IR 05000289/2009006

IR 05000289-09-006 on 06/01/2009 - 06/26/2009 for Three Mile Island, Unit 1, Component Design Bases Inspection

ML092220552
Person / Time
Site:	Crane
Issue date:	08/10/2009
From:	Doerflein L Engineering Region 1 Branch 2
To:	Pardee C Exelon Generation Co, Exelon Nuclear
References
IR-09-006
Download: ML092220552 (36)

Text

August 10, 2009

Mr. Charles Senior Vice President, Exelon Generation Company, LLC President and Chief Nuclear Officer (CNO), Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

Dear Mr. Pardee:

SUBJECT:

THREE MILE ISLAND STATION, UNIT 1 - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000289/2009006

On June 26, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Three Mile Island Station, Unit 1. The enclosed inspection report documents the inspection results, which were discussed on June 26, 2009, with Mr. William Noll and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

In conducting the inspection, the team examined the adequacy of selected components and operator actions to mitigate postulated transients, initiating events, and design basis accidents.

The inspection involved field walkdowns, examination of selected procedures, calculations and records, and interviews with station personnel.

This report documents three NRC-identified findings which were of very low safety significance (Green). The findings were determined to involve violations of NRC requirements. However, because of the very low safety significance of the violations and because they were entered into your correction action program, the NRC is treating them as non-cited violations (NCV)

consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U. S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, Region 1; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C.

20555-0001; and the NRC Resident Inspector at the Three Mile Island Station. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region I, and the NRC Resident Inspector at the Three Mile Island Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305. In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for the public inspection in the NRC Public Docket Room or from the Publicly Available Records component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Lawrence T. Doerflein, Chief

Engineering Branch 2

Division of Reactor Safety

Docket No.

50-289 License No.

DPR-50

Enclosure:

Inspection Report 05000289/2009006

w/Attachment: Supplemental Information

SUMMARY OF FINDINGS

IR 05000289/2009006; 06/01/2009 - 6/26/2009; Exelon Generation Company, LLC; Three Mile

Island Station, Unit 1; Component Design Bases Inspection.

The report covers the Component Design Bases Inspection conducted by a team of five NRC inspectors and two NRC contractors. Three findings of very low risk significance (Green) were identified, which were all considered to be non-cited violations (NCV). The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of 10 CFR 50, Appendix B, Criterion III,

Design Control. The team determined Exelon did not evaluate, in accordance with methodology described in the UFSAR, the suitability of the river water stop logs in the Intake Screen and Pump House (ISPH) structure to ensure they would not fall and block the river water flow path during a seismic event. The team determined that failure of the logs to remain in place would impact the capability of the safety-related nuclear river water, decay river water, and reactor river water pumps to perform their design function following the event. The Updated Final Safety Analysis Report (UFSAR), section 5.1.1, describes the ISPH and the river water systems as Seismic Class I structures, systems and components, and states that this equipment should be evaluated in accordance with the methodologies described in the UFSAR. Following identification Exelon entered the issue into the corrective action program and performed a preliminary analysis which indicated the stop logs would remain in place for all design basis events.

This finding is more than minor because it affected the design control attribute of the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding was determined to be of very low safety significance (Green)because the design/qualification deficiency confirmed not to result in loss of operability or functionality. This finding was not assigned a cross-cutting aspect because the underlying cause was not indicative of current performance. (Section 1R21.2.1.7)

Severity Level IV. The team identified a Severity Level IV NCV of 10 CFR 50.59,

Changes, Tests and Experiments, for the failure to obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a change to the components credited to be operable for the decay heat river system. The team reviewed a modification and associated safety evaluation that removed the internals of the decay heat river water strainer. Exelons 10 CFR 50.59 safety evaluation credited the operation of three non-safety-related traveling screens to perform this strainers safety functions in order to allow the change to the facility without a license amendment. The team determined that because the screens were not safety-related structures, systems, or components, they could not be used to meet the system operability requirements as discussed in Technical Specification 3.3 Emergency Core Cooling, Reactor Building Emergency Cooling and iii Reactor Building Spray Systems. Use of these components would require a change to the TS, and, therefore, the 10 CFR 50.59 process screening should have determined the process cannot be used. Following identification of the issue Exelon performed an operability evaluation to ensure the system could respond to credited design basis events and performed an apparent cause evaluation to determine the cause of the performance deficiency.

The failure to submit this change prevented the NRC from performing its regulatory function and the issue was evaluated under traditional enforcement guidance. The team determined that this issue was more than minor because there was a likelihood that the activity would have required NRC approval prior to implementation. The severity level of the violation was determined to be Severity Level IV because there was no willful aspect and the finding was determined to be of very low safety significance. The finding was determined to have a crosscutting aspect in Human Performance-Decision Making which states the licensee should use conservative assumptions in decision making and adopts a requirement to demonstrate that the proposed action is safe. (H.1(b)) (Section 1R21.2.1.8)

Green.

The team identified a NCV of 10 CFR Part 50, Appendix B, Criterion V,

Instructions, Procedures, Drawings, in that Exelon did not include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Specifically, the team identified that the maintenance and testing procedure E-5.2 for the Westinghouse type DB-50 480V safety-related load center circuit breaker did not include instructions to ensure that a jumper be installed to defeat the Amptector discriminator circuit. The failure to install the jumper resulted in the feeder breaker to a safety-related motor control center not meeting Exelons design requirements that were implemented to ensure breaker coordination existed between safety and non-safety related equipment. Following identification of the issue Exelon performed an operability assessment and implemented compensatory actions to ensure breaker coordination was maintained.

