IR 05000261/2010011

IR 05000261-10-011; 8/30/2010 - 11/17/2010; H.B. Robinson Steam Electric Plant, Unit 2; Component Design Bases Inspection

ML103620338
Person / Time
Site:	Robinson
Issue date:	12/23/2010
From:	Binoy Desai NRC/RGN-II/DRS/EB1
To:	Duncan R Carolina Power & Light Co
References
IR-10-011
Download: ML103620338 (42)

Text

UNITED STATES ber 23, 2010

SUBJECT:

H.B. ROBINSON STEAM ELECTRIC PLANT - NRC COMPONENT DESIGN BASES INSPECTION - INSPECTION REPORT 05000261/2010011

Dear Mr. Duncan:

On November 17, 2010, U. S. Nuclear Regulatory Commission (NRC) completed an inspection at your H.B. Robinson reactor facility. The enclosed inspection report documents the inspection results, which were discussed with Mr. Curt Castell and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents seven NRC-identified findings of very low safety significance, six of which were determined to be violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the NRC Enforcement Policy because of their very low safety significance and because they were entered into your corrective action program. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the H.B. Robinson Steam Electric Plant. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at the H.B. Robinson Steam Electric Plant.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of

___ML103620338________ G SUNSI REVIEW COMPLETE OFFICE RII:DRS RII:DRS RII:DRS RII:DRS CONTRACTOR CONTRACTOR RII:DRP SIGNATURE RA RA RA RA RA RA RA NAME SWALKER PBRAXTON JEARGLE SSANDAL GSKINNER MYEMINY RMUSSER DATE 12/22 /2010 12/16 /2010 12/ 21 /2010 12/ 21 /2010 12/ 21 /2010 12/ 21/2010 12/ /2010 E-MAIL COPY? YES NO YES NO YES NO YES NO YES NO YES NO YES NO OFFICE RII:DRS SIGNATURE RA NAME BDESAI DATE 12/ /2010 E-MAIL COPY? YES NO

CP&L 3 cc w/encl:

S. D. West Division of Radiological Health Superintendent Security TN Dept. of Environment & Conservation H. B. Robinson Steam Electric Plant Electronic Mail Distribution Progress Energy Electronic Mail Distribution R. J. Duncan, II Vice President Joseph W. Donahue H. B. Robinson Steam Electric Plant Unit 2 Vice President Carolina Power & Light Company Nuclear Oversight Electronic Mail Distribution Carolina Power and Light Company Electronic Mail Distribution Sandra Threatt, Manager Nuclear Response and Emergency David T. Conley Environmental Surveillance Associate General Counsel Bureau of Land and Waste Management Legal Dept.

Department of Health and Environmental Progress Energy Service Company, LLC Control Electronic Mail Distribution Electronic Mail Distribution John H. O'Neill, Jr.

Vacant Shaw, Pittman, Potts & Trowbridge Vice President 2300 N. Street, NW Nuclear Operations Washington, DC 20037-1128 Carolina Power & Light Company Electronic Mail Distribution Susan E. Jenkins Director, Division of Waste Management Brian C. McCabe Bureau of Land and Waste Management Manager, Nuclear Regulatory Affairs S.C. Department of Health and Progress Energy Carolinas, Inc. Environmental Control Electronic Mail Distribution Electronic Mail Distribution Christos Kamilaris Tom Cosgrove Director Plant General Manager Fleet Support Services Carolina Power & Light Company Carolina Power & Light Company Electronic Mail Distribution Electronic Mail Distribution Robert P. Gruber Curt A. Castell Executive Director Supervisor Public Staff - NCUC Licensing/Regulatory Programs 4326 Mail Service Center Carolina Power & Light Company Raleigh, NC 27699-4326 Electronic Mail Distribution W. Lee Cox, III B. C. White Section Chief Manager Radiation Protection Section Support Services - Nuclear N.C. Department of Environmental Carolina Power & Light Company Commerce & Natural Resources Electronic Mail Distribution Electronic Mail Distribution (cc w/encl contd - See page 4)

CP&L 4 (cc w/encl contd)

Mark Yeager Division of Radioactive Waste Mgmt.

S.C. Department of Health and Environmental Control Electronic Mail Distribution Public Service Commission State of South Carolina P.O. Box 11649 Columbia, SC 29211 Chairman North Carolina Utilities Commission Electronic Mail Distribution Senior Resident Inspector U.S. Nuclear Regulatory Commission H. B. Robinson Steam Electric Plant 2112 Old Camden Rd Hartsville, SC 29550

Letter to Robert II from Binoy Desai dated December 23, 2010.

SUBJECT: H.B. ROBINSON STEAM ELECTRIC PLANT - NRC COMPONENT DESIGN BASES INSPECTION - INSPECTION REPORT 05000261/2010011

U. S. NUCLEAR REGULATORY COMMISSION

REGION II

Docket Nos.: 50-261 License Nos.: DPR-23 Report Nos.: 05000261/2010011 Licensee: Carolina Power and Light Company Facility: H.B. Robinson Steam Electric Plant, Unit 2 Location: 3851 West Entrance Road Hartsville, SC 29550 Dates: August 30 - November 17, 2010 Inspectors: S. Walker, Senior Reactor Inspector (Lead)

P. Braxton, Reactor Inspector J. Eargle, Reactor Inspector S. Sandal, Senior Reactor Inspector G. Skinner, Contractor M. Yeminy, Contractor Approved by: Binoy B. Desai, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000261/2010011; 8/30/2010 - 11/17/2010; H.B. Robinson Steam Electric Plant,

Unit 2; Component Design Bases Inspection.

This inspection was conducted by a team of four NRC inspectors from the Region II office, and two NRC contract inspectors. Seven findings of very low significance (Green)were identified during this inspection. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609,

Significance Determination Process (SDP). The cross-cutting aspects were determined using IMC 0310, Components Within the Cross Cutting Areas. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.

Cornerstone: Initiating Events

Green.

The team identified a finding having very low safety significance (Green)involving the failure to perform a post maintenance test to verify functionality of valve position permissive interlocks associated with the reactor coolant system (RCS) hot leg loop isolation valves. The licensee performed a visual inspection to verify that the associated contacts for the valve position permissive interlock function were in their expected open position, and is tracking further actions in the corrective action program under NCR 422032.

The failure to perform a post maintenance test to verify functionality of the permissive interlock associated with the RCS hot leg loop isolation valves following replacement of relays which affected that function was a performance deficiency. The finding was more than minor because it adversely affected the RCS and barrier performance attribute of the barrier integrity cornerstone objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events.

Specifically, the failure to verify functionality of the permissive interlocks for the RCS hot leg loop isolation valves following intrusive maintenance, challenged the assurance that the interlocks design function would be available to prevent opening of the RCS hot leg isolation valves with a flow path established to the RWST and; therefore, prevent a loss of RCS water inventory to the RWST. The finding was determined to be of very low safety significance because the finding would not have likely affected other mitigation systems resulting in a total loss of their safety function. Further, this finding did not constitute a violation of NRC requirements since the interlock function and associated components the licensee failed to test were not safety-related. The finding is assigned a cross-cutting aspect in the resources component of the human performance area in that complete, accurate, and up-to-date work packages were not provided

H.2(c). (Section 1R21.3)

Cornerstone: Mitigating Systems

Green.

