that the relaying bypass schemes were being applied in accordance with regulatory requirements. The EDG output breaker sizing, control logic, and dc control voltage were reviewed to ensure that the breaker and controls were being applied within manufacturer ratings and capabilities during worst case design bases events. The inspectors reviewed licensee responses to industry OE related to EDG voltage regulators (IN 2007-36) to determine if timely and effective measures were taken to address applicable issues. A visual non-intrusive inspection was performed to assess installation, configuration, material condition, and potential vulnerability to hazards to verify that the component installed configurations have been maintained consistent with design assumptions.

b. Findings

No findings were identified.

.2.9 Emergency Auxiliary Transformer XTF31 and Voltage Regulator XTF6

a. Inspection Scope

The inspectors reviewed the TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design bases of the component. Load flow calculations were reviewed to verify that station offsite power would be available and unimpeded during accident/event conditions. The inspectors reviewed periodic maintenance and testing practices to ensure the equipment was maintained in accordance with industry practices. Calculations for the automatic load tap changer voltage and time delay settings were reviewed to verify that design bases and assumptions had been appropriately translated into design calculations. Support system calculations and vendor information were reviewed to verify that energy sources, including those used for control functions would be available and adequate during accident/event conditions. Modifications to the system were reviewed against design documents to verify that performance capabilities of selected components had not been degraded. The inspectors conducted a walkdown of the transformers and their associated auxiliaries, reviewed vendor manuals, and performed focused field inspections to verify that the installed configuration would support its design bases function under accident/event conditions and that the equipment was properly protected. Interviews with system engineers and maintenance personnel were conducted; and, system health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and that component replacement was consistent with in service/equipment qualification life. The inspectors reviewed selected industry OE and any plant actions to address the applicable issues to verify that applicable insights from operating experience had been applied.

b. Findings

No findings were identified.

.2.10 7.2kV Switchgear XSW-1DB

The team inspected the 4kV Bus and associated switchgear to verify it would operate during design basis events. System health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented. The team reviewed selected calculations for electrical distribution system load flow/voltage drop, degraded voltage protection, short-circuit, and electrical protection and coordination. This review was conducted to assess the adequacy and appropriateness of design assumptions, and to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. Additionally, the switchgear's protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst-case, short-circuit conditions. The team evaluated selected portions of the licensee response to NRC Generic Letter (GL) 2006-02, "Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power," dated February 1, 2006. The station's interface and coordination with the transmission system operator for plant voltage requirements and notification set points were reviewed. The team reviewed the degraded and loss of voltage relay protection schemes and bus transfer schemes between offsite power supplies and the associated emergency diesel generators to verify the adequacy of setpoints. The team reviewed the preventive maintenance inspection and testing procedures to verify that breakers were maintained in accordance with industry and vendor recommendations. The team reviewed selected industry OE and any plant actions to address the applicable issues to ensure that applicable insights from operating experience have been applied. The 125Vdc voltage calculations were reviewed to determine if adequate voltage would be available for the breaker open/close coils and spring charging motors during design basis events. The team also performed a visual non-intrusive inspection of 7.2kV Switchgear XSW-1DB to assess the installation configuration, material condition, and potential vulnerability to hazards.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control" for the licensee's failure to use the most limiting design inputs in an electrical calculation associated with determining settings for the degraded voltage relays to ensure that adequate voltages would be available to safety-related emergency core cooling system equipment during a design basis loss of coolant accident with offsite power available. Specifically, the team identified nine deficiencies in Calculation DC08200-001, "ESF Undervoltage Logic and Settings."

Description:

10 CFR 50, Appendix A - GDC 17 states, in part, that an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety and that both onsite and offsite power systems have a safety function. Therefore, the licensee's voltage calculations should verify the proper operation of the plant safety-related electrical distribution system when supplied from the offsite power circuits during all plant conditions and verify that the degraded voltage relays will not actuate and spuriously separate the safety-related electrical distribution system from the offsite power circuits, unless those circuits are degraded or lost.

