IR 05000483/2008008

IR 05000483-08-008; July 28 Through August 22, 2008; Callaway Plant: Baseline Inspection, NRC Inspection Procedure 71111.21, Component Design Basis Inspection

ML083400481
Person / Time
Site:	Callaway
Issue date:	12/05/2008
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Heflin A Union Electric Co
References
IR-08-008
Download: ML083400481 (44)

Text

ber 5, 2008

SUBJECT:

CALLAWAY PLANT - NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000483/2008008

Dear Mr. Heflin:

On August 22, 2008, the US Nuclear Regulatory Commission (NRC) completed a component design bases inspection at your Callaway Plant. The enclosed report documents our inspection findings. The preliminary findings were discussed on August 22, 2008, with Mr. F. Diya, and other members of your staff. After additional in-office inspection, a final exit meeting was conducted on October 21, 2008, with Messrs. M. McLaghlan and L. Graessie.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The team reviewed selected procedures and records, observed activities, and interviewed cognizant plant personnel.

Based on the results of this inspection, the NRC has identified three findings that were evaluated under the risk significance determination process. Violations were associated with all of the findings. All three of the findings were found to have very low safety significance (Green) and the violations associated with these findings are being treated as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any of the noncited violations, or the significance of the violations you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the US Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 East Lamar Blvd., Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, US Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Callaway Plant.

UNITED STATESNUCLEAR REGULATORY COMMISSIONREGION IV612 EAST LAMAR BLVD, SUITE 400ARLINGTON, TEXAS 76011-4125 Union Electric Company - 2 -

In accordance with Code of Federal Regulations, Title 10, Part 2.390 of the NRC's Rules of Practice, a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/ Thomas Farnholtz, Chief, Engineering Branch 1 Division of Reactor Safety Docket: 50 483 License: NPF 30

Enclosures:

NRC Inspection Report 05000483/2008008 w/attachment: Supplemental Information

REGION IV Docket: 50-483 License: NPF-30 Report Nos.: 05000483/2008008 Licensee: Ameren Electric Co.

Facility: Callaway Plant Location: Junction Highway CC and Highway O, Fulton, Missouri Dates: July 28 through August 22, 2008 Team Leader: R. Kopriva, Senior Reactor Inspector, Engineering Branch 1 Inspectors: J. Drake, Senior Reactor Inspector, Plant Support Branch 2 P. Gage, Senior Examiner, Operations Branch G. George, Reactor Inspector, Engineering Branch 1 W. Sifre, Senior Reactor Inspector, Engineering Branch 1 Accompanying Personnel: C. Baron, Mechanical Engineer, Beckman and Associates N. Della Greca, Electrical Engineer, Beckman and Associates Others: D. Loveless, Senior Reactor Analyst D. Reinert, PhD., Reactor Inspector, Engineering Branch 1 Approved By: Thomas Farnholtz, Acting Chief Engineering Branch 1 Division of Reactor Safety

- 2 -

SUMMARY OF FINDINGS

IR 05000483/2008008; July 28 through August 22, 2008; Callaway Plant: baseline inspection, NRC Inspection Procedure 71111.21, Component Design Basis Inspection.

The report covers an announced inspection by a team of five regional inspectors, two contractors and one inspector in training. Three findings were identified. All of the findings were of very low safety significance. The final significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation 10 CFR 50, Appendix B, Criterion III, "Design Control," for failure to verify the adequacy of design and for failure to correctly translate the 125 Vdc system design basis into instructions, procedures, and drawings. Specifically, the licensee failed to include momentary loads in the battery sizing calculation, thus reducing the peak load demand voltage during the first minute of an event, an intermediate scenario event, and the last minute of the battery duty cycle. Additionally, the licensee's subsequent review determined that the calculation had failed to include three additional momentary loads. The failure to include these loads prevented the licensee from developing a battery duty cycle profile that conforms to the guidance of IEEE 485-1983 and correctly simulates the battery loads following a design basis or station blackout event. The licensee entered this finding into their corrective action program as Callaway Action Request 200808609.

The failure to account for all loads, including momentary loads, in the battery design calculation was a performance deficiency because it prevented the licensee from correctly analyzing available voltage at safety-related components during the battery peak loading periods. The finding was more than minor because it is associated with the Design Control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of the safety-related battery systems to respond to initiating events and prevent undesirable consequences. Using the Manual Chapter 0609, Phase 1 screening worksheet, the issue screened as having very low safety significance because adequate margins had been included in the battery selection and, therefore, the issue was a design deficiency confirmed not to result in loss-of-operability in accordance with NRC Manual Chapter Part 9900, "Technical Guidance, Operability Determination Process for Operability and Functional Assessment." (Section 1R21.b.1).

Green.

The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for not verifying the adequacy of the design. Specifically, an incorrect pipe break location in the analysis for loss of the condensate storage tank feed to the auxiliary feedwater pumps caused the analysis to be non-conservative for the amount of water available to the auxiliary feedwater pumps. This error provided for more water to be available for use by the auxiliary feedwater pumps than would actually be available if the analysis had identified the correct location of the postulated pipe break. The licensee has entered this finding into their corrective action program as Callaway Action Request CAR 200808674.

The failure to meet design control requirements associated with the pipe break analysis with sufficient water to run the auxiliary feedwater pumps prior to switch over to the essential service water system is a performance deficiency. Per Manual Chapter 0612, Appendix E, Section 3, "Non-significant Dimensional, Time, Calculation, or Drawing Discrepancies," Example J, this finding is more than minor because the engineering calculation error resulted in a condition where there was a reasonable doubt on the operability of a system or component. Using Manual Chapter 0609, Significance Determination Process Phase 1 screening worksheet, the team determined that the finding was of very low safety significance. There was no actual loss of safety function and the new analysis demonstrated that the auxiliary feedwater pumps would have enough water available from the Condensate Storage Tank prior to switchover to the Essential Service Water system to complete their design function. (Section 1R21.b.2).

