IR 05000338/2009007

IR 05000338-09-007 & 05000339-09-007; on 11/2/2009 - 12/10/2009; North Anna Power Station, Units 1 and 2; Component Design Basis Inspection

ML100740600
Person / Time
Site:	North Anna
Issue date:	03/11/2010
From:	Binoy Desai NRC/RGN-II/DRS/EB1
To:	Heacock D Virginia Electric & Power Co (VEPCO)
References
IR-09-007
Download: ML100740600 (38)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION II SAM NUNN ATLANTA FEDERAL CENTER 61 FORSYTH STREET, SW, SUITE 23T85 ATLANTA, GEORGIA 30303-8931 rch 11, 2010

SUBJECT:

NORTH ANNA POWER STATION - NRC COMPONENT DESIGN BASES INSPECTION - INSPECTION REPORT 05000338/2009007 AND 05000339/2009007

Dear Mr. Heacock:

On December 10, 2009, U. S. Nuclear Regulatory Commission (NRC) completed an inspection at your North Anna Power Station Units 1 and 2. The enclosed inspection report documents the inspection results, which were initially discussed on December 10, 2009, and again on January 25, 2010 with Mr. Eric Hendrixson and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents three NRC-identified findings of very low safety significance, two of which were determined to be violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy because of their very low safety significance and because they were entered into your corrective action program. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the North Anna Power Station. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at North Anna Power Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the

VEPCO 2 NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/ Binoy B. Desai, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos.: 50-338, 50-339 License Nos.: NPF-4, NPF-7

Enclosure:

Inspection Report 05000338/2009007, 05000339/2009007 w/Attachment: Supplemental Information

REGION II==

Docket Nos.: 50-338, 50-339 License Nos.: NPF-4, NPF-7

Report Nos.: 05000338/2009007, 05000339/2009007 Licensee: Virginia Electric and Power Company (VEPCO)

Facility: North Anna Power Station, Units 1 and 2 Location: 1022 Haley Drive Mineral, Virginia 23117 Dates: November 2 - December 10, 2009

Inspectors: R. Lewis, Senior Reactor Inspector (Lead) R. Moore, Senior Reactor Inspector J. Hamman, Reactor Inspector J. Eargle, Reactor Inspector A. Alen, Reactor Inspector (Trainee) C. Baron, Contractor G. Nicely, Contractor

Approved by: Binoy Desai, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000338/2009007, 05000339/2009007; 11/2/2009 - 12/10/2009; North Anna Power Station, Units 1 and 2; Component Design Basis Inspection.

This inspection was conducted by a team of four NRC inspectors and one trainee from the Region II office, and two NRC contract inspectors. Three findings of very low safety significance (i.e. Green) were identified during this inspection. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609,

"Significance Determination Process" (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," (ROP) Revision 4, dated December 2006.

Cornerstone: Mitigating System

Green: The team identified a finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to assure that thermal overload protection devices (TOLs) on safety-related motor-operated valve (MOV) circuits of Unit 1 were periodically tested to ensure that trip set point drift does not affect the reliability or availability of mitigating systems when called upon to operate. The licensee entered this issue into the corrective action program as CR361181.

The inspectors concluded that the finding was more than minor in that the finding involves the mitigating systems cornerstone attribute of procedure quality and affects the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the inspectors determined that the failure to assure that TOLs would not unnecessarily prevent safety related valves from performing their function. This could affect the availability and ability of MOVs to respond to initiating events. As no failures due to TOL performance were identified by the inspectors which would affect plant response, the inspectors determined this finding and violation of regulatory requirements to be of very low safety significance. The finding was reviewed for cross-cutting aspects and none were identified as this was determined to not be indicative of current licensee performance. (Section 1R21.2.4)

Green: The inspectors identified a finding having very low safety significance (Green) involving the failure of the licensee to ensure that the control settings for the non-safety related reserve station service transformer (RSST) 'A' replacement load tap changer (LTC) controller installed through design change package (DCP)05-108 were correctly implemented such that the LTC could respond as expected and credited across the range of design conditions. The licensee declared the RSST inoperable and implemented a change to the controller settings in compliance with design, and is tracking further actions under CR 358215.

