IR 05000305/2012009

IR 05000305-12-009 on 10/01/2012 - 11/02/2012; Kewaunee Power Station; Component Design Bases Inspection (CDBI)

ML12356A483
Person / Time
Site:	Kewaunee
Issue date:	12/21/2012
From:	Ann Marie Stone NRC/RGN-III/DRS/EB2
To:	Heacock D Dominion Energy Kewaunee
George Hausman
References
IR-12-009
Download: ML12356A483 (42)

Text

ber 21, 2012

SUBJECT:

KEWAUNEE POWER STATION - NRC COMPONENT DESIGN BASES INSPECTION (CDBI) INSPECTION REPORT 05000305/2012009

Dear Mr. Heacock:

On November 2, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a Component Design Bases Inspection (CDBI) at your Kewaunee Power Station. The enclosed report documents the inspection findings, which were discussed on November 2, 2012, with Mr. Roy Simmons and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, five NRC-identified findings of very low safety significance were identified. The findings involved violations of NRC requirements. However, because of their very low safety significance, and because the issues were entered into your Corrective Action Program, the NRC is treating the issues as Non-Cited Violations (NCVs) in accordance with Section 2.3.2 of the NRC Enforcement Policy.

If you contest the subject or severity of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, Region III; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Kewaunee Power Station. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III, and the NRC Resident Inspector at the Kewaunee Power Station. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any), will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)

component of NRC's Agency wide Documents Access and Management System (ADAMS),

accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Ann Marie Stone, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-305 License No. DPR-43

Enclosure:

Inspection Report 05000305/2012009 w/Attachment: Supplemental Information

REGION III==

Docket No: 50-305 License No: DPR-43 Report No: 05000305/2012009 Licensee: Dominion Energy Kewaunee, Inc.

Facility: Kewaunee Power Station Location: Kewaunee, WI Dates: October 1, 2012, through November 2, 2012 Exit Date: November 2, 2012 Inspectors: George M. Hausman, Senior Engineering Inspector, Lead Ijaz Jesse Hafeez, Engineering Inspector, Electrical Dariusz Szwarc, Engineering Inspector, Mechanical Nicholas A. Valos, Operations Inspector Craig J. Baron, Mechanical Contractor George B. Skinner, Electrical Contractor Approved by: Ann Marie Stone, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000305/2012009; 10/01/2012 - 11/02/2012; Kewaunee Power Station; Component Design

Bases Inspection (CDBI).

The inspection was a 3-week onsite baseline inspection that focused on the design of components. The inspection was conducted by regional engineering inspectors and two consultants. Five (Green) findings were identified by the inspectors. All five of these findings were considered Non-Cited Violations (NCVs) of NRC regulations. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White,

Yellow, Red) and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process dated June 2, 2011. Cross-cutting aspects are determined using IMC 0310, Components within the Cross Cutting Areas dated October 28, 2011. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy dated June 7, 2012. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Green.

The inspectors identified a finding of very low safety significance and an associated Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XVI,

Corrective Action, for the licensees failure to establish measures to assure that conditions adverse to quality were corrected. Specifically, the licensee failed to correct a previously identified finding concerning the safety-related 125 Volts direct current (Vdc)battery service test procedures, where the procedures failed to include the appropriate acceptance criteria for critical periods of the duty cycle, including the first minute. The licensee entered this finding into their Corrective Action Program as CR491149, 2012 CDBI Identified No Acceptance Criteria in the Battery Surveillance Procedure, dated October 10, 2012.

The performance deficiency was determined to be more than minor because the licensee could not be assured that loads supplied by the 125 Vdc batteries would have adequate voltage to operate during critical periods of the duty cycle. Since the finding did not represent an actual loss of safety function, the finding screened as having very low safety significance (Green). This finding has a cross-cutting aspect in the area of human performance, decision making because the licensee did not formally define the authority and roles for decisions affecting nuclear safety and as a result did not take the necessary steps to resolve an inadequate surveillance procedure in a timely manner.

Specifically, the licensee delayed resolving the inadequate surveillance procedures until a major calculation revision was accomplished. H.1(a) [Section 1R21.3b.(1)]

Green.

The inspectors identified a finding of very low safety significance and an associated Non-Cited Violation (NCV) of Improved Technical Specifications (ITS),

Surveillance Requirement (SR) 3.7.7.1 because the licensee failed to ensure four component cooling (CC) system manual valves in the flow path servicing the safety-related CC system pumps, that were not locked, sealed, or otherwise secured in position, were verified in the correct position (i.e., open) every 31 days. The licensee entered this finding into their Corrective Action Program as CR490316, 2012 CDBI CC

Pump Recirc Valves (CC-21A, -22A, -23B, -24B) Are Not Sealed, dated October 4, 2012.

The performance deficiency was determined to be more than minor because it was similar to Inspection Manual Chapter (IMC) 0612, Appendix E, Example 3.c. The finding was considered more than minor because more than one valve was in the required position, but not locked, sealed or otherwise secured in the correct position (i.e., open).

Since the finding did not represent an actual loss of safety function, the inspectors screened the finding as having very low safety significance (Green). This finding has a cross-cutting aspect in the area of human performance, decision-making because the licensee did not use conservative assumptions in implementing ITS, SR 3.7.7.1.

Specifically, the licensee failed to perform an effective review of the safety related consequences of their decision to not verify the valves correct position every 31 days.

(H.1(b)) [Section 1R21.3b.(2)]

Green.

The inspectors identified a finding of very low safety significance and an associated Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III,

Design Control, for the licensees failure to assure that the design basis was correctly translated into specifications and procedures. Specifically, the licensee failed to provide design control measures to account for motor control center (MCC) voltage dips in MOV calculations that occur when large ESF motors are started at the onset of an accident. The licensee entered this finding into their Corrective Action Program as CR494297, 2012 CDBI: Potential MOV Stalls Not Proven by Calc to Not Occur, dated November 1, 2012.

The performance deficiency was determined to be more than minor because the inspectors had reasonable doubt that adequate margin existed to ensure the MOVs required to start at the onset of an accident would have adequate voltage and/or torque.

Upon further evaluation by the licensee, the inspectors determined the finding did not represent a loss of operability or functionality, therefore, the finding screened as having very low safety significance (Green). This finding has a cross-cutting aspect in the area of human performance, resources because the licensee did not provide complete, accurate, and up-to-date design documentation, including calculations and procedures to assure nuclear safety. Specifically, the licensee failed to ensure that personnel had adequate procedural guidance to account for MCC voltage dips in MOVs that occur when large ESF motors are started at the onset of an accident. H.2(c)

[Section 1R21.3b.(3)]

Green.

The inspectors identified a finding of very low safety significance and an associated Non-Cited Violation (NCV) of Improved Technical Specification (ITS),

Section 5.4.1b because Procedure EOP ES-1.3, Transfer to Containment Sump Recirculation, Revision 36 did not establish the necessary actions as required.

Specifically, the licensee failed to ensure Procedure EOP ES-1.3 contained the necessary actions for establishing containment sump recirculation for a large loss of coolant accident (LLOCA) with a concurrent failure of safety injection (SI) Pump A and the inability to establish containment sump recirculation using residual heat removal (RHR) Train B. The licensee entered this finding into their Corrective Action Program as CR491773, 2012 CDBI Identified Issue with EOP ES-1.3, dated October 15, 2012. In addition, the licensee initiated a procedure change to ES-1.3 to revise the procedure to allow transfer to containment sump recirculation without SI flow interruption to the RCS for a LLOCA with a failure of SI Pump A and with RHR Train B unable to be aligned for containment sump recirculation.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstones attribute of procedure quality and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensee failed to ensure the procedure for establishing containment sump recirculation for a LLOCA contained the necessary actions for potential equipment failures. Since the finding resulted in the potential for a loss of the containment sump recirculation function during a LLOCA for certain equipment failures, the inspectors determined a Detailed Risk Evaluation was required. Based on the Detailed Risk Evaluation, the Senior Reactor Analysts determined that the delta core damage frequency for the finding was 1.0E-10/yr and was of very low safety significance (Green). The inspectors did not identify a cross-cutting aspect associated with this finding because the finding was not representative of current performance.