The team identified nine examples of non-conservative inputs and methodologies in electrical calculation DC08200-001, "ESF Undervoltage Logic and Settings." This calculation, among other purposes, was used

(1) to determine settings for the degraded voltage relays,

(2) to establish acceptable voltage ranges for the 115 and 230kV offsite systems, and

(3) to determine safety-related bus and motor/load voltages during a design basis accident with offsite power available. The team identified the following issues that contributed to the identified performance deficiency:

1) The calculation included a detailed analysis for the 7.2kV switchgear (1DA) and associated MCCs being fed from the 115kV grid thru transformers (XTF4 or XTF5). This analysis was used as bounding for all other configurations and alignments that are allowed by the plant design. The team determined that the evaluation failed to provide an adequate justification that this analysis was the most limiting. Additionally, the team identified that a significantly worst case configuration of Buses 1DA and 1DB being fed thru transformers XTF4 or XTF5 as allowed by TS was not analyzed. The licensee entered this issue into the corrective action program as condition report CR-11-01027.

2) The calculation determined that a minimum voltage of 119.5kV was required for the configuration of both trains (1DA and 1DB) being fed from one transformer supplied by the 115kV grid. The team identified that the licensee failed to verify that 119.5kV could be provided by transmission during times of peak load and minimum voltages. The licensee entered this issue into the corrective action program as CR-11-01027.

3) The calculation failed to adequately account for grid sag during large motor block starting during accident conditions. The team noted the inconsistent use of the grid thevenin equivalent circuit - which is used to model grid sagging during motor starting.

The licensee entered this issue into the corrective action program as condition report CR-11-01027.

4) The calculation used plant electrical loading as an input. The team, through discussions with transmission, identified that this input is different than the plant loading value that is used in the transmission operator's state estimator. The state estimator models the impact on the grid in case of a trip of the station's main generator. The licensee entered this issue into the corrective action program as CR-11-00991.

5) The calculation established the degraded voltage relay setpoints. In 2007, CR-07-00195 was initiated to address the failure to update the calculation when degraded voltage relays with different setpoints were installed. In 2010, as a result of CR-07-00195 and to account for the higher degraded voltage relay set points, the licensee completed Revision 23 of the calculation and added 0.009 per unit

(pu) to the 115kV and 230kV minimum grid requirements. The team identified that the licensee failed to perform an evaluation to verify the added 0.009 pu would be adequate for all configurations and alignments allowed by the FSAR. The licensee entered this issue into the corrective action program as CR-11-01027.

6) The calculation, as stated in the FSAR was performed using DAPPER software. The team noted that recent revisions to the calculation have been performed using ETAP PowerStation software without proper verification and validation as required by procedure CWP-003, "Computerware V&V Plans, Test Plans, and Periodic Test Plans." Additionally, the software is not listed in procedure DB-04, "Design Engineering Software Inventory". The licensee entered this issue into the corrective action program as CR-11-01027.

7) The calculation evaluated voltages during accident load sequencing and determined MCC terminal voltages.

The team identified that when determining the MCC terminal voltages, the licensee failed to evaluate the effects of MOVs that operate during the ECCS load sequencing. For example, MCC 1DBY2 would incur approximately an additional 225 amps of in-rush current during the initial accident initiated load block. As a result, non-conservative (too high) MCC voltages were used as a design input into calculation DC08200-003, Class 1E 480V MOV Starting Voltages at Degraded Voltage Conditions. The terminal voltages developed in Calculation DC08200-003 are used as a design input into the applicable mechanical thrust and torque calculations for MOVs. The licensee entered this issue into the corrective action program as CR-11-00631. See Green NVC in Section 1R21.2.9 of this report.

8) The calculation contained the write-up, methodology, results and conclusions. The team noted the calculation failed to include all attachments, sketches/model and retrievable computer runs that form the basis for the results and conclusions as required by procedure ES-412, "Initiation and Control of Design Calculations." The team determined that this information was necessary so that a qualified reviewer could verify that the worst case analyses were performed and that the model of the electrical power distribution system was correctly depicted. During the inspection the licensee performed additional computer runs and obtained data from a vendor. The licensee entered this issue into the corrective action program as CR-11-00750.