The inspectors concluded that the finding was more than minor in that it is associated with the reactor safety mitigating systems cornerstone attribute of equipment performance and affects the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, failure of the LTC to operate, as credited, due to incorrect LTC controller set points or inadequate control voltages, would have caused the 4kV safety related buses to pre-maturely disconnect from offsite power during a design basis event. The finding is of very low safety significance as it did not result in an actual loss of safety function. Further, this finding did not constitute a violation of NRC requirements as the RSST 'A' is a non-safety related component. The team also evaluated the finding for cross-cutting aspects and determined it to involve a failure to ensure adequately trained resources were available to design, check, and review complex digital controllers and their settings, and so involved the human performance (H) resources component cross cutting aspect (H.2.(c)). (Section 1R21.2.15)

Green: The team identified a finding of very low safety significance and associated NCV of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the failure to ensure the adequacy of control voltage to the 4160 and 480 VAC equipment in support of mitigating system loads; specifically, a lack of voltage drop analysis for 125 VDC control power to breaker open/close coil, spring charging motors, and other miscellaneous DC loads. The licensee entered this issue into the corrective action program as CR361181.

The inspectors concluded that the finding is more than minor in that it involves the mitigating systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors determined the failure to assure and verify that adequate control voltage was available to close and open the 4160 VAC and 480 VAC breakers could have affected the capability of safety-related equipment to respond to initiating events. The finding is of very low safety significance as it did not result in an actual loss of safety function. The team also evaluated the finding for cross-cutting aspects and none were identified as this was determined to not be indicative of current licensee performance. (Section 1R21.2.16)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R21 Component Design Bases Inspection

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the licensee's Probabilistic Risk Assessment (PRA). In general, this included components and operator actions that had a risk achievement worth factor greater than 1.3 or Birnbaum value greater than 1 X10

-6. The components selected were located within the following systems: offsite power, 4kv distribution, DC distribution and power supply, emergency diesel generator (EDG), engineered safety features (ESF), auxiliary feedwater (AFW), component cooling water (CC), and anticipated transient without scram (ATWS) mitigation system actuation circuitry (AMSAC). The sample included 18 components, 5 operating experience items, and 6 operator actions. The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases had been correctly implemented and maintained. This design margin assessment considered original design, potential margin reductions due to modifications, or margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These reliability issues included items related to failed performance test results, significant corrective action, repeated maintenance, maintenance rule (a)1 status, RIS 05-020 (formerly GL 91-18) conditions, NRC resident inspector input of problem equipment, System Health Reports, industry operating experience and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

.2.1 Emergency Diesel Generator Fuel Oil System

a. Inspection Scope

The team reviewed the plant technical specifications (TS), updated final safety analysis report (UFSAR), design basis documents (DBDs), piping and instrumentation diagrams (P&IDs), and associated system lesson plans to establish an overall understanding of the design bases of the system. Design calculations (i.e. net positive suction head (NPSH), fuel oil consumption, etc) and system operating parameters were reviewed to verify that design bases and design assumptions had been appropriately translated into calculations and procedures. Modifications to the system were reviewed against design requirements to verify that the performance capability of the selected components had not been degraded. Walkdowns, interviews, and instrumentation reviews (specifically, day tank and underground storage tank level instruments) were performed to verify that the installed configuration would support the design bases functions under accident/event conditions, and that they had been maintained to be consistent with design assumptions, and that component operation and alignments were consistent with design and licensing basis assumptions. External event analyses were reviewed against design specifications and requirements in order to verify that the equipment was adequately protected. Testing procedures and their associated results were reviewed to verify that acceptance criteria for the tested parameters were supported by calculations or other engineering documents to ensure that the design and licensing bases were met, and to verify that individual test and/or analyses validated component operation under accident/event conditions. Interviews of system engineers, health reports and walkdown results were utilized to verify that potential degradation was monitored or prevented, and that component replacement was consistent with inservice/equipment qualification life. The licensee's response to and actions in light of IN 2009-02, "Biodiesel in Fuel Oil Could Adversely Impact Diesel Engine Performance," were reviewed to verify that applicable insights from operating experience had been applied to the selected components.

b. Findings

No findings of significance were identified.