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawing" for the failure to follow Procedure APA-ZZ-00500, Appendix 1, Revision 6, "Operability Determination." The evaluation did not include the additional heat loading on equipment in the turbine driven auxiliary feedwater pump room, caused from an active steam leak from the turbine governor end case joint. The licensee had failed to include the additional steam leak heat load in either of the room temperature calculations M-GF-415 or BO -05, which were used in the operability determination. The heat input into the room, due to the steam leak, may have adversely affected the operation of the turbine digital speed control unit. The licensee has entered this finding into their corrective action program as Callaway Action Request 200808777.

The failure to either correct the active steam leak or to account for the leak in their design calculations, is a performance deficiency. Per Inspection Manual Chapter 0612, Appendix E, Section 3, "Non-significant Dimensional, Time, Calculation, or Drawing Discrepancies," Example J, this finding is more than minor because the licensee had not resolved the deficiency, resulting in a condition in which there was a reasonable doubt regarding the reliability of the turbine digital speed control unit. Using Inspection Manual Chapter 0609, "Significance Determination Process," Phase 1 screening worksheets, the team determined that the finding was of very low safety significance. Since there was no actual loss of safety function and the new analysis demonstrated that the maximum room temperature, including the additional heat load, would not exceed the design limit of digital turbine speed controls unit, the issue was a design deficiency confirmed not to result in loss of operability per NRC Manual Chapter Part 9900, "Technical Guidance, Operability Determination Process for Operability and Functional Assessment." The finding had crosscutting aspects in the area of human performance (decision making) because the licensee used non-conservative assumptions in decision making and failed to either repair the active steam leak, or to account for it in their design calculations. This activity was indicative of current performance as the steam leak still existed and had not been included in the design calculations until October 2008. [H.1 (b)] (Section 1R21.b.3).

B. Licensee-Identified Violations

.

None.

REPORT DETAILS

REACTOR SAFETY

Inspection of component design bases verifies the initial design and subsequent modifications and provides monitoring of the capability of the selected components and operator actions to perform their design bases functions. As plants age, their design bases may be difficult to determine and important design features may be altered or disabled during modifications. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Bases Inspection

The team selected risk-significant components and operator actions for review using information contained in the licensee's probabilistic risk assessment. In general, this included components and operator actions that had a risk achievement worth factor greater than two or a Birnbaum value greater than 1E-6.

a. Inspection Scope

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design bases and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For the review of operator actions, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design bases have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 20 to 30 risk-significant and low design margin components, 3 to 5 relatively high-risk operator actions, and 4 to 6 operating experience issues. The sample selection for this inspection was 21 components, 5 operator actions, and 6 operating experience items.

The components selected for review were:

Mechanical BM-HV-002, Steam Generator Blowdown Air-Operated Valve The team reviewed the Final Safety Analysis Report (FSAR), selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the air operated valve to perform its intended function during design basis events. The team reviewed design calculations to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations, including the required air pressure for valve operation. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis and performed a walkdown of the valve.

AB-PV-003, Main Steam Atmospheric Dump Air-Operated Valve The team reviewed the FSAR, selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the air operated valve to perform its intended function during design basis events. The team reviewed design calculations to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations, including the required air pressure for valve operation and the capacity of the nitrogen accumulator to operate the valve for the required duration. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis and performed a walkdown of the valve.

EJ-HV-8701B, RHR Hot Leg Isolation Motor Operated Valve The team reviewed the FSAR, Design Basis Document (DBD), selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the motor operated valve to perform its intended function during design basis events. The team reviewed Generic Letter 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance," calculations and requests for resolution to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations. The team reviewed the design and testing of the control interlocks and setpoints associated with the valve. The team reviewed electrical calculations to verify the appropriate voltage values were included in the valve calculations. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis. EJ-HV-8804A, RHR to Safety Injection Motor Operated Valve The team reviewed the FSAR, DBD, selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the motor operated valve to perform its intended function during design basis events. The team reviewed Generic Letter 89-10 calculations and requests for resolution to evaluate the capability of the valve to change position as required under the most limiting accident conditions. The team reviewed the calculations to verify that the most limiting system operating conditions were considered in the calculations. The team reviewed the design and testing of the control interlocks associated with the valve. The team reviewed electrical calculations to verify the appropriate voltage values were included in the valve calculations. The team also reviewed operating procedures related to the valve to ensure they were consistent with the design basis calculations and the licensing basis.

TAP-01, Condensate Storage Tank The team reviewed the FSAR, DBD, selected drawings, calculations, maintenance records, and operating procedures to verify the capability of the tank to perform its intended function during postulated station blackout events. The team reviewed various calculations to evaluate the inventory, instrument uncertainty, and capacity of the tank. The team reviewed the vortex limit and Net Positive Suction Head (NPSH) calculations for the auxiliary feedwater pumps. The team reviewed calculations to verify the amount of water that would be required for the postulated station blackout event. The team also reviewed operating procedures related to the tank to ensure they were consistent with the design basis.

Internal Flooding of Vital Electrical Areas The team reviewed the FSAR, DBD, selected drawings, calculations, and operating procedures to evaluate the potential internal flooding of plant areas containing safety related electrical equipment. This review addressed both postulated design basis floods and beyond design basis floods addressed by risk assessments. The team reviewed various flooding calculations for the safety related switchgear areas, emergency diesel generator rooms, and safety related battery areas. These calculations were based on postulated cracks or breaks of piping in those areas, and considered the leakage paths from the areas containing the safety related equipment. The team also performed walkdowns of these areas.

