IR 05000298/2018011
| ML18163A201 | |
| Person / Time | |
|---|---|
| Site: | Cooper |
| Issue date: | 06/13/2018 |
| From: | Thomas Farnholtz Region 4 Engineering Branch 1 |
| To: | Dent J Nebraska Public Power District (NPPD) |
| References | |
| IR 2018011 | |
| Preceding documents: |
|
| Download: ML18163A201 (32) | |
Text
June 13, 2018
SUBJECT:
COOPER NUCLEAR STATION - NRC DESIGN BASES ASSURANCE (TEAMS)
INSPECTION REPORT 05000298/2018011
Dear Mr. Dent,
Jr.:
On April 19, 2018, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Cooper Nuclear Station. On April 30, 2018, the NRC inspectors discussed the results of this inspection with Mr. Dan Buman, Director of Nuclear Safety Assurance and other members of your staff. The results of this inspection are documented in the enclosed report.
NRC inspectors documented four findings of very low safety significance (Green) in this report.
These findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy.
If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspectors at the Cooper Nuclear Station.
If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspectors at the Cooper Nuclear Station.
J. Dent, Jr.
This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely,
/RA/
Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety
Docket: 50-298 License: DPR-46
Enclosure:
Inspection Report 05000298/2018011 w/ Attachment:
Detailed Risk Analysis for NCV 2018011-02
Enclosure
U.S. NUCLEAR REGULATORY COMMISSION
Inspection Report
Docket Number:
05000298
License Number:
Report Number:
Enterprise Identifier: I-2018-011-0011
Licensee:
Nebraska Public Power District
Facility:
Cooper Nuclear Station
Location:
Brownville, Nebraska
Inspection Dates:
April 2, 2018, to April 30, 2018
Inspectors:
G. George, Senior Reactor Inspector, Region IV, Team Lead
W. Cullum, Reactor Inspector, Region IV
R. Deese, Senior Reactor Analyst, Region IV
S. Hedger, Emergency Preparedness Inspector, Region IV
M. Riley, Reactor Inspector, Region II
J. Leivo, Contractor, Beckman and Associates
M. Yeminy, Contractor, Beckman and Associates
Approved By:
T. Farnholtz, Chief
Engineering Branch 1
Division of Reactor Safety
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a Design Bases Assurance (Teams) inspection at Cooper Nuclear Station in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors.
Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information. Findings and violations being considered in the NRCs assessment are summarized in the table below.
List of Findings and Violations
Failure to Correct Extent of Condition of Surge Suppression Varistor Failures Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-01 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, occurred when the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.
Failure to Ensure Adequate Design Control Measures are in Place Associated with RHR Service Water Booster Pump Room Cooling Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-02 Closed H.6 - Human Performance,
Design Margins 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to incorporate malfunctions of the residual heat removal (RHR) service water booster pump (SWBP) room cooling temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained.
Inadequate Design Basis Calculation for the EDG Rooms Temperature Distribution Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-03 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for the licensees failure to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers.
Incorrect Classification of Potential Safety-Related Components Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-04 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the inspectors identified three examples of the licensees failure to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems.
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs)in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html.
Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.
REACTOR SAFETY
===71111.21MDesign Bases Assurance Inspection (Teams)
From April 2, 2018, to April 30, 2018, the inspectors reviewed the following design attributes associated with risk-significant components, permanent plant modifications, and operating experience.
Components===
- (1) 4160V Switchgear 1F
a) Component maintenance history and corrective action program reports
b) Electrical distribution and system load flow/voltage drop calculations
c) Procedures for circuit breaker preventive maintenance, inspection, and testing
d) Equipment qualification specifications
e) Surveillance testing of the loss-of-offsite power instrumentation
- (2) Emergency Diesel Generator 1B
a) Design requirements within purchase and manufacturing specifications
b) Surveillance and inservice tests of the air starting subsystem and check valves
c) Surveillance tests of the Fuel Oil subsystem including pumps and level switches
d) Surveillance tests and acceptance criteria of the diesel generator room ventilation system
e) Design calculations of the capacity of air starting system, fuel oil supply system, and room ventilation system
f) Component maintenance history and corrective action program reports g) Failure mode effects of non-safety related pressure relief dampers on diesel generator operation
h) Design piping, electrical, and instrumentation drawings
- (3) Residual Heat Removal Pump A
a) Component maintenance history and corrective action program reports
b) Calculations for net positive suction head, maximum flow, and pump performance
c) Inservice test procedures and vendor recommendations for testing frequency
d) Pump curves
e) Heat exchanger thermal performance test procedures and data
- (4) Reactor protection system relays for scram discharge volume high level, K1, and reactor vessel low level discharge volume high level, K6A and K6B:
a) Component maintenance history and a sample of corrective action documents
b) Calculations for instrument uncertainties and setpoints
c) Elementary, instrument loop, and instrument piping diagrams
d) Device ratings for the components and auxiliary devices
e) Surveillance procedures and results for calibration, functional tests, and response tests
f) Maintenance procedures and results of preventive maintenance, inspection, and post-maintenance tests
g) Visual inspection of environment and material condition of the relays
Component Large Early Release Frequency (LERF) (1 Sample)
- (1) Residual Heat Removal Service Water Booster Pump A:
a) Calculations for room heating, ventilation, and cooling
b) Operating procedures for pump operation during a design bases loss-of-coolant accident coincident with a loss-of-offsite power
c) Pump temperature ratings and pump cooling requirements
d) Calibration and testing history of temperature switches used to indicate high room temperature e) Qualifications of emergency cooling unit and temperature switch associated with room cooling
Permanent Modifications (4 Samples)
- (1) Change Evaluation Document 6024460, 4kV Breaker Auxiliary Switch Removal
- (2) Change Evaluation Document 6028860, Alternate Decay Heat Removal Subsystem
- (3) Change Evaluation Document 6039040, Relocation of Shutdown Cooling Isolation Function
- (4) Change Evaluation Document 6039501, Reactor Protection System Test Box
Operating Experience (3 Samples)
- (1) NRC Information Notice 2010-27, Ventilation System Preventive Maintenance and Design Issues
- (2) NRC Bulletin BL-88-04, Potential Safety-Related Pump Loss
- (3) NRC Information Notice 2016-01, Recent Issues Related to the Commercial Grade Dedication of Allen Bradley 700-RTC Relays
Evaluation of Inspection Sample Related Operator Procedures and Actions
- (1) Control room operator actions resulting from a simulated break in the service water system header while operating RHR service water booster pump and RHR pumps in suppression pool cooling mode.
a) Control room crew were expected to enter procedures to address flooding in the control building basement.
b) From receipt time of first control building flooding level alarm, actions to secure the RHR service water booster pump and affected train service water pumps were to be completed within 10 and 30 minutes, respectively.