The team identified a Green NCV of 10 CFR Part 50, Appendix B,

Criterion III, "Design Control," for the licensees failure to account for the high range of Emergency Diesel Generator (EDG) frequency allowed by technical specifications (TS) in the safety analysis. While no immediate operability issues were identified, the licensee entered this issue into the corrective action program as NCR 420058.

The failure to evaluate the effect of high EDG frequency was a performance deficiency. This finding was a more than minor because it affected the mitigating systems cornerstone attribute of design control to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences. This finding also closely parallels IMC 0612,

Appendix E, Example 3.j, "Not Minor: If the engineering calculation error results in a condition where there is now a reasonable doubt on the operability of a system or component, or if significant programmatic deficiencies were identified with the issue that could lead to worse errors if uncorrected." Specifically, failure to account for an allowable diesel frequency of 61.2 Hz (60 +2%) for all safety related pumps may result in operating at a higher flow rate and a higher developed suction head. This finding was of very low safety significance because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding the TS allowed outage time, and did not affect external event mitigation. The team also evaluated the finding for cross-cutting aspects and determined it to involve the area of Problem Identification and Resolution associated with Operating Experience for the licensees failure thoroughly evaluate NRC Information Notice 2008-02, which specifically identified high diesel frequency as a potential problem for AC motor-operated pumps P.2(a). (Section 1R21.2.1)

Green.

The team identified a Green NCV of 10 CFR Part 50, Appendix B,

Criterion XI, "Test Control," for the licensees failure to ensure the in-service testing(IST) of the discharge check valve of the Auxiliary Feedwater (AFW)steam driven pump applied an acceptance criterion that is in accordance with the limits established in design documents. The licensee revised the IST procedure during the inspection and is tracking further action in the corrective action program under NCR 419768.

The failure to establish proper acceptance criteria for the Steam Driven (SD)

AFW discharge check valve was a performance deficiency. This finding was more than minor because it affected the mitigating systems cornerstone attribute of procedure quality to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to incorporate the proper acceptance criteria could result in a failure of the test to identify a check valve degraded to a condition where its back leakage will cause reverse rotation of the SD AFW pump. This finding was of very low safety significance because it was not a test issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding the TS allowed outage time, and did not affect external event mitigation. The team determined that no cross cutting aspect was applicable to this performance deficiency because the failure to establish a proper acceptance criteria for the discharge check valve of the SDAFW pump was determined to not be indicative of current licensee performance. (Section 1R21.2.1)

Green.

The team a Green NCV of 10 CFR Part 50, Appendix B, Criterion III,

Design Control, for the licensees failure to have calculations supporting the design bases of safety related components, specifically for the EDG fuel oil storage tank with respect to tornado wind loadings, and the net positive suction head (NPSH) of the service water pumps. No immediate operability issues were identified and the licensee entered this issue into the corrective action program as NCR 422985 and NCR 423985.

The failure to demonstrate the adequacy of the design for safety related components, specifically regarding the capability of the fuel oil storage tank to withstand tornado wind loading and the failure to demonstrate that the NPSH available to the service water pumps was greater than the required NPSH, was a performance deficiency. This finding was more than minor because it affected the mitigating systems cornerstone attribute of design control to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences. This finding was of very low safety significance because the licensee performed a simplified evaluation indicating that this condition was not a design issue resulting in loss of function, it did not represent an actual loss of a system safety function, did not result in exceeding the TS allowed outage time, and did not affect external event mitigation. The team determined that no cross cutting aspect was applicable to this performance deficiency because the failure to demonstrate the adequacy of the design was determined to not be indicative of current licensee performance. (Section 1R21.2.4)

• Green: The team identified a Green NCV of 10 CFR Part 50, Appendix B,

Criterion III, "Design Control," for the failure to correctly translate the design basis of the EDG air start system into specifications. Specifically, the licensee did not properly translate the lowest air pressure for the EDG air start receiver that would provide a single EDG start into the TS (150 psig). The licensee reviewed the low pressure alarm history of the EDGs and did find any instance where they failed to declare the EDG inoperable based on the new operability setpoint. Further actions are being tracked in the corrective action program under NCR 423776.

The licensees failure to correctly translate the design basis of the EDG air start system into the TS was determined to be a performance deficiency. The finding was more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the EDG starting air receiver pressure could fall below 150 psig, but the TS would not direct the licensee to declare the EDG inoperable. The finding is of very low safety significance as it was determined not to have resulted in the loss of operability or functionality. The team determined that no cross cutting aspect was applicable to this performance deficiency because the failure was determined to not be indicative of current licensee performance. (Section 1R21.2.5)

Green.

The team identified a Green NCV of 10 CFR 50, Appendix B, Criterion V,

Procedures, Instructions and Drawings, for failure to follow procedure EGR-NGGC-006, Vendor Manuals, which requires performance of reviews to determine technical accuracy and potential changes to procedures, processes or equipment; specifically for safety related 480V Breakers and reactor trip breakers. The licensee performed a gap analysis, reviewed the discrepancies, and concluded that they did not impede the ability of the breakers from performing their associated function. Further actions are being tracked in the corrective action program under NCRs 422184 and 422976.

The team concluded that the failure to perform reviews to determine technical accuracy and potential changes to procedures for circuit breaker vendor manual changes was a performance deficiency. This finding is more than minor because it affects the mitigating systems cornerstone objective to ensure the reliability, availability, and capability of systems that respond to initiating events and is associated with the attribute of procedure quality, in that procedure inconsistencies were identified in procedures MST-012-1, Maintenance and Testing of A Reactor Trip Breaker, and PM-466, Westinghouse Type 50DH350E 1200 Amp 4160V Air Circuit Breaker Maintenance. This finding also closely parallels IMC 0612, Appendix E, Example 4.a., in that the procedure discrepancies indicate that the licensee routinely failed to perform reviews EGR-NGGC-006, Vendor Manuals, which requires performance of reviews to determine technical accuracy and potential changes to procedures, processes or equipment. The team determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of operability or functionality. The team also evaluated the finding for cross-cutting aspects and determined it to involve the area of Problem Identification and Resolution associated with Operating Experience for the licensees failure to thoroughly evaluate vendor recommendations, as well as NRC Information Notice 2008-02 which identified an issue relating to improper maintenance of circuit breakers involving failure to follow vendor maintenance recommendations P.2(b).

(Section 1R21.2.11)

Green.

The team identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control, in that the licensee failed to verify the adequacy of the design for Amptector trip devices installed on safety related 480V circuit breakers. The licensee reviewed the latest calibration records and contacted the vendor for further guidance and additional information. Further actions are being tracked in the corrective action program under NCR 423795.

The team determined that the failure to establish an adequate minimum setting for Amptector trip devices was a performance deficiency. The finding was more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Also, this finding closely parallels NRC IMC 0612, Appendix E, Example 3.j in that the condition resulted in reasonable doubt of the operability of the safety related 480V system pending re-analysis. Specifically, the licensee failed to evaluate margins needed to prevent spurious tripping during accident loading conditions. The team determined the finding was of very low safety significance because it was a design deficiency that did not result in a loss of operability or functionality. The team also evaluated the finding for cross-cutting aspects and determined it to involve the area of Human Performance, because this condition is related to the component of resources which requires complete, accurate and up-to-date design documentation, specifically calculations, to assure nuclear safety H.2(c).