.2.2 Turbine-driven (TD) AFW Pump

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs, P&IDs, and associated system lesson plans to establish an overall understanding of the design basis of the component. Design calculations (i.e. minimum flow, run out protection, NPSH, and vortex prevention) and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents. The team requested and reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the component's performance capability and were appropriately incorporated into relevant drawings and procedures. A component walkdown was conducted to verify that the installed configuration would support its design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing basis assumptions. Operating procedures for aligning AFW pumps during a station blackout (SBO), small break loss of coolant accident (SBLOCA), or other event scenario that causes a loss of main feed water were reviewed to verify that operation of this component was consistent with the design basis requirements and analyzed conditions. Alternate flow paths and water sources, as well as possible diversion paths, were reviewed to verify that the process medium would be available and unimpeded during an accident. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses validated component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.3 Component Cooling Water (CC) Pumps

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, P&IDs, and associated system lesson plans to establish an overall understanding of the design bases of the pumps. Design calculations (i.e. minimum flow and NPSH) and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents. Additionally, the inspectors reviewed calculations that establish cable ampacity, voltage drop, protection and coordination, motor BHP requirements, and short circuit for the CC pump motor power supply and feeder cable to verify that the design basis and design assumptions had been appropriately translated into calculations. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the component's performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing basis assumptions. Additionally, the inspectors reviewed time critical operator actions which supported design basis assumptions or conclusions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.4 SI-MOV-1867 and SI-MOV-1836, Cold Leg Injection Motor-operated Valves (MOVs)

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs, P&IDs, and associated system lesson plans to establish an overall understanding of the design basis of the components. Design calculations (i.e., minimum voltage and required torque/thrust) and site procedures were reviewed to verify the design basis and design assumptions were appropriately translated into these documents. The inspector reviewed the calculations for degraded voltage at the MOV terminals, to ensure that proper voltage was utilized in the torque calculations. The inspectors reviewed the calculations that establish cable ampacity, control circuit voltage drop, short circuit, and protection/coordination, including thermal overload sizing and application. Additionally, motor control center (MCC) breaker maintenance and thermal overload testing programs were reviewed. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the component's performance capability and were appropriately incorporated into relevant drawings and procedures. Component walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control room indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing basis assumptions. Additionally, the inspectors reviewed time critical operator actions which supported design basis assumptions or conclusions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documents, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green) and associated NCV of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control," for the licensee's failure to assure that thermal overload protection devices (TOLs) on safety-related motor-operated valve (MOV) circuits of Unit 1 were periodically tested. The periodic testing ensures that trip setpoint drift did not affect the reliability, availability, or operability of mitigating systems when called upon to operate.

Description:

Regulatory Guide 1.106, Revision 1, "Thermal Overload Protection For Electric Motors On Motor-Operated Valves," to which the licensee is committed, specified methods acceptable to the NRC staff for complying with Appendix B, Criterion XI with regard to the application of TOLs that are integral with the motor starter for electric motors on MOVs. These methods ensure, in part, that the TOLs would not needlessly trip, thus preventing the motor from performing its safety-related function.

The guide allowed the licensee to either bypass the TOL during a design basis event or leave the TOL in the MOV circuit continuously, provided that they were sized properly and periodically tested, in order to ensure continued functional reliability and the accuracy of the trip point. The licensee chose to leave the TOLs in the MOV circuits continuously and had established an acceptable criteria for properly sizing TOLs, but failed to periodically test them to ensure continued functional reliability and accuracy of the trip setpoint for Unit 1. The licensee had established, for Unit 2, a TOL testing program in accordance with RG 1.106.

All Unit 1 TOLs are inspected during molded case circuit breaker testing preventive maintenance procedure 0-EPM-0304-01, which only consists of a visual inspection, verifying freedom of movement and a contact resistance check. By comparison, the Unit 2 TOL trip setpoints are fully tested using current injection to verify trip setpoint adequacy. The licensee credited periodic operation of the MOV during operation, surveillances, and testing to ensure that the TOLs do not trip prematurely. Further, the licensee had established a conservative protection sizing criteria that met the current industry guidelines as recommended in IEEE 741-1990, IEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations, for the safety related MOVs. However, the existing TOL sizing criteria, without periodic testing to determine the susceptibility to trip setpoint drift, had not ensured that the applications were adequate to ensure that the safety function would be met for a design basis event, which can subject the MOVs to transient voltage dips, possible stall conditions, and degraded voltage.

Analysis:

The inspectors determined that failing to assure that TOL's on safety-related MOV circuits were periodically tested was a performance deficiency. The inspectors determined that the finding was more than minor in accordance with IMC 0612, "Power Reactor Inspection Reports," Appendix B, "Issue Disposition Screening," in that the finding involved the mitigating systems cornerstone attribute of procedure quality and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the inspectors determined that the failure to assure that TOLs would not unnecessarily prevent safety related valves from performing their function, but could affect the ability of MOVs to respond to initiating events. The team screened this finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined the finding was of very low safety significance (Green) as no failures due to TOL performance were identified by the inspectors which would affect plant response. The finding was reviewed for cross-cutting aspects and none were identified as this was determined to not be indicative of current licensee performance.

