IR 05000305/2005002

IR 05000305-05-002 (Drs), on 01/24/2005 - 02/18/2005; Kewaunee Nuclear Power Plant; Cross-Cutting Aspects of Findings, Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components, and Operator Actions

ML050950237
Person / Time
Site:	Kewaunee
Issue date:	04/04/2005
From:	Pederson C Division of Reactor Safety III
To:	Lambert C Nuclear Management Co
References
IR-05-002
Download: ML050950237 (69)

Text

ril 4, 2005

SUBJECT:

KEWAUNEE NUCLEAR POWER PLANT NRC INSPECTION REPORT NO. 05000305/2005002(DRS)

Dear Mr. Lambert:

On February 18, 2005, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Kewaunee Nuclear Power Plant. The enclosed inspection report documents the inspection findings which were discussed on February 18 and March 29, 2005, with you and members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents eight NRC-identified findings, all of very low safety significance (Green)

and one NRC-identified Severity Level IV violation, also of very low safety significance. Six of the eight NRC-identified findings were determined to involve violations of NRC requirements.

However, because of the very low safety significance and because the violations were entered in your corrective program, the NRC is treating these issues as Non-Cited Violations, in accordance with Section VI.A.1 of the NRCs Enforcement Policy. In addition, one licensee identified violation is listed in Section 4OA7 of this report.

If you contest the subject or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S.

Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region III, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector Office at the Kewaunee facility. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA by Roy J. Caniano Acting For/

Cynthia D. Pederson, Director Division of Reactor Safety Docket No. 50-305 License No. DPR-43 Enclosure: Inspection Report 05000305/2005002(DRS)

w/Attachment: Supplemental Information cc w/encl: J. Cowan, Executive Vice President, Chief Nuclear Officer Plant Manager Manager, Regulatory Affairs J. Rogoff, Vice President, Counsel & Secretary D. Molzahn, Nuclear Asset Manager, Wisconsin Public Service Corporation L. Weyers, Chairman, President and CEO, Wisconsin Public Service Corporation D. Zellner, Chairman, Town of Carlton J. Kitsembel, Public Service Commission of Wisconsin

SUMMARY OF FINDINGS

IR 05000305/2005002(DRS); 01/24/2005 - 02/18/2005; Kewaunee Nuclear Power Plant;

Cross-Cutting Aspects of Findings, Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components, and Operator Actions.

This inspection was conducted by a team of six NRC inspectors and three NRC contract inspectors. One Severity Level IV Non-Cited Violation (NCV), and eight Green findings associated with six NCVs were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the Significance Determination Process does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

A. Inspector-Identified and Self-Revealed Findings

Cornerstone: Initiating Events

Green.

The team identified a finding of very low safety significance for a failure to provide adequate relay setpoint calibration tolerances on safety buses 1-5 and 1-6 loss of voltage relays. The existing relay setting calibration tolerances would have allowed the loss of voltage relays to actuate spuriously during certain offsite electrical system disturbances and un-necessarily separate the safety buses from the offsite power system and result in a plant transient. The licensee implemented corrective actions to revise the appropriate loss of voltage relay surveillance procedures.

The finding was more than minor because the failure to provide adequate relay setting tolerances could result in an unnecessary separation of the safety buses from the electrical grid and an ensuing plant transient. The finding was of very low safety significance because the issue would not preclude the safety buses from being re-energized by the emergency power sources. The finding was a not a violation of regulatory requirements. (Section 4OA5.2.1.1b(2))

Green.

The team identified a Non-Cited Violation of 10 CFR 50.63, Loss of All Alternating Current Power, for a failure to maintain procedural steps that minimized the likelihood and duration of a Station Blackout (SBO) event. The deleted procedural steps allowed for the cross-connection of the plants two redundant safety buses should both the Reserve Auxiliary Transformer and the 1B Emergency Diesel Generator fail. These procedural steps, as originally employed, served to lessen the likelihood of the SBO occurring, and/or reduce the time of the SBO. The licensee implemented corrective actions to revise the appropriate operations procedure.

This finding was more than minor, because it was associated with the likelihood of an initiating event and the reliability of a safety bus that responds to an initiating event. The finding was of very low safety significance, because multiple sources of both onsite and offsite power remained available to supply the two safety buses. (Section 4OA5.2.2b(2))

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very low safety significance for a failure to provide adequate electrical coordination of protective devices thereby ensuring that postulated electrical faults would be isolated upon detection. Specifically, the team identified that the lack of adequate electrical systems coordination between the undervoltage and overcurrent protection on 4160 Vac safety bus 1-5 would result in the loss of voltage relays actuating before the bus over-current relays. This design deficiency results in the failure to lock out safety bus 1- 5 upon postulated electrical faults and subjects the postulated faulted safety bus 1-5 to be re-energized via an alternate offsite source. This design introduced a challenge to the safety equipment availability and reliability. The licensee planned to develop changes to the affected relays.

The finding was more than minor because the failure to provide adequate electrical coordination of electrical devices provided an unnecessary challenge to safety-related equipment, and if left uncorrected, could become a more safety significant concern.

The finding was of very low safety significance because it was a design deficiency that did not result in the loss of system function. The finding was a not a violation of regulatory requirements. (Section 4OA5.2.1.1b(1))

Green.

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion II, Quality Assurance Program, for a failure to identify potentially adverse conditions to the plants fire protection safe shutdown analysis caused by known overduty conditions on non-safety related buses 1-1, 1-2, 1-3, and 1-4. While the overduty condition was known to have existed at least since 1992, the licensee never entered the issue into the plants corrective action program, where a proper evaluation should have addressed 10 CFR Part 50, Appendix R, safe shutdown related effects.

The licensee planned to continue efforts to identify additional evaluations and corrective actions.

This finding was more than minor, because it was associated with the degradation of a fire protection feature. The finding was of very low safety significance because after extensive evaluation of the deficiency, the licensee was able to determine that the plant could still safely shut down the plant during a postulated fire event. (Section 4OA5.2.1.1b(3))

Green.

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for failure to implement adequate design controls of documents, inputs, and assumptions in the design of the two safety-related batteries.

Specifically, the licensee did not perform and control battery sizing calculations, including consideration of temperature effects, to ensure that the batteries maintained sufficient capacity to perform the intended design function. The team determined that the failure to appropriately evaluate effects of battery room and cell temperatures also affected the cross-cutting area of Problem Identification and Resolution because the subject of battery capacity versus battery temperature had been previously identified in a 1992 NRC inspection. The licensee planned to perform battery sizing calculations as part of an overall electrical systems analysis improvement project.

This finding was more than minor because it affected the mitigating systems cornerstone objective of ensuring the availability and reliability of the 125 Volts direct current battery system to respond to initiating events to prevent undesirable consequences. The finding is of very low safety significance because the battery remained operable. The licensee planned to develop formal battery sizing calculations.

(Section 4OA5.2.1.2)

• Severity Level IV. The team identified a finding involving a Non-Cited Violation of 10 CFR 50.59, Changes, Tests, and Experiments. The finding involved a failure to perform an adequate review of operations procedure changes in accordance with 10 CFR 50.59 associated with the operation of motor-operated valves for the auxiliary feedwater suction source from the service water system. The team determined that the licensees approval of changes to Procedure E-0-05, with the introduction of adverse effects, and a determination that 10 CFR 50.59 was not applicable was a violation of 10 CFR 50.59. The licensee subsequently performed additional evaluations of the procedure changes.

Because the issue affected the NRCs ability to perform its regulatory function, this finding was evaluated with the traditional enforcement process. The finding was determined to be of very low safety significance since the design basis safety-related function of the AFW system, to remove reactor decay heat following a loss of normal feedwater, was not adversely affected. This was determined to be a Severity Level IV NCV of 10 CFR 50.59. (Section 4OA5.2.1.10b(2))

Green.

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, for failure to establish the condensate storage tank (CST)level setpoint to transfer the auxiliary feedwater (AFW) pump suction supply from the CST to service water. The team determined that the calculation setpoint did not include an allowance for the manual operator actions required by emergency operations procedures. The licensee revised the plant procedure to perform the operator actions earlier in the procedure.

This finding was more than minor because it affected the mitigating systems cornerstone objective of equipment reliability, in that failure to align the AFW pump suctions to service water prior to the CSTs being depleted could have resulted in damage to the AFW pumps. The finding was determined to be of very low safety significance because it was a design deficiency that did not result in a loss of function.

(Section 4OA5.2.1.10b(3))

Green.

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control. The finding involved the condensate storage tank (CST)level setpoint to transfer the auxiliary feedwater (AFW) pump suction from the CSTs to service water. A calculation assumption stated that a flow would drain from the CSTs to the condenser for 10 minutes until the operators isolated the flow by closing manual valve MU-2A. The team determined that the actions could not be completed in the time assumed by the calculation. The licensee initiated corrective actions to revise the appropriate operations procedure and calculation.

This finding was greater than minor because it affected the mitigating system cornerstone objective of equipment reliability, in that failure to align the AFW pump suctions to service water prior to the CSTs being depleted could have resulted in damage to the AFW pumps. The finding was determined to be of very low safety significance because it was a design deficiency that was not found to result in a loss of function. The team concluded that it was unlikely that the operators would allow the CST level to reach the EOP setpoint without attempting to refill the tanks from other sources, and that the operators would be aware of the CST levels.

(Section 4OA5.2.2.b(1))

Green.

The team identified a Non-Cited Violation of 10 CFR 50.63, Loss of All Alternating Current Power. The finding involved the failure to establish a target reliability for the plants alternate power source consistent with the reliability approved by the NRC staff in the licensees Station Blackout submittal for 10 CFR 50.63. The non-conservative target reliability employed by the licensee resulted in the failure of the licensee to increase efforts to restore the Technical Support Center (TSC) Diesel Generator (DG) to its approved target reliability at an earlier date. The licensee subsequently initiated a corrective action to change the TSC DG reliability methodology.

This finding was more than minor, because it affected the reliability of a support system required for the mitigation of an Station Blackout event. The finding was of very low safety significance, because the finding did not directly affect the immediate operability of the TSC DG. (Section 4OA5.2.2b(2))

Licensee-Identified Violations

Violations of very low safety significance, which were identified by the licensee, have been reviewed by the team. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. The violations and the licensees corrective action tracking numbers are listed in Section 4OA7 of this report.

REPORT DETAILS

Summary of Plant Status

The plant operated at or near 100 percent power throughout the inspection period.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems

4OA3 Event Follow-up

(Open) URI 05000305/2004009-03: Potential Flooding in the Turbine Building Basement.

During this inspection, the team performed additional reviews of the licensees design for protecting against postulated breaks and ruptures of non-safety related piping and tanks to evaluate whether the plant design could mitigate the consequences of such events. The results of these inspection efforts revealed that weaknesses existed in the licensees ability to demonstrate that internal flooding events would not affect safe shutdown of the plant. This inspection effort is further discussed in Section 4OA5.4b(1),

Internal Flooding Events. This URI remains open pending further NRC reviews of the equipment affected by potential flooding in the turbine building basement.

