IR 05000331/2013010

Preliminary White Choice Letter and Inspection Report 05000331-13-010

ML13277A720
Person / Time
Site:	Duane Arnold
Issue date:	09/30/2013
From:	O'Brien K Division Reactor Projects III
To:	Richard Anderson NextEra Energy Duane Arnold
References
EA-13-182 IR-13-010
Download: ML13277A720 (28)

Text

UNITED STATES ber 30, 2013

SUBJECT:

DUANE ARNOLD ENERGY CENTER - NRC FOLLOW-UP INSPECTION REPORT 05000331/2013010; PRELIMINARY WHITE FINDING

Dear Mr. Anderson:

This letter discusses the inspection conducted from April 8, 2013, through September 5, 2013, for your Duane Arnold Energy Center. The purpose of the inspection was to follow-up on unresolved item (URI)05000331/2013002-01, A Standby Diesel Generator Lube Oil Heat Exchanger Gasket Failure, to review the stations root cause evaluation and past operability review associated with the March 8, 2013, failure of the A standby diesel generator (SBDG)

lube oil heat exchanger gasket. The enclosed report documents the results of the follow-up inspection, which were discussed on September 5, 2013, with you and other members of your staff.

Based on the results of this inspection, the Nuclear Regulatory Commission (NRC) has identified a finding that has been preliminarily determined to be a White finding of low to moderate safety significance that will result in additional NRC inspection and potentially other NRC action. As described in Section 1R12, the self-revealed finding involved the failure to prescribe a work instruction of a type appropriate to the circumstances for the re-assembly of the A SBDG lube oil heat exchanger. Specifically, the work instruction did not contain sufficient detail and acceptance criteria, appropriate torque values, and operating experience information to ensure the gasket was properly compressed.

The finding is not a current safety concern. On March 8-10, 2013, actions were completed to replace, and properly install the gasket, and successfully demonstrate operability of the A SBDG following testing. Your staff also performed an immediate extent-of-condition evaluation to provide assurance that the B SBDG was not susceptible to a similar concern with the lube oil heat exchanger.

Attachment 2 to the Inspection Report contains Sensitive Unclassified Non-Safeguards Information. Upon separation from Attachment 2 to the Inspection Report, the enclosed Inspection Report, and Attachment 1 to the Inspection Report are DECONTROLLED. This finding was assessed based on the best available information, using the applicable significance determination process (SDP). The basis for the NRCs preliminary significance determination is described in the enclosed report. This finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with NRC Enforcement Policy. The current Enforcement Policy is included on the NRCs website at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The SDP encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staffs final determination.

Before we make a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final Significance Determination Process determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of IMC 0609.

Please contact Ms. Christine Lipa at 630-829-9703 and in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with and finalize our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for the inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS)

component of NRC's Agencywide Documents Access and Management System (ADAMS),

accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). However, the material enclosed in Attachment 2 herewith contains Security-Related Information in accordance with 10 CFR 2.390(d)(1) and its disclosure to unauthorized individuals could present a security vulnerability. Therefore, the material in Attachment 2 will not be made available electronically for public inspection in the NRC Public Document Room or from the PARS component of NRCs ADAMS.

Sincerely,

/RA/

Kenneth OBrien, Acting Director Division of Reactor Projects Docket No. 50-331 License No. DPR-49

Enclosure:

Inspection Report 05000331/2013010 (Public)

w/Attachments: 1) Supplemental Information (Public)

2) Top 100 Cutsets (Non-public)

REGION III==

Docket No: 50-331 License No: DPR-49 Report No: 05000331/2013010 Licensee: NextEra Energy Duane Arnold, LLC Facility: Duane Arnold Energy Center Location: Palo, IA Dates: April 8, 2013 through September 5, 2013 Inspectors: L. Haeg, Senior Resident Inspector R. Murray, Resident Inspector M. Jones, Reactor Inspector N. Feliz-Adorno, Reactor Inspector Approved by: Christine Lipa, Chief Branch 1 Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

Inspection Report (IR) 05000331/2013010, 04/08/2013 - 09/05/2013; Duane Arnold Energy

Center; Maintenance Effectiveness.

This report follows up on URI 05000331/2013002-01, A SBDG Lube Oil Heat Exchanger Gasket Failure. The NRC staff identified one finding, preliminarily determined to be White, or a finding of low to moderate safety significance. The preliminary White finding is associated with an apparent violation of NRC requirements. The significance of inspection findings is indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter 0609, Significance Determination Process dated June 2, 2011.

The cross-cutting aspect was determined using IMC 0310; Components Within the Cross Cutting Areas dated October 28, 2011. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy dated January 28, 2013. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process Revision 4, dated December 2006.

NRC-Identified

and Self-Revealed Findings

Cornerstone: Mitigating Systems

Preliminary

White.