This finding is more than minor because it affected the design control attribute of the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding was of very low safety significance since it was a design deficiency determined not to have resulted in the loss of safety function. The finding had a cross cutting aspect in Human Performance - Resources which requires procedures to be complete, accurate and up-to-date. (H.2(c)) (Section 1R21.2.1.12)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstone: Initiating Events, Mitigating Systems, Barrier Integrity

==1R21 Component Design Bases Inspection (IP 71111.21)

==

.1 Inspection Sample Selection Process

The team selected risk significant components and operator actions for review using information contained in the Three Mile Island Probabilistic Risk Assessment (PRA) and the U. S. Nuclear Regulatory Commissions (NRC) Standardized Plant Analysis Risk (SPAR) model. Additionally, the Three Mile Island Unit 1 Significance Determination Process (SDP) Phase 2 Notebook was referenced in the selection of potential components and operator actions for review. In general, the selection process focused on components and operator actions that had a Risk Achievement Worth (RAW) factor greater than 1.3 or a Risk Reduction Worth (RRW) factor greater than 1.005. The components selected were located within both safety-related and non-safety-related systems, and included a variety of components such as pumps, breakers, heat exchangers, electrical busses, transformers, and valves.

The team initially compiled a list of components and operator actions based on the risk factors previously mentioned. Additionally, the team reviewed the previous component design bases inspection report (05000289/2007006) and excluded those components previously inspected. The team then performed a margin assessment to narrow the focus of the inspection to eighteen components, five operator actions and one operating experience issue. The teams evaluation of possible low design margin included consideration of original design issues, margin reductions due to modifications, or margin reductions identified as a result of material condition/equipment reliability issues.

The assessment also included items such as failed performance test results, corrective action history, repeated maintenance, maintenance rule (a)1 status, operability reviews for degraded conditions, NRC resident inspector insights, system health reports, and industry operating experience. Finally, consideration was also given to the uniqueness and complexity of the design and the available defense-in-depth margins. The margin review of operator actions included complexity of the action, time to complete the action, and extent-of-training on the action.

The inspection performed by the team was conducted as outlined in NRC Inspection Procedure (IP) 71111.21. This inspection effort included walkdowns of selected components, interviews with operators, system engineers and design engineers, and reviews of associated design documents and calculations to assess the adequacy of the components to meet design basis, licensing basis, and risk-informed beyond design basis requirements. A summary of the reviews performed for each component, operator action, operating experience sample, and the specific inspection findings identified are discussed in the subsequent sections of this report. Documents reviewed for this inspection are listed in the Attachment.

.2.1.1 Battery 1B

a. Inspection Scope

The team inspected the 1B battery to verify it was capable of performing its design basis function. The team reviewed calculations to verify that the sizing of the battery would satisfy the design requirements of the safety-related and risk significant DC loads, and that all operating loads on the battery were included in the calculation. In particular, the evaluation focused on voltage drop calculations to verify adequate voltage would remain available for the individual loads required to operate during design basis events. The team also reviewed the battery room hydrogen generation calculation to verify that the hydrogen concentration level would stay below acceptable levels during normal and accident conditions. The team reviewed battery surveillance test procedures and results to determine whether test acceptance criteria and frequency requirements satisfied TS and the Institute of Electrical and Electronics Engineers (IEEE) standards, and the acceptance criteria were met. Finally, the team performed a walkdown of the battery and reviewed selected corrective action documentation (issue reports) to verify that design and testing issues related to the batteries were appropriately identified and corrected, and to assess the overall material condition of the battery.

b. Findings

No findings of significance were identified.

.2.1.2 Battery Charger 1A

a. Inspection Scope

The team inspected the 1A battery charger to verify it was capable of performing its design basis function. The team inspected the battery charger to verify its sizing would satisfy the amperage and voltage requirements of the DC loads during design basis events. The team reviewed the UFSAR, vendor documents, and procedures to identify the design basis requirements for the charger. The team verified the battery charger was adequately sized to supply the design duty cycle of the 250/125 VDC system and that adequate voltage would be maintained for the individual load devices required to operate during design basis events. In addition, the team performed a walkdown to visually inspect the physical condition of the battery charger, and to verify the charger was properly aligned and the panels indicated acceptable voltage and current. The team interviewed design and system engineers to determine the design aspects and operating history for the battery chargers. Finally, the team reviewed battery charger surveillance test procedures and testing results to verify that applicable test acceptance criteria and test frequency requirements specified for the battery charger were in accordance with TS and design basis assumptions, and the acceptance criteria were met.

b. Findings

No findings of significance were identified.

.2.1.3 A Emergency Diesel Generators Starter Circuit

a. Inspection Scope

The team inspected the starter circuit of the A emergency diesel generator to verify that the circuit could meet its design basis function of starting and loading the diesel within the analyzed time requirements. Drawings and calculations were reviewed to determine if assumptions used in the analyses, to confirm system operation, were acceptable. The team reviewed periodic test results to verify that the starter system and its components met acceptance criteria and that acceptance criteria were sufficient to show them capable of performing their safety function. The team conducted walkdowns of the emergency diesel generator (EDG) starting panels to determine the material condition and the operating environment for the equipment. Finally, issue reports were reviewed to ensure issues associated with the EDG starter system were identified and properly addressed.

b. Findings

No findings of significance were identified.

.2.1.4 Instrumentation and Control Circuits of Turbine Bypass and Atmospheric Dump Valves

a. Inspection Scope

The team inspected the instrumentation and control circuits of the turbine bypass and atmospheric dump valves to verify that they will be functional and provide desired control during accident/event conditions. The team reviewed the system design used to control these valves, from the main steam line pressure transmitters to the valves, to verify that they would provide accurate control capability. The team reviewed calibration results and replacement schedules of circuit components to verify that the components remained within their design specification limits. Qualification classification evaluations were also reviewed to ensure the components met the criteria for safety-related components designation. Surveillance test procedures and results were reviewed for the circuit integrated control system (ICS) modules to ensure discrepancies between calculated and measured module outputs were monitored and dispositioned appropriately. The team interviewed responsible station personnel to determine design aspects and operating history of the control systems. The team also walked down selected accessible portions of the system to assess the material condition of the components.

b. Findings

No findings of significance were identified.