4OA4 Cross-Cutting Aspects of Findings

.1 The finding described in Section 4OA5.2.1.2 of this report was related to the

cross-cutting area of problem identification and resolution. Specifically, the licensee had failed to implement corrective actions to address a previously identified deficiency involving battery room temperature effects on battery capacity. The subject of battery capacity versus battery temperature had been previously identified in 1992, during the NRC Electrical Distribution System Functional Inspection, yet when new batteries were installed later in the same year, the licensee did not implement corrective actions to ensure the battery room temperatures concerns were addressed and corrected.

4OA5 Other Activities

Temporary Instruction 2515/158, Functional Review of Low Margin/Risk Significant Components and Human Actions

.1 Inspection Sample Selection Process

In selecting samples for review, the team focused on the most risk-significant components and operator actions. The team selected these components and operator actions by using the risk information contained in the licensees Probabilistic Risk Assessment (PRA) and the U.S. Nuclear Regulatory Commissions (NRC) Simplified Plant Analysis Risk models. An initial sample was chosen from those components that had a risk achievement worth factor greater than two. These components are important to safety since their assumed failure would result in at least doubling the risk of an accident that could result in core damage. Additionally, the sample selection also considered the risk reduction worth factor. This factor relates to the decrease in the plants core damage frequency if the component is assumed to be successful. In addition, high-risk operator actions were also selected as part of the initial sample selection. Lastly, five inspection samples were added based upon operational experience reviews. A complete listing of all components, operator actions, and operating experience issues reviewed by the inspection team is contained in the Supplemental Information attached to this report. A total of 59 samples, in addition to the 5 operating experience reviews, were chosen for the teams initial review.

A preliminary review was performed on the 59 samples to determine whether any low margin concerns existed. For the purpose of this inspection, margin concerns included original design issues, reductions in margin as a result of component non-conformances or material condition issues. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense-in-depth margins. Based upon the above considerations, 24 of the original 59 samples were selected for a more detailed review. An overall summary of the reviews performed and the specific inspection findings identified is included in the following sections of the report.

During this inspection, the team completed all of the requirements in Temporary Instruction (TI) 2515/158. As a result of completing the TI, the scope of the following baseline inspection procedures was met and these procedures are considered complete/partially complete by reference to this TI:

• 1 sample for 71111.21 (complete);

• 1 sample for 71111.02 (partially complete) (Section 4OA5.2.1.10b(2));

• 3 samples for 71111.17B (partially complete) (Section 4OA5.3);

• 6 samples for 71111.22 (partially complete) (Section 4OA5.3); and

• 2 samples for 71111.15 (partially complete) (Sections 4OA5.2.1.2, 4OA5.2.1.10b(1)).

.2 Results of Detailed Reviews

The team performed detailed reviews on the 19 components, 5 operator actions, and 5 operating experience issues. For components, the team reviewed the adequacy of the original design, modifications to the original design, maintenance and corrective action program histories, and associated operating and surveillance procedures. As practical, the team also performed walkdowns of the selected components. For operator actions, the team reviewed the adequacy of operating procedures and evaluated time-critical operator actions as reflected in design bases documents. For the operating experience issues chosen for detailed review, the team assessed the issues applicability to Kewaunee and the licensees disposition of the issue. The following sections of the report provide a summary of the detailed reviews, including any findings identified by the inspection team.

.2.1.1 4160 Volt alternating current (Vac) Safety Buses

a. Inspection Scope

The team conducted electrical system walkdowns, observed instrument indications, and reviewed selected operations surveillances to verify that the power supplies for 4160 Vac buses 1-5 and 1-6 would be available and unimpeded during normal and accident/event conditions. Reviews were based upon the Updated Safety Analysis Report (USAR) system descriptions and Technical Specification (TS) requirements.

Specifically, the team reviewed procedures for the operation, maintenance and testing of the 4160 Vac buses 1-5 and 1-6 and their respective normal and alternate supply transformers to verify proper design configuration and control. The team reviewed power supply calculations, operating lineup procedures, drawings, licensing and design basis information, surveillance procedures, recent plant modification records, and vendor manuals.

The team reviewed the electrical overcurrent, undervoltage, differential and ground protective relay settings for selected circuits to verify that the trip setpoints would not spuriously interfere with the equipment fulfilling its safety function, and secondarily, that adequate protection was provided. Specific relays reviewed were the overcurrent, undervoltage, differential and ground relays associated with the Reserve Auxiliary Transformer (RAT), the Tertiary Auxiliary Transformer (TAT), the Diesel Generators and the 4160 Vac buses 1-5 and 1-6. Data sheets for the last relay calibration were also reviewed to verify that the calibrations were within the calculated limits and that excessive instrument drift was not taking place. The team also performed limited reviews of non-safety buses 1-1, 1-2, 1-3, and 1-4, within the scope of this review.

During the review of the 4160 Vac buses, the team also reviewed the adequacy and appropriateness of design assumptions, adequacy of analytical models and methods, calculations and acceptance criteria for surveillance and performance validation tests.

This was performed to verify that the power sources were adequate to meet minimum voltage specifications for electrical equipment during normal and accident events.

Among the reviewed components were the offsite 345/138 kV substation equipment alignment, the interconnections between the onsite 4160 Vac buses and their sources of supply, including the RAT and TAT transfomers and their associated circuit breakers.

The team reviewed design drawings and performed walkdowns of portions of the electrical distribution systems, including the TAT, RAT, and the safety 4160 Vac buses.

The purpose of the inspection was to verify that system alignments were consistent with design and licensing basis assumptions and to verify that the observable material condition was acceptable.

The team reviewed the safety 4160 Vac circuit breaker control logic design drawings applicable to the Safety buses 1-5 and 1-6 and performed field and control room walkdowns to verify that the installed local and remote circuit breaker control switches, breaker position indicating lights, and the operator actions for the resetting of the lockout relays were consistent with design drawings and operations procedures.

b. Findings

(1) Safety 4160 Vac Bus 1-5 Overcurrent and Loss of Voltage Relay Coordination

Introduction:

The team identified a finding having very low safety significance (Green)based on the lack of adequate electrical systems coordination between the undervoltage and overcurrent protection on 4160 Vac safety bus 1-5. Under postulated electrical fault conditions, the bus 1-5 loss of power relay settings would cause these relays to be actuated before the bus over-current relays. This design deficiency results in the failure to lock out safety bus 1-5 upon postulated electrical faults and the faulted bus is re-energized via an alternate offsite source. This design introduced a challenge to the safety equipment availability and reliability.

Description:

The normal source of offsite power to 4160 Vac bus 1-5 is from the TAT.

The RAT provides the alternate source of offsite power to safety bus 1-5. The licensees voltage restoration design scheme allows the safety buses to be re-energized from the alternate source of offsite power should the bus be disconnected from its normal offsite source by the safety bus 1-5 undervoltage relays. However, this voltage restoration scheme is disabled when the bus becomes disconnected from its normal offsite source of power due to actuation of the bus 1-5 protective overcurrent relays.

The actuation of the protective overcurrent relays initiates operation of the safety bus 1-5 lockout relays which lock the bus out from being re-energized from any offsite or onsite source of power. This design provides isolation and lockout of the safety bus since a faulted bus condition exists.

The team performed independent calculations of available fault current contributions from the TAT and the RAT for postulated safety bus 1-5 faults and compared them with the overcurrent and undervoltage relay settings. The team identified a design deficiency involving the lack of adequate coordination margin between safety bus 1-5 loss of voltage and overcurrent relays when the bus was connected to its normal offsite power source (TAT). The team determined that the impedance and capacity of the TAT limits the current contribution to short circuit faults at safety bus 1-5 to values at which the accompanying voltage dips can be sensed by the undervoltage relays. This would result in the undervoltage relays actuating before the overcurrent relays to isolate a faulted bus. As a result, the undervoltage relays would provide a signal to the supply breaker for bus 1-5 to open and separate the bus from the TAT transformer. As part of the loss of voltage protection scheme, the bus supply breaker from the RAT would then close to re-energize bus 1-5 and the faulted bus condition would be re-established.

Upon this condition, the faulted bus condition would be detected and isolated by the overcurrent relay protection when the RAT is supplying breaker power to bus 1-6.

Therefore, this design deficiency subjects the postulated faulted safety bus 1-5 to be re-energized via an alternate offsite source. This existing lack of adequate coordination between these relays could subject the safety bus 1-5 to multiple faults and introduced a challenge to safety equipment availability and reliability. In addition, the team determined that this design deficiency was not consistent with USAR Section 8.2.2.

Section 8.2.2, Evaluation of Layout and Load Distribution, stated that the 4160 Vac switchgear and 480 Vac load centers were coordinated electrically to permit safe operation of the equipment under normal and short-circuit conditions. The licensee entered the lack of relay coordination issue into corrective action program (CAP) as CAP025424 and planned to develop changes to the affected relays. The team determined that this design deficiency did not exist on 4160 Vac bus 1-6.

Analysis:

The team determined that the lack of adequate electrical systems coordination between the undervoltage and overcurrent protection on 4160 Vac safety bus 1-5 was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that the finding was more than minor because it was associated with the availability and reliability of a mitigating system. The design deficiency resulted in the failure to lock out safety bus 1-5 upon postulated electrical faults and the faulted bus would be re-energized via an alternate offsite source. This design deficiency introduced a challenge to the safety equipment availability and reliability. The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, because of the finding. The team determined that the performance deficiency was a design deficiency that did not result in a loss of system function and the condition did not exist on the redundant 4160 Vac bus. Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

The failure to provide electrical coordination at the 4160 Vac safety buses, consistent with USAR 8.2.2, thereby resulting in a challenge to the equipment reliability, was not considered to constitute a violation of any regulatory requirements.

This issue was entered into the corrective action program as CAP025424, and was considered a finding of very low safety significance (FIN 05000305/2005002-01).

(2) Safety Buses 1-5 and 1-6 Loss of Voltage Relay Sensitivity to External Electrical Disturbances

Introduction:

The team identified a finding having very low safety significance (Green)based on the lack of an adequate relay setpoint calibration tolerances on safety buses 1-5 and 1-6 loss of voltage relays. The existing relay setting calibration tolerance would have allowed the loss of voltage relays to actuate spuriously during certain offsite electrical system disturbances and un-necessarily separate the safety buses from the offsite power system and result in a plant transient.

Description:

Offsite transmission grid disturbances, resulting from transmission system fault clearing operations, can subject the 4160 Vac buses 1-5 and 1-6 to transient undervoltage conditions. Should the 4160 Vac buses 1-5 and 1-6 loss of power undervoltage relay settings drift to their allowed lower calibration limits, they could spuriously actuate during external electrical disturbances and disconnect the plant from the transmission grid.

The team determined that, while the licensees acceptable time delay setpoint calibration margins for the loss of power undervoltage relays were within the TS limits, they could produce spurious operations if the setpoints reached their lower acceptable calibration limits. The team reviewed the offsite transmission system performance history with the licensee and American Transmission Company (ATC) to obtain an overview of the protocols which exist between the two organizations and also reviewed the records of transmission system operating voltage profiles for the preceding 24-month period. This review was done to verify the adequacy of the design assumptions in the licensees loss-of-voltage and degraded-grid relay settings.

