IR 05000298/2011010

IR 05000298-11-010, on 11/28/2011 - 12/01/2011, Cooper Nuclear Station, Supplemental Inspection - Inspection Procedure (IP) 95001

ML113570417
Person / Time
Site:	Cooper
Issue date:	12/23/2011
From:	Geoffrey Miller NRC/RGN-III/DRS/EB2
To:	O'Grady B Nebraska Public Power District (NPPD)
References
IR-11-010
Download: ML113570417 (18)

Text

UNITED STATES NU C LE AR RE G ULATO RY C O M M I S S I O N ber 23, 2011

SUBJECT:

COOPER NUCLEAR STATION - NRC INSPECTION PROCEDURE 95001 SUPPLEMENTAL INSPECTION REPORT 05000298/2011010

Dear Mr. OGrady:

On December 1, 2011, the U.S. Nuclear Regulatory Commission (NRC) completed a supplemental inspection pursuant to Inspection Procedure 95001, Supplemental Inspection for One or Two White Inputs in a Strategic Performance Area, at your Cooper Nuclear Station.

The enclosed inspection report documents the inspection results, which were discussed on December 1, 2011, with you and other members of your staff.

In accordance with the NRC Reactor Oversight Process Action Matrix, this supplemental inspection was performed to follow-up on a White finding with low to moderate safety significance which was documented in the first quarter of 2011. This issue was previously documented and assessed in NRC Inspection Reports 05000298/2010006 and 05000298/2011009. The NRC was informed by phone on October 20, 2011, of your staffs readiness for this inspection.

The objectives of this supplemental inspection were to provide assurance that: (1) the root causes and the contributing causes for the risk-significant issues were understood; (2) the extent of condition and extent of cause of the issues were identified; and (3) corrective actions were or will be sufficient to address and preclude repetition of the root and contributing causes.

The NRC determined that the staff at Cooper Nuclear Station performed an acceptable evaluation of the White finding. The evaluation identified the primary root cause of the issue to be the lack of a protocol to physically validate assumptions embedded within the post-fire safe shutdown procedures. The evaluation identified that the extent of cause included other emergency procedures which have not been physically tested to validate that they work as intended. Your staff took immediate corrective actions to modify the post-fire safe shutdown

Nebraska Public Power - Cooper -2-procedures to ensure that operators could safely shutdown the plant. In addition, your staff is executing an improved procedure validation protocol to demonstrate the emergency procedures contained in the extent of cause will work as intended. Finally, your staff is planning to implement a plant modification for 28 motor-operated valves that will remove the need for operators to manipulate the valves by manually depressing their associated motor contactors/starters.

The NRC has determined that the inspection objectives stated above have been met.

Therefore, in accordance with IMC 0305, Operating Reactor Assessment Program, the performance issue shall not be considered in the Action Matrix after the end of the fourth quarter of 2011.

No findings were identified during this inspection.

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Geoffrey B. Miller, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos.: 50-298 License Nos: DPR-46

Enclosure:

Inspection Report 05000298/2011010 w/Attachment: Supplemental Information

REGION IV==

Docket: 50-298 License: DRP-46 Report: 05000298/2011010 Licensee: Nebraska Public Power District Facility: Cooper Nuclear Station Location: 72676 648A Ave Brownville, NE 68321 Dates: November 28 through December 1, 2011 Inspectors: S. Alferink, Reactor Inspector E. Uribe, Reactor Inspector Approved By: Geoffrey Miller, Chief Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

Inspection Report (IR) 05000298/2011010; 11/28/2011 - 12/01/2011; Cooper Nuclear Station;

Supplemental Inspection - Inspection Procedure (IP) 95001 Two regional inspectors performed this inspection. No findings were identified.

Cornerstone: Mitigating Systems

The NRC staff performed this supplemental inspection in accordance with IP 95001, Inspection of One or Two White Inputs in a Strategic Performance Area, to assess the licensees evaluation associated with the repeated failure to ensure that some steps contained in emergency procedures would work as written. The NRC staff previously characterized this issue as having low to moderate safety significance (White), as documented in Inspection Reports 05000298/2010006 and 05000298/2011009.

The inspectors determined that the licensees evaluations and corrective action plan for the White finding were adequate. The evaluation identified the primary root cause of the issue to be the lack of a protocol to physically validate assumptions embedded within the post-fire safe shutdown procedures. The evaluation identified that the extent of cause included other emergency procedures which have never been physically tested to validate that they work as intended. The licensee was in the process of executing an improved procedure validation protocol to demonstrate the emergency procedures contained in the extent of cause will work as intended. The licensee also plans to implement a plant modification for 28 motor-operated valves that will remove the need for operators to manipulate the valves by manually depressing their associated motor contactors/starters.

