IR 05000336/2009006

IR 05000336-09-006, 05000423-09-006; on 01/12/2009 - 03/06/2009; Millstone Power Station; Component Design Bases Inspection

ML090900030
Person / Time
Site:	Millstone
Issue date:	03/31/2009
From:	Doerflein L Engineering Region 1 Branch 2
To:	Christian D Dominion Resources
References
FOIA/PA-2011-0115 IR-09-006
Download: ML090900030 (49)

Text

March 31, 2009 Mr. David Christian Sr. Vice President and Chief Nuclear Officer Dominion Resources 5000 Dominion Boulevard Glenn Allen, VA 23060-6711 SUBJECT: MILLSTONE POWER STATION - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000336/2009006 AND 05000423/2009006

Dear Mr. Christian:

On February 6, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Millstone Power Station. The enclosed inspection report documents the inspection results. The preliminary inspection results were discussed with Mr. A. J. Jordan, Site Vice President, and other members of your staff on February 6, 2009. Following in-office review of additional information, the final results of the inspection were provided via telephone to Mr. W. Bartron, Licensing Supervisor, and other members of your staff on March 6, 2009.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. In conducting the inspection, the team examined the adequacy of selected components and operator actions to mitigate postulated transients, initiating events, and design basis accidents. The inspection involved field walkdowns, examination of selected procedures, calculations and records, and interviews with station personnel.

This report documents four NRC-identified findings which were of very low safety significance (Green). All of these findings were determined to involve violations of NRC requirements. However, because of the very low safety significance of the violations and because they were entered into your corrective action program, the NRC is treating the violations as non-cited violations (NCV) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U. S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, Region 1; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at Millstone Power Station. In addition, if you disagree with the characterization of the cross-cutting aspect of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region I and the NRC Resident Inspector at the Millstone Power Station. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for the public inspection in the NRC Public Docket Room or from the Publicly Available Records component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/ Lawrence T. Doerflein, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-336, 50-423 License Nos. DPR-65, NPF-49

Enclosure: Inspection Report 05000336/2009006 and 05000423/2009006 w/Attachment: Supplemental Information

SUMMARY OF FINDINGS

IR 05000336/2009006, 05000423/2009006; 01/12/2009 - 03/06/2009; Millstone Power Station; Component Design Bases Inspection.

The report covers the Component Design Bases Inspection conducted by a team of five NRC inspectors and two NRC contractors. Four findings of very low risk significance (Green) were identified, which were also considered to be non-cited violations. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using NRC Inspection Manual Chapter (IMC) 0609, "Significance Determination Process" (SDP). The cross-cutting aspects were determined using IMC 0305, "Operating Reactor Assessment Program." Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XI, "Test Control," in that, Unit 2 and Unit 3 written test procedures for battery performance testing were not adequate and did not ensure that test results were properly documented and evaluated to assure that the test requirements were satisfied. Specifically, the battery performance test procedure did not ensure that the correct discharge rate was used, that the test was terminated correctly, and that the battery capacity and subsequent decrease in capacity were correctly calculated and evaluated. In response, Dominion entered the issue into the corrective action program and determined that there was sufficient battery margin to assure operability of the station batteries.

The finding is more than minor because it is associated with the procedure quality attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined the finding was of very low safety significance (Green) because it was not a design or qualification deficiency, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. This finding has a cross-cutting aspect in the area of Human Performance, Resources Component, because Dominion did not ensure that complete, accurate, and up-to-date procedures were available and adequate to assure nuclear safety. Specifically, the battery performance test procedure did not ensure that the correct discharge rate was used, that the test was terminated correctly, and that the battery capacity and subsequent decrease in capacity were correctly calculated and evaluated. (IMC 0305, Aspect H.2(c)) (1R21.2.1.1.1)iii

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," in that, Dominion did not take did not take corrective actions for a degraded cell in a Unit 2 safety related battery. Specifically, although testing of the 'B' battery between 1996 and 2008 indicated a degraded cell, actions were not taken to initiate a condition report or evaluate the impact of the degraded condition. In response, Dominion entered the issue into the corrective action program and determined that there was sufficient battery margin to assure operability of the battery.

The finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined the finding was of very low safety significance (Green) because it was not a design or qualification deficiency, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. This finding has a cross-cutting aspect in the area of Problem Identification and Resolution, Corrective Action Program Component, because Dominion did not thoroughly evaluate the problem such that the resolution addressed the cause. Specifically, although data indicated cell 10 was degraded, no action was taken to evaluate the reduced cell capacity on the overall battery. (IMC 0305, Aspect P.1(c)) (1R21.2.1.1.2)

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," in that, Dominion did not take corrective actions for repeated out-of-calibration test results associated with Unit 2 safety related inverters. Specifically, although testing of the safety related inverters between 2005 and 2008 indicated that the as-found results were frequently out-of-calibration, actions were not always taken to initiate a condition report; and condition reports that were generated, did not evaluate the repetitive failure to remain in calibration. In response, Dominion entered the issue into the corrective action program and determined that the out-of-calibration results did not render the safety related instrument panels inoperable.

The finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined the finding was of very low safety significance (Green) because it was not a design or qualification deficiency, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event. This finding has a cross-cutting aspect in the area of Problem Identification and Resolution, Corrective Action Program Component, because Dominion did not thoroughly evaluate the problem such that the resolution addressed the cause. Specifically, although testing of the safety related inverters between 2005 and 2008 indicated regular out-of-calibration as-found results, actions were not always taken to initiate a condition report; and condition reports that were generated, did not evaluate the repetitive failure to remain in calibration. (IMC 0305, Aspect P.1(c)) (1R21.2.1.2)

iv

Green.

The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," in that Dominion did not ensure the adequacy of the recirculation spray system heat exchanger design.

Specifically, Dominion had not performed analyses or testing to evaluate the potential of air entrapment in the recirculation spray system heat exchangers under post-accident conditions. In response, Dominion entered this issue into their corrective action program and performed analyses to demonstrate that this condition did not render associated equipment inoperable.

This finding is more than minor because it is associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of recirculation spray system operability or functionality. This finding did not have a cross-cutting aspect. (1R21.2.1.24)

B. Licensee-Identified Violations

None

REPORT DETAILS

1R21 Component Design Bases Inspection (IP 71111.21)

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the Millstone Power Station Units 2 and 3 Probabilistic Risk Assessments (PRA) and the U. S. Nuclear Regulatory Commission's (NRC) Standardized Plant Analysis Risk (SPAR) models for Units 2 and 3. Additionally, the Millstone Significance Determination Process (SDP) Phase 2 Notebooks (Revision 2.1a) for Units 2 and 3 were referenced in the selection of potential components and operator actions for review. In general, the selection process focused on components and operator actions that had a Risk Achievement Worth (RAW) factor greater than 1.3 or a Risk Reduction Worth (RRW) factor greater than 1.005. The components selected were located within both safety related and non-safety related systems, and included a variety of components such as pumps, breakers, heat exchangers, transformers, and valves.

The team initially compiled a list of components and operator actions based on the risk factors previously mentioned. Additionally, the team reviewed the previous component design bases inspection report (05000336/2006010 and 05000423/2006010) and excluded the majority of those components previously inspected. The team then performed a margin assessment to narrow the focus of the inspection to 27 components, six operator actions and six operating experience items. The team's evaluation of possible low design margin included consideration of original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition/equipment reliability issues. The assessment also included items such as failed performance test results, corrective action history, repeated maintenance, maintenance rule (a)(1) status, operability reviews for degraded conditions, NRC resident inspector insights, system health reports, and industry operating experience. Finally, consideration was also given to the uniqueness and complexity of the design and the available defense-in-depth margins. The margin review of operator actions included complexity of the action, time to complete the action, and extent of training on the action.

The inspection performed by the team was conducted as outlined in NRC Inspection Procedure (IP) 71111.21. This inspection effort included walkdowns of selected components, interviews with operators, system engineers and design engineers, and reviews of associated design documents and calculations to assess the adequacy of the components to meet design basis, licensing basis, and risk-informed beyond design basis requirements. Summaries of the reviews performed for each component, operator action, operating experience sample, and the specific inspection findings identified are discussed in the subsequent sections of this report. Documents reviewed for this inspection are listed in the Attachment.