[Section 1R21.3b.(4)]

Green.

The inspectors identified a finding of very low safety significance and an associated Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III,

Design Control, for the licensees failure to ensure consistent criterion was used in OP-KW-ORT-MISC-014, Validation of Time Critical Operator Actions, Revision 2 (i.e., the Operations procedure) to validate the time-critical operator actions for Break Flow Termination. Specifically, the licensee failed to ensure the Break Flow Termination criterion (i.e., the time frame when the primary-to-secondary flow in the ruptured steam generator (SG) is required to be stopped) was consistent with the criterion contained in CN-CRA-03-16, Kewaunee Power Station Supplemental Steam Generator Tube Rupture Margin to Overfill Analysis, Revision 0 (i.e., the calculation).

The licensee entered this finding into their Corrective Action Program as CR492485, 2012 CDBI TCA Validation Criteria Does Not Agree with Engineering Basis Document, dated October 19, 2012.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstones attribute of procedure quality and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, during the performance of the steam generator tube rupture (SGTR) design basis event scenario on the licensees simulator, the inspectors noted the operators did not terminate the primary-to-secondary break flow within the time frame assumed in design calculation. Therefore, the inspectors concluded there was reasonable doubt that adequate margin existed to ensure SG overfill would have been prevented during an actual SGTR design basis event. The inspectors determined the finding could be evaluated using the Mitigating Systems Screening questions in Exhibit 2 of IMC 0609 and concluded the finding screened as having very low safety significance (Green). The inspectors did not identify a cross-cutting aspect associated with this finding because the finding was not representative of current performance. [Section 1R21.6b]

Licensee-Identified Violations

No violations were identified.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R21 Component Design Bases Inspection

.1 Introduction

The objective of the Component Design Bases Inspection is to verify the design bases have been correctly implemented for the selected risk-significant components and the operating procedures and operator actions are consistent with design and licensing bases. As plants age, their design bases may be difficult to determine and an important design feature may be altered or disabled during a modification. The Probabilistic Risk-Assessment (PRA) model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

Specific documents reviewed during the inspection are listed in the Attachment to the report.

.2 Inspection Sample Selection Process

The inspectors used information contained in the licensees PRA and the Kewaunee Power Stations Standardized Plant Analysis Risk-Model to identify two scenarios to use as the basis for component selection. The scenarios selected were station blackout (SBO) and steam generator tube rupture (SGTR) events. Based on these scenarios, a number of risk-significant components were selected for the inspection.

The inspectors also used additional component information such as a margin assessment in the selection process. This design margin assessment considered original design reductions caused by design modifications, power uprates, or reductions due to degraded material condition. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as performance test results, significant corrective actions, repeated maintenance activities, Maintenance Rule (a)(1) status, components requiring an operability evaluation, NRC resident inspector input of problem areas/equipment, and system health reports.

Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in depth margins. A summary of the reviews performed and the specific inspection findings identified are included in the following sections of the report.

The inspectors also identified procedures and modifications associated with the selected components. In addition, the inspectors selected operating experience issues associated with the selected components.

This inspection constituted 17 samples as defined in Inspection Procedure 71111.21-05.

.3 Component Design

a. Inspection Scope

The inspectors reviewed the Updated Safety Analysis Report (USAR), Improved Technical Specifications (ITS), design basis documents (DBDs), drawings, calculations, and other available design basis information, to determine the performance requirements of the selected components. The inspectors used applicable industry standards, such as the American Society of Mechanical Engineers (ASME) Code, Institute of Electrical and Electronics Engineers (IEEE) Standards and the National Electric Code, to evaluate acceptability of the systems design. The inspectors also evaluated licensee actions, if any, taken in response to NRC issued operating experience, such as Bulletins, Generic Letters (GLs), Regulatory Issue Summaries (RISs), and Information Notices (INs). The review was to verify the selected components would function as designed when required and support proper operation of the associated systems. The attributes needed for a component to perform its required function include process medium, energy sources, control systems, operator actions, and heat removal. The attributes to verify the component condition and tested capability was consistent with the design bases and was appropriate may include installed configuration, system operation, detailed design, system testing, equipment and environmental qualification, equipment protection, component inputs and outputs, operating experience, and component degradation.

For each of the components selected, the inspectors reviewed the maintenance history, preventative maintenance activities, system health reports, operating experience-related information, vendor manuals, electrical and mechanical drawings, and licensee Corrective Action Program (CAP) documents. Field walkdowns were conducted for all accessible components to assess material condition and to verify the as-built condition was consistent with the design. Other attributes reviewed are included as part of the scope for each individual component.

The following 17 components (inspection samples) were reviewed:

• 125 Vdc Safety-Related Battery BRB-101: The inspectors reviewed various electrical calculations associated with the safety-related 125 Vdc battery to verify the battery was designed to perform its function and pick up the required loads during a SBO event. These calculations included sizing calculations to determine whether the battery was adequately sized to provide the required current and voltage during worst case accident loading; short circuit and protective device calculations to determine whether the batteries were adequately protected and immune from spurious tripping; and voltage drop calculations to determine whether the most limiting load had adequate voltage under minimum battery voltage conditions. The inspectors reviewed battery surveillance procedures and completed tests to determine whether the acceptance criteria and results were consistent with design basis calculations. The inspectors also reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends.

In addition, the inspectors performed a visual inspection of the 125 Vdc batteries to assess material condition and the presence of hazards.

• 125 Volts direct current (Vdc) Distribution Panels BRB-102 and BRB-104: The inspectors reviewed various electrical calculations including load flow calculations to determine whether the panels were applied within their required current ratings; voltage drop calculations to determine whether loads had their required minimum voltage and whether they were applied within their maximum voltage rating during battery equalizing; and short circuit and protective device calculations to determine whether equipment was adequately protected and immune from spurious tripping.

The inspectors also reviewed maintenance schedules, procedures, and maintenance records, including circuit breaker test requirements, to determine whether the panels and their associated circuit breakers were being properly maintained. In addition, the inspectors performed a visual inspection of the 125 Vdc Distribution Panels to assess material condition and the presence of hazards.

• 4160 Volts alternating current (Vac) Bus 1-6: The inspectors reviewed bus loading calculations to determine whether the 4160 Vac system had sufficient capacity to support its required loads under worst case accident loading and grid voltage conditions. The inspectors reviewed the design of the degraded voltage protection scheme to determine whether it afforded adequate voltage to safety-related devices at all voltage distribution levels. This included review of degraded voltage relay setpoint calculations and voltage calculations for downstream equipment such as motor operated valves (MOVs). The inspectors reviewed the overcurrent protection scheme for the 4160 Vac buses including drawings and calculations to determine whether loads were adequately protected and immune from spurious tripping. The inspectors reviewed 125 Vdc system voltage drop calculations to determine whether 4160 Vac bus circuit breakers had adequate control voltage. The inspectors reviewed maintenance schedules and procedures for the 4160 Vac bus and its associated circuit breakers to determine whether the equipment was being properly maintained. This included reviewing acceptance criteria in procedures for consistency with vendor recommendations and design calculations. The inspectors reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends. In addition, the inspectors performed a visual inspection of the 4160 Vac safety buses to assess material condition and the presence of hazards. Passive long lived portions of this component were verified to be in scope of license renewal and aging effects managed by appropriate programs.