The inspectors identified three weaknesses in the licensees evaluations. First, the inspectors noted that Root Cause Evaluation 2010-08193 initially focused the problem statement and extent of condition on the post-fire safe shutdown procedures and initially failed to identify a 28th valve (CS-MO-12B) which was operated in a similar manner in a B.5.b mitigating strategy, but was not used in the post-fire safe shutdown procedures. Second, the inspectors identified a lack of clear documentation associated with the extent of condition in Root Cause Evaluation 2010-08193. Specifically, the inspectors noted that the root cause evaluation listed one model number for the contactors, although there were unique model numbers for the open and closed contactors for the AC starters. Third, the inspectors identified that Root Cause Evaluation 2010-08242 had too narrow of a focus in that the evaluation only focused on the post-fire safe shutdown manual actions and procedures. The inspectors agreed that the root cause was associated with a breakdown in the modification process in 1985, but determined that this breakdown was not specific to the validation of the Appendix R manual actions. The licensee captured the inspectors concerns in their corrective action program.

Given the licensees acceptable performance in addressing the White finding, this issue will be removed from consideration in assessing plant performance in accordance with Manual Chapter 0305, Operating Reactor Assessment Program. Inspectors will review the licensees implementation of corrective actions during a future inspection.

Findings No findings were identified.

REPORT DETAILS

4OA4 Supplemental Inspection

.01 Inspection Scope

The NRC staff performed this supplemental inspection in accordance with Inspection Procedure (IP) 95001 to assess the licensees evaluation of a White finding, which affected the mitigating systems cornerstone in the reactor safety strategic performance arena. The inspection objectives were to:

• provide assurance that the root and contributing causes of risk-significant issues were understood;

• provide assurance that the extent of condition and extent of cause of risk-significant issues were identified; and

• provide assurance that the licensees corrective actions for risk-significant issues were or will be sufficient to address the root and contributing causes and to preclude repetition.

The licensee entered the Regulatory Response Column of the NRCs Action Matrix in the first quarter of 2011 as a result of one inspection finding of low to moderate safety significance (White). This finding was associated with the repeated failure to ensure that some steps contained in emergency procedures would work as written. The NRC staff previously characterized this issue in Inspection Reports 05000298/2010006 and 05000298/2011009.

The licensee staff informed the NRC staff by phone on October 20, 2011, that they were ready for the supplemental inspection. In preparation for the inspection, the licensee performed two root cause evaluations in order to identify weaknesses that resulted in a risk-significant finding. The first evaluation, Root Cause Evaluation 2010-08193, addressed the failure of the licensees corrective actions to identify the procedure deficiencies. The second evaluation, Root Cause Evaluation 2010-08242, explored the history of the motor control center starter designs and addressed the introduction of the initial procedure error.

The inspectors reviewed the licensees root cause evaluations in addition to other evaluations and assessments conducted in support and as a result of the root cause evaluations. The inspectors reviewed corrective actions taken or planned to address the identified causes. The inspectors also held discussions with licensee personnel to ensure that the root and contributing causes were understood and corrective actions taken or planned were appropriate to address the causes sufficiently to preclude repetition. The inspectors performed a plant walkdown to independently verify the model numbers of the contactors/starters installed in the plant to the list of contactors contained in the root cause evaluation.

.01 Problem Identification

a. IP 95001 requires that the inspection staff determine that the licensees evaluation of the issue documents who identified the issue (i.e., licensee-identified, self-revealing, or NRC-identified) and the conditions under which the issue was identified.

During the 2010 triennial fire protection inspection, the team expressed concerns that some of the post-fire safe shutdown procedure steps could not be reliably performed by the operators because personal protective equipment might not allow access to the recessed contactors. In response to this concern, the licensee used spare contactors and performed a demonstration for the team. During this demonstration, operators were unable to operate one of the contactors in question. The inspectors verified that this information was included in the licensees root cause evaluations.

b. IP 95001 requires that the inspection staff determine that the licensees evaluation of the issue documents how long the issue existed and prior opportunities for identification.

The licensee determined that this issue existed since 1985, when the licensee installed the Size 2 DC contactors as part of a modification to implement environmental qualification requirements. The licensee had several opportunities to identify the procedure deficiencies that included procedure verification and validation following the 2007 triennial fire protection White finding, the 1996-1997 safe shutdown analysis report reanalysis, and procedure change implementation. The licensee also identified several other missed opportunities during self-assessments, audits, corrective actions, and training development and delivery. The inspectors determined that the licensees evaluation was adequate with respect to identifying how long the issue existed and prior opportunities for identification.

c. IP 95001 requires that the inspection staff determine that the licensees evaluation documents the plant specific risk consequences, as applicable, and compliance concerns associated with the issue.

