IR 05000331/2009009

IR 05000331-09-009; on April 17, 2009; Duane Arnold Energy Center; Problem Identification and Resolution

ML091210530
Person / Time
Site:	Duane Arnold
Issue date:	05/01/2009
From:	Pederson C Division Reactor Projects III
To:	Richard Anderson Florida Power & Light Co
References
EA-09-083 IR-09-009
Download: ML091210530 (19)

Text

UNITED STATES May 1, 2009

SUBJECT:

DUANE ARNOLD ENERGY CENTER, NRC FOLLOW-UP INSPECTION REPORT 05000331/2009009; PRELIMINARY WHITE FINDING

Dear Mr. Anderson:

On April 17, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Duane Arnold Energy Center. This report documents the actions taken to review an unresolved issue (URI) from the 2008 baseline inspections at the Duane Arnold Energy Center (URI 05000331/2008005-03). The results were discussed on April 17, 2009, with you and members of your staff.

The inspection examined activities conducted under your license, as they relate to safety and to compliance with the Commissions rules and regulations, and with the conditions of your license. The inspectors reviewed selected analyses, records, and interviewed personnel.

The enclosed report presents the results of this inspection including a finding that has preliminarily been determined to be White, a finding with low to moderate safety significance that may require additional NRC inspections. As described in Section 4OA2 of this report, the finding involves a failure to promptly identify and correct a condition adverse to quality which resulted in the B emergency diesel generator (EDG) output breaker tripping under full load conditions while conducting a monthly surveillance test. The inspectors review concluded that the licensees initial troubleshooting efforts and corrective actions failed to identify and correct the cause of the B EDG overspeed trip alarms, a condition documented in the licensees corrective action program as being adverse to quality in February 2008. Following corrective actions in March 2008, to replace a faulty annunciator card, the spurious overspeed trip alarms began recurring in June 2008. By not performing additional evaluation to identify and correct the cause for the recurring spurious overspeed trip alarms, the conditions which allowed the overspeed switch degradation continued, and eventually resulted in the failure of the B EDG during the monthly surveillance test conducted in November 2008.

The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. The finding was not an immediate safety concern because, at the time of discovery, it did not involve a complete loss of safety function of the onsite emergency power system and repairs were performed to restore the B EDG to an operable state.

In accordance with NRC Inspection Manual Chapter (IMC) 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process (SDP) encourages an open dialogue between the NRC staff and the licensee. However, the dialogue should not impact the timeliness of the staffs final determination.

Before we make a final decision on this matter, we are providing you with an opportunity to:

(1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of IMC 0609.

Please contact Kenneth Riemer at (630) 829-9628 and in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.

Sincerely,

/RA by Gary L. Shear, Acting For/

Cynthia D. Pederson, Director Division of Reactor Projects Docket No. 50-331;72-032 License No. DPR-49 Enclosure: Inspection Report 05000331/2009009 w/Attachment: Supplemental Information cc w/encl: M. Nazar, Senior Vice President and Chief Nuclear Officer M. Ross, Managing Attorney A. Khanpour, Vice President, Nuclear Engineering D. Curtland, Plant Manager S. Catron, Manager, Regulatory Affairs M. Mashhadi, Senior Attorney T. Jones, Vice President, Nuclear Operations, Midwest Region P. Wells, Vice President, Nuclear Safety Assessment R. Hughes, Director, Licensing and Performance Improvement D. McGhee, Iowa Dept. of Public Health Chairman, Linn County, Board of Supervisors R. McCabe, Chairman, Regional Assistance Committee, DHS/FEMA Region VII M. Rasmusson, State Liaison Officer

SUMMARY OF FINDINGS

IR 05000331/2009009; April 17, 2009; Duane Arnold Energy Center; Problem Identification and

Resolution.

This report covers follow-up inspection activities conducted by resident and regional inspectors to close an open Unresolved Item (URI). The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

NRC-Identified

and Self-Revealed Findings Preliminary

White.