.2.1.5 Decay Heat Removal Cross Connect to High Pressure Injection (DH-V-7B), Decay Heat

River Water Discharge (DR-V-1A), Makeup and Purification System (MU-V-16A), and Main Steam Isolation (MS-V-1A) Motor Operated Valves

a. Inspection Scope

The team inspected the motor operated valves (MOV) identified above to verify that they were capable of performing their specific design functions. The valves have safety functions in the open or closed position which require the valves to operate during multiple design basis events. The team reviewed the UFSAR, design basis documents, vendor drawings, and procedures to identify the design basis requirements of each valve. The team also determined expected system alignments to assess whether component operation based on allowed alignments was consistent with the design and licensing basis assumptions. Valve testing procedures and valve specifications were also reviewed to verify the design bases requirements, including assessment of worst case system and environmental conditions, were incorporated into the test acceptance criteria and component design.

The team reviewed periodic verification diagnostic test results and stroke test documentation to verify acceptance criteria were met. Additionally, the team verified the valves safety function, torque switch settings, performance capability, and design margins were adequately monitored and maintained in accordance with Generic Letter (GL) 89-10 guidance. Required test frequencies were reviewed to verify they were correctly determined, based on test results, as described in GL 96-05. The team reviewed motor data, degraded voltage conditions, thermal overload settings, and voltage drop calculations to confirm that the motor operated valves would have sufficient voltage and power available to perform their safety function at worst case degraded voltage conditions.

The team interviewed the MOV program and system engineer to gain an understanding of maintenance issues and overall reliability of the valves. The team also conducted walkdowns to assess the material condition of the valves, and to verify the installed valve configurations were consistent with design bases assumptions and plant drawings. Finally, component issue reports (IR) and system health reports were reviewed to verify that deficiencies were appropriately identified and resolved, and that valves were properly maintained.

b. Findings

No findings of significance were identified.

.2.1.6 Pressurizer Safety Valve (RC-RV-1B)

a. Inspection Scope

The team inspected the B pressurizer safety valve to verify that it was capable of performing its design function. The team reviewed the UFSAR, design basis documents, and procedures to identify the design basis requirements of the valve.

The team verified that safety relief valve setpoints were set in accordance with station test procedures, and the results of setpoint testing was in accordance with TS requirements. The team reviewed design documentation for sizing and lift setpoints, and the analysis for overpressure protection capability of the valve, to determine if the valve would meet design requirements. The team also discussed safety valve performance and trending with the system engineer and reviewed the valves maintenance and in-service test history, associated issue reports, and system health reports to assess the material condition of the valve.

b. Findings

No findings of significance were identified.

.2.1.7 Nuclear Services River Water (NR-P1C) and

Decay Heat River Water (DR-P1A) Pumps

a. Inspection Scope

The team inspected the C nuclear services and A decay heat river water pumps to verify they were capable of performing their design function. The team reviewed drawings, calculations, hydraulic analyses, procedures, system health reports, and design basis documents to evaluate whether the maintenance, testing, and operation of the pumps were adequate to ensure the pumps would deliver the design basis flows at the required pressure during transient and accident conditions. The team reviewed seismic qualification requirements to ensure the pumps, and required supporting equipment in the intake structure could operate following a seismic event. Additionally, procedures for external flood control at the intake structure were reviewed to ensure the pumps would perform during a design basis flooding event. Surveillance test results were also reviewed to determine if the pumps were operating within established acceptance criteria, and that the criteria ensured the pumps could meet their system design requirements.

The team also reviewed electrical calculations, drawings and equipment specifications to determine whether adequate voltage and current would be available at the pump motor terminals for starting and running under worst case voltage conditions and to determine if the motor capacity was adequate for the anticipated loading condition. Finally, the team reviewed breaker trip settings to determine whether appropriate electrical protection coordination margins had been applied for the maximum motor loading requirement. The intake structure ventilation design was reviewed to ensure ambient temperature requirements for the motor and associated instrumentation were maintained.

In addition, the team reviewed vendor requirements for the suction bell submergence at minimum river level to ensure conditions that would cause vortexing were not present and net positive suction head requirements were met. The team also reviewed the implementation of the licensees commitments made in response to GL 89-13, Service Water System Problems Affecting Safety-Related Equipment, regarding intake bay silting control in the pump suction area. The team performed a walkdown of the pumps and supporting equipment, including the intake structure, to ensure the pump suction and discharge conditions were adequate. Finally, the team reviewed issue reports to ensure problems associated with the pumps were appropriately identified and corrected.

b. Findings

Introduction:

The team identified a Green NCV of 10 CFR 50, Appendix B, Criterion III, Design Control, which states that measures shall be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components.

Specifically, the licensee did not review the potential seismically-induced failure of the non-seismically qualified river water stop logs (SR-SL-1A/B/C and 2A/B/C) in the seismic Class I intake screen and pump house (ISPH) using approved methodology as defined in the TMI FSAR. Failure of the river water stop logs to remain in place would result in a common cause failure of the intake structure water flowpath to the suction of the safety-related and seismic Class I nuclear river water, decay river water, and reactor river water pumps.

Description:

During a walkdown of the ISPH the team observed three enclosed flow channels imbedded in the concrete of the building structure. Each channel provides a suction water flow path from the Susquehanna River to the safety-related nuclear river water, decay river water, and reactor river water pumps. The team noted that there were two steel river water stop logs in series hanging above the flow path in each of three channels. Following the walkdown the team requested Exelon provide the seismic analysis for the stop logs. Exelon personnel informed the team that the stop logs had no seismic classification, and no analysis had been performed to ensure the capability of the river water stop logs to remain in place during a seismic event. Subsequently, Exelon reviewed the Seismic Qualification Utility Group (SQUG) evaluations performed at the site but did not find a discussion or evaluation related to the stop logs.