The NRC characterized this issue as having low to moderate safety significance (White),as documented in Inspection Reports 05000298/2010006 and 05000298/2011009. The risk significance of this issue was determined by the failure of the three valves controlled by Size 2 DC contactors. The licensee noted that the failure of the valves to operate during fire scenarios could cause the consequences of the fire to be more severe. The inspectors determined that the licensee appropriately documented the risk consequences and compliance concerns associated with this issue.

d. Findings

No findings were identified.

.02 Root Cause, Extent of Condition, and Extent of Cause Evaluation

a. IP 95001 requires that the inspection staff determine that the licensee evaluated the issue using a systematic methodology to identify the root and contributing causes.

The licensee used the following systematic methods to complete the root cause evaluations:

• data gathering through interviews and document review,

• timeline construction,

• barrier analysis, and

• event and causal factor charting.

The inspectors determined that the licensee evaluated the issue using a systematic methodology to identify root and contributing causes.

b. IP 95001 requires that the inspection staff determine that the licensees root cause evaluation was conducted to a level of detail commensurate with the significance of the issue.

The licensee performed two root cause evaluations for this White finding. The licensees root cause evaluations included an extensive timeline of events, a barrier analysis, and an event and causal factor charting as discussed in the previous section.

The first evaluation, Root Cause Evaluation 2010-08193, addressed the failure of the licensees corrective actions to identify the procedure deficiencies. These corrective actions were implemented in response to a similar White finding from the 2007 triennial fire protection inspection. This evaluation identified the root cause to be the lack of a protocol to physically validate assumptions embedded within the post-fire safe shutdown procedures and a contributing cause to be the deficient use of precursor events to detect recurring problems.

The second evaluation, Root Cause Evaluation 2010-08242, explored the history of the motor control center starter designs and addressed the introduction of the initial procedure error. This evaluation identified the root cause to be a breakdown in the modification process in 1985 due to insufficient guidance for identification and validation that design features for Appendix R manual actions were not unintentionally altered.

The inspectors determined that the licensees root cause evaluations were conducted, in general, to a level of detail commensurate with the significance of the issue. However, the inspectors did note two weaknesses in the licensees evaluations associated with the level of detail.

First, the inspectors identified a lack of clear documentation associated with the extent of condition in Root Cause Evaluation 2010-08193. The inspectors performed a plant walkdown and compared the model numbers of the contactors/starters installed in the

plant to the list of contactors contained in the root cause evaluation. The inspectors noted that the root cause evaluation listed one model number for the contactors, although there were unique model numbers for the open and closed contactors for the AC starters. The root cause evaluation failed to note that there were different model numbers for the two contactors and that some valves are opened and others closed in the post-fire safe shutdown procedures. In response to the inspectors concerns, the licensee contacted the vendor and verified that the two models are essentially the same

- the only difference was the presence of a thermal overload attached to the open contactor. The licensee also installed the two contactors not previously tested at the Sheridan training facility and demonstrated that the contactors performed the same.

Second, Root Cause Evaluation 2010-08242 explored the history of the motor control center starter designs and addressed the introduction of the initial procedure error. The licensees evaluation focused on manual actions credited for achieving safe shutdown after a fire. The licensee identified the root cause to be a breakdown in the modification process in 1985 due to insufficient guidance for identification and validation that design features for Appendix R manual actions were not unintentionally altered. The inspectors noted that the licensees evaluation was narrowly focused on only the post-fire safe shutdown manual actions and procedures. The inspectors agreed that the root cause was associated with a breakdown in the modification process in 1985 but determined that this breakdown was not specific to the validation of the Appendix R manual actions.

Specifically, the inspectors noted that the licensee had a remote shutdown procedure (not related to the fire protection program) which operated a motor-operated valve by manually depressing its associated motor contactor/starter. The inspectors noted that the licensee was aware of this valve operation, but the modification process failed to ensure that the new starters/contactors maintained this specific design feature. The licensee characterized this failure as a process issue and has implemented changes to various procedures to include a thorough review by different departments. The licensee has also identified various root causes and plans to implement corrective actions to prevent recurrence by the next refueling outage.

c. IP 95001 requires that the inspection staff determine that the licensees root cause evaluation included a consideration of prior occurrences of the issue and knowledge of operating experience.