• 480 Vac Bus 1-62: The inspectors reviewed bus loading calculations to determine whether the 480 Vac system had sufficient capacity to support its required loads under worst case accident loading and grid voltage conditions. The inspectors reviewed the overcurrent protection scheme for the 480 Vac buses including drawings and calculations to determine whether loads were adequately protected and immune from spurious tripping. The inspectors reviewed 125 Vdc system voltage drop calculations to determine whether 480 Vac bus circuit breakers had adequate control voltage. The inspectors reviewed maintenance schedules and procedures for the 480 Vac bus and its associated circuit breakers to determine whether the equipment was being properly maintained. This included reviewing acceptance criteria in procedures for consistency with vendor recommendations and design calculations. The inspectors reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends.

In addition, the inspectors performed a visual inspection of the 480 Vac safety buses to assess material condition and the presence of hazards.

• 4160 Vac Circuit Breaker 1-601, Reserve Auxiliary Transformer (RAT) Feed to Bus 1-6: The inspectors reviewed bus loading and short circuit calculations to determine whether the breaker was adequately rated for worst case accident loading and maximum fault current. The inspectors reviewed the overcurrent protection scheme for the 4160 Vac buses including drawings and calculations to determine whether the breaker was immune from spurious tripping. The inspectors reviewed 125 Vdc system voltage drop calculations to determine whether the circuit breaker had adequate control voltage. The inspectors reviewed maintenance schedules and procedures for the breaker to determine whether it was being properly maintained.

This included reviewing acceptance criteria in procedures for consistency with vendor recommendations and design calculations. The inspectors reviewed corrective action documents and maintenance records to determine whether there were any adverse operating trends. In addition, the inspectors performed a visual inspection of the breaker to assess material condition and the presence of hazards.

• Component Cooling (CC) Pump 1B: The inspectors reviewed design analyses associated with the CC water pump capacity, net positive suction head (NPSH), and minimum flow to verify the equipments capacity to perform its required functions.

The inspectors also reviewed pump performance test procedures and recent results to verify the actual capability of the installed equipment. The inspectors reviewed a sample of operating procedures associated with the pump under normal and accident conditions. The inspectors performed walkdowns of the pump and associated equipment, conducted interviews with the responsible system engineer, and reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment. The inspectors reviewed the system design basis associated with the capability of recovering from a postulated single failure.

The inspectors also reviewed the capability of the electrical system to support pump operation. The inspectors reviewed voltage drop calculations to determine whether the motors had adequate voltage for running and starting under degraded voltage conditions. The inspectors reviewed protective relaying calculations to determine whether the motors were adequately protected and immune to spurious tripping.

• Diesel Room B Supply Fan: The inspectors reviewed system health reports and CAP documents associated with the diesel room B supply fan. The inspectors interviewed the system engineer and discussed the recent modification of the air supply for the ventilation dampers. The inspectors reviewed the ventilation calculation to verify that the emergency diesel generator (EDG) would have enough combustion air available to support its operation. The inspectors reviewed voltage drop calculations to determine whether the motors had adequate voltage for running and starting under degraded voltage conditions. The inspectors reviewed protective relaying calculations to determine whether the motors were adequately protected and immune to spurious tripping. The inspectors also performed a walkdown of the system.

• Emergency Diesel Generator (EDG) 1B: The inspectors reviewed selected mechanical support systems for the 1B EDG, which included diesel room cooling, lube oil, and jacket water cooling. The inspectors conducted a field walkdown of the EDG to verify the ambient environmental and the material condition of the EDG.

This included an assessment of building ventilation and susceptibility of EDG support systems to damage from tornado depressurization. The inspectors reviewed the design basis documentation, USAR, and ITS to ensure design and licensing bases were met. In addition, the inspectors interviewed system and design engineers and reviewed selected condition reports (CRs) to assess the current condition of the EDG. The inspectors reviewed the equipment system health reports, maintenance history, and corrective action records to determine whether there had been any adverse operating trends. The inspectors reviewed the ability of the EDG to start at the end of a SBO using starting air. The inspectors reviewed fuel availability and fuel consumption calculations. Passive long lived portions of this component were verified to be in scope of license renewal and aging effects managed by appropriate programs.

• Residual Heat Removal (RHR) Supply Valve RHR-11: The inspectors reviewed calculations, maintenance history, operations history, and design requirements to verify the equipments capacity to perform its required functions. The inspectors reviewed the design differential pressure for this valve to verify its capability to operate under the most limiting conditions. The inspectors reviewed a modification associated with the electrical control circuits for the valve and verified that the control circuit testing and calibration was comprehensive. The inspectors also reviewed MOV test procedures and recent results to verify the actual capability of the installed equipment. The inspectors conducted interviews with the responsible system engineer and MOV engineer, and reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment. The inspectors also reviewed the capability of the electrical system to support valve operation. The inspectors reviewed voltage drop calculations to determine whether the motors and their associated control circuits had adequate voltage under degraded voltage conditions. The inspectors also reviewed protective relaying calculations to determine whether the MOVs were adequately protected and immune to spurious tripping.

• RHR Suction Valve RHR-1B: The inspectors reviewed calculations, maintenance history, operations history, and design requirements to verify the equipments capacity to perform its required functions. The inspectors reviewed the design differential pressure for this valve to verify its capability to operate under the most limiting conditions. The inspectors also reviewed the potential impact of NRC GL 96-06 on the capability of the valve to be opened when required to initiate RHR operation. The inspectors verified that the control circuit testing and calibration was comprehensive. The inspectors also reviewed MOV test procedures and recent results to verify the actual capability of the installed equipment. The inspectors conducted interviews with the responsible system engineer and MOV engineer, and reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment. The inspectors also reviewed the capability of the electrical system to support valve operation. The inspectors reviewed voltage drop calculations to determine whether the motors and their associated control circuits had adequate voltage under degraded voltage conditions. The inspectors also reviewed protective relaying calculations to determine whether the MOVs were adequately protected and immune to spurious tripping.

• Pressurizer Power Operated Relief Valve (PORV) PR-2B: The inspectors reviewed maintenance history, operations history, and design requirements to verify the valves capacity to perform its required functions. The inspectors reviewed the instrument air and back-up accumulator supply to the valve. The inspectors also conducted interviews with the air operated valve (AOV) engineer and observed the use of the PORV during a simulator exercise involving a SGTR event, and reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment.

• Reserve Auxiliary Transformer: The inspectors reviewed load flow calculations to determine whether the transformer was applied within its specified ratings. The inspectors reviewed maintenance schedules, vendor recommendations, and procedures to determine whether the transformers were being properly maintained.

This included reviewing acceptance criteria in procedures for consistency with vendor recommendations and design calculations. The inspectors reviewed protective relaying schemes and calculations to determine whether the transformer was adequately protected and whether it was susceptible to spurious tripping. The inspectors reviewed maintenance and corrective action histories to determine whether there were any adverse operating trends. In addition, the inspectors performed a walkdown of the installed equipment to determine whether the installed configuration was consistent with design documents including drawings and calculations and to assess the presence of hazards.

• RHR Pump 1B: The inspectors reviewed design analyses associated with RHR pump capacity, NPSH, and minimum flow to verify the equipments capacity to perform its required functions. The inspectors reviewed calculations, drawings, procedures, tests, and other analyses to verify selected calculation inputs, assumptions, and methodologies were accurate and justified, and were consistently applied. The inspectors reviewed completed tests to confirm the acceptance criteria and test results demonstrated the capability of the pump to provide required flow rates. In-Service Testing (IST) and full flow design basis test results were reviewed to assess potential component degradation and impact on design margins. The inspectors also reviewed the 1B RHR pumps capability to transfer pump suction sources. The inspectors reviewed voltage drop calculations to determine whether the motors had adequate voltage for running and starting under degraded voltage conditions. The inspectors reviewed protective relaying calculations to determine whether the motors were adequately protected and immune to spurious tripping.