9) The calculation credits the use of a 115kV voltage-regulating transformer (XTF6) to ensure that the degraded voltage relays can be reset during accident load sequencing. Specifically, for the onsite safety-related distribution system being energized by the 115kV offsite power supply, the calculation credited operation of the non safety-related voltage regulating transformer XTF6 to regulate the pre-event voltage level to the 7.2kV safety buses to nominal (7200V) instead of the degraded grid relay setpoints specified in the Technical Specifications. The team noted that the calculation determined that the minimum 115kV grid voltage requirement was 9.5kV less than when XTF6 is not in service. The lower grid voltage requirement was used as a direct input into the plant/grid interface requirements with the transmission operator and was translated into plant procedure, AOP-301.01, Response to Electrical Grid Issues. The team determined that the calculation did not assess the effects of grid depression (main generator trip and ECCS loading) for tap positions less than 110% or operation of the 7.2kV safety buses at the minimum expected grid voltage without crediting the non safety-related voltage regulating equipment. The team noted that Draft NRC Regulatory Information Summary 2011-0013, "Adequacy of Station Electrical Distribution System Voltages, Degraded Voltage Relay Setting Design Calculations", states that no credit should be taken for voltage controlling equipment external to the Class 1E distribution system such as automatic load tap changers. Recent NRC inspection findings at Peach Bottom Atomic Station (Inspection Report 2010004) concluded that load tap changers are not safety-related and are subject to operational limitations and credible failures and cannot be relied on to protect and provide the required minimum voltage to all safety-related equipment during a design basis event. The licensee entered this issue into the corrective action program as condition report CR-11-01045.

As a result of the above observations, the team determined that the calculation was not adequate to provide reasonable assurance that a spurious separation from the grid would not occur and, that adequate voltages would be available to safety-related emergency core cooling system equipment during a design basis loss of coolant accident with offsite power available. The result of a spurious separation from the grid is that ECCS loads would be loaded onto the emergency diesel generators. The inspectors determined that the performance deficiency did not adversely affect the ability of the EDGs to energize ECCS components during a design bases event.

For the nine items listed above, the licensee completed a preliminary evaluation that was documented in Technical Work Record, "2011 NRC CDBI Issue Evaluation" dated March 14, 2011. The evaluation determined that no immediate safety concern exists, and discussed plans to revise the calculation within the next several months to address the nine issues. Additionally, for item 1 above, the licensee implemented an immediate corrective action of raising the offsite voltage limit by

.986 per unit for a specific offsite power alignment to ensure that the degraded voltage relay would reset. This alignment consisted of the "A" train being energized from the 115 kV offsite source via transformers XTF-4 in parallel with XTF-5, and with XTF-6 voltage regulator not in service.

Analysis:

The team determined that the use of non-conservative inputs and methodologies in electrical calculation DC08200-001 was a performance deficiency. Specifically, the nine examples of deficiencies in the calculation resulted in a reasonable doubt that a spurious separation from offsite power would occur and that adequate voltages would be available to safety-related emergency core cooling system equipment during a design basis loss of coolant accident with offsite power available. This finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding affected the availability of the offsite power feed from Transformer XTF-4 and/or XTF-5, and with XTF-6 voltage regulator not in service under specific minimum grid voltage conditions. These transformers are the normal offsite power supply to Safety Bus 1DA and the alternate supply to Safety Bus 1DB. Using Manual Chapter Attachment 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," the inspectors determined that the finding represented a potential loss of core decay heat removal safety function under the mitigating systems cornerstone conditional upon specific offsite power grid system voltage circumstances. The VC Summer SDP phase 2 pre-solved Worksheet did not have a suitable surrogate for this finding therefore a phase 3 SDP analysis was performed by a regional SRA. The phase 3 SDP analysis utilized the latest VC Summer NRC SPAR risk model and an exposure period of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> per year. The dominant sequence was a loss of DC Bus B with a failure of emergency feedwater and a failure to implement feed and bleed leading to core damage. The risk was mitigated by equipment available from Safety Bus 1DB and the short exposure period. The SDP phase 3 risk analysis result was an increase in core damage frequency of <1E-6 per year. The finding was characterized as GREEN, a finding of very low safety significance. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which requires, in part, "design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program." Contrary to the above, in March 1993 the licensee failed to verify the adequacy of a design calculation that was used to provide reasonable assurance that 10CFR50, Appendix A, General Design Criterion 17 requirements are met. Specifically the licensee's design control measures failed to verify or check the adequacy of design in Calculation DC08200-001, "ESF Undervoltage Logic and Settings" that was used to assure a spurious separation from offsite power would not occur and that adequate voltages would be available to safety-related emergency core cooling system equipment during a design basis loss of coolant accident. This finding was entered into the licensee's corrective action program as condition reports CR-11-00631, CR-11-00750, CR-01027, CR-11-00991 and CR-11-01045. Because this finding was determined to be of very low safety significance (Green) and was entered into the licensee's corrective action program, this violation is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000395/2011006-07, "Failure to Use the Most Limiting Design Inputs in an Electrical Calculation."