A finding and apparent violation of 10 CFR 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, was self-revealed for the licensees failure to prescribe a work instruction of a type appropriate to the circumstances for the re-assembly of the A standby diesel generator (SBDG)lube oil (LO) heat exchanger (HX), an activity affecting quality. Specifically, on October 18, 2012, work order 40132858 was performed to replace the A SBDG LO HX tube bundle assembly. On March 8, 2013, the LO HX tube bundle sheet-to-shell gasket catastrophically failed, rendering the A SBDG unavailable. The gasket failure was attributed, in part, to the work order not containing sufficient detail and acceptance criteria, appropriate torque values, and operating experience information to ensure the gasket was properly compressed. The licensee documented the issue in condition report (CR) 01855032 and immediate corrective actions included a replacement of the A SBDG LO HX gasket.

The inspectors determined that the licensees failure to prescribe a work order appropriate to the circumstances was a performance deficiency, because it was the result of the failure to meet regulatory requirements, and the cause was reasonably within the licensees ability to foresee and correct and should have been prevented. The performance deficiency was determined to be more than minor and a finding because it impacted the Mitigating Systems cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency resulted in the failure of the A SBDG LO HX gasket during a maintenance run of the engine on March 8, 2013.

The inspectors evaluated the finding in accordance with IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2 for the Mitigating Systems Cornerstone. The inspectors answered Yes to the screening question under the Mitigating Systems Cornerstone Does the finding represent an actual loss of function of at least a single Train for > its Tech Spec Allowed Outage Time OR two separate safety systems out-of-service for > its Tech Spec Allowed Outage Time?" since the finding represented an actual loss of a safety function of a single train (A SBDG) for 22 days, which is greater than the Technical Specification (TS) allowed outage time of 7 days. Therefore, a detailed risk evaluation was performed using IMC 0609, Appendix A. A Significance and Enforcement Review Panel (SERP)preliminarily determined this finding to have low to moderate safety significance (White).

The inspectors determined that the performance characteristic of the finding that was the most significant causal factor of the performance deficiency was associated with the cross-cutting aspect of Human Performance, having Decision Making components, and involving the licensee using conservative assumptions in decision making and adopting a requirement to demonstrate that a proposed action is safe in order to proceed rather than a requirement to demonstrate that a proposed action is unsafe in order to disapprove an action. Specifically, the licensee used non-conservative assumptions during the development and implementation of work order 40132858 that significantly contributed to the eventual failure of the A SBDG LO HX gasket. H.1(b)

(Section 1R12)

Licensee-Identified Violations

No violations were identified.

REPORT DETAILS

1R12 Maintenance Effectiveness

.1 Routine Quarterly Evaluations

a. Inspection Scope

The inspectors followed up on URI 05000331/2013002-01, A SBDG Lube Oil Heat Exchanger Gasket Failure, by reviewing revisions 0 and 1 of root cause evaluation (RCE) 01855032, A Emergency Diesel Generator (EDG) Lube Oil Heat Exchanger Gasket Failure, and revisions 0 and 1 of past operability review (POR) 01855032 associated with the March 8, 2013, failure of the A SBDG LO HX gasket failure.

Documents reviewed are listed in the Attachment to this report.

This inspection constituted one quarterly maintenance effectiveness sample as defined in IP 71111.12-05.

b. Findings

(1) (Closed) Unresolved Item 05000331/2013002-01: A Standby Diesel Generator Lube Oil Heat Exchanger Gasket Failure

Introduction:

A finding and apparent violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, was self-revealed for the licensees failure to prescribe a work instruction of a type appropriate to the circumstances for the re-assembly of the A SBDG LO HX, an activity affecting quality.

Specifically, on October 18, 2012, Work Order (WO) 40132858 was performed to replace the A SBDG LO HX tube bundle assembly. On March 8, 2013, the LO HX tube bundle sheet-to-shell gasket catastrophically failed, rendering the A SBDG unavailable. The gasket failure was attributed, in part, to the work order not containing sufficient detail and acceptance criteria, appropriate torque values, and operating experience information to ensure the gasket was properly compressed. The licensee documented the issue in CR 01855032 and immediate corrective actions included a replacement of the A SBDG LO HX gasket.

Description:

During the fall 2012 Refueling Outage (RFO) 23, the licensee conducted maintenance on the A SBDG from October 8, 2012, to October 18, 2012, which included replacing the LO HX tube bundle assembly. Work Order 40132858, 1E053A2: Replace Lube Oil Cooler Tube Bundle, directed the activity to replace the LO HX tube bundle assembly and re-assemble the HX. The SBDG LO HXs at Duane Arnold are comprised of a horizontal once-through HX design with LO on the shell side and jacket water on the tube side. The tube bundle sheet is fastened between the HX shell flange and a channel head flange. The WO directed the HX-to-channel head joint bolts to be tightened to 22 ft-lbs, followed by tightening of the perpendicular channel head-to-jacket water joint bolts. The WO had provisions at the end of the maintenance activity to further tighten the HX joint should there be any leakage. Once the assembly of the HX was completed and the LO system was returned to service, a small leak was identified at the ten oclock position of the HX joint between the HX flange and the tube sheet. Workers tightened the bolted connection to 43 ft-lbs, as allowed per the WO, and the leak stopped. The workers did not loosen any other bolted connections prior to increasing the torque to 43 ft-lbs (i.e. the perpendicular channel head-to-jacket water joint bolts). Between the post maintenance run on October 18, 2012, and the last monthly surveillance test on February 16, 2013, the A SBDG had been run for testing and maintenance several times, with no identified LO leakage from the HX.