• RHR Heat Exchanger 1B: The inspectors reviewed documentation for the RHR Heat Exchanger 1B, which included USAR licensing design basis requirements, ITS, and overall RHR system performance requirements. The system engineer was interviewed and the overall health of the RHR system, with emphasis on the heat exchanger, was discussed. The inspectors also reviewed test procedures for appropriate acceptance criteria; including the testing and inspection results to verify compliance with heat exchanger program requirements.

• Safety Injection (SI) Pump 1B: The inspectors reviewed design analyses associated with the SI pump capacity, NPSH, runout flow, and minimum flow to verify the equipments capacity to perform its required functions. The inspectors also reviewed pump performance test procedures and recent results to verify the actual capability of the installed equipment. The inspectors reviewed a sample of operating procedures associated with the pump under normal and accident conditions. The inspectors performed walkdowns of the pump and associated equipment, conducted interviews with the responsible system engineer, and reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment. The inspectors also observed the use of the pump during a simulator exercise involving a SGTR event. The inspectors reviewed the capability of the electrical system to support pump operation. The inspectors reviewed voltage drop calculations to determine whether the motors had adequate voltage for running and starting under degraded voltage conditions. The inspectors reviewed protective relaying calculations to determine whether the motors were adequately protected and immune to spurious tripping.

• Service Water Pumps 1B1 and 1B2: The inspectors reviewed design analyses associated with the service water pump capacity, runout flow, and minimum flow to verify the equipments capacity to perform its required functions. This review included the system hydraulic analysis and the comparison of the analysis to available system flow test results. The inspectors also reviewed pump performance test procedures and recent results to verify the actual capability of the installed equipment. The inspectors reviewed a sample of operating procedures associated with the pump under normal and accident conditions. The inspectors performed walkdowns of the pump and associated equipment, conducted interviews with the responsible system engineer, and reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment. The inspectors also reviewed the potential effects of flooding on the pumps and reviewed the design of the heating, ventilation, and air conditioning (HVAC) system in the pump area. The inspectors reviewed the capability of the electrical system to support pump operation. The inspectors reviewed voltage drop calculations to determine whether the motors had adequate voltage for running and starting under degraded voltage conditions. The inspectors reviewed protective relaying calculations to determine whether the motors were adequately protected and immune to spurious tripping.

• Steam Generator PORVs SD-3A and SD-3B: The inspectors reviewed calculations, maintenance history, operations history, and design requirements to verify these valves capacity to perform their required functions. The inspectors also reviewed valve test procedures and recent results to verify the actual capability of the installed equipment. The inspectors reviewed the instrument air, back-up air accumulators, and nitrogen supplies associated with the valves to verify their capability under normal, accident, and SBO conditions. The inspectors performed walkdowns of the valves and associated equipment, conducted interviews with the AOV engineer, and observed the use of the steam generator PORVs during a simulator exercise involving a SGTR event. The inspectors also reviewed a sample of corrective action and maintenance documents to verify the material condition of the equipment.

b. Findings

(1) Failure to Correct a Condition Adverse to Quality Associated with the Safety-Related 125 Vdc Battery Service Test Procedures

Introduction:

The inspectors identified a finding of very low safety significance (Green)and an associated Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for the licensees failure to establish measures to assure that conditions adverse to quality were corrected. Specifically, the licensee failed to correct a previously identified finding concerning the safety-related 125 Vdc battery service test procedures, where the procedures failed to include the appropriate acceptance criteria for critical periods of the duty cycle, including the first minute.

Description:

During the 2007 CDBI, the NRC identified a finding involving the failure to include appropriate minimum battery terminal voltage, during the first minute, into the acceptance criteria for safety-related battery service test Procedures SP-38-102A/B Station Battery Load Test Electrical Maintenance Revisions 4 and 6, respectively.

During the 2012 CDBI, the inspectors reviewed the corrective actions taken in response to the NCV issued for this failure. The inspectors determined that two CAP documents were listed in the 2007 CDBI report. The first, CAP 042057, CDBI - Station Battery Load Test Procedures SP-38-102A&B was implemented and a procedure change request (PCR) resulted. The inspectors reviewed PCR030635, CDBI - Station Battery Load Test Procedures SP-38-102A&B dated March 20, 2007, which applied to Procedure SP-28-102A/B and noted that, while it required adding a step to attach test data for the first minute at 10 second intervals, it did not address incorporating any minimum battery terminal voltage, during the first minute, into the acceptance criteria.

Therefore, this CAP did not resolve the NCV.

The second CAP 042342 was never closed. The corrective actions for resolving this issue were affected by a series of reassignments caused by a change in the electronic corrective action system, and a series of corrective action time extensions. During these reassignments and time extensions, the necessity for updating the surveillance procedure was subordinated to a roll up of calculation addenda, which was viewed as a purely administrative process, which ultimately was assigned a due date of May 2013.

The inspectors also reviewed Surveillance Procedures MA-KW-ESP-EDC-004A and MA-KW-ESP-EDC-004B, Station Battery BRA101/102 Load Test Electrical Maintenance, Revisions 2 and 3, respectively. The inspectors determined that these procedures replaced SP-38-102A/B. The inspectors reviewed the new procedures and noted the acceptance criteria for the minimum battery voltage during critical portions of the duty cycle (e.g., the first minute) was not included.

On October 10, 2012, the licensee initiated CR491149 and concluded that the previous test results had been acceptable because they showed minimum voltages above 110 Vdc for BRA-101 and 112 Vdc for BRB-101, as specified in USAR, Section 8.2.3.4.

The inspectors noted, however, that appropriate acceptance criteria for safety-related battery service tests could not be easily discerned from the design basis calculations.

This was partially due to the fact that the determination of minimum required battery voltage was not identified as a calculation objective in the 125 Vdc system voltage drop calculations, such as C11723, 125 Vdc Battery BRA-101 and BRB-101 Sizing, Voltage Drop, Short Circuit and Charger Sizing. In response to further inquiries by the inspectors, the licensee confirmed that the voltage criteria in USAR, Section 8.2.3.4 was not supported by design calculations and concluded that the minimum required voltages were approximately 111 Vdc for BRA-101 and 113 Vdc for BRB-101. The conclusion was based on voltage requirements for 125 Vdc control circuits analyzed in Calculation C11727, 125 Vdc Control Circuit Voltage Drop, Revision 1. These criteria were also determined to be satisfied by previous test results, as documented in CR491765. The inspectors subsequently questioned these values and determined that the actual minimum voltage required for safety-related battery BRA-101 was approximately 113 Vdc, based on voltage requirements for the turbine driven auxiliary feedwater pump lube oil pump motor, as documented in Calculation C11723, Addendum A. The licensee confirmed that this criterion was also satisfied by previous test results for safety-related Battery BRA-101.

Analysis:

The inspectors determined that the licensees failure to establish measures to assure that conditions adverse to quality were corrected was contrary to 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, and was a performance deficiency. Specifically, the licensee failed to correct a previously identified violation concerning the safety-related 125 Vdc battery service test procedures, where the procedures failed to include the appropriate acceptance criteria for critical periods of the duty cycle, including the first minute.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstones attribute of equipment performance and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the licensee could not be assured that loads supplied by the 125 Vdc batteries would have adequate voltage to operate during critical periods of the duty cycle.

In accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 2, the inspectors determined the finding affected the Mitigating Systems cornerstone. As a result, the inspectors determined the finding could be evaluated using Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2 for the Mitigating Systems cornerstone. The performance deficiency which affected the qualification of the mitigating structures, system, and components (SSCs) did not result in a loss of operability or functionality because the licensees previous test results showed the minimum voltages observed and documented during the testing to be above the required voltages determined by the licensees preliminary review of the design calculations. Therefore, the inspectors answered "yes" to the Mitigating Systems Screening question A.1 in Exhibit 2 and screened the finding as having very low safety significance (Green).

This finding has a cross-cutting aspect in the area of human performance, decision making because the licensee did not formally define the authority and roles for decisions affecting nuclear safety and as a result did not take the necessary steps to resolve an inadequate surveillance procedure in a timely manner. Specifically, the licensee delayed resolving the inadequate surveillance procedure until a major calculation revision was accomplished. H.1(a)

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.

Contrary to the above, from March 1, 2007, to October 31, 2012, the licensee failed to establish measures to assure that conditions adverse to quality were corrected.

Specifically, the licensee failed to correct a previously identified violation concerning the safety-related 125 Vdc battery service test procedures, where the procedures failed to include the appropriate acceptance criteria for critical periods of the duty cycle, including the first minute.

This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy because it was of very low safety significance and was entered into the licensees CAP as CR491149 (NCV 05000305/20120009-01, Failure to Correct a Condition Adverse to Quality Associated with the Safety-related 125 Vdc Battery Service Test Procedures).

(2) Failure to Ensure Four CC System Manual Valves Were in the Correct Position as Required by ITS, SR 3.7.7.1

Introduction:

The inspectors identified a finding of very low safety significance (Green)and an associated NCV of ITS, SR 3.7.7.1 because, the licensee failed to ensure four CC system manual valves in the flow path servicing the safety-related CC system pumps, that were not locked, sealed, or otherwise secured in position, were verified in the correct position (i.e., open) every 31 days.

Description:

On October 30, 2003, the modification to install the four manual valves CC-21A, CC-22A, CC-23B, and CC-24B was completed per Design Change Request (DCR) 3381, Install CCW Pump Recirc Lines, dated September 24, 2003. The four CC system manual valves were added to the flow paths servicing the safety-related CC system pumps 1A and 1B. The safety-related CC system pumps 1A and 1B recirculation flow paths ensure proper cooling and provide a continuous minimum recirculation flow to prevent the safety-related CC system pumps from operating in a dead-headed condition.

On February 12, 2011, Improved Technical Specifications were implemented at the Kewaunee Power Station via License Amendment No. 207. Following implementation of ITS, SR 3.7.7.1 required the licensee every 31 days to Verify each CC [system] manual, power operated, and automatic valve in the flow path servicing safety-related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

During this inspection, the inspectors identified four CC system manual valves in the CC systems flow path associated with the safety-related CC system pumps recirculation lines that were not locked, sealed, or otherwise secured in position. Per ITS, SR 3.7.7.1, the four CC system manual valves CC-21A, CC-22A, CC-23B, and CC-24B were required to be periodically verified in their correct position (i.e., open) every 31 days.

However, the CC system manual valves were not included in the licensees surveillance Procedure OP-KW-OSP-ESF-002, ESF Monthly Alignment Verification, Revision 7 to meet this requirement. As a result, the licensee initiated CAP document CR490316, 2012 CDBI CC Pump Recirc Valves (CC-21A, -22A, -23B, -24B) Are Not Sealed, dated October 4, 2012.

On October 4, 2012, the licensee verified the correct position (i.e., open) for the four CC system manual valves CC-21A, CC-22A, CC-23B, and CC-24B using N-CC-31-CL, Component Cooling System Prestartup Checklist. In addition, in lieu of verifying that the four CC system manual valves are in the correct position (i.e., open) every 31 days per Procedure OP-KW-OSP-ESF-002, the licensee on October 30, 2012, sealed the four CC system manual valves in the open position and updated Procedure N-CC-31-CL, from Revision 32 to Revision 33, to reflect that the four CC system manual valves were required to be in the sealed open position.

Analysis:

The inspectors determined that the licensees failure to ensure four CC system manual valves in the flow path servicing the safety-related CC system pumps, that were not locked, sealed, or otherwise secured in position, were verified in the correct position (i.e., open) every 31 days was contrary to ITS, SR 3.7.7.1 and was a performance deficiency.

The performance deficiency was determined to be more than minor because it was similar to IMC 0612, Appendix E, Example 3.c. The finding was considered more than minor because more than one valve was in the required position, but not locked, sealed, or otherwise secured in the correct position (i.e., open). Therefore, this performance deficiency also impacted the Mitigating Systems cornerstones objective of ensuring the availability, reliability, and capability of systems to respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, a potentially mispositioned valve in a safety-related CC system pumps recirculation flow path would render the safety-related CC system pump incapable of performing its required safety function.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 2, the inspectors determined the finding affected the Mitigating Systems cornerstone. As a result, the inspectors determined the finding could be evaluated using Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2 for the Mitigating Systems cornerstone. The inspectors answered "no" to all the Mitigating Systems Screening questions in Exhibit 2 and screened the finding as having very low safety significance (Green).

This finding has a cross-cutting aspect in the area of human performance, decision-making because the licensee did not use conservative assumptions in implementing ITS, SR 3.7.7.1. Specifically, the licensee failed to perform an effective review of the safety related consequences of their decision to not verify the valves correct position every 31 days. (H.1(b))

Enforcement:

Improved Technical Specification, Section SR 3.7.7.1 states, in part, that each CC manual valve in the flow path servicing safety-related equipment, that is not locked, sealed, or otherwise secured in position, is verified in the correct position every 31 days.

Contrary to the above, from February 12, 2011, to October 4, 2012, the licensee failed to ensure each CC manual valve in the flow path servicing safety-related equipment, that is not locked, sealed, or otherwise secured in position, is verified in the correct position every 31 days. Specifically, manual valves CC-21A, CC-22A, CC-23B, and CC-24B are in the flow path servicing the safety-related CC system pumps and are not locked, sealed, or otherwise secured in position. These valves were not included in Procedure OP-KW-OSP-ESF-002, ESF Monthly Alignment Verification, Revision 7 and therefore, were not verified to be in the correct position (i.e., open) every 31 days.

The violation is being treated as an NCV, consistent with Section 2.3.2 of the NRCs Enforcement Policy because it was of very low safety significance and was entered into the licensees CAP as CR490316 (NCV 05000305/2012009-02; Failure to Ensure Four CC System Manual Valves Were in the Correct Position as Required by ITS, SR 3.7.7.1).

(3) Non-Conservative Voltage Calculations for Motor Operated Valves

Introduction:

The inspectors identified a finding of very low safety significance (Green)and an associated NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to assure that the design basis was correctly translated into specifications and procedures. Specifically, the licensee failed to provide design control measures to account for motor control center (MCC) voltage dips in MOV calculations that occur when large ESF motors are started at the onset of an accident.

Description:

Limitorque Technical Update (TU) 93-03, Reliance Three Phase Limitorque Corporation Actuator Motors (Starting Torque at Elevated Temperature),dated September 1993, identified a requirement to derate the torque capability of MOV motors for elevated motor temperatures. Elevated motor temperatures can be caused by elevated ambient temperatures or by internally generated heat caused by motor current. Limitorque TU 93-03 stated that locked rotor current can cause significant heating during periods when the motors may be stalled and that applications where the motor can draw locked rotor current until the system or valve stabilizes must be addressed. The licensees Procedure NEP-14.14, MOV Electrical/Control System Review, Revision 4 provided the methodology for calculating the degraded voltage factor for use in MOV torque calculations. The procedure required using the technique described in TU 93-03 for derating the motors to account for elevated ambient temperature, but not for internally generated heat. This would be acceptable if it was assured that motors would not stall during load sequencing.