The inspectors identified a finding and associated apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, associated with the licensees failure to identify and correct the cause of B EDG overspeed trip alarms, a condition documented in the licensees corrective action program as being adverse to quality (CAP 055746), in February 2008. Following corrective actions in March 2008, to replace a faulty annunciator card, the spurious overspeed trip alarms began recurring in June 2008. By not performing additional evaluation to identify and correct the cause for the recurring spurious overspeed trip alarms, the conditions which allowed the overspeed switch degradation continued, which eventually resulted in the failure of the B EDG during the monthly surveillance test conducted in November 2008. The licensee implemented corrective actions that included replacing the B EDG overspeed microswitch, developing written instructions for installation and setup of the microswitch, inspecting the A EDG overspeed switch for extent of condition, stopping the practice of resetting the EDG overspeed latch once per shift, repair of the overspeed electrical conduit support bracket, and revisions to the stations administrative control procedure for troubleshooting to require more rigorous troubleshooting activities for Priority 2 items.

The finding was determined to be more than minor because the reliability of the B EDG is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and adversely affects the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding associated with this apparent violation was assessed using a Phase 3 analysis in accordance with NRC Inspection Manual Chapter 0609 Appendix A, Determining the Significance of Reactor Inspection Findings for At-Power Situations, and is preliminarily determined to have low to moderate safety significance (White).

The cause of this apparent violation was related to the Corrective Action Program Component for the cross-cutting area of Problem Identification and Resolution, because the licensee failed to thoroughly evaluate problems such that the resolutions address causes and extent of conditions P.1(c). Specifically, the licensee failed to thoroughly evaluate and identify the cause of recurring B EDG overspeed trip alarms. The recurring alarms started in February 2008, and periodically continued until the B EDG output breaker tripped during a surveillance test on November 2, 2008. (Section 4OA2.1)

Licensee-Identified Violations

No violations of significance were identified.

REPORT DETAILS

4OA2 Problem Identification and Resolution

.1 (Closed) URI 05000331/2008005-03: Root Cause Evaluation 1078, B EDG Output

Breaker Trip

a. Inspection Scope

The inspectors chose to review the licensees Root Cause Evaluation (RCE) associated with the November 2, 2008, trip of the B EDG output breaker during a routine surveillance test.

b. Findings

Introduction:

A finding of low to moderate safety significance and associated apparent violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, associated with the licensees failure to identify and correct the cause of the B EDG overspeed trip alarms, a condition documented in the licensees corrective action program as being adverse to quality (CAP 055746), in February 2008.

Description:

On February 13, 2008, the licensee received the first of several spurious overspeed trip alarms on the B EDG while station operators were performing shiftly reset checks of the overspeed trip lever. On February 21, 2008, the second spurious overspeed trip alarm was received and documented in the corrective action program as a condition adverse to quality, CAP 055746, CAQ-B SBDG [Standby Diesel Generator]

Overspeed Trip Alarm While Resetting the Reset Lever. Additional CAPs were written for spurious B EDG overspeed alarms on March 17, 19, 22, and 24. The licensee initiated Condition Evaluation (CE) 6215 for engineering to evaluate the spurious overspeed alarms. Initial troubleshooting efforts by engineering personnel cited Duane Arnold operating experience in their determination that the B EDG overspeed alarms were caused by degraded capacitors on the annunciator alarm cards. Three Corrective Work Orders (CWOs) were written to replace annunciator cards in the EDG alarm circuitry. On March 25, maintenance personnel replaced one of the suspect annunciator alarm cards. Post-maintenance inspections of the removed card identified a bad capacitor on the card. The two other CWOs, A92419 and A92420, could not be worked because the licensee had not acquired the annunciator cards from the vendor.

CWO A92419 was scheduled with a milestone date for completion of June 9, 2009, and CWO A92420 was scheduled with a milestone completion date of May 4, 2009. The licensee continued to monitor the B EDG following the maintenance.

On June 26, 2008, a spurious B EDG overspeed alarm was received during the shiftly reset check of the overspeed trip lever. Operations personnel initiated a CAP to document the deficiency and also initiated CWO A92405 to replace the annunciator alarm card previously replaced on March 25. However, spurious B EDG overspeed alarms were again received on July 7 and 9, 2008, during the shiftly reset check of the overspeed trip lever. On July 14 CWO A92405 was completed. Autopsy of the removed annunciator card did not identify any degraded capacitors. The two CWOs written in March, A92419 and A92420, to replace additional annunciator alarm cards were still in the licensees work planning system awaiting completion. A condition evaluation (CE 6530) performed by the licensee determined that the spurious B EDG overspeed alarms were being caused by the alarm annunciator cards that had not yet been replaced.