Emergency Service Water Pump "B" The team reviewed DBD's, including procedures, calculations, drawings, vendor manuals, inservice testing requirements, and accident analyses to verify that the pump is capable of meeting it's functional and design basis requirements. In addition, the team reviewed surveillance procedures, maintenance procedures, and the associated results of the surveillance and post maintenance tests to ensure that the pump would be operated and maintained within its design basis. Specifically, the team reviewed the emergency service water flow balance procedures and the corresponding calculation for flow balance acceptance criteria.

Emergency Service Water Valve, EFHY0060 The inspection team reviewed valve motor torque calculations, flow balance, condition reports, inservice testing results, and vendor manuals to assess whether the motor operated valve, EFHY0060, would be able to perform its design function in a design basis accident. Specifically, the team assessed whether design modifications to the valve were controlled within the original design basis and vendor specifications. Additionally, the team assessed whether any deviations from the original design basis or vendor specifications were controlled under applicable regulatory requirements. The team's review also included a walkdown of the emergency service water system.

Component Cooling Water Heat Exchanger "B" The team reviewed the DBD's, test and maintenance procedures, and calculations to ensure the component cooling water heat exchanger "B" would perform its design basis function. In addition to the test and maintenance procedures, the inspectors reviewed previous heat exchanger test results from 2003 to 2008, to ensure that the heat exchanger never exceeded the fouling factor and tube plugging limits. The team also reviewed results from the component cooling water heat exchanger inspections. The team's review of calculations included a review of the design basis heat load analysis and worst case tube plugging limits.

Auxiliary Feedwater Pump 2A Turbine Control System and Digital Control Panel (FC219).

The team reviewed the Qualification Report for the Turbine Control System Upgrade installed on Turbine Driven Auxiliary Feedwater Pump 2A. The control logic was reviewed and coupled to the potential spectrum of design basis events requiring pump operation. The team also reviewed seismic and environmental qualification of the controller. The team also reviewed IST data, testing data, surveillance test procedures, corrective action entries, and significant procedures that require operation of this pump.

Steam Generator Blowdown Isolation Valve BM-TV-00040. The team reviewed the Generic Letter 89-10 design basis calculation, which included design features of the motor, actuator and valve. The control logic was reviewed and coupled to the potential spectrum of design basis events requiring valve operation. Maximum opening and closing differential pressures, including the required opening and closing stroke times were reviewed. The team also reviewed Inservice Testing (IST) data, Valve Operation Test & Evaluation System (VOTES) testing data, surveillance test procedures, corrective action entries, and significant procedures that require operation of this valve.

Control Room Pressurization and Ventilation Isolation Logic The team reviewed the design basis calculations associated with control room habitability. The control and actuation logics for both the Control Room Air Conditioning System (CRACS) and Control Room Emergency Ventilation System (CREVS) were reviewed and coupled to the potential spectrum of design basis events requiring system actuation and interactions. The team reviewed system testing data, surveillance and operating procedures, and corrective action entries associated with the actuation logic circuits associated with the systems. The inspectors also verified system compliance with Regulatory Guides 1.52, "Criteria For Programmable Digital Computer System Software In Safety-Related Systems Of Nuclear Power Plants," 1.78, "An Approach For Plant-Specific Risk-Informed Decisionmaking For Inservice Inspection Of Piping," Revision 1, and Generic Letter (GL) 2003-01, "Control Room Habitability."

Electrical EDG Load/Voltage/Frequency The team inspected the electrical portions of the emergency diesel generator (EDG) and associated supply breaker to verify the adequacy of the equipment to respond to design basis events. The team reviewed diesel generator starting logic and output breaker control logic to verify the appropriate functionality was implemented. The team reviewed completed surveillances to verify that the technical specification requirements were met. The team reviewed protection/coordination and short-circuit calculations to verify the EDG was adequately protected by protective devices during test mode and emergency operation.

Additionally, the team reviewed calculations and technical evaluations to verify that: 1) steady-state and transient loading were within design capabilities; 2)adequate voltage would be present to start and operate connected loads; and 3)operation at maximum allowed frequency would be within the design capabilities. The review included determining the bases for brake horsepower loading values used, and verifying that design bases and design assumptions had been appropriately translated into the design calculations and procedures. The team reviewed the basis for the EDG load sequence time delay setpoints. The team reviewed the EDG feeder breaker maintenance and control voltage to verify that the components would function when required. Finally, the team performed a walk down of the emergency diesel generator and breaker to assess the installation configuration, material condition, and potential vulnerability to hazards.

Breakers 52NG0Y06 and 52NG0103 The team reviewed selected calculations for electrical distribution system load flow/voltage drop, short circuit, and electrical protection and coordination. The adequacy and appropriateness of design assumptions and calculations were reviewed to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. The Motor Control Center's (MCC's) protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst case short circuit conditions. The inspectors performed a visual non-intrusive inspection of observable portions of the load center to assess the installation configuration, material condition, and the potential vulnerability to hazards.