The team reviewed Updated Final Safety Analysis Report (UFSAR) section 5.1.1 which states those structures, components, and systems, including instruments and controls, whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of radioactivity, and those structures and components which are vital to safe shutdown and isolation of the reactor are designated (seismic) Class I.

Additionally, section 5.1.1.1.a. describes the ISPH as a seismic Class I structure, and Section 5.1.1.1.d. describes the Decay Heat River Cooling Water Systems and Nuclear Services River Cooling Water Systems as seismic Class I systems. The team also determined that UFSAR Section 5.4.5 states in part Seismic evaluations of existing, new and replacement structures, systems and components may be performed by combining the responses due to each of the three directional components of the earthquake using the square root of the sum of the squares approach as described in USNRC Regulatory Guide 1.92. Seismic experience data methods (SQUG) may be used on a case-by-case basis as described in Section 5.1.2.1.2.c. Based on the above statements the team concluded that the river water stop logs should have been shown to be suitable to meet seismic loading, per the FSAR methodology, because a loss of function of several safety-related systems would occur if the stop logs dropped into the channels during a seismic event, and, therefore, should have been evaluated via the guidance in section 5.4.5.

The team inspected two of the installed stop logs. The inspection found that each stop log was suspended above the channels and weighed approximately 6000 pounds. Each was held in place by several components including two steel pins, supporting eyes, welds between eyes and the stop log, and ISPH structural concrete. The team observed that the supporting components did not show significant degradation and further determined that the pins would be the most critical of the structural components. The team also noted that no in-service inspection had been performed on the components and the pedigree of the components, including material characteristics of the metals and welds could not be confirmed. As a result of the teams concern, Exelon entered the issued into their corrective action program, performed a preliminary evaluation of the support components which determined that the stop logs would remain in place following a Safe Shutdown Earthquake (SSE). The team reviewed and agreed with the conclusions of the evaluation. Additionally, Exelon intends to perform a complete seismic evaluation in accordance with the methodology described in the UFSAR.

Analysis:

The team determined that failure to ensure that the ISPH river water stop logs would not fall and block the river water flow path during a seismic event in accordance with methodology described in the UFSAR was a performance deficiency. This finding is more than minor because it affected the design control attribute of the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and was similar to the more than minor examples 3j in IMC 0612 Appendix E because there was a reasonable doubt of operability. The team evaluated the finding in accordance with IMC 0609, SDP, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the mitigating systems cornerstone. The finding was determined to be of very low safety significance (Green) because it was a design/qualification deficiency confirmed not to result in loss of operability or functionality. The licensee determined that adequate structural capability existed in the steel supports holding the stop logs in place to prevent them from falling into the intake channel during a seismic event. This finding was not assigned a cross-cutting aspect because the underlying cause was not indicative of current performance.

Enforcement:

10 CFR 50, Appendix B, Criterion III, Design Control, states, in part, that measures shall be established for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. UFSAR Section 5 states in part that those structures and components which are vital to safe shutdown and isolation of the reactor are designated Class I and Seismic evaluations of existing, new and replacement structures, systems and components may be performed as described in USNRC Regulatory Guide 1.92 or seismic experience data methods (SQUG) may be used on a case-by-case basis. Contrary to the above, prior to June 25, 2009, Exelon did not verify the evaluation of the river water stop logs had been suitably performed to ensure that they were seismically qualified. Because this finding is of very low safety significance and was entered into the licensees corrective action program (AR #

00932899), it is identified as an NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000289/2009006-01, Failure to Assess Seismic Qualification of Stop Logs)

.2.1.8 Decay Heat River Water Strainer (DR-S-1A)

a. Inspection Scope

The team inspected the A decay heat river water strainer to verify it was capable of performing its required function of removing particulate from raw river water in order to prevent clogging of downstream components during design basis events and plant shutdown conditions. The team reviewed the UFSAR, the vendor manual, design basis documents, drawings, and procedures to identify the design basis requirements of the strainer. The team interviewed the system engineer to gain an understanding of maintenance issues and overall reliability of the strainer, and conducted walkdowns to assess the material condition, and to verify the system configurations were consistent with design bases and plant drawings. The team also reviewed issue reports to ensure problems associated with the strainer were appropriately identified and corrected.

During a system walkdown, the team determined that the B strainer was removed from the system for maintenance. The team reviewed Exelons 10 CFR 50.59 evaluation, the modification package and associated analysis performed for the removal of the strainer.

The team reviewed design basis analysis of the system (assuming the strainer was installed) including system hydraulic analysis, system single failure analysis, system drawings, system seismic requirements, decay river pump curves and system characteristic curves, and evaluated the impact of the maximum allowable particle size on the decay river system, to determine if the system configuration would permit performance of its required function during design basis events.

b. Findings

Introduction:

The team identified a Severity Level IV, non-cited violation of 10 CFR 50.59, "Changes, Tests, and Experiments," for failure to obtain a license amendment pursuant to 10 CFR 50.90 prior to implementing a changing credited structures, systems, and components (SSCs) required to meet Technical Specification (TS) 3.3 Emergency Core Cooling, Reactor Building Emergency Cooling and Reactor Building Spray Systems. Exelon incorrectly credited the use of three non-safety-related traveling screens in place of the safety-related decay heat river strainer to fulfill the requirements of TS.

Description:

On January 22, 2009, Exelon implemented a temporary modification that removed the internal straining components of the B train decay river water system strainer. The strainer is credited with removing debris from the river water so that downstream system components will not clog. Exelon transferred this straining function to three traveling screens installed in each portion of the intake structure and performed a 50.59 safety evaluation per procedure LS-AA-104, Exelon 50.59 Review Process, to evaluate whether this change was allowed via 10 CFR 50.59 regulations. Exelon concluded that the change to the facility could be made without a license amendment.