On March 8, 2013, during a maintenance run of the A SBDG tagout of the engine for planned cable inspections, the A SBDG LO HX developed an oil leak which started during the first few minutes of engine operation and was approximately 5 drops per minute (DPM). During the course of the test run, the leak increased to approximately 60 DPM, when the engine was finally secured after completing the requirements for the test. The licensee made plans to start the engine a second time, with the intent of tightening the flange and stopping the leak. Upon engine startup during the second run, the SBDG developed a significant oil leak, losing approximately 20-25 gallons of oil from the HX, and requiring the engine to be locally secured and declared unavailable (it had been considered inoperable since the commencement of a maintenance activity that was not related to the LO HX). The licensee identified that the oil leak was caused by a failed gasket at the horizontal HX joint between the HX flange and the tube sheet (at approximately the 10-11 oclock position). The licensee evaluated the B SBDG for a potential common cause failure and determined that it remained operable. The licensee enacted repairs, performed testing, and declared the A SBDG operable on March 10, 2013.

The licensee performed a RCE 01855032 and POR 01855032 for the March 8, 2013, failure of the A SBDG lube oil heat exchanger gasket. The licensee identified the following root (RC) and contributing causes (CC):

• RC1 - Misalignment or flaws between flange mating surfaces of the 'A' EDG Heat Exchangers led to uneven compression of a gasket, leakage, and failure of the lube oil channel head connection, specifically at the 10-11 o'clock position.

• CC1 - The evaluation completed in 2008 lowered the torque value to ensure the channel head did not crack during reassembly. The torque values were lowered to an overly conservative value without taking into account additional factors that would contribute to sufficient compression (gasket change, increased monitoring, torque checks, and sealing surface imperfections). This action allowed for preexisting conditions/weaknesses to manifest.

• CC2 - A lack of detail in the work packages for the unique EDG Heat Exchanger arrangement has led to inconsistent assembly practices.

• CC3 - Multiple opportunities to incorporate internal and external operating experience and identified Electric Power Research Institute (EPRI) Best Practices for re-torquing have been missed in the planning of EDG heat exchanger work.

The inspectors review of the RCE and POR noted that WO 40132858 was not appropriate and lacked several important items as determined by the licensees root and contributing causes. Specifically, WO 40132858 did not:

• Contain the requisite level of detail to ensure the tube bundle and channel head flange were properly aligned to ensure even compression of the gasket;

• Ensure that the perpendicular channel head-to-jacket water connection was loosened prior to applying further torque to the channel head-to-shell flange bolts to ensure even compression of the gasket;

• Include appropriate torque values (a 2008 calculation was insufficient in determining minimum torque and overly conservative in calculating maximum torque values. The purpose of changing the torque values was to preclude damage to the cast iron channel head, but did not evaluate for sufficient compression of the gasket with the potential for surface flaws, misalignment, thermal expansion, and vibration); and

• Include or consider relevant operating experience or industry best practices prior to performance of the work (e.g. licensee did not check the bolt torque 12-24 hours after initial tightening, as recommended by EPRI and the gasket manufacturer). In addition, DAEC has internal operating experience related to the replacement of the HX tube bundle that shows bolt relaxation is applicable to the LO HX.

Further, the inspectors noted that the WO to perform the tube bundle replacement instructed the workers to tighten the flange in accordance with GMP-MECH-01, General Bolting Requirements. This procedure was not included as part of the WO.

The inspectors identified several aspects of GMP-MECH-01, which were either not completed, or not documented as being completed:

• The torque sequence used by the installers was not documented in the work order as required.

• The workers did not notify the maintenance planner ifthe flange gasket is different from that stated in the work order. The specific cause for why the wrong gasket was installed was not determined by the licensee.

Based on the above, the inspectors observed that GMP-MECH-01 was either not followed sufficiently or not used at the worksite. This procedure has a classification of reference use, in that it was not required to be documented other than those items stated in the procedure (e.g. torque information on the maintenance data sheet).

The gasket installed during the A SBDG tube bundle replacement in October 2012 was not the gasket identified in WO 40132858. Following the A SBDG LO HX gasket failure on March 8, 2012, the licensee sent the gasket to a laboratory for analysis.

Although the manufacturer and model of the gasket could not be determined, the laboratory concluded that the gasket was suitable for the application (appropriate material properties, dimensions, etc.). However, the WO 40132858 minimum torque of 22 ft-lbs that was initially applied during RFO 23 was not sufficient to meet the minimum recommended gasket compression. The root cause was unable to determine why the incorrect gasket was installed, but did conclude that the gasket type was not a cause of the failure. Nevertheless, the inspectors observed that the gasket type called out in the WO was not controlled in a manner appropriate to the circumstances.

The licensees POR concluded that the A SBDG was inoperable beginning February 16, 2013, following the last successful monthly TS surveillance test. The licensee revised both the RCE and POR following questions by the inspectors associated with the potential for degradation of the gasket over time since the original installation during the fall 2012 RFO. The licensees revised evaluations changed the date of unavailability to March 6, 2013, based on the identification of an additional contributing cause, specifically:

• CC4 - Joint temperature differences between shutdown and operating conditions for the lube oil system on March 6, 2013, allowed thermal forces to reduce gasket compression.