The licensees Procedure NEP-14.14 specified that MCC voltage be taken from Calculation C11450, Auxiliary Power System Modeling and Analysis, Revision 2, dated March 5, 2011. The inspectors noted that the Electrical Transient and Analysis Program (ETAP) computer models used to calculate the MCC voltage in Calculation C11450 for the MOVs did not account for the MCC voltage dips that occur when large ESF motors are started at the onset of an accident. Therefore, the torque capability calculations for these MOVs did not demonstrate that the voltage would be adequate throughout load sequencing to prevent the MOVs from temporarily stalling and subsequently experiencing reduced torque due to increased temperature.

In response to the inspectors concern, the licensee initiated CR494297, 2012 CDBI:

Potential MOV Stalls Not Proven by Calc to Not Occur, dated November 1, 2012. The licensee prepared a preliminary evaluation of the effects of potential stalling. The results of that evaluation showed that the maximum torque reduction due to a stall period of five seconds would be 15 percent or less and that MOVs that start at the onset of an accident had a minimum of 15.2 percent torque margin. Based on this evaluation, the licensee concluded that there was reasonable assurance of MOV operability pending a formal re-analysis.

Analysis:

The inspectors determined that the licensees failure to provide design control measures to account for MCC voltage dips in MOV calculations that occur when large ESF motors are started at the onset of an accident was contrary to 10 CFR Part 50, Appendix B, Criterion III, Design Control and was a performance deficiency.

Specifically, the licensees documentation (i.e., C11450 and NEP-14.14) for the MOVs torque capability failed to demonstrate that the MOVs voltage would be adequate throughout load sequencing to prevent the MOVs from temporarily stalling and subsequently experiencing reduced torque due to increased temperature.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstones attribute of Design Control and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the inspectors had reasonable doubt that adequate margin existed to ensure the MOVs required to start at the onset of an accident would have adequate voltage and/or torque.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 2, the inspectors determined the finding affected the Mitigating Systems cornerstone. As a result, the inspectors determined the finding could be evaluated using Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2 for the Mitigating Systems cornerstone. The performance deficiency which affected the qualification of the mitigating SSCs did not result in a loss of operability or functionality because the licensees evaluation concluded that the maximum torque reduction due to a stall period of 5 seconds would be 15 percent or less, and that MOVs that start at the onset of an accident had a minimum of 15.2 percent torque margin. Therefore, the inspectors answered "yes" to the Mitigating Systems Screening question A.1 in Exhibit 2 and screened the finding as having very low safety significance (Green).

This finding has a cross-cutting aspect in the area of human performance, resources because the licensee did not provide complete, accurate, and up-to-date design documentation, including calculations and procedures to assure nuclear safety.

Specifically, the licensee failed to ensure that personnel had adequate procedural guidance to account for MCC voltage dips in MOV calculations that occur when large ESF motors are started at the onset of an accident. H.2(c)

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.

Contrary to the above, as of March 5, 2011, the licensee failed to assure that the design basis was correctly translated into specifications and procedures. Specifically, the licensee in their MOV documentation (i.e., C11450 and NEP-14.14) failed to account for MCC voltage dips in MOV calculations that occur when large ESF motors are started at the onset of an accident.

This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy because it was of very low safety significance and was entered into the licensees CAP as CR494297 (NCV 05000305/2012009-03; Non-Conservative Voltage Calculations for Motor Operated Valves).

(4) Failed to Consider Multiple Failures in the Emergency Operating Procedure (EOP)

ES-1.3, Transfer to Containment Sump Recirculation as Required by ITS Section 5.4.1b

Introduction:

The inspectors identified a finding of very low safety significance (Green)and an associated Non-Cited Violation of ITS, Section 5.4.1b because Procedure EOP ES-1.3, Transfer to Containment Sump Recirculation, Revision 36 did not establish the necessary actions as required. Specifically, the licensee failed to ensure Procedure EOP ES-1.3 contained the necessary actions for establishing containment sump recirculation for a large loss of coolant accident (LLOCA) with a concurrent failure of SI Pump A and the inability to establish containment sump recirculation using RHR Train B.

Description:

The inspectors completed a review of Procedure EOP ES-1.3, Transfer to Containment Sump Recirculation, Revision 36 to verify the prescribed actions were in agreement with the Westinghouse Owners Group (WOG) Emergency Response Guidelines (ERGs). For the inspectors review of Procedure EOP ES-1.3, the inspectors chose a case where SI Pump A is failed and RHR Train B cannot be aligned for containment sump recirculation (e.g., due to an RHR Pump B failure or a failure of a valve needed to align Train B of RHR for recirculation). During this review, the inspectors noted that in Step 16.b, which ensures SI Pump A is running, the Response Not Obtained (RNO) column for this procedure step stated IF SI Pump A can NOT be started, THEN GO TO ECA-1.1, LOSS OF EMERGENCY COOLANT RECIRCULATION. The inspectors review of WOG ERG ES-1.3, Transfer to Cold Leg Recirculation, guideline and its associated background document directed the user in Step 4 (RNO) IF at least one flow path from the sump to the RCS [reactor coolant system] can NOT be established or maintained, THEN go to ECA-1.1, LOSS OF EMERGENCY COOLANT RECIRCULATION, Step 1. The inspectors evaluation of EOP ES-1.3, Step 16.b (RNO) concluded that for the case reviewed (i.e., SI Pump A failed and RHR Train B unable to be aligned for containment sump recirculation), that Step 16.b (RNO) was not in conformance with WOG ERG ES-1.3 and would have resulted in an inappropriate entry into ECA-1.1.

The inspectors review of EOP ECA-1.1, Loss of Emergency Coolant Recirculation, Revision 29 concluded that if the operators had followed Step 16.b (RNO) and transitioned to EOP ECA-1.1 when SI Pump A could not be started, that within minutes, an SI flow interruption to the RCS would have occurred due to the requirement to stop any pumps taking suction from the refueling water storage tank (RWST) when level in the RWST reached 4 percent. The Kewaunee Power Station is not analyzed for an SI flow interruption to the RCS for a LLOCA. Both EOP ES-1.3 and the WOG ERG ES-1.3 contain a CAUTION before Step 1 that states SI recirculation flow to RCS must be maintained at all times. The basis for this CAUTION as stated in both WOG ERG ES-1.3 background document and the licensees EOP background document (i.e., BKG ES-1.3) is that maintaining core cooling will minimize or prevent fuel damage.

A review of the licensees EOP background document BKG ES-1.3, for Step 16, revealed that the licensee had not documented a related step deviation from the WOG ERGs for a transition to ECA-1.1, even though a method was available for successful transfer to containment sump recirculation for a LLOCA by starting SI Pump B for the equipment failure conditions identified above. Also related to this issue, a review of the licensees EOP ES-1.3 determined that the EOP would successfully transfer to containment sump recirculation for a LLOCA with a failure of SI Pump B and the RHR Train A unable to be aligned for containment sump recirculation (i.e., for failures in the opposite trains).