- (2) Operations support center maintenance staff actions resulting from a design basis loss-of-coolant accident to install turbine stop valve shaft adjustment tools as part of aligning the licensees alternate leakage treatment pathway configuration.
a) Qualified staff were expected to implement the procedure attachment for installing the shaft adjustment tools.
b) Qualified staff were expected to use the designated tools for this task to install the tools within 30 minutes of entering the turbine building.
- (3) Operations support center actions resulting from a design basis loss-of-coolant accident or loss-of-offsite power event to establish a natural circulation cooling for the RHR service water booster pump room.
a) Qualified staff were directed to develop natural circulation ventilation for the RHR service water booster pump room using procedure 2.3_R-1, Panel/Window: R-1/E-7, Section 1.3.2.
b) From the receipt of the associated RHR service water booster pump room high temperature alarm, qualified staff were directed by procedure to establish the ventilation flow path within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
INSPECTION RESULTS
Failure to Correct Extent of Condition of Surge Suppression Varistor Failures Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-01 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, occurred when the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.
Description:
The inspectors requested design documents supporting the basis for the application and ratings of the electrical surge suppression varistors shown in the 120 Vac reactor protection system (RPS) control circuits elementary diagram 454005876, Revision 22, for certain General Electric Type HFA relays. The licensee provided the following information. From the following information, the inspectors identified:
- Reactor protection system elementary diagram 454005876, Revision 22, identified a device voltage rating of 175 Vdc. The inspectors identified that no reference to a design specification or a traceable model number was documented to provide critical specifications or qualifications, such as Joule (energy dissipation) ratings.
- Minor design change MDC 74-31, Voltage Transient Suppression, performed in 1974, allowed the use of surge suppression metal oxide varistors at the discretion of engineering. The MDC 74-31 identified a Special Precaution to verify the General Electric metal oxide varistor is rated for the circuit in which it is applied. The inspectors determined there was no evidence of verification or acceptance criteria for the selection, test, or installation of the devices as stipulated in the Special Precaution and Acceptance Test Procedure of MDC 74-31.
The inspectors determined that no design specifications or analyses for selection or application were available for surge suppressor varistors, for certain General Electric Type HFA relays used in RPS. The devices were shown symbolically on the RPS diagrams, but the diagrams did not present or reference sufficient detail that would provide a link to the complete specifications or a model number for the device, as well as a design basis for its selection and application.
In addressing the inspectors concerns, the licensee provided Condition Report RCR 2002-1665, dated September 11, 2002. This condition report documented a NRC-identified, NCV 50-298/0015-02 and associated condition adverse to quality for the, failure to document and maintain a design standard for surge suppression varistors in the Division 2 emergency diesel [generator] control circuit. As documented in the NCV and Condition Report RCR 2002-1665, the use of incorrect values for these components caused the generator to frequently trip during the shutdown process and thereby be unavailable for immediate restart. The licensees apparent cause evaluation concluded that improperly sized and rated metal oxide varistors installed as surge suppressors resulted in a spurious overspeed trip. The immediate corrective action included the replacement of the varistor in the emergency diesel generator control circuit. However, the condition report identified an extent of condition existed beyond the diesel control circuit, as well as programmatic issues, including unresolved design control issues for surge suppressors.
To correct the extent of condition, the two corrective actions identified in Condition Report RCR 2002-1665 were:
- Revise [Maintenance Procedure] 7.3.16, Low Voltage Relay Removal and Installation, to require Engineering to verify that installed varistors, when found, are appropriately sized and design information is correctly reflected in controlled drawings. The due date was March 1, 2003.
- Revise the RPS, DG, and HPCI elementary diagrams to include appropriate design information of installed varistors. The due date was May 1, 2003.
Based on the documents provided during the inspection, the inspectors concluded that these corrective actions had never been effectively implemented. The requirement for engineering to verify the suitability of the ratings was not incorporated in the current revision of Maintenance Procedure 7.3.16 or in other revisions since the corrective action due date.
Additionally, the appropriate design information for surge suppressors was not completely reflected on drawings either directly or by reference. For example, the voltage rating was identified on the drawings, but additional critical characteristics such as Joule ratings or model numbers were not presented or referenced.
Corrective Actions: The licensee performed a historical search to identify surge suppression varistor applications in safety-related control circuits. The licensee then performed informal and bounding calculations based on first principles and component vendor data for the relays, and installed metal oxide varistors. The team concluded that the results of the informal calculations provided reasonable assurance that the surge suppression varistor ratings had ample margin and were suitable for their application and service.
Corrective Action References: Condition Reports CR-CNS-2018-02331 and CR-CNS-2018-02374
Performance Assessment:
Performance Deficiency: The inspectors determined that the failure to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings was a performance deficiency.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.
Specifically, the failure to establish, implement, and maintain a design standard for surge suppression varistors used in safety-related control circuits could result in unsuitable selection and application of the device, such that failure of the device could result in shorting of a normally energized relay coil changing the systems to an undesirable state.
Significance: Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, dated June 19, 2012, the inspectors determined that this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a structure, system, or component and operability was maintained.
Cross-cutting Aspect: The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.
Enforcement:
Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.
Contrary to the above, from September 11, 2002, to April 19, 2018, the licensee failed to establish measures to assure that conditions adverse to quality were promptly corrected.
Specifically, the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665, to verify that installed surge suppressor varistors were appropriately sized, and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.
Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.
Failure to Ensure Adequate Design Control Measures are in Place Associated with RHR Service Water Booster Pump Room Cooling Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-02 Closed H.6 - Human Performance, Design Margins 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to incorporate malfunctions of the RHR service water booster pump room cooling temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained.