The team reviewed the modification and associated safety evaluation to verify a license amendment was not required. The team reviewed TS 3.3 which ensures the operating status of emergency core cooling systems including the decay river system. Section 3.3.1.1.d states that two decay heat removal heat exchangers and their cooling water supplies shall be operable. TS 1.3 states A system, subsystem, train, component or device shall be OPERABLE when it is capable of performing its specified function(s) and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its function(s) are also capable of performing their related support function(s). Additionally, the licensees TS bases documents define the cooling water system as the coolers and associated system components. The team also determined that the traveling screens were not classified as safety-related SSCs as defined by 10 CFR 50.2, and were not seismically qualified.

Additionally, the team determined that 10 CFR 50 Appendix B Quality Control requirements were not (nor were they required) applied to these components.

The team concluded that the traveling screens could not be used to meet the system operability requirements as discussed in Technical Specification 3.3 because the screens were not classified as safety related SSCs and, therefore, could not be included as one of the components described in TS 1.3 to meet the requirements of TS 3.3.

Crediting the use of these components would require a change to the TS, and, therefore, the 10 CFR 50.59 process screening should have determined the process could not be used because it is not applicable for TS changes. Following identification of the issue Exelon performed an operability evaluation to ensure the system could respond to credited design basis events and performed an apparent cause evaluation to determine the cause of the performance deficiency.

Analysis:

The team concluded that using the 10 CFR 50.59 process to change the requirements of the Technical Specifications was a performance deficiency. The failure to submit this change to the NRC for approval prior to implementation prevented the NRC from performing its regulatory function and, therefore, the issue should be evaluated under traditional enforcement guidance. The team determined that this issue was more than minor because there was a likelihood that this activity would have required NRC approval prior to implementation. The severity level of the violation was determined to be Severity Level IV in accordance with example D.5 of Supplement 1 of the NRC Enforcement Policy. Additionally, the team evaluated the finding in accordance with IMC 0609, SDP, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the mitigating systems cornerstone. The issue was determined to be of very low safety significance (Green) because the issue was determined to be a qualification issue confirmed not to result in loss of operability of the system. This finding was determined to have a crosscutting aspect in Human Performance-Decision Making which states the licensee should use conservative assumptions in decision making and adopts a requirement to demonstrate that the proposed action is safe. (H.1(b))

Enforcement:

10 CFR 50.59 states in part that the licensee may make changes in the facility as described in the final safety analysis report without obtaining a license amendment pursuant to 10 CFR 50.90 only if a change to the Technical Specifications incorporated in the license is not required. Contrary to this requirement, on January 28, 2008, Exelon changed the acceptable components credited to meet the operability requirements for Technical Specification 3.3 via their 10 CFR 50.59 safety evaluation process without prior approval by the NRC. Exelon performed an operability evaluation following identification of the issue to ensure there was not a current safety issue and entered the issue into their corrective action program (AR #00927536) with a planned action to reinstall the strainer internals. Therefore, the finding is being treated as a Severity Level IV, noncited violation consistent with Section V1.A.1 of the NRC Enforcement Policy: (NCV 05000289/2009006-02, Inadequate Decay Heat River Water Equipment.)

.2.1.9 Decay Heat Closed Cooling Water Pump (DC-P1A)

a. Inspection Scope

The team inspected the decay heat closed cooling water pump to ensure it could respond to design basis events. The team reviewed drawings, calculations, hydraulic analyses, procedures, system health reports, and design basis documents to evaluate whether the maintenance, testing, and operation of the pump were adequate to ensure the pump could deliver the design basis flows at the required pressure under transient and accident conditions. The team reviewed seismic qualification requirements to ensure the pump, and expansion tank could operate following a seismic event.

Surveillance test results were reviewed to determine if the pump was operating within established acceptance criteria, and the team also verified that the test acceptance criteria ensured the pump could meet the design requirements. The team performed a walkdown of the pump and expansion tank areas to access the material conditions.

The team also reviewed electrical calculations, drawings and equipment specifications to determine whether adequate voltage and current would be available at the pump motor terminals for starting and running under worst case voltage conditions and to determine if the motor capacity was adequate for the loading requirements. The team reviewed breaker trip settings to determine whether appropriate electrical protection coordination margins had been applied for the maximum motor loading requirement.

b. Findings

No findings of significance were identified.

.2.1.1 0 B Emergency Diesel Generator (Mechanical)

a. Inspection Scope

The team inspected the EDG fuel oil, lube oil, cooling water, starting air and EDG room ventilation systems to ensure they could respond to design basis events. The team reviewed the UFSAR, design basis calculations, vendor documents, and procedures to identify the design basis requirements for the systems. A walkdown was performed to assess the material conditions of the systems. The team also reviewed EDG surveillance test results to ensure the mechanical support systems were operating as designed, and verified maintenance was being performed on the fuel oil, and lube oil filters. For the fuel oil system, the team reviewed fuel oil consumption calculations that were performed to ensure Technical Specification requirements were met. The team also reviewed seismic qualification documents related to the fuel oil day tanks. For the lube oil system, the team verified that sufficient lube oil supplies were on site to support extended EDG runs. The team reviewed the design specification for the starting air system, as well as EDG air start test results, normal operating pressure band, alarm setpoint band, and Technical Specification limit for operability, to verify that the start air system was properly sized and could meet its design function for successive starts. The cooling water radiator system design requirements were reviewed to ensure adequate performance of the radiator under worst-case ambient conditions. The EDG room ventilation system design was reviewed, including failure positions of air-operated dampers, to ensure environmental qualification limits were not exceeded during operation, and ventilation system test results were reviewed to ensure adequate cooling air was available to the room. Finally, external flood protection design features, and procedures were reviewed to ensure the EDG, and associated equipment would operate during design flood conditions.

b. Findings

No findings of significance were identified.