Enforcement:

10 CFR Part 50, Appendix B, Criterion XI, "Test Control" requires, in part, that a test program be established to ensure that systems and components perform satisfactorily inservice. Contrary to the above, as of December 7, 2009, the licensee had failed to ensure that an adequate testing program was in place for Unit 1 to assure the trip setpoint of the TOLs had not changed after being in service. As the licensee entered this issue into the corrective action program as CR361181, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000338/2009007-01, Failure to Perform Periodic TOL Testing on Unit 1).

.2.5 MS-PCV-101-A/B/C/D, Steam Generator Pressure Relief Valves

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, P&IDs, and associated system lesson plans to establish an overall understanding of the design basis of the components. Design calculations and operation procedures were reviewed to verify that the design basis and design assumptions had been appropriately translated. Component walkdowns were conducted to verify that the installed configurations would support their design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control panel indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing basis assumptions. Additionally, the inspectors reviewed time critical operator actions which supported design basis assumptions or conclusions. External event analyses were reviewed against design specifications and requirements in order to verify that the equipment was adequately protected. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.6 Emergency Diesel Generator (EDG) Building Ventilation

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, plant layout drawings, and associated system lesson plans to establish an overall understanding of the design basis of the system. Design calculations and operation procedures were reviewed to verify that the design basis and design assumptions had been appropriately translated and that heat will be adequately removed from major components. A component walkdown was conducted to verify that the installed configuration would support its design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Additionally, the team combined these walkdown results with calculation reviews to verify that the process medium would be available and unimpeded during accident/event condtions. External event analyses were reviewed against design specifications and requirements in order to verify that the equipment was adequately protected. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented.

b. Findings

No findings of significance were identified.

.2.7 MS-TV-211-A/B, TDAFW Pump Steam Admission Valves

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs, P&IDs and associated system lesson plans to establish an overall understanding of the design bases of the components. Design calculations (i.e. sizing/thrust, stroke time, etc) and system operating parameters were reviewed to verify that the design basis and design assumptions had been appropriately translated into calculations and procedures. Modifications to the system were reviewed against design documents to verify that performance capability of selected components had not been degraded. Walkdowns, interviews, and instrumentation reviews were performed to verify that the installed configurations will support their design basis functions under accident/event conditions and had been maintained to be consistent with design assumptions. Testing procedures, their bases, and their associated results were reviewed to verify that acceptance criteria for the tested parameters were supported by calculations or other engineering documents to ensure that the design and licensing bases were met, and to verify that individual test and/or analyses validate component operation under accident/event conditions. Interviews of system engineers, health reports and walkdown results were utilized to verify that potential degradation is monitored or prevented, and that component replacement is consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.8 Turbine Building Emergency Switchgear Room Flood Barrier

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the component. Civil calculations and plant procedures were reviewed to verify that design bases and design assumptions have been appropriately translated into calculations and procedures. Modifications to the system were reviewed against design documents to verify that performance capabilities of selected components had not been degraded. The team walked down the flood barrier system, reviewed corrective action and maintenance history, and reviewed test results to confirm that the installed configuration would support its design basis function under accident/event conditions and that potential degradation was monitored or prevented.

b. Findings

No findings of significance were identified.

.2.9 Cold Leg Accumulators

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs, P&IDs, and associated system lesson plans to establish an overall understanding of the design bases of the components. Sizing calculations and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents. Instrument maintenance and calibration procedures were reviewed in conjunction with the above to verify that instrumentation was maintained such that component inputs and outputs were suitable for application and would be acceptable under accident/event conditions. Accumulator refill procedures and practices were reviewed against design and licensing bases to verify that component operation and alignments were consistent with assumptions. Modifications affecting the accumulator injection were reviewed to verify that the performance capability of the selected components had not been degraded through those modifications. Interviews of system engineers, health reports and corrective action system reviews were utilized to verify that potential degradation was monitored or prevented, and that component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.10 Component Cooling Water Head Tank

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the component. Sizing calculations and site procedures were reviewed to verify the design basis and design assumptions had been appropriately translated into these documents.