Description:
During a design basis loss-of-cooling accident, the licensee operates the RHR service water booster pump system to provide cooling to the RHR system without an uncontrolled release of radioactive material to the environment. The systems design bases, as stated in Cooper Nuclear Station Updated Safety Analysis Report (USAR) Chapter X, Section 8.2.2, includes the following:
- No single system component active failure shall be able to prevent the system from achieving its safety objective.
- The system shall provide an adequate supply of cooling water to the RHR system under all accident and transient conditions.
Standard IEEE 279-1971 provides expectations on what constitutes the plants design basis and defines the single failure criterion. As part of the design basis minimum elements, Section 3(8) states that the following shall be documented:
[T]he malfunctions, accidents, or other unusual eventswhich could physically damage protection system components or could cause environmental changes leading to functional degradation of system performance, and for which provisions must be incorporated to retain necessary protection system action.
Section 4.2 states:
Any single failure within the protection system shall not prevent proper protection system action when required.
Notes further state:
Single failure includes such events as the shorting or open-circuiting of interconnecting signal or power cables. It also includes single credible malfunctions or events that cause a number of consequential component, module, or channel failures.
During a design basis accident, the RHR service water booster pump system room is cooled by the RHR service water booster pump room fan coil unit or by manual operator actions.
The cooling methods, described in USAR Chapter X, Section 10.3.5.4, include the following:
- The fan coil unit is normally cooled by a recirculation loop to a cooling tower.
- If the recirculation loop is not available, the cooling coils can be manually aligned with service water.
- Acceptable room temperatures can be maintained for a single RHR service water booster pump without forced ventilation through operator action to reduce the room heat load and establishment of a natural ventilation flow path.
The cooling tower described in the USAR has not been functional since the late 1980s. On July 29, 2016, the fan coil unit was tagged out of service, to facilitate removal of the cooling tower, and was still out of service at completion of this inspection. Therefore, the only active means of cooling the RHR service water booster pump room, in all accident and transient conditions, was to take the operator action establishing a natural ventilation flow path.
To implement room cooling under all accident and transient conditions, control room operators initiate actions based on annunciator RHR SWBP ROOM HIGH/TEMP (Panel/Window R-1/E-7). This annunciator operates based on a room temperature of 1200F, as indicated by temperature switch HV-TS-1109. The inspectors questioned whether the events that could cause damage to the temperature switch had been documented and what provisions had been incorporated to retain its ability to provide for protective action. Further, the inspectors questioned whether the postulated failure of the temperature switch would constitute a single active failure and whether it is seismically qualified to function during a design basis earthquake.
Section 9.3.4 of the licensees original safety evaluation report, (dated February 14, 1973),states that the RHR service water booster pump system is designed as Seismic Class I, and that RHR Service Water Booster Pump Systems can supply essential cooling water even after failure of all Class II (seismic) systems with which it interfaces and a concurrent failure of an active component in the Class I (seismic) system. No information was provided by the licensee to indicate that the temperature switch had been analyzed during accident conditions, with provisions to retain its ability to provide protective action in those cases.
Further, no indication was provided that the temperature switch was seismically qualified to function after a design basis earthquake. Failure of the switch would result in an active failure that would cause the annunciator to not operate. This would result in not ensuring timely operator action to set up cooling for the RHR service water booster pumps. This set of consequential failures would result in degradation of the RHR service water booster pump system to provide adequate cooling water under all accident and transient conditions.
Corrective Actions: In response to this issue, the licensee revised alarm response, system operating, and emergency operating procedures to establish natural ventilation in the RHR service water booster pump system room on the onset of the loss of normal plant ventilation during accident conditions without relying on the temperature switch.
Corrective Action References: Condition Reports CR-CNS-2018-02034 and CR-CNS-2018-02069
Performance Assessment:
Performance Deficiency: The inspectors determined that the licensees failure to incorporate malfunctions of the RHR service water booster pump room cooling temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained, in accordance with IEEE 279-1971 Section 3, Design Basis, was a performance deficiency.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to incorporate malfunctions of the temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis would degrade the capability of the RHRSWB system to meet its design function during design basis accidents.
Significance: The inspectors used Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, dated October 7, 2016; and the corresponding Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The inspectors determined the finding represented a potential loss of function; therefore, the NRC senior reactor analyst completed a detailed risk evaluation. The results of the detailed risk evaluation yielded an estimate of the increase in core damage frequency 1.7E-8/year.
Because the increase in core damage frequency was less than 1.0E-7/year, the increase in core damage frequency from external events and the increase in large early release frequency were not analyzed. Based on this evaluation, the performance deficiency screened as having very low safety significance (Green).
Cross-cutting Aspect: The finding had a cross-cutting aspect in the area of human performance associated with Design Margins. Margins are carefully guarded and changed only through a systematic and rigorous process. When the room cooler was tagged out in 2016, the room cooling capability was not evaluated adequately to ensure that design margin was maintained [H.6].
Enforcement:
Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control requires, in part, that measure shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions.
Contrary to the above, from July 29, 2016 to present, the licensee failed to assure applicable regulatory requirements and the design basis were correctly translated into the specifications design of the RHR service water booster pump cooling. Specifically, the licensee failed to incorporate malfunctions of the RHR service water booster pump room temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained.
Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.
Inadequate Design Basis Calculation for the EDG Rooms Temperature Distribution Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-03 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for the licensees failure to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers.
Description:
Design basis calculation NEDC 91-103, DG Room Cooling Without Cooling Coil, Revision 2, evaluated the capacity of the ventilation system to sufficiently cool the emergency diesel generator room. The calculation was performed in order to approve a design change DC 91-23 that disconnected the flow of service water to cooling coils in the ventilation duct.
The calculation determined the required air flow rates and resulting room temperatures of the ventilation system at outside air temperatures of 97°F and 104°F. The calculation was based on an extrapolation of data from the 1988 performance of a Special Test Procedure, which measured temperatures at different locations in the room while the emergency diesel generators were running. The calculation extrapolated the temperatures, assuming maximum outdoor temperatures. The result of the calculation determined that with 97°F inlet air, the temperature of the area around the emergency diesel generators most limiting component was 120.56°F while the temperature of the air exiting the room will be 134°F, at minimum required air flow. According to the calculation, the limiting component, the alternating current generator, had a limiting temperature of 120.60°F, leaving a design margin of 0.04°F.