.2.1.1 'B' 125 Vdc Battery and Associated 125 Vdc Bus (Unit 2)

a. Inspection Scope

The team reviewed the design, testing and operation of the 'B' 125 Vdc station battery at Unit 2 to verify that it could perform its design function of providing a reliable source of DC power to connected loads under operating, transient and accident conditions. The team reviewed design calculations to assess the adequacy of the battery sizing to ensure the battery could power the required equipment for a sufficient duration, and at a voltage above the minimum required for equipment operation. The DC protective coordination study was reviewed to verify that adequate protection would exist for postulated faults in the DC system. The team also reviewed the battery room hydrogen generation calculation to verify that the hydrogen concentration levels would stay below acceptable levels during normal and postulated accident conditions. Battery performance test results, including discharge tests, were reviewed to ensure the testing was sufficient and was in accordance with requirements; and that the results confirmed acceptable performance of the battery. Design and system engineers were interviewed regarding the design, operation, testing and maintenance of the battery. The team performed a walkdown of the 'B' station battery, the battery chargers and associated distribution panels to assess the material condition of the battery cells and associated electrical equipment. When issues were identified during this review, the team considered other station batteries, including those at Unit 3, to assess extent-of-condition. Finally, a sample of condition reports was reviewed to ensure Dominion was identifying and properly correcting issues associated with the 'B' station battery and associated DC system components.

1. Inadequate Performance Testing of Safety Related Batteries

Introduction:

The team identified a finding of very low safety significance (Green) involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XI, "Test Control," in that, written test procedures for battery performance testing were not adequate and did not ensure that test results were properly documented and evaluated to assure that the test requirements were satisfied.

Description:

The team reviewed test procedures and test results for two safety related batteries: 'B' battery at Unit 2, and No. 2 battery at Unit 3. The team identified several test control issues that affected the subject batteries. Specifically, the battery performance test procedure did not ensure that the correct discharge rate was used, that the test was terminated correctly, and that the battery capacity and subsequent decrease in capacity were correctly calculated and evaluated.

Performance tests are Technical Specification required tests that are performed for safety related batteries. During a performance test, the battery is discharged at a vendor specified rate that is adjusted based upon the battery temperature. This discharge rate is maintained until the battery is fully discharged (105 Vdc, or an average of 1.75 Vdc per cell). The battery capacity is then calculated based on the duration in which the battery becomes fully discharged. The calculated capacity, when trended and properly evaluated, will accurately determine when a battery is reaching the end of its service life. The calculated capacity is also used to determine the test frequency.

The team reviewed the last three performance tests for the Unit 2 'B' battery and the last three performance tests for the Unit 3 No. 2 battery. The team identified that errors in the temperature adjustment resulted in using the wrong discharge rate for all three of the performance tests for the 'B' battery and two of the three performance tests for the No. 2 battery. The team also identified that all three performance tests on the Unit 2 'B' battery were stopped prematurely (i.e., before the battery was fully discharged). The team observed that the capacity for the No. 2 battery during the 2008 test was incorrectly calculated due to a calculation error. Finally, the team noted that the performance test procedure did not formally calculate the decrease in battery capacity for determining the correct testing frequency.

The performance test frequency is initially set at five years but must be performed more often toward the end of the battery's life. Accurate measuring and trending of the battery's capacity are required to establish the correct testing frequency. Based on the observed deficiencies with the battery performance testing, there was reasonable doubt whether the battery test control program would recognize a degraded battery in a timely fashion. In particular, due to the errors identified with battery testing, data collection and capacity determination, the battery performance trend was unclear for the Unit 2 'B' battery and the Unit 3 No. 2 battery. Further, Dominion was unable to determine whether either battery should be subject to accelerated performance testing due to the inaccurate battery capacity determination and lack of accurate trend data.

Dominion entered the above issues into the corrective action program (CRs 321792, 320208, 320686, and 322402), and implemented actions to verify operability and evaluate and correct the deficiencies in the battery testing program, including an extent-of-condition review. Based on the magnitude of the errors and current battery capacity margins, Dominion determined that there were no operability issues with either battery and that the current testing frequency for both batteries was appropriate. The team reviewed Dominion's bases for operability and independently evaluated battery operability. The team similarly concluded that the issues identified did not render either of the subject station batteries inoperable.

Analysis:

The team determined that the failure to properly perform battery testing in accordance with written test procedures and to document and evaluate test results to assure that test requirements were satisfied was a performance deficiency that was reasonably within Dominion's ability to foresee and prevent. The finding was more than minor because it was similar to NRC Inspection Manual Chapter 0612, Appendix E, "Examples of Minor Issues," Example 2c, in that the test control inadequacies affected multiple batteries and the issue was repetitive. The finding was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," a Phase 1 SDP screening was performed and determined the finding was of very low safety significance (Green) because it was not a design or qualification deficiency, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event.

This finding has a cross-cutting aspect in the area of Human Performance, Resources Component, because Dominion did not ensure that complete, accurate, and up-to-date procedures were available and adequate to assure nuclear safety. Specifically, the battery performance test procedure did not ensure that the correct discharge rate was used, that the test was terminated correctly, and that the battery capacity and subsequent decrease in capacity were correctly calculated and evaluated. (IMC 0305, Aspect H.2(c))

Enforcement:

10 CFR 50, Appendix B, Criterion XI, "Test Control," requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is performed in accordance with written test procedures, and test results are documented and evaluated to assure that test requirements have been satisfied. Contrary to the above, on five occasions between March 21, 1996 and November 5, 2008, written test procedures for battery performance testing were not adequate, and Dominion did not ensure that test results were properly documented and evaluated to assure that the test requirements were satisfied. Because this violation was of very low safety significance (Green) and has been entered into Dominion's corrective action program (CRs 321792, 320208, 320686, and 322402), this violation is being treated as a non-cited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000336/2009006-01 & 05000423/2009006-01, Inadequate Performance Testing of Safety Related Batteries)2. Inadequate Corrective Action for Degraded Battery Cell

Introduction:

The team identified a finding of very low safety significance (Green) involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," in that, Dominion did not take did not take corrective actions for a degraded cell in a safety related battery.

Specifically, although testing of the Unit 2 'B' station battery between 1996 and 2008 indicated a degraded cell, actions were not taken to initiate a condition report or evaluate the impact of the degraded condition.

Description:

Millstone Unit 2 Technical Specifications require performance tests to be performed on the 'B' battery every five years. The team reviewed battery performance test results for the 'B' battery and identified a concern with a degraded cell that was not evaluated or corrected.

Performance tests measure the capacity of the overall battery and individual cells.

Average battery cell voltages during a performance test vary between 2.1 and 1.75 Vdc. However, during the performance test for the 'B' battery in 1996, cell 10 reached 1.0 Vdc. If a cell reaches 1.0 Vdc during the performance test, it is approaching polarity reversal. If a cell reverses polarity, it no longer induces a voltage, rather, it reduces the overall battery voltage. Reaching 1.0 Vdc during the test constitutes a degraded cell that requires evaluation for corrective action or replacement. The team found that a condition report (CR) was not written for cell 10, and the adverse condition was not evaluated. During the next performance test in 2000, cell 10 again reached 1.0 Vdc. Again, a CR was not written and the degraded condition was not evaluated. During the third performance test in 2005, individual cell voltages were not recorded, so the exact performance of cell 10 was unknown. Notwithstanding, it appears that cell 10 did not reverse polarity based on the automatic shutdown settings of the test equipment.

Service tests, which are less demanding than performance tests (i.e., batteries are not fully discharged) are required by Technical Specifications every 18 months, between the five year performance tests. In 2008, a service test was performed on the 'B' battery and the individual cell voltage data indicated a potential for significant degradation of cell 10 in that the cell went below the design minimum value of 1.75 Vdc. This data was not evaluated until identified by the team. Dominion, working with the battery vendor, was able to show that the indications during the 2008 service test were due to faulty test equipment. However, because the faulty test equipment was not promptly identified, cell 10 was not accurately measured during the test. This represents another missed opportunity for Dominion to observe and evaluate the degraded cell.