.2.11 Steam Generator (SG) Power Operated Relief Valve(s) (PORV)

a. Inspection Scope

The team reviewed the FSAR, TS, DBD, applicable plant calculations, and drawings to identify the design bases requirements of the SG PORVs. The team examined system health reports, records of surveillance testing and maintenance activities, and applicable corrective actions to verify that potential degradation or low margin design issues were being monitored, prevented and/or corrected. Additionally, the team reviewed station operating and off-normal response procedures to verify design bases requirements had been adequately translated into procedural instructions. After discussion with operations and system engineers, the team performed a walkdown of the valve areas to examine the visible material condition of the valves, and to verify that the installation was consistent with design basis documentation. The team reviewed design bases documentation, maintenance records, and drawings of the instrument air system to verify that the support function provided to the SG PORVs was consistent with design requirements. The team reviewed station emergency operating procedures, simulator timeline validation studies, and selected operator requalification training records for a postulated design bases steam generator tube rupture (SGTR) event to verify that SG PORV use and operation would be consistent with accident analysis assumptions documented in the FSAR. The team observed an operating crew's response to a SGTR event in the training simulator. The team also reviewed vendor hand wheel design and sizing criteria to verify the feasibility of local manual operation of the valve under bounding, design bases accident conditions.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action", for the licensee's failure to implement prompt corrective actions to ensure that SG primary to secondary break flow could be terminated within the accident analysis assumptions used for a design basis SGTR event.

Description:

On March 20, 1998, the licensee initiated CR-98-0262 which identified that the ability of operators to perform required actions within the time frames assumed in the plant's design and licensing basis accident analysis were not fully documented. One of the accident scenarios of concern was the 30 minute timeframe to isolate the affected SG following a design basis SGTR event. Initial attempts by the licensee to perform simulator timeline validations for SGTR were not successful due to simulator thermo/hydraulic modeling issues. The simulator modeling issues were corrected and, in October 2004, the licensee completed simulator timeline validation studies for SGTR events which confirmed that station system design and/or emergency operating procedures may not be sufficient to provide reasonable assurance that SGTR primary to secondary break flow could be terminated by operator actions within the 30 minutes assumed in the accident analysis and documented in section 15.4.3 of the FSAR. Simulator timeline validation data indicated SG termination of break flow times of 42 to 76 minutes. On October 20, 2004, resolution of the SGTR timeline issue was transferred from CR-98-0262 to a new condition report (CR-04-03328).

As a result of this concern, the licensee implemented compensatory measures in 2005 to administratively limit RCS activity to levels less than that required by TS until additional long term corrective action evaluations could be completed to support a license amendment request to extend the time required to isolate SGTR break flow. The remaining corrective actions identified in 2006 focused largely on developing a project plan to perform the necessary evaluations and studies to support either an engineering change request or license amendment request that would support an increase in operator response times to an acceptable value.

The team reviewed the corrective action history associated with CR-04-03328 and noted that the development of the project plan was initially "delayed due to higher priority items" and then subsequently revised two times before the action item was closed to another action item to track project implementation. Additionally, the team noted that in 2003 and 2004 the licensee completed initial thermodynamic/hydraulic and dose assessment evaluations for a design basis SGTR event. The preliminary evaluations required revision due to information from Westinghouse which identified potential errors in bounding decay heat assumptions used in SGTR margin to overfill analysis. The thermo/hydraulic analyses were later revised in 2009, using Westinghouse "best estimate" analysis methodology to support a license amendment request to extend operator response times for a SGTR event. The licensee concluded that their use of a best estimate approach for SGTR accident analysis would not account for instrument uncertainties associated with determining SG water mass and, therefore, would not establish a sufficient basis to support a license amendment request.