The interview with ATC confirmed the teams concern over the adequacy of the loss of power relay calibration limits to override external electrical disturbances. Based on stability studies, the transmission system voltages can briefly dip below the loss of power relay settings for faults near the Kewaunee 345 kV substation and then recover to their pre-fault levels. The voltage recovery time to reach 70 percent of pre-fault voltage is virtually instantaneous; recovery to 80 percent of pre-fault voltage is 0.5 seconds; recovery to 90 percent of pre-fault voltage is within seconds, before the system will recover to the full pre-fault voltage level. The team and the licensee considered the results of the ATC stability study as appropriate design inputs in calculating undervoltage relay settings at 4160 Vac buses 1-5 and 1-6. The team also noted that TS Basis 3.5, Instrumentation System, stated that the associated time delay feature for the undervoltage relays prevented inadvertent actuation of the undervoltage relays from voltage dips. The teams observations revealed that this was not the case as discussed above.

The team also reviewed the vendors undervoltage relay instruction leaflet and determined that these relays reset virtually instantaneously upon voltage recoveries slightly above their dropout voltage settings if the voltage recoveries occur within the time delay settings. At the conclusion of the inspection, the licensee was considering validating this newly identified relay resetting feature by test, applying it as design input in degraded grid voltage relay setpoint determination, and establishing the optimal offsite transmission grid operating voltage limits with ATC. The licensee initiated CAP025528, Consider Testing of Degraded Grid Relays for Virtual Zero Reset.

The licensee amended CAP025424 HRLM Inspection, Bus 5 Overcurrent Versus Loss of Voltage Relay Time Delay, to revise the appropriate loss of voltage relay surveillance procedures (SP 39-227A/B) to change the time delay acceptance criteria for the loss of voltage relays from the existing range of 0.5 to 1.5 seconds to a new range of 0.9 to 1.1 seconds. The team determined that these immediate actions, although temporary, improve the coordination margin between the loss of voltage relays and safety bus 1-5 overcurrent relays, and reduce the vulnerability to margin for spurious separation of the plant from the grid upon the occurrence of external electrical disturbances.

Analysis:

The team determined that the lack of an adequate relay setpoint calibration tolerances on safety buses 1-5 and 1-6 loss of voltage relays was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that the finding was more than minor because it was associated with an increase in the likelihood of an initiating event (disconnection of safety bus from a viable offsite power source). The design deficiency of the existing relay setting calibration tolerances would have allowed the loss of voltage relays to actuate spuriously during certain offsite electrical system disturbances and un-necessarily separate the safety buses from the offsite power system and result in a plant transient. The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, because of the finding. The team determined that the finding did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation functions would be unavailable.

Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

The lack of an adequate relay setpoint calibration tolerance on safety buses 1-5 and 1-6 loss of voltage relays would have allowed the loss of voltage relays to actuate spuriously during certain offsite electrical system disturbances and unnecessarily separate the safety buses from the offsite power system. This deficiency was not consistent with TS Basis 3.5, which stated that time delay features prevented inadvertent actuation of the undervoltage relays from voltage dips. Nonetheless, the time delays were set in accordance with TS and hence no violation of TS or other regulatory requirements occurred. This issue was entered into the corrective action program as CAP025424 and CAP025528 and was considered to be a finding of very low safety significance (FIN 05000305/2005002-02).

Operating Experience Reviews The team reviewed the licensees metering and relaying drawings to determine whether the Kewaunee plant was vulnerable to the same type of single failure identified at Crystal River Nuclear Plant on January 27, 2005, and reported to the NRC under 10 CFR 50.72. The single failure concern identified at Crystal River involved the failure of a wire connecting the current transformers, the watthour meter, and protective relays.

A single failure within the shared current transformers circuit could actuate the protective relays and their associated lockout relays to lock out the circuit breakers for the offsite and onsite emergency sources of power. The team verified the licensees conclusion that the same condition did not exist at Kewaunee.

(3) Short Circuit Duty of Buses 1-1, 1-2, 1-3, and 1-4

Introduction:

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion II, Quality Assurance Program, having very low safety significance (Green),for failure to evaluate the effects of over-dutied circuit breakers on non-safety related 4160 Vac buses 1-1, 1-2, 1-3, and 1-4, on the plants fire protection safe shutdown analysis. The licensee was aware of the over-dutied condition, but the issue had never been entered into the licensees corrective action program as required by the plants Quality Assurance program. This condition was considered a failure to carry out the instructions contained within the quality assurance program.

Description:

Based upon discussions with the licensees engineering staff, the team learned that non-safety related 4160 Vac buses 1-1, 1-2, 1-3, and 1-4 were over-dutied based on the calculated potential fault currents at the bus. The licensee had been aware of this condition since 1992, when an NRC inspection team had raised a concern in regard to the over-dutied condition. The concern at that time was that if a fault on the non-safety related 4160 Vac system was not cleared because of this deficiency, it could result in the loss of the offsite power supply to the 4160 Vac system. The licensee had stated that the possibility of a three phase fault of the size that would cause the switchgear to exceed their current rating was highly unlikely. Nonetheless, at that time, the NRC concluded that while the condition was a design weakness, if a fault were to occur, voltage would be degraded on the safety-related buses resulting in the automatic separation from offsite power, and the EDGs would then power the buses. During this inspection, the team was concerned that the effects of the over-dutied condition on the plants ability to be safely shut down during a fire scenario had not been evaluated.

During this inspection, the team became aware of this over-duty condition and questioned the licensees engineering staff if the potential adverse effects on the plants fire protection safe shutdown analysis had been evaluated. Specifically, if due to a fire, a three-phase fault were to occur on a feeder cable in a different fire area, the fault could cause a fire in the overduty switchgear. This postulated fire would be in a different fire area thereby resulting in two simultaneous fires in different safe shutdown fire areas.

This could adversely affect the safe shutdown functions during a fire, because it is an implicit assumption that only one fire, in one fire area, can occur at one time. This type of condition invalidates this assumption. Based upon the teams concerns, the licensee continued to state that three-phase faults are uncommon and improbable occurrences.

The team agreed that although three-phase faults were uncommon, good engineering and industry-accepted practices considered such faults since they have occurred, and short circuit analyses always considered three-phase faults. As a result, the licensee initiated CAP025709 to re-evaluate the over-duty condition on these switchgear and to address the potentially adverse effects on the plants fire protection safe shutdown analysis.

The licensees evaluation for CAP025709, indicated that the power cables for reactor coolant pump RCP-P-1B were routed in both fire areas (Kewaunee has a unique fire analysis which utilizes only two fire areas, both alternate shutdown areas in accordance with 10 CFR Part 50, Appendix R, Section III.G.3, for the entire plant). Based upon the evaluation, the licensee determined that for the postulated fire and ensuing fault-induced fire, safe shutdown could still be accomplished. The licensee based this determination on cable configurations, combustible loadings, and the lack of ignition sources in the affected areas.

While the licensee was able to conclude, in the evaluation for CAP025709, that safe shutdown could still be achieved with this over-duty condition, the condition had never been addressed, nor had any corrective action document been generated, in the 13 years (1992) since the over-duty switchgear issue was initially raised. At the conclusion of the inspection, the licensee was continuing efforts to identify additional evaluations and corrective actions.

Analysis:

The team determined that this failure to identify and evaluate a deficiency with potential adverse consequences to the plants fire protection safe shutdown analysis was a performance deficiency warranting a significance evaluation. This finding was determined to be more than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Screening, issued on January 14, 2004, because it was associated with degradation of a fire protection feature. The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Appendix F, Fire Protection Significance Determination Process. The team determined that the finding category affected was post-fire safe shutdown and that the degradation was low because the licensee determined that safe shutdown could still be accomplished. Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

Criterion II of 10 CFR Part 50, Appendix B, requires that the licensee establish a quality assurance program. It states, in part, that the program shall be documented by written policies, procedures, or instructions and shall be carried out throughout plant life in accordance with those policies, procedures, or instructions. The Kewaunee Operational Quality Assurance Program (OQAP), Appendix E, implements Quality Assurance requirements for the fire protection program. Appendix E establishes that the fire protection program is governed by the requirements in OQAP, Section 11.

Section 3.1.5, of OQAP Section 11, states, in part, that programs and processes shall be established to provide for identification and the evaluation of plant related problems.

These occurrences were also to be promptly documented using the appropriate corrective action process. Additionally Section 3.1.7 states, in part, that programs and processes shall be established to assure that conditions adverse to quality detected during the conduct of assessments, surveillances and/or inspections are documented and controlled. Contrary to these requirements in the Kewaunee Quality Assurance Program, deficiencies potentially adverse to the fire protection program and the Kewaunee plant specific safe shutdown analysis were never identified and evaluated.

Although, the over-duty conditions on non-safety related switchgear 1-1, 1-2, 1-3, and 1-4 were identified as early as 1992 from a safe shutdown analysis perspective, the conditions were not fully addressed or entered into the Kewaunee corrective action program. This failure to carry out the policies and instructions in the Quality Assurance Program is considered to be a violation of 10 CFR Part 50, Appendix B, Criterion II, which requires, in part, that the licensee carries out the policies, procedures, and instructions of the Quality Assurance Manual throughout plant life.

The results of this violation were determined to be of very low safety significance, because after extensive evaluation of the deficiency, the licensee was able to determine that the plant could still safely shut down during a postulated fire event. Therefore, since this violation of the requirements contained in 10 CFR Part 50, Appendix B, Criterion II was captured in the licensees corrective action program (CAP025709), it is considered a Non-Cited Violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2005002-03).

.2.1.2 Safety Battery (BRA-101)

a. Inspection Scope

The team reviewed the battery sizing calculation and load profile calculation for the two safety batteries to determine if the batteries could carry the load specified by the load profile, and that appropriate values for temperature correction factor, margin factor, and aging factor had been considered in the sizing calculation.

The load profile calculation was evaluated to determine if the battery duty cycle was in accordance with USAR requirements, if worst case loading had been considered, and if each profile step included the loads anticipated for that step. The team also verified if the required momentary and station blackout (SBO) loads had been included at the proper step in the battery load profile calculation.

The battery minimum cell/room temperature was evaluated to determine conformance with the temperature used in the battery sizing calculation. The team also reviewed effects of the loss of the non-safety related battery room ventilation in order to determine the minimum room temperature, and effects on room hydrogen concentrations.

The team performed a walkdown of the battery rooms, and reviewed the monthly, quarterly, and five-year battery surveillance procedures. The team witnessed the quarterly surveillance tests performed on a battery to determine if the testing was conducted in accordance with procedures, and that the technicians were competent to perform the testing.

b. Findings

Introduction:

The team identified a Non-Cited Violation (NCV) of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green)for failure to implement adequate design controls of documents, inputs, and assumptions in the design of the two safety-related batteries. These adverse conditions have existed since 1992 when new batteries were installed.

Description:

The team identified that battery sizing calculations did not exist for the two safety batteries. In 1989, the licensee received a vendor purchase proposal for new batteries from C & D Charter Power Systems; these batteries were to replace Batteries BRA-101 and BRB-101. The vendor provided a quotation that included a Battery Sizing Worksheet. The worksheet determined the required size of a 59 cell battery based on the load profile provided by the licensee, and assumed a minimum cell temperature of 77 degrees Fahrenheit (F), design margin of 1.10, and an aging factor of 1.25.