.2.1.1 1 480V Screen House Engineered Safeguards Bus (1T)

a. Inspection Scope

The team inspected the 480V screen house engineered safeguards bus, 1T, to verify it was capable of performing its design basis function. The team reviewed load flow and short circuit current calculations to determine if the maximum load, interrupting duty, and bus bracing requirements were within the load center equipment vendor ratings and were in conformance with design basis. The team also reviewed the coordination/protection calculation for the incoming line, bus tie and feeder breaker Amptector trip settings to ensure the protection scheme was evaluated for design basis load flow conditions.

Walkdowns at the 480V load center were performed to assess the material condition and to determine if seismic II/I issues existed. Also, the team reviewed transformer cooling fan operation to determine if it would satisfy design basis load requirements. Issue reports and corrective maintenance history for issues affecting reliability were reviewed to ensure deficiencies were properly evaluated and corrected. Finally, the team reviewed surveillance test results of the Amptector trip units on 1T 480V screen house engineered safeguards bus incoming line breaker, cross-tie breaker and the IB screen house engineered safeguards control center breaker to verify they were set in accordance with design basis assumptions.

b. Findings

No findings of significance were identified.

.2.1.1 2 1B Engineering Safeguards Valves (ESV) 480V Motor Control Center (MCC)

a. Inspection Scope

The team inspected the 1B ESV 480V MCC to verify it was capable of performing its design basis function. The team reviewed load flow and short circuit current calculations to determine if the maximum load, interrupting duty, and bus bracing requirements were within the MCC equipment vendor ratings and were in conformance with the design basis. The team also reviewed the coordination/protection calculation for the incoming line and MCC feeder breaker Amptector trip settings for design basis load flow conditions. Walkdowns at the MCC and load center 1S were performed to assess the material condition and to identify if seismic II/I issues existed. The team also verified voltage and current readings on the load center bus instrumentation were within expected bands. Also, the team reviewed condition issue reports and corrective maintenance history to determine if deficiencies were being properly evaluated and corrected. Finally, the team reviewed surveillance test results of the Amptector trip units 1S 480V engineered safeguards bus unit 4C and the feeder breaker of the 1B ESV MCC, to verify they were set in accordance with design basis assumptions.

b. Findings

Introduction:

The team identified a Green NCV of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, Drawings, involving the failure to include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Specifically, the team identified that maintenance and testing procedure E-5.2, Westinghouse 480 Volt DB-50 Circuit Breaker Maintenance and Testing, did not ensure that design basis requirements for breaker coordination were in place.

Description:

The team reviewed Exelons breaker coordination study, Calculation C-1101-733-5350-003, TMI-1 Class 1E 480V Unit Substations Settings for Conversion to Solid State Trip Units. The team found the coordination study required that there be no instantaneous trips for the safety-related load center incoming line, bus-tie and MCC feeder breakers to ensure acceptable coordination with downstream breakers during fault conditions. Breaker coordination is also required to satisfy Exelons System Design Description SDD 772-A, TMI-1 Nuclear Generating Station Electrical Cable and Raceway Routing, Section 4.3, Electrical Isolation, which requires that non-Class 1E circuits be analyzed to demonstrate that operation of Class 1E circuits are not degraded below an acceptable level due to transients or faults on the non-Class 1E side. In order to disable the instantaneous trip feature, the breaker Amptector discriminator circuit must either be bypassed with a jumper or the load current must exceed a minimum threshold current (3% of sensor rating) prior to the fault condition. The team determined that Exelon designed the system so that the subject breakers were to have jumpers installed to disable the Amptector discriminator circuit.

While reviewing testing results for the 1T 480V Screen House Bus cross-tie breaker, the team observed that the Amptector discriminator was tested satisfactorily. The team questioned how the discriminator circuit function could have been tested if it had been disabled as required by the coordination study and maintenance and testing procedure E-5.2. Exelon investigated the discrepancy and determined the 1T bus cross-tie breaker Amptector discriminator jumper was not installed. Additionally, Exelon identified three other breakers, including the 1B ESV MCC feeder breaker, which did not have jumpers installed as required on the Amptector discriminator and, therefore, the discriminator function was not disabled.

Exelon performed an operability assessment for the deficient breaker installations. They concluded the bus-tie breaker was normally open so there was no operability concern and the other load center breakers remained operable without the jumper installed because the Amptector discriminator was functionally bypassed due to the loading on the bus exceeding the 3% sensor current. The team agreed with the assessment except for the 1S load center breaker unit 4C, breaker EE-MCC-ESV-1B-BK. The team determined that to meet required loading levels, non-safety-related loads on the MCC were required to be energized in order to disable the Amptector discriminator function. The team concluded that the electrical isolation provided for the postulated fault condition, with the subject Amptector discriminator function not being jumpered, could satisfy the requirements of SDD 772A for electrical isolation of non-Class 1E circuits only when Exelon credited non-safety-related equipment for the operability of safety-related equipment. Therefore, the team concluded that the breaker was non-conforming because the non-safety-related equipment cannot be credited to ensure the operability of safety-related equipment. However, the team agreed with Exelons assessment of operability for the subject breakers because Exelon implemented compensatory measures to ensure that sufficient load current was maintained on the breaker in order to disable the Amptector discriminator function. Additionally, Exelon planned to install the missing jumper during the next scheduled breaker maintenance and to correct the maintenance and operating procedures.