A component walkdown was conducted to verify that the installed configuration would support its design basis functions under accident/event conditions and had been maintained to be consistent with design assumptions. Valve alignment observation was compared to walkdown results and procedure reviews to verify that component operation and alignments were consistent with design and licensing basis assumptions and that the process medium would be available and unimpeded during accident/event conditions. External event analyses were reviewed against design specifications and requirements in order to verify that the equipment was adequately protected. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses validated component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and that component replacement was consistent with the inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.11 Vital Batteries 2-BY-B-02 and 2-BY-B-03

a. Inspection Scope

The team reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the components. Design calculations (i.e. battery sizing, loading, and voltage) and site procedures (i.e.

maintenance and operation) were reviewed to verify that the design basis and design assumptions had been appropriately translated into these documents. Test procedures and recent testing results were reviewed in order to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents to ensure that design and licensing bases were met and that individual tests and or analyses validated component operation under accident/event conditions. Modifications to the system were reviewed against design documents to verify that performance capabilities of selected components had not been degraded. The inspectors conducted a visual non-intrusive inspection to assess installation, configuration, material condition, and potential vulnerability to hazards of the batteries and their associated chargers. The inspectors reviewed vendor manuals and construction drawings, and performed focused field inspections to verify that the installed configuration would support its design basis function under accident/event conditions and that the equipment was properly protected.

Interviews with system engineers and maintenance personnel were conducted, system health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.12 Reactor Trip Breakers

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the component. Design calculations (i.e. coordination and short circuit) and site procedures (i.e. maintenance and testing) were reviewed to verify that the design basis and design assumptions had been appropriately translated into these documents. Control wiring diagrams and DC loading calculations were reviewed to verify that component inputs and outputs were suitable for application and would be acceptable under accident/event conditions. The inspectors conducted a walkdown of the breakers, reviewed vendor manuals and construction drawings, and performed alignment verifications to verify that the installed configuration would support its design basis function under accident/event conditions and that the equipment was properly protected. System health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life. Environmental qualification documents and procurement specifications were reviewed to verify that equipment qualification is suitable for the environment expected under all conditions. The licensee's response to and actions in light of GL 85-09, Salem ATWS, were reviewed to verify that applicable insights from operating experience had been applied to the selected components.

b. Findings

No findings of significance were identified.

.2.13 Switchyard Batteries

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the components.

Design calculations (i.e. battery sizing, loading, and voltage) and site procedures (i.e. maintenance and operation) were reviewed to verify that the design basis and design assumptions had been appropriately translated into these documents. Test procedures and recent testing results were reviewed in order to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents to ensure that design and licensing bases were met and that individual tests and or analyses validated component operation under accident/event conditions. Battery room temperature was reviewed to verify that the equipment qualification was suitable for the environment expected under all conditions. The inspectors conducted a walkdown of the batteries and their associated chargers, reviewed vendor manuals and construction drawings, and performed focused field inspections to verify that the installed configuration would support its design basis function under accident/event conditions and that the equipment was properly protected.

Interviews with system engineers and maintenance personnel were conducted, system health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.14 Emergency Diesel Generator (EDG) 2J Load Profile

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the component.

Design calculations (i.e. voltage and loading) and site procedures (i.e. maintenance and testing) were reviewed to verify that the design basis and design assumptions had been appropriately translated into these documents. Modifications to the system were reviewed against design documents to verify that performance capabilities of selected components had not been degraded. System health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life. The inspectors reviewed selected industry OE and any plant actions to address the applicable issues to ensure that applicable insights from operating experience have been applied. The inspectors performed a visual non-intrusive inspection to assess installation, configuration, material condition, and potential vulnerability to hazards to verify the component installed configurations have been maintained to be consistent with design assumptions.

b. Findings

No findings of significance were identified.

.2.15 Reserve Station Service Transformer (RSST) A

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the component. Load flow calculations were reviewed to verify that station offsite power would be available and unimpeded during accident/event conditions. The inspectors reviewed periodic maintenance and testing practices to ensure the equipment is maintained in accordance with industry practices. Calculations for the automatic load tap changer voltage and time delay settings were reviewed to verify that the design basis and assumptions have been appropriately translated into design calculations.

Support system calculations and vendor information were reviewed in order to verify that energy sources, including those used for control functions would be available and adequate during accident/event conditions. Modifications to the system were reviewed against design documents to verify that performance capabilities of selected components had not been degraded. The inspectors conducted a walkdown of the transformers and their associated auxiliaries, reviewed vendor manuals and construction drawings, and performed focused field inspections to verify that the installed configuration would support its design basis function under accident/event conditions and that the equipment was properly protected.