However, a battery sizing calculation was not performed by the licensee to substantiate the vendor worksheet. The team did not consider this worksheet to be a calculation since it was not performed or controlled in accordance with appropriate design controls.

Though the licensee had an updated battery load profile calculation, this profile was not used to update the battery sizing worksheet performed by the vendor in 1989. Though calculation C-038-002 existed to document the up-to-date battery duty cycle (load profile), this duty cycle was never used to confirm that the battery still had adequate capacity based on successive revisions of the load profile. The licensee issued CAP025336 to document this condition. The team reviewed the operability evaluation written for CAP025336 and noted that the operability evaluation categorized the lack of a sizing calculation as an administrative issue. The team determined this to be an inadequate operability evaluation.

The team noted that the minimum temperature used in the battery sizing worksheet was not maintained or effectively controlled in the battery rooms; and the surveillance procedure used to document temperatures during surveillance testing of the batteries had no acceptance criteria. The vendor worksheet used a licensee-specified 77 degrees F as the minimum battery cell temperature. However, the licensee had not incorporated this requirement into the battery room ventilation design which presently maintained battery room temperature between 67 degrees F and 83 degrees F.

Additionally, the consequences of a loss of the non-safety related ventilation system on room temperature and hydrogen accumulation, had not been evaluated by the licensee.

The licensee issued CAP025206 to document this issue.

The team also noted that an insulated steam pipe (associated with the turbine driven auxiliary feedwater system) traversed the battery BRB-101 room but no analysis existed to account for potential heat input from this pipe under different operating conditions.

The licensee issued CAP025077 to document this issue.

The team also noted that the monthly/quarterly surveillance tests routinely documented battery cell temperatures, yet no acceptance criteria was provided for determining if the documented values were within allowable limits. In reviewing past surveillance test data, the team noted that the minimum room and cell temperatures documented since battery installation in 1992, were 65 degrees F and 70.1 degrees F, respectively. Both values were below the assumed and analyzed minimum of 77 degrees F. CAP025206 also addressed this issue. At the completion of the inspection, the licensee was developing a plan to perform various electrical system analyses, including battery sizing calculations.

Analysis:

The team determined that failure to perform and control battery sizing calculations for the two safety batteries, to ensure assumptions and inputs, such as temperature effects, was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that the finding was more than minor because it affected the Mitigating System Cornerstone objective of equipment capability, in that the lack of battery sizing calculations, and incorporating temperature effects in determining the required battery capacity, could result in insufficient battery capacity under worst case temperature environment. The team determined that the failure to appropriately evaluate effects of battery room and cell temperatures also affected the cross-cutting area of Problem Identification and Resolution. The subject of battery capacity versus battery temperature had been previously identified in 1992 during the NRC Electrical Distribution System Functional Inspection, yet when new batteries were installed later in the same year (1992), the licensee did not implement corrective actions to ensure these battery room temperatures concerns were addressed and corrected.

The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, because the finding was associated with the availability and reliability of a mitigating system. The team determined that the performance deficiency was a design deficiency that did not result in a loss of system function. The battery had sufficient capacity to demonstrate operability.

Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods. Contrary to the above, the licensee did not have a battery sizing calculation, to demonstrate the battery was sufficiently sized to perform design function and appropriately factor actual plant temperature effects into the sizing of the batteries. Because this violation is of very low safety significance and has been entered into the licensee's corrective action program as CAPs 025336 and 025206, this violation is being treated as a Non-Cited Violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2005002-04).

.2.1.3 Safety 480 Vac Buses 51 and 52

a. Inspection Scope

The team performed electrical system walkdowns, observed instrument indications and reviewed selected operations surveillances to verify that the power supplies for the 480 Vac safety buses 51 and 52 would be available and unimpeded during normal and accident/event conditions. Reviews were based upon the USAR and TS requirements.

Specifically, the team reviewed procedures for the operation, maintenance and testing of the 480 Vac buses and their respective supply transformers to verify proper design configuration and control. The team reviewed power supply calculations, operating lineup procedures, drawings, licensing and design basis information, surveillance procedures, recent plant modification records and vendor manuals.

The team reviewed the electrical overcurrent and ground protective relay settings for selected circuits to verify that the trip setpoints would not spuriously interfere with the equipment fulfilling its safety function, and secondarily, that adequate protection was provided. Specific relays reviewed were the overcurrent, and ground relays associated with buses 51 and 52 bus protection and motor control center (MCC) MCC 52E feeder circuit protection. Data sheets for the last relay calibration were also reviewed to verify that the calibrations were within the calculated limits and that excessive drift was not taking place.

During the review of the 480 Vac buses 51 and 52, the team focused on the appropriateness of design assumptions, adequacy of analytical models and methods, calculations and acceptance criteria for surveillance and performance validation tests.

This was done to verify that the power sources were adequate to meet minimum voltage specifications for electrical equipment during normal and accident events. Among the reviewed components were the 4160/480 Vac Station Service Transformers (SST)51 and 52.

The team reviewed design drawings and performed walkdowns of portions of the electrical distribution systems, including the SST 51, SST 52, and safety 480 Vac buses 51 and 52. The purpose of the inspection was to verify that system alignments were consistent with design and licensing basis assumptions and to verify that the observable material condition was acceptable. The team observed the temperature readings on SST51 and 52 to verify that they were within the equipment ratings.

The team reviewed the safety 480 Vac buses 51 and 52 supply circuit breaker control logic design drawings and performed field walkdowns to verify that the installed local and remote circuit breaker control switches, breaker position indicating lights and the operator actions for the resetting of the lockout relays were consistent with design drawings and operations procedures.

b. Findings

No findings of significance were identified.

.2.1.4 Emergency Diesel Generators (EDG)

a. Inspection Scope

The team reviewed the EDG loading calculation to determine if the EDGs had the capacity and capability to supply the required loads under worst case conditions, as described in USAR Section 8.2.3.

The EDG breaker control schematic diagrams were reviewed to determine proper functioning of close and trip functional requirements. Included were the schematics of the fire pumps and the pressurizer heaters to assure that they were blocked from closing during an accident scenario, per design. The load sequencing on the EDG was also reviewed to determine if sequencer relay and timer tolerances had been accounted for in preventing timing sequences from being exceeded, or from adjacent steps from overlapping. The team also reviewed specific large loads to determine if the conservative brake horsepower values had been used in the loading calculation.

The team reviewed the USAR, the Final Safety Analysis Report (FSAR), Regulatory Guide 1.9, and Safety Guide 9, as part of the diesel generator loading. The team also performed inspection walkdowns of the EDGs.

b. Findings

EDG Loading Limit

Introduction:

The team identified a minor violation of 10 CFR 50.59 in that the licensee failed to follow the guidelines established in the USAR indicating that where a difference existed between different issues of NRC Criterion relating to the Emergency Power System, the more stringent requirements would be followed. Differences between NRC Safety Guide 9 and Regulatory Guide 1.9, resulted in the licensee following the less stringent requirements.

Description:

The diesel generator ratings and maximum loading were reviewed after the team noted differences between the maximum EDG loading limits specified in the current USAR and those of the superseded FSAR (Amendment 19, June 3, 1972). The USAR used 2950 kiloWatt (kW) as the load limit, whereas the FSAR imposed a criterion of 2750 kW as the loading limit.

Safety Guide 9 (dated March 10, 1971), suggested that the predicted diesel generator loads should not exceed the smaller of the 2000-hour rating, or 90 percent of the 30-minute rating. The loading limit in accordance with Safety Guide 9 would therefore be 2745 kW, and the FSAR established 2750 kW as the not-to-exceed criterion.

In contrast, in keeping with the guidance of Regulatory Guide 1.9, the USAR stated that the EDG loads should not exceed the short-time rating of the unit, and because the KNPP EDG does not have a short-time rating, the licensee stated that the load imposed on the diesel generator would not exceed the 7-day rating of 2950 kW, which is a conservative value based on a possible short-time (2-hour) rating.

The team noted that the change in commitment from Safety Guide 9 to Regulatory Guide 1.9, resulted in an increase of the permissible diesel generator loading limit from 2750 kW to 2950 kW, an increase of 200 kW. The licensee advised the team that no documentation, in the form of an evaluation pursuant to 10 CFR 50.59, existed to justify or explain the basis and acceptability of this increase in the loading limit from the Safety Guide 9 guidance previously established. Nonetheless, the licensee did have information from the EDG manufacturer to support the EDG unit capability to operate at 2950 kW. The licensee issued CAP025534 to document this issue.

Analysis:

The team determined that a performance deficiency existed because the licensee failed to follow the guidelines established in the USAR indicating that where a difference existed between different issues of NRC Criterion relating to the Emergency Power System, the more stringent requirements would be followed. The licensee could not provide an evaluation performed pursuant to 10 CFR 50.59 documenting the basis for the USAR change. Because violations of 10 CFR 50.59 are considered to be violations that potentially impede or impact the regulatory process, they are dispositioned using the traditional enforcement process instead of the Significance Determination Process. Accordingly, based on NRC management review, this violation was considered minor because although the licensee did not maintain the analysis to support the change in commitment to Regulatory Guide 1.9, the EDG unit was rated to be capable of carrying the calculated design loads. Additionally, the team determined that there was not a reasonable likelihood that the change would ever require NRC approval per 10 CFR 50.59.

Enforcement:

The failure to maintain a documented basis for the change in commitment, as reflected in the USAR, was considered a violation of 10 CFR 50.59 which has minor significance and is not subject to enforcement action in accordance with Section IV of the NRCs Enforcement Policy. The licensee entered the issue into the corrective action program as CAP025534.

While minor violations are not normally documented in inspection reports, the team determined that documentation was appropriate in this case because it represented an example of 10 CFR 50.59 program weakness, the underlying cause is similar to that of another finding in this report relating to 10 CFR 50.59, and documentation is consistent with the TI requirements.

.2.1.5 Air Operated Valve MU-1022

a. Inspection Scope

The team reviewed the design and operation of valve MU-1022 based on a corrective action program history which indicated performance problems which could reduce available operating and design margin. Valve MU-1022 was designed to provide a suction path from the boric acid blender to the suction of the charging pumps. The team reviewed nine CAPs that were generated for this valve over the past two years to evaluate the licensees corrective actions and evaluate valve operability. The CAPs addressed failures of this air operated valve to close on loss of air, failures related to limit switch operation and indication, and problems with packing leaks. The team also held discussions with responsible engineers as part of these reviews.

b. Findings

No findings of significance were identified.

.2.1.6 Technical Support Center (TSC) Diesel Generator

a. Inspection Scope

The team reviewed the TSC diesel generator loading calculation to determine if the diesel generator had the capacity and capability to supply the required loads under the specified conditions. The calculation addressing the initial application of loads on energizing the generator to the bus, and the subsequent load sequencing, were also reviewed.

The team reviewed CAPs relating to the TSC diesel generators failures to start, failures to run, and frequent coolant system problems. A walkdown inspection was also conducted by the team. Section 4OA5.2.2 of this report further discusses issues relating to the TSC DG.

b. Findings

No findings of significance were identified.