Analysis:

The team determined that the licensees failure to include appropriate quantitative or qualitative acceptance criteria in maintenance and testing procedure E-5.2 to disable the Amptector discriminator circuits by installing jumpers when required was performance deficiency. This finding was more than minor because it affected the design control attribute of the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and was similar to the more than minor example 4.l in IMC 0612 Appendix E. Specifically, the 1B ESV MCC would be incapable of meeting the design basis function when required if the feeder breaker to the MCC were to trip due to lack of coordination for a fault on a non-Class 1E circuit on the MCC during a design basis event. The team evaluated the finding in accordance with IMC 0609, SDP, 0609.04, Phase 1 - Initial Screening and Characterization of findings, Table 4a for the mitigating systems cornerstone. The finding was determined to be of very low safety significance (Green) because it was determined to be a deficiency that did not result in actual loss of single train or system safety function, and was not risk significant due to seismic, flooding or severe weather initiating events. This finding has a cross-cutting aspect in the area of Human Performance, Resources because the licensee did not ensure that personnel, equipment, procedures, and other resources were available and adequate to assure nuclear safety. Specifically, those necessary to ensure procedures are complete, accurate and up-to-date. (H.2(c)).

Enforcement:

10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, Drawings requires, in part, that activities affecting quality be prescribed by and accomplished in accordance with documented instructions and procedures. It further states that instructions, procedures and drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Contrary to the above after October 10, 2007, Exelon did not establish adequate procedures to maintain plant equipment in correlation with design documentation resulting in three load center breakers not having the required bypass jumpers installed in the Amptector discriminator circuit. However, because this violation was of very low safety significance and since it was entered in the licensees corrective action program (AR 928439928439 AR 929080929080 AR 929073929073 and AR 929068929068, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy.

(NCV 05000289/ 2009006-03, Failure to Install Amptector Bypass Jumper for Load Center Breaker)

.2.1.1 3 4160V Engineered Safeguards Bus (1D)

a. Inspection Scope

The team inspected the 1D 4160V engineered safeguards bus to verify it was capable of performing its design basis function. The team reviewed load flow and short circuit current calculations to determine if the maximum load, momentary and interrupting duty, and bus bracing requirements were within the switchgear equipment vendor ratings and in accordance with the design basis. The team also reviewed design basis inputs for conservatism, confirmed the use of maximum switchyard voltage for short circuit calculations, and reviewed vendor equipment data for adequate margin for breaker momentary and interrupting duty. The team confirmed the calculated minimum voltage (for degraded grid conditions) and short circuit current (for maximum switchyard voltage)were based on the switchyard voltage schedule operating limits. The team reviewed surveillance test results on degraded voltage relays, loss of voltage relays and degraded grid timing relays to ensure acceptance criteria were met. The team also confirmed degraded voltage relay field settings were in accordance with design basis calculations.

The team reviewed preventive maintenance packages completed on selected breakers including results of inspections/tests. Additionally, component replacement records and issue reports on bus equipment were reviewed to verify issues identified were properly evaluated and corrected. Finally, the team performed a walkdown of the 4160V switchgear to assess the material condition of the equipment.

b. Findings

No findings of significance were identified.

.2.1.1 4 Auxiliary Transformer (1B)

a. Inspection Scope

The team inspected the 1B auxiliary transformer to verify it was capable of performing its design basis function. The team reviewed one line diagrams, transformer nameplate and vendor test results for impedance data, and the electrical impedance model calculation to confirm that correct transformer impedances were utilized. A walkdown of the transformer overcurrent protective relays was performed to observe settings and to determine conformance with relay setting assumptions in the design basis documents.

The team confirmed the adequacy of the overcurrent relay settings for design basis loading requirements. Also, the team reviewed lightning arrestor condition monitoring and trending, transformer bushing condition monitoring and trending, and the transformer and auxiliarys preventive maintenance condition monitoring and trending for adverse conditions that could affect reliability. The team reviewed the modification history of the transformer for potential impact on the design basis. A team walkdown of the transformer was performed to assess material condition and to confirm that selected wiring and electrical protective devices inside the transformer control cabinet were installed in accordance with vendor drawings. The team also reviewed the corrective maintenance history and issue reports for issues affecting reliability to verify they were properly evaluated and corrected.

b. Findings

No findings of significance were identified.

.2.2 Detailed Operator Action Reviews (5 samples)

The team assessed manual operator actions and selected a sample of five operator actions for detailed review based upon risk significance, time urgency, and factors affecting the likelihood of human error. The operator actions were selected from a PRA ranking of operator action importance based on RAW and RRW values. The non-PRA considerations in the selection process included the following factors:

$

Margin between the time needed to complete the actions and the time available prior to adverse reactor consequences;

$

Complexity of the actions;

$

Reliability and/or redundancy of components associated with the actions;

$

Extent of actions to be performed outside of the control room;

$

Procedural guidance to the operators; and

$

Amount of relevant operator training conducted.

.2.2.1 Operators Cooldown with Once Through Steam Generator Atmospheric Dump Valves

from the Control Room

a. Inspection Scope

The team inspected the operator actions associated with initiating cooldown and achieving required conditions for once through steam generator (OTSG) isolation given an OTSG tube rupture scenario. The team reviewed Exelons Human Reliability Analysis (HRA) to determine when and how quickly the cooldown and isolation should be accomplished. The team reviewed applicable emergency operations procedures (EOPs) and operating procedure 1102-11, Plant Cooldown, to verify that the procedure cues were as described in the HRA. Additionally, the team interviewed the plant operating staff to understand the timeline for operator actions and the success criteria basis. The team verified that Exelon had recently time validated simulator scenarios as described in the HRA. Finally, the team verified that Exelon completed corrective actions regarding previously identified deficiencies in ensuring the capability of local manual valve operations credited in the PRA, such as locally operating the atmospheric dump valves manual handwheels.

b. Findings

No findings of significance were identified.