On August 15, 2008, another B EDG overspeed alarm was received. CAP 059587 was initiated along with Apparent Cause Evaluation (ACE) 1876 to evaluate the potential failure of the engine overspeed switch. In addition, CWO A80069 was written to inspect the B EDG Overspeed switch. The Management Review Committee subsequently closed the ACE to CE 6530 without a more in-depth analysis being performed. The licensee justified closing the ACE based on the criteria listed in station procedure PI-AA-204 that states, This issue has been previously evaluated or identified as a result of an extent of condition review under a previous evaluation. The cause is understood and corrective actions are being implemented. If this is a repeat event the request shall discuss timeliness of corrective actions and the need for additional interim actions.

Additionally, CWO A80069 was canceled and the overspeed switch was never inspected. Communications documented in the justification for closing the ACE stated that engineering and operations personnel were still performing troubleshooting efforts of the spurious overspeed alarms.

On September 1 and 2, 2008, two additional B EDG overspeed alarms were received and CAPs were generated for each alarm.

While performing a Technical Specification required surveillance run of the B EDG on November 2, 2008, operators received an engine overspeed alarm. This was the first instance of the overspeed alarm coming in while the EDG was running. The overspeed alarm cleared, and then multiple alarms were received over the next several minutes.

After approximately 30 to 50 B EDG overspeed alarms being received and then clearing, the output breaker unexpectedly tripped open while the EDG was loaded. The B EDG never reached an actual overspeed condition and the engine continued to run unloaded after the breaker tripped open. Operations personnel declared the B EDG inoperable.

The licensee entered their failure investigation process to troubleshoot, identify, and repair the cause of the B EDG output breaker tripping open. On November 5, 2008, the B EDG was repaired and it was declared operable. Licensee RCE 1078 was initiated to determine the root cause of the B EDG output breaker trip. This evaluation did not identify a root cause but did conclude that the trip was caused by a combination of four contributing causes:

1. A lack of detailed instructions did not assure correct installation/set-up of the

engine overspeed microswitch to preclude spurious actuation.

2. The arrangement of supports for the conduit assembly to the engine overspeed

microswitch allowed engine operation and/or conduit movement to affect the tightness of the switch hex locknut. In addition, the licensee identified that one of two clamps was missing from the conduit assembly for the B EDG.

3. Operators were using the engine overspeed microswitch wiring conduit as a

handle during overspeed trip lever resets or reset checks resulting in momentary movement of the microswitch and contributed to the microswitch hex nut loosening.

4. Initial troubleshooting steps did not progress beyond replacement of one of the

two suspect annunciator cards while spare parts were being obtained.

Station administrative control procedure (ACP) 109.3, Troubleshooting Process, states that following initial troubleshooting efforts, the licensee shall collect results, data, outcomes, facts, information, etc. obtained from executing the Troubleshooting Plan.

Compare these results to the expected results of the planIf the problem is not corrected, then return to section 3.10 [Approval of Formal Troubleshooting Plan] and revise the Troubleshooting plan as necessary. If further follow-up actions are required, then enter the Corrective Action process. Follow-up actions may include: [an] Apparent Cause Evaluation.

By not performing additional evaluation to identify and correct the cause for the recurring spurious overspeed trip alarms, the conditions, which allowed the overspeed switch degradation continued, which eventually resulted in the failure of the B EDG during the monthly surveillance test conducted in November 2008.

Analysis:

The inspectors determined that the licensee failed to promptly identify and correct a condition adverse to quality, which resulted in the B EDG output breaker tripping under full load conditions while conducting a monthly surveillance test. This was considered a performance deficiency warranting further review.

The performance deficiency was determined to be more than minor because the reliability of the B EDG is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and adversely affects the cornerstone objective to ensure the reliability of systems that respond to initiating events to prevent undesirable consequences.

The inspectors evaluated the finding using IMC 0609, Appendix A, Attachment 1, Significance Determination of Reactor Inspection Findings for At-Power Situations.