Safeguards Transformer "A" The team reviewed selected calculations for electrical distribution system load flow/voltage drop, short circuit, and electrical protection and coordination. The adequacy and appropriateness of design assumptions and calculations were reviewed to verify that bus capacity was not exceeded and bus voltages remained above minimum acceptable values under design basis conditions. The switchgear's protective device settings and breaker ratings were reviewed to ensure that selective coordination was adequate for protection of connected equipment during worst case short circuit conditions. The team reviewed the voltage protection scheme and the adequacy of instrumentation/alarms available. To ensure that breakers were maintained in accordance with industry and vendor recommendations, the team reviewed the preventive maintenance inspection and testing procedures. The 125Vdc voltage calculations were reviewed to determine if adequate voltage would be available for the breaker open/close coils and spring charging motors. The team performed a visual non-intrusive inspection of observable portions of the safety related 480Vac load center to assess the installation configuration, material condition, and the potential vulnerability to hazards. The team assessed the sizing, loading, protection, and voltage taps for Safeguards Transformer "A" to ensure adequate voltage to the 480V switchgear. The team reviewed the ampacity for the source and load side feeder cables as well as the protective device settings to ensure that the feeder cables and transformer was protected in accordance with industry standards. A review of the testing requirements, preventive maintenance, and instrumentation/alarms was performed. The team performed a visual non-intrusive inspection of observable portions of the transformer to assess the installation configuration, material condition, and potential vulnerability to hazards.

Safety-Related 125Vdc Station Battery NK11 and Inverter NN11 The team selected Station Battery NK11 and Inverter NN11 for their review. Inverter NN11, with a rating of 7.5 KVA, supplies power to the Channel I, safety-related instrumentation. The team conducted a design review of the components, including design capabilities, voltage drop calculations, list of related design changes, vendor manuals, maintenance history, testing criteria and results, and condition reports initiated during the last five years. The team interviewed system and design engineering personnel to gain an understanding of recent margin and performance issues and the overall reliability of the inverters. The team conducted a walkdown of the batteries and inverters to inspect their physical condition and to confirm that input and output voltages and currents were reasonable and corresponded to the values used in the battery sizing calculations.

Non-Safety-Related 125 Vdc Station Battery PK21 Battery PK12 is a non-safety related battery, but is risk significant because it provides the 125Vdc control power necessary for operation of circuit breakers and circuit interrupters required for realignment of the offsite power to the emergency bus following a loss of offsite power or station blackout event. Additionally, the battery provides DC power to various fire protection components. In selecting battery PK12, the team considered its potential failure and the resulting consequences for mitigating the above events. The team reviewed the battery sizing and voltage drop calculations to verify that the battery selected for the intended function would satisfy the requirements of the risk significant loads and that the minimum required voltage was taken into account. Specifically, the evaluation focused on verifying that the battery was adequately sized to supply its anticipated loads during and following a loss of coolant accident/loss of offsite power or station blackout scenarios, and that adequate voltage would remain available to the loads required to operate during and at the end of a postulated four-hour SBO coping duration. The review included a physical inspection of the battery and the associated battery charger. During the walkdown, the team visually inspected the battery for signs of inadequate maintenance or component degradation such as excessive terminal corrosion and electrolyte leaks. The team also confirmed that the battery charger supplied power at an acceptable voltage level to the battery and its loads. The team reviewed battery surveillance test results to confirm that the applicable test acceptance criteria and test frequency requirements specified for the battery were being met. The team also interviewed responsible design and system engineers regarding design aspects of the system and operating history for the battery.

Selected Operator Actions:

• Loss of class 1E 125 Vdc bus (NK01) and pressurizer steam space leak.

• Loss of instrument air and failure of 'B' Power Operated Relief Valve (PORV) to open.

• Inadvertent Safety Injection (SI) with failure of automatic reactor trip and feedwater break.

• Loss of All Alternating Current (AC), natural circulation cooldown.

• Steam Generator Tube Rupture (SGTR) with failure of affected Main Steam Isolation Valve (MSIV) to close.

Review of Industry Operating Experience and Generic Issues NRC Information Notice 94-24, Inadequate Maintenance of Interruptible Power Supplies and Inverters.

This review addressed the adequacy of Callaway maintenance activities related to the safety-related inverters to ensure that such activities did not negatively impact the reliability of the inverters themselves and the availability of AC power to safety-related instrumentation during a design basis event or a station blackout.

NRC Information Notice 94-80, Inadequate DC Ground Detection in Direct Current Distribution Systems.

This review evaluated the 125 Vdc ground detection system at Callaway to ensure that it was sufficiently sensitive to prevent a failure of the system during a design basis event or a station blackout.

NRC Information Notice 2006-26: Failure of Magnesium Rotors in MOV Actuators The inspectors reviewed the applicability/actions taken by Callaway to address IN 2006-26, which discussed three recent examples of Motor Operated Valve (MOV) failures due to magnesium rotor degradation, described three failure modes, and provided references for potential corrective and preventive actions to address the degradation mechanisms.

The inspectors noted that Callaway identified which MOV's in the plant have magnesium rotors that meet the criteria identified in IN 2006-26. The inspectors reviewed Callaway's MOV program to address inspections for magnesium rotor degradation for the high risk MOV's.

NRC Information Notice 2006-31: Inadequate Fault Interrupting Rating of Breakers The team reviewed the applicability/actions taken by Callaway to address IN 2006-31, which addressed concerns of inadequate fault interrupting rating of breakers. Callaway electrical calculations show that the postulated worst-case fault currents are within the breaker, switchgear, and bus bracing ratings.

NRC Generic Letter 2006-02 Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power The team reviewed the applicability/actions taken by Callaway to address GL 2006-02, which discussed the use of protocols between the nuclear power plant and the transmission system operator and the use of transmission load flow tools in monitoring grid conditions to determine the operability of offsite power systems under plant technical specifications. The team reviewed Callaway procedures for operation and maintenance of switchyard equipment identified in response to GL-2006-02.

NRC Generic Letter 2003-01 Control Room Habitability The team reviewed the applicability/actions taken by Callaway to address GL 2003-01, which addressed concerns of control room habitability. The team reviewed the licensee's response to the generic letter and verified that the licensee's control room habitability systems were designed, constructed, configured, operated and maintained in accordance with the design and licensing basis.

