IR 05000298/2005008

IR 05000298-05-008; 05/02-07/07/2005; Cooper Nuclear Station; Safety System Design and Performance Capability; and Evaluation of Changes, Tests, or Experiments

ML052340314
Person / Time
Site:	Cooper
Issue date:	08/19/2005
From:	O'Keefe N Division of Reactor Safety IV
To:	Edington R Nebraska Public Power District (NPPD)
References
IR-05-008
Download: ML052340314 (42)

Text

August 19, 2005

SUBJECT:

COOPER NUCLEAR STATION - NRC SAFETY SYSTEM DESIGN AND PERFORMANCE CAPABILITY INSPECTION REPORT 05000298/2005008

Dear Mr. Edington:

On May 20, 2005, the U.S. Nuclear Regulatory Commission (NRC) completed an onsite inspection at your Cooper Nuclear Station. The enclosed inspection report documents the inspection findings, which were discussed on July 7, 2005, with you and other members of your staff.

This inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, the NRC identified six findings, which were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC also determined that there were six violations associated with these findings. However, because these violations were of very low safety significance and the issues were entered into the licensees corrective action program, the NRC is treating these findings as noncited violations, consistent with Section VI.A.1 of the NRCs Enforcement Policy. These noncited violations are described in the subject inspection report. If you contest the violations or significance of the noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Cooper Nuclear Station facility.

Nebraska Public Power District-2-In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Neil F. OKeefe, Chief Engineering Branch-1 Division of Reactor Safety Docket: 50-298 License: DPR-46

Enclosure:

NRC Inspection Report 05000298/2005008 w/attachment: Supplemental Information

REGION IV==

Docket.:

50-298 License:

DPR-46 Report:

05000298/2005008 Licensee:

Nebraska Public Power District Facility:

Cooper Nuclear Station Location:

P.O. Box 98 Brownville, Nebraska Dates:

May 2 - 20, 2005 (Onsite); May 23 through July 7, 2005 (In-Office)

Team Lead:

C. E. Johnson, P. E., Senior Reactor Inspector, Engineering Branch 1 Inspectors:

C. Paulk, Senior Reactor Inspector, Engineering Branch 1 W. McNeill, Reactor Inspector, Engineering Branch 1 G. George, Reactor Inspector, Engineering Branch 1 Accompanying Personnel:

G. Skinner, Contractor, Beckman & Associates, Inc.

Approved By:

Neil F. O'Keefe, Chief Engineering Branch-1 Division of Reactor Safety

Enclosure-2-SUMMARY OF FINDINGS IR 05000298/2005008; 05/2-7/7/2005; Cooper Nuclear Station; Safety System Design and Performance Capability; and Evaluation of Changes, Tests, or Experiments.

The NRC conducted an inspection onsite with a team of four regional inspectors and one contractor for 2 weeks. The inspection identified six Green noncited violations. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609 "Significance Determination Process." Findings for which the significance determination process does not apply are indicated by "No Color" or by the severity level of the applicable violation. The NRC described its program for overseeing the safe operation of commercial nuclear power reactors in NUREG-1649, "Reactor Oversight Process,"

Revision 3, dated July 2000.

NRC Identified Findings Cornerstone: Mitigating Systems

Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which requires, in part, that design controls shall provide for verifying the adequacy of design by the use of a suitable testing program.

Specifically, the team found that the testing after the impeller replacements did not verify the adequacy of the residual heat removal Pumps A and D's performance over the range of design conditions for which the pumps are used. The establishment of one performance point does not demonstrate that the slope of the pump performance curve has not changed.

Failure to follow Criterion III to adequately demonstrate that design requirements were met for testing of residual heat removal pumps after impeller replacement was a performance deficiency. The team determined this violation to be greater than minor because it affected the reactor safety cornerstone objective of barrier integrity to provide reasonable assurance to maintain containment, in particular, the design control attribute to maintain structural integrity. The finding screened out in the Phase 1 worksheet in Inspection Manual Chapter 0609 as having very low safety significance because the team concluded that the finding did not result in an actual reduction in the pressure control function of the containment spray mode of the residual heat removal system.

(Section 1R21.2b1)

C Green. The team identified a noncited violation of 10 CFR 50.65(a)(2) for the failure to demonstrate that the performance or condition of the 125 Vdc battery chargers was effectively controlled through the performance of appropriate preventive maintenance, such that, the battery chargers remained capable of performing their intended functions.

Failure to demonstrate effective control through appropriate preventive maintenance for the 125 Vdc battery chargers was a performance deficiency. This finding is more than minor because it affects the Mitigating Systems cornerstone attributes of equipment

Enclosure-3-reliability for the 125 Vdc battery chargers. Using the Phase 1 worksheet in Inspection Manual Chapter 0609, this violation was determined to be of very low safety significance because there was no actual loss of a safety function. The licensee entered this finding into their corrective action program as Condition Reports CR-CNS-2005-03823 and-03838. (Section 1R21.2b2)

Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, was identified for failure to implement adequate measures to assure availability of the offsite power supplies. The team identified three examples of this finding, including the undetected loss of the computer-based contingency analyzer program used for monitoring the operability of offsite power sources, inadequate analyses for the second level undervoltage relay reset setpoint, and inadequate procedures for controlling the second level undervoltage relay reset setpoint. This issue was entered into the licensee's corrective action program under Condition Reports CR-CNS-2005-03498 and -03632.

The failure to implement adequate measures to assure the proper functioning of the contingency analyzer program, and to control the relay setpoints, represented a performance deficiency. This finding was more than minor since it affected the Mitigating Events cornerstone attribute of design control, that, if left uncorrected, could result in loss of both preferred ac power supplies needed to mitigate an accident. The issue screened as having very low safety significance in Phase I of the significance determination process, because it involved a design deficiency that was determined not to involve a loss of function in accordance with Generic Letter 91-18, "Information to Licensees Regarding NRC Inspection Manual Section on Resolution of Degraded and Nonconforming Conditions," Revision 1. (Section 1R21.4b1)

Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion III, was identified for failure to perform adequate calculations for ac control circuit voltage drop under degraded voltage conditions. The team identified that calculations to determine voltage drop in motor control center and 120 Vac distribution panel control circuits were nonconservative because they used incorrect data for contactor power factor, did not include all loads in the circuits, and failed to include series resistance because of devices, such as switch contacts and fuses. The cumulative effect of these errors could result in voltage below the existing acceptance criteria. Failure to perform adequate analysis of control circuit capability under degraded voltage conditions was a violation of 10 CFR Part 50, Appendix B, Criterion III. This issue was entered into the licensee's corrective action program under Condition Report CR-CNS-2005-3811.

Failure to perform conservative control circuit voltage drop calculations was a performance deficiency. This issue was more than minor because it affected the Mitigating System cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a design basis accident by failing to assure control circuits have sufficient voltage to perform their function. The issue screened as having very low safety significance in Phase I of the significance determination process because it was a design deficiency that was not found to result in a loss of function in accordance with Generic Letter 91-18. (Section 1R21.4b2)

Enclosure-4-

Green. The team identified a noncited violation of Technical Specification 5.4.1(a) for failure to maintain adequate procedures for configuration control and for the implementation of technical specification-required surveillance for the 12.5 kV subsystem alignment. The team identified that the licensee removed a restriction on a previously prohibited 12.5 kV system alignment, but the evaluation justifying the change relied on a computer-based grid analyzer operated by the grid control center that could be out of service without the knowledge of the nuclear station. This was a violation of Technical Specification 5.4.1(a), which requires that the licensee establish and implement written procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Appendix A recommends procedures for operation of offsite electrical systems. The licensee entered this finding into their corrective action program as Condition Report CR-CNS-2005-4145. This finding had problem identification and resolution cross-cutting aspects because corrective action for a related violation was negated by an inappropriate procedure change.

The failure to maintain adequate procedures for configuration control and for the implementation of technical specification-required surveillance represented a performance deficiency. This finding was more than minor since it affected the Mitigating Systems cornerstone attributes of configuration control that, if left uncorrected, could result in loss of one of the preferred ac power supplies needed to mitigate an accident. Based on the results of the Phase 1 worksheet in Inspection Manual Chapter 0609, this finding was determined to have very low safety significance because the team did not identify any instances where both offsite power sources were inoperable for greater than their allowed outage time. (Section 1R21.4b4)

Green. The team identified a noncited violation of Criterion V, Instructions, Procedures, and Drawings, of 10 CFR Part 50, Appendix B. Specifically, the licensee failed to demonstrate compliance with Technical Specification Surveillance Requirement 3.5.1.1 because of an inadequate surveillance procedure. Surveillance Requirement 3.5.1.1 requires that every 31 days the licensee must verify that the piping for each emergency core cooling system injection/spray subsystem is filled with water from the pump discharge valve to the injection valve. Surveillance Procedure 6.MISC.503, 31 Day Venting of Emergency Core Cooling System and RCIC Injection/Spray Subsystem, implements this requirement. The team identified that the procedure does not contain adequate acceptance criteria to qualitatively or quantitatively assess abnormal amounts of air that may be entrained in the high pressure core system and, therefore, does not fully implement technical specification requirements. The licensee entered this issue into the corrective action program as Condition Report CR-CNS-2005-03857. This finding also had crosscutting aspects regarding problem identification and resolution, in that, a similar issue was identified in 2001 Problem Identification Report 0010082704, dated May 3, 2001, but was not corrected in a timely manner. (Section 4OA2).

Failure to demonstrate compliance with Technical Specification Surveillance Requirement 3.5.1.1 because of an inadequate surveillance procedure was a performance deficiency. The finding was greater than minor because it affected the Mitigating Systems cornerstone because the failure to assure that the emergency core cooling subsystem was full of water, from the pump discharge to the injection valve, did not provide reasonable assurance that the equipment would be available to complete its

Enclosure-5-function. Using the Phase 1 worksheet in Inspection Manual Chapter 0609, this violation was determined to be of very low safety significance because there was no evidence a void currently exists in the piping and is no actual loss of a safety function.

(Section 1R21.5b1)

Enclosure-1-Report Details 1.