Though this issue required two equipment failures (i.e., SI Pump A failed and RHR Train B unable to be aligned for containment sump recirculation), NUREG-0737, Clarification of TMI Action Plan Requirements,Section I.C.1, and NUREG-0737, Supplement 1, Section 7, required that the EOPs consider the occurrence of multiple failures. The ITS, Section 5.4.1b required the EOPs to implement the requirements of NUREG-0737 and NUREG-0737, Supplement 1. As stated above, the licensees EOP ES-1.3 was not in conformance with WOG ERGs for EOP ES-1.3. As a result, the licensee initiated CAP document CR491773, 2012 CDBI Identified Issue with EOP ES-1.3, dated October 15, 2012, to address this issue. In addition, the licensee initiated a procedure change to ES-1.3 to revise the procedure to allow transfer to containment sump recirculation without SI flow interruption to the RCS for a LLOCA with a failure of SI Pump A and with RHR Train B unable to be aligned for containment sump recirculation.

Analysis:

The inspectors determined that the licensees failure to ensure Procedure EOP ES-1.3 contained the necessary actions for establishing containment sump recirculation for a LLOCA with a concurrent failure of SI Pump A and the inability to establish containment sump recirculation using RHR Train B was contrary to the requirements of WOG ERG ES-1.3 and was a performance deficiency. Specifically, the licensee failed to ensure EOP ES-1.3 contained the necessary actions for establishing containment sump recirculation for a LLOCA with a concurrent failure of SI Pump A and the inability to establish containment sump recirculation using RHR Train B. These steps were necessary in order to provide for uninterrupted SI flow to the RCS.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstones attribute of procedure quality and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the licensee failed to ensure the procedure for establishing containment sump recirculation for a LLOCA contained the necessary actions for potential equipment failures.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 2, the inspectors determined the finding affected the Mitigating Systems cornerstone. As a result, the inspectors determined the finding could be evaluated using Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2 for the Mitigating Systems cornerstone. Since the finding resulted in the potential for a loss of the containment sump recirculation function during a LLOCA for certain equipment failures when transferring to containment recirculation, the inspectors answered "Yes" to the Mitigating Systems Question A.2 in Exhibit 2 and determined a Detailed Risk Evaluation was required.

The Kewaunee Standardized Plant Analysis Risk (SPAR) Model, Version 8.20 and Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE),

Version 8.0.8.0 software was used by the Senior Reactor Analysts to evaluate the risk significance of this finding. From the SPAR Model, the following information was obtained:

SPAR Model Designation Description Value IE-LLOCA Initiating Event Frequency for a LLOCA 2.50E-6/yr Event HPI-MDP1A (Fault Tree) Probability of SI Pump A Failure or 6.27E-3 Unavailability HPR-RHR-SIB (Fault Tree) Probability of RHR Train B Unable to be 6.49E-3 Aligned for Containment Sump Recirculation The exposure time for the finding was assessed to be one year, since the finding duration is greater than one year [and one year is the maximum exposure time per the NRCs Risk Assessment Standardization Project (RASP) Handbook]. Making the conservative assumption that the failure or unavailability of SI Pump A and the inability to establish containment sump recirculation using RHR Train B during a LLOCA initiating event would result in core damage, the delta core damage frequency ( CDF) for the finding is obtained as the product of the following factors from the table above:

CDF = [IE-LLOCA] x [HPI-MDP1A] x [HPR-RHR-SIB]

= [2.50E-6/yr] x [6.27E-3] x [6.49E-3]

= 1.0E-10/yr Based on the Detailed Risk Evaluation, the Senior Reactor Analysts determined that the finding was of very low safety-significance (Green).

The inspectors did not identify a cross-cutting aspect associated with this finding because the finding was not representative of current performance.

Enforcement:

Improved Technical Specification, Section 5.4.1b states, in part, that Written procedures shall be established, implemented, and maintained covering the following activities: The emergency operating procedures required to implement the requirements of NUREG-0737 and NUREG-0737, Supplement 1, as stated in GL 82-33.

NUREG-0737, Supplement 1, Section 7.1.c, requires that licensees upgrade their EOPs to be consistent with Technical Guidelines. The Technical Guidelines are specified, in part, by WOG ERG ES-1.3, Transfer to Cold Leg Recirculation, dated April 30, 2005.

The licensee established EOP ES-1.3, Transfer to Containment Sump Recirculation, as the implementing procedure for WOG ERG ES-1.3 to specify the actions required for transfer to containment sump recirculation.

Contrary to the above, from May 18, 2006, to November 2, 2012, Procedure EOP ES-1.3, Transfer to Containment Sump Recirculation, Revision 36 did not establish the necessary actions as required. Specifically, the licensee failed to ensure Procedure EOP ES-1.3 contained the necessary actions for establishing containment sump recirculation for a LLOCA with a concurrent failure of SI Pump A and the inability to establish containment sump recirculation using RHR Train B.

This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy because it was of very low safety significance and was entered into the licensees CAP as CR491773 (NCV 05000305/2012009-04; Failed to Consider Multiple Failures in ES-1.3, Transfer to Containment Sump Recirculation as Required by ITS, Section 5.4.1b)

.4 Operating Experience

a. Inspection Scope

The inspectors reviewed three operating experience issues (inspection samples) to ensure NRC generic concerns were adequately evaluated and addressed by the licensee. The issues listed below were reviewed as part of this inspection:

• GL 96-06, Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions;

• IN 2009-02, Biodiesel In Fuel Oil Could Adversely Impact Diesel Engine Performance; and

• IN 2010-11, Potential for Steam Voiding Causing RHR System Inoperability.

b. Findings

No findings of significance were identified.

.5 Modifications

a. Inspection Scope

The inspectors reviewed four permanent plant modifications related to selected risk significant components to verify that the design bases, licensing bases, and performance capability of the components had not been degraded through modifications. The modifications listed below were reviewed as part of this inspection effort:

• DC 2930, Rewire Appendix R Motor Operated Valves;

• DC 3381, Install CCW Pump Recirculation Lines;

• DCR 3699, Service Water Pump Upgrade; and

• KW-10-01101, EDG Ventilation Dampers Air Supply.

b. Findings

No findings of significance were identified.

.6 Operating Procedure Accident Scenario Reviews

a. Inspection Scope

The inspectors performed a detailed review of the procedures listed below associated with the selected scenarios of SBO and SGTR events. For the procedures listed, time-critical operator actions were reviewed for reasonableness, simulator scenarios were observed, and in-plant actions were walked down with a non-licensed operator or a licensed operator as appropriate. It was evaluated whether there was sufficient information to perform the procedure, whether the steps could reasonably be performed in the available time, and whether the necessary tools and equipment were available.

The procedures were compared to USAR and design assumptions. In addition, the procedures were reviewed to ensure the procedure steps would accomplish the desired result.

• E-0, Reactor Trip or Safety Injection, Revision 45;

• E-3, Steam Generator Tube Rupture, Revision 37; and

• ECA-0.0, Loss of All AC Power, Revision 46.

b. Findings

Failure to Ensure Consistent Criterion Used for Time Critical Operator Actions to Prevent a Steam Generator Overfill

Introduction:

The inspectors identified a finding of very low safety significance (Green)and an associated non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the licensees failure to ensure consistent criterion was used in OP-KW-ORT-MISC-014, Validation of Time Critical Operator Actions, Revision 2 (i.e., the Operations procedure) to validate the time-critical operator actions for Break Flow Termination. Specifically, the licensee failed to ensure the Break Flow Termination criterion (i.e., the time frame when the primary-to-secondary flow in the ruptured steam generator (SG) is required to be stopped) was consistent with the criterion contained in CN-CRA-03-16, Kewaunee Power Station Supplemental Steam Generator Tube Rupture Margin to Overfill Analysis, Revision 0 (i.e., the calculation).

Description:

The inspectors completed reviews of OP-KW-ORT-MISC-014 (i.e., the Operations procedure) and CN-CRA-03-16 (i.e., the calculation) to verify the criteria specified for time-critical operator actions were consistent with the requirements identified in the calculation. The Operations procedure is used to validate the calculations time-critical operator actions based upon periodic performance of a SGTR design basis event scenario on the licensees simulator.