Although cell 10 had indicated degraded performance, as evidenced by the performance discharge test data, there was no evaluation of the impact of the degraded cell on the overall battery. Because there was no evaluation, Dominion failed to assess the potential need to replace the cell or to increase monitoring since the 1996 performance test. The team determined that, based on the performance data showing degraded cell 10 performance and poor documentation of the cell's performance since 1996, there was not reasonable assurance that cell 10 could achieve its design function. In response to the team's concerns, Dominion initiated CR 320943 to evaluate the significance of the reduced capacity in cell 10, to determine if the cell should be replaced, and to determine if increased monitoring or troubleshooting are required. Dominion determined that there were no operability issues based on the current battery capacity margin, acceptable cell performance on a 2006 service test, and successful quarterly surveillance tests. The team independently reviewed test data and design documents, and similarly concluded that the degraded cell will not render the 'B' battery inoperable prior to the next performance test.

Analysis:

The team determined that the failure to take corrective action for the degraded battery cell was a performance deficiency that was reasonably within Dominion's ability to foresee and prevent. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements.

In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," a Phase 1 SDP screening was performed and determined the finding was of very low safety significance (Green)because it was not a design or qualification deficiency, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event.

This finding has a cross-cutting aspect in the area of Problem Identification and Resolution, Corrective Action Program Component, because Dominion did not thoroughly evaluate the problem such that the resolution addressed the cause. Specifically, although data indicated cell 10 was degraded, no action was taken to evaluate the reduced cell capacity on the overall battery. (IMC 0305, Aspect P.1(c))

Enforcement:

10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that conditions adverse to quality, such as deficiencies, are promptly identified and corrected. Contrary to the above, although testing of the Unit 2 'B' station battery indicated a degraded cell on multiple occasions between March 21, 1996, and April 29, 2008, actions were not taken to initiate a condition report or evaluate the impact of the degradation of the cell on the overall battery. Because this violation was of very low safety significance (Green) and has been entered into Dominion's corrective action program (CR 320943), this violation is being treated as a non-cited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000336/2009006-02, Inadequate Corrective Action for Degraded Battery Cell)

.2.1.2 120 Vac Vital Instrument Panel VA10 (Unit 2)

a. Inspection Scope

The team reviewed the capability of the Unit 2 VA10 instrument panel to provide instrumentation and control power during all conditions, but particularly during design basis accident conditions. The calculation for loading and voltage drop was reviewed for the VA10 instrument panel to ensure that sufficient capacity exists for all normal and accident loading, and that sufficient voltage was available for all loads. The 'A' station battery loading study was reviewed to verify that the battery was capable of providing the appropriate load for the inverter. Design and system engineers were interviewed regarding the design, operation, testing and maintenance of the inverter and instrument panel. The team performed a walkdown of the No. 1 inverter and the VA10 panel to assess the material condition of the associated electrical equipment. Finally, a sample of condition reports was reviewed to ensure Dominion was identifying and properly correcting issues associated with the VA10 instrument panel and associated inverter.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green) involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," in that, Dominion did not take corrective actions for repeated out-of-calibration (OOC) conditions associated with safety related inverters. Specifically, although testing of the safety related inverters between 2005 and 2008 indicated that the as-found results were frequently out-of-calibration, actions were not always taken to initiate a condition report; and condition reports that were generated, did not evaluate the repetitive failure to remain in calibration.

Description:

Unit 2 has four safety related inverters that supply power to respective safety related instrumentation panels, and are normally powered from safety related batteries. Under certain conditions of undervoltage or overvoltage from the output of the safety related inverters, an associated static switch will transfer power from the safety related batteries to one of several non-safety related power supplies. The transfer is prevented under certain conditions of underfrequency or overfrequency sensed on the non-safety related backup power supplies.

Calibration tests are done every 18 months on each of the four inverters and static switches to verify that the undervoltage, overvoltage, underfrequency, and overfrequency setpoints are correct. Incorrect setpoints could cause the power supply to transfer away from the safety related power source too soon, too late, or not at all.

The team reviewed the last three calibrations for each of the four inverters. Every calibration reviewed had at least one OOC result. A total of 28 OOC values were identified over the 12 tests reviewed. The team observed that, in 2005, there were eight OOC values; in 2006, there were nine OOC values; and in 2008, there were eleven OOC values. Typical OOC values were approximately 0.5 Vac and 0.1 Hz beyond the acceptance limits. The maximum voltage error was 2.0 Vac in 2006, and the maximum frequency error was 0.29 Hz in 2008. The team observed that there appeared to be an adverse trend related to the voltage and frequency OOC results.

Four condition reports were written over the last three cycles, which captured 8 of the 28 OOC values. None of the condition reports contained an evaluation of the overall issue of repeated OOC values. Three of the four condition reports evaluated operability via maintenance rule functional failure evaluations for the specific OOC value(s) addressed by the condition reports, but the condition reports did not address the consistent inability of the values to remain in calibration between testing intervals.

The most significant OOC was for the No. 1 inverter in April 2005. The DC undervoltage trip setpoint for the No. 1 inverter was found at 106.0 Vdc, with the acceptance criteria maximum of 104 Vdc. This could have caused the inverter to shut down when adequate voltage was still available from the safety related battery.

Dominion initiated CR 325532 to evaluate the significance of the OOC results. Dominion determined that there were no operability issues based on the OOC values being very close to the acceptance criteria and the station batteries having adequate voltage margin. In all instances where instruments were found to be OOC, the instruments were correctly identified in the test documentation and were properly re-calibrated. The team reviewed Dominion's operability assessment, and similarly concluded that the OOC results have not rendered the safety related instrument panels inoperable.

Analysis:

The team determined that the failure to take corrective action for the repeated OOC results for safety related inverters was a performance deficiency that was reasonably within Dominion's ability to foresee and prevent. The finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements.

In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," a Phase 1 SDP screening was performed and determined the finding was of very low safety significance (Green) because it was not a design or qualification deficiency, did not represent a loss of system safety function, did not represent an actual loss of safety function of a single train, and did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating event.

This finding has a cross-cutting aspect in the area of Problem Identification and Resolution, Corrective Action Program Component, because Dominion did not thoroughly evaluate the problem such that the resolution addressed the cause.

Specifically, although testing of the safety related inverters between 2005 and 2008 indicated regular out-of-calibration as-found results, actions were not always taken to initiate a condition report; and condition reports that were generated, did not evaluate the repetitive failure to remain in calibration. (IMC 0305, Aspect P.1(c))

Enforcement:

10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that conditions adverse to quality, such as deficiencies, are promptly identified and corrected. Contrary to the above, although testing of the safety related inverters between 2005 and 2008 indicated that the as-found results were frequently out-of-calibration, actions were not always taken to initiate a condition report; and condition reports that were generated, did not evaluate the repetitive failure to remain in calibration. Because this violation was of very low safety significance (Green) and has been entered into Dominion's corrective action program (CR325532), this violation is being treated as a non-cited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000336/2009006-03, Inadequate Corrective Action for Safety Related Inverter Out-of-Calibration Results)

.2.1.3 4160 Vac Lower Switchgear Room Cooling Fan F134 (Unit 2)

a. Inspection Scope

The team inspected the F134 cooling fan to verify it could respond to all design basis events. The team conducted a walkdown of the fan and associated ventilation equipment to assess the material condition of the system. The team reviewed inspection, testing, and calibration procedures to verify that appropriate preventive maintenance procedures were being performed. The team reviewed past test results to verify that the fan and associated heat exchanger were capable of removing the required heat load. The team reviewed design documents and drawings to evaluate the ability of the fan to provide adequate cooling. The team interviewed engineers regarding the maintenance and operation of the fan and heat exchanger. Finally, the team reviewed a sample of condition reports to ensure Dominion was identifying and properly correcting issues associated with cooling fan F134 and its associated heat exchanger.

b. Findings

No findings of significance were identified.

.2.1.4 High Pressure Safety Injection Pump P41A (Unit 2)

a. Inspection Scope

The team reviewed the Unit 2 UFSAR, Design Bases Summary, Technical Specifications, licensing documents, vendor manual, and pump specifications to identify the design bases for the Unit 2 high pressure safety injection pump P41A. The team reviewed the P41A pump to assess its ability to meet design basis head and flow requirements for injection into the reactor coolant system. The team reviewed drawings, calculations, hydraulic analyses, procedures, system health reports, corrective and preventive maintenance activities, and selected condition reports to evaluate whether the maintenance, testing, and operation of the high pressure safety injection pump P41A was adequate to ensure the pump would satisfy design basis requirements under transient and accident conditions.