REACTOR SAFETY Introduction The NRC performed an inspection to verify that the licensee adequately preserved the facility safety system design and performance capability and that the licensee preserved the initial design in subsequent modifications of the systems selected for review. The scope of the review also included any necessary nonsafety-related structures, systems, and components that provided functions to support safety functions. The inspection effort also reviewed the licensee's programs and methods for monitoring the capability of the selected systems to perform the current design basis functions. This inspection verified aspects of the initiating events, mitigating systems, and barrier cornerstones.

The licensee based the probabilistic risk assessment model for the Cooper Nuclear Station on the capability of the as-built safety systems to perform their intended safety functions successfully. The team determined the area and scope of the inspection by reviewing the licensees probabilistic risk analysis models to identify the most risk significant systems, structures, and components according to their ranking and potential contribution to dominant accident sequences and/or initiators. The team also used a deterministic effort in the selection process by considering recent inspection history, recent problem area history, and all modifications developed and implemented.

The team reviewed the low pressure safety injection system in detail. The primary review prompted parallel review and examination of support systems, such as, electrical power, instrumentation, and related structures and components (e.g., residual heat removal and core spray systems and components).

The team assessed the adequacy of calculations, analyses, engineering processes, and engineering and operating practices that were used by the licensee to support the performance of the safety system selected for review and the necessary support systems during normal, abnormal, and accident conditions. Acceptance criteria utilized by the NRC inspection team included NRC regulations, the technical specifications, applicable sections of the Final Safety Analysis Report, applicable industry codes and standards, as well as, industry initiatives implemented by the licensees programs.

1R02 Evaluations of Changes, Tests, or Experiments (71111.02)

a.

Inspection Scope The procedure requires a minimum sample size of 5 evaluations and 10 screenings.

The team reviewed 7 10 CFR 50.59 evaluations to verify that the licensee had appropriately considered the conditions under which the licensee may make changes to the facility or procedures or conduct tests or experiments without prior NRC approval.

The licensee performed these evaluations since the last NRC inspection of 10 CFR 50.59 activities.

Enclosure-2-The team reviewed an additional 15 10 CFR 50.59 screenings, in which the licensee concluded that full evaluations were not required, to ensure consistency with the requirements of 10 CFR 50.59 in the licensee's exclusion of a full evaluation.

The team reviewed a sample of 7 of the 55 corrective action documents (condition reports and notifications) associated with the corrective action processes written since the last NRC 10 CFR 50.59 inspection to determine whether the licensee properly identified and subsequently resolved problems or deficiencies.

b.

Findings No findings of significance were identified.

1R21 Safety System Design and Performance Capability (71111.21)

.1 System Requirements a.

Inspection Scope The team inspected the following attributes of the low pressure safety injection system and associated support systems: (1) process medium (water, steam, and air),

(2) energy sources (ac and dc electrical systems), (3) control systems, and (4) equipment protection. The team examined the procedural instructions to verify instructions were consistent with actions required to meet, prevent, and/or mitigate design basis accidents. The team also considered requirements and commitments identified in the Final Safety Analysis Report, technical specifications, design basis documents, and plant drawings.

b.

Findings No findings of significance was identified.

.2 System Condition and Capability a.

Inspection Scope The minimum sample size for this procedure is one risk-significant system for mitigating an accident. The team completed the required sample size by reviewing the low pressure safety injection system. The primary review prompted parallel review and examination of support systems, such as low pressure safety injection makeup, related structures and components, and electrical power sources.

The team assessed the adequacy of calculations, analyses, engineering processes, and engineering and operating practices that licensee personnel used for the selected safety system and the necessary support systems during normal, abnormal, and accident conditions. Acceptance criteria used by the team included NRC regulations, the technical specifications, applicable sections of the Updated Final Safety Analysis Report, applicable industry codes and standards, and industry initiatives implemented by the licensees programs.

Enclosure-3-The team reviewed the periodic testing procedures for the low pressure safety injection system to verify that the licensee periodically verified the capability of the system. The team also reviewed the systems operations by conducting system walkdowns; reviewing normal, abnormal, and emergency operating procedures; and reviewing the Updated Final Safety Analysis Report, technical specifications, design calculations, and drawings.

The team also verified that necessary instrumentation and alarms were available to control room operators, and that operators are appropriately trained in operation of the low pressure safety injection system.

b.

Findings b.1 Residual Heat Removal Pump Impeller Replacement Introduction. The team identified a green noncited violation of 10 CFR Part 50, Appendix B, Criterion III, for failure to perform adequate testing after residual heat removal pump impeller replacement, which demonstrated the pumps would perform their design basis functions under all required conditions.

Description. The licensee staff replaced the impellers of Residual Heat Removal Pump D in accordance with Work Order 4326202 on January 26, 2005, and for Pump A in accordance with Work Order 4432106 on April 19, 2005. Subsequent testing performed on January 30, 2005, for Pump D and April 30, 2005, for Pump A did not establish a curve, but only a one point verification, which did not demonstrate the pump performance curve did not change.

The licensee staff tested these pumps by throttling the pump flow to the design flow value for the low pressure injection mode, 7,800 gpm, and determined the performance of the pump by measurement of the differential pressure across the pump.

The old reference value for Pump D was 164 psid and the new value was 189 psid, a change in performance of 15 percent. The old reference value for Pump A was 179 psid and measured the new value was 170 psid, a change in performance of 5 percent. This testing was performed without first establishing the acceptable performance of the pumps. The ASME Code Section 4.3, states, in part, that reference values shall only be established when the pump is known to be operating acceptably.

A 10 percent change in differential pressure is a significant change in pump performance. The ASME Code, Operations and Maintenance Standard, Part 6, Section 6, considers a 10 percent change to the place the pump in the required action range. When the performance falls within the required action range, then the pump must be declared inoperable, the cause determined, and the condition corrected.

At Cooper Nuclear Station, the residual heat removal pumps are used in the low pressure injection mode, in the suppression pool cooling mode, and containment spray mode. The residual heat removal system, therefore, affects emergency containment cooling (barrier integrity), as well as decay heat removal (mitigating systems). The design flow for the containment spray mode was 6,500 gpm according to

Enclosure-4-Calculation NEC 94-034A without identifying the differential pressure requirement. The design flow for the suppression pool cooling mode was 5,775 gpm according to the Cooper Nuclear Station design basis document without identifying the differential pressure requirement.

After the onsite inspection, the licensee staff reported the suppression pool flow in the design basis document to be in error. They reported their anticipated transient without scram analysis established a flow of 7,700 gpm. Condition Report CR-CNS-2005-04257 was written to correct the design basis and other documents. The containment spray flow did not change. The team asked for the differential pressure requirements for all the modes, but the licensee did not identify such parameters. Therefore, it cannot be concluded that testing at 7,800 gpm is bounding of for all conditions, such as, flow at 6,500 gpm for the containment spray mode.

Analysis. The team determined this violation to be greater than minor because it affected the barrier integrity cornerstone objective for the design control attribute. The finding screened as having very low safety significance (Green) in the Phase 1 worksheet in Inspection Manual Chapter 0609 because the team concluded that the finding did not result in an actual reduction in the pressure control function of the containment spray mode of the residual heat removal system.

The team concluded that the testing was inadequate because the acceptability of the pump performance was not established before re-establishing the new inservice testing reference values. In addition, the testing was inadequate because the test was not performed over a range of design conditions for which the pumps are used.

Enforcement. 10 CFR Part 50, Appendix B, Criterion III, requires that design controls shall provide for verifying the adequacy of design by the use of a suitable testing program.

Contrary to the above, the testing program implemented after the impeller replacements in January and April 2005 did not verify the adequacy of the pumps performance over the range of design conditions for which the pumps are relied upon. The establishment of one performance point does not demonstrate that the slope of the pump performance curve has not changed. Additionally, the licensee staff established a new reference value without demonstrating the acceptable performance of the pumps.

Because this finding is of very low safety significance and has been entered in the licensee's corrective action program as Condition Reports CR-CNS-2005-03850 and -

-0377, this violation is being treated as a noncited violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000298/2005008-01, Inadequate Design Control and Compliance with ASME Code Requirements for Inservice Test after Residual Heat Removal Pump Impeller Replacements).

Enclosure-5-b.2 Maintenance Rule Introduction. The team identified a Green noncited violation for the failure to demonstrate that the performance or condition of the 125 Vdc battery chargers was effectively controlled through the performance of appropriate preventive maintenance, such that, the battery chargers remained capable of performing their intended functions.

Description. During the review of the status of the 125 Vdc system, the team noted that licensee personnel monitored the unavailability of the 125 Vdc battery chargers on a train basis. By monitoring on a train basis, the licensee was not able to demonstrate that the performance or condition of the risk-significant battery chargers was effectively controlled through the performance of appropriate preventive maintenance. Because a spare change was installed, this method of measurement of unavailability would only identify the time when two or more chargers were unavailable, thus, masking ineffective maintenance on the battery chargers.

The team determined that the monitoring of the unavailability of the 125 Vdc battery chargers on a train basis has the potential to mask degrading performance because the unavailable time would be charged to either Train A or B, even if the swing charger was supplying the train. As a result, ineffective maintenance on Charger EE-CHG-125(A)

would not be noticed since Train A would be supplied by Charger EE-CHG-125(C) and there would be no unavailability counted against Train A.

Analysis. The team found that the failure to monitor the unavailability of the risk-significant battery chargers at an appropriate level would result in a misleading measurement for the demonstration of effective maintenance. The team determined that, on the basis of actual equipment performance, the performance criterion for unavailability (219 hours0.00253 days <br />0.0608 hours <br />3.621032e-4 weeks <br />8.33295e-5 months <br />) was exceeded in December 1999 (Charger EE-CHG-125(C)

with 348.63 hours7.291667e-4 days <br />0.0175 hours <br />1.041667e-4 weeks <br />2.39715e-5 months <br />) and again in July 2000 (Charger EE-CHG-125(B) with 345.40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />).

The team determined that this was more than minor because it affected the equipment performance attributes of the mitigating systems cornerstone. Because there was no actual loss of function, the team determined that this finding was of very low safety significance (Green) in Phase 1 of the significance determination process.