The Special Test Procedure documented temperature measurements of nine specified locations, where the ninth point was the temperature of the air exiting the room. All eight points measured at different locations around the emergency diesel generator room were substantially lower than the temperature of the air exiting the room, which represents the bulk temperature of the room. Based on the magnitude of temperature differences, the inspectors found the results of the 1988 special test questionable, and as a result, witnessed the surveillance test of the emergency diesel generator at full load on April 16, 2018.
During this April 16 surveillance test, the inspectors and the licensee measured temperatures in areas previously measured by the 1988 special test and the temperature of the air exiting the room. The resulting temperature of the air exiting the room was generally lower than temperatures measured in the vicinity of the emergency diesel generator for the normal ventilation conditions present during the test. Based on these results, the inspectors and the licensee agreed that the existing heat distribution model for the calculation was not accurate.
The licensees preliminary Gothic model reanalysis and the inspectors hand calculation determined room exit temperature should be 128°F, not 134°F.
Additionally, the calculation failed to consider the potential effects on the ventilation system of the non-safety related CO2 dampers in the open position. When the ventilation system starts, the supply fan starts, pressurizing the room, and opening the CO2 dampers installed on each side of the ventilation discharge duct. After a few seconds lag, the discharge fan starts, pressurizing the air inside the discharge duct and closing the CO2 dampers. If the dampers are in the open position, a significant portion of the hot air would be diverted into the room rather than being discharge outdoors. Therefore, increasing the room temperatures.
Since 2004, the licensee recorded at least 11 failures of the CO2 dampers to close or found in the open position. These non-safety related dampers did not undergo scheduled preventive maintenance. Furthermore, the emergency diesel generator surveillance test procedure does not have a step to validate that the CO2 dampers remain closed during the test. The preliminary Gothic model prepared by the licensee determined that if these CO2 dampers are stuck open, the bulk temperature of the room will be increased by 15 degrees F. This would result in bulk room temperature increasing from 128°F to 143°F.
Based on the increased room temperature, the inspectors requested the licensee complete a review of the emergency diesel generator control components to identify which components maximum allowable temperatures would be exceeded. The licensee identified that the temperature challenged the design margin of two ventilation control relays for each emergency diesel generator ventilation system. Based on the conservative design margin of the components maximum allowable temperatures, the components would remain functional.
Corrective Actions: In response to this issue, the licensee completed a preliminary reanalysis to determine that there was no immediate safety concern. The licensees long term corrective actions will be to correct room temperature model including potential failures of CO2 dampers.
Corrective Action References: Condition Report CR-CNS-2018-02308
Performance Assessment:
Performance Deficiency: The inspectors determined that the licensees failure to verify the adequacy of the emergency diesel generator room ventilation by use of alternate or simplified calculation methods, or by a suitable testing program, was a performance deficiency.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.
Specifically, the licensees failure to correctly model the room temperature profile and potential failures of non-safety related CO2 dampers had the potential to lead to exceedance of safety-related components maximum allowable temperatures.
Significance: Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, dated June 19, 2012, the inspectors determined that this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a structure, system, or component, and operability was maintained.
Cross-cutting Aspect: The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.
Enforcement:
Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.
Contrary to the above, prior to April 19, 2018, the licensee failed to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers.
Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.
Incorrect Classification of Potential Safety-Related Components Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems
Green NCV 05000298/2018011-04 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the inspectors identified three examples of the licensees failure to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems.
Description:
The safety-related (or Essential) classification of structures, systems, and components are governed by the following:
- Cooper Nuclear Station Updated Safety Analysis Report (USAR) Appendix G, Section 2.4.2, Methodology to Identify Safety-Related Structures, Systems, Components, and Parts
- Cooper Nuclear Station Procedure 3-EN-DC-167, Classification of Structures, Systems, and Components, Revision 4C2
The inspectors identified three examples where the licensee failed follow the methodology listed in Appendix G or Procedure 3-EN-DC-167. The examples are:
Example 1: The licensee failed to classify emergency diesel generator room CO2 pressure relief dampers as safety-related. The safety-related emergency diesel generator ventilation is equipped with safety-related ducts with CO2 pressure relief dampers installed in the duct.
These CO2 pressure relief dampers were not designed, manufactured, delivered, installed, or maintained as safety-related components. Failure of a CO2 damper to close causes some of the discharge air to recirculate back into the room. The combined surface area of the CO2 dampers located on both sides of the discharge duct is equal to the surface area of the safety-related discharge damper located downstream. Failure of the dampers to close will result in safety-related electrical components exceeding maximum allowable room temperatures. Since 2004, the licensee recorded at least 11 failures of the CO2 dampers to close or found in the open position. These non-safety related dampers did not undergo scheduled preventive maintenance. Furthermore, the emergency diesel generator surveillance test procedure does not have a step to validate that the CO2 dampers remain closed during the test. The inspectors determined that the CO2 pressure relief dampers should be classified safety-related in accordance with USAR Appendix G, Section 2.4.2, paragraph
- (e) and Procedure 3-EN-DC-167, Section 5.2. Paragraph
- (e) requires components in non-safety related systems that are required to provide safety-related functions due to interface requirements shall be determined and classified safety-related.
Procedure 3-EN-DC-167 Section 5.2 [2], Equipment Classification Criteria, requires Essential (safety-related) classification of equipment if the equipment is not required to function but can fail in a manner that would prevent the system from performing it safety-related function.
Example 2: The licensee failed to classify the RHR service water booster pump room emergency fan coil unit as safety-related. During a design basis accident, the RHR service water booster pumps and motors are cooled by the RHR service water booster pump room emergency fan coil unit or by manual operator actions. This fan coil unit and its associated temperature controller, HV-TC-1109, which starts the cooling unit automatically on high temperature, were not installed and maintained as safety-related components. Failure of the fan cooling unit to cool the RHR service water booster pump room will result in the loss of function of at least one train of RHR function without operator actions to recover. The inspectors determined that the RHR service water booster pump room emergency fan coil unit should be classified safety-related in accordance with USAR Appendix G, Section 2.4.2, paragraph
- (e) and Procedure 3-EN-DC-167, Section 5.2. Paragraph
- (e) requires components in non-safety related systems that are required to provide safety-related functions due to interface requirements shall be determined and classified safety-related.