.2.1.7 Service Water Pumps SW-1A1, 1A2, 1B1, and 1B2

a. Inspection Scope

The team reviewed the design of the service water (SW) pumps. This review included the related USAR sections and TS, the SW system flow diagram, various flow analyses, summaries of inservice testing results, and various CAPs related to the pumps. The team reviewed the hydraulic model of the service water system, as well as various other system analyses, including the analysis to establish the inservice testing acceptance criteria for the pumps. The team reviewed the results of inservice testing from 1999 through 2004. The team also reviewed CAPs related to the adequacy of flow to various components and the adequacy of SW water pressure to prevent flashing under post-accident conditions.

b. Findings

No findings of significance were identified.

.2.1.8 Valve Residual Heat Removal (RHR) RHR-2A

a. Inspection Scope

The team reviewed the design of motor operated valve RHR-2A. This valve is a normally closed valve and is located in the RHR supply line from the reactor coolant system A hot leg. The team reviewed the Operating Conditions Evaluation that determined the maximum pressure drop and flow values for the valve. The team reviewed the closing margin for the valve and various calculations related to this valve.

b. Findings

No findings of significance were identified.

.2.1.9 Main Steam Atmospheric Dump Valves SD-3A and 3B

a. Inspection Scope

The team reviewed the design of the air operated main steam atmospheric dump valves. This review included the sizing calculation for the nitrogen back-up to the instrument air supply. The team also reviewed various CAPs related to the common power supply for these valves, instrument air leakage, and steam leakage.

b. Findings

No findings of significance were identified.

.2.1.1 0 Motor Driven Auxiliary Feedwater Pumps AFW-1A and 1B

a. Inspection Scope

The team reviewed the design of the motor driven auxiliary feedwater (AFW) pumps.

This review included the related USAR sections and TS, the system flow diagram, various flow analyses, summaries of inservice testing results, and various CAPs related to the pumps. The team reviewed the hydraulic model of the auxiliary feedwater system, as well as various other system analyses, including the net positive suction head (NPSH) analysis, pump runout analysis, and the analysis to establish the inservice testing acceptance criteria for the pumps. The team reviewed the condensate storage tank (CST) level setpoints, as well as the capability of the pumps to be transferred from the CST to the safety related source (SW system). The team also reviewed the results of inservice testing from 1991 through 2004.

b. Findings

(1) Potential Common Mode Failure of Auxiliary Feedwater Pumps Due to Failure of Non-Safety Related CSTs or Suction Piping

Introduction:

The team identified an Unresolved Item (URI) associated with the design of the AFW pumps discharge pressure switch. The team identified the potential for air intrusion into operating AFW pumps, potentially resulting in a common mode failure of the AFW system.

Description:

As discussed in USAR Section 6.6.3, the AFW system was modified in response to NRC NUREG-0737. One of the modifications was the addition of automatic trip of the AFW pumps upon low pump discharge pressure (separate pressure switch and trip for each of the three AFW pumps).

As documented in NRC correspondence dated September 21, 1979, NUREG-0737, Recommendation GL-4 stated, in part, Licensees having plants with unprotected normal AFW system water supplies should evaluate the design of their AFW systems to determine if automatic protection of the pumps is necessary following a seismic event or tornado. Consideration should be given to providing pump protection by means such as automatic switchover of the pump suctions to the alternate safety-grade source of water, automatic pump trips on low suction pressure or upgrading the normal source of water to meet seismic Category I and tornado protection requirements. In a letter dated May 7, 1993, the licensee stated that the recommended low pump suction pressure trip setpoint would need to be at sub-atmospheric pressure, and therefore, stated that a pump low discharge pressure trip would be installed instead, to, provide the desired NPSH protection. The NRC stated that this design was acceptable in a letter dated June 8, 1993. This design change was installed in 1994 via Design Change Request (DCR) DCR No. 2668, Revision 1. Technical Specifications Section 3.4.b was also amended to require these low discharge pressure trip channels to be operable.

In preparation for the NRC inspection, on January 24, 2005, the licensee initiated CAP025124 to document the lack of a definitive basis for the AFW pump discharge pressure trip setpoints (350 psig for the two motor driven pumps and 100 psig for the turbine driven pump). On January 27, 2005, the team asked the licensee if the potential for air ingestion and pump damage had been evaluated for the pump discharge pressure trip design. The team was concerned that, in the event of a failure of the CSTs or suction piping due to a seismic event or tornado, the discharge pressure switches would not detect the air ingestion until pump performance was significantly degraded.

On February 4, 2005, the licensee initiated CAP025341, which stated that the pump discharge pressure trip design was not in compliance with the plant licensing basis because it could not be shown that the AFW pumps would be protected if the CSTs or suction piping failed. However, the CAP also stated that the AFW system was operable.

On February 7, 2005, Operability Recommendation (OPR) OPR-87, Revision 0, was approved. The OPR concluded that the AFW system was capable of performing its safety function after a seismic event or tornado, and the AFW system was considered operable but degraded. This conclusion was primarily based on a determination that the AFW pump suction piping was not expected to fail due to a seismic event or tornado. Additionally, credible failures of the CSTs would be mitigated through reliance on the capabilities of the control room operators, using normal procedures and training to prevent damage to the AFW pumps. The OPR stated that no compensatory measures were required to maintain operability. The team questioned the licensees operability determination and reliance on existing operations procedures. The licensee was relying upon existing SW system and abnormal operations procedures to mitigate the potential failure of the CST due to a seismic or tornado event. The team considered such reliance to be inappropriate since the existing procedures were developed to address normal depletion of the CST during non-seismic or tornado events.

Additionally, the licensee was relying upon operators to recognize low CST level alarms following a seismic event or tornado, and likely plant trip, and take actions to switchover the supply to the AFW pumps from the CST to the SW system. The team expressed concern that operators would be in emergency operating procedures and may not have sufficient time to accomplish the tasks before the pumps were damaged, and may not recognize the CST low level alarm due to other annunciators and alarms. Lastly, the team expressed concern that the licensee was relying upon the operator actions but had not performed any time validation in the plant simulator to provide a confidence level as to the adequacy of the existing procedures.

On February 8, 2005, Operability Recommendation OPR-87, Revision 1, was approved and still stated that no compensatory measures were required to maintain operability.

However, it did include additional measures to provide a dedicated control room operator and procedure changes to transfer the AFW pumps to service water sooner in the event of an earthquake or tornado strike.

On February 9, 2005, Operability Recommendation OPR-87, Revision 2, was approved.

Revision 2 included a qualitative discussion to support an additional conclusion that, if the pump suction was lost, there was reasonable assurance that the AFW pumps would not be damaged before the discharge pressure trips actuated and stopped the pumps.

On February 11, 2005, the licensee declared all three AFW pump discharge pressure switches inoperable based on a vendor analysis which predicted substantial damage to the CSTs from a tornado, and that the AFW pumps could be damaged by air ingestion prior to actuation of the pump low pressure discharge pressure trip. Based on proceduralized compensatory actions put in place to realign the AFW pump suctions to service water at the earliest indication of a tornado threat, the AFW Pump Low Discharge Pressure Trips were declared Operable but Non-Conforming on February 12, 2005. NRC notification was provided in accordance with 10 CFR 50.72 (Event 41406). On February 13, 2005, Operability Recommendation OPR-87, Revision 3 was approved. Revision 3 addressed these compensatory measures.

The team continued to question some of the technical bases for the conclusions included in OPR-87, Revision 3. These questions included the capability of the CSTs and the pump suction piping to survive a seismic event, and the capability of the piping in the turbine building basement to survive a tornado. The day following the completion of this inspection, the licensee determined that the AFW pump suction piping was susceptible to damage from a high energy line break in the turbine building. As a result, on February 19, 2005, the licensee declared all three AFW trains inoperable and began a reduction in power and plant shutdown in accordance with the facilitys TS Section 3.4.b. NRC notification was provided in accordance with 10 CFR 50.72 (Event No. 41423). The licensee has entered the issue into the corrective action program as CAP025341.

At the conclusion of this inspection, the licensee was continuing evaluations to develop corrective actions to address the AFW operability concerns. The NRC was continuing the review of the licensee actions and inspection activities to understand the possible AFW system failure modes due to seismic, tornado, and high energy line break events.

Therefore, this issue will be considered as an unresolved item (URI) pending further NRC review of the different failure modes of the CST and associated piping to all three AFW pumps (URI 05000305/2005002-05).

(2) Inadequate Evaluation of Plant Procedure Changes

Introduction:

The team identified that the licensee failed to perform an adequate review of operations procedure changes in accordance with 10 CFR 50.59 associated with the operation of motor-operated valves for the AFW suction source from the SW system.

The issue was considered to be of very low safety significance and was dispositioned as a Severity Level IV Non-Cited Violation (NCV).

Description:

Part 50.59 of Title 10 CFR, required, in part, that a licensee may make changes in the procedures as described in the final safety analysis report (as updated)without obtaining a license amendment only if the change does not meet any of the specific criteria of section 10 CFR 50.59. Procedures as described in the final safety analysis report means those procedures that contain information described in the FSAR such as how structures, systems, and components are operated and controlled (including assumed operator actions and response times).

As discussed in the preceding section, on February 8, 2005, the licensee approved Operability Recommendation OPR-87, Revision 1, and identified additional measures to provide a dedicated control room operator and procedure changes to transfer the AFW pumps to service water in the event of a seismic event or tornado activity. The additional measures consisted of changes to Alarm Response Procedure 47064-Q, Condensate Storage Tanks Level High/Low, Revision F, and Operations Procedure E-0-05, Response to Natural Events, Revision L. The approved changes required operators to align the SW system to the AFW pump suction upon loss of the CST or AFW suction from the CST. These changes were approved based on a 10 CFR 50.59 Applicability Review concluding that 10 CFR 50.59 requirements did not apply.

As also discussed in the preceding section, on February 11, 2005, the licensee declared all three AFW pump discharge pressure switches inoperable. The licensee approved procedure changes to realign the AFW pump suctions to service water at the earliest indication of a tornado threat. On February 12, 2005, the licensee performed a 10 CFR 50.59 Applicability Review for a proposed temporary change to Emergency Operating Procedure E-0-05, Response to Natural Events, Revision L. The procedure was being changed to direct control room operators to align the AFW pumps suction source to the SW system in the event of a tornado watch or tornado warning. This temporary change was being implemented as a compensatory measure related to the AFW pump low discharge pressure trip design. The team identified that the 10 CFR 50.59 Applicability Review form incorrectly determined that the procedure changes could be evaluated under the guidance provided in NRC Generic Letter 91-18, Revision 1, and not per 10 CFR 50.59. The team concluded that the licensees determination was not correct because the 10 CFR 50.59 Applicability Review was being performed for the proposed changes to an existing approved Operations Procedure E-0-05, and not for the existing non-conforming plant condition. Hence, the licensee should have determined that 10 CFR 50.59 did apply to the procedure change and a 10 CFR 50.59 Screening should have been performed.

The team also questioned whether the licensee had appropriately followed the guidance in Nuclear Energy Institute standard NEI 96-07, which the NRC endorsed in Regulatory Guide 1.187. Specifically, the NEI guidance states that 10 CFR 50.59 should be applied to temporary procedure changes proposed as compensatory actions to address degraded or non-conforming conditions. Additionally, changes that introduce a new type of malfunction would be screened in and a 10 CFR 50.59 evaluation performed.