Enforcement. 10 CFR 50.65(a)(1) states, in part, that "each holder of an operating license... shall monitor the performance or condition of structures, systems, or components against licensee-established goals... and that such goals shall be established commensurate with safety."

10 CFR 50.65(a)(2) states, in part, that monitoring under (a)(1) is not required where it has been demonstrated that the performance or condition of structures, systems, or components is being effectively controlled through the performance of appropriate preventive maintenance, such that, the structures, systems, or components remain capable of performing their intended function.

Enclosure-6-Contrary to the above, from July 10, 1996, to May 18, 2005, the licensee failed to monitor the performance of the 125 Vdc battery chargers at a level to demonstrate that the availability of the battery chargers was effectively controlled through the performance of appropriate preventive maintenance.

Because this finding is of very low safety significance and has been entered in the licensee's corrective action program as Condition Reports CR-CNS-2005-03823, and-03838, this violation is being treated as a noncited violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000298/2005008-02, Failure to Demonstrate the Effectiveness of Maintenance).

.3 System Walkdowns a.

Inspection Scope The team performed walkdowns of the accessible portions of the low pressure safety injection system, and required support systems. The team focused on the installation and configuration of switchgear, motor control centers, manual transfer switches, field cabling, raceways, piping, components, and instruments. During the walkdowns, the team assessed:

The placement of protective barriers and systems,

The susceptibility to flooding, fire, or environmental conditions,

The physical separation of trains and the provisions for seismic concerns,

Accessibility and lighting for any required local operator action,

The material condition and preservation of systems and equipment,

The conformance of the currently-installed system configurations to the design and licensing bases, and

The physical separation of the onsite and offsite electrical power sources.

The team verified that the plant configuration was in agreement with the as-built drawings, and the external material condition of the equipment was good, and that redundancy of systems and physical separation was appropriate.

b.

Findings No findings of significance were identified

.4 Design Review a.

Inspection Scope

Enclosure-7-The team reviewed the current as-built instrument and control, electrical, and mechanical design of the low pressure safety injection system and required support systems. These reviews included an examination of design assumptions, calculations, required system thermal-hydraulic performance, electrical power system performance, protective relaying, control logic, and instrument setpoints and uncertainties. The team specifically focused on the design basis analysis for the performance of the low pressure safety injection systems, such as the design flow required, net-positive suction head, and the electrical power sources, which included availability of offsite power. The team also reviewed the licensees calculations and methodology for ensuring the low pressure safety injection system was protected against seismic, flooding, fire, and high energy line break events.

The team also reviewed the effects of a tornado on the diesel generator building and the safety-related equipment inside the building to determine if emergency power could be supplied to equipment, such as low pressure safety injection during a tornado and safely shutdown the reactor.

The team reviewed calculations, drawings, specifications, vendor documents, Updated Final Safety Analysis Report, technical specifications, emergency operating procedures, and permanent modifications.

b.

Findings b.1 Inadequate Controls to Assure Availability of Offsite Power Supplies to Safety-Related Buses For Safe Shutdown Introduction: The team identified a (Green) noncited violation of 10 CFR Part 50, Appendix B, Criterion III, with three examples relating to the calculations and procedures necessary to assure availability of the offsite power supplies to safety-related buses for safe shutdown. Each of these three items adversely affected the ability of the degraded voltage relay to reset during accidents and other plant transients. This unnecessarily increased the possibility of losing power from the offsite power source concurrent with such events.

Description: Updated Final Safety Analysis Report, Section 2.2.2, defines the safety objective of the startup ac power source as providing a source of offsite ac power to the critical service portion of the auxiliary power distribution system adequate for the safe shutdown of the reactor. Updated Final Safety Analysis Report, Section 3.1, defines the safety objective of the emergency ac power as an additional source of power to the critical service portion of the auxiliary power distribution system to back up the normal and startup sources and to permit portions of the 345 kV system to be removed from service for inspection, testing, and maintenance. Technical Specification 3.8.1 requires two qualified circuits between the offsite transmission network and the onsite Class 1E ac electrical power distribution system to be operable in Modes 1, 2, and 3. Determining the operability of the startup and emergency ac power sources is accomplished through Surveillance Procedure 6.EE.610, "Off-Site AC Power Alignment," Revision 10. This procedure credits either the contingency analyzer computer program or state estimator alarms, both monitored offsite by the Nebraska Public Power District Doniphan Control Center, to identify conditions when the voltage at the safety buses could drop too low to

Enclosure-8-reset the second level undervoltage relays. Therefore, in order to assure the safety objective of the offsite power supplies is satisfied, as defined in the Updated Safety Analysis Report, the licensee must control both the second level undervoltage relays reset setpoint, as well as the tools used by operators to prevent grid voltage from declining to levels where the setpoint would be challenged. This finding involves three examples of the licensees failure to adequately control the software, procedures, or analyses required to assure operability of the offsite power sources.

1.

Nebraska Public Power District Contingency Analyzer During the recent T-2 transformer outage, voltages on the 161 kV system declined to unusually low values that should have resulted in voltage violation flags from the contingency analyzer at the Nebraska Public Power District Doniphan Control Center. The team requested contingency analyzer records for the transformer outage period and confirmed the absence of violations flags.

Subsequent investigation by the licensee determined that the contingency analyzer software had been mis-programmed approximately a year earlier and the flag for identifying projected voltage violations had been inadvertently disabled. This meant that the primary means of assuring operability of both required offsite power supplies had been unavailable for approximately 1 year resulting in the inability to detect inoperability of offsite power source.

The team reviewed offsite power voltage data for the previous year prior to the inspection to determine whether there were instances when either required source may have been inoperable without the knowledge of the station, based on the administrative limits. The team noted that, based on state estimator alarm data, the 161 kV voltage dropped below the 167.5 kV administrative limit several times in the 12-month period preceding the inspection. Most of these instances were of brief duration, lasting a few seconds to several minutes. The team determined that because the contingency analyzer was not working for more than a year, there were no adequate controls in place to detect an inoperable offsite power source. The team also concluded from this data that the offsite sources would generally have been operable during the period that the contingency analyzer was not working properly. The licensee has documented this issue in Condition Report CR-CNS-2005-3632.

2.

Inadequate Control of Relay Reset Setpoint The team determined that Surveillance Procedures 6.1EE.303,Emergency Bus Undervoltage (27) Relays Testing and Calibration (DIV 1), and 6.2.EE.303, Emergency Bus Undervoltage (27) Relays Testing and Calibration (DIV 2), did not contain adequate acceptance criteria for the second level undervoltage relays reset setpoint. Specifically, the procedures did not contain tolerances for the as-left setting, or acceptance criteria for the as-found setting. Failure to provide tolerances for the as-left setting required the technician to leave the relay at the exact value listed on Drawing E150, sheets 7 and 9, which was listed as reference in the surveillance procedure. The as-left settings for the reset function was determined in calculation of record Calculation NEDC 88-086B to be 3914V. If this had been incorporated into the surveillance procedure, it would

Enclosure-9-have resulted in an unacceptable reset setting since the voltage criteria used for determining operability of the offsite power supply allowed voltage to decline to approximately 3913 V at the relay, as noted below. The licensee stated that the as-left tolerances determined in the calculation were actually treated as tolerances to account for drift and other inaccuracies, and the expectation was that technicians would always set the relay at the nominal setting listed on the drawing. However, failure to provide as-left tolerances for relay setpoints forces the technician to either violate the procedure by leaving the setpoint slightly off the required value, or to expend excessive time attempting to achieve the exact value. Consequently, this practice should be avoided. The presence of an unacceptable as-left tolerance in the calculation of record for the relay provided the potential for error since there was no documentation of the fact that the tolerance was being used for purposes other than those defined in the calculation.

As noted above, the procedure also failed to provide criteria for the as-found setpoint. Failure to specify acceptance criteria for the as-found reset setpoint could result in the failure to detect a malfunctioning relay that could compromise both the dropout function used for safety-related equipment protection, as well as the reset function used for maintaining operability of the offsite power sources. This is because the dropout and reset functions of the relay are functionally dependent, so a significant error in one setting indicates that both functions are unreliable.

A review of recent surveillance records for the reset setting indicated that it had been left at, or very close to the nominal setpoint listed on the drawing. Also, a review of as-found settings in surveillance records did not indicate the occurrence of unacceptable readings that would indicate relay malfunction. The team concluded from this data that the procedure deficiencies had not resulted in an actual loss of function. The licensee has documented this issue in Condition Report CR-CNS-2005-3498.

3.

Inadequate Analytical Basis for Operability of the Offsite Power Supplies Calculation 88-086B, Setpoint Determination of Second Level Undervoltage Relays, calculated both the dropout and reset setpoints for the subject relays.

Although Calculation 88-086B calculated the nominal and as-left reset setpoints, it did not identify the functional requirements of the reset function relative to preventing spurious grid separation, and did not determine the maximum value the setpoint could be, considering drift, measuring and test equipment errors, etc. In order to prevent spurious grid separation, the maximum reset setpoint must be maintained below the value assumed in the analytical tools used by the system operators for controlling grid voltage. As noted above, the licensee relied on technicians to adjust the relay to its exact nominal reset setpoint at each

Enclosure-10-calibration, and then relied on margin equivalent to the as-left tolerance to account for errors, such as, drift and measuring and test equipment inaccuracies, to assure an adequate setpoint between calibration cycles. This approach was not documented or justified in the calculation, or in other documents provided to the team, and represented an inappropriate setpoint methodology.

The criteria in plant procedures for declaring the offsite source inoperable was a predicted post-contingency voltage of approximately 3913 V at the relay location.

The nominal reset setpoint is 3899 V, leaving approximately 14 V tolerance to account for drift, measuring and test equipment, power supply, and temperature effect. This margin is very small relative to the actual tolerances of the ABB Type 27 N relay used for the second level undervoltage relays. For instance, the tolerance calculated for the dropout setpoint was approximately 30 V. The team concluded that the setpoints being used by the licensee have not been justified by analysis to be adequate to support criteria in plant surveillance procedures. The licensee has documented this issue in Condition Reports CR-CNS-2005-3498.