Interviews with system engineers and maintenance personnel were conducted, system health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life. The inspectors reviewed selected industry OE and any plant actions to address the applicable issues to verify that applicable insights from operating experience have been applied.

b. Findings

Introduction:

The inspectors identified a finding of very low safety significance (Green) involving the failure of the licensee to ensure that the control settings for the non-safety related RSST 'A' replacement load tap changer (LTC) controller installed through design change package (DCP)05-108 were correctly implemented, as required by STD-GN-0001, Rev 43, "Instructions for DCP Preparation", such that the LTC could respond as expected and credited across the range of design conditions. The licensee entered this problem in their corrective action program as CR 358215.

Description:

The implementing DCP 05-108 was issued in accordance with STD-GN-0001, which required adequate checking and review of design change packages prior to issue. Specifically, issued voltage analysis, EE-0008, credited the operation of the LTCs for offsite power source operability as being able to reset the degraded voltage relays following a design basis event. The correct under-voltage (UV) blocking value is < 90 VAC (at the input to the LTC) which is < 73% of the RSST output voltage setting, i.e. 3150 volts. The degraded voltage relay requirement settings are 3675 VAC, therefore, the LTCs should continue functioning and regulating to at least the degraded voltage setting and/or lowest expected voltage transient during a design basis event.

The licensee designed a new power supply for the LTC controls and drive motor from the 480V class 1E power system. The licensee was able to perform an evaluation of the available control voltage during the assessment, therefore satisfying the inspectors that adequate voltage would be available. However, the inspectors, in questioning the licensee on the adequacy of the voltage supply to the LTC, caused the licensee to look more closely at the settings installed in the controller. The LTC UV blocking setting was found to be set at 90% of the RSST output voltage setting which is equal to a Safety Related bus voltage level of 3883 VAC, against a requirement of 3675 VAC. This as found setting would have prevented the LTC from changing the voltage taps during a design basis event. Failure of the automatic LTC controls and motor to operate, as credited, due to incorrect settings or inadequate control voltage, would have caused the 4kV safety related buses to pre-maturely disconnect from offsite power. As a result of the incorrect setting, the licensee declared RSST 'A' inoperable, as the licensee was unable to verify that they were fully able to meet GDC-17 "preferred source" requirements. The licensee issued CR 358215 and subsequently updated the existing calibration procedure with the correct user defined settings. A work package then implemented the correct values into the controller logic for RSST 'A' and tested the device per the applicable calibration procedure.

Analysis:

The failure of the licensee to verify the adequacy of DCP 05-108, as required by licensee procedure STD-GN-0001, to ensure that the control settings for the RSST 'A' LTC were correctly implemented such that the LTC could respond as expected and credited across the range of design conditions, was determined by the team to reflect a performance deficiency. This performance deficiency was determined to be more than minor, in that it was associated with the reactor safety mitigating systems cornerstone attribute of equipment performance and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, failure of the LTC to operate, as credited, due to an incorrect LTC controller setpoint, would have caused the 4kV safety related buses to pre-maturely disconnect from offsite power during a design basis event. The team screened this finding in accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined the finding was of very low safety significance (Green) as it did not result in an actual loss of safety function. The team also evaluated the finding for cross-cutting aspects and determined it to involve a failure to ensure adequately trained resources were available to design, check, and review complex digital controllers and their settings, and so involved the human performance resources component cross cutting aspect (H.2.(c)).

Enforcement:

North Anna procedure STD-GN-0001, Rev 43, "Instructions for DCP Preparation" requires, in part, adequate checking and review of design change packages prior to issue. Contrary to the above, the licensee failed to ensure that the control settings for the non-safety related RSST 'A' replacement load tap changer (LTC)controller installed during DCP 05-108 were correctly implemented such that the LTC could respond as expected and credited across the range of design conditions. Because this finding does not involve a violation of regulatory requirements, has a very low safety significance, and has been entered in the licensee's corrective action program as CR 358215, it is identified as (FIN 05000338,339/2009007-02, Failure to Ensure RSST 'A' LTC Controller Settings Were Correctly Implemented).

.2.16 EDG 4160 VAC Output/Feeder Breaker

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the EDG 4160 VAC output/feeder breaker. Design calculations (i.e. coordination and short circuit) and site procedures (i.e. maintenance and testing) were reviewed to verify that the design basis and design assumptions had been appropriately translated into these documents and that the equipment is maintained in accordance with industry practices. Control wiring diagrams and DC loading and voltage drop calculations were reviewed to verify that component inputs and outputs were suitable for application and would be acceptable under accident/event conditions. A component walkdown was conducted to verify that the installed configuration would support design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. System health reports, component maintenance history and licensee corrective action program reports were reviewed to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

Introduction:

The inspectors identified an NCV of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the failure to ensure the adequacy of control voltage to the 4160 and 480 VAC equipment in support of mitigating system loads; specifically, a lack of voltage drop analysis for 125 VDC control power to breaker open/close coil, spring charging motors, and other miscellaneous DC loads. The licensee entered this issue into their corrective action program as CR 361405.