The team noted that the first time this issue was brought back to the corrective action review board (CARB) following identification in the 1998 and 2004 condition reports to evaluate the status of corrective actions was in August 2010. The licensee made the decision to bring the issue back to the CARB following questions from NRC inspectors regarding the reporting of RCS activity performance indicator data which did not include the lower administrative limits established by compensatory measures. A subsequent CARB review was held again in February 2011 and the CARB determined that additional timeline validation studies, procedure changes, training, plant modifications, accident analysis evaluations, and NRC approval of a license amendment request would be required to correct the condition. The team also reviewed a design engineering self-assessment performed in September 2009 which concluded that work in the accident analysis safety area was not being properly prioritized. The team reviewed CR-09-05709, which was generated as a result of the self-assessment, and noted that corrective actions to provide a revised safety analysis project plans were due in April, 2011 and, therefore, had not yet been completed at the time of the inspection. Additionally, the team observed an operating crew respond to a SGTR simulator scenario on February 14, 2011. During the course of the simulator scenario, the team noted that the initial cooldown of the reactor coolant system using the unaffected SG PORV began at 30 minutes following the tube rupture event and, therefore, did not meet accident analysis assumptions specified by the FSAR. The licensee entered this issue into their corrective action program as CR-11-00735.

Based on a review of the corrective action history for this issue over the last 12 years, the team concluded that although the licensee had worked on the preliminary evaluations and time studies necessary to support long term corrective actions, implementation of those measures identified above had not resulted in the completion of the effective and prompt corrective actions necessary to restore assurance that plant equipment and procedures would be adequate to mitigate a SGTR event. The licensee entered this concern into the CAP as CR-11-01031.

Analysis:

The licensee's failure to implement prompt and effective corrective actions to ensure that primary to secondary SGTR break flow could be terminated within the timeframes established by the FSAR accident analysis of record was a performance deficiency. The performance deficiency was greater than minor because it adversely affected the SSC/barrier performance, procedure quality, and human performance attributes of the barrier integrity cornerstone objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, the failure to complete timely corrective actions to ensure the adequacy of system design, emergency operating procedures, and/or licensing basis SGTR accident analyses challenged the assurance that those attributes would demonstrate sufficient protection for the consequences associated with a design basis SGTR event. The significance of the finding was screened using the barrier integrity column of IMC 0609, "Significance Determination Process", Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," and determined to be of very low safety significance (Green) because the finding did not represent

(1) the degradation of only the radiological barrier function provided for the control room/auxiliary building/spent fuel pool,

(2) the degradation of the barrier function of the control room against toxic atmosphere or smoke,

(3) an actual open pathway in the integrity of reactor containment or heat removal components, or

(4) an actual reduction in function of hydrogen igniters in the reactor containment. The team concluded through a review of corrective action records, self-assessment documents and interviews with licensee personnel that other emerging plant issues were given higher priority for resolution and competed with the availability of resources to fully implement corrective actions necessary to resolve the adverse condition. Because the licensee did not ensure that the necessary resources were available and adequate to maintain long term plant safety through the maintenance of design margins (by prompt implementation of actions identified through the corrective action program), this finding is assigned a cross-cutting aspect in the resources component of the human performance area H.2(a).

Enforcement:

10 CFR 50, Appendix B, Criterion XVI, "Corrective Action", requires, in part, that measures be established to assure conditions adverse to quality are promptly identified and corrected. Contrary to the above, on March 20, 1998, the licensee identified a condition adverse to quality which challenged the assurance that a ruptured SG could be isolated within the timeframe given by the SGTR accident analysis documented in section 15.4.3 of the FSAR and had failed to implement measures to assure the condition was corrected in a prompt manner. Because this violation was determined to be of very low safety significance and has been entered into the licensee's CAP as CR-04-03328 and CR-11-01031, it is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-11, "Failure to Implement Timely Corrective Actions to Address Design Bases Requirements for SGTR Event."

.2.12 Reactor Coolant Pump (RCP) Thermal Barrier Heat Exchanger Flow Transmitters

a. Inspection Scope

The team reviewed the FSAR, DBD, and system drawings to identify the design bases requirements of the RCP thermal barrier heat exchanger flow instruments. The team reviewed system flow diagrams, I&C drawings, elementary and schematic diagrams, instrument setpoint documents, as well as calibration procedures and test records to verify that the I&C were appropriately being monitored and maintained consistent with the design and licensing bases requirements.

b. Findings

No findings were identified.