The team interviewed engineers regarding the design, operation, testing and maintenance of pump P41A. The team reviewed design calculations and specifications to assess the adequacy of net positive suction head, vortex protection, minimum flow, and runout protection and to assess the capability of the pump to achieve the flow and developed head as assumed in operating, transient and accident calculations. The team verified whether design inputs were properly translated into system procedures and tests; and reviewed completed surveillance tests associated with the demonstration of pump operability. Electrical calculations were reviewed to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running the motor under design basis conditions. The team performed a field walkdown to assess the material condition of pump. The team also reviewed pump room temperature heat up calculations and equipment thermal design requirements to assess whether the pump would operate within design temperature limits during transient conditions. Finally, the team reviewed the lube oil cooling system for the pump to assure the oil cooler would operate under design basis conditions.

b. Findings

No findings of significance were identified.

.2.1.5 Reactor Building Component Cooling Water Heat Exchanger X18A (Unit 2)

a. Inspection Scope

The team inspected the Unit 2 reactor building component cooling water (RBCCW) heat exchanger X18A to ensure that it was capable of removing the required heat loads during design basis events. The team reviewed design basis documents, the tube plugging limit evaluation, eddy current and thermal performance results, service water full flow tests, heat exchanger cleaning and inspection reports, and the water hammer analysis to verify that the heat exchanger could maintain adequate heat removal capability and system integrity during design basis events. The team reviewed design basis and vendor documentation to ensure operating and maintenance parameters were appropriately incorporated into operating and test procedures. Additionally, the team conducted a walkdown of the heat exchanger, interviewed system and component engineers, and reviewed system health and condition reports to assess instrumentation and material condition of the heat exchanger as well as overall system health; and to verify issues entered into the corrective action program were being appropriately addressed. The team also reviewed Dominion's response to NRC Generic Letter 89-13, "Service Water System Problems Affecting Safety Related Equipment," to verify that associated commitments were being maintained.

b. Findings

No findings of significance were identified.

.2.1.6 High Pressure Safety Injection Pump Header Check Valve 2-SI-008 (Unit 2)

a. Inspection Scope

The team inspected the Unit 2 high pressure safety injection (HPSI) pump header check valve, 2-SI-008, to verify that it was capable of meeting its design basis requirements. This vertically mounted swing check valve is normally closed and is required to open upon HPSI system initiation. Additionally, when closed, it has the function to prevent backflow through the HPSI system when downstream piping is used as an alternate charging flowpath. The team reviewed the corrective and preventive maintenance history, as well as surveillance test results, to ensure the design basis requirements were met. The team reviewed the seismic calculation of the system piping section to verify protection during a design basis earthquake. Additionally, the team interviewed the system and component engineers and conducted a walkdown of the check valve to verify material condition, nameplate data, and proper orientation were consistent with the design basis and plant drawings. The team also reviewed condition reports to determine the overall health of the valve.

b. Findings

No findings of significance were identified.

.2.1.7 Instrument Air Compressor F3D (Unit 2)

a. Inspection Scope

The team inspected the Unit 2 instrument air compressor, F3D, to verify that it was capable of meeting its design basis requirements. This compressor normally provides compressed air to the Unit 2 instrument air system. The team reviewed the design modification that added this compressor to the system to verify the adequacy of the design. This review included an assessment of the capacity of the compressor as well as the electrical power supply. The team also reviewed condition reports and maintenance history to determine the overall condition of the equipment. Finally, the team interviewed the system engineer and performed a walkdown of the compressor and associated equipment to determine the material condition and overall health of the compressor.

b. Findings

No findings of significance were identified.

.2.1.8 EDG Heat Exchanger SW Bypass Valve 2-SW-231A (Unit 2)

a. Inspection Scope

The team inspected the Unit 2 emergency diesel generator (EDG) heat exchanger bypass valve, 2-SW-231A, to verify that it was capable of meeting its design basis requirements. This air operated valve provides a service water (SW) flowpath to bypass the EDG heat exchanger when required to maintain minimum service water system flow. Specifically, the valve is normally open during cold weather when the normal SW loads are not adequate for SW pump minimum flow, and is normally closed during warm weather. When the EDG is operated, this valve automatically closes to provide the required service water flow to the heat exchangers. The valve was designed to fail in the closed position.

This team reviewed the capability of the valve to perform its required function under limiting operating conditions. The team reviewed analyses, vendor information, test procedures and recent test results to confirm that design bases were appropriately translated into component operation and test procedures. The review included recent condition reports and maintenance history to determine the overall condition of the valve.

Finally, the team interviewed the system engineer and air-operated valve engineer; and performed a walkdown of the valve and associated equipment to determine the material condition and overall health of the valve.

b. Findings

No findings of significance were identified.

.2.1.9 Emergency Diesel Generator 'B' Support Systems (Unit 2)

a. Inspection Scope

The team inspected the Unit 2 'B' EDG support systems to verify that they were capable of meeting their design basis requirements. This EDG provides vital AC power if normal off-site power is not available. The team inspected the air start and fuel oil support systems to verify the capability of those systems to perform their required functions. The air start system included non-safety related air compressors, safety related air receiver tanks, and associated piping and valves. The air start system provides motive force to automatically start the diesel engine when required. The fuel oil system included a non-safety related fuel storage tank, a safety related diesel oil supply tank, and associated piping and valves.

This team reviewed the capability of the air start system to perform its required function under limiting operating conditions. The reviewed included vendor information, test procedures and recent test results, including system leakage test results. The team reviewed the Technical Specification requirements associated with the air start system; and reviewed recent condition reports and maintenance history to determine the overall condition of the components. The team interviewed the system engineer and performed a walkdown of air start system equipment to assess material condition.

The team reviewed the capability and capacity of the fuel oil system to verify its ability to perform its design basis function. The reviewed included vendor information, test procedures, calculations, and an evaluation of the use of ultra-low sulfur diesel fuel. The team reviewed the Technical Specification requirements associated with the fuel oil system; and reviewed recent condition reports and maintenance history to determine the overall condition of the components. The team also reviewed operating procedures associated with cross-connecting the diesel oil supply tanks, if required. Finally, the team interviewed the system engineer and performed a walkdown of the diesel oil supply tank and associated equipment to assess material condition.

b. Findings

No findings of significance were identified.

.2.1.1 0 4160 Vac Emergency Bus 24D (Unit 2)

a. Inspection Scope

The team reviewed AC load flow calculations to determine whether the 4160 Vac system had sufficient capacity to support its required loads under worst case accident loading and grid voltage conditions. The team reviewed the design of the 4160 Vac bus degraded voltage protection scheme to determine whether it afforded adequate voltage to safety related devices at all voltage distribution levels. This included review of degraded voltage relay setpoint calculations, motor starting and running voltage calculations, and motor control center control circuit voltage drop calculations. The degraded voltage protection scheme was also reviewed to determine whether it would cause spurious separation of the bus from the offsite power supply during accident loading concurrent with minimum grid voltage. The team reviewed test procedures and results for the degraded voltage relays to determine whether equipment was performing as required by the design bases and Technical Specifications. The team reviewed protective relaying schemes and calculations to determine whether equipment such as motors and cables were adequately protected, and to determine whether protective devices featured proper selective tripping coordination. The team reviewed maintenance procedures to determine whether they reflected up to date vendor technical data; and to determine whether equipment was being properly maintained. The team reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends. The team also reviewed operating procedures to determine whether the limits and protocols for maintaining offsite voltage were consistent with design calculations. Finally, the team performed a visual inspection of the 4160 Vac safety buses to assess material condition and the presence of hazards.

b. Findings

No findings of significance were identified.

.2.1.1 1 Facility 1 Fast Transfer Initiation Relay 83X1 (Unit 2)

a. Inspection Scope

The team reviewed elementary and logic diagrams to determine whether the design of the fast bus transfer scheme was consistent with design bases for immediate access of the safety buses to the offsite power supply during accidents and other transients. The team reviewed the fast bus transfer scheme to determine whether running motors could be safely transferred without damage, and without causing unacceptable voltage or current transients that could cause tripping of buses. The team reviewed vendor data to determine whether the relay was applied within its voltage and current ratings; and reviewed test procedures and records to determine whether proper relay operation was periodically verified. In addition, the team reviewed corrective action and maintenance records to determine whether there were any adverse operating trends.

b. Findings

No findings of significance were identified.