Description:

The team's review of the licensee's 125 VDC calculations found them to evaluate the vital battery loading and the capability of the vital batteries to supply those loads through the computation of voltage drops to the distribution boards and not to the connected loads or end devices. The licensee did not have calculations or analyses to determine the voltages available at 125 VDC control power to breaker open/close coils, breaker spring charging motors, and other miscellaneous DC loads during a loss-of-offsite-power/loss-of-coolant (LOOP/LOCA) event. The licensee had however evaluated the EDG 1H and 2H breaker controls as a result of DCP 83-23 in calculation EE-012.

The results showed that voltages at the breaker close coils were calculated to be less than the required 70 VDC and resulted in the licensee requiring periodic minimum voltage testing of those devices.

The inspectors additionally identified that breaker spring charging motors require a minimum voltage of 90 VDC, but during periodic breaker preventive maintenance in 0-EPM-0302-01 the licensee only evaluates the devices at 133 VDC, which is the higher expected float voltage, as compared to an operational/design minimum. The springs are not verified to be charged except for when the breakers are racked into the cubicles.

The licensee submitted CRs 356482 and 356663 associated with the breaker spring charging motor concerns.

The licensee performed a simplified evaluation to determine the worst case available close and open coil voltage at the worst case breaker and spring charging motors fed from the 4160 VAC and 480V AC safety-related switchgear. A total of five circuits from the 4160 VAC emergency buses and two circuits from the 480V Switchgear buses were evaluated. All of the circuits evaluated, with the exception of one, had adequate voltage to the devices. One circuit, however required 70 VDC, but was calculated only to have 67.26 VDC available. Based on coil testing for similar circuits, the licensee concluded that the device would be expected to operate successfully with 67.26 VDC available. The inspectors reviewed the evaluations and found that based on a limited, but conservative sample, that it would be expected that the required loads would operate during a design basis event.

Analysis:

The inspectors determined that failing to verify the adequacy of the design of the essential 4160 VAC and 480 VAC circuit breaker controls, spring charging motors, and other required loads was a performance deficiency. The inspectors concluded that the finding was greater than minor in accordance with IMC 0612, "Power Reactor Inspection Reports," Appendix B, "Issue Screening," issued on December 24, 2009 because the finding involved the mitigating systems cornerstone attribute of design control and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to assure and verify that adequate control voltage was available to close and open the 4160 VAC and 480 VAC breakers could have affected the capability of safety-related equipment to respond to initiating events. The finding was evaluated in accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined to be of very low safety significance (Green) as it did not result in an actual loss of safety function. The finding was evaluated for cross-cutting aspects and none were identified as this was determined to not be indicative of current licensee performance.

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, as of December 7, 2009, the licensee had failed to ensure the adequacy of control voltage to the 4160 and 480 VAC equipment in support of mitigating system loads; specifically, the licensee lacked voltage drop analysis for 125 VDC control power to breaker open/close coil, spring charging motors, and other miscellaneous DC loads. The licensee entered this issue into the corrective action program as CR 361405, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000338,339/2009007-03, Failure to Ensure the Adequacy of Control Voltage to the 4160 and 480 VAC Equipment).

.2.17 Anticipated Transient Without Scram (ATWS) Mitigation System Actuation Circuitry

(AMSAC) System

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs and associated system lesson plans to establish an overall understanding of the design basis of the component.

System control schematic/elementary diagrams, logic diagrams, and vendor information were reviewed in order to verify that energy sources, including those used for control functions, would be available and adequate during accident/event conditions and to verify that component inputs and outputs were suitable for application and would be acceptable under accident/event conditions. A component walkdown was conducted to verify that the installed configuration would support its design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses validated component operation under accident/event conditions. Vendor documentation, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.2.18 CH-MOV-115E, Volume Control Tank (VCT) Outlet Valve