1. Safety-Related 125 Vdc Station Battery NK11 Inadequate Battery Sizing Calculation

a. Inspection Scope

The team reviewed the design and testing documents of the safety-related, Division I, 125 Volt direct current (Vdc) battery NK11 to verify that it was adequately designed and tested, and that it was capable of performing its required safety functions. The team reviewed the battery sizing calculation to confirm that the duty cycle of the battery was adequately addressed and that the selected battery size took into account component aging and performance at minimum ambient and electrolyte temperature. The team also reviewed voltage drop calculations to confirm that cable sizes and temperatures were adequately evaluated and that the components minimum voltage requirements were being adequately met under worst battery loading conditions. In addition, the team reviewed short circuit calculations to confirm that distribution equipment was adequately protected and capable of withstanding calculated maximum short circuits.

The team reviewed electrical schematics to evaluate loads supplied by the battery and to confirm that selected loads had been included in the battery sizing and voltage drop calculations. The team also verified that the system included a ground detection system and that the alarm setpoint was sufficiently low to ensure proper protection of the battery from unwanted grounding under design basis events. The system review included an evaluation of the circuit protection provided and, for selected circuits, confirmed that adequate coordination existed between the downstream and the upstream fuses. The team also verified that adequate float and equalizing charging voltages were being provided to the battery and that the battery tests required by the technical specification (TS), including service and performance discharge tests, were being performed at the TS required frequency and met the TS specified acceptance criteria. The system undervoltage relay setpoint and the calibration procedure were also reviewed.

The team conducted detailed walkdowns of the battery and associated components to determine their physical/material condition and to confirm that the battery and charger room temperatures were within specified design temperature ranges. During the walkdowns, the team visually inspected the battery for signs of degradation such as excessive terminal corrosion and electrolyte leaks and confirmed that the battery float voltage was at the recommended level.

b. Findings

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for an inadequate battery sizing calculation. The calculation assumed that momentary loads would have insignificant impact on the battery size. Therefore, they were specifically ignored. The inclusion of momentary loads is required to ensure that the battery is capable of providing adequate voltage to all components during battery peak loading conditions, including when momentary loads are being applied to the battery. In response to the team's concerns, the licensee evaluated the impact of their failure to include the momentary loads and confirmed that the size of the battery was adequate and that the minimum voltage during peak loading remained within acceptable range.

Description.

The size of the battery is determined by reviewing the loads it is required to carry during the period for which it is required to perform its safety function, duty cycle, and verifying that the minimum design voltage under peak loading conditions remained within acceptable limits. In their evaluation of the battery loads, the licensee elected not to include momentary loads, such as breaker trip coils and motor starting inrush currents.

Following a loss of offsite power, in anticipation for emergency diesel generator (EDG) load sequencing, many breakers are concurrently tripped. When the EDG reaches proper voltage and frequency, loads are added to the EDG at a predetermined sequence, by closing the associated breakers. Closure of a breaker is followed by the starting of the spring charging motor to get the breaker ready for a subsequent trip and automatic closure, if necessary. Both the trip coil and motor starting inrush current are of very short duration and have minimal impact on the selection of the battery size. However, the combined effect of all the trip coils on the selected battery during the very brief period when all breakers are automatically tripped could be sufficient to lower the voltage to a level that could prevent some breakers from tripping. Similarly, during the motor starting inrush period, the voltage could drop sufficiently to prevent a relay from energizing or cause a relay to drop out on low voltage.

Regarding momentary loads, IEEE Standard 485-1983, to which the licensee is committed, states that, "Although momentary loads may exist for only a fraction of a second, each is considered to exist for a full minute because the instantaneous battery voltage drop for a given momentary load is essentially the same as the voltage drop after 1 minute. When several momentary loads occur within the same 1 minute period and a discrete sequence cannot be established, the load shall be assumed to be the sum of all the momentary loads occurring within that minute. If a discrete sequence can be established, the load for 1 minute period shall be assumed to be the maximum current at any instant." This battery loading analysis represents the battery duty cycle that is then used to select the size of the battery necessary to supply quality voltage to all its loads throughout the duty cycle. As indicated previously, the battery duty cycle calculated by the licensee prior to the inspection did not include momentary loads at the beginning of the test. The loads imposed on the battery were much higher than postulated, and the licensee could not assure that adequate voltage would be available to its loads during peak loading.

As a result of the team's questions, the licensee did confirm that the battery size had adequate margin to accommodate the additional momentary loads and that the minimum voltage derived from the battery performance curves was sufficient to supply adequate voltage to all the loads during peak loading. During this review, the licensee also observed that the load list did not include three additional shunt trips. The licensee issued Callaway Action Request (CAR) 200808609 to address these deficiencies.

Analysis.

The failure to account for all loads, including momentary loads in the battery design calculation, was a performance deficiency because it prevented the licensee from correctly analyzing available voltage at safety-related components during the battery peak loading periods. This finding was more than minor because it affected the mitigating system cornerstone objective (design control attribute) to ensure the reliability and capability of the equipment needed to mitigate initiating events. The team used the Manual Chapter 0609, "Significance Determination Process," Phase 1 screening worksheet and determined that the finding screened as having very low safety significance because adequate margins had been included in the battery selection and, therefore, the issue was a design deficiency confirmed not to result in loss-of-operability in accordance with NRC Manual Chapter Part 9900, "Technical Guidance, Operability Determination Process for Operability and Functional Assessment."