Procedure 3-EN-DC-167 Section 5.2 [2], Equipment Classification Criteria, requires Essential (safety-related) classification of equipment if the equipment is not required to function but can fail in a manner that would prevent the system from performing it safety-related function.
Example 3: The licensee failed to classify the RHR service water booster pump room temperature switch HV-TS-1109 as safety-related. During a design basis accident, the RHR service water booster pumps and motors are cooled by the RHR service water booster pump room emergency fan coil unit or by manual operator actions. If the fan coil unit was not available, the USAR credits manual action to provide natural circulation cooling by opening hatches and doors for the room. This natural convection cooling would ensure the safety function of one RHR service water booster pump. The initiation of the manual action occurs on receiving a control room alarm for high room temperature, as indicated by HV-TS-1109.
Failure of the switch to function after a design basis loss-of-cooling accident would delay manual actions to initiate natural convection cooling in an appropriate time that ensures the safety function of one RHR service water booster pump. The inspectors determined that the RHR service water booster pump room temperature switch HV-TS-1109 should be classified safety-related in accordance with USAR Appendix G, Section 2.4.2, paragraph
- (e) and Procedure 3-EN-DC-167, Section 5.2. Paragraph
- (e) requires components in non-safety related systems that are required to provide safety-related functions due to interface requirements shall be determined and classified safety-related. Procedure 3-EN-DC-167 Section 5.2 [2], Equipment Classification Criteria, requires Essential (safety-related)classification of equipment if the equipment is not required to function but can fail in a manner that would prevent the system from performing it safety-related function.
Corrective Actions: In response to Example 1, the licensee completed a preliminary reanalysis to determine that there was no immediate safety concern. The licensees long term corrective actions will be to correct the room temperature model including potential failures of CO2 dampers. In response to Example 2, the licensee had implemented compensatory measures in place while emergency fan coil unit was out of service; therefore, there was no immediate safety concern. In response to Example 3, the licensee revised alarm response, system operating, and emergency operating procedures to establish natural ventilation in the RHR service water booster pump system room on the onset of the loss of normal plant ventilation during accident conditions without relying on the temperature switch.
Corrective Action References: Condition Reports CR-CNS-2018-02034, CR-CNS-2018-02069, and CR-CNS-2018-02075
Performance Assessment:
Performance Deficiency: The inspectors determined that the failure to classify emergency diesel generator ventilation system and RHR service water booster pump room cooling system components as safety-related (Essential), in accordance with USAR Appendix G, Section 2.4.2, Methodology to Identify Safety-Related Structures, Systems, Components, and Parts and Cooper Nuclear Station Procedure 3-EN-DC-167, Classification of Structures, Systems, and Components, Revision 4C2, was a performance deficiency.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.
Specifically, the failure to classify components as safety-related (Essential) led to configuration control, maintenance, and problem identification practices which degraded the capability of the emergency diesel generator ventilation system and RHR service water booster pumps to perform their design function.
Significance: Using Inspection Manual Chapter 0609, Appendix A, dated June 19, 2012, the team determined that this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a structures, systems, or components, and operability was maintained.
Cross-cutting Aspect: The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.
Enforcement:
Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control requires, in part, that measure shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions.
Contrary to the above, prior to April 19, 2018, the licensee failed to correctly translate the applicable regulatory requirements and design basis to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions. Specifically, the licensee failed to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems.
Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
On April 19, 2018, the team presented the preliminary results of the Inspection Procedure 71111.21M inspection to Mr. J. Dent, Jr., Site Vice President and Chief Nuclear Officer, and other members of the licensee staff.
On April 30, 2018, the team presented the results of the Inspection Procedure 71111.21M inspection to Mr. D. Buman, Director, Nuclear Safety Assurance and other members of the licensee staff.
DOCUMENTS REVIEWED
IP 71111.21M - Design Bases Assurance Inspection (Teams)
Condition Reports (CR-CNS-)
1994-00762
2002-01665
2012-09956
2012-10656
2013-02959
2013-05725
2013-06870
2015-00604
2015-02085
2015-02090
2015-02106
2015-02366
2015-02373
2015-02393
2015-02883
2015-02947
2016-00820
2016-06248
2016-06251
2016-06680
2016-06989