This contributing cause was determined after the licensee recognized that the clearance tagout for the A SBDG cable inspection on March 6, 2013, resulted in the LO system being de-energized and the room ventilation dampers opening. This tagout, the licensee contended, reduced the HX joint temperature to the point where the HX joint compression relaxed and LO was able to migrate onto portions of the gasket surface. The licensee used a finite element model (FEM) and other analyses performed by an outside vendor and concluded that the A SBDG was always operable from the fall 2012 RFO replacement until March 6, 2013. The licensees basis for this conclusion was that wetting of the gasket surface from oil reduced the friction coefficient of the gasket surfaces to the point where the LO starting pressure on March 8, 2013, resulted in gasket movement, leakage, and subsequent failure of the gasket. The inspectors thoroughly reviewed the revised evaluations and continued to have concerns for a number of reasons. The inspectors determined that the analyses contained several variables and assumptions that could have significantly affected the results of the analyses based on values used, for example:

• As an input to the FEM, as-found measured gasket thickness values were used to extrapolate assumed compression values of the joint; however, the FEM did not account for flange surface conditions such as circumferential light scratches and irregularities on the HX shell flange, nor the tube bundle sheet surface finish of <125 micro-inches, as referenced in the RCE. The inspectors were concerned that these conditions could potentially impact the FEM conclusions;

• The FEM calculated that the gasket would not be allowed to displace under the calculated compression unless the coefficient of friction between the gasket and its surfaces was 0.034. The conclusion was in order for the coefficient of friction to reach 0.034; lube oil would have had to wet the surface(s) of the gasket at the location of failure. In order for oil to wet the surface(s),compression would have had to become nearly zero. The licensee contended that the compression could have reached zero during the de-energization of the LO system and opening of the A SBDG room ventilation dampers on March 6, 2013; however, no oil leakage was identified prior to or after the re-energization of the LO system to a standby pressure of 2-3 psig. The inspectors concerns were that the tube bundle sheet flange-side of the as-found gasket appeared clean, dry and well mated (smooth), and, even if oil did wet the shell-side flange gasket surface, some compression would have been restored prior to the engine startup and a coefficient of friction of 0.034 on the shell-side flange gasket surface to displace the gasket was an unreasonably low value. The bounding FEM case that was performed used a coefficient of friction of 0.2 that resulted in no gasket displacement and it was not clear whether two potentially different coefficients (for the HX shell surface and tube bundle sheet surface) were considered as discussed above;

• The compressive stress was estimated anywhere from 0 to 1000 psi; however, different compression values were used in the friction coefficient calculation (250 psi) than the FEM (417 psi) at the localized failure region of the gasket;

• The gasket manufacturing tolerance was +/- 0.006 inches and was not factored into the FEM or other analyses. Because the gaskets nominal thickness was assumed to be 0.0625 inches, a tolerance of +/- 0.006 inches had the potential to impact the outcome;

• There were assumptions made in ambient A SBDG room temperatures, HX joint temperatures, gasket relaxation temperatures, etc., but a sensitivity evaluation was not performed to bound the assumptions in the FEM and other analyses. The licensees position was that conservative values were used in all cases; however, the inspectors took issue with the levels of conservatism; and

• The licensee was unable to validate the FEM with a known result in order to quantify their confidence in the models results.

The inspectors determined that the thermal transient on the joint during the March 6, 2013, maintenance tagout and HX temperature transient likely accelerated or exacerbated the existing root cause and contributing causes that were in place since the fall 2012 RFO. Overall, the inspectors determined that the licensee had not provided reasonable assurance that the gasket would not have failed absent the HX thermal transient on March 6, 2013.

The inspectors considered several factors in determining the February 16, 2013, date as the appropriate start of the exposure period. February 16, 2013, correlated to the last performance of a successful surveillance test of the A SBDG that demonstrated operability of the A SBDG with no documented LO leaks of the HX. The engine ran for over three hours with no identified LO leaks and a postulated continued runtime of the engine at a relative constant temperature and LO pressure, with no additional thermal cycling or pressure spikes acting upon the gasket, was reasonable.

Therefore, the inspectors determined that there was a reasonable expectation that the engine would be able to run for the probabilistic risk assessment (PRA) mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (had it needed to continue to run on that date). The inspectors determined that the licensee did not provide sufficient justification to show that the engine would have been able to complete its mission time if called upon following February 16, 2013, since the next engine start on March 6, 2013, resulted in increasing gasket leakage and eventual failure.

Analysis:

The inspectors determined that the licensees failure to prescribe a work order appropriate to the circumstances was a performance deficiency, because it was the result of the failure to meet regulatory requirements, and the cause was reasonably within the licensees ability to foresee and correct and should have been prevented.

The performance deficiency was determined to be more than minor and a finding because it impacted the Mitigating Systems cornerstone attribute of equipment performance and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency resulted in the failure of the A SBDG LO HX gasket during a maintenance run of the engine on March 8, 2013.