.2.2.2 Operators Restart a Nuclear Services River Water Pump Following a Loss of Offsite

Power and Without an Engineered Safeguards Actuation Signal

a. Inspection Scope

The team inspected the operator action to restart a nuclear services river water (NSRW)pump following a loss-of-offsite power (LOOP) without an engineered safeguards actuation system (ESAS) signal. This unique scenario requires operators to manually restart NR-P-1A from the control room to restore reactor coolant pump (RCP) seal cooling. The team determined that the annunciator cues for the operator were limited and appropriately not credited in the HRA. The team observed operators respond to this scenario in a simulator session to verify that NR-P-1A could be reliably started in sufficient time before RCP seals overheated. The team also walked down the equipment alignment of makeup and intermediate closed cooling water pumps to verify that Exelon was minimizing the probability of a total loss of RCP seal cooling during design basis events. Finally, the team reviewed the basis for the timeline established in the HRA and also verified that Exelon had taken corrective actions to revise loss of RCP seal cooling abnormal procedures consistent with recent Westinghouse (the RCP seal vendor) guidance.

b. Findings

No findings of significance were identified.

.2.2.3 Operators Initiate High Pressure Injection Cooling

a. Inspection Scope

The team inspected the operator actions to establish high pressure injection (HPI)cooling in response to a loss of secondary heat transfer. Due to the short timeframe required for operator action to ensure core cooling under all circumstances, the team observed operators respond to this event in a simulator scenario to verify that the immediate operator actions associated with a loss of subcooling margin and initiating HPI cooling were prompt and highly reliable. The team reviewed applicable EOPs to verify that the procedure cues were as described in the HRA. Finally, the team reviewed Exelons intended corrective actions to administratively control all manual actions credited in various aspects of plant operation, such as fire safe shutdown, the PRA, and design basis accidents to ensure planned actions adequately addressed identified deficiencies.

b. Findings

No findings of significance were identified.

.2.2.4 Operator Restarts Instrument Air Compressors IA-P-1A/B Following a LOOP with an

ESAS Signal Present

a. Inspection Scope

The team inspected the operator actions associated with starting standby emergency instrument air compressors (IAC) IA-P-1A and 1B to prevent a loss of instrument air event. The team interviewed system engineers and plant operations staff to verify that the IACs operation was as described in the HRA. The team also interviewed operators to verify they understood the necessary equipment operations to restart an IAC under the circumstances as described in the HRA and verified that associated abnormal operating procedures provided the necessary details to restart the IAC during the circumstances evaluated. The team also verified that IACs were routinely tested and reviewed recent surveillance test results to verify acceptable equipment operation.

Finally, the team verified that Exelon completed corrective actions regarding previous deficiencies to ensure the capability of local manual valve operations credited in the PRA, such as locally operating IC-V-3, IC-V-4 and MU-V-20, were completed.

b. Findings

No findings of significance were identified.

.2.2.5 Operator Bypasses Instrument Air Dryer Transfer Valve on Dryer failure

a. Inspection Scope

The team inspected the operator action to bypass the instrument air tower (IA-Q-1)during a dryer tower switching failure. The team verified that annunciator procedures provided adequate cues and procedure direction as credited in the HRA to allow operators to perform the bypass. The team observed an equipment operator walk through bypassing IA-Q-1 and interviewed the equipment operator regarding his expected response actions during a loss-of-instrument air event. The team verified that adequate preventive maintenance was performed on IA-Q-1 and reviewed the corrective action program database for recent issues with IA-Q-1 and its associated components.

b. Findings

No findings of significance were identified.

.2.3.1 NRC Information Notice (IN) 2004-001, Auxiliary Feedwater (AFW) Pump Recirculation

Line Orifice Fouling-Potential Common Cause Failure

a. Inspection Scope

The team reviewed Exelons disposition of IN 2004-001 - Auxiliary Feedwater (AFW)

Pump Recirculation Line Orifice Fouling-Potential Common Cause Failure. The IN discussed a recent industry event where it was discovered that the pressure reducing orifice in the AFW pump minimum flow line could be clogged by water-borne debris from the safety-related service water pumpage. The team reviewed the disposition of the IN as documented by Exelon in AR 00153393 and found that Exelon had concluded that the design was adequate and additional design modifications were not required. The team reviewed the evaluation which determined that the orifice would not clog from service water debris and determined that this OE was identified and handled appropriately.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems (IP 71152)

a. Inspection Scope

The team reviewed a sample of problems that Exelon had identified and entered into their corrective action program. The team reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions. In addition, corrective action documents written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action system. The specific corrective action documents that were sampled and reviewed by the team are listed in the attachment.

b. Findings

No findings of significance were identified.

4OA6 Meetings, including Exit

The team presented the inspection results to Mr. William Noll, Site Vice President, and other members of Exelon staff at an exit meeting on June 26, 2008. The team verified that none of the information in this report is proprietary.

ATTACHMENT

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

W. Noll

Site Vice President

W. Carsky

Director, Engineering

T. Dougherty

Plant Manager

T. Wickel

Design Engineering, Senior Manager

T. Alvey

Operations Staff, Manager

B. Young

Engineering Manager

P. Bennett

Mechanical Design, Manager

R. Ezzo

Electrical Design, Manager

W. McSorley

System Engineer

S. Sallade

Operations Staff

D. McGettrick

Engineering Response Team

K. Robles

System Engineer

R. Seigliez

Fire Protection Engineer

B. Smith

System Engineer

J. Bashista

System Engineer

M. Fitzwater

System Engineer

T. Flemming

System Engineer

K. Haisley

MOV Engineer

R. Masoero

System Engineer

M. Reed

System Engineer

LIST OF ITEMS

Opened and Closed

05000289/2009006-01 NCV Failure to Assess Seismic Qualification of Stop Logs

05000289/2009006-02 NCV Inadequate Decay Heat River Water Equipment

05000289/2009006-03 NCV

Failure to Install Amptector Bypass Jumper for Load Center Breaker