(Section 1R21.2.11)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the licensees Probabilistic Risk Assessment (PRA). In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1 X10-6. The sample included seventeen components, four operator actions, and three operating experience items.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases had been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule (a)1 status, Regulatory Issue Summary (RIS)05-020 (formerly GL 91-18) conditions, NRC resident inspector input of problem equipment, System Health Reports, industry operating experience and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense-in-depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2.1 Auxiliary Feedwater Pumps

a. Inspection Scope

The team reviewed the design basis documentation, pump vendor manual, vendor correspondence, drawings, plant technical specifications (TS), and the Updated Final Safety Analysis Report (UFSAR) to identify design, maintenance, and operational requirements related to pump flow, developed head, achieved system flow, net positive suction head (NPSH), vortex formation and prevention, and minimum flow requirements.

These requirements were reviewed for pump operation with suction from the Condensate Storage Tank (CST) and with the availability of an alternate suction source in case the water supply from the CST is not available. The team reviewed design calculations as well as documentation of in-service testing and periodic surveillance tests to verify that design performance requirements were met. Additionally, the team reviewed maintenance, corrective action, and design change history to assess the potential for component degradation and the resulting impact on performance and design margins.

The team reviewed the adequacy and reliability of the suction source swap-over function from the preferred to the assured water source to determine whether the time constraints associated with valve closing and the operator actions associated with the process are consistent with design basis assumptions.

The team reviewed piping and instrumentation drawings (PI&D), vendor operation and maintenance manuals, the system Design Basis Document (DBD), and performed walk-down on portions of the auxiliary feedwater (AFW) system to verify that the installed configuration was consistent with design basis information. Additionally, the inspectors visually inspected the material condition of the pumps for any component degradation.

The team assessed the type and adequacy of check valves installed in vertical pipes and ascertained their capability to properly shut on cessation of flow.

The inspection team also reviewed the design, operation, and in-service testing of AFW discharge check vales to ascertain their capability to support unhindered system operation. The inspectors reviewed system operation during a loss of offsite power event and questioned the proper operation of the motor driven AFW pumps when powered by the emergency diesel generator (EDG).

b. Findings

Failure to Establish Proper In-service Testing Acceptance Criteria to Prevent Reverse Rotation of the SDAFW Pump

Introduction:

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for failure to establish an acceptance criteria in accordance with the limits established in design documents for the in-service testing of the discharge check valve of the steam-driven AFW (SDAFW) pump.

Description:

The inspectors observed the licensees test acceptance criterion applied in OST-702-3, Secondary Side Inservice Valve Test for Auxiliary Feedwater, Rev. 1, was to ensure a differential pressure of 725 psi or greater across the discharge check valve of the SDAFW pump. The team noted that the licensee did not have any analysis supporting this acceptance criterion with regard to

(1) translating the pressure differential to a reverse flow rate (back leakage) through the valve, and

(2) subsequently, requiring a verification that the SDAFW pump is not rotating backwards as a result of the potential back leakage. The potential back leakage may result in a reverse flow rate high enough to rotate the pump backwards. The licensees procedures, however, did already contain verification for potential reverse rotation for the motor driven AFW pumps. During the inspection, the licensee evaluated the reverse flow rate with respect to the established pressure differential and determined that it could be greater than 40 gpm, which is the minimum rate expected to rotate the pump backwards. Reverse rotation of the pump is a condition that may result in over-torquing the pump shaft beyond its limit upon a start signal, thus failing the pump to run. The licensee revised the in-service testing procedure OST-702-3 during the inspection and entered this issue into the corrective action program as NCR 419768.

Analysis:

The licensees failure to establish acceptance criteria supporting the design of the discharge check valve in-service testing and preventing possible reverse rotation of the SDAFW pump was a performance deficiency. This finding was determined to be of more than minor significance because it affected the mitigating systems cornerstone attribute of procedure quality to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to incorporate the proper acceptance criteria in the in-service test procedure of the check valve could result in a failure of the test to identify a check valve degraded to a condition where its back leakage will cause reverse rotation of the SDAFW pump. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green)because it was not a test issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding the TS allowed outage time, and did not affect external event mitigation. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion XI, Test Control, requires, in part, that a test program be established to ensure that structures, systems, and components perform satisfactorily in service and are performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Contrary to Criterion XI, prior to September 1, 2010, the licensee failed to properly translate a maximum allowable reverse flow rate through the check valve to a differential pressure across the valve such that reverse rotation of the SDAFW pump will be prevented at all times. Moreover, the test procedure did not require testing personnel to verify that the SDAFW pump was not reverse rotating during the test. Because the finding is of very low safety significance and was entered into the licensees corrective action program as Condition Report NCR 419768, the violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement policy (NCV 05000261/2010011-01, Failure to Establish Proper In-service Testing Acceptance Criteria to Prevent Reverse Rotation of the SDAFW Pump).

Failure to Ensure the Full Range of Emergency Diesel Generator Frequency is Accounted for in the Safety Analyses

Introduction:

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensees failure to analyze the performance of safety related pumps (e.g., motor-driven AFW pump) operating at an electrical alternating current up to the TS allowable range for EDG frequency of 61.2 Hertz.

Description:

The licensees TS allow unrestricted plant operation with EDG frequency up to 61.2 Hertz (60 +/-2%). During the inspection, the team identified this entire range was not accounted for in the safety analysis with regard to safety related motor operated pumps that could be loaded on the EDG in emergency situations. The performance of motor operated pumps varies with the angular speed of the pump which is directly affected by the frequency of the EDGs alternating current. The licensee did not account for safety related pumps operating at the high frequency range. The failure to account for an allowable diesel frequency of 61.2 Hz (60 +2%) for all safety related pumps may result in operating at 2% higher flow rate and 4% higher developed head. A 2% higher flow rate renders NPSH calculations non-conservative because centrifugal pumps require greater NPSH at a higher flow rate. Operating at a higher frequency will also render the vortex calculations non-conservative because vortex formation will occur earlier (at a higher tank water level). This also means that the water supply used by the pump is available for a shorter duration. In addition, diesel fuel oil will be consumed by the EDG at a greater rate, hence, making the available fuel oil lasting a shorter period.

The licensee entered this issue into the corrective action program as NCR 420058.

Analysis:

The licensees failure to ensure that the entire range of allowable diesel frequency was accounted for in the safety analysis was a performance deficiency. This finding was determined to be more than minor because it affected the mitigating systems cornerstone attribute of design control to ensure the availability, reliability, and capability of safety systems that respond to initiating events to prevent undesirable consequences.

This finding also closely parallels IMC 0612, Appendix E, Example 3.j, in that the engineering calculation error resulted in a condition where there was a reasonable doubt on the operability of a system or component, or if significant programmatic deficiencies were identified with the issue that could lead to worse errors if uncorrected. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green) because it was not a design issue resulting in loss of function, did not represent an actual loss of a system safety function, did not result in exceeding the Technical Specification allowed outage time, and did not affect external event mitigation.