The inspectors evaluated the finding in accordance with IMC 0609, Appendix A, The Significance Determination Process for Findings At-Power, Exhibit 2 for the Mitigating Systems Cornerstone. The inspectors answered Yes to the screening question under the Mitigating Systems Cornerstone Does the finding represent an actual loss of function of at least a single Train for > its Tech Spec Allowed Outage Time OR two separate safety systems out-of-service for > its Tech Spec Allowed Outage Time?,"

since the finding represented an actual loss of a safety function of a single train (A SBDG) for greater than its TS allowed outage time. Therefore, a detailed risk evaluation was performed using IMC 0609, Appendix A.

The Senior Reactor Analysts (SRAs) evaluated the finding using the Duane Arnold Standardized Plant Analysis Risk (SPAR) external event model version 8.22, Systems Analysis Programs for Hands-on Integrated Reliability Evaluations version 8.0.9.0.

The performance deficiency affected plant risk during loss of offsite power events.

Based on information from NRC inspectors, the SRAs determined that given a loss of offsite power after the last successful start (and approximate 1.2-hour loaded run),there would have been about 1.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the loaded run to recover an offsite power source before equipment supplied by A SBDG lost power. The SPAR model was changed to account for this offsite power recovery credit. Post-processing rule changes in the SPAR model were used to calculate the amount for this credit and the cutsets were adjusted accordingly.

Within the SPAR model, the A SBDG hardware fault tree was changed to model the availability of the A SBDG following its last successful surveillance test run. For modeling the A SBDG failure, three change sets were used. One change set contained basic events representing a "failure to run early" component and a "failure to run late" component. The "failure to run late" component was changed in the deficient case to "1.0" to reflect failure of the diesel generator after 1.2 fully loaded run hours.

A second change set was used to model common cause failure potential. A third change set was used to model the test and maintenance repair during the last two days of the exposure period. A delta core damage frequency (CDF) was obtained by taking the difference of the risk results in the deficient and the nominal cases.

Other modeling changes were considered based on requests from the Duane Arnold PRA staff who performed their own risk evaluation of this issue. The licensee's requests were coordinated and discussed with NRC SPAR model contractors from Idaho National Laboratory (INL). The licensee-requested changes and their disposition are addressed below. (Note: Only the first two items below had appreciable impact on the CDF for this issue. The remaining items had already been included in the model or had insignificant impact on the CDF.)

Technical Support Center Diesel Generator The SPAR model was changed to credit aligning the Technical Support Center (TSC) diesel generator to supply power to all of the five 125 VDC and 250 VDC battery chargers under station blackout conditions to extend the life of the batteries to up to 12-hours with successful load shedding. This change allowed continued operation of the High Pressure Coolant Injection (HPCI) or Reactor Core Isolation Cooling (RCIC) system with instrumentation availability. (See discussion of "Battery Depletion Time" below for additional information related to this change).

Battery Depletion Time The SPAR model was changed to account for a revised battery depletion time for two cases. One was with the TSC diesel being aligned to the battery chargers, and the second was without the TSC diesel being aligned to the battery chargers. The two cases are discussed below.

Case 1: Without TSC diesel alignment to battery chargers - The SPAR model was changed to extend DC power availability through the station batteries from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during a station blackout.

Case 2: With TSC diesel alignment to battery chargers - The SPAR model was changed to extend DC power availability through the station batteries for a maximum of 12-hours when chargers are aligned to the TSC diesel. The licensee believed more than 12-hours should be credited but the NRC disagreed. The licensee maintained that with the TSC diesel aligned to a battery charger the batteries are assumed to last more than 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> given DC load shedding and 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> without load shedding. The NRC disagreed in crediting the station batteries beyond 12-hours because many manual actions are required beyond this timeframe that are judged collectively to have a high probability of failure. Idaho National Laboratory personnel stated that they had reviewed thermo-hydraulic information for similar type plants and after about 12-hours problems begin to develop regarding containment heat-up, the need to vent containment, depressurize the reactor, Net Positive Suction Head issues, aligning alternate injection sources, etc. The NRC's position is in agreement with analyses documented in NUREG 1953, "Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk-Models - Surry and Peach Bottom." This NUREG published in 2011 describes MELCOR analyses performed to support the NRC SPAR modeling assumptions.

Residual Heat Removal Service Water to Residual Heat Removal Crosstie Motor-Operated Valve MO-1942 The SPAR model was requested to be changed to credit action to manually open valve MO-1942 locally when there is no Division 1 power. The logic associated with this action was already in the model. The action allows injection when normal injection systems are inadequate or unavailable.

RCIC Operation vs. Suppression Pool Temperature The SPAR model was requested to be changed to reflect failure of RCIC due to inadequate pump cooling (bearing cooling) with a suppression pool temperature of 240°F. The SPAR model assumed RCIC fails when suppression pool temperature reaches approximately 140°F. The NRC explained that while the 140° suppression pool temperature is discussed in the SPAR model documentation, it is not associated with any timing or core damage sequences in the model. The NRC also stated that the RCIC system would more likely fail due to other reasons prior to the suppression pool reaching 240°F.

Also, Section 5.4 of the Duane Arnold Updated Final Safety Analysis Report, Chapter 5.4, "Component and Subsystem Design," stated that the maximum water temperature in the suppression pool during RCIC operation is 140°F for continuous operation and 170°F for periods of short duration. There was also a note in the SPAR model documentation that the limiting condition for RCIC is based on Net Positive Suction Head instead of lube oil cooling. The SRAs concluded that the licensee did not have sufficient basis to implement the change regarding failure of RCIC to be associated with a suppression pool temperature of 240°F.