2016-08010
2017-05040
2017-07520
Inspection Generated Condition Reports (CR-CNS-)
2018-01975
2018-01979
2018-01989
2018-02003
2018-02004
2018-02033
2018-02034
2018-02034
2018-02035
2018-02056
2018-02063
2018-02064
2018-02069
2018-02069
2018-02074
2018-02075
2018-02076
2018-02097
2018-02163
2018-02293
2018-02308
2018-02314
2018-02315
2018-02316
Work Orders
281699
4551512
4733240
4850159
4908185
4908614
4943761
4944185
4946822
4948722
5030026
5031812
5039857
5056976
5059028
5059032
5059855
5060013
5062381
5072414
5075220
5085176
5089053
5097666
5102533
5113147
5118603
5119820
21779
22463
23397
23676
25110
5167111
Procedures
Number
Title
Revision
Or Date
15.MS.201
MSIV Leakage Pathway Valve Testing
2, 3, 4
2.0.3
Conduct of Operations
2.1.11.1
Turbine Building Data
154
2.1.22
Recovering from a Group I Isolation
2.2.59
Plant Air System
2.2.69.3
RHR Suppression Pool Cooling and Containment Spray
2.2.70
RHR Service Water Booster Pump System
76, 85
2.2.70
RHR Service Water Booster Pump System
2, 85
2.2.73
2.3_RHR-
GLND-1
RHR Gland Water Supply - Annunciator Panel 1A
3.1
Engineering Procedure
Procedures
Number
Title
Revision
Or Date
3-EN-DC-115
Engineering Change Process
15C11
3-EN-DC-147
Engineering Reports
5C1
3-EN-DC-167
Classification of Structures Systems and Components
4C2
3-EN-DC-306
Acceptance of Commercial-Grade Items/Services in Safety-
Related Applications
5C1
5.1BREAK
Pipe Break Outside Secondary Containment
5.2FUEL
Fuel Failure
5.3EMPWR
Emergency Power During Modes 1, 2, or 3
66, 67
5.4FIRE-SD
Procedure -Fire Induced Shutdown From Outside Control
Room
6.1RPS.307
Surveillance Procedure: Low-High Water Level Channel
Calibration (Div 1) [WOs 4850159, 4944185, 5030026]
6.1RPS.310
Surveillance Procedure: South SDV High Water Level Switches
and Transmitters Examination and Channel Calibration (Div 1)
[WOs 4908614, 4946822, 5031812]
6.1RPS.311
Surveillance Procedure: RPS Instrument Channel Response
Time (Run Mode)(Div 1) [WOs 4908185, 4943761, 5072414]
6.1RPS.312
Surveillance Procedure: RPS Instrument Channel Response
Time (Shutdown)(Div 1) [WO 4281699]
6.1RPS.707
Surveillance Procedure: Reactor Vessel Low-High Water Level
Channel Functional Test (Div 1)[WOs, 5085176, 5097666,
5113147]
6.1RPS.710
Surveillance Procedure: South SDV High Water Level Switches
and Transmitters Channel Functional Test (Div 1) [WOs
5089053, 5102533, 5118603]
6.2 DG.105
Diesel Generator Starting Air Compressor Operability (IST) (Div
2)
6.2 DG.401
Diesel Generator Fuel Oil Transfer Pump IST Flow Test (Div 2)
6.2 DG.402
IST Closure Testing of DGSA Receiver Inlet Check Valves (Div
2)
6.2HV.602
Air Flow Test of Fan Coil Unit HV-DG-1D (Div 2)
7.1.8
Rigging and Lifting Program
7.13.17.1
4160 Breaker Examination
7.13.17.3
Replacing 4160V Breakers
7.3.16
Low Voltage Relay Removal and Installation
7.3.16
Low Voltage Relay Removal and Installation
800000023083 Maintenance Plan, Visual Inspection of Relays [WO 4948722]
06/08/15
Procedures
Number
Title
Revision
Or Date
Alarm
Procedure
2.3_B-3
Panel B - Annunciator B-3
Alarm
Procedure
2.3_R-1
Panel R - Annunciator R-1
16, 18
EOP 5.8,
Secondary Containment Control, Radioactivity Release Control
(5A)
EOP 5.8,
Primary Containment Control (3A)
EOP 5.8.10
Average Drywell Temperature Calculation
Drawings
(Number)
Title
Revision or
Date
2011 sheet 1
Flow Diagram Turbine oil Purification and Transfer System and
Diesel oil System
24 sheet 2
Flow Diagram HVAC Miscellaneous Buildings
N38
2040
Sheet 1 Flow Diagram Residual Heat Removal System
2040
Sheet 1 Iso Key Flow Diagram Residual Heat Removal System
2077
Flow Diagram - Diesel Generator Building Service water Starting
Air Fuel Oil Sump System and Roof Drains
N78
21
HVAC Plan and Sections Diesel Generator Building Heating
Boiler Room
N03
28147
RHR Pump Curves
2/06/1973
2006649
Arrangement Drawing, RPS Trip System A
2006650
Arrangement Drawing, RPS Trip System B
2203102
Scram Discharge Instrument Volume Flow Diagram
N06
2243047
Level Switch Specifications
N01
2243048
Level Switch Specifications
N01
453236930
Cooper Nuclear Station Panel K & R Annunciator Input Loop
Diagram ANN-MUX-13
N03
454003632
Flow Diagram, Control Rod Drive Hydraulic System
454003919
Cooper Nuclear Station Control Elementary Diagrams
454003974
Cooper Nuclear Station, Turbine Generator Building Operating
Floor, Lighting and CCTV Plan (3108, Sh. 1)
AC/21
454003975
Cooper Nuclear Station, Turbine Generator Building Operating
Floor - Lighting Plan Sheet 2 (3109)
AB/10
Drawings
(Number)
Title
Revision or
Date
454005876
Elementary Diagram, Reactor Protection System
454006449
Elementary Diagram, Reactor Protection System
N14
454006451
Elementary Diagram, Reactor Protection System
454006561
Elementary Diagram, Primary Containment Isolation System
454006562
Electrical Diagram, Primary Containment Isolation System
454006580
Elementary Diagram, Reactor Protection System
454203115
Scram Discharge Volume North Header Instrument Piping
454203116
Scram Discharge Volume South Header Instrument Piping
29E211BB
Process Diagram Residual Heat Removal System
2-71212PI
Sheet 2DG
Diesel Generator Building Units 1-HV-DG-1B and 1D
CNS-BLDG-
456
Floor/Roof Plan 932 - 6 (Critical SWGR Rooms) Reactor
Building
N02
CNS-MS-43
Leakage Path from Outboard MSIVs, Cooper Nuclear Station
N05
DR-2016-0444
EE-PNL-AA3 125 VDC Load & Fuse Schedule