The cause of this finding was directly related to cross cutting aspect of Systematic Evaluation of Operating Experience in the Operating Experience component of the Problem Identification and Resolution area, associated with Operating Experience, because the licensee had received NRC Information Notice 2008-02, which specifically identified the high diesel frequency as a potential problem for ac motor-operated pumps and the licensee failed to identify the applicability of this potential problem to the safety related motor operated pumps, including the motor driven AFW pumps, and take proper actions P.2(b).

Enforcement:

10 of CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to Criterion III, the licensee failed to properly account for the high range of EDG frequency allowed by TS in the safety analysis for the operation of safety related motor operated pumps (i.e., motor-driven AFW pumps) during subsequent loading on the EDG. Because this finding is of very low safety significance and was entered into the licensees corrective action program as Condition Report NCR 420058, this violation is being treated as a non-cited violation, consistent Section 2.3.2 of the NRC Enforcement Policy (NCV 05000261/2010011-02, Failure To Ensure that the Full Range of Emergency Diesel Generator Frequency is Accounted for in the Safety Analyses).

.2.2 Auxiliary Feedwater Flow Control Valves (FCV-1424 & FCV-1425)

a. Inspection Scope

The inspection team reviewed design calculations, design drawings, equipment specifications, vendor operating and maintenance instructions, and operating procedures supporting the installation, operation and maintenance of these flow control valves, including the operation of their hydraulic operators (hydramotors) to verify correct implementation of design bases. In addition, the inspectors reviewed the manual override of these hydramotors; cautions associated with the manual override; as well as operating procedures for the manual override, and verified the valves capability to operate automatically while the manual override is engaged. The inspectors reviewed the vendor recommended maintenance intervals and checked maintenance records to verify the schedule for maintenance and complete overhaul activities.

The inspectors walked down the AFW motor operated valves hydramotors, verified their position, their non-stop operation (they operate at all times including times when the system is not operating), and their operating temperature (not overheating).

b. Findings

No findings of were identified.

.2.3 Condensate Storage Tank

a. Inspection Scope

The inspectors reviewed the CST specification and tank drawings to verify material, nozzle, and vent connections. The inspection team also reviewed the total volume of water in the CST, and the volume available for AFW. These reviews included the lowest level at which water is added to the CST to increase inventory and the level at which water addition is stopped. The inspectors also reviewed these levels with respect to instrument uncertainties and the effect of the CST diaphragm (bladder) on the level indication and the associated setpoints of the level instruments. The inspectors reviewed the elevation of the suction lines to determine if a sufficient volume of water was available to achieve the CSTs stated safety function, considering the highest elevation of vortex formation.

The inspectors reviewed the expected life of the floating diaphragm, the effect of water temperature on its life expectancy, and its scheduled replacement. A review of the diaphragms history was conducted to verify if the diaphragm had ever failed catastrophically. A thorough evaluation of the diagram design was performed to verify that its failure would not result in sinking to the bottom of the tank and thereby block the suction nozzles of the AFW pumps. The inspectors also reviewed maintenance practices to determine if the licensee practiced nitrogen addition (between the water surface and the diaphragm), which could create additional pressure that may affect the reading of the level instrument. The inspection also included a walk-down of the Unit 2 CST and the suction piping of the AFW pumps.

b. Findings

No findings were identified.

.2.4 Emergency Diesel Generator - Fuel Oil Transfer

a. Inspection Scope

The team reviewed calculations (including hydraulic analysis), system diagrams, isometric drawings, equipment specifications, vendor manuals, certified capacity-head curve, and applicable UFSAR sections to verify correct implementation of design bases.

The team reviewed whether the hydraulic calculations used the correct data from engineering and component related documents, whether the data was applied correctly in the analysis, and whether instrument uncertainties were accounted for. The team also reviewed whether assumptions were properly documented, explained, justified, or confirmed; and whether the engineering calculations were correctly translated into procedures and limits of operation.

The team reviewed the design of the transfer pumps suction strainer, suction isolation valve, and discharge isolation valve, as well as their inspection records. The inspectors also reviewed the cleaning frequency of the suction strainers, and the head loss associated with them.

The inspectors reviewed how the licensee accommodated the use of ultra low sulfur diesel fuel oil, as well as the capacity of the fuel oil storage tank and the capability to transfer fuel oil from Unit 1 (fossil unit) to Unit 2. Finally, the team walked down the fuel oil storage tank, the transfer pumps, their isolation valves, and their strainers, to evaluate their material condition, their specific outdoor location and their protection from flooding and tornado wind loading.

b. Findings

Introduction:

The team identified two examples of a Green, NCV of 10 CFR 50, Appendix B, Criterion III, Design Control, for the licensees failure to possess calculations supporting the design bases of safety related components, specifically for the EDG fuel oil storage tank with respect to tornado wind loadings, and the NPSH of the service water pumps. The licensee entered this issue into the corrective action program as NCR 422985 and NCR 423985.

Description:

During the inspection, the team requested design documents to support the design of the EDG fuel oil storage tank with respect to its capability to withstand tornado wind loading, and design documents supporting the operation of the service water pumps with respect to NPSH. After further discussion, it was communicated by the licensee that these design documents could not be retrieved.

According to the inspectors review of design documents, the fuel oil storage tank must be designed, constructed, and erected with the capability to withstand tornado wind loading. The licensing basis of H. B. Robinson states that the design basis tornado intensities were obtained from NRC Regulatory Guide 1.76, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, and that region 1 locality intensities were considered since it has the most severe parameters. The UFSAR describes the maximum wind speed, the rotational speed, the translational speed of the tornado as well as its radius, the pressure drop across it, and the rate of pressure drop. Additionally, UFSAR Section 3.3.2.2 specifically discusses the Diesel Fuel Oil Storage Tank, stating that it was designed and evaluated for tornado wind loading (300 mph wind with -3 psi pressure). The actual evaluation document supporting this design bases was not identifiable by a document number and no such document could be found in plant records despite an extensive search. Design Bases Document, DBD/R87038/SD05, Emergency Diesel Generator System, Section 3.4.1, states EDGs components essential to the prevention or mitigation of the consequences of nuclear accidents shall be protected from, or designed to withstand, the forces reasonably imposed by extraordinary natural phenomena. The licensee entered this issue into the corrective action program as NCR 422985.

The service water pumps are designed to operate during design basis emergencies and deliver the design flow rate to all their safety related users. The operation of the service water pumps is limited in part by the NPSH available to them. When the available NPSH falls below the required NPSH for a specific flow rate, the pumps will experience extensive cavitation and can lead to failure. Furthermore, the NPSH available to the service water pumps is also used as a basis for determining the minimum allowable lake level for continued operation (a TS value). The actual evaluation document supporting this design bases was not identifiable by a document number and no such document could be found in plant records despite an extensive search. The licensee entered this issue into the corrective action program as NCR 423985.