Furthermore, pursuant to 10 CFR 50.59.c(2), a licensee shall obtain a license amendment prior to implementing a proposed change if the change would result in more than a minimal increase in the likelihood of occurrence of a malfunction of a SSC important to safety previously evaluated in the FSAR (as updated).

After the temporary procedure change was issued, the team determined that this change could have potentially resulted in an adverse effect. Specifically, the team was concerned that the licensee had not fully evaluated the potential adverse effects and consequences due to the change. The procedure was being changed to direct control room operators to align the AFW pumps suction source to the SW system in the event of a tornado watch or tornado warning. This change would ensure that if the CST or AFW pump suction piping was lost during a tornado, the AFW pump suction source would already be aligned to the SW system. However, the team questioned the adequacy of this procedure change since it did not address the potential that the CST and piping remain intact but a SBO could subsequently occur. In this situation, there would be a resultant loss of service water header pressure (due to the loss of all alternating current power) with the AFW pumps aligned to the SW system. During the review of the teams concerns, the licensee identified that this condition could also result in the draindown of the CST through the depressurized service water headers.

Additional procedure changes were required to address this potential scenario.

The team questioned the results of the 10 CFR 50.59 Applicability Review. In response to this concern, the licensee initiated CAP025487 on February 14, 2005. The CAP stated that this procedure change should not have been screened out by the 10 CFR 50.59 Applicability Review. The licensee issued a 10 CFR 50.59 Screening (SCRN No. 05-026-00) on February 15, 2005, to address this procedure change, as well as other related procedure changes.

Analysis:

The team determined that the licensees approval of changes to Procedure E-0-05, with the introduction of adverse effects, and a determination that 10 CFR 50.59 was not applicable, was a licensee performance deficiency warranting a significance evaluation. Because violations of 10 CFR 50.59 are considered to be violations that potentially impede or impact the regulatory process, they are dispositioned using the traditional enforcement process instead of the Significance Determination Process. In this case, the licensee failed to perform a safety evaluation in accordance with 10 CFR 50.59 for adverse changes made to the operations procedure concerning the function and operation of the AFW pumps suction source from the SW system.

This finding was determined to be more than minor because the team could not reasonably determine that the original procedure change would not have ultimately required NRC approval. The procedure changes, in the form of operator actions, adversely impacted the operation of mitigating systems during an SBO event. The team completed a significance determination of this finding using IMC 0609, Appendix A, Significance Determination of Reactor Inspection Findings for At-Power Situations.

The team determined from the mitigating systems evaluation in the Phase 1 Screening Worksheet that all the questions were answered No, therefore the finding was determined to be of very low safety significance (Green).

Enforcement:

Title 10 CFR 50.59(d)(1) states, in part, that the licensee shall maintain records of changes in the facility, of changes in procedures, and of tests and experiments. These records must include a written evaluation which provides the bases for the determination that the change, test, or experiment does not require a license amendment. Contrary to the above, the licensee issued an operating procedure change that introduced adverse consequences during an SBO event and failed to perform a safety evaluation in accordance with 10 CFR 50.59.

The results of this violation were determined to be of very low safety significance; therefore, this violation of the requirements in 10 CFR 50.59 was classified as a Severity Level IV Violation. Because this non-willful violation was non-repetitive, and was captured in the licensees corrective action program (CAP025487), this violation is being treated as a Non-Cited Violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2005002-06).

(3) Setpoint to Transfer AFW Pump Suctions from CSTs to Service Water Did Not Include Allowance for Manual Operator Actions

Introduction:

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for failure to establish an adequate CST level setpoint to transfer the AFW pump suction source from the CST to the SW system. The established setpoint did not include allowance for the completion of the manual operator actions.

Description:

Calculation C10859-3, Condensate Storage Tank Level EOP Switchover to Alternate Water Source Setpoint, Revision 0, was approved on June 23, 2003, to verify the control loop accuracy to support a change to an EOP and abnormal procedure setpoint from 4 to 8 percent of CST level. The setpoint provided the level at which control room operators would switch the AFW suction source from the CSTs to the SW system. This calculation was based on an analytical limit of 4 percent tank level to prevent air ingestion into the discharge nozzle. An additional allowance of 4 percent was included for instrument error, bringing the EOP setpoint to 8 percent.

Emergency Operating Procedure E-0-QRF, Quick Reference Foldout, Section E-0, Revision H, directed the operators to switch to an alternate AFW pump water source per Abnormal Procedure A-FW-05B, Abnormal Auxiliary Feedwater System Operation, Revision AI, if CST level decreased to less than 8 percent. When the CST level was no longer greater or equal to 8 percent, the procedure directed the operators to locally align three manual valves prior to opening the motor operated service water supply valves to the AFW pump suctions.

The team questioned the licensee if the local manual actions could be accomplished before the CST depleted to the point that AFW pump air ingestion could occur, potentially damaging the AFW pumps. The licensee stated that the manual actions required by Procedure A-FW-05B had not been time validated, and on February 14, 2005, initiated CAP025479 to address the issue.

On February 15, 2005, the licensee issued a temporary change to Operating Procedure A-FW-05B to change the sequence of the steps needed to re-align the AFW suction source, thereby minimizing the time needed to accomplish the action once the 8 percent setpoint was reached.

The team also questioned the licensee regarding the potential for air entrainment due to vortexing in the CSTs. Calculation C10859-3 stated that the floating CST roof would settle on its pedestals when the CST level reached 4.167 percent. The calculation did not include a vortex analysis. However, the teams review of the applicable tank drawing indicated that the floating roof would reach the pedestals at 5.8 percent level, resulting in a potential vortex concern. The team also noted that this issue had been raised by the NRC during a 1997 team inspection (when the EOP setpoint was 4 percent). The previous question had been addressed in Kewaunee Assessment Process KAP 0709, dated February 1, 1997, which included a qualitative discussion and concluded air entrainment was unlikely. This KAP did not address instrument uncertainty.

In response to the vortex question, on February 14, 2005, the licensee initiated CAP025485. The CAP included an informal analysis to show that adequate margin existed to preclude air entrainment, based on the current 8 percent setpoint and considering instrument error. The CAP recommended updating Calculation C10859-3 to include a vortex analysis.

Analysis:

The team determined that the failure to implement adequate design controls as demonstrated by an EOP setpoint calculation not consistent with the procedures and the calculation including incorrect information constituted a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that this issue was more than minor because it affected the mitigating system cornerstone objective of equipment reliability, in that failure to align the AFW pump suctions to service water prior to the CSTs being depleted could have resulted in damage to the AFW pumps. The team also noted that prior to March 2004, the EOP setpoint of 4 percent did not include any allowance for instrument uncertainty, which could have resulted in air entrainment and potential AFW pump damage. The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, because the finding was associated with a mitigating system. The team determined that the performance deficiency was a design deficiency that did not result in a loss of system function. The team concluded that it was unlikely that the operators would allow the CST level to reach the EOP setpoint without attempting to refill the tanks from other sources, and that the operators would be aware of the CST levels. Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee did not establish measures to ensure that the actions required to transfer the AFW pump suctions prior to depleting the CSTs were effectively transferred into plant procedures. Because this violation is of very low safety significance and has been entered into the licensee's corrective action program (CAP025479), this violation is being treated as a Non-Cited Violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2005002-07).

.2.1.1 1 Turbine Driven Auxiliary Feedwater Pump

a. Inspection Scope

The team reviewed the design of the turbine driven AFW pump. This review included the related USAR sections and TS, the system flow diagram, various flow analyses, summaries of inservice testing results, and various CAPs related to the pump. The team reviewed the hydraulic model of the auxiliary feedwater system, as well as various other system analyses, including the NPSH analysis, pump runout analysis, and the analysis to establish the inservice testing acceptance criteria for the pump. The team also reviewed the CST level setpoints, as well as the capability of the pump to be transferred from the CST to the safety related service water source. The team reviewed the results of inservice testing from 1991 through 2004. In addition, the team reviewed the design of the motor-operated steam admission valve MS-102. This valve had a safety function to open to start the pumps. The team verified the adequate margin of the valve in both the open and closed directions.

b. Findings

The findings associated with the motor driven auxiliary feedwater pumps (Section 4OA5.2.1.10) are also applicable to the turbine driven AFW pump.

.2.1.1 2 Service Water Pump Discharge Check Valves

a. Inspection Scope

The team reviewed the design of the check valves (SW-1A1, 1A2, 1B1, and 1B2)located on the discharge of the four service water pumps. The team verified the inservice testing of these valves. The team also reviewed CAPs associated with a proposed design change to replace these valves, delays in performing valve disassembles and inspections, and the lack of an analysis for valve leakage.

b. Findings

No findings of significance were identified.

.2.1.1 3 Motor Operated Valve CVC-301

a. Inspection Scope

The team reviewed the design of motor operated valve CVC-301. This normally closed valve was located in the supply line from the RWST to the charging pump suction.

Although this valve performed no safety function in the open position, it would be used to provide a source of reactor coolant pump seal water in the event of a loss of component cooling water. The team reviewed the Operating Conditions Evaluation that determined the maximum pressure drop and flow values for the valve. The team investigated the margin for the valve, and reviewed the motor-operated valve calculation related to this valve.

b. Findings

No findings of significance were identified.

.2.1.1 4 Charging Pumps

a. Inspection Scope

The team reviewed the charging pumps selected based on the poor maintenance history of the components. The team reviewed the associated failures, the Maintenance Rule (a)(1) action plans initiated to address the pumps reliability and availability issues, and the proposed design change to replace the pumps Vari-drive system.

b. Findings

No findings of significance were identified.

.2.1.1 5 Diesel Generator Ventilation

a. Inspection Scope

The team reviewed the components associated with the EDG room ventilation system to ensure the system and components would be capable of performing their required design functions. EDG room ventilation is supplied and exhausted through air actuated dampers, which require air to open or modulate upon a EDG start signal. The air to the damper is provided from the EDG starting air receivers. The safety-related air supplied from the air receivers is tested on a monthly basis to ensure minimum hours of damper operation. The team conducted equipment walkdowns and assessed CAPs, test procedures and results, maintenance history, drawings and applicable sections of the USAR and TS. The team performed specific reviews of the licensees calculations to ensure minimum hours of damper operation provided from the air receivers. The teams review also included a Licensee Event Report (LER), which identified several deficiencies regarding the EDG air start system in 1989. A Licensee-Identified Violation associated with this issue is documented in Section 4OA7.

b. Findings

No findings of significance were identified.

.2.1.1 6 Motor Operated Valve AFW-10A and 10B

a. Inspection Scope

The team reviewed the design of motor operated valves AFW-10A and 10B. These normally open valves were located in the discharge lines from the turbine driven auxiliary feedwater pump. The valves performed an active safety function in the closed position to separate the auxiliary feedwater headers. The team investigated the closed margin for these valves, and reviewed the MOV calculation related to the valves.

b. Findings

No findings of significance were identified.