Since the performance deficiency affected the ability of the B EDG to run upon the receipt of a valid actuation signal, the inspectors used the Phase 1 SDP worksheet for the Mitigating System Cornerstone to determine the significance of the finding. The finding was determined to require a Phase 2 SDP review because the finding resulted in the loss of function of a single train for greater than its Technical Specification outage time.

The Phase 2 SDP resulted in a risk significance of Yellow. This was primarily due to assumptions of a one year exposure time and no credit for actual run times of B EDG prior to its failure. The dominant sequences involve a station blackout. To address these conservatisms a Phase 3 SDP was performed.

The Senior Reactor Analyst (SRA) performed the Phase 3 SDP using the plant Standard Plant Analysis Risk (SPAR) Model: Duane Arnold Station, Rev. 3-Plus (Change 3.45),

June 2008. The B EDG would not have failed immediately upon demand throughout the exposure period as assumed in the Phase 2 SDP. Any time that a diesel generator runs and carries load following a loss of offsite power (LOOP) provides additional time to recover offsite power and/or the redundant EDG prior to station blackout. Therefore, the analyst evaluated the impact of the assumed failure time of B EDG during the postulated LOOP as a method of conducting the Phase 3 analysis.

The period when the degraded condition of B EDG existed (the exposure time) is not reasonably known. According to the Risk Assessment of Operational Events (RASP)

Handbook, lacking specific information, the exposure time starts at the time when the component no longer had the capability to operate for the mission time. Based on this, the Region III SRA determined that the exposure period was 180 days, starting on May 9, 2008, when B EDG no longer had the capability to run for its PRA mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and ending on November 5, 2008, when B EDG was restored to functional status.

A timeline of the relevant information is as follows:

• 05/09/08 - ran for 5.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />

• 05/11/08 - ran for 2.15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />

• 05/25/08 - ran for 1.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

• 06/01/08 - ran for 2.85 hours9.837963e-4 days <br />0.0236 hours <br />1.405423e-4 weeks <br />3.23425e-5 months <br />

• 07/06/08 - ran for 3.05 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />

• 08/04/08 - ran for 3.40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />

• 09/04/08 - ran for 2.80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />

• 10/03/08 - ran for 3.00 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />

• 11/02/08 - failure 2.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> after starting

• 11/05/08 - B EDG restored to functional status Therefore, the exposure time started on May 9, 2008, when B EDG no longer had the capability to run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (i.e., the 24-hour clock started about two and a half hours into the May 9 run).

It is assumed that B EDG would have failed to run after 2.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> of a LOOP demand, or if it was inoperable for maintenance, during the 3-day period from November 2-5, 2008.

Prior to November 2, B EDG would have failed to run at 5.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> following a LOOP demand at any time during the 30-day period from October 3, 2008, until the test failure that occurred on November 2, 2008. Similarly, B EDG would have failed to run:

• at 8.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> following a LOOP demand during the 29-day period from September 4 to October 3, 2008;

• at 11.65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> during the 31-day period from August 4 to September 4, 2008;

• at 14.70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> during the 30-day period from July 6 to August 4, 2008;

• at 17.55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> during the 35-day period from June 1 to July 6, 2008;

• at 18.90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> during the 11-day period from May 25 to June 5, 2008 and;

• at 21.05 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during the 14-day period from May 11 to May 25, 2008.

Before May 11, 2008, it is assumed that B EDG would not have failed from the overspeed limit switch failure for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Therefore, prior this date, no additional risk impact is assumed. Other influential assumptions included were:

• The degradation mechanism (vibration) was assumed dormant with B EDG in standby. The degradation of the microswitch plunger spring preload affected B EDG during its operation due to inadequate initial setup and subsequent engine vibration.

• During the months leading up to the November 2, 2008 failure, the EDG had been operated multiple times. Adjustments were made to the AC power recovery probabilities to account for the longer time frames available for recovery.

• No common cause failures were assumed.

The result of the internal events Phase 3 SDP was a delta Core Damage Frequency (CDF) of 6.0E-6. The analyst evaluated the risk associated with each of the above time segments and computed a total delta CDF. The dominant cut-sets involve station blackout scenarios: loss of offsite power, failure of the EDGs, failure to recover either emergency or offsite AC power, and failure of station batteries. For the internal events analysis the SPAR basic event EPS-DGN-FR-DGB was set to "True." The common cause basic event EPS-DGN-CF-RUN was reset to its base case value of 4.172E-4 to ensure that cutsets containing common cause to run events would cancel out in the base and current case.