Analysis: This finding was more than minor since it affected the Mitigating Systems cornerstone attribute of design control that, if left uncorrected, could result in loss of both preferred ac power supplies needed to mitigate an accident. The examples screened as having very low safety significance in Phase I of the significance determination process, because they involved a design deficiency that was determined not to involve a loss of function in accordance with Generic Letter 91-18, "Information to Licensees Regarding NRC Inspection Manual Section on Resolution of Degraded and Nonconforming Conditions," Revision 1.

Enforcement: 10 CFR Part 50, Appendix B, Criterion III, requires, in part, that measures shall be established to assure that the design basis is correctly translated into specifications, drawings, procedures, and instructions. Contrary to these requirements, the licensee failed to implement adequate measures to assure the proper functioning of the contingency analyzer program and the control of relay setpoints to assure operability of offsite power supplies. Because this violation was of very low significance, and was documented in the licensees corrective action program (Condition Reports CR-CNS-2005-03498 and -03632), this finding is being treated as an noncited violation consistent with Section VI.A of the NRC Enforcement Policy (NCV 05000298/2005008-03, Inadequate Controls to prevent Spurious Grid Separation).

b.2 Control Circuit Voltage Calculations Introduction: The team identified a Green noncited violation of 10 CFR Part 50, Appendix B, Criterion III, for failure to perform adequate calculations for ac control circuit voltage drop.

Description: Calculation NEDC 87-132A determined the voltage drop in control circuits powered by Motor Control Center (MCC) 480V/120V control power transformers, as well as for circuits supplied by 120 Vac distribution panels, for degraded voltage conditions.

Enclosure-11-The team determined that the calculation was not conservative because it used inappropriate input data, and it failed to include actual loading and resistive devices in the models. Specifically, the calculations for MCC control circuits used an inrush power factor of 20 percent for all contactors, based on a statement in the technical data for control power transformers manufacturer that this was acceptable for most applications, instead of using actual data obtained from the contactor manufacturers. Although specific data for the contactors used at Cooper Nuclear Station could not be obtained during the inspection, a review of technical data for several contactor manufacturers showed that typical contactor inrush power factor ranged from approximately 50 percent for Size 1 starters, to 20 percent for Size 5 starters. This data was consistent for all manufacturers reviewed, and because contactors are manufactured with standard ratings in accordance with industry standards, it is believed to be applicable to the Cooper Nuclear Station starters. The higher power factor, especially for Size 1 starters, will result in an increased voltage drop of approximately 0.75 percent. Calculations for MCC control circuits also failed to include parallel loads in the control circuit models, such as indicating lights, and auxiliary devices. These devices will increase the current and, therefore, the overall voltage drop. Calculations for both 120 Vac panels and MCC control circuits failed to include the series resistance of circuit elements, such as, fuses and switch contacts. The effect of these factors could increase voltage drop by 1 to 2 percent. Since the available voltage margin shown in existing calculations for several circuits was approximately 1 percent, the cumulative effect of these errors could result in voltage results below the existing acceptance criteria. The team noted that the calculation was conservative in other respects so that it is not expected that corrected calculations will reveal operability concerns. The licensee has issued Condition Report CR-CNS-2005-3811 to address this issue.

Analysis. The team concluded that this finding was a performance deficiency because the licensee failed to adequately perform calculations required to demonstrate that safety-related equipment could operate under degraded voltage conditions. This issue was more than minor because it affected the Mitigating System cornerstone objective of ensuring availability, reliability, and capability of systems needed to respond to a design basis accident by failing to assure control circuits have sufficient voltage to perform their function. The issue screened as very low safety significance in Phase I of the significance determination process, because it was a design deficiency that was not found to result in a loss-of-function in accordance with Generic Letter 91-18.

Enforcement. 10 CFR Part 50, Appendix B, Criterion III, requires that measures be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee failed to perform proper calculations for ac control circuit voltage drop under degraded voltage conditions. Since this finding is of very low safety significance and has been entered into the licensees corrective action program as Condition Report CR-CNS-2005-3811, it is considered a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000298/2005008-04, Nonconservative Calculation for AC Control Circuit Voltage Drop).

Enclosure-12-b.3 Double Sequencing Event Not Analyzed Introduction: The team identified an unresolved item involving several issues, including inadequate procedure changes that permitted unanalyzed electrical system alignments, inadequate corrective actions, and design inadequacies. These alignments could subject the safety-related electrical systems to short duration power interruptions during the response to an accident. The response of plant systems and equipment to these interruptions has not been formally analyzed. Short power interruptions have the potential to damage fluid systems including emergency core cooling systems, or to cause failure of electrical equipment required for safe shutdown of the station. This issue is unresolved pending further analysis by the licensee and NRC determination of the safety significance.

Description: During normal power operation, plant auxiliaries are supplied by the main generator through the normal system service transformer. If an accident occurs, plant auxiliaries, including both essential and non-essential buses, automatically transfer to the startup transformer, which is supplied from the 161 kV transmission system. Since essential Buses 1F and 1G are normally connected to upstream non-safety Buses 1A and 1B, respectively, the transfer to the startup transformer is implemented by opening the normal closed breakers between the normal system service transformer and Buses 1A and 1B and closing the breakers between the startup transformer and Buses 1A and 1B. If the startup transformer is not available (locked out), or not capable of carrying the applied load, Buses 1F and 1G are disconnected from Buses 1A and 1B, and are transferred to the emergency station service transformer, which is supplied by the 69 kV transmission system. If neither the startup transformer nor the emergency station service transformer is available, essential Buses 1F and 1G are transferred to their respective emergency diesel generators.

Because of the differences in undervoltage protection between the essential and non-essential buses, it is possible for non-essential Buses 1A and 1B to remain connected to the startup transformer while essential Buses 1F and 1G are transferred to the emergency station service transformer. If 161 kV system voltage at the time of the accident is sufficiently low, Buses 1F and 1G will be promptly disconnected from Buses 1A and 1B before load sequencing is started. Generally, if startup transformer voltage is sufficient to prevent shedding of non-safety Buses 1A and 1B, it will also be sufficient to prevent transfer of Buses 1F and 1G to the emergency station service transformer until after the starting of some emergency core cooling system loads has occurred.

However, if source voltage declines below limits required for operability, and essential loads are sequenced onto the inoperable source, the second level undervoltage relays will disconnect the essential buses after a time delay, and load sequencing will commence again on the alternate offsite source, if available, or the standby diesel generators. This phenomena is known as double sequencing.

Inadequate Procedure Change Procedure 5.3 GRID, "Degraded Grid Voltage," Revision 0, was implemented to address concerns relating to the operability of offsite power sources. The procedure established limits on the quality of offsite power supplies including Cooper Nuclear Station switchyard voltage limits for both the 161 kV power source to the startup transformer

Enclosure-13-and the 69 kV power source to the emergency station service transformer. The procedure directed the locking out of unstable and unreliable sources in order to avoiding double sequencing vital loads. The procedure specifically provided for blocking transfer of essential buses from the normal system service transformer to either the startup transformer or the emergency station service transformer if its power source was unreliable, as evidenced by transformer primary voltage below 167.5 kV and 70 kV respectively. The procedure required declaring the affected offsite source inoperable and entering the appropriate technical specification limiting condition for operation, but did not require immediate shutdown of the station. However, Revision 1 to the procedure completely eliminated measures to prevent transfer to an unreliable source during the period allowed for operation by the applicable technical specification limiting condition for operation. Although the procedure still required declaring a degraded source inoperable, it eliminated requirements to take it out of service by blocking the automatic transfer. Technical Specification 3.8.1 allows the station to operate for 7 days with one offsite source inoperable and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with both offsite sources inoperable, prior to commencing shutdown.

The 10 CFR 50.59 screening that evaluated this change relied on Procedure PRA02014, Risk Assessment of Proposed Actions in Procedure 5.3 Grid. However, Procedure PRA02014 did not support the changes made in Procedure 5.3 GRID, Revision 1, because it evaluated a proposed change different from the changes actually made. This risk assessment evaluated a proposed new Attachment 4 to Procedure 5.3 GRID that would have required locking out both offsite power supplies for the essential buses and manually tripping the plant in the case where grid voltage was below required limits for operability for both offsite sources. The risk associated with this action was compared with continuing to operate the station while taking actions to stabilize the grid. This risk assessment concluded that there was less risk associated with continuing to operate the station than taking the actions in the proposed Attachment 4, which included scramming the plant. However, not only was the proposed Attachment 4 not implemented, different changes were made that were not evaluated or supported by Procedure PRA02014.

The changes actually made to Procedure 5.3 GRID eliminated the requirement to lock out an inoperable source. In addition, the existing Procedure 5.3 GRID did not require manually tripping the plant, which was the major contributor to the risk for the proposed changed evaluated in Procedure PRA02014. Therefore, the existing actions in Procedure 5.3 GRID, Revision 0, requiring locking out an unreliable source were reasonable and prudent measures that posed considerably less risk than the proposed actions evaluated in Procedure PRA02014. Even in the case where both sources were declared inoperable and locked out, Procedure 5.3 GRID, Revision 0, did not require immediate manually tripping of the plant, and allowed operation for the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed by Technical Specification 3.8.1. Also, the measures eliminated from the procedure had been specifically implemented to prevent an unanalyzed double sequencing scenario.

Neither the 10 CFR 50.59 screen, nor Procedure PRA02014 addressed the risks

Enclosure-14-associated with the reintroduction of this unanalyzed vulnerability. NRC Inspection Report 50-298/0402 identified a similar condition where the 161 kV system had not been analyzed for alignments allowed by station procedures that could have also resulted in double sequencing. The original finding was determined to be a violation of Technical Specification 5.4.1(a), which requires that the licensee establish and implement written procedures for operation of offsite electrical systems.