The licensees root cause evaluations included an evaluation of internal and external operating experience. The licensee considered prior occurrences and operating experience. The licensee noted at least five condition reports related to the post-fire safe shutdown procedures. The licensee also reviewed six industry operational experience items which were related, but not directly applicable, to this issue. As a result of this review, the licensee determined that a contributing cause for this issue was the deficient use of precursor events to detect recurring problems. The inspectors determined that the licensees root cause evaluations included appropriate consideration of prior occurrences of the issue and knowledge of operating experience.

d. IP 95001 requires that the inspection staff determine that the licensees root cause evaluation addresses the extent of condition and extent of cause of the issue(s).

The licensees evaluations considered the extent of condition and extent of cause of the issue. In Root Cause Evaluation 2010-08193, the licensee identified that the extent of condition included other emergency operating procedures and abnormal operating procedures that may be unreliable during execution. In this evaluation, the licensee identified that the extent of cause included other emergency procedures which have never been physically tested to validate that they work as intended.

In Root Cause Evaluation 2010-08242, the licensee identified that the extent of condition included 27 motor-operated valves that were operated by manually depressing their associated motor contactors/starters. In this evaluation, the licensee identified that the extent of cause could extend to other processes where alternative components are approved for installation in the plant without identification and validation of design features for Appendix R credited manual actions.

The inspectors determined that the licensees root cause evaluations adequately addressed the extent of condition and extent of cause of the issue. However, the inspectors did note a weakness in the licensees evaluations associated with the extent of condition.

The inspectors noted that Root Cause Evaluation 2010-08193 initially focused the problem statement and extent of condition on the post-fire safe shutdown procedures.

The licensee identified that this condition existed for 27 motor-operated valves that were operated by manually depressing their associated motor contactors/starters in the post-fire safe shutdown procedures. During the planned modification review process, the licensee identified a 28th valve (CS-MO-12B) which was operated in a similar manner for a B.5.b mitigating strategy, but was not used in the post-fire safe shutdown procedures.

The inspectors noted that this valve should have been identified during the licensees extent of condition review and the licensee had not written a condition report documenting the initial failure to identify this valve. The inspectors determined that this valve was not operated by a Size 2 DC contactor; therefore, the inspectors concluded that this valve would have operated as intended during the B.5.b mitigating strategy.

e. IP 95001 requires that the inspection staff determine that the licensees root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in Inspection Manual Chapter 0310.

In Root Cause Evaluation 2010-08193, the licensee found a weakness in the cross-cutting area of Human Performance, specifically in the component of Decision Making.

Specifically, the licensee noted that the assumptions in the post-fire safe shutdown procedures had not been field tested, and prior to the NRC raising the issue, the licensee had no plans to test them in a mock-up or similar situation. This weakness correlates to the H.1(b) cross-cutting aspect described in Manual Chapter 0310, dated October 28, 2011.

In Root Cause Evaluation 2010-08242, the licensee found a weakness in the cross-cutting area of Human Performance, specifically in the component of Resources. The licensee noted that the necessary process guidance for evaluation or plant modifications for fire protection impact was not in place. This weakness corresponds to the H.2(c)cross-cutting aspect described in Manual Chapter 0310, dated October 28, 2011.

The inspectors determined that the licensees root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in Inspection Manual 0310.

f. Findings

No findings were identified.

.03 Corrective Actions

a. IP 95001 requires that the inspection staff determine that

(1) the licensee specified appropriate corrective actions for each root and/or contributing cause, or

(2) an evaluation that states no actions are necessary is adequate.

The licensee took immediate corrective actions to modify the post-fire safe shutdown procedures to ensure that operators could safely shutdown the plant. To address the root cause from Root Cause Evaluation 2010-08193, the licensee was in the process of executing an improved procedure validation protocol to demonstrate the emergency procedures contained in the extent of cause will work as described. The licensee also developed a plant modification for 28 motor-operated valves that will remove the need for operators to manipulate the valves by manually depressing their associated motor contactors/starters. The licensee committed to completing this modification prior to startup from Refueling Outage 27.

To address the contributing cause from this evaluation, the licensee planned to incorporate guidance for apparent cause evaluations to include operating experience search guidance from Entergy Procedure EN-LI-119, Apparent Cause Evaluation (ACE)

Process, Attachment 9.6.

Although not credited as a corrective action, the licensee is also planning to address the use of operator manual actions during their transition to a risk-informed performance-based fire protection program, as described in NFPA-805.

To address the root cause from Root Cause Evaluation 2010-08242, the licensee revised Procedures EDP-06, Supporting Requirements for Configuration Change Control, and ESDP-05.3, Fire Protection Review of Plant Changes, to ensure the potential impact of plant changes on the functionality of design features associated with operator manual actions are appropriately recognized and considered.