DR-2016-0498
Auxiliary One Line Diagram MCC Z SWGR 1A 1B 1E & Critical
SWGR 1F 1G
DR-2017-0001
Relay Settings for 4160V Bus 1F
DR-2017-0196
4160V Switchgear Elementary Diagram
M82317
Residual Heat Removal Heat Exchanger
M82454
Residual Heat Removal Heat Exchanger
MEC3000407
R01-P-MSIV
Leakage
Pathway
MSIV Leakage Pathway to the Condenser
09/01/11
Calculations
Number
Title
Revision
or Date
EE-02-078
Engineering Evaluation, Justification for Measuring Tape on Scram
Discharge Instrument Volumes
11/04/03
EE-15-048
Engineering Evaluation, DG-REL-DG1(14RY1) Use-as-is
Evaluation
NEDC 00-003
CNS Aux. Power System Load Flow and Voltage Analysis
NEDC 00-029
Post-LOCA MSIV Leakage Path to Main Condenser
NEDC 00-111
CNS Auxiliary Power System AC Loads
NEDC 01-006
MSIV Leakage Pathway Piping System Walkdown and Evaluation
Packages
Calculations
Number
Title
Revision
or Date
NEDC 02-064
Post-LOCA Operator Action Time Limits for Configuration of MSIV
Leakage Pathway
NEDC 02-068
Review of Westinghouse Letter for Turbine Stop Valve Shaft for
Post-LOCA Sealing Force
NEDC 07-082
Radiological Dose Analysis for a Loss-of-Coolant Accident (LOCA)
at Cooper Nuclear Station
2, 4
NEDC 07-082
Radiological Dose Analysis for a Loss-of-Coolant Accident (LOCA)
at Cooper Nuclear Station
NEDC 07-090
Fuel Oil Transfer Pump NPSH
NEDC 09-010
ECCS Suction Strainer Heat Loss Analysis with Alternate
Methodology
NEDC 09-102
Internal Flooding - HELB, MELB, and Feedwater Line Break
NEDC 11-072
DGSA Accumulator Capacity and Starts
NEDC 87-052
DG Storage Tank Fuel capacities
NEDC 87-131C
25 VDC Division I Load and Voltage Study
NEDC 87-131D
25 VDC Division II Load and Voltage Study
NEDC 87-133
NPPD Review of CYGNA Calculation for RHR and CS Pump
Motor Acceleration Time
NEDC 88-298
Review of S&L Calc 8206-E1 Control Bldg Heat Loads
NEDC 88-298
Review of S&L Calc 8206-E1 Control Building Heat Loads
NEDC 88-299A
Review of S&L Calc No. COOLC-01 Rev. 6 HVAC Load
Calculation for Control Building EL 903 -6
NEDC 88-299A
Review of S&L Calc Number COOLC-01 HVAC Load Calculation
for Control Building EL 903-6
NEDC 89-1828
Max Flow Through the RHR Pumps
NEDC 90-068
DG Room Heat Load
NEDC 90-384
NBI-LIS-101A, B, C, D, Level 3 Setpoint Calculation
NEDC 91-103
DG Room Cooling Without Cooling Coil
NEDC 91-290
RHR Loop B Test Calculations
NEDC 92-050A
Scram Discharge Instrument Volume High Water Level Setpoint
Calculation
NEDC 92-050B
Scram Discharge Instrument Volume High Water Level/Rod
Withdrawal Block Level Switch Setpoint Calculation
NEDC 92-063
Maximum SWBP Room Temperatures with No Cooling from
Control Building HVAC
NEDC 92-063
Maximum SWBP Room Temperature w/ No Cooling from Control
Building HVAC
1, 2
Calculations
Number
Title
Revision
or Date
NEDC 92-064
Transient Temperature Rise in SWBP Room
NEDC 92-202
RHR Loop A Test Calculations
NEDC 93-178
Drywell Fibrous Insulation
NEDC 94-034D
Small Steam Line Break (SSLB) Analysis
NEDC 94-231
RHR Pumps NPSH Maximum Flow Calculation
NEDC 97-012
DG Fuel On-Site Storage
NEDC 97-044A
NPSH Margins for the RHR and CS Pumps
NEDC 97-044A
NPSH Margins for the RHR and CS Pumps
R4C1
NEDC 97-044A
NPSH Margins for the RHR and CS Pumps
R4C2
NEDC 97-044A
NPSH Margins for the RHR and CS Pumps
R4C3
NEDC 97-044A
NPSH Margins for the RHR and CS Pumps
R4C4
NEDC 98-005
Min Flow Line Capacity for RHR Pumps During Single and Parallel
Pump Operation
R1
NEDC 98-005
Min Flow Line Capacity for RHR Pumps During Single and Parallel
Pump Operation
Maximum Extended Load Line Limit and Increased Core Flow for
Cooper Nuclear Station
01/2000
The General Electric Pressure Suppression Containment
Analytical Model
05/1971
Loss-of-Coolant Accident & Emergency Core Cooling Models for
General Electric Boiling Water Reactors
04/1971
Mark I Containment Program Load Definition Report
TE-10594270
Technical Evaluation, Dedication Package CGI-10594270
TE-10777780
Technical Evaluation, Dedication Package CGI-10777780
Engineering
Changes
Number
Title
Revision or
Date
4kV Breaker Auxiliary Switch Removal
11/26/2008
Relocation of Shutdown Cooling Isolation Function
RPS Test Panels
MDC 74-31
Minor Design Change: Voltage Transient Suppression
Miscellaneous
Number
Title
Revision or
Date
RHR-P-A IST
2015
RHR-P-A IST
2016
Miscellaneous
Number
Title
Revision or
Date
RHR-P-A IST
2017
RHR-P-A IST
2018
Action Way
Tracking #: LO
2016-0035-004
Vulnerability Review: Recent Issues Related to the
Commercial Grade Dedication of Allen Bradley 700-RTC
Relays [IN 2016-01]
CNS Letter
CNSS887255
Supplemental Response to IE Bulletin 84-02
06/29/1988
CNS Letter
NLS8400018
NPPD Response to IE Bulletin 84-02, Failures of General
Electric Type HFA Relays in Use in Class 1E Safety Systems
07/16/1984
CNS-PSA-014
Cooper Nuclear Station Human Reliability Analysis
DC 88-053B
Sustained Elevated Ambients in the Critical Switchgear Rooms
Reference Letter
2/21/1989
EE 06-025
Implementation of Alternate Source Term LOCA Analysis
Engineering
Evaluation
Number 01-147
Summary of Main Steam Isolation Valve (MSIV) Leakage
Pathway to the Condenser Seismic Qualification
EPM Report
EQDI-3273
Report on Review of Existing Equipment Qualification Master
Equipment List - Attachments 1 & 2
09/20/83
Franklin
Research Center
TER-C5506-69
Technical Evaluation Report, BWR Scram Discharge Volume
Long-Term Modifications, NPPD Cooper Nuclear Station [p.