Analysis:

The licensees failure to demonstrate adequacy of the design regarding the capability of safety related components, specifically, the EDG fuel oil storage tank to withstand tornado wind loading and the failure to demonstrate that the NPSH available to the service water pumps is greater than the NPSH required for their operation at the design flow rate, was a performance deficiency. This finding was determined to be more than minor because it was associated with the design control attribute of the mitigating system cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green) because during the inspection, the licensee performed preliminary evaluations indicating that these conditions are not design issues resulting in loss of function, they do not represent an actual loss of a system safety function, do not result in exceeding the TS allowed outage time, and do not affect external event mitigation. The team determined that no cross cutting aspect is applicable to this performance deficiency because it was not indicative of current licensee performance.

Enforcement:

10 of CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established to ensure that the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to Criterion III, as of September 29, 2010, the licensee failed to demonstrate the adequacy of the design with respect to the availability of diesel fuel oil under all conditions, and with respect to the capability of the service water pumps to operate as designed under all conditions. Because the finding was of very low safety significance and was entered into the licensees corrective action program as NCR 422985 and NCR 423985, the violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement policy (NCV 05000261/2010011-03, Failure to Demonstrate the Capability of the Fuel Oil Storage Tank and the Service Water Pumps to Fulfill Their Safety Functions Under All Conditions).

.2.5 Emergency Diesel Generator - Air Start

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of the pumps. Design calculations (i.e. minimum number of air start attempts, etc) and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the components performance capability and were appropriately incorporated into relevant drawings and procedures.

Component walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing basis assumptions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. The team examined maintenance rule documentation to verify that the system was properly scoped, and monitored.

Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

Introduction:

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the failure to correctly translate the design basis of the EDG air start system into specifications. Specifically, the licensee did not properly translate into the TS, the lowest air pressure necessary for the EDG air start receivers to provide a single, reliable EDG start.

Description:

In 1969, the licensee conducted pre-operational testing on the EDG air start system to show that it meets the FSAR requirements of having sufficient compressed air storage for eight cold engine starts. As a result of the testing, the licensee determined that the minimum air pressure in the air start receivers required for a single EDG start was 100 psig. This number was translated into the licensees TS, and the TS directed the licensee to declare the EDG inoperable if the starting air receiver pressure falls below 100 psig.

The team reviewed the pre-operational testing results, and found that not all of the tests indicated that 100 psig was adequate pressure to start the EDG. The team found that two out of the three documented tests indicated that the diesel failed to start at pressures greater than 100 psig. The team also determined that the test was not adequate to determine the lowest air pressure to provide a single start because the EDG had been preconditioned by being started multiple times before failing to start at a reduced pressure. This preconditioning reduced the friction that would have to be overcome if the EDG had been idle since the last completed surveillance run.

The team reviewed the EDG vendor manual and determined that the vendor specifies a minimum starting air pressure of 150 psig. The licensee contacted the vendor about the minimum pressure, and the vendor confirmed that a 150 psig minimum air start receiver pressure is needed to ensure reliable starting of the EDGs.

The licensee entered the issue into their correction action program as NCR 423776 and subsequently, developed and implemented a standing instruction to declare the EDGs inoperable when starting air receiver pressure falls below 150 psig. As part of the corrective actions, the licensee is developing a TS change to the EDG starting air receiver low pressure operability limit. The licensee has reviewed the low pressure alarm history of the EDGs and has not found any instances where they failed to declare the EDG inoperable when the EDG starting air receiver pressure was below 150 psig.

Analysis:

The licensees failure to correctly translate the design basis of the EDG air start system into the TS was determined to be a performance deficiency. The finding was more than minor because if left uncorrected, the performance deficiency could have the potential to lead to a more significant safety concern. Specifically, the EDG starting air receiver pressure could fall below 150 psig, but the TS would not direct the licensee to declare the EDG inoperable for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or until pressure reaches 100 psig. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green) since it was a design deficiency determined not to have resulted in the loss of operability or functionality. The team determined that no cross cutting aspect is applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be established to assure that the design basis is correctly translated into specifications. Contrary to the Criterion III, since plant start-up, the licensee failed to correctly translate the EDG air start system design requirements into specifications.

Specifically, the licensee did not properly translate the lowest air pressure for the EDG air start receiver that would provide a single, reliable EDG start into the TS. Because the violation was of very low safety significance and was entered into the licensees corrective action program as NCR 423776, this violation is being treated as a green non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy (NCV 05000261/2010011-04, Failure to Correctly Translate EDG Starting Air System Design Requirements into TS).

.2.6 Service Water Pumps

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of the pumps. Design calculations (i.e. minimum flow and NPSH) and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the components performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing basis assumptions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings were identified.

.2.7 Service Water Pump Discharge Check Valves (SW-374, 375, 376, & 377)

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of the valves. Calculations supporting the installed system capability were reviewed to verify that design bases and assumptions were appropriately translated and that conclusions supported overall system capability. The team conducted component walkdowns to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. The team examined maintenance rule documentation to verify that the check valves were properly scoped, and monitored. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings were identified.

.2.8 Component Cooling Water Check Valves (CC-702A, CC-702B, & CC-702C)

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, and P&IDs to establish an overall understanding of the design bases of the valves. Calculations supporting the installed system capability were reviewed to verify that design bases and assumptions were appropriately translated and that conclusions supported overall system capability.

Component walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. The team examined maintenance rule documentation to verify that the check valves were properly scoped, and monitored. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings were identified.

.2.9 Startup Transformer

a. Inspection Scope

The team reviewed load flow calculations to determine whether the capacity of the transformer was adequate to supply worst case accident loads. The team reviewed calculations and operating procedures to determine whether transformer taps and administrative controls for switchyard voltage were adequate to assure the availability of offsite power during accident conditions. The team reviewed maintenance schedules, procedures, and completed work records to determine whether the transformer was being properly maintained. The team reviewed corrective action histories to determine whether there had been any adverse operating trends. The team reviewed results of transformer analysis following the March 2010 fire event to determine if the transformer was stressed or degraded. In addition, the team performed a visual inspection of the startup transformer to assess material condition and the presence of hazards.

b. Findings

No findings were identified.

.2.10 480V Emergency Bus E-1

a. Inspection Scope

The team reviewed bus loading calculations to determine whether the 480V system had sufficient capacity to support its required loads under worst case accident loading and grid voltage conditions. The team reviewed the design of the 480V bus degraded voltage protection scheme to determine whether it afforded adequate voltage to safety related devices at all voltage distribution levels. This included review of degraded voltage relay setpoint calculations, motor starting and running voltage calculations, and motor control center (MCC) control circuit voltage drop calculations. It also included review of undervoltage tripping logic and testing procedures to determine whether the scheme would perform as intended. The team reviewed procedures and completed surveillances for calibration of the degraded voltage relays to determine whether acceptance criteria was consistent with design calculations, and to determine whether relays were performing satisfactorily. The team reviewed operating procedures to determine whether the limits and protocols for maintaining offsite voltage were consistent with design calculations. The team reviewed the licensees response to NRC Generic Letter 2006-02, Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power, to determine whether current procedures for maintaining the availability of offsite power were consistent with licensee responses. The team reviewed the 480V system grounding scheme including ground resistor sizing calculations and ground isolation procedures to determine whether the system was subject to damage from overvoltages caused by single line to ground faults. The team reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends.