a. Inspection Scope

The inspectors reviewed the plant TS, UFSAR, DBDs, P&IDs, and associated system lesson plans to establish an overall understanding of the design basis of the component. Design calculations (i.e., minimum voltage and required torque/thrust) and site procedures were reviewed to verify that the design basis and design assumptions had been appropriately translated into these documents. The inspector reviewed the calculations for the degraded voltage at the MOV terminals, to ensure the proper voltage was utilized in the team's review of MOV torque calculations. The inspector reviewed the calculations that establish cable ampacity, control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing and application. Additionally, MCC breaker maintenance and thermal overload testing programs were reviewed. The team reviewed system modifications over the life of the component to verify that the subject modifications did not degrade the component's performance capability and were appropriately incorporated into relevant drawings and procedures. A component walkdown was conducted to verify that the installed configuration would support its design basis function under accident/event conditions and had been maintained to be consistent with design assumptions. Control room indicators were observed and operating procedures reviewed to verify that component operation and alignments were consistent with design and licensing bases assumptions. Additionally, the inspectors reviewed time critical operator actions which supported design basis assumptions or conclusions. Test procedures and recent test results were reviewed against design basis documents to verify that acceptance criteria for tested parameters were supported by calculations or other engineering documents and that individual tests and/or analyses served to validate component operation under accident/event conditions. Vendor documents, system health reports, preventive and corrective maintenance history, and corrective action system documents were reviewed in order to verify that potential degradation was monitored or prevented and the component replacement was consistent with inservice/equipment qualification life.

b. Findings

No findings of significance were identified.

.3 Review of Low Margin Operator Actions

a. Inspection Scope

The team performed a margin assessment and detailed review of six risk significant and time critical operator actions. Where possible, margins were determined by review of the assumed design basis and UFSAR response times. For the selected operator actions, the team performed a walkthrough of associated emergency procedures (EPs), abnormal procedures (APs), annunciator response procedures (ARPs), and other operations procedures with plant operators and engineers to assess operator knowledge level, adequacy of procedures, availability of special equipment when required, and the conditions under which the procedures would be performed. Detailed reviews were also conducted with operations and training department leadership, and through observation and utilization of a simulator training period to further understand and assess the procedural rationale and approach to meeting the design basis and UFSAR response and performance requirements. Operator actions were observed on the plant simulator and during plant walk downs. Additionally, the team reviewed the station configuration control for risk significant manual valves. This review included field verification that the valve positions for a selected sample of valves was consistent with applicable drawings and system operating procedures.

Operator actions associated with the following events/evolutions were reviewed:

• Loss of Instrument Air

• Reactor coolant system (RCS) Feed and Bleed

• Restoration of CC following SI

• ATWS - Emergency Boration

• Local manual operation of the steam generator's (SG) power operated relief valves (PORVs)

• Sluicing of SI Accumulators for Level Control

b. Findings

No findings of significance were identified.

.4 Review of Industry Operating Experience

a. Inspection Scope

The team reviewed selected operating experience issues that had occurred at domestic and foreign nuclear facilities for applicability at the North Anna Power Station. The team performed an independent applicability review for issues that were identified as applicable to the North Anna Power Station and were selected for a detailed review. The issues that received a detailed review by the team included:

• IN 2007-09, Equipment Operability under Degraded Voltage Conditions

• IN 2006-24, Recent Operating Experience Associated with Pressure and Main Steam Safety/Relief Valve Lift Setpoints

• GL 83-28 and 85-09/10, Required Actions and Technical Specifications (Items 4.3 and 4.4) Based on Generic Implications of Salem ATWS Events

• IN 2007-36, Emergency Diesel Generator Voltage Regulator Problems

• IN 2009-10, Transformer Failures - Recent Operating Experience

b. Findings

No findings of significance were identified.

4OA6 Meetings, Including Exit On December 10, 2009, the team presented the inspection results to Mr. Eric Hendrixson and other members of the licensee staff.

A re-exit was conducted by telephone with Mr. Hendrixson on January 25, 2010 to recharacterize the inspection results given additional information presented to the NRC by the licensee. No proprietary information was provided to, nor identified by the team, through the course of the inspection. ATTACHMENT: SUPPPLEMENTAL INFORMATION

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

J. Leberstein, Licensing Technical Consultant

S. Morris, Supervisor - Engineering

NRC personnel

J. Reece, Senior Resident Inspector

LIST OF ITEMS

Opened and Closed

05000338/2009007-01 NCV Failure to Perform Periodic TOL Testing on Unit 1 (Section 1R21.2.4)

05000338,339/2009007-02 FIN Failure to Ensure RSST 'A' LTC Controller Settings Were Correctly Implemented (Section 1R21.2.15)

05000338,339/2009007-03 NCV Failure to Ensure the Adequacy of Control Voltage to the 4160 and 480 VAC Equipment (Section 1R21.2.16)