The Duane Arnold base LOOP frequency of 3.59E-2/yr was adjusted to reflect the situation that only LOOP events with durations greater than the run times of B EDG in each of the time segments listed above would result in a risk increase. As an example, during the 3-day period from November 2-5, 2008, the 2.45-hour non-recovery probability of offsite power was estimated as 0.272. Therefore, the frequency of LOOP events that are not recovered in 2.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> was estimated at 9.76E-3/yr. The SRA computed a similar LOOP frequency for each of the above time segments.

The SRA adjusted the human error probabilities reflecting offsite power non-recovery for the event times that are relevant in the SPAR core damage cutsets. These event times were 30 minutes, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. As an example, during the 3-day period from November 2-5, 2008, resetting event time t = 0 to t = 2.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> following the LOOP event requires that the recovery factors for offsite power be adjusted. The SRA used the following offsite AC power nonrecovery probabilities in the analysis of this 3-day time segment: 0.81 (30 minutes), 0.70 (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), 0.33 (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), and 0.18 (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />).

The analyst computed offsite AC power nonrecovery values for each of the other time segments as well.

To compensate for sequences when A EDG fails to start and then is recovered before B EDG fails from the overspeed limit switch failure at 2.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />, as in the above example, the result for the base and the current case cutsets that contained an A EDG failure to start event were multiplied by the success probability of recovering A EDG in 2.45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />, which was computed at 0.39. This CDF value was then subtracted to obtain a final result for the base and current case. This adjustment assumes that recovery from an A EDG failure to start event before failure of B EDG will not contribute to delta-CDF. Also, the methodology assumes that for A EDG failure to run events, the A EDG failure occurs more or less at the same time that B EDG fails.

External event risk due to fires, flooding, or seismic events were not significant contributors to the risk associated with this finding. The SRA used the Duane Arnold Individual Plant Examinations of External Events and discussions with the licensee probabilistic risk assessment (PRA) staff to estimate external event risk. The highest external event risk contributor was risk due to control room fire, which was determined to be more than an order of magnitude lower than internal event risk.

The potential risk contribution due to Large Early Release Frequency (LERF) was considered using IMC 0609 Appendix H, Containment Integrity Significance Determination Process," and the Duane Arnold Phase 2 Notebook. Duane Arnold is a GE BWR-4 plant with a Mark I containment. Table 5.1 from Appendix H (Phase 1 screen) required further evaluation since station black out (SBO) sequences were important. The LERF factors from the Phase 2 Notebook were 1.0 for the affected SBO sequences, showing that the risk for this finding to be an order of magnitude higher than the risk from internal and external results (i.e., Yellow).

The analyst obtained information from the licensee and worked with HQ containment PRA staff. The licensee provided a phenomenological and timing argument to justify a lower risk impact due to LERF. The phenomenological argument alone was sufficient to justify lowering the LERF risk significance. Following a SBO event, operators would depressurize the RCS according to emergency operating procedures, implying that the reactor would remain depressurized up to the time of reactor vessel breach.

Although the licensee did not address the likelihood that safety relief valves (SRVs)would reclose and that the reactor coolant system (RCS) would repressurize following battery depletion, results of NRC-sponsored accident progression analyses indicate that there is a high probability that the RCS would subsequently depressurize as a result of either temperature-induced creep rupture of the steam lines or a stuck open SRV (due to cycling at high temperature). ERI/NRC 03-204, "The Probability Of High Pressure Melt Ejection-Induced Direct Containment Heating Failure in Boiling Water Reactors with Mark I Design," estimates a 0.9 probability of creep rupture of the steam lines regardless of the type of SBO, and approximately a 0.5 probability of a stuck open SRV. More recent (draft) analyses for a long term SBO in a Mark I plant performed as part of the State-of-the-Art Reactor Consequences Analyses project assume that the RCS will depressurize prior to reactor pressure vessel (RPV) breach as a result of an SRV sticking open due to cycling at high temperature.