.2.1.1 2 Motor-Driven Auxiliary Feedwater Pump P9B (Unit 2)

a. Inspection Scope

The team inspected the P9B motor-driven auxiliary feedwater (AFW) pump to assess its ability to meet design basis head and flow requirements for injection into the steam generators. The team reviewed the design capacity of the condensate storage tank (CST), hydraulic analyses, net positive suction head (NPSH) and vortexing calculations, and completed surveillance results to ensure that the preferred water source (CST) will be available and the process medium will be unimpeded during transient and postulated accident conditions. The team reviewed the AFW pump start logic and completed test results to verify pump controls will be functional and provide desired control when called upon to operate. Test procedures were reviewed to verify that design inputs were properly translated into acceptance criteria for tested parameters. The UFSAR, Technical Specifications, accident analyses, procedures and design bases documents were reviewed to ensure that design and licensing bases were met. System health reports, condition reports and maintenance history were reviewed to verify that potential degradation was identified, monitored and corrected. A walkdown was performed to assess the material condition and verify that the pump's installed configuration will support its design basis function during transient and postulated accident conditions. Finally, the team verified that the pump and its supporting piping and water source was adequately protected from flooding, missile, high energy line break, and freezing scenarios.

b. Findings

No findings of significance were identified.

.2.1.1 3 Pressurizer Power Operated Relief Valve 2-RC-404 (Unit 2)

a. Inspection Scope

The team inspected the pressurizer power operated relief valve (PORV) 2-RC-404 to verify the valve was capable of performing its design basis functions. Engineering evaluations were reviewed and system engineers were interviewed to ensure the adequacy of implemented PORV design changes and changes to testing procedures. The team reviewed PORV logic and completed test results to verify valve controls will be functional and the valve will properly operate during transient and postulated accident conditions. Test procedures were reviewed to verify that design inputs were properly translated into acceptance criteria for tested parameters. The UFSAR, Technical Specifications, accident analyses, and design bases documents were reviewed to ensure that design and licensing bases were met. Design calculations were reviewed to determine the adequacy of PORV lift settings. Completed test results were reviewed to verify PORV operability during both normal operation and while in the low temperature overpressure protection mode of operation. Finally, the team reviewed condition reports, work orders, and maintenance history to ensure potential problems were appropriately identified and corrected.

b. Findings

No findings of significance were identified.

.2.1.1 4 Safety Injection Pump 3SIH*P1A (Unit 3)

a. Inspection Scope

The team reviewed the Unit 3 UFSAR, Design Bases Summary, Technical Specifications, licensing documents, vendor manual, and pump specifications to identify the design basis information for the Unit 3 safety injection pump 3SIH*P1A. The team inspected this pump to assess its ability to meet design basis head and flow requirements to deliver water to the reactor coolant system from the refueling water storage tank during the injection phase of a postulated accident and from the containment sump via the recirculation spray system pumps during the recirculation phase. The team reviewed design calculations to assess the adequacy of net positive suction head, vortex protection, minimum flow, and runout protection and to assess the capability of the pump to achieve the flow and developed head as assumed in operating, transient and accident calculations. The team reviewed associated electrical calculations to confirm that the design basis minimum voltage at the motor terminals would be adequate for starting and running the motor under design basis conditions.

The team interviewed system and design engineers to discuss the design, operation and maintenance history of pump 3SIH*P1A; and reviewed test results to ensure design basis requirements were met. The team performed a walkdown to assess the material condition of the pump. The team also reviewed design change history and maintenance activities to assess potential component degradation and impact on design margins.

The team reviewed modification DM3-00-0191-07 (Cold Leg Injection Permissive), which changed the control scheme for cold leg injection valves 3SIH*MV8801A/B to inhibit opening in the absence of an actual accident signal. This modification was implemented in support of the recent stretch power uprate for Millstone Unit 3. In particular, the team reviewed the circuit modifications to determine whether they were correctly described, evaluated, and implemented.

b. Findings

No findings of significance were identified.

.2.1.1 5 480 Vac Load Center Bus 32U (Unit 3)

a. Inspection Scope

The team reviewed AC load flow calculations to determine whether the 480 Vac bus 32U had sufficient capacity to support its required loads under worst case accident loading and grid voltage conditions. The team reviewed the degraded voltage protection scheme to determine whether the voltage setpoints were selected based on the voltage requirements for safety related loads at the 480 Vac level. The team reviewed cable sizing calculations to determine whether the voltage drop would prevent proper starting or running of safety related loads under minimum bus voltage conditions. The team reviewed breaker coordination studies to determine whether equipment was protected and whether protective devices featured selective coordination. The team reviewed alarm response and maintenance procedures to determine whether the procedures reflected the design bases and industry experience. The team also reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends. Finally, the team performed a visual inspection of the 480 Vac safety buses to assess material condition and the presence of hazards.

b. Findings

No findings of significance were identified.

.2.1.1 6 4160 Vac Reserve Station Service Transformer 15G-23SA (Unit 3)

a. Inspection Scope

The team reviewed AC load flow calculations to determine whether Reserve Station Service Transformer (RSST) 15G-23SA had sufficient capacity to support its required loads under worst case accident loading and grid voltage conditions. The team reviewed transformer protective relaying schemes to determine whether the transformer was adequately protected; and reviewed maintenance and test procedures for insulation testing, oil sampling, relay calibration, vibration monitoring, and thermography to determine whether methods and acceptance criteria were consistent with vendor recommendations and industry standards. The team reviewed completed work packages to determine whether activities were properly performed and whether adverse conditions were corrected. Corrective action documents for the RSST were reviewed to determine whether there were any adverse operating trends. In addition, the team performed a visual inspection of the transformer to assess material condition and the presence of hazards.

b. Findings

No findings of significance were identified.

.2.1.1 7 Emergency Diesel Generator Enclosure Fan Temperature Switch 3HVP*TS32A (Unit 3)

a. Inspection Scope

The team reviewed calculations for the emergency diesel generator (EDG) enclosure design temperature and temperature switch setpoint accuracy to determine whether setpoints were adequate to maintain operability of the EDGs. The team reviewed wiring diagrams for the EDG enclosure fan control scheme to determine whether the source of power and control scheme were consistent with the design bases. The team reviewed instrument calibration procedures and schedules to determine whether they were consistent with the requirements and assumptions of the design calculations. The team reviewed calibration records and corrective maintenance history to determine whether there had been any adverse operating trends. In addition, the team performed a visual inspection of the temperature switch to determine its suitability for its intended function, and to assess material condition and the presence of hazards.

b. Findings

No findings of significance were identified.

.2.1.1 8 34B to 34D Bus Tie Breaker 34D-1T-2 (Unit 3)

a. Inspection Scope

The team inspected the 34B to 34D bus tie circuit breaker (34D-1T-2) to verify it could respond to design basis events. The team conducted a walkdown of the associated switchgear to verify the material condition of the equipment. The team reviewed inspection, calibration, and overhaul procedures to verify that appropriate preventive maintenance procedures were being performed. The team reviewed condition reports written during the last two years to assess corrective actions taken to address discrepancies. The team reviewed design documents and drawings to evaluate the ability of the breaker to perform its design functions. The system engineer was interviewed regarding the maintenance and operation of the breaker. Finally, the team reviewed the DC voltage drop study to verify that at minimum battery conditions there was sufficient voltage available to operate the breaker.

b. Findings

No findings of significance were identified.

.2.1.1 9 125 Vdc Battery No. 2 and Associated 125 Vac Bus (Unit 3)

a. Inspection Scope

The team reviewed the design, testing and operation of the No. 2 - 125 Vdc station battery to verify that it could perform its design function of providing a reliable source of DC power to connected loads under operating, transient and accident conditions. The team reviewed design calculations to assess the adequacy of the battery sizing to ensure the battery could power the required equipment for a sufficient duration, and at a voltage above the minimum required for equipment operation. The team reviewed the DC protective coordination study to verify that adequate protection exists for postulated faults in the DC system. The team reviewed the battery room hydrogen generation calculation to verify that the hydrogen concentration levels would stay below acceptable levels during normal and postulated accident conditions. The team also reviewed battery performance test results, including discharge tests, to ensure the testing was sufficient and was in accordance with plant technical specifications; and that the results confirmed acceptable performance of the battery. Design and system engineers were interviewed regarding the design, operation, testing and maintenance of the battery. The team performed a walkdown of the No. 2 station battery, the battery chargers and associated distribution panels to assess the material condition of the battery cells and associated electrical equipment. Finally, a sample of condition reports was reviewed to ensure Dominion was identifying and properly correcting issues associated with the No. 2 station battery and associated DC system components.

b. Findings

No findings of significance were identified, with the exception of the battery testing issues identified in Section 1R21.1.1.1.