Unanalyzed Configuration Voluntarily Entered During the weekend of April 29, 2005 to May 1, 2005, the 345/161 kV T-2 transformer was taken out-of-service for planned maintenance. During the outage, the 161/4.16 kV startup transformer was declared inoperable in accordance with plant procedures. As part of the licensees planning for this outage, a decision was made to leave the startup transformer in service for most of the outage so that it would be available to maintain continuity of service to non-essential buses in case of an accident. This was determined by the licensee to incur less risk than locking out the startup transformer, which would have caused load shedding of the non-essential buses during an accident. During the planning for the outage, the licensee determined by calculation that the minimum required 161 kV system voltage to maintain continuity of service to the non-essential buses was approximately 154 kV. The station then requested the that the Nebraska Public Power District control center reset the 161 kV system voltage alarm to 167.5 kV to 155 kV, in order to provide notification if voltage was too low to maintain continuity of service to the non-essential buses. This temporary alarm voltage was recognized to be well below the voltage determined in Calculation NEDC 00-003 to be required to prevent actuation of the second level undervoltage relays (approximately 166 kV). Therefore, it was recognized that this alignment was likely to cause double sequencing in case of an accident.

The team reviewed voltage data for the T-2 transformer outage period, and determined that 161 kV system voltage was low enough to have caused double sequencing if an accident had occurred during a 42 hour4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> period.

The design basis for Cooper Nuclear Station is simultaneous loss-of-offsite power/loss-of-coolant accident. Double sequencing has not been formally analyzed. Nonetheless, during the T-2 transformer outage, the plant was deliberately placed in a configuration where double sequencing was likely to occur in case of an accident, without analyzing the potential adverse effects on electrical and mechanical systems that could occur.

These effects could include damage to fluid systems including the emergency core cooling system because of water hammer, and also damage to or tripping of electrical equipment. In response to the teams concern, the licensee provided Risk Assessment PSA-ES060, Risk Assessment of a Double Sequencing Event, dated September 27, 2002. This document had previously evaluated whether procedure changes should be made to lock out degraded offsite power sources to prevent double-sequencing during alignments such as the one that was used during the T-2 transformer outage. Risk Assessment PSA-ES060 included a qualitative analysis of the potential for water hammer during double sequencing that took credit for the emergency core cooling system pump discharge check valves to maintain the water column from the reactor vessel to the emergency core cooling system pumps. The assessment did not, however, consider a failure of the discharge check valve involving the failure to reclose

Enclosure-15-during the pump starting and stopping sequence. Since there is only one discharge check valve per pump, a single check valve failure could result in water column separation while the emergency core cooling system pumps are stopped. In addition, the assessment did not provide a comprehensive or quantitative analysis of the impact to electrical equipment during double sequencing. Consequently, the team concluded that Risk Assessment PSA-ES060 did not serve as an adequate analysis to justify the alignment entered during the T-2 transformer outage. The licensee did not perform a 10 CFR 50.59 screen to support the outage because the alignment allowing double sequencing had been permitted by plant procedures ever since the restrictions on such alignments were eliminated by Revision 1 to Procedure 5.3GRID. This finding has been entered into the licensees corrective action program as Condition Report CR-CNS-2005-04202.

Analysis: This finding is greater than minor because it affected the Mitigating System cornerstone objective of equipment reliability, in that, Cooper Nuclear Station was in an unanalyzed condition that could have damaged fluid systems or loss-of-electrical equipment needed for safe shutdown, and could have prevented the station from recovering from a previously analyzed accident. This finding involves several aspects such as an inadequate 10 CFR 50.59 evaluation and inadequate corrective action from a previous NRC inspection. The licensee was asked to provide an analysis or demonstrate that the plant could survive a double sequencing event during accident conditions.

This finding does not present an immediate safety concern because the alignment in question was exited when the T-2 transformer was placed back in service at the beginning of May 2005. This finding has been entered into the licensees corrective action program as Condition Report CR-CNS-2005-04202. This finding is unresolved pending further response and evaluation by the licensee and review of this evaluation by the NRC (URI 298-50/05-08-05, Double Sequencing Unanalyzed).

Enforcement: This finding is unresolved pending further analysis and evaluation by the licensee and review of this evaluation by the NRC to determine if a violation occurred and its significance.

b.4 Inadequate Controls for Alignment of 12.5 kV Subsystem

Introduction: The team identified a Green noncited violation of Technical Specification 5.4.1(a) for failure to establish and maintain proper controls for aligning the 12.5 kV buses to their alternate 69 kV supply.

Description: The 69 kV system was one of the two qualified offsite power supplies required to be operable in Modes 1, 2 and 3 by Technical Specification 3.8.1. In response to Unresolved Item 05000298/0015-01 the licensee revised System Operating Procedure 2.2.90 to prohibit alignment of the 12.5 kV subsystem, which supplies non-power block loads, to the 69 kV system Cornfield substation, when the 69 kV line was required to be operable. This change was required because the operability of the 69 kV system could not be assured while it was carrying the 12.5 kV system load. In April 2005, System Operating Procedure 2.2.90, "12.5 kV System," Revision 40, was revised again to remove this restriction. Engineering Evaluation EE 05-017 was prepared to

Enclosure-16-justify the change, and relied on the availability of the contingency analyzer computer program operated offsite by the Doniphan Control Center to provide notification when the 69 kV system was inoperable. The evaluation stated that the contingency analyzer had been proven to be a reliable and conservative measure to assure operability of the 69 kV system and rendered the previous limitation on 12.5 kV system alignment unnecessary.

The evaluation did not, however, address important issues relating to this change.

Engineering Evaluation EE 05-017 did not consider the fact that station procedures allowed operation of the station in Modes 1, 2 and 3 when the contingency analyzer is not working, by using fixed switchyard voltage criteria, similar to the method that was used when the original deficiency was discovered. Procedures 5.3GRID and 6.EE.610 provide guidance and limitations for operation when the contingency analyzer was out of service, but the provisions do not address 12.5 kV system alignment. In addition, the interface operating agreement governing communications between Doniphan Control Center and Cooper Nuclear Station does not require notification of the Cooper Nuclear Station control room for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> if the contingency analyzer is not working.

Consequently, the enhanced protection afforded by the contingency analyzer and credited in Engineering Evaluation EE 05-017 could be lost during alignment of the 12.5 kV buses to Cornfield for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> without notification to Cooper Nuclear Station.

During the T-2 transformer outage conducted at the end of April 2005, the 161 kV offsite source was declared inoperable as a consequence of removing the T-2 transformer from service in accordance with plant procedures. During this period, the 69 kV system was considered the only qualified offsite source for compliance with Technical Specification 3.8.1. The outage plan called for complete removal of the normal 161 kV source from service for a portion of the outage. Since this was the normal source of power for the 12.5 kV subsystem, it was aligned to its alternate source, the 69 kV Cornfield substation, as allowed by the recently revised System Operating Procedure 2.2.90. The contingency plan for the outage included an item for loss of the contingency analyzer, but did not require any actions for removing the 12.5 kV buses from their alignment to the Cornfield substation. The team discovered that during the outage, and for approximately one year prior to the outage, the contingency analyzer was, in fact, not functioning.

The team requested data to determine whether the 69 kV system was actually operable during the alignment of the 12 kV buses to the Cornfield substation. There were several incidences during the T-2 outage where the voltage on the high side of the emergency station service transformer dipped below a value of 70 kV. This voltage level is the setting for the back-up alarm from the Doniphan Control Center, in the event that contingency analysis is not solving. As a result of determining that the emergency station service transformer 69 kV voltage did drop below 70 kV during the T-2 outage, special analyses were initiated by the licensee to determine the capability of the 69 kV system during the T-2 transformer outage. The analysis using the contingency analyzer software showed low but acceptable voltage would have been available.

This issue was entered into the licensee's corrective action program under Condition Report CR-CNS-2005-4145.

Enclosure-17-NRC Inspection Report 05000298/2004002 closed unresolved item 05000298/0015-01 based on a change to System Operating Procedure 2.2.90, which prohibited alignment of the 12.5 kV buses to the 69 kV system when the 69 kV line was required to be operable. Noncited Violation 50-298/0402-05 was issued at that time. Because the licensee removed the alignment restriction without implementing adequate controls, this issue represents a repetition of the condition documented in NRC Inspection Report 05000298/2004002.

This finding has cross-cutting aspects in the area of problem identification and resolution because the April 2005 procedure change nullified corrective actions to address the same 12.5 kV subsystem alignment concerns documented in Noncited Violation 50-298/0402-05.

Analysis. The failure to maintain adequate procedures for configuration control and for the implementation of technical specification required surveillance represented a performance deficiency. Station procedures did not address the operability of the 69 kV system when the 12.5 kV subsystem was aligned to the Cornfield substation concurrent with an outage of the contingency analyzer. This finding was more than minor since it affected the Mitigating Systems cornerstone attributes of configuration control, that, if left uncorrected, could result in loss of one of the preferred ac power supplies needed to mitigate an accident. The team did not identify any instances where both offsite power sources were inoperable for greater than their technical specification allowed outage time. Therefore, based on the results of an significance determination process Phase 1 evaluation, this finding was determined to have very low safety significance.

Enforcement. Technical Specification 5.4.1(a) requires that the licensee establish and implement written procedures recommended in Regulation Guide 1.33, Revision 2, Appendix A, February 1978. Appendix A recommends procedures for operation of offsite electrical systems. Contrary to this requirement, Surveillance Procedure 6.EE.610 did not contain adequate acceptance criteria for verifying the operability of offsite power supplies. In addition, System Operating Procedure 2.2.90 allowed one of the offsite power circuits to be aligned in an unanalyzed configuration.

Since this finding is of very low safety significance and has been entered into the licensees corrective action program as Condition Report CR-CNS-2005-4145, it is considered a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy. (NCV 05000298/2005008-06, Inadequate Controls for 12.5 kV Subsystem Alignment).

b.5 Capability of Diesel Generator Building Ventilation Systems to Withstand A Tornado Introduction: The team identified a unresolved item involving the lack of analyses to demonstrate the capability of the diesel generator building ventilation systems to withstand a tornado. This issue is unresolved pending further analysis by the licensee and completion of the NRC staff review and determination of the safety significance.