RCIC/HPCI Room Cooling Dependency The SPAR model was requested to be changed to credit operator action to facilitate convection cooling with air from outside the rooms. For RCIC, the licensee had an analysis showing that room cooling was not required within the 24-hour mission time. The NRC explained that the SPAR model does show a dependency on room cooling, but there was existing logic in the model for both RCIC and HPCI to allow manual actions (e.g., open doors) to recover room cooling.

Loss of Offsite Power Recovery The SPAR model was requested to be changed to use unique recovery curves for the four classes of loss of offsite power events (weather, grid, plant-centered, and switchyard-related). These recovery curves had already been incorporated into the SPAR model. See also discussion of "Emergency Alternating Current (AC) Power Recovery Modeling" below.

Exposure Time Modeling According to the Section 2.2 of the NRC Risk Assessment of Operational Events Handbook (i.e., RASP Handbook) the exposure time is the duration period of the failed or degraded structure, system, or component that is reasonably known to have existed, including repair time. For this issue, based on the inspectors' conclusion that the gasket was displaced over time due to numerous operational thermal and pressure cycles and was not expected to fail after an initial "successful" (i.e., leak-free) startup of A SBDG, the SRAs determined that the exposure period should start at the time when the A SBDG was last successfully tested prior to failure. The exposure time was thus 22-days, from February 16 through March 10, 2013. This time is equal to the total time from the last successful operation through unsuccessful operation plus repair time.

The licensee questioned whether an exposure time equal to one-half of the time period

("t/2") since the last successful functional operation of the A SBDG plus repair time should be used, presumably because the inception of the failure was not reasonably known. Use of "t/2" was rejected since the inception of the failure was reasonably known to occur on February 16, 2013. After this date the A SBDG was not expected to operate for its 24-hour PRA mission time. This was because on the very next start on March 8, 2013, there was an oil leak that got progressively worse. In particular, the A SBDG was started and ran for under 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> before being shutdown to fix a leak that grew to 60 drops per minute. That same day, after verifying minimum torque values and re-starting the engine, 25 gallons of oil were discharged. The licensee's risk evaluation assumed a 20-day exposure time which did not include repair time through March 10, 2013.

Emergency Alternating Current (AC) Power Recovery Modeling Emergency AC power recovery credit as a function of time is included in all of the SPAR models. However, while reviewing the licensee's risk evaluation, the NRC observed that the licensee used an outdated curve for emergency AC power non-recovery probabilities and incorrectly applied convolution credit. Convolution credit eliminates a simplifying assumption that all failures happen at time zero by combining diesel failure time data and offsite power duration data into a new probability distribution.

Licensee Use of Inappropriate Standby Diesel Generator Recovery Curve:

The licensee's outdated standby diesel generator recovery curve was contained in Table 3-1 from its AC Power Recovery Notebook, "DAEC-PSA-AC-07," Revision 2. The emergency AC power non-recovery probabilities incorporated into the licensee's risk model are based on the incorrect assumption that a licensee can choose the easiest emergency diesel to recover when there are multiple failed diesels. Several years ago the NRC determined that this assumption was faulty because in reality when a diesel generator is failed during a loss of offsite power event, plant personnel will likely not wait for another diesel generator to fail to make a decision on which one to fix.

The NRC SPAR model incorporates updated emergency AC power non-recovery probabilities from NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants," and NUREG/CR-5496 (INEELIEXT-97-00887), "Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1980 - 1996." The latest published curves are posted at the "Results and Databases" section of the NRC public website for operating reactors in Table 6, "EDG Non-Recovery Probability for Selected Times." The website where this can be found is http://nrcoe.inel.gov/resultsdb/LOSP/.

Licensee Misapplication of Convolution:

Another area where the licensee appears to have mistreated recovery of emergency AC power is in the application of its convolution methodology. The licensee used the method discussed in EPRI Report 1009187, "Treatment of Time Interdependencies in Fault Tree Generated Cutset Results" which is incorporated into Appendix G of the licensee's AC Power Recovery Notebook, "DAEC-PSA-AC-07," Revision 2. After reviewing the licensee documents, the SRAs and INL personnel concluded that the licensee uses the same method as the NRC. However, after reviewing the licensee's cutset results the NRC determined that the licensee inappropriately applied the method. As an example, the licensee applied a convolution factor to its dominant cutsets yet the conditions that allow for convolution (i.e. failure to run of the B SBDG) are not present. The licensee stated that the factor was applied to the A SBDG.

However, the A SBDG had an observed failure shortly after it was started and applying a recovery term to this failed diesel is incorrect.

Common Cause Failure The NRC disagreed with the licensee on modeling common cause failure for this issue. The licensee's risk evaluation assumed no common cause failure potential.