.2.1.2 0 Reactor Coolant Pump Seal Water Injection Filter 3CHS-FLT3B (Unit 3)

a. Inspection Scope

The team inspected Unit 3 reactor coolant pump (RCP) seal water injection filter 3CHS-FLT3B to ensure it was capable of meeting its design basis requirements. The team reviewed design bases documents, including the UFSAR, calculations, procedures, drawings, and vendor specifications to confirm that the design bases were appropriately implemented and maintained in relation to the operation and maintenance of the filter system. The team reviewed the corrective and preventive maintenance history, as well as surveillance test results, related to the seal injection filters and the filter high differential pressure alarm to determine whether the filter and associated differential pressure instrumentation were appropriately maintained, monitored and operated. The team also reviewed the design bases related to the filter capacities and filtration abilities in order to assess the overall design and effectiveness of the component. Finally, the team conducted a field walkdown with the system engineer of the accessible portions of the associated seal injection filter system to verify that the installed configuration and material condition were consistent with the design bases, specifications and plant drawings.

b. Findings

No findings of significance were identified.

.2.1.2 1 Main Steam Safety Valve 3MSS-RV22A (Unit 3)

a. Inspection Scope

The team inspected Unit 3 Main Steam Safety Valve 3MSS-RV22A to ensure its capability of meeting its design basis requirement of preventing the over-pressurization of the secondary system during postulated design basis events. The team reviewed the Design Bases Summary, UFSAR, and applicable plant drawings to identify the design basis requirements of the safety valve. The team reviewed the corrective and preventive maintenance history, as well as surveillance test results, to verify that potential degradation was being properly identified, monitored and corrected; and to determine whether maintenance, testing, and inspections were being conducted in accordance with the applicable requirements. Also, the team verified the safety setpoint calculation to ensure consistency with design basis requirements. Additionally, the team conducted a walkdown of the safety valve with the system and component engineers to verify that the installed configuration, nameplate data, and material condition were consistent with the design bases and plant drawings. Finally, the team reviewed condition reports to determine the overall health of the relief valve.

b. Findings

No findings of significance were identified.

.2.1.2 2 Charging and Safety Injection Pump Cooling Pumps 3CCE*P1B & 3CCI*P1B (Unit 3)

a. Inspection Scope

The team inspected the 'B' charging pump and safety injection pump cooling pumps, 3CCE*P1B and 3CCI*P1B, to verify that they were capable of meeting their design basis requirements. Both the charging pumps and safety injection pumps were provided with closed loop cooling systems. These cooling pumps circulate cooling water from the charging and safety injection pumps to heat exchangers that are cooled by the service water system.

The team reviewed the capability of the cooling pumps to perform their required function under limiting operating conditions. The team reviewed analyses, operating and test procedures and recent pump test results. The team reviewed the Technical Specification requirements associated with the charging pumps and safety injection pumps to confirm the appropriate requirements were incorporated into operation and test procedures. The team also reviewed recent condition reports and maintenance history to determine the overall condition of the pumps. The team interviewed the system engineer and performed a walkdown of cooling pumps and associated equipment to assess material condition of the components.

b. Findings

No findings of significance were identified.

.2.1.2 3 Turbine-Driven Auxiliary Feedwater Pump 3FWA*P2 (Unit 3)

a. Inspection Scope

The team inspected the Unit 3 turbine-driven auxiliary feedwater (AFW) pump, 3FWA*P2, to verify that it was capable of meeting its design basis requirements. The turbine-driven AFW pump was designed to provide feedwater flow to the steam generators when the normal feedwater system is not available. The pump's motive force is provided by a steam turbine supplied from the main steam system. In addition, the pump would provide feedwater flow to the steam generators in the event of a loss of all AC power (Station Blackout).

This team reviewed the capability of the AFW pump to perform its required function under limiting operating conditions. The review included calculations, operating procedures, test procedures and recent pump test results; and included minimum and maximum flow calculations, as well as NPSH and vortex calculations to verify the adequacy of the pump's suction supply. The team reviewed room heat-up analyses to verify the capability of the pump to operate without room cooling during a postulated station blackout event. The team reviewed the steam supply piping and condensate drains to verify the capability of the pump to start as required. The team also reviewed the Technical Specification requirements associated with the AFW pump; and reviewed recent condition reports and maintenance history to determine the overall condition of the pump and turbine. The team interviewed the system engineer and performed a walkdown of the turbine-driven AFW pump, turbine and associated equipment to assess the material condition of the components.

b. Findings

No findings of significance were identified.

.2.1.2 4 Containment Recirculation Spray Pump 3RSS*P1B (Unit 3)

a. Inspection Scope

The team inspected the Unit 3 containment recirculation spray system (RSS) pump, 3RSS*P1B, to verify that it was capable of meeting its design basis requirements. The containment recirculation pump was designed to provide spray flow to the containment building when required for cooling and depressurization. The pump's suction is provided from the containment sump, and the pump discharge is aligned to its associated RSS heat exchanger. The RSS also functions to deliver water from the containment sump to the suction of the high pressure safety injection pumps and charging pumps during the recirculation phase following a postulated accident to support long term core cooling.

This team reviewed the capability of the RSS pump to perform its required function under limiting operating conditions. The review evaluated calculations, operating procedures, test procedures and recent pump test results; and also reviewed minimum and maximum flow calculations, as well as NPSH and vortex calculations to verify the adequacy of the pump's suction supply. The team reviewed the capability of the pump to fill the normally dry RSS discharge piping when started under accident conditions. The team also reviewed the Technical Specification requirements associated with the recirculation spray pump; and reviewed recent condition reports and maintenance history to determine the overall condition of the pump. Finally, the team interviewed system and design engineers regarding the design of the pump and associated system.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green) involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," in that, Dominion did not ensure the adequacy of the design of the Unit 3 RSS heat exchangers under post accident conditions. Specifically, Dominion did not evaluate the potential impact of air being trapped in the RSS heat exchangers upon system initiation.

Description:

The team reviewed the start-up transient of the Unit 3 RSS pumps under post-accident conditions and identified a potential concern with the RSS heat exchanger design and operation. The RSS heat exchangers are normally maintained in a dry condition and the shell side of the heat exchangers must be filled upon start of the RSS pumps to support containment heat removal. The design basis containment analyses were based on the heat exchangers operating in a water solid condition. The team observed that the inlet connection was located at the upper end of the vertical heat exchanger and the outlet connection was located at the lower end. Therefore, completely filling the shell side of the heat exchanger would require all the air being ejected from the lower heat exchanger connection. The team questioned if any analyses had been performed to verify that all the air would be displaced by the water flow in order to ensure sufficient heat removal capability.

Dominion's review did not identify any existing analysis to address this issue. The team noted that the post-accident design flow through the RSS heat exchangers had been reduced by approximately 50 percent during the 1998 timeframe, when an orifice was installed in the discharge piping of each RSS pump. The team determined that this flow reduction could increase the probability of air being trapped in the heat exchanger shell side during post-accident operation. In addition, Dominion identified that a recent technical evaluation, M3-EV-08-0026, included a statement that the heat exchanger shells would "self vent," but that evaluation did not provide an analysis to support that statement. The team determined that Dominion's failure to evaluate this issue during the design change process was a missed opportunity to correct this design control deficiency.

During the inspection, an informal analysis was performed to verify that the heat exchangers could still perform their design function with the maximum amount of air trapped in the upper section of the shell. Based on the results of this calculation, the impact on post-accident containment temperature would be small and this condition would not result in an operability concern. Dominion initiated CR 322563 to address this issue on February 5, 2009.