Description: During the walkdown of electrical support systems, the team noted from one deficiency tag that several louvers on a safety-related damper were misaligned.

The team questioned whether this damper and ventilation duct could withstand the effects of a tornado as stated in the Final Safety Analysis Report. The licensee was not

Enclosure-18-able to provide an analysis or other documentation to demonstrate that the diesel generator building ventilation systems were capable of withstanding the rapid depressurization effects that can occur in a tornado. Each diesel generator building is equipped with two ventilation systems, a small one intended for personnel comfort while the diesel is not operating, and a larger one intended to assure operability of the diesels by removing heat from the building while the diesel is operating. The large system features two open loops, one to supply filtered and cooled outside air to the building, and the other to remove hot air to the outside. Each loop features a centrifugal fan, duct work, and a connection to the outside atmosphere. The supply loop also includes filters and chilled water cooling coils. During a tornado, air can be drawn out of the intake and exhaust openings because of the lower than atmospheric pressure inside the tornado.

The team was concerned that the pressure differential between the atmosphere inside and outside of the building, could be sufficient to damage the fans or filters, or collapse the duct work inside the building. This could render the diesels inoperable because of the inability to maintain building temperature within required limits. In response to the teams concerns, the licensee generated Calculation NEDC 05-0521, "3PSI Tornado Pressure Effect for DG Building HVAC," that showed that the diesel rooms would be effectively vented though the CO2 relief dampers located in the exhaust system duct work near the room ceiling. The calculation showed that the room pressure would closely follow the outside pressure so that the maximum differential pressure across the duct work would be approximately 0.54 psi vs. a 0.64 psi collapse pressure.

The team determined that is calculation was both insufficient to demonstrate the capability of the ventilation systems, and also raised new concerns relating to the venting of the buildings, which were presented to the licensee, as follows:

1.

The CO2 damper that was credited as the vent path for depressurizing the room will only operate effectively in one direction and is not available to repressurize the room after the depressurization zone passes. Since the room was shown to be depressurized down to approximately 11.7 psia, a 3 psi differential pressure could then develop between the room atmosphere and unvented equipment, such as, control panels, pull boxes, and motor control centers. Therefore, the equipment in the room should be evaluated for potential for damage.

2.

The calculation did not evaluate the magnitude or effect of differential pressure within the duct to determine whether components such as fans, dampers, filters and cooling coils could be damaged.

3.

The CO2 dampers that were credited for venting the diesel room were not specifically designed for the function credited in the calculation and may be damaged by the event.

As a partial response to these concerns, the licensee revised Calculation NEDC 05-0521 to analyze the effects on ventilation system duct work of the repressurization phase of the tornado event when the depressurization zone recedes. This calculation showed a differential pressure of 2.43 psi between the inside and outside of the duct during repressurization vs. 0.54 psid during the depressurization phase. This pressure was well in excess of the design capability of the ventilation system and was expected to deform the ducts. Although the calculation asserted that the duct work would remain

Enclosure-19-intact, the calculation did not provide sufficient analysis to show that the ventilation systems would remain operable. For instance, the calculation did not address whether the duct would rupture at seams, or whether the expected deformation would dislodge parts that could migrate to, and damage the fan, or other internal components. In addition, the calculation did not address other concerns previously posed by the team such as the effect of depressurization on electrical equipment enclosures in the diesel generator rooms. The team concluded that, because of the omissions and uncertainties with the data provided by the licensee, this calculator did not provide a reasonable assurance of operability for the diesel generator building ventilation systems in a tornado. As part of the response to this issue, the licensee confirmed that the operability of the diesel generators could not be assured without the availability of the safety-related ventilation systems. This finding has been entered into the licensees corrective action program as Condition Report CR-CNS-2005-03486.

Analysis. The team concluded that this issue was a performance deficiency because the licensee failed adequately to demonstrate that the diesel generator building ventilation systems would remain operable following the depressurization effects of a design basis tornado. This issue was more than minor because it affected the Mitigating System cornerstone objective of ensuring availability, reliability, and capability of the diesel generator systems needed to respond to a design basis event. This finding is unresolved pending further response by the licensee and review by the NRC staff.

Enforcement. Pending further analysis by the licensee and review by the NRC to determine if a violation occurred and it significance, this finding will remain as an unresolved item (NRC URI 05000298/2005008-07, No Analysis to Demonstrate That the Emergency Diesel Generator Building Ventilation System Can Withstand the Depressurization Effects of a Tornado). The licensee agreed to provide analyses of the effects of tornadoes on the ventilation system. Within the NRC, additional review was needed to determine the license bases requirements applied to tornado protection for the system.

.5 Safety System Inspection and Testing a.

Inspection Scope The team reviewed the program and procedures for testing and inspecting selected components for the low pressure safety injection system and required support systems.

The review included the results of surveillance tests required by the technical specifications and selective review of inservice tests.

b.

Findings b.1 Surveillance Requirements for Emergency Core Cooling System Injection Systems

Introduction. The team identified a non-cited violation of Criterion V, Instructions, Procedures, and Drawings, of 10 CFR Part 50, Appendix B, having very low safety significance. Specifically, the licensee failed to demonstrate compliance with Technical Specification Surveillance Requirement 3.5.1.1 because of an inadequate surveillance procedure.

Enclosure-20-Description. Surveillance Requirement 3.5.1.1 requires that every 31 days the licensee must verify, for each emergency core cooling system injection/spray subsystem, the piping is filled with water from the pump discharge valve to the injection valve. To ensure that Surveillance Requirement 3.5.1.1 is met, the licensee implements Surveillance Procedure 6.MISC.503, 31 Day Venting of Emergency Core Cooling System and RCIC Injection/Spray Subsystem.

Through a review of Cooper Nuclear Stations response to industry operating experience, licensee personnel identified a section of high pressure coolant injection system discharge piping, from the pump discharge valve to the injection valve, which had the potential to contain voids. The potential was associated with two factors:

(1) the section of piping leading to the high pressure coolant injection valve being at a higher elevation than the high point vent valve used to vent the piping; and (2) the section of piping cannot be vented during normal operation because of its location in the steam tunnel.

The team identified that Surveillance Procedure 6.MISC.503 does not contain adequate acceptance criteria to qualitatively or quantitatively assess abnormal amounts of air in the high pressure coolant injection system. Also, the venting procedure, which relies heavily on operator knowledge, does not contain specific instructions for operators and lacks guidance when abnormal conditions are present.

Since this procedure is inadequate, licensee personnel cannot properly verify that voids do not exist in the system, such as the section of piping stated above. Therefore, this procedure does not provide adequate assurance that the intent of Surveillance Requirement 3.5.1.1 is met.

This issue was entered into the licensees corrective action program as Condition Report CNS-2005-03857.

A similar procedural issue was identified in 2001 by the senior resident inspector and placed into the licensees corrective action program under Problem Identification Report 0010082704, dated May 3, 2001. The corrective action recommendation was to determine wording for 6.MISC.503 that would ensure that if the operator found air in the injection piping that a notification and operability call would be made. However, the change to the procedure did not occur. Therefore, this finding had cross-cutting aspects in the problem identification and resolution area.

Analysis. The team determined that the inadequate procedure was a performance deficiency because the licensee failed to fully satisfy Technical Specification Surveillance Requirement 3.5.1.1. The finding was greater than minor because it affects the Mitigating Systems cornerstone objective associated with procedure quality. The failure to assure that the emergency core cooling system subsystem is full of water, from the pump discharge to the injection valve, does not provide reasonable assurance that the equipment will be available when relied upon to complete its function. Using the significance determination process Phase 1 worksheet, this finding was determined to be of very low safety significance because there would be no actual loss of a safety function.

Enclosure-21-Enforcement. Criterion V of 10 CFR Part 50, Appendix B, requires that activities affecting quality shall be prescribed by documented procedures of a type appropriate to the circumstances and shall be accomplished in accordance with these procedures. The procedures shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Contrary to this statement, the licensee failed to ensure that Surveillance Procedure 6.MISC.503 would verify that the high pressure coolant injection system was free of voids because the procedure does not include appropriate quantitative or qualitative acceptance criteria for determining that venting of the system is satisfactorily accomplished. Because the violation was of very low safety significance and has been entered into the licensees corrective action program as Condition Report-CNS-2005-03857, this violation is being treated as a noncited violation, consistent with Section VI.A of the Enforcement Policy (NCV 05000298/2005008-08)

A similar procedural issue was identified in 2001 by the senior resident inspector and placed into the licensees corrective action program under Problem Identification Report 0010082704, dated May 3, 2001. The corrective action recommendation was to determine wording for 6.MISC.503 that would ensure that if the operator found air in the injection piping that a notification and operability call would be made. However, the change to the procedure did not occur. The failure to implement prompt corrective actions will be referenced in Section (4OA2) of this report.

4.

OTHER ACTIVITIES 4OA2 Problem Identification and Resolution a.

Inspection Scope The team reviewed 35 condition reports and 12 notifications written on the low pressure safety injection system and verified that corrective actions taken were appropriately evaluated and corrected. The sample included open and closed condition reports for the past 3 years and are listed in the attachment to this report. Inspection Procedure 71152,

"Identification and Resolution of Problems," was used as guidance to perform this part of the inspection. Older condition reports that were identified while performing other areas of the inspection were also reviewed.

b.

Findings Cross-References to PI&R Findings Documented Elsewhere Section 1R21.4b4 describes a noncited violation of Technical Specification 5.4.1(a) for the licensees failure to establish and maintain proper controls for aligning the 12.5 kV buses to their alternate 69 kV supply. This issue was identified as an unresolved item in 2000. In response to Unresolved Item 05000298/0015-01, the licensee revised System Operating Procedure 2.2.90 to prohibit alignment of the 12.5 kV subsystem, which supplies non-power block loads, to the 69 kV system Cornfield substation, when the 69 kV line was required to be operable. This change was required because the operability of the 69 kV system could not be assured while it was carrying the 12.5 kV

Enclosure-22-system load. In April 2005, approximately 2 weeks prior to a planned outage of the T-2 transformer, System Operating Procedure 2.2.90 was revised again to remove the restriction previously implemented in response to the unresolved item. Engineering Evaluation EE 05-017, which was prepared to justify the change, relied on the availability of the contingency analyzer computer program operated by the Doniphan Control Center to provide notification when the 69 kV system was inoperable. The evaluation stated that the contingency analyzer had been proven to be a reliable and conservative measure to assure operability of the 69 kV system and rendered the previous limitation on 12.5 kV system alignment unnecessary. The evaluation did not, however, address important issues relating to this change.