In addition, the team performed a visual inspection of the 480V safety buses to assess material condition and the presence of hazards.

b. Findings

No findings were identified.

.2.11 Emergency Bus E-1 and E-2 Normal Supply Breakers (52/18B & 52/28B)

a. Inspection Scope

The team reviewed bus load flow calculations to determine whether the breakers were applied within their specified capacity ratings under worst case accident loading and grid voltage conditions. The team reviewed short circuit calculations to determine whether the circuit breakers were applied within their specified ratings. The team reviewed schematic diagrams and calculations for the 480V Amptector trip devices to ensure that equipment was adequately protected, loads were not subject to spurious tripping, and to determine whether proper coordination was maintained. The team reviewed recent corrective action documents; and completed maintenance and testing records, to determine whether there were any adverse operating trends. In addition, the team performed a visual inspection of the 480V buses to assess material condition and the presence of hazards.

b. Findings

Inadequate Criteria to Prevent Spurious Actuation of Amptector Trip Devices

Introduction:

The team identified a Green, non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, in that the licensee failed to verify the adequacy of the design for Amptector trip devices installed on safety related 480V circuit breakers.

Specifically, the licensee failed to evaluate margins needed to prevent spurious tripping of the breakers during accident loading conditions.

Description:

Calculations RNP-E-2.009 and RNP-E-2.010 determined settings for Amptector trip devices used for the incoming feeder breakers from the EDG and the normal offsite power supply, respectively, to the safety related 480V buses. The team noted that the calculations did not address the margin required to prevent tripping of the breakers under accident loading conditions. Westinghouse Maintenance Program Manual, MPM-DB states that the accuracy of the WESTECTOR/Amptector I-A trip unit is approximately plus or minus 10%. The calculations established the long time trip device setting for both breakers at a 1.15 time sensor rating, equivalent to 4600 primary amps.

When this setting was incorporated into procedure PM-402, Inspection and Testing of Circuit Breakers for 480 Volt Bus E-1, the as-left setpoint tolerance was established as 4140 to 5060 (4600 +/-10%) amps for diesel generator output breaker 52/17B, and 4320 to 5060 (4600 +10%/-6%) amps for Bus E-1 main breaker 52/18B. However, because of the calibration technique used (secondary current injection), the majority of the Apmtectors +/-10% tolerance must be applied in addition to the as-left setting. The team concluded that if the Amptectors were left at the lowest settings allowed by the procedure, the diesel generator breaker could trip at a current as low as approximately 3726 amps and the main circuit breaker could trip at a current as low as approximately 3888 amps. These values are well below the Bus E-1 load current of approximately 3829 amps when on the diesel generator at maximum frequency, and approximately 3993 amps when connected to the offsite power supply with switchyard voltage at the lower end of the normal range. This condition could have resulted in the loss of offsite power to the safety bus while switchyard voltage was within its expected range, and the subsequent tripping of the EDG output breaker, resulting in a loss of all AC power to the safety bus.

In response to the teams concerns the licensee obtained preliminary data from the vendor indicating that the tolerance for the Robinson Amptectors, based on actual maintenance and testing equipment used, was approximately +/-7%, instead of the published +/-10%. The licensee reviewed the latest calibration records for the Amptectors and determined that with the actual as-left setpoints, and the revised tolerance provided by the vendor, the breakers would not trip under accident loading conditions. The licensee documented this finding in NCR 423795.

Analysis:

The team determined that the failure to establish an adequate minimum setting for Amptector trip devices was a performance deficiency that was reasonably within the licensees ability to foresee and prevent. The finding was more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. This finding also closely parallels IMC 0612, Appendix E, Example 3.j, because the condition resulted in reasonable doubt of the operability of the 480V safety buses and their offsite power supply pending re-analysis. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality. The team determined the cause of this finding was directly related to the cross cutting aspect of Complete and Accurate Design Documentation in the Resources component of the Human Performance area because specific calculations to assure nuclear safety, Calculations RNP-E-2.009 and RNP-E-2.010, were last revised on 1/8/2009 and Procedure PM-402 was revised on 5/31/2010, without being updated to include the necessary and accurate trip device settings H.2(c).

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, requires, in part, that measures be provided for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program, and to ensure that the design is correctly translated into specifications, drawings, procedures, and instructions.

Contrary to Criterion III, as of September Robinsons design control measures did not verify the adequacy of the design for the Amptector trip devices on safety related 480V circuit breakers. Specifically, Robinson did not establish minimum settings to prevent spurious tripping under accident loading conditions. Because this violation is of very low safety significance and has been entered into Robinsons corrective action program (NCR 423795), it is being treated as a non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy (NCV 05000261/2010011-05, Inadequate Criteria to Prevent Spurious Actuation of Amptector Trip Devices).

Failure to Translate Vendor Recommendations Into Procedures

Introduction:

The team identified a Green, non-cited violation of 10 CFR 50, Appendix B, Criterion V, Procedures, Instructions and Drawings, with two examples, for failure to follow procedure EGR-NGGC-006, Vendor Manuals, which requires performance of reviews to determine technical accuracy and potential changes to procedures, processes or equipment; specifically for safety related 480V Breakers and the reactor trip breakers.

Description:

The team identified inconsistencies between the vendor maintenance recommendations contained in Westinghouse Maintenance Program Manual MPM-DB and Robinson procedures for the emergency bus 480V breakers. The team initially noted that the 4000 cycle service life requirement for type DB50 breakers listed in Section 5.1 of the vendor manual had not been incorporated into preventive maintenance procedure PM-466, Westinghouse Type 50DH350E 1200 Amp 4160V Air Circuit Breaker Maintenance. Specifically, the procedure did not require recording the number of operating cycles on the breakers, or comparing them to acceptance criteria. As part of an extent of condition review, the team noted that Procedure MST-012-1, Maintenance and Testing of A Reactor Trip Breaker, similarly did not require evaluating the number of breaker operating cycles. In response to the teams request, the licensee performed a gap analysis for the reactor trip breakers to identify other discrepancies between vendor recommendations and licensee specific procedures. This analysis revealed several other discrepancies including missed visual inspections, missed dimensional measurements, and missed contact resistance measurements. In response to these findings, the licensee performed a preliminary extrapolation of the number of operating cycles on the emergency bus 480V breakers and concluded that none of them had exceeded the vendor recommendation. The reactor trip breakers were equipped with cycle counters and a review of maintenance records by the licensee showed that they had also not exceeded the maximum number of cycles. In addition, the licensee reviewed the discrepancies identified in MST-012-1 and concluded that they did not impede the ability of the reactor trip breakers from performing their trip function. The licensee documented these findings in NCRs 422184 and 422976.

Analysis:

The team concluded that the failure to perform reviews to determine technical accuracy and potential changes to procedures for circuit breaker vendor manual changes was a performance deficiency. This finding was determined to be more than minor because it affects the mitigating systems cornerstone objective to ensure the reliability, availability, and capability of systems that respond to initiating events and is associated with the attribute of procedure quality, in that procedure inconsistencies were identified in procedures MST-012-1, Maintenance and Testing of A Reactor Trip Breaker, and PM-466, Westinghouse Type 50DH350E 1200 Amp 4160V Air Circuit Breaker Maintenance.