Analysis:

The team determined that the failure to verify the adequacy of the design, such as by the performance of a design review or by the use of a calculational method, was a performance deficiency that was reasonably within Dominion's ability to foresee and prevent. The finding was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that that respond to initiating events to prevent undesirable consequences. Also, this issue was similar to example 3j of MC0612, Appendix E because the condition resulted in reasonable doubt of the operability of the component, and additional analyses were necessary to verify operability. Traditional enforcement does not apply because the issue did not have any actual safety consequences or potential for impacting the NRC's regulatory function, and was not the result of any willful violation of NRC requirements. In accordance with NRC Inspection Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," a Phase 1 SDP screening was performed and determined the finding was of very low safety significance (Green) because it was a design or qualification deficiency confirmed not to result in a loss of RSS operability or functionality. This finding did not have a cross-cutting aspect because the most significant contributor of the performance deficiency was not reflective of current licensee performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, "Design Control," requires, in part, that measures be provided for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Contrary to the above, prior to February 5, 2009, Dominion had not ensured the adequacy of the design of the RSS heat exchanger. Specifically, Dominion had not performed analyses or testing to evaluate the potential of air entrapment in the RSS heat exchangers under post-accident conditions. Because this violation is of very low safety significance and has been entered into Dominion's corrective action program (CR 322563), it is being treated as a non-cited violation consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000423/2009006-02, Inadequate Design Control for Potential Air Entrapment in Recirculation Spray System Heat Exchangers)

.2.1.2 5 Charging Pump 3CHS*P3A (Unit 3)

a. Inspection Scope

The team inspected charging pump 3CHS*P3A to assess its ability to meet design basis head and flow requirements under operating, transient, and postulated accident conditions. The team reviewed the design capacity of the refueling water storage tank, hydraulic analyses, NPSH and vortexing calculations, and completed test results to ensure that the injection water source will be available and the process medium will be unimpeded during transient and postulated accident conditions. The team reviewed the charging pump start logic and completed test results to verify pump controls will be functional and provide desired control. The UFSAR, Technical Specifications, accident analyses, and design bases documents were reviewed to ensure that design and licensing bases were met. Pump maintenance history and component modification packages were reviewed to ensure the pump was capable of performing its design function. System health reports, condition reports and the preventive maintenance history were reviewed to verify that potential degradation was identified, monitored and corrected. The team performed a walkdown to assess the material condition of the pump and verify that the installed configuration will support the design basis functions. Finally, the team verified that the pump and associated supporting piping and water sources were adequately protected from flooding, missile, high energy line break, and freezing scenarios.

b. Findings

No findings of significance were identified.

.2.1.2 6 Charging Pump Cubicle Outlet Damper 3HVR*MOD49A (Unit 3)

a. Inspection Scope

The team inspected the Unit 3 charging pump cubicle outlet damper, 3HVR*MOD49A, to ensure it could meet its design function of cooling the 'A' charging pump. The UFSAR, licensing commitments, technical drawings, and other design basis documents were reviewed to ensure that design and licensing bases were met. Condition reports, the vendor manual and damper maintenance history were reviewed to verify that potential degradation was identified, monitored and corrected. Environmental qualification reports were reviewed and compared to the vendor manual replacement recommendations to ensure the damper can perform its safety function when exposed to postulated environmental conditions. A walkdown was performed to assess the material condition and verify that the installed configuration will support its design basis functions under transient and postulated accident.

b. Findings

No findings of significance were identified.

.2.1.2 7 Component Cooling Water Heat Exchanger Supply Valves 3SWP*MOV50A/B (Unit 3)

a. Inspection Scope

The Unit 3 reactor plant component cooling water heat exchanger service water supply valves, 3SWP*MOV50A/B, were inspected to ensure the valves were capable of performing their design function. The team reviewed the valve operating logic and completed surveillance test results to verify valve controls will function to provide desired control in response to an actual or simulated initiation signal. The team verified that the MOV thermal overload settings are bypassed during design basis conditions. The site MOV manual was reviewed, the MOV engineer was interviewed, and calculations were reviewed to verify that the thrust and torque limits and actuator settings were correct and based on appropriate design conditions (e.g., maximum expected differential pressures and minimum expected motor terminal voltage). The UFSAR, Technical Specifications and design bases documents were reviewed to ensure that design and licensing bases were met. System health reports, condition reports and the corrective and preventive maintenance history were reviewed to verify that potential degradation was identified, monitored and corrected. A walkdown was performed to assess the material condition and verify that the installed configuration will support its design basis function under transient and postulated accident conditions.

b. Findings

No findings of significance were identified.

.2.2 Detailed Operator Action Reviews (6 samples)

The team assessed manual operator actions and selected a sample of six operator actions for detailed review based upon risk significance, time urgency, and factors affecting the likelihood of human error. The operator actions were selected from a probabilistic risk assessment (PRA) ranking of operator action importance based on risk reduction worth (RAW) and risk achievement worth (RRW) values. The non-PRA considerations in the selection process included the following factors:

• Margin between the time needed to complete the actions and the time available prior to adverse reactor consequences;

• Complexity of the actions;

• Reliability and/or redundancy of components associated with the actions;

• Extent of actions to be performed outside of the control room;

• Procedural guidance to the operators; and

• Amount of relevant operator training conducted.

.2.2.1 Trip the Reactor Coolant Pumps Following Loss of Seal Cooling (Unit 2)

a. Inspection Scope

The team reviewed the operator action to secure the reactor coolant pumps (RCP) upon loss of seal cooling to the RCPs. The team reviewed the PRA studies to determine when and how quickly the operators are credited with securing the RCPs to prevent a seal loss-of-coolant accident. The team reviewed associated operating, alarm response, and emergency procedures to ensure this action could be performed as credited. The team performed a walkdown of the associated annunciators and instrumentation on the main control room panels. In addition, the team observed operator responses during a simulator run and interviewed the operators on indications and responses to verify operator knowledge and ability to perform the required procedural actions. Finally, the team reviewed a sample of condition reports associated with components necessary to complete the operator action to assess the overall health of the affected components.

b. Findings

No findings of significance were identified.

.2.2.2 Align Standby Service Water Pump Subsequent to Strainer Failure (Unit 2)

a. Inspection Scope

The team reviewed the operator action to align and start the standby service water (SW)pump when the operating SW pump strainer fails. The team reviewed the PRA studies to determine when and how quickly operators are credited with re-establishing SW cooling. The team interviewed licensed operators and training staff, and reviewed associated operating, alarm response and emergency procedures to ensure this action could be performed as credited. The team performed a walkdown of the associated annunciators and instrumentation on the main control room panels to verify the alarm information available to operators. In addition, the team performed a field walkdown of the SW pumps and strainers in the Unit 2 intake structure to evaluate local instrumentation and the ability of the operators to perform the required local proceduralized actions. Finally, the team reviewed a sample of condition reports associated with components necessary to complete the operator action to assess the overall health of the affected components.

b. Findings

No findings of significance were identified.

.2.2.3 Transfer to Cold Leg Recirculation Following a Loss-of-Coolant Accident (Unit 3)

a. Inspection Scope

The team reviewed the manual operator actions to align residual heat removal and recirculation spray systems and transfer to cold leg recirculation after a postulated small break or small-small break loss-of-coolant accident (LOCA). The team reviewed the PRA and Human Reliability Analysis (HRA) studies to assess critical operator action times for success of the operator action. The team interviewed operators and training staff, observed operator responses during a simulator session to transfer to cold leg recirculation, reviewed emergency operating and training procedures, and walked down applicable panels in the simulator and control room to evaluate the time credited critical operator actions. The team reviewed associated alarm response and operating procedures, and reviewed simulator scenarios and operator results to independently assess operator task complexity and emergency procedure clarity. The team compared the available time, based on the identified equipment and operating limits, against operator simulator performance.

In addition, the team walked down accessible portions of the systems credited for the operator action to independently assess configuration control and the material condition of the associated structures, systems, and components; and reviewed maintenance history and a sample of condition reports associated with components necessary to complete the operator action to assess the overall health of the affected components.

b. Findings

No findings of significance were identified.

.2.2.4 Isolate Steam Generator and Depressurize the Reactor Coolant System Following a Steam Generator Tube Rupture (Unit 3)

a. Inspection Scope

The team reviewed the manual operator actions to mitigate the effects of a postulated design basis steam generator (SG) tube rupture; to isolate the SG and depressurize the reactor coolant system (RCS). The team reviewed Dominion's Unit 3 PRA and HRA to determine when critical operator action response times were to be accomplished. The team interviewed operators and training staff, reviewed emergency and operating procedures, observed operator responses during a simulator session, and walked down applicable panels in the simulator and control room to verify the reasonableness of time critical operator margins and risk assumptions. Specifically, the actions reviewed were isolation of auxiliary feedwater to the affected SG, isolation of the SG following the tube rupture, RCS cooldown and depressurization, and emergency core cooling system termination. In addition, the team reviewed a sample of condition reports associated with components necessary to complete the operator action to assess the overall health of the affected components.

b. Findings

No findings of significance were identified.