The validation of the criterion for Break Flow Termination for a SGTR design basis event is essential to prevent SG overfill (i.e., water level in the ruptured SG rising into the main steam line) and the potential for an unmonitored release of radioactive material.

Steam generator overfill could occur due to late termination of break flow from the RCS to the secondary side of the SG during a SGTR design basis event. Steam generator overfill would result in the following concerns:

(1) increased dead weight placed on the main steam line and its supports,

(2) loads placed on the main steam lines due to the potential for rapid collapse of steam voids resulting in water hammer, and

(3) the potential for secondary side safety valves sticking open following the discharge of water or two-phase flow (i.e., reference GL 81-28).

The inspectors review of the Operations procedure and the calculation for Break Flow Termination, showed that each criterion was specified as within 49 minutes. However, the Operations procedures criterion was not consistent with the calculations criterion (i.e., the time frame when the primary-to-secondary flow in the ruptured SG is required to be stopped). The licensee interpreted the Operations procedures criterion as the time frame when the SI pumps are stopped instead of the time frame when the primary-to-secondary flow in the ruptured SG is stopped. Per the calculation, during an actual SGTR event and after the SI pumps are stopped, there is a pressure difference between the RCS and the ruptured SG. The RCS pressure is approximate 300 psig higher than the ruptured SGs pressure (i.e., per Figure D-1 of the calculation). Therefore, the primary-to-secondary break flow would continue (i.e., per Figure D-2 of the calculation).

In the calculation, the time frame identified to terminate SI (i.e., stop SI pumps) was within 39 minutes and 11 seconds instead of the 49 minutes specified in the Operations procedure. To determine how far back the criterion inconsistency existed, the inspectors reviewed previous revisions of the Operations procedure. The inspectors noted the Operations procedure superseded GNP-05.16.06, Validation of Time Dependant Operator Actions, Revision D dated April 19, 2007. The inspectors review of GNP-05.16.06 found the Break Flow Termination criterion remained inconsistent with the calculation.

On October 18, 2012, the inspectors observed the performance of a SGTR design bases event scenario on the licensees simulator. The inspectors noted the operators stopped the SI pumps at 39 minutes, 47 seconds which exceeded the time specified in the calculation criteria by 36 seconds. Immediately after the SI pumps were stopped, the RCS pressure remained at approximately 300 psig higher than the ruptured SGs pressure. Primary-to-secondary break flow continued until the pressures equalized.

The break flow was finally terminated at 56 minutes, 12 seconds which exceeded the calculation criteria by more than 7 minutes. To address this issue, the licensee initiated CAP document CR492485, 2012 CDBI TCA Validation Criteria Does Not Agree with Engineering Basis Document, dated October 19, 2012.

Analysis:

The inspectors determined that the licensees failure to ensure consistent criterion was used in the Operations procedure to validate the time-critical operator actions for Break Flow Termination was contrary to the requirements identified in the calculation and was a performance deficiency. Specifically, the licensee failed to ensure the Break Flow Termination criterion (i.e., the time frame when the primary-to-secondary flow in the ruptured SG is required to be stopped) was consistent with the criterion contained in the calculation.

The performance deficiency was determined to be more than minor because it was associated with the Mitigating Systems cornerstones attribute of procedure quality and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, as demonstrated during a simulated SGTR event, operators were unable to terminate the operators break flow within the analyzed response time. The capability of the systems to mitigate the SGTR event was not assured. Therefore, the inspectors concluded there was reasonable doubt that adequate margin existed to ensure SG overfill would have been prevented during an actual SGTR design basis event.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Initial Characterization of Findings, Table 2, the inspectors determined the finding affected the Mitigating Systems cornerstone. As a result, the inspectors determined the finding could be evaluated using Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2 for the Mitigating Systems cornerstone. The inspectors answered "no" to all the Mitigating Systems Screening questions in Exhibit 2 and screened the finding as having very low safety significance (Green).

The inspectors did not identify a cross-cutting aspect associated with this finding because the finding was not representative of current performance

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions.

Contrary to the above, from April 19, 2007, to November 2, 2012, the licensee failed to ensure measures were established to assure that the design basis for SGTR overfill was correctly translated into procedures. Specifically, the licensee failed to protect against SG overfill during a SGTR design basis event by not ensuring consistent criteria was used in the Operations procedure to validate the time-critical operator actions for Break Flow Termination. The Break Flow Termination criterion for the Operations procedure was not consistent with the calculation.

This violation is being treated as an NCV, consistent with Section 2.3.2 of the Enforcement Policy because it was of very low safety significance and was entered into the licensees CAP as CR492485. (NCV 05000305/2012009-05; Failure to Ensure Correct Criterion Used for Time Critical Operator Actions to Prevent a Steam Generator Overfill)

4OA2 Identification and Resolution of Problems

.1 Review of Items Entered Into the Corrective Action Program

a. Inspection Scope

The inspectors reviewed a sample of the selected component problems that were identified by the licensee and entered into the CAP. The inspectors reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions related to design issues. In addition, corrective action documents written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the CAP. The specific corrective action documents that were sampled and reviewed by the inspectors are listed in the Attachment to this report.

b. Findings

No findings of significance were identified.

4OA6 Meeting

.1 Exit Meeting Summary

On November 2, 2012, the inspectors conducted a final exit of the inspection results with Mr. Roy Simmons, and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. Several documents reviewed by the inspectors were considered proprietary information and were either returned to the licensee or handled in accordance with NRC policy on proprietary information.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

J. Arcand, Instrumentation and Control Supervisor

D. Asbel, Outage and Planning Manager

M. Aulik, Design Engineering Manager

C. Edwards, Response Team - Maintenance

J. Gadzala, Licensing

B. Gauger, Operations Supervisor (Response Team - Operations)

J. Grau, Maintenance Manager

M. Haese, Licensing (Response Team - Licensing)

S. Jordan, Site Vice-President

J. Kudick, Engineering Technician (Response Team - Engineering)

D. Lawrence, Operations Manager

J. Madden, Engineering Systems Manager

J. McNamara, Design Engineering Supervisor

T. Olson, Engineering Programs Manager

J. Palmer, Training Manager

R. Repshas, Licensing Supervisor

J. Riste, Licensing

M. Rosseau, Engineering Supervisor (Response Team Lead)

R. Simmons, Plant Manager

J. Stafford, Director Safety and Licensing

S. Yuen, Engineering Director

K. Zastrow, OR Manager

Nuclear Regulatory Commission

K. Barclay, Resident Inspector

A. Stone, Chief Engineering Branch 2

Attachment

LIST OF ITEMS

Opened and Closed

05000305/2012009-01 NCV Failure to Correct a Condition Adverse to Quality Associated with the Safety-related 125 Vdc Battery Service Test Procedures (Section 1R21.3b.(1))

05000305/2012009-02 NCV Failure to Ensure Four CC System Manual Valves Were in the Correct Position as Required by ITS, SR 3.7.7.1 (Section 1R21.3b.(2))

05000305/2012009-03 NCV Non-Conservative Voltage Calculations for Motor Operated Valves (Section 1R21.3b.(3))

05000305/2012009-04 NCV Failed to Consider Multiple Failures in ES-1.3, Transfer to Containment Sump Recirculation as Required by ITS, Section 5.4.1b) (Section 1R21.3b.(4))

05000305/2012009-05 NCV Failure to Ensure Correct Criterion Used for Time Critical Operator Actions to Prevent a Steam Generator Overfill (Section 1R21.6b)

Discussed

None.

Attachment