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for verifying the adequacy of design. These measures may include calculations. The licensee used Calculation NK-05 to calculate the duty cycle and size of the Division I, safety-related Battery NK11. Contrary to the above, as of August 22, 2008, the design control measures for calculating the size and duty cycle of the NK11 battery were inadequate, in that Calculation NK-05 failed to include momentary loads and failed to include three additional safety-related breaker shunt trips also powered by the battery. Because the violation is of very low safety significance and has been entered into the licensee's corrective action program as CAR 200808609, this violation is being treated as a non-cited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy:

NCV 05000483/2008008-01, Safety-Related 125 Vdc Station Battery NK11 Inadequate Battery Sizing Calculation.

2. Non-conservative Pipe Break Location for the Condensate Storage Tank Supply to Auxiliary Feedwater Pumps.

a. Inspection Scope

The inspection team reviewed uncertainty calculations, vendor manuals, drawings, and walkdowns of the condensate storage tank and auxiliary feedwater systems. The team reviewed the calculation to determine the pressure setpoint for automatic switchover from the condensate storage tank to the essential service water suction supply. The team reviewed the corresponding emergency diesel generator loading sequence of the components necessary to complete the automatic switchover. In addition, the team reviewed the operability assessment of the turbine driven auxiliary feedwater pump after a concurrent loss-of-off-site power and safe shutdown earthquake.

b. Findings

Introduction.

The inspection team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for failure to verify the adequacy of the design for turbine driven auxiliary feedwater pump operability. Specifically, the licensee used a non-conservative pipe break location in a calculation to model the effects of a design basis earthquake on the non-seismic portion of the condensate storage tank and auxiliary feedwater suction piping.

Description.

The team reviewed the licensee's Request for Resolution (RFR) 14020, "Operability of Turbine Drive Auxiliary Feedwater Pump after Safe Shutdown Earthquake and Loss of Offsite Power." This RFR was based on a 1997 concern which questioned the operability of the turbine driven auxiliary feedwater pump following a seismic event that results in both the loss of the non-seismically designed condensate storage tank and the electrical switchyard.

In an external seismic event with concurrent loss-of-offsite-power scenario, the non-safety related condensate storage tank, the primary source to the auxiliary feedwater system, may be unavailable. Twelve seconds after the event, when diesel generators are at necessary speed, the auxiliary feedwater pump suction header will begin to isolate from the condensate storage tank on low header pressure, using motor operated valves. Concurrently, with the condensate storage tank isolation, the emergency service water system, the secondary source to the auxiliary feedwater system, will begin to align to the auxiliary feedwater suction header.

During this swap over sequence, the emergency service water pumps are idle and the turbine driven auxiliary feedwater pump is running. The original concern was that during this swap over period, the turbine driven auxiliary feedwater pump would operate for 20 seconds without an adequate suction supply until the emergency service water pumps would start, 32 seconds after the event.

To resolve the concern, the licensee issued Revision B of RFR 14020 in October 1997. Assuming a failure of the condensate storage tank, this evaluation determined the volume of water necessary, during the swap over period, for the demand of the turbine driven auxiliary feedwater pump. This volume was 67 gallons. The evaluation also determined the volume of water in the seismic Category 1 sections of the auxiliary feedwater suction piping that would be available to feed the turbine driven pump. This volume was 97 gallons. Additionally, the licensee modified the steam admission valve to the turbine driven auxiliary feedwater pump to open coincident with the emergency diesel generator loading.

The team reviewed RFR 14020, Revision B, noting that the licensee assumed that a pipe break would occur at the non-seismically designed nozzle of the condensate storage tank. The elevation of this break location is 2001 feet. The team determined this break location was not conservative because the non-seismically designed section of the auxiliary feedwater piping begins at a lower elevation of 1991 feet. The team determined a pipe break at the unprotected portion of the lower elevation pipe location would render water volume, credited in RFR 14020, unusable.

In response to the team's concerns, the licensee entered the non-conservative condition into the corrective action system as CAR 200808674. The licensee engineering staff promptly performed an analysis to determine the effects of the pipe break at lower elevations. Since the emergency service water pumps are idle for 32 seconds in this scenario, the analysis included the effects of no pressure and subsequent system drain-down in the emergency service water system when aligned to the auxiliary feedwater system for 20 seconds.

The licensee's analysis determined that by taking a pipe break at the lower elevation, 1991 feet, the credited water volume in the seismically designed sections of the auxiliary feedwater piping would be lost upstream of the condensate storage supply line check valve, which is at an elevation of 2003 feet. This lowered the usable volume of water to 81 gallons. The licensee determined that the turbine driven auxiliary feedwater pump would remain functional for the 20 second pump run because the idle emergency service water system equilibrium water column level provided an adequate net positive suction head.

Analysis.

The inspection team determined the licensee's failure to verify the adequacy of the design for turbine driven auxiliary feedwater pump operability is a performance deficiency because the licensee failed to meet 10 CFR Part 50, Appendix B, Criterion III, "Design Control." The finding is more than minor because the calculation error resulted in a condition where there was reasonable doubt in the turbine driven auxiliary feedwater pump to perform its design function. Using Phase 1 worksheet of NRC Manual Chapter 0609, "Significance Determination Process," this finding is determined to have very low safety significance (Green) because there was no actual loss of safety function.

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion III, "Design Control," requires, in part, that measures be established for verifying the adequacy of design. These measures may include seismic calculations on safety-related and non safety-related pipe break analysis. Contrary to this, between October 1997 and October 2008, the licensee failed to verify the adequacy of the design for turbine driven auxiliary feedwater pump operability. Specifically, the licensee used a non-conservative pipe break location in a calculation to model the effects of a design basis earthquake on the non-seismic portion of the condensate storage tank and auxiliary feedwater suction piping. Because this finding is of very low safety significance and has been entered in the licensee's corrective action program as CAR 200808674, this violation is being treated as a NCV consistent with Section VI.A of the NRC Enforcement Policy. NCV 05000483/2008008-02, Non-conservative Pipe Break Location for the Condensate Storage Tank Supply to Auxiliary Feedwater Pumps.