.2.13 125vdc Bus DPN 1HA1

a. Inspection Scope

The team reviewed the direct current

(dc) sizing and loading calculation to verify that battery bank capacity was not exceeded. Additionally, the team reviewed the dc voltage calculations to verify that adequate voltage would be provided to all components under full load conditions during accident scenarios. The team also verified that the short circuit interrupting capability was adequate for associated breakers. The team interviewed the system engineer and performed a non-intrusive visual inspection of DC Bus DPN 1HA1 to assess the installed configuration and verify that degraded material conditions were being appropriately addressed. A review of associated corrective action history was performed to verify that degraded conditions were being appropriately addressed.

b. Findings

Introduction:

The team identified a Green non-cited violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, "Design Control" for the licensee's failure to adequately account for the in-rush current of the 7.2 kV breaker spring charging motors in a safety-related calculation. Specifically, the licensee used the steady-state current instead of the more limiting in-rush current in battery voltage drop calculation.

Description:

The licensee performed Calculation DC08320-010, "Class 1E 125 Volts DC System Voltage and Voltage Drop," Rev. 12 to provide assurance that components energized from the safety-related batteries would have adequate voltages during design bases events. The team determined that the licensee failed to use the most limiting current for the 7.2kV breaker spring charging motors. The licensee used the steady-state current of 14 amps instead of the more limiting in-rush current of 56 amps. A higher current causes a greater voltage drop across the cables and results in a decreased voltage to affected components. During the inspection, the licensee re-calculated the voltage available for the most limiting components. It was determined that 71.04vdc was available to the closing coil for the B service water pump breaker which is below the required 90vdc. The team noted that the vendor manual for the 7.2kV Magne-Blast circuit breaker specified the minimum pickup voltage for the closing coil was 90vdc, and that procedure EMP-405.001, "7.2K volts Circuit Breaker Maintenance", Rev. 20, verified that the circuit breaker closed instantaneously at the coil rated voltage of 90vdc.

By the end of the inspection, the licensee completed an operability determination which included conducting a test that determined a breaker of the same design would close with 61vdc. The licensee entered the issue into their corrective action program as CR 11-00989.

Analysis:

The failure of the licensee to use the more limiting in-rush current in the safety-related calculation is a performance deficiency. The performance deficiency was more than minor because it was similar to Inspection Manual Chapter (IMC) 0612, "Power Reactor Inspection Reports," Appendix E, "Examples of Minor Issues", Example 3j, which states that if "the engineering calculation error results in a condition where there is now a reasonable doubt on the operability of a system or component" the performance deficiency is not minor; and was more than minor because the performance deficiency adversely affected the mitigating systems cornerstone attribute of design control and adversely affected the cornerstone objective to ensure the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the deficiencies in Calculation DC08320-010 resulted in a reasonable doubt that the B service water pump breaker would not have reliably closed during a design bases event. The performance deficiency resulted in the breakers not being tested with the lower voltage (71.04vdc) that would be available during an event. In accordance with NRC IMC 0609.04,"Initial Screening and Characterization of Findings", the inspectors conducted a Phase 1 Significance Determination Process (SDP) screening and determined the finding to be of very low safety significance (Green) because it was a design deficiency confirmed not to result in the loss of operability or functionality, did not represent the loss of a system safety function and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event.

Through testing, the licensee determined that the affected breaker was capable of operation at 61vdc. A cross-cutting aspect was not identified because the finding does not represent current performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that design control measures provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, since at least May 31, 1989, the licensee failed to verify the adequacy of design in safety-related calculations used to provide assurance that adequate voltage would be available to operate safety-related equipment during design bases accidents. Specifically, in Calculation DC08320-010, the licensee used non-conservative in-rush currents when determining the capability of the safety-related batteries to operate a service water pump breaker during design bases events. The licensee entered the finding into their corrective action program as CR 11-00989. Because this violation was of very low safety significance and was entered into the licensee's corrective action program CR 11-00989, it is being treated as an NCV consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000395/2011006-09, "Failure to Adequately Account for the In-rush Current of the 7.2 kV Breaker Spring Charging Motors in a Safety-related Battery Voltage Drop Calculation."