Section 1R21.5b1 describes a finding for an inadequate surveillance procedure, which is used to vent the various emergency core cooling system subsystems. A similar issue was identified in 2001 by the senior resident inspector and placed into the licensees corrective action program under Problem Identification Report 0010082704, dated May 3, 2001. The corrective action recommendation was to "determine wording for Surveillance Procedure 6.MISC.503 that would ensure that if the operator found air in the injection piping that a notification and operability call would be made. However, the licensee did not implement the corrective action.

4OA6 Management Meetings Exit Meeting Summary The team leader presented the inspection results to Mr. Randall K. Edington, Vice President Nuclear Operations and CNO, and other members of licensee management at the conclusion of the onsite inspection on May 20, 2005.

After additional in-office review, a telephonic exit meeting was held July 7, 2005. The team leader presented the inspection results to Mr. Randall K. Edington, Vice President Nuclear Operations and CNO, and other staff members.

At the conclusion of this meeting, the team leader asked the licensee's management whether any materials examined during the inspection should be considered proprietary.

No proprietary information was identified.

Attachment A-1 SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT Licensee Personnel V. Bhardwaj, Manager, Engineering Support D. Buman, Assistant Manager, Design Engineering R. Edington, Vice President-Nuclear and CNO J. Flaherty, Site Regulatory Liaison J. Gausman, Engineer, Design Engineering G. Kline, Director, Engineering J. Lechner, Supervisor, Civil/Design Engineering M. McCormack, Electrical Engineering Supervisor, Design Engineering S. Minahan, General Manager, Plant Operations H. Northrop, Manager, Materials, Purchasing and Contracts J. Roberts, Director, Nuclear Assurance K. Thomas, Supervisor, Mechanical Engineering Programs D. Van Der Kamp, Supervisor, Licensing B. Victor, Licensing Engineer, Licensing J. Whisler, Supervisor, Work Control D. Willis, Manager, Maintenance NRC Personnel J. Clark, P.E., Branch Chief, Division of Reactor Safety S. Schwind, Senior Resident Inspector D. Terao, Section Chief, Office of Nuclear Reactor Regulation LIST OF ITEMS OPENED AND CLOSED Opened 05000298/2005008-05 URI Double Sequencing Unanalyzed, Section 1R21.4b3 05000298/2005008-07 URI No Analysis to Demonstrate that the DG Building Ventilation System Can Withstand the Depressurization Effects of a Tornado, Section 1R21.4b5 Opened and Closed 05000298/2005008-01 NCV Inadequate Design Control and Compliance with ASME Code Requirements for Inservice Test after Residual Heat Removal Pump Impeller Replacements, Section 1R21.2b1

Attachment A-2 05000298/2005008-02 NCV Failure to Demonstrate the Effectiveness of Maintenance, Section 1R21.2b2 05000298/2005008-03 NCV Inadequate Controls to Assure Availability Of Offsite Power Supplies to Safety-Related Buses for Safe Shutdown, Section 1R21.4b1 05000298/2005008-04 NCV Non-conservative Calculation for AC Control Circuit Voltage Drop, Section 1R21.4b2 05000298/2005008-06 NCV Inadequate Controls for 12.5 KV Subsystem Alignment, Section 1R21.4b4 05000298/2005008-08 NCV Failure to Comply With Technical Specification Surveillance Requirements Due to An Inadequate Procedure 1R21.5b1 Documents Reviewed Section 1R02: Evaluations of Changes, Tests, or Experiments Condition Reports CR-CNS-2004-06952 CR-CNS-2004-07355 CR-CNS-2004-07670 CR-CNS-2005-01439 Notifications 0010310226 0010321642 0010326736 Procedure Administrative Procedure 0.8, 10 CFR 50.59 Reviews, Revision 14 10 CFR 50.59 Safely Evaluations 2002-0014 2003-0008 2003-0009 2004-0001 2004-0002 2004-0005 2004-0009

Attachment A-3 10 CFR 50.59 Screenings for the following documents Nuclear Engineering Design Calculation 03-017 Change Evaluation Document 6008662 Change Evaluation Document 6008750 Change Evaluation Document 6011600 Change Evaluation Document 6014680 Change Evaluation Document 6017140 Change Evaluation Document 6017142 Change Evaluation Document 6017220 Engineering Evaluation 05-001 Engineering Evaluation 05-002 Engineering Evaluation 05-008 Engineering Evaluation 05-017 Procedure 2.2.38.2 Revision 11 Setpoint Change Request 2003-16 Temporary Configuration Change 4322246 Miscellaneous USA 50.59 Resource Manual, Revision 1a Section 1R021: Safety System Design and Performance Capability Condition Reports CNS-CR-2003-07776 CNS-CR-2003-04655 CNS-CR-2005-00674 CNS-CR-2005-00675 CNS-CR-2005-03412 CR-CNS-2005-03418 CR-CNS-2005-03451 CNS-CR-2005-03453 CNS-CR-2005-03486 CNS-CR-2005-03498 CNS-CR-2005-03507 CNS-CR-2005-03511 CNS-CR-2005-03563 CNS-CR-2005-03625 CNS-CR-2005-03632 CNS-CR-2005-03784 CNS-CR-2005-03805 CNS-CR-2005-03811 CNS-CR-2005-03814 CNS-CR-2005-03821 CNS-CR-2005-03823 CNS-CR-2005-03831 CNS-CR-2005-03832 CNS-CR-2005-03833 CNS-CR-2005-03835 CNS-CR-2005-03849 CNS-CR-2005-03850 CNS-CR-2005-03857 CNS-CR-2005-04202 CNS-CR-2005-04145 CR-CNS-2005-02557 CR-CNS-2005-03737 CR-CNS-2005-03850 CR-CNS-2005-02565 CA-00001 CR-CNS-2005-03777 Inservice Testing Surveillance Activities Component Test type Surveillance Dates RHR-P-A Pump performance 6.1RHR101 February 7, 2005

Attachment A-4 RHR-P-C Pump performance 6.1RHR.101 April 21, 2005 February 7, 2005 November 16, 2004 RHR-P-D Pump performance 6.2RHR.101 April 13, 2005 January 30, 2005 November 9, 2004 RHR-MOV-MO13A Stroke 6.1RHR.201 April 22, 2005 January 31, 2005 November 16, 2004 Position 6.MISC.401 January 31, 2005 May 18, 2004 January 6, 2003 RHR-MOV-MO65A Stroke 6.1RHR.201 April 22, 2005 February 6, 2005 October 31, 2004 Position 6.MISC.401 May 18, 2004 March 30, 2003 September 10, 2003 RHR-MOV-MO25A Stroke 6.2RHR.201 April 12, 2005 January 30, 2005 November 9, 2004 Position 6.MISC.401 January 29, 2005 May 12, 2004 December 23, 2002 Leak 6.PC.518 and 6.2RHR.402 January 22, 2005 January 28, 2005 January 29, 2005 March 4, 2003 March 7, 2003 December 1, 2001 RHR-MOV-MO57 Stroke 6.2RHR.201 April 12, 2005 January 30, 2005 November 9, 2004 Position 6.MISC.401 January 29, 2005 May 12, 2004 December 23, 2002 Leak 6.PC.518 January 24, 2005 March 5, 2003 December 11, 2001

Attachment A-5 RHR-MOV-MO274B Position 6.2RHR.402 January 29, 2005 March 7, 2003 December 1, 2001 Leak 6.PC.518 January 22, 2005 January 28, 2005 March 3, 2003 RHR-MOV-MO166B Leak 6.PC.518 January 23, 2005 March 3, 2003 December 13, 2001 RHR-CV-10CV Stroke 6.2RHR.401 November 13, 2001 October 31, 1995 March 21, 1990 RHR-CV-15CV Stroke 6.2RHR.101 April 13, 2005 January 30, 2005 November 9, 2004 RHR-CV-27CV Stroke 6.CSCS.402 January 21, 2005 March 21, 2003 May 30, 2003 Position 6.CSCS.403 January 21, 2005 March 2, 2003 November 29, 2001 Leak 6.PC.518 and 6.2RHR.402 January 22, 2005 January 28, 2005 January 29, 2005 March 3, 2003 March 7, 2003 December 1, 2001 RHR-RV-10RV Relief 7.2.35 November 23, 2001 May 13, 1997 November 5, 1991 RHR-RV-15RV Relief 7.2.35 March 10, 2003 October 29, 2003 March 12, 2000 RHR-RV-19RV Leak 6.PC.518 January 23, 2005 December 3, 2001 December 9, 2001 Calculation Title Revision NEDC 00-003 CNS AUX. Power System Load Flow and Voltage Analysis

Attachment A-6 NEDC 05-021 3PSI Tornado Pressure Effect for DG Building HVAC

NEDC 05-021 3PSI Tornado Pressure Effect for DG Building HVAC

NEDC 87-131A 250 VDC Division II Load and Voltage Study

NEDC 87-131B 250 VDC Division II Load and Voltage Study

NEDC 87-131C 125 VDC Division II Load and Voltage Study

NEDC 87-131D 125 VDC Division II Load and Voltage Study

NEDC 87-132A Plant AC Voltage Study

NEDC 91-043 Cable Impedance Calculation for 4160 VAC and 480 VAC

NEDC 91-197 Low Voltage Drywell Penetration Short Circuit Withstand Calculation

NEDC 93-104 Emergency Transformer Permissive Relay

NEDC 94-018 Critical Control Power Panels Calcs

NEDC 92-050N Reactor Vessel Level below Low Level Trip Setpoint Calculation

NEDC 94-067-018 Relief Valves RHR-RV-14RV & RHR-RV-15RV Sizing

NEDC 94-067-028 Relief Valves RHR-RV-10RV, RHR-RV-11RV, RHR-RV-12RV, RHR-RV-13RV NEDC 94-231 RHR Pumps NPSH/Maximum Flow Calculation

NEDC 94-258 Tech. Spec. acceptance criteria for LPCI pumps flowing at 7800 gpm.