3. Auxiliary Feedwater Turbine Digital Control Panel (FC219)

a. Inspection Scope

The team reviewed turbine driven auxiliary feedwater pump room temperature calculations to determine whether the digital control panel would remain within its environmental design limits during accident conditions. The team reviewed corrective action documents to determine if there were any adverse operating trends. The team performed a visual inspection of the turbine driven auxiliary feedwater pump room to assess equipment and environmental conditions. In addition, the team interviewed licensee engineering and operations personnel regarding the qualification of the turbine digital controls, observations during routine pump surveillance testing, and compensatory administrative controls for monitoring room temperatures.

b. Findings

Introduction.

The team identified a Green, non-cited violation of 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings." Specifically, the team identified that the licensee had failed to follow Procedure APA-ZZ-00500, Appendix 1, Revision 6, "Operability and Functionality Determinations." The evaluation did not include the additional heat loading on equipment in the turbine driven auxiliary feedwater pump room, caused from an active steam leak from the turbine governor end case joint. The licensee had failed to include the additional steam leak heat load in either of the room temperature calculations M-GF-415 or BO-05, which were used in the operability determination.

Description.

In 2001, an active steam leak from the turbine governor end case joint was identified, and the gland casing was repaired during a turbine overhaul during refuel outage 13. The steam leak reappeared in 2004. The licensee issued CAR 200400798 and performed an operability determination of the steam leak. The leakage was considered acceptable until a repair could be performed during refuel outage 14. The team determined that the operability determination contained no quantitative justification for the acceptance of the added heat load attributed to the steam leak. The gland casing was replaced during refuel outage 14, however, the steam leak reappeared soon thereafter. The condition was left uncorrected through refuel outage 15. The justification for the acceptance of this degraded condition was based upon the previous operability determination documented in CAR 200400798. The licensee recognized that the leak would worsen with increased usage of the turbine, so in 2004, to limit the rate of degradation, the frequency of the turbine driven auxiliary feedwater pump surveillance was changed from a monthly surveillance to a quarterly surveillance test.

In the operability determination, Calculations M-GF-415, "Temperature of Callaway Turbine-Driven Auxiliary Feedwater Pump Room" and BO-05, "Station Blackout Room Temperature" were performed to evaluate the turbine driven auxiliary feedwater pump room (Room 1331) temperature under normal and emergency operating conditions.

FSAR 16.7.4.1, "Area Temperature Monitoring," states that the maximum allowable temperature in Room 1331 is 147°F. The maximum room temperature during a Station Blackout event as calculated in BO-05, Addendum 14, is 143.6°F. This calculation included heat loads from the turbine driven auxiliary feedwater pump, main and auxiliary steam piping, and room lighting, but did not consider the added heat load due to an active steam leak from the governor end case joint outboard gland casing. The team noted there was no documentation to support the ability of the digital turbine control unit to perform it's safety function should the room temperature exceed 147°F.

The licensee cited previous operational data in which the room temperature increases were very minor in relation to the maximum room temperature limit of 147°F. This data was collected during routine turbine driven auxiliary feedwater pump surveillance and testing. However, in each of these instances, the room temperature increase was substantially mitigated by the non-safety related ventilation system in Room 1331. During an accident condition the room ventilation would be assumed unavailable.

In response to the team's concerns, the licensee performed a prompt operability determination and calculated that the maximum room temperature, including the additional heat load from the steam leak, would not exceed the 147°F design limit. The licensee entered this issue in their corrective action program as CAR 200808777.

Analysis.

The licensee's failure to either correct the active steam leak or to account for the leak in their design calculations, is a performance deficiency. Per Inspection Manual Chapter 0612, Appendix E, Section 3, "Non-significant Dimensional, Time, Calculation, or Drawing Discrepancies," Example J, this finding is more than minor because the licensee had not resolved the deficiency, resulting in a condition in which there was a reasonable doubt regarding the operability and reliability of the turbine digital speed control unit. The team screened the finding using the Inspection Manual Chapter 0609, "Significance Determination Process" Phase 1 worksheets. The finding screened as having very low safety significance (Green) because the subsequent analysis verified that there was no loss of operability or functionality. The finding had crosscutting aspects in the area of human performance (decision making) because the licensee used non-conservative assumptions in decision making in assessing whether to either correct the active steam leak or to include the steam leak heat input into design calculations M -

GF-415 and BO-05. This activity was indicative of current performance as the steam leak still existed and had not been included in the design calculations until October 2008. [H.1 (b)]

Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," requires in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Contrary to the above, in the spring of 2004 and fall of 2005, the licensee failed to follow the requirements of Procedure APA-ZZ-00500, Appendix 1, Revision 6, "Operability and Functionality Determinations," step 4.2, "Scope of Prompt Operability Determinations." The licensee did not assure that the operability requirements for the system, structure and component encompass all necessary support systems (per the TS definition of operability) regardless of whether the TS explicitly specify operability requirements for the support functions. Specifically, an active steam leak within the turbine driven auxiliary pump room had not been included in calculations M-GF-415 and BO-05, used in the Operability Determination, which evaluated the turbine driven auxiliary feedwater pump room (Room 1331) temperature under normal and emergency operating conditions. However, because the finding is of very low safety significance and the licensee entered this issue into their corrective action program as CAR 200808777, this finding is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy. NCV 05000483/2008008-03, Auxiliary Feedwater Turbine Digital Control Panel (FC219).