.2.14 XTF1EA1 7200kV/480V Transformer and Output breaker

a. Inspection Scope

The team reviewed vendor nameplate and test information to verify that appropriate impedance data was used in voltage regulation and short circuit studies. Also, the team reviewed the protective relay calculation, setting sheets, and field settings to verify consistency with voltage regulation and short circuit studies. Coordination and short circuit calculations were reviewed along with maintenance and testing procedures to verify that design bases and design assumptions had been appropriately translated into calculations and procedures. The team reviewed periodic maintenance and testing practices to ensure that the equipment was maintained in accordance with industry practices.

System health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and that component replacement was consistent with in service/equipment qualification life. The team also performed a visual non-intrusive inspection to assess installation, configuration, observable material condition, and potential vulnerability to hazards.

b. Findings

No findings were identified.

.2.15 Switchyard Batteries and Cross-tie to Station Batteries

a. Inspection Scope

The team reviewed the DBD, related design bases support documentation, and operational requirements to identify the design bases requirements of the switchyard batteries and the station battery cross-tie. The team reviewed applicable plant operating procedures to ensure that risk significant functions could be performed.

In addition, the team reviewed periodic maintenance and testing practices to ensure that the equipment was maintained in accordance with industry practices.

System health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and that component replacement was consistent with in service/equipment qualification life. The team also performed a visual non-intrusive inspection to assess installation, configuration, observable material condition, and potential vulnerability to hazards.

b. Findings

No findings were identified.

.3 Operating Experience (5 Samples)

a. Inspection Scope

The team reviewed five operating experience issues for applicability at the Summer Nuclear Plant. The team performed an independent applicability review for these issues and where applicable, assessed the licensee's evaluation and dispositioning of each item. The issues that received a detailed review by the team included:

• NRC Information Notice 2009-10, Transformer Failures - Recent Operating Experience

• EA-10-080, Calvert Cliffs Event Involving Failure of Agastat Timing Relays, 08/03/2010

• H. B. Robinson, LER 2010-005-00: EDG Inoperable Due to Inverter Failure

• NRC Information Notice 2010-11, Steam Voiding Causing RHR Inoperability

• NRC Information Notice 2007-01, Recent Operating Experience Concerning Hydrostatic Barriers

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

On April 21, 2011, the team presented the inspection results to Mr. Gatlin and other members of the licensee's staff. Proprietary information that was reviewed during the inspection was returned to the licensee or destroyed.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

J. Garza, Licensing

C. Osier, Plant Support Engineering Supervisor

S. Shealy, Design Engineering Supervisor

NRC personnel

B. Desai, Chief, Engineering Branch Chief 1, Division of Reactor Safety, RII

LIST OF ITEMS

Opened and Closed

05000395/2011006-01 NCV Failure to Develop Procedures to Provide Starting Air to EDGs During a SBO Event (Section 1R21.2.1)

05000395/2011006-02 NCV Failure to Correctly Translate the Design Basis into Procedures for Low EDG Air Pressure and Low Thermal Barrier Heat Exchanger Flow (Section 1R21.2.2)

05000395/2011006-03 NCV Failure to Adequately Calculate Motor Actuator Output Torque and Control Circuit Voltages for MOVs (Section 1R21.2.3)

05000395/2011006-04 NCV Failure to Verify Adequacy of the Suction Lift for the Fuel Oil Transfer Pumps (Section 1R21.2.4.1)

05000395/2011006-05 NCV Failure to Develop a Procedure to Ensure an Emergency Diesel Generator Alarm Device was Calibrated or Tested (Section 1R21.2.4.2)

05000395/2011006-06 NCV Failure to Properly Test Emergency Feedwater Pump Discharge Check Valves (Section 1R21.2.5)

05000395/2011006-07 NCV Failure to Use the Most Limiting Design Inputs in an Electrical Calculation (Section 1R21.2.10)

05000395/2011006-08 NCV Failure to Implement Timely Corrective Actions to Address Design Bases Requirements for SGTR Event (Section 1R21.2.11)

05000395/2011006-09 NCV Failure to Adequately Account for the In-rush Current of the 7.2 kV Breaker Spring Charging Motors in a Safety-related Battery Voltage Drop Calculation (Section 1R21.2.13)