.2.1.1 7 Air Operated Pressurizer PORVs PR-2A and 2B

a. Inspection Scope

The team reviewed the design of air operated valves PR-2A and 2B. The valves had a safety function in both the open and closed positions. The team reviewed the air-operated valve calculation to verify the capability of the valves to perform their safety function. The team also reviewed the inservice testing of the valves and the sizing of the associated air accumulators.

b. Findings

No findings of significance were identified.

.2.1.1 8 Circulating Water Expansion Joint

a. Inspection Scope

A walkdown of the turbine building basement was performed to assess the adequacy of flood protection measures regarding the postulated failure of a main condenser circulating water expansion joint, and other piping systems. Additionally, the team reviewed licensee procedures for the inspection of condenser inlet and outlet expansion joints. Section 4OA5.4.3 of this inspection report further discusses issues regarding potential internal flooding.

b. Findings

No findings of significance were identified.

.2.2 Review of High Risk Operator Actions

a. Inspection Scope

During the inspection, the team reviewed risk-significant, time-critical operator actions that had little margin between the time required and time available to complete the action:

• Operator Recovery from Loss of Offsite Power;

• Operator Action to Maintain CST Inventory;

• Operator Action to Establish AFW;

• Operator Actions Following Station Blackout; and

• Operator Action to Establish Feed and Bleed.

b. Findings

(1) Operator Action to Maintain CST Inventory Failure to Ensure that Calculation Assumption was Based on Valid Times for Manual Operator Actions

Introduction:

The team identified a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green) for failure to implement adequate design controls of calculations and assumptions. The finding involved a calculation assumption that was non-conservative with regard to the time required to complete manual operator actions. A calculation assumption stated that a flow would drain from the CSTs to the condenser for 10 minutes during an SBO event until the operators isolated the flow by closing manual valve MU-2A. The team determined that the actions could not be completed in the time assumed by the calculation.

Description:

Calculation C10859-4, Condensate Storage Tank Level - Technical Specifications Minimum Volume Requirement, Revision 0, was prepared to determine the minimum level that must be maintained in the CSTs to ensure that the required Technical Specification 3.4.c volume was available for decay heat removal during an SBO. Assumption 14 stated that a flow of 360 gallons per minute (gpm) was assumed to drain from the CSTs to the condenser through fail-open air operated valve MU-3A.

The flow was assumed to continue for 10 minutes until the operators isolated the flow by closing manual valve MU-2A.

The team questioned the basis of the 10-minute assumption, and asked if the actual time required to take this action under SBO conditions had been validated. On February 1, 2005, the licensee initiated CAP025273 to address the basis for the 10-minute assumption. The licensee subsequently informed the team that there was no validation data to support the 10-minute assumption. During the inspection, the licensees operations personnel determined that the time required to close manual valve MU-2A would be 15 to 18 minutes following an SBO. A walkdown by team members provided comparable results. Therefore, the additional 8 minutes could result in approximately 2880 gallons being drained from the CSTs to the condenser and not be available in the CST to mitigate a SBO event. The licensee subsequently verified that the existing CST volume met TS requirements based on the actual CST levels and the conservative flow rate assumed in the calculation.

The licensee initiated Procedure Change Request PCR018201 on February 11, 2005, to revise Procedure ECA-0.0 and decrease the time required for the operators to close valve MU-2A. The licensee also initiated Corrective Action CA018202 on February 11, 2005, to revise Calculation C10859-4, Revision 0.

Analysis:

The team determined that the failure to implement adequate design controls by verifying a calculation assumption constituted a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that the finding was more than minor because it affected the mitigating system cornerstone objective of equipment capability, in that failure to isolate the manual valve within the assumed time could result in less than the required water volume being available for decay heat removal.

The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process, because the finding was associated with a mitigating system. The team determined that the performance deficiency was a design deficiency that did not result in a loss of system function.

Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures be established and implemented to assure that applicable regulatory requirements and the design basis for structures, systems, and components are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee did not establish measures to ensure that manual actions required to maintain the minimum required CST available volume were transferred into plant procedures. Because this violation is of very low safety significance and has been entered into the licensee's corrective action program (CAP025273), this violation is being treated as a Non-Cited Violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2005002-08).

(2) Operator Actions Following Station Blackout Invalidated SBO Coping Duration

Introduction:

The team identified a Non-Cited Violation of 10 CFR 50.63, Loss of All Alternating Current Power, having very low safety significance (Green) for failure to maintain appropriate procedure controls to minimize the likelihood and duration of a SBO event. The lack of procedure controls resulted in invalidating the licensees SBO coping strategy.

Description:

The team identified that the licensee had deleted procedural steps that were instrumental in the determination of the stations SBO coping duration.

Specifically, the licensee deleted a step in Operating Procedure A-EHV-39, which allowed for the cross-connection of the two redundant safety buses (1-5 and 1-6) should both the RAT and the 1B EDG fail. The NRCs evaluation of the licensees compliance with 10 CFR 50.63, was documented in a Safety Evaluation Report dated October 1, 1991. The evaluation report stated that, During a subsequent telephone conversation, the licensee explained that if the 1B EDG does not start, the emergency operating procedure contains a provision to tie the emergency buses together, thus fulfilling the RG 1.155 manual transfer requirement for an I2 (independence of offsite power group) ... the ability to manually tie the emergency buses together lessens the chance of the SBO occurring, or can reduce the time of the SBO. Thus, the staff finds the I2 classification acceptable for those plants that have an emergency operating procedure for such a transfer. This I2 classification allowed the licensee to establish a coping duration of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as opposed to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Because of the importance of this transfer capability, the team reviewed the current version of Procedure A-EHV-39, Abnormal 4160 Vac Supply and Distribution System.

During this review, the team identified that the licensee had removed these steps from the procedure in a previous revision. The team concluded that by removing this ability to provide power to both divisions through this cross-connect ability, the licensee had invalidated their basis for the 4-hour coping duration.

As a result of the team concerns, the licensee revised Procedure A-EHV-39, by re-inserting the steps required to provide the transfer ability which was originally depended upon for the plants 4-hour SBO coping duration.

Analysis:

The team determined that the licensees failure to maintain the basis for the licensees 4-hour coping duration was a licensee performance deficiency warranting a significance determination in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that the finding was more than minor because it affected the initiating events cornerstone objective. The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process.

Specifically, the lack of procedure steps reduced the redundancy of power sources available to the safety buses and therefore increased the likelihood of the loss of the safety bus. A Phase 2 SDP evaluation was performed, since the finding affected both the initiating event and mitigating systems cornerstones. The inspectors evaluated the loss of offsite power with loss of an emergency bus (LEAC) worksheet and increased the initiating event likelihood by one order of magnitude. The RIII SRA reviewed the results of the Phase 2 analysis and determined that the results were conservative for this particular finding. The finding actually increased only the likelihood of a partial loss of offsite power and a loss of an AC bus because the number of power sources to the safety-related 4160 Vac bus was reduced from two offsite (the TAT and the RAT) and one onsite (the EDG) to one offsite (RAT) and one onsite (EDG). Based upon these results, this finding was determined to be of very low safety significance (Green).

Enforcement:

Title 10 CFR 50.63, Loss of All Alternating Current Power, states, in part, that the specified station blackout duration shall be based on the redundancy of the onsite emergency ac power sources and the probable time needed to restore offsite power. The 4-hour coping duration for SBO at Kewaunee was based upon the ability to be able to manually tie the emergency buses together, thereby, lessening the chance of an SBO occurring, or reducing the time of the SBO. This capability was achieved by including a provision to tie the emergency buses together in the licensees emergency operating procedure. Contrary to the requirements of 10 CFR 50.63, the licensee removed these procedural provisions, thereby, invalidating the plants 4-hour coping duration without making the additional necessary changes in the Kewaunee plant specific SBO coping strategy.

The results of this violation were determined to be of very low safety significance, because multiple sources of both onsite and offsite power remained available to supply power to the safety buses. Therefore, since this violation of the requirements contained in 10 CFR 50.63 was captured in the licensees corrective action program (CAP025427),it is considered a Non-Cited Violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000305/2005002-09).

TSC DG Target Reliability

Introduction:

The team identified a Non-Cited Violation of 10 CFR 50.63, Loss of All Alternating Current Power, having very low safety significance (Green) for the failure to establish a target reliability for the plants alternate AC (AAC) source consistent with the reliability approved by the NRC staff during the approval of the licensees SBO submittal, per 10 CFR 50.63©)(3).

Description:

Based upon the teams review of the SER, dated November 19, 1992, the NRC approved the licensees SBO submittal and reliance on the use of the TSC DG, in part, based upon meeting the criteria in NUMARC 87-00, Appendix B. The licensee stated in the SBO submittal, dated September 18, 1992, that the TSC diesel generator meets the guidelines of NUMARC 87-00, Appendix B. Item B.13 stated that the system reliability should be maintained at or above 0.95 per demand, as determined in accordance with NSAC-108 methodology (or equivalent). Guidance document NSAC-108 determined the reliability using a straight ratio such that 5 failures out of 100, or 1 out of 20, would constitute a 95 percent reliability.

The team reviewed the licensees criteria for restoring the TSC DG to its target reliability, and noted that the licensee was not using the same methodology (straight ratio) for TSC DG failures, as discussed in NSAC-108. Rather, the licensee was using a methodology employed in NUMARC 87-00, Revision 1. This methodology was used in initially determining the SBO coping duration for the station based upon past EDG reliability. However, the team was not provided with any documents which supported use of this different methodology for the AAC source, the TSC DG. In fact, this methodology was clearly less conservative than the straight reliability method used in NSAC-108. Using this methodology, the licensee established a criteria of 3 failures in 20 demands, 5 failures in 50, and 8 failures in 100. At the time of the inspection, the TSC DG had 4 failures in 20 demands, and had exceeded the trigger value of 3 failures, for restoring the TSC DG to its target reliability of 95 percent. However, the team were concerned that the licensee had not used a straight reliability, with a trigger value of 2 failures, such as that in NSAC-108. The result was that the licensee had not increased efforts to restore the TSC DG to the target reliability at an earlier date.

Because of the non-conservative failure rate methodology employed by the licensee, the team determined that the licensee was not attempting to meet the target reliability for the plants AAC source which was accepted by the NRC staff during the approval of the licensees SBO submittal. This failure to maintain the reliability of the AAC source for SBO coping was considered to be a violation of the requirements in 10 CFR 50.63. The licensee subsequently initiated a corrective action to change the TSC DG reliability methodology.

Analysis:

The team determined that the failure to meet the target reliability of 95 percent was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. This finding was determined to be more than minor because it affected the mitigating systems cornerstone objective. The team determined that the finding could be evaluated using the SDP in accordance with IMC 0609, Significance Determination Process. The team determined that the performance deficiency was a deficiency that did not result in a loss of function in accordance with Generic Letter (GL) 91-18, Revision 1. Accordingly, the finding was determined to be of very low safety significance (Green).