4. Adequacy of the NK11 Battery Service Test.

Introduction:

The team identified an unresolved issue (URI) related to the service testing of the safety-related NK11 and NK14 batteries.

Description:

Surveillance Requirement 3.8.4.7 of the Callaway TS requires that every 18 months the licensee, "verify that the battery capacity is adequate to supply, and maintain in OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test." The service test to which the NK11 and NK14 safety related batteries are subjected at the required 18-month frequency was described in Callaway test procedures MSE-NK-QB011 and MSE-NK-QB014, respectively. The team's review of these procedures determined that the service test loading requirements and durations were included in Section 3.1 of the procedures, as part of the acceptance criteria for battery service test (duty cycle) and that these requirements corresponded to those specified in Table 8.3-2 of the FSAR, "125 V DC Class IE Battery Loading Cycle (Amperes Required per Time Interval per Battery after Loss of AC Power) Subsystems 1 and 4." The latest revision of Table 8.3-2 was dated March 2003. The team also observed that the 200-minute duration for the duty cycle, contained in the FSAR table and the test procedure, was not consistent with another section of the FSAR. In fact, in Table 8.3A-1, as a result of their station blackout coping analysis, the licensee concluded that Callaway was a four-hour or a 240-minute plant. This statement implies that the battery must be proven to be capable of providing adequate voltage to the station blackout loads for the entire coping duration, 240 minutes, and have sufficient capacity to allow restoration of the normal AC power sources at the end of the 240-minute coping period.

The licensee recognized the need to demonstrate such capability and in Note 2 of Table 8.3-2 stated that "The 200 minute duty cycle is the design load cycle for the batteries. The batteries have been analyzed for a 240 minute loading cycle to support the Station Blackout coping analysis." The team's review of the battery sizing calculation determined that the licensee did evaluate the capability of the selected batteries to support the 240 minute loading cycle during the station blackout, albeit the licensee made no distinction between LOCA/LOOP and SBO loads. The importance of the service (duty cycle) test is to confirm that, given the plant specific duty cycle loading, the battery is capable of supplying adequate voltage to the loads for the duration of the service life of the battery and to detect degradation of the system as the battery approaches the end of its service life. The team discussed their concern with the licensee who simply indicated that the 200 minute duty cycle in the test enveloped the 240 minute loading cycle calculated in NK-05. This item is unresolved pending further review by the NRC of the license requirements under the SBO rule and the licensee's revision of battery sizing calculation, NK-05.

URI 05000483/2008008-04, Adequacy of the NK11 Battery Service Test.

4OA2 Identification and Resolution of Problems

The team reviewed CARs associated with the selected components, operator actions and operating experience notifications. One issue was identified with respect to Identification of Problems. The licensee failed to identify an error in a operability determination, where they did not include the additional heat input from an active steam leak into design calculations used in the operability determination discussed in section 1R.21.b.3. No other issues were identified.

4OA6 Meetings, Including Exit

On August 22, 2008, the team leader presented the preliminary inspection results to Mr. F. Diya, Vice President, Nuclear, and other members of the licensee's staff. On September 24, 2008, the Engineering Branch 1 Chief conducted a telephonic exit meeting with Mr. D. Turley, Supervising Engineer, and other members of the licensee's staff discussing the unresolved issue, and on October 21, 2008, the team leader held a final exit with Mr. M. McLaghlan and Mr. L. Graessle.

No proprietary information was received or included in this report.

4OA7 Licensee Identified Violations

None.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Andreasen, Associate Engineer

D. Dickneite, Consulting Engineer

F. Diya, Vice President, Nuclear Operations

R. Farnam, Manager, Radiation Protection

E. Goss, Consulting Engineer

L. Graessle, Manager, Regulatory Affairs

M. Haag, Principal Engineer

M. Hudson, Consulting Engineer

J. Imhoff, Principal Engineer

W. Jessop, Manager, Business Operations

L. Kanuckel, Manager, Quality Assurance

D. Lantz, Superintendent, Nuclear Operations Training

J. Little, Consulting Engineer

S. Maglio, Assistant Manager, Regulatory Affairs

D. Martin, Supervising Engineer

M. McLaghlan, Manager, Engineering Services

K. Mills, Manager, Plant Engineering

D. Neterer, Plant Director

J. Norman, ESW Design Engineer

E. Olson, Superintendent, Performance Improvement

S. Petzel, Engineer, Regulatory Affairs

J. Pitts, Supervisor, Engineering Technical Support

S. Reed, Assistant Manager, Engineering Services

N. Smith, System Engineer

D. Stepanovic, Assistant Manager, Engineering

T. Szumski, Design Engineer

K. Tipton, System Engineer

D. Trokey, Regulatory Affairs Specialist, Regulatory Affairs

D. Turley, Supervising Engineer

E. Vaughn, Mechanical Design Engineer

R. Wilson, Consulting Engineer, Engineering Services

LIST OF ITEMS

OPENED AND CLOSED

Opened

05000483/2008008 04 URI Adequacy of the NK11 Battery Service Test. (Section 1R21.b.4.)

Opened and Closed

05000483/2008008 01 NCV Safety-Related 125 Vdc Station Battery NK11 Inadequate Battery Sizing Calculation (Section

1R21.b.1).

05000483/2008008 02 NCV Non-conservative Pipe Break Location for the Condensate Storage Tank Supply to Auxiliary Feedwater Pumps. (Section 1R21.b.2)

05000483/2008008 03 NCV Auxiliary Feedwater Turbine Digital Control Panel FC219. (Section 1R21.b.3)