This finding also closely parallels IMC 0612, Appendix E, Example 4.a., in that the procedure discrepancies indicate that the licensee routinely failed to perform reviews EGR-NGGC-006, Vendor Manuals, which requires performance of reviews to determine technical accuracy and potential changes to procedures, processes or equipment. The team screened this finding in accordance with IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and determined the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of operability or functionality. The cause of this finding was related to the cross-cutting aspect of Systematic Evaluation of Vendor Recommendations in the Operating Experience component of the Problem Identification and Resolution area, specifically with respect to including vendor recommendations in procedures to support plant safety. In addition, NRC IN-2008-02 identified an issue relating to improper maintenance of circuit breakers involving failure to follow vendor maintenance recommendations P.2(b).

Enforcement:

10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality be prescribed by documented instructions, procedures, and drawings of a type appropriate to the circumstances and be accomplished in accordance with these instructions and procedures. EGR-NGGC-006, Vendor Manuals, requires performance of reviews to determine technical accuracy and potential changes to procedures, processes or equipment. Contrary to Criterion V, as of September 16, 2010, activities affecting quality were not accomplished in accordance with prescribed procedures, in that the licensee did not perform an adequate review of MST-012-1 or PM-466, to identify deviations between the vendor manual and the maintenance procedures. Because this violation was of very low safety significance and has been entered into the licensees corrective action program (NCRs 422184 and 422976), it is being identified as a non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy (NCV 05000261/2010011-06, Failure to Translate Vendor Recommendations Into Procedures for 480V Circuit Breakers).

.2.12 4KV Bus Feeder Breakers (52/7 & 52/12, 52/17, 52/19, 52/20) and 480V Breakers

(52/15B &16B)

a. Inspection Scope

The team reviewed bus load flow calculations to determine whether the breakers were applied within their specified capacity ratings under worst case accident loading and grid voltage conditions. The team reviewed short circuit calculations to determine whether the circuit breakers were applied within their specified ratings. The team reviewed schematic diagrams and calculations for 480V and 4160V bus protective relays to ensure that equipment was adequately protected, loads were not subject to spurious tripping, and to determine whether proper coordination was maintained. The team reviewed recent corrective action documents and completed maintenance and testing records to determine whether there were any adverse operating trends. In addition, the team performed a visual inspection of the 480V and 4160V buses to assess material condition and the presence of hazard

b. Findings

No findings were identified.

.2.13 Station Battery A

a. Inspection Scope

The team reviewed station battery A design calculations to verify that the battery sizing would satisfy the requirements of the safety related and risk significant DC loads, and that the minimum possible voltage was taken into account. In particular, the review focused on verifying that the battery was adequately sized to supply the design duty cycle of the 125 VDC system for the loss-of-coolant accident/loss-of-offsite power (LOCA/LOOP)loading scenarios, and that adequate voltage would remain available for the individual load devices required to operate during the scenarios duration. Plant drawings were reviewed to ensure that all loads were considered. The station battery A charger sizing calculations were reviewed to evaluate whether it was consistent with the design and licensing basis.

In addition, a visual non-intrusive inspection of the station batteries and associated charger was performed to assess the installation configuration, material condition, and room temperatures were within specified design temperature ranges. Modification history was reviewed to identify changes to the battery/charger system and potential effect on the design basis for the battery. The team reviewed battery test procedures and results to determine whether test acceptance criteria and frequency requirements specified in technical specifications and appropriate standards were satisfied. Engineers were interviewed regarding design aspects and operating history for the battery, and a sample of condition reports was selected to verify that the design and testing issues related to station battery A were adequately addressed.

b. Findings

No findings were identified.

.2.14 Dedicated Shutdown Emergency Diesel Generator

a. Inspection Scope

The team reviewed drawings, TS, USFAR, and related design basis documents to identify design maintenance and operational requirements for the dedicated shutdown emergency diesel generator and its associated motor driven fuel oil transfer pump.

Maintenance history, as demonstrated by system health reports, corrective maintenance documentation, Maintenance Rule monitoring, condition reports, and surveillance tests results, were reviewed to verify the design bases have been maintained; to verify that potential degradation was being monitored; and that identified degradation or malfunctions had been adequately addressed. The team reviewed the preventive maintenance history and schedule to verify it was consistent with vendor requirements.

Additionally, the team conducted a field walkdown of the diesel generator and fuel oil transfer pump with cognizant engineers to verify that the installed configuration was consistent with the design basis and plant drawings.

b. Findings

No findings were identified.

.2.15 Emergency Diesel Generator Breakers (52/17B & 52/27B)

a. Inspection Scope

The team reviewed DBDs, drawings, calculations, the UFSAR, breaker specifications, and name plate data to verify that 480V breakers, 52/17B and 52/27B, were capable of performing their intended functions. The team reviewed the Westinghouse DS-100 breaker maintenance and vendor technical update to determine whether vendor requirements have been incorporated into station maintenance and surveillance procedures. Completed maintenance and surveillance documentation was reviewed to verify that anomalies were properly documented, resolved, and TS periodicity requirements were met. The team reviewed related corrective actions to verify appropriate actions had been taken for adverse conditions and to note any adverse trends. Interviews were also conducted with engineering personnel to assess the long-term health of the circuit breakers and assess the proper use of operating experience and scheduled maintenance on the circuit breakers.

b. Findings

No findings were identified.

.3 Review of Low Margin Operator Actions

a. Inspection Scope

The team performed a margin assessment and detailed review of four risk significant and time critical operator actions. Where possible, margins were determined by the review of the assumed design basis and UFSAR response times. For the selected operator actions, the team performed a walkthrough of associated End Path Procedures (EPPs),

Abnormal Operating Procedures (AOPs), Annunciator Panel Procedures (APPs), and other operations procedures with plant operators and engineers to assess operator knowledge level; adequacy of procedures; availability of special equipment when required; and the conditions under which the procedures would be performed. Detailed reviews were also conducted with operations and training department leadership.

Observation and utilization of a simulator training period to was used to further understand and assess the procedural rationale and approach to meeting the design basis and UFSAR response and performance requirements. Operator actions were observed on the plant simulator and during plant walkdowns. Selected operator actions associated with the following events/evolutions were reviewed:

• Operator actions for transfer to cold leg recirculation

• Operator actions for transfer of charging pump suction to RWST

• Operator actions for primary bleed and feed

• Operator actions for aligning alternate sources of water to AFW

b. Findings

Introduction:

The team identified a Green finding for the licensees failure to test the function of the 33bcx relays for the SI-862A/B and SI-863A/B valves following replacement of the relays and return to service on October 22, 2008. Specifically, the licensee implemented work orders to replace the 33bcx relays (whose function was to establish a permissive interlock that requires the refueling water storage tank (RWST)isolation valves to be closed prior to allowing the reactor coolant system (RCS) hot leg isolation valves to be opened); and failed to implement a post maintenance test which verified the interlock was functional prior to returning the system to service.