The inspectors determined that the proposed corrective actions were appropriate to address each root and contributing cause.

b. IP 95001 requires that the inspection staff determine that the licensee prioritized corrective actions with consideration of risk significance and regulatory compliance.

The licensees immediate corrective actions ensured that operators could safely shutdown the plant in the event of a fire. The licensees corrective actions to address the root and contributing causes were prioritized in accordance with Administrative Procedure 0.5, Conduct of the Condition Report Process. The licensee gave the highest priority to actions of an immediate nature and established a schedule of actions to resolve the other program, design, training, and procedure weaknesses.

The inspectors determined that the licensee appropriately prioritized the corrective actions with consideration of risk significance and regulatory compliance.

c. IP 95001 requires that the inspection staff determine that the licensee established a schedule for implementing and completing the corrective actions.

The licensee established due dates for the corrective actions in accordance with their corrective action program. The licensee captured the due dates in the two root cause evaluations as well as the corrective action program.

The inspectors determined that the licensee established a schedule for implementing and completing the corrective actions.

d. IP 95001 requires that the inspection staff determine that the licensee developed quantitative and/or qualitative measures of success for determining the effectiveness of the corrective actions to prevent repetition.

The licensees corrective action program required an evaluation of the effectiveness of the corrective actions that were identified as corrective actions to prevent recurrence.

The root cause evaluations specified an effectiveness review plan for the corrective actions to prevent recurrence. The effectiveness review plan specifies the method, attributes, success criteria, and timeliness for the review.

The inspectors determined that the licensee developed appropriate qualitative measures of success for determining the effectiveness of the corrective actions to preclude repetition.

e. IP 95001 requires that the inspection staff determine that the licensees planned or taken corrective action adequately address a Notice of Violation that was the basis for the supplemental inspection, if applicable.

The NRC issued a Notice of Violation to the licensee on June 10, 2011. The licensee provided the NRC a written response to the Notice of Violation on July 8, 2011. The licensees response described:

(1) corrective steps which have been taken and the results achieved,

(2) corrective steps which will be taken,

(3) the date when full compliance will be achieved, and

(4) the reasons for the violation. During this inspection, the inspectors confirmed that the licensees root cause evaluations and planned and taken corrective actions addressed the Notice of Violation. The licensee restored full compliance on November 5, 2010, by completing their immediate corrective actions and ensuring that operators could safely shutdown the plant in the event of a fire.

f. Findings

No findings were identified.

.04 Evaluation of IMC 0305 Criteria for Treatment of Old Design Issues

The licensee did not request credit for self-identification of an old design issue; therefore, the risk-significant issue was not evaluated against the IMC 0305 criteria for treatment of an old design issue.

4OA5 Other Activities

(Closed) Violation 05000298/2011009-01: Inadequate Post-Fire Safe Shutdown Procedure (EA-11-024)

The inspectors reviewed the licensees immediate corrective actions and planned plant modification. The inspectors noted that the planned modification would install isolation/transfer switches and control switches to the 28 valves that were operated by manually depressing their associated motor contactors/starters. The inspectors determined that this modification would, if implemented as described, eliminate the need for operators to manipulate these valves by manually depressing their associated motor contactors/starters as well as provide operators with an indication of the valve position.

This violation is closed.

4OA6 Exit Meeting

On December 1, 2011, the inspectors presented the inspection results to Mr. B.

OGrady, Vice President-Nuclear and Chief Nuclear Officer, and other members of his staff, who acknowledged the results. Mr. N. OKeefe, Branch Chief,conducted a Regulatory Performance Meeting during the exit meeting. The inspectors asked the licensee if any of the material examined during the inspection should be considered proprietary. The licensee did not identify any propriety information.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Bergmeier, Operation Support Group Supervisor

K. Billesbach, Materials, Purchasing, and Contracts Manager

D. Buman, Director of Engineering

J. Dykstra, Electrical Engineering Program Supervisor

J. Flaherty, Senior Licensing Engineer

B. OGrady, Vice President-Nuclear and Chief Nuclear Officer

R. Penfield, Operations Manager

R. Rexroad, Electrical Engineer

D. Van Der Kamp, Licensing Manager

D. Willis, General Manager Plant Operations

A. Zaremba, Director of Nuclear Safety Assurance

NRC Personnel

J. Josey, Senior Resident Inspector

LIST OF ITEMS

OPEN, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

None

Closed

05000298/2011009-01 VIO Inadequate Post-Fire Safe Shutdown Procedures (EA-11-024)

Discussed

None

-1- Enclosure