The SRA modeled the A SBDG failure as having an increased potential for common cause failure affecting the opposite SBDG per existing NRC guidance. The SRA's modeling was in accordance with guidance in the RASP Handbook. This handbook contained several categories of events with a spectrum of cases encountered in events and condition assessment modeling. In particular, for this specific risk analysis, the RASP Manual Guidance, Section 5.5, "Common Cause Failure Treatment Cases,"

Case 1 in Section 5.5, applied. The guidance states to apply conditional common cause failure based on the following:

"Observed failure with loss of function of one component in the Common Cause Component Group (CCCG); and

• No other observed failures or degradations in other components in the CCCG were identified by inspections; and

• Other opponents in the CCCG were tested to be functional.

Basis: No credit for observed success (Given that the performance deficiency could have impacted the other components, but did not due to chance, is considered a success)."

A SBDG Run Time Modeling On March 8, 2013, the A SBDG developed a lube oil leak starting at 5 DPM that increased to 60 DPM while running at full load for 1.23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> prior to being shutdown.

After checking flange torque values the licensee re-started the engine later that same day and excessive oil leakage occurred immediately upon startup, requiring a manual trip of the engine. Approximately 20-25 gallons of lube oil were discharged. NRC inspectors concluded that if the lube oil heat exchanger gasket (stationary tube sheet-to-shell flange gasket) did not leak or fail during A SBDG start-up conditions, then it was not expected to fail at any other point during that same maintenance test or surveillance run. Based on this, the SRA concluded that following the prior surveillance run in February 2013, the A SBDG had 1.23 full load run hours remaining until failure. During these 20-days, the A SBDG was modeled as being failed after 1.23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />. During the 2-day repair time, there were no run hours remaining. During this time A SBDG was modeled as being in test and maintenance. The CDF for the two time periods was calculated and summed to obtain a cumulative CDF for the internal event risk contribution. The degradation mechanism (e.g., stresses due to thermal expansion and vibration) was assumed to be dormant with the A SBDG in standby. The modeling for the 22-day time period is discussed in Case 1 and Case 2 below.

Case 1: February 16-March 8 Change sets were used to model this time segment. The SPAR Model was run with a change set to invoke common cause failure potential and another change set to invoke failure to run of the A SBDG after 1.23 fully loaded run hours. The core damage frequency (CDF) for the deficient case was 5.52E-05/yr. The CDF for the nominal case was 5.04E-06/yr. The difference is 5.02E-05/yr. The CDF for the 20-day exposure is thus 2.75E-06/yr.

The dominant accident sequences involved a station blackout corresponding to a weather-related loss of offsite power initiating event, failure of emergency AC power, failure to extend RCIC operation after initial success, failure of fire water as an alternate injection source, and failure to recover AC power.

Case 2: March 8-10 A test and maintenance change set was used to model this time segment. The SPAR model was run with the change set representing test and maintenance recovery set to 1.0. The CDF for the deficient case was 3.92E-05/yr. The CDF for the nominal case was 5.04E-06/yr. The difference is 3.42E-05/yr. The CDF for the 2-day exposure is thus 1.87E-07/yr. The dominant accident sequences were the same as that in Case 1.

The total internal events risk is the sum of Case 1 and Case 2 results, or CDF of 2.94E-06/yr. The licensee contended that the A SBDG could have run much longer than the 1.23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> assumed by the SRA since it just leaked in drops per minute. However, given that the A SBDG failed within minutes of its second start on March 8, as a sensitivity analysis, the SRA increased the failure to start probability based on a total of nine starts since the gasket was replaced in October 2012. The SRA performed a Bayesian update and calculated a mean failure to start probability of 0.15. Solving the model with this revised probability resulted in a CDF of 2.4E-06/yr.

Summary of Internal Event Risk The total internal events risk is the sum of Case 1 and Case 2 results, or CDF of 2.94E-06/yr.

External Event Risk Contribution The SRAs linked the external event trees and performed a base case update prior to evaluating the external event tree sequences. The SRAs evaluated the risk due to the performance deficiency given fires, floods, and seismic events.

Fires In the external event feature of the Duane Arnold SPAR model, the SRAs identified fire initiating events that could result in a loss of offsite power. The SRAs solved the particular fire event trees with change sets representing failure of the A SBDG during the 20-day exposure and representing the 2-day maintenance recovery period. The SRAs gave credit for the 1.23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> remaining run time during the 20-day exposure period. The SRA evaluated main control room fires and other fires outside the main control room.

Main Control Room Fires The SPAR model was changed to use an updated control room fire frequency from NUREG/CR 6850 Supplement 1. Specifically, the SPAR model has a control room fire frequency of 1E-02/yr.

NUREG/CR 6850 Supplement 1, "Fire Probabilistic Risk Assessment Methods Enhancements," Section 10.2.1, shows an updated mean frequency value of 8.24E-04/yr. To estimate the fraction of these fires leading to a potential loss of offsite power, the SRA used the licensee's response to a Request for Additional Information (Letter NG-97-2134)for the Individual Plant Examination of External Events, dated December 29, 1997, which stated that the fraction of control room panels considered critical for achieving safe shutdown was 9 out of 74.

The SRA conservatively assumed that a fire affecting any of these panels resulted in a loss of offsite power. The frequency of main control room fires leading to a potential loss of offsite power was thus estimated at (8.24E-04/yr) * (9/74) = 1.00E-04/yr.