The licensee also stated that operators would flood the drywell floor using an AC-independent pump and water source in accordance with cited procedural guidance.

The timeline for the SBO accident provided by the licensee indicates that there would be approximately 6.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from the onset of core damage to the time of RPV breach. It would be reasonable to expect that the required actions to implement this strategy could be completed within this timeframe.

As a result of the above considerations, the use of a LERF multiplier based on a depressurized RCS and a flooded drywell floor was appropriate. The analysts concluded that the risk due to delta LERF was equivalent to the internal results event.

The result of the phase 3 SDP analysis is an estimated delta CDF of 6.1E-6/yr which is a finding of low to moderate safety significance (White).

The licensee contracted their risk assessment to an engineering firm. Existing event tree and fault tree structures were modified to update AC power recovery probabilities to reflect longer times available for recovery.

Modifications to the PRA model were supported by a series of thermo hydraulic analyses (MAAP cases), which were run to determine available times for recovery of AC power.

Six PRA cases were run to calculate change in CDF for an exposure time of 17.7 days (t/2). An additional eight cases calculated change in CDF based on a longer exposure time of 177 days. The licensee performed the quantification similar to the NRC method by dividing the timeline into four segments. The first three segments assumed a 30-day exposure period. The fourth segment assumed an 87-day exposure period.

The licensee later realized that 180 days should have been used instead of 177 days.

This small underestimation of risk does not appreciably change the licensee's final risk estimate. The 177 (180) day estimate was based on the period of time prior to the B EDG failure event for which the B EDG had accumulated a total run time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The licensee's final delta CDF result was 1.2E-6 for the shorter (177 day) exposure time, which was also considered a finding of low to moderate safety significance (White).

The licensees RCE identified no single cause for the microswitch failure and concluded that the B EDG became inoperable at the time of the output breaker trip with no past operability concerns identified.

The licensee implemented several corrective actions to address the identified deficiencies. The corrective actions included, in part, replacing the B EDG overspeed microswitch, developing written instructions for installation and setup of the microswitch, inspecting the A EDG overspeed switch for extent of condition; stopping the practice of resetting the EDG overspeed latch once per shift, repair of the overspeed electrical conduit support bracket, and revisions to the stations administrative control procedure for troubleshooting to require more rigorous troubleshooting activities for Priority 2 items.

Enforcement:

10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.

Contrary to the above, the licensees initial troubleshooting efforts and corrective actions failed to identify and correct the cause of the B EDG overspeed trip alarms, a condition documented in the licensees corrective action program as being adverse to quality (CAP 055746), in February 2008. Following corrective actions in March 2008, to replace a faulty annunciator card, the spurious overspeed trip alarms began recurring in June 2008. By not performing sufficient further evaluation to identify and correct the cause for the recurring spurious overspeed trip alarms, the conditions which allowed the overspeed switch degradation continued, which eventually resulted in the failure of the B EDG during the monthly surveillance test conducted in November 2008.

Pending determination of final safety significance, this is an apparent violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, associated with the licensees failure to identify and correct the cause of the B EDG overspeed trip alarms.

(AV 05000331/2009009-01)

4OA6 Management Meeting

.1 Exit Meeting Summary

• On April 17, 2009, the inspectors presented the inspection results to Mr. R. Anderson, Site Vice President, and other members of the licensee staff.

The licensee acknowledged the issues presented. The inspectors confirmed that none of the potential report input discussed was considered proprietary.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

R. Anderson, Site Vice President

D. Curtland, Plant General Manager

B. Eckes, NOS Manager

S. Catron, Licensing Manager

J. Cadogan, Engineering Director

C. Dieckmann, Operations Manager

G. Rushworth, Assistant Operations Manager

M. Lingenfelter, Design Engineering Manager

J. Swales, Design Engineering Supervisor

K. Kleinheinz, Maintenance Manager

Nuclear Regulatory Commission

K. Feintuch, Project Manager, NRR

K. Riemer, Chief, Reactor Projects Branch 2

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000331/2009009-01 Failure to Promptly Identify and Correct a Significant AV Condition Averse to Quality Associated with the B EDG (4OA2.1)

Closed

05000331/2008005-03 Root Cause Evaluation 1078, B EDG Output Breaker URI Trip (4OA2.1)

Attachment