Description:

During performance of the inspection, the team questioned the licensee regarding the functional design basis and testing of the 33bcx relays which are associated with a permissive valve position interlock used to prevent opening of the RCS hot leg isolation valves RHR-750 and RHR-751 when

(1) either residual heat removal (RHR) suction isolation valves to the RWST (SI-862A or SI-862B) are open, or

(2) either RHR to high head safety injection (HHSI)/containment spray valves (SI-863A or SI-863B) are open. The team reviewed station documents including DBD/R87038/SD02, Design Basis Document Safety Injection System, and determined the function of the valve position permissive interlock was to prevent the potential for an inadvertent transfer of RCS water to the RWST when the RHR system is being aligned to provide the shutdown cooling function.

As a result of the teams questions regarding whether or not this valve position interlock function had ever been tested, the licensee found four completed work orders (01124144, 01124145, 01124146, and 01124147) which were implemented to replace the 33bcx relays for SI-862A/B and SI-863A/B. Following replacement of the 33bcx relays, the licensee performed a post maintenance test on October 22, 2008 using procedure OST-257, RHR Loop Valves Interlock Test (Refueling), and returned the system to service. The team discovered that the purpose of OST-257; however, was to test the permissive pressure interlocks associated with SI-862A, SI-862B, SI-863A, SI-863B, RHR-750, and RHR-751, and not the valve position interlocks. The pressure permissive interlocks prevent SI-862A, SI-862B, SI-863A, and SI-863B from being opened if RHR loop pressure is greater than 210 psig to protect RWST piping from the potential for over-pressurization. An additional pressure interlock prevents RHR-750 and RHR-751 from being opened if RCS pressure is greater than 474 psig to protect RHR suction piping from the potential for over-pressurization. The team concluded that test procedure OST-257 did not test the valve position permissive interlock function associated with the 33bcx relays which were replaced by the maintenance activity. The licensee entered this issue into the corrective action program as NCR 422032.

The team reviewed station emergency operating procedures for sub-cooled recovery from a steam generator tube rupture (SGTR) event using RHR and determined that unavailability of the interlock function would result in a plant configuration where an operator error (failure to perform step 10.b of Supplement I, Aligning RHR System for Core Cooling Mode, to close SI-862A or SI-862B) would result in an open flow path from the RCS to the RWST when RHR-750 and RHR-751 are subsequently opened to align RHR for the shutdown cooling mode of operation.

As a result of the concern regarding interlock functionality, the licensee implemented WO 01829389 on September 29, 2010 to visually verify that the 33bcx relay plungers were in their de-energized positions and that the associated contacts for the valve position permissive interlock function were in their expected open positions. The team concluded that the visual inspections of the 33bcx relays provided assurance that the interlock function would be available pending completion of an interlock functionality test to be performed following the next plant shutdown.

Analysis:

The licensees failure to verify functionality of the interlock associated with the 33bcx relays in the SI-862A/B, SI-863A/B, RHR-750, and RHR-751 valve control circuits through the performance of an inadequate post maintenance test was a performance deficiency. The finding was more than minor because it adversely affected the RCS and barrier performance attribute of the barrier integrity cornerstone objective to provide reasonable assurance that physical design barriers protect the public from radionuclide releases caused by accidents or events. Specifically, the failure to verify functionality of the permissive interlocks for the RHR-750, and RHR-751 valves following maintenance which had the potential to affect those interlocks, challenged the assurance that the interlocks design function would be available to prevent opening of the RCS hot leg isolation valves with a flow path established to the RWST and; therefore, prevent a loss of RCS water inventory to the RWST. Because the finding represented an intermediate system loss of coolant accident (ISLOCA) event initiator contributor, the finding was screened using IMC 0609, Significance Determination Process, Attachment 4, Phase 1 - Initial Screening and Characterization of Findings, and was determined to be of very low safety significance (Green) because the finding would not have likely affected other mitigation systems resulting in a total loss of their safety function. Specifically, the visual verification of the 33bcx relay and contact states performed on September 29, 2010 provided assurance that the permissive interlock function was not adversely affected by the finding. The cause of this finding was related to the cross-cutting aspect of Complete, Accurate, and Up-to-date Documentation in the Resources component of the Human Performance Area because the work order instructions used to replace the relays did not specify guidance to adequately test the interlock function following completion of the maintenance H.2(c).

Enforcement:

Enforcement action does not apply because the performance deficiency did not result in a violation of a regulatory requirement since the interlock function and associated components the licensee failed to test were not safety-related. The licensee entered this issue into the corrective action program as NCR 422032. Because this finding does not involve a violation and has very low safety significance, it is identified as (FIN 05000261/2010011-07, Failure to Implement Adequate Post Maintenance Test of Residual Heat Removal Valve Interlock Function).

.4 Review of Industry Operating Experience

a. Inspection Scope

The team reviewed selected operating experience issues that had occurred at domestic and foreign nuclear facilities for applicability at the Robinson Nuclear Plant. The team performed an independent applicability review for issues that were identified as applicable to the Robinson Nuclear Plant and were selected for a detailed review. The issues that received a detailed review by the team included:

• IN 86-09, Check and Stop-Check Valve Obstructing Flow

• IN 2002-01, Metalclad Switchgear Failures and Consequent Losses of Offsite Power

• IN 2006-06, Loss of Offsite Power and Station Blackout are More Probable during Summer Period

• IN 2007-14, Loss of Offsite Power and Dual-Unit Trip at Catawba Nuclear Generating Station

• Bulletin 88-04, Potential Safety-Related Pump Loss

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

On September 30, 2010, the team presented preliminary inspection results to members of the licensees staff. Proprietary information that was reviewed during the inspection was returned to the licensee.

A final review of information provided to the team was performed on November 17, 2010 and the results of open inspection items were presented to Mr. Castell and other members of the licensees staff.

ATTACHMENT: SUPPPLEMENTAL INFORMATION

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

C. Castell, Licensing Supervisor

B. Peavyhouse, Design Engineering Manager

G. Sanders, Licensing

NRC personnel

J. Hickey, Senior Resident Inspector, Robinson

B. Desai, Chief, Engineering Branch Chief 1, Division of Reactor Safety, RII

LIST OF ITEMS

Opened and Closed

05000261/2010011-01 NCV Failure to Establish Proper In-service Testing Acceptance Criteria to Prevent Reverse Rotation of the SDAFW Pump (Section 1R21.2.1)

05000261/2010011-02 NCV Failure To Ensure that the Full Range of Emergency Diesel Generator Frequency is Accounted for in the Safety Analyses (Section 1R21.2.1)

05000261/2010011-03 NCV Failure to Demonstrate the Capability of the Fuel Oil Storage Tank and the Service Water Pumps to Fulfill Their Safety Functions Under All Conditions (Section 1R21.2.4)

05000261/2010011-04 NCV Failure to Correctly Translate EDG Starting Air System Design Requirements into TS (Section 1R21.2.5)

05000261/2010011-05 NCV Inadequate Criteria to Prevent Spurious Actuation of Amptector Trip Devices (Section 1R21.2.11)

05000261/2010011-06 NCV Failure to Translate Vendor Recommendations Into Procedures for 480V Circuit Breakers (Section 1R21.2.11)

05000261/2010011-07 FIN Failure to Implement Adequate Post Maintenance Test of Residual Heat Removal Valve Interlock Function (Section 1R21.3)