The SRA solved the event tree representing sequences for main control room fires leading to a potential loss of offsite power and obtained a base CDF of 8.73E-07/yr. Using change sets to invoke common cause and to invoke failure to run of the A SBDG after 1.23 fully loaded run hours, the CDF for the deficient case was 1.25E-05/yr. Adjustment for the 20-day exposure resulted in a CDF of 6.37E-07/yr. For the 2-day repair period exposure, CDF was computed to be 3.97E-08/yr. The total CDF for a main control room fire with potential to cause a loss of offsite power was the sum of the risk for the two exposure periods, or 6.77E-07/yr.

Other Fires The SRA solved the remaining event trees representing fires outside the main control room that could cause a loss of offsite power. These were in the cable spreading room and the divisional safety related switchgear areas. Adjustment for the 20-day exposure resulted in a CDF of 4.01E-09/yr. For the repair period exposure, using a change set with A SBDG test and maintenance recovery set to 1.0, resulted in a CDF of 4.88E-08/yr. The total CDF for fires outside of the main control room is the sum of the risk for the two exposure periods, or 5.28E-08/yr.

Summary of Fire Risk The CDF for this performance deficiency due to all fires was estimated at 7.30E-07/yr.

Flooding Internal flood risk contributions were screened using the external event feature of the Duane Arnold SPAR Model. The SRA reviewed the flooding event trees and identified none that transferred to an internal events loss of offsite power event tree. The risk of this finding due to flooding is insignificant.

Seismic Seismic risk contributions were screened using the RASP external events handbook guidance. The generic median earthquake frequency assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at Duane Arnold of this magnitude or greater is 3.0E-5/yr. This value is several orders of magnitude lower than the internal events LOOP frequency or the internal fire frequencies. As a result, seismic risk is insignificant relative to internal event and fire risk.

Summary of External Event Risk The total external events risk is the sum of the fire, flooding, and seismic risk, or 7.30E-07/yr.

Total Estimated Change in Risk The total change in risk due to this performance deficiency is the sum of the internal and external events CDF risk, or a CDF of 3.67E-06/yr (White).

Potential Risk Contribution Due to Large Early Release Frequency (LERF)

The potential risk contribution due to LERF was considered using IMC 0609 Appendix H, Containment Integrity Significance Determination Process."

Duane Arnold is a GE BWR-4 plant with a Mark I containment. Table 5.1 from Appendix H (Phase 1 screen) indicated that this issue required further evaluation since station blackout sequences were important for BWRs with Mark I containments.

Table 5.2 from Appendix H (Phase 2 analysis) listed a "LERF multiplier" (i.e., LERF factor) of 0.6 for core damage sequences ending with a flooded drywell and high pressure (high pressure defined as greater than 250 psi at the time of reactor vessel breach). Table 5.2 also lists a LERF factor of less than 0.1 for core damage sequences with a flooded drywell and low pressure (less than 250 psi) at the time of reactor vessel breach.

The SRAs used the results of a LERF analysis for a similar diesel generator fail-to-run issue from CY 2008 (Reference IR 05000331/2009-009 (ML091210530)). In that analysis, the SRAs worked with the NRC Headquarters Containment PRA Staff to conclude that the lesser LERF factor was appropriate based on accident timing to allow for effective evacuation of the population and resultant low pressure core damage sequences. The SRAs used judgment to determine that the risk of this deficiency due to LERF was not more significant than risk due to CDF.

Evaluation of Cross-Cutting Aspects The inspectors determined that the performance characteristic of the finding that was the most significant causal factor of the performance deficiency was associated with the cross-cutting aspect of Human Performance, having Decision Making components, and involving the licensee using conservative assumptions in decision making and adopting a requirement to demonstrate that a proposed action is safe in order to proceed rather than a requirement to demonstrate that a proposed action is unsafe in order to disapprove an action. Specifically, the licensee used non-conservative assumptions during the development and implementation of work order 40132858 that significantly contributed to the eventual failure of the A SBDG LO HX gasket. H.1(b)

Enforcement:

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions of a type appropriate to the circumstances and be accomplished in accordance with these procedures. On October 18, 2012, an activity affecting quality for the safety-related A SBDG LO HX tube bundle assembly replacement was not prescribed by instructions appropriate to the circumstances.

Specifically, on October 18, 2012, the licensee completed WO 40132858, which replaced the A SBDG LO HX tube bundle. This WO did not contain sufficient detail and acceptance criteria, appropriate torque values, and operating experience information to ensure the gasket was properly compressed; resulting in the eventual failure of the gasket, a significant oil leak, and the A SBDG being rendered unavailable on March 8, 2013, during a maintenance run. This is an apparent violation of Title 10 CFR 50, Appendix B, Criterion V. The licensee placed this issue into their Corrective Action Program as CR 01855032, replaced the failed gasket, and developed a maintenance procedure to be used for future diesel HX gasket replacements. This issue is being characterized as an apparent violation (AV) in accordance with NRCs Enforcement Policy, and its final significance will be dispositioned in separate future correspondence (AV 05000331/2013010-01; A Standby Diesel Generator Lube Oil Heat Exchanger Gasket Failure).

4OA6 Management Meetings

.1