NEDC 96-003 Pressure Locking Calculation - RHR-MOV-MO13A/B/C/D

NEDC 97-044A NPSH Margins for the RHR and CS pumps

NEDC 98-005 Minimum Flow Line Capacity for RHR Pumps during Single and Parallel Pump Operation

Notifications 000010308964 000010323451 000010323452 000010325213 000010333832 000010110178 000010356240 000010384705 000010384706 000010385090 000010384850 000010386278 Work Orders 4376000 4389436 4397110 4440677

Attachment A-7 Vendor VM-0396, Cooper Nuclear Station Vedor Manual Vent & Air Conditioner Units for OG, I, DG BLDG, Turbine Office Radiochem & Control Room, Revision 4 Technical Specifications Technical Specification 3.8.1, through Amendment No. 178 USAR Cooper Nuclear Station Updated Final Safety Analysis Report Memoranda K. Cohn to M. VanWinkle, Re: Item #161, dated May 17, 2005 K. Cohn to M. Baldwin et al., Re: State Estimator Alarm Changes, dated April 27, 2005 K. Cohn to S. Gocek et al., T2 Outage Information, dated April 26, 2005 K. Cohn to A. Bysfield, RE: Cooper Data, dated May 18, 2005 A. Mitchell to W. Victor, License Basis Application of the CNS Tornado Design Criteria to SSCs, dated May 12, 2005 Miscellaneous USA 50.59 Resource Manual, Revision 1a PSA-ES060, Risk Assessment of a Double-Sequencing Event, Revision 0 PRA02014, Risk Assessment of Proposed Actions in Procedure 5.3Grid, Revision 1, dated April 22, 2002 PRA05007, Risk Assessment for the T-2 Transformer Outage Starting April 29, 2005, dated April 26, 2005 Procedure Change Request for 5.3Grid Revision 1, dated 7/12/02 SSST & T2 OPS Contingencies, undated NPP1-PR-01, Station Blackout Coping Assessment for Cooper Nuclear Station, Revision 2 Cooper Nuclear Station Contingency Analysis Monitoring Reports, dated April 30, 2005 and May 1, 2005

Attachment A-8 SSST MIN/MAX Voltages During T-2 Outage, dated April 29, 2005 to May 1, 2005 Individual Plant Examination of External Events (IPEEE) Report -10CFR50.54(f) Cooper Nuclear Station, NRC Docket No. 50-298, License No. DPR-46 CNS Technical Program Health Reports for CNS IST Program for January, February and March 2005 Cooper Nuclear Station Inservice Testing Program Basis Document, Revision 5 and 5.1 Engineering Evaluation 02-035, Operational Abandonment of Residual Heat Removal Steam Condensing Mode, Revision 0 General Electric Specification, 22A1259, Standby AC Power, Revision 0 GE 234A9307NS, Rev 2, Instrument Data Sheet (PI-10-106A/B/C/D)

SKL012-42-23, Rev 19, OPS Residual Heat Removal SKL012-42-18, Rev 18, OPS Reactor Core Isolation Cooling SKL012-42-06, Rev 18, OPS Core Spray System CNS Technical Program Health Reports for CNS IST Program for January, February and March 2005 Cooper Nuclear Station Inservice Testing Program Basis Document, Revision 5 and 5.1 Engineering Evaluation 02-035, Operational Abandonment of Residual Heat Removal Steam Condensing Mode, Revision 0 General Electric Specification, 22A1259, Standby AC Power, Revision 0 Procedure Title Revision 5.3GRID Degraded Grid Voltage

5.3GRID Degraded Grid Voltage

5.3GRID Degraded Grid Voltage

5.3SBO Station Blackout

2.2.18 4160V Auxiliary Power Distribution System

6.EE.610 Off-Site AC Power Alignment

2.2.90 12.5 kV System

2.2.15 Startup Transformer

Attachment A-9 AP 2.4 SDC, Shutdown Cooling Abnormal

EOP 5.8.7 Primary Containment Flooding/Spray Systems

EOP 5.8.6 RPV Flooding Systems

EOP 5.8.4 Alternate Injection Subsystems

SOP 2.2A_125DC.DIV2 125 VDC Power Checklist

SOP 2.2.9 Core Spray System

SOP 2.2.69 Residual Heat Removal System

SOP 2.2.69.1 RHR LPCI Mode

SOP 2.2.69.2 RHR System Shutdown Operations

SOP 2.2.69.3 RHR Suppression Pool Cooling and Containment Spray

SOP 2.2.97 Torus Drain and Refill Operation

Drawings Drawing Number Title Revision DWG 2040 Flow Diagram, Residual Heat Removal Sys Loop B Sh. 2, N13 DWG 2510-4 RH-2 Residual Heat Removal N09 2624-1 RH-2 RHR Pump 1-A &1-C Discharge N06 2624-2 RH-2 Residual Heat Removal N22 2624-3-C RH-2 Residual Heat Removal N08 2625-1 RH-3 RHR Pump 1-C Suction N09 2625-2 RH-3 RHR Pump 1-A & 1-D Suction N09 2625-3 RH-3 RHR Pumps Suction N02 2625-4 RH-3 RHR Pump 1-B Suction N07 2626-1 RH-4 RHR Pumps 1-A & 1-C Suction N06 2626-2 RH-4 Residual Heat Removal N04 2626-201 RH-4 Residual Heat N01 CNS-HV-47 CNS Essential Control Building Ventilation Ductwork Support Location Control Building EL. 903-6 N01

Attachment A-10 E150 Sh. 7 Relay Settings for 4160V Bus1F N28 E150 Sh. 9 Relay Settings for 4160V Bus1G N30 E150 Sh. 16 Timer Settings for 4160V Swgr. 1E, 1F, 1G, and Miscellaneous Timers 453019154 Control Building Battery Room Exhaust Duct Revision

2024 Sh. 2 Flow Diagram HVAC Misc. Service Bldg N34 3001 Cooper Nuclear Station Main One Line N15 3002 Sh. 1 Cooper Nuclear Station Auxiliary One Line Diagram N33 3017 Sh. 1 4160V Switchgear Elementary Diagrams N10 3019 Sh. 3 4160V Switchgear Elementary Diagrams N28 3020 Sh. 4 4160V Switchgear Elementary Diagrams N19 3022 Sh. 6 4160V Switchgear Elementary Diagrams N29 3023 Sh. 7 4160V Switchgear Elementary Diagrams N16 3059 SH 9 EE-PNL-BB4, 125 VDC Load & Fuse Schedule N01 3059 SH 10 EE-PNL-AA5, 125 VDC Load & Fuse Schedule N01 3059 SH 11 EE-PNL-DG1, 125 VDC Load & Fuse Schedule N05 3059 SH 12 EE-PNL-DG2, 125 VDC Load & Fuse Schedule N08 791E261 Sh 1 Elementary Diagram - Residual Heat Removal System N15 791E261 Sh 2 Elementary Diagram - Residual Heat Removal System N12 791E261 Sh 3 Elementary Diagram - Residual Heat Removal System N124 791E261 Sh 4 Elementary Diagram - Residual Heat Removal System N16 791E261 Sh 5 Elementary Diagram - Residual Heat Removal System N17 791E261 Sh 6 Residual Heat Removal System N07 791E261 Sh 7 Elementary Diagram - Residual Heat Removal System N16 791E261 Sh 8 Residual Heat Removal System N19 791E261 Sh 9 Residual Heat Removal System N06 791E261 Sh 16 Residual Heat Removal System N07 791E261 Sh 17 Residual Heat Removal System N14 3038 DC One Line Diagram N47

Attachment A-11 3071 Control Elementary Diagram N23 0223R0558 Sh 25 Undervoltage Circuits 4160V Bus 1G & 1F N15 0223R0558 Sh 25A Undervoltage Circuits 4160V Bus 1F N06 0223R0558 Sh 25B Undervoltage Circuits 4160V Bus 1G N06 2221 HVAC - Plan & Sections Diesel Generator BLDG.

Heating Boiler Room N03 Surveillance Tests Surveillance Procedure 6.1EE.303, Emergency Bus Undervoltage (27) Relays Testing and Calibration (DIV 1), dated 3/19/03 Surveillance Procedure 6.EE.301, Emergency Bus Undervoltage Relays Testing and Calibration, dated 3/20/03 Surveillance Procedure 6.EE.301, Emergency Bus Undervoltage Relays Testing and Calibration (DIV 1), dated 4/2/03 Surveillance Procedure 6.1EE.303, Emergency Bus Undervoltage (27) Relays Testing and Calibration (DIV 1), dated 2/1/05 Surveillance Procedure 6.2EE.303, Emergency Bus Undervoltage (27) Relays Testing and Calibration (DIV 2), dated 4/3/03 Surveillance Procedure 6.2EE.303, Emergency Bus Undervoltage (27) Relays Testing and Calibration (DIV 2), dated 1/25/05 Surveillance Procedure 6.EE.301, Emergency Bus Undervoltage Relays Testing and Calibration, dated 1/25/05 Surveillance Procedure 6.EE.301, Emergency Bus Undervoltage Relays Testing and Calibration, dated 2/1/05 NRC Documents Cooper Nuclear Station - NRC Integrated Inspection Report 05000298/2004002, dated May 6, 2004 Cooper Nuclear Station - Safety Evaluation of the Response to the Station Blackout Rule (TAC No. 68534), dated August 22, 1991 Nebraska Public Power District Operations Guidelines, Cooper Nuclear Station - Black Plant Procedure, dated October 22, 2004 Staff Evaluation Report Related to Individual Plant Examination of External Events (IPEEE)

Nebraska Public Power District, et. al. Cooper Nuclear Station Docket No. 50-298