Enforcement:

Title 10 CFR 50.63, Loss of All Alternating Current Power, states, in part, that necessary support systems must provide sufficient capacity and capability to ensure that the core is cooled and appropriate containment integrity is maintained in the event of a station blackout for the specified duration. At Kewaunee, the TSC DGs SBO support function was as the alternate AC source. In 10 CFR 50.2, the definition of an alternate AC source requires, in part, that it has sufficient capacity and reliability for operation of all systems required to bring and maintain the plant in safe shutdown. The reliability of the TSC DG was determined to be acceptable based upon the criteria in NUMARC 87-00, Appendix B, Item B-13, which states that the system reliability should be maintained at or above 0.95 per demand, as determined in accordance with NSAC-108 methodology (or equivalent). NSAC-108 uses a straight reliability that, if followed, would establish a trigger value of 2 failures on 20 demands for restoring the TSC diesel generator to its target reliability. Contrary to this, the licensee used an alternative methodology for determining reliability that established a trigger value of 3 failures. This failure to meet the target reliability of 95 percent was a violation of the 10 CFR 50.63 requirement to ensure that support systems, the TSC DG, have sufficient capability in the event of a station blackout.

The results of this violation were determined to be of very low safety significance, because it did not affect the immediate operability of the TSC diesel generator.

Therefore, since this violation of the requirements contained in 10 CFR 50.63 was captured in the licensees corrective action program (CAPs 026518 and 025943), it is considered a Non-Cited Violation consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000305/2005002-10).

.3 Surveillance Testing and Modifications Reviews

a. Inspection Scope

The team reviewed TS surveillance testing associated with risk-significant components within the scope of this inspection. The team focused on the adequacy of the testing to demonstrate component capability to perform their intended safety functions.

Additionally, the team also reviewed permanent plant modifications associated with risk significant components within the scope of this inspection. The surveillance tests and modifications listed below were reviewed as part of this inspection effort:

• SP-38-101B - Station Battery BRB-101 Monthly and Quarterly Test, Revision L;

• PMP 42-08, Train B Auto Sequencing Test with Diesel B in Pullout Electrical Maintenance; Revision K;

• SP-42-328, Diesel Generator Start-Up Air Leakage Test;

• SP-38-102A, Station Battery BRA 101 Load Test (QA-1), Revision B;

• SP-38-102B, Station Battery BRB 102 Load Test (QA-1), Revision C;

• SP-39-227B, Bus 1-6, Loss of Voltage Relay Test and Calibration, Revision O;

• DCR 2618, 4160 Volt Circuit Breaker Replacement for Buses 5 and 6;

• DCR 3176, 480 Volt Safety Breaker Replacement; and

• DCR 3507, Diesel Generator Circuitry Surge Suppression.

b. Findings

No findings of significance were identified.

.4 Review of Operating Experience Events Relating to Initiating Events and Generic Issues

a. Inspection Scope

During the inspection, the team identified five initiating events that were reviewed to ensure operating experience issues, either NRC generic concerns or identified at other facilities, had been adequately addressed by the licensee.

In addition, the team selected other operating experience identified at other facilities that were reviewed for their applicability to Kewaunee and the selected components.

Several of these issues that were determined to be applicable were selected for a more in-depth review:

• Inverter Failures Contributors to Plant Transients and Trips;

• Loss of Offsite Power Events;

• Internal Flooding Events;

• ATWS Lessons Learned; and

• Main Feedwater Transients.

b. Findings

(1) Internal Flooding Events The team performed reviews of industry operating experience as reflected in past licensee event reports (LER) related to internal flooding deficiencies. The NRC previously identified an URI associated with the potential vulnerability of safety-related equipment to flooding in the Turbine Building Basement (05000305/2004009-03). The URI pertained to the failure of non-safety related equipment in the Turbine Building which could impact the ability of safety related equipment in the areas to perform their intended safety function. The team performed additional reviews of the licensees evaluations and actions taken in response to the issues and concerns raised by the NRC during the previous inspection. Section 4OA3 of this report further discusses this URI.

In response to the NRCs previous concerns regarding flood protection measures, during this inspection period, the licensee developed compensatory measures in the form of pre-staged sand bags, hoses, and sump pumps to enable a means to remove water before safety equipment was affected. The team discussed with licensee personnel the potential for non-category I systems and components in the turbine building basement, including the condenser and condenser expansion joints, which if failed could impact the safety-related equipment.

The team also noted that the potential for internal flooding affecting safety related equipment had been previously recognized at other facilities and by the NRC. These other events were documented in LERs, as well as NRC Information Notice 83-44. This IN discussed the potential damage to redundant safety equipment as a result of backflow through equipment and floor drains. The IN discussed a condition identified at a facility where without backflow protection in the floor drains, a circulating water conduit break in the turbine building or a design basis flood could flood the turbine building condenser pit and result in flooding in rooms containing safety-related equipment. It further stated that older plants may be susceptible to the same or equivalent potential problem.

At the conclusion of the inspection, the licensee was continuing to review the potential for flooding in the turbine bundling from various water sources, and calculating the worst possible flood levels in various areas of the turbine and auxiliary building, based on different pipe breaks. Additionally the licensee was also attempting to identify the most credible size leak in the turbine building which could affect safety related equipment, rather than assuming the largest pipe size as a worst case. The licensees actions to resolve these issues was continuing at the end of this inspection.

Subsequent to the completion of the inspection, on March 15, the licensee notified the NRC, pursuant to 10 CFR 50.72 (Event No. 41496), that the plants design for flooding events may not mitigate the consequences of piping system failures.

No findings of significance were identified.

(2) ATWS Lessons Learned

Introduction:

A minor finding related to the mitigating systems cornerstone was identified. The finding involved deficient procedures.

Description:

The team reviewed the licensees actions to comply with the Anticipated Transient Without SCRAM (ATWS) rule, 10 CFR 50.62. The team reviewed the licensees ATWS Mitigating System Actuation Circuitry (AMSAC) design, the licensing documents that evaluated and approved the design, surveillance procedures for AMSAC, and operating procedures associated with ATWS. The team also reviewed corrective action program and maintenance history associated with AMSAC.

The team reviewed the periodic surveillance procedures used to verify proper operation of the AMSAC system. The team identified that the sequence of operations could potentially mask a time dependent fault within the AMSAC logic. In the AMSAC Quarterly Functional Test, SP-47-281, Revision K, the key switch is taken to PROG and back to RUN to verify that a system fault is annunciated before any logic testing is done.

In the AMSAC Calibration and Logic Test, SP-47-282, Revision H, the system is turned off, then back on to verify that the system fault annunciator is operating. This is also done before any logic testing to verify proper operation. These actions potentially reset the logic and preclude a determination of as found condition.

Analysis:

The team determined that the testing sequence could potentially mask a time dependent fault within the AMSAC logic was a performance deficiency warranting a significance evaluation in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued January 14, 2004. The team determined that the finding was minor because there is no evidence that any sort of fault actually exists. The licensee initiated a procedure change to correct the deficiency.

While minor performance deficiencies are not normally documented in inspection reports, the team determined that documentation was appropriate in this case because of the long-standing practice of pre-conditioning which had not been previously identified by the licensee and documentation is consistent with the TI requirements.

4OA6 Meetings

.1 Exit Meeting

On February 18, and March 29, 2005, the team presented the inspection results to Mr. C. Lambert and other members of licensee management, who acknowledged the findings presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

4OA7 Licensee-Identified Violations

The following violations of very low significance were identified by the licensee and are violations of NRC requirements which met the criteria of Section VI of the NRC Enforcement Manual, NUREG-1600, for being dispositioned as Non-Cited Violations.

Cornerstone: Mitigating Systems

In preparation for the NRC inspection, on January 7, 2005, the licensee identified that corrective actions described in LER 05000305/1989-005-01, Inspection of Diesel Generator Start Up Air System Deficiencies That Could Render Both Diesel Generators Inoperable, dated September 6, 1991, had not been implemented. Specifically, the licensee had failed to develop operating procedures, equipment, and operator training to ensure that air supplies would be available for the DG room ventilation dampers. During this inspection, the licensee developed corrective actions to address this issue. The deficiencies were documented in CAP 024845, DGs Dependent on QA-2 Components for Sustained Operation.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Nuclear Management Company, LLC

C. Lambert, Site Vice President

K. Hoops, Site Director

K. Davison, Plant Manager

L. Armstrong, Engineering Director

P. Anderson, Outage and Planning Manager

T. Breene, Plant and Systems Engineering Manager

E. Coen, Probabilistic Risk Analyst Engineer

P. deTemple, System Engineer

D. Geisen, Nuclear Oversight Manager

L. Gerner, Licensing Supervisor

K. Gillaume, Instrument and Control Analyst

G. Harrington, Licensing

B. Hennig, Senior Engineer

S. Hills, Maintenance General Supervisor

J. Hoard, Design Supervisor

D. Irlbeck, Operations Shift Manager

J. Kimmers, Corrective Action Program Analyst

B. Koehler, Manager of Projects

T. Lillehei, Design Engineer, Prairie Island

D. Lohman, Operations Manager

D. Mielke, Operations Supervisor

T. Perez, Engineering Supervisor

K. Peveler, Program Engineering Manager

J. Pollock, Design Engineering Manager

S. Putman, Maintenance Manager

P. Rappel, Senior Technical Advisor

J. Riste, Licensing Supervisor

G. Salamon, Regulatory Affairs Manager

J. Schweitzer, Engineering Director, Point Beach

P. Short, Operations Support Manager

P. Snyder, Electrical Maintenance

J. Stafford, Assistant Operations Manager

L. Sutton, Engineering Analyst

Nuclear Regulatory Commission

C. Pederson, Director, DRS, RIII

T. Kozak, Team Leader, Technical Support Section

J. Adams, Senior Resident Inspector, Prairie Island

J. Jacobson, NRR

INPO

P. Inserra, INPO Senior Evaluator

Attachment

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000305/2005002-01 FIN Lack of 4160 Vac Bus 1-5 Overcurrent and Loss of Voltage Relay Coordination (Section 4OA5.2.1.1b(1))

05000305/2005002-02 FIN Safety Buses Relay Sensitivity to External Electrical Disturbances (Section 4OA5.2.1.1b(2))

05000305/2005002-03 NCV Short Circuit Duty of Buses Exceeded - Impact on Safe Shutdown Analysis (Section 4OA5.2.1.1b(3))

05000305/2005002-04 NCV Battery Sizing Deficiencies (Section 4OA5.2.1.2)

05000305/2005002-06 NCV Inadequate Evaluation of Procedure Changes to Address AFW Design Deficiencies (Section 4OA5.2.1.10b(2))

05000305/2005002-07 NCV Lack of Allowance for Manual Actions in Establishing Setpoint to Transfer AFW Pump Suction Source (Section 4OA5.2.1.10b(3))

05000305/2005002-08 NCV Failure to Ensure that Calculation Assumption was Based on Valid Times for Manual Operator Actions (Section 4OA5.2.2b(1))

05000305/2005002-09 NCV Operator Actions Following Station Blackout - Lack of Procedure Guidance (Section 4OA5.2.2.b(2))

05000305/2005002-10 NCV TSC DG Target Reliability Methodology Inadequate (Section 4OA5.2.2.b(2))

Opened

05000305/2005002-05 URI Potential Common Mode Failure of Auxiliary Feedwater Pumps (Section 4OA5.2.1.10.b(1))

Discussed

05000305/2004009-03 URI Potential Flooding in the Turbine Building Basement (Section 4OA3)

Attachment