.2.2.5 Start Standby Charging Pump and Initiate Emergency Core Cooling System (Unit 3)

a. Inspection Scope

The team reviewed the operator action to respond to and stabilize and control the plant following a reactor trip and failure of the operating charging pump. Specifically, this operator action involves starting the standby charging pump and, if necessary, initiating the emergency core cooling system. The team reviewed Dominion's Unit 3 PRA and HRA to determine when and how quickly this action should be accomplished.

The team interviewed operators and training staff, reviewed emergency and operating procedures, directly observed operator responses during a simulator, and walked down applicable panels in the simulator and control room to verify the reasonableness of time margins and risk assumptions. The team reviewed associated alarm response and operating procedures and observed operator responses in the simulator to independently assess operator task complexity and emergency procedure clarity. The team also reviewed a sample of condition reports associated with components necessary to complete the operator action to assess the overall health of the affected components.

b. Findings

No findings of significance were identified.

.2.2.6 Refill Refueling Water Storage Tank Given a Steam Generator Tube Rupture and Unisolable Faulted Steam Generator (Unit 3)

a. Inspection Scope

The team selected the manual operator action required to fill the refueling water storage tank (RWST) following a steam generator tube rupture with an unisolable faulted steam generator on Unit 3. The team reviewed Dominion's PRA and design basis documents to validate the sequence and time restraints for the actions to be accomplished. The team interviewed licensed operators, reviewed emergency and operating procedures, and walked down applicable portions of the auxiliary building and control room to ensure license bases assumptions remained valid. The specific operator action evaluated was manually refilling the RWST from the demineralized water storage tank. The team reviewed the associated procedures and conducted a plant walkdown with operators to observe whether the local actions could be performed in accordance with procedures, and that plant design and configuration supported this action. The team also reviewed a sample of condition reports associated with components necessary to complete the operator action to assess the overall health of the affected components.

b. Findings

No findings of significance were identified.

.2.3 Review of Industry Operating Experience and Generic Issues (6 samples)

The team reviewed selected operating experience issues for applicability at Millstone Power Station. The team performed a detailed review of the operating experience issues listed below to verify that Dominion had appropriately assessed potential applicability to site equipment at both Units 2 and 3, and initiated corrective actions when necessary.

.2.3.1 NRC Information Notice 2004-01, Auxiliary Feedwater Pump Recirculation Line Orifice Fouling - Potential Common Cause Failure

a. Inspection Scope

The team reviewed the applicability and disposition of NRC Information Notice (IN) 2004-01. The NRC issued this IN to inform licensees of potential common cause failure of auxiliary feedwater pumps because of fouling of pump recirculation line flow orifices. The team reviewed Dominion's evaluation of the auxiliary feedwater pump recirculation line orifice fouling at Millstone. Specifically, the team reviewed drawings and corrective action documents and interviewed plant personnel to verify that Dominion had appropriately evaluated the operational experience.

b. Findings

No findings of significance were identified.

.2.3.2 NRC Information Notice 2004-10, Loose Parts in Steam Generators

a. Inspection Scope

The team evaluated Dominion's applicability review and disposition of NRC IN 2004-10. The NRC issued this IN to inform licensees about loose parts found in steam generators. The team reviewed Dominion's evaluation of loose parts found in steam generators. Specifically, the team reviewed procedures, technical requirements, and corrective action documents for preventing, identifying, tracking, and removing loose parts in steam generators.

b. Findings

No findings of significance were identified.

.2.3.3 NRC Information Notice 2005-23, Vibration-Induced Degradation of Butterfly Valves

a. Inspection Scope

The team evaluated Dominion's applicability review and disposition of NRC IN 2005-23. The NRC issued this IN to inform licensees of the degradation of butterfly valves supplied by Fisher Controls and other manufacturers. Specifically, taper pins that connect the valve disc to the valve stem had the potential to become displaced during plant operations. The team reviewed Dominion's evaluation of butterfly valves at Millstone. The team also reviewed the maintenance procedure, work orders and corrective action documents to determine whether the butterfly valves at Millstone were susceptible to the specific degradation in the Information Notice.

b. Findings

No findings of significance were identified.

.2.3.4 NRC Information Notice 2006-29, Potential Common Cause Failure of Motor-Operated Valves as a Result of Stem Nut Wear

a. Inspection Scope

The team evaluated Dominion's applicability review and disposition of NRC IN 2006-029. The NRC issued this IN to inform licensees of potential common cause failure of motor-operated valves (MOV) as a result of stem nut wear. The team reviewed Dominion's evaluation of stem nut wear on MOVs. Specifically, the team reviewed procedures, corrective action documents and interviewed plant personnel to determine whether the MOVs at Millstone were adequately being monitored for stem nut wear.

b. Findings

No findings of significance were identified.

.2.3.5 NRC Information Notice 2007-034, Operating Experience - Electrical Circuit Breakers

a. Inspection Scope

The team evaluated Dominion's applicability review and disposition of NRC IN 2007-034. The NRC issued this IN to inform licensees about operating experience regarding low, medium and high-voltage circuit breakers. The team reviewed Dominion's evaluation of the performance and work practices regarding circuit breakers. Specifically, the team reviewed the procedure and corrective action documents to validate adequate measures were in place to limit the likelihood of circuit breaker issues as described in the Information Notice.

b. Findings

No findings of significance were identified.

.2.3.6 NRC Information Notice 2008-09, Turbine-Driven AFW Pump Bearing Issues

a. Inspection Scope

The team evaluated Dominion's applicability review and disposition of NRC IN 2008-09. The NRC issued the IN to alert licensees to issues with turbine-driven auxiliary feedwater (AFW) pumps, as they relate to the importance of having accurate maintenance instructions and effective post-maintenance testing. The team reviewed Dominion's evaluation of their AFW pump maintenance procedures. The team also reviewed a related Millstone 2 Licensee Event Report (2006-0030), corrective action documents, and maintenance procedures related to the turbine-driven AFW pumps to determine if Millstone was susceptible to the issues stated in the Information Notice.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems (IP 71152)

The team reviewed a sample of problems that Dominion had previously identified and entered into the corrective action program. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions. In addition, condition reports written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action system. The specific corrective action documents that were sampled and reviewed by the team are listed in the attachment.

b. Findings

No findings of significance were identified in addition to the corrective action deficiencies identified separately in this inspection report.

4OA6 Meetings, Including Exit

The team presented the preliminary inspection results to Mr. A. J. Jordan, Site Vice President, and other members of Dominion staff, at an exit meeting on February 6, 2009.

Additional in-office inspection activities continued following the preliminary exit meeting through February 27, 2009. The team presented the final inspection results to Mr. W. Bartron, Licensing Supervisor, and other Dominion staff members during a telephone conference call on March 6, 2009. The team verified that none of the information in this report is proprietary.

ATTACHMENT

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Aube Supervisor - Nuclear Engineering D. Bajumpaa Safety Analysis Engineer J. Barile System Engineer R. Bonner Operations R. Burnham Licensing

T. Cleary Licensing Engineer T. Ickes IST Engineer N. Jaycox System Engineer J. Majewski System Engineer J. Plourde Maintenance

R. Patel Design Engineer E. Peterson Design Engineer C. Roth System Engineer T. Ryan System Engineer L. Salyards Mechanical Liaison

E. Smith System Engineer S. Stricker Design Engineer H. Thompson System Engineer R. Van Steenbergen MOV Engineer L. Wagnecz System Engineer

LIST OF ITEMS

Opened and Closed

NCV

05000336/2009006-01 Inadequate Performance Testing of Safety Related

05000423/2009006-01 Batteries (Section 1R21.2.1.1.1)

NCV

05000336/2009006-02 Inadequate Corrective Action for Degraded Battery Cell (Section 1R21.2.1.1.2)

NCV

05000336/2009006-03 Inadequate Corrective Action for Safety Related Inverter Out-of-Calibration Results (Section 1R21.2.1.2)

NCV

05000423/2009006-02 Inadequate Design Control for Potential Air Entrapment in Recirculation Spray System Heat Exchangers (Section 1R21.2.1.24)

LIST OF DOCUMENTS REVIEWED

Calculations