11, surveillance criteria for scram discharge system]]
01/05/82
GE Letter
C960911
CNS Setpoint Analysis
09/11/96
Lesson Number
COR002-23-02
(1481)
OPS Residual Heat Removal System
Lesson Plan:
MEC3000407
MSIV Leakage Pathway to the Condenser
LO 2016-0035-
036
IN 2016-08 Inadequate Work Practices Resulting in Faulted
Circuit Breaker Connection
---
LRP-PNL-(9-15)
CNS Screening Evaluation Worksheet Ch A RPIS & RPS
Vertical Board 9-15
LRP-PNL-(9-17)
CNS Screening Evaluation Worksheet Ch B PCIS & RPS
Vertical Board 9-17
BWROG Report for Increasing MSIV Leakage Rate Limits and
Elimination of Leakage Control Systems
08/1999
NLS8800347
Response to NRC Bulletin 88-04
07/08/1988
NPPD Submittal
to NRC
IE Bulletin 80-14, Degradation of BWR Scram Discharge
Volume Capability Proposed Technical Specifications
10/21/1980
Miscellaneous
Number
Title
Revision or
Date
Procedure
Change Request
6.RHR.308
10/09/2014
Procedure
Change Request
6.1DG.302
03/15/2017
Procedure
Change Request
6.1SW.301
10/10/2017
R3-764-9
Qualification Test Report, ITT Barton Model 764 Differential
Pressure Electronic Transmtter
10/05/1982
Screening
Evaluation
Worksheet
4160V Switchgear
2/09/1996
Plant Specific Evaluation Report for USI A-46 Program
Implementation at Cooper Nuclear Station
09/30/1999
TQD # 0655ELE,
SAP #552
ERO - Electrical Maintenance OSC Pool Personnel
TQD # 0655IAC,
SAP #1126
ERO - IAC Maintenance OSC Pool Personnel
TQD #0655MEC,
SAP # 154
ERO - Mechanical Maintenance OSC Pool Personnel
TQD #0655UTL,
SAP #953
ERO - Utility Maintenance OSC Pool Personnel
Vendor Documents
Number
Title
Revision or
Date
4500187217
Certificate of Conformance Backdraft Dampers
4500187217
Purchase Order Backdraft Dampers
2/01/2015
GE 234A9303NS
Sheet 22: Instrument Data Sheet, Scram Discharge Level
GE Application Note
200.60
GE-MOV Varistors - Voltage Tansient Suppressors
08/75
GE Application Note
200.72
Using GE-MOV Varistors to Extend Contact Life
08/75
GE Catalog Cut
HFA 100 Multicontact Auxiliary Relays
HFA Relay Magnetic Coil Assembly Replacement and
Relay Adjustments
07/10/84
Voltage
Suppression
Manual
GE-MOV II Metal Oxide Varistors for Transient Voltage
Protection, Ratings and Characteristics Table: L Series
[Data Sheet, p. 139]
3rd Edition
GEH 2024F
Multi-Contact Auxiliary Relay Type HFA 51
2/99
Vendor Documents
Number
Title
Revision or
Date
GEI 68749B
Multi-Contact Auxiliary Relay Types HFA65D & HFA65E
06/95
GEK 45484
Multi-Contact Auxiliary Relay Type HFA151
03/94
GEK 45486A
Multi-Contact Auxiliary Relay Type HFA154
11/88
VM-0004
RHR Pumps
VM-1750
GE Relay Composite Manual
VM-1763
GE Power Circuit Breaker Composite Manual
DETAILED RISK ANALYSIS FOR NCV 2018011-02
Failure to Ensure Adequate Design Control Measures are in Place Associated with RHR
Service Water Booster Pump Room Cooling
For the detailed risk evaluation, the analyst changed the base condition of the Cooper SPAR
model to reflect a hypothetical, single failure proof configuration where two temperature
elements existed for Control Building basement high room temperature annunciation and two
temperature elements existed for emergency cooler fan actuation. The temperature elements
were modeled with failure rates which were consistent with other temperature elements in the
SPAR Template 2015, Version 1, with a value of 1.7E-3. Specific changes the analyst made
were:
Sub-fault trees for Residual Heat Removal Service Water Booster pump failures
resulting from high room temperature were added. This sub-fault trees included logic
which modeled that the Residual Heat Removal Service Water Booster pumps would fail
due to high room temperature in the Control Building basement when the following
failed:
o Normal room cooling,
o Emergency room cooling, and
o Alternate room cooling
The sub-fault tree logic represented normal cooling failing on:
o Losses of offsite power
o Failures to run
o Failures to start
o Being in test and maintenance
The sub-fault tree logic represented emergency cooling failing on:
o Failures to run
o Failures to start
o Being in test and maintenance
o Failures of two temperature elements which start the emergency fan (both
independent and common cause failures)
The sub-fault tree logic represented alternate room cooling failing on:
o Operators failing to take timely or any action to establish alternate room cooling
o Failures of two temperature elements which actuate the room temperature
annunciator to cue the operator to take action (both independent and common
cause failures)
The performance deficiency was then modeled by applying ignore failure model logic to the
redundant temperature element basic events and the temperature element common cause
failure basic events to represent the existing, non-single failure proof configuration. Also, the
analyst increased the failure rate of the remaining sole temperature elements to that of the 95th
percentile of the distribution of temperature elements in the distribution from SPAR Template
2015, Version 1, with a value of 3.33E-3, to represent a lower quality standard for the existing
temperature elements. These changes when applied over a one-year exposure period yielded
and estimate of the increase in core damage frequency 1.7E-8/year.
The dominant core damage sequences were losses of offsite power. Operator action to recover
suppression pool cooling and operator action to vent containment were the remaining means to
mitigate the initiators. These analyses were run on the Cooper SPAR model, Version 8.55, as
modified above, ran on SAPHIRE 8.1.6. Because the increase in core damage frequency was
less than 1.0E-7/year, the increase in core damage frequency from external events and the
increase in large early release frequency were not analyzed.
SUNSI Review
ADAMS:
Non-Publicly Available
Non-Sensitive
Keyword:
By: GAG
Yes No
Publicly Available
Sensitive
OFFICE
SRI:R4/DRS/EB1
RI:R4/DRS/EB1
RI:R2/DRS/EB2
SRA:R4/DRS/PSB2
SRA:DRS/PSB2
NAME
GGeorge
WCullum
MRiley
SHedger
RDeese
SIGNATURE
/RA/
/RA/
/RA/
/RA/
/RA/
DATE
06/08/2018
06/09/18
06/09/18
06/09/18
06/09/18
OFFICE
C:R4/DRS/EB1
C:R4/DRP/PBC
C:R4/DRS/EB1
NAME
TFarnholtz
JKozal
TFarnholtz
SIGNATURE
/RA/
/RA by CYoung
Acting For/
/RA/
DATE
06/11/18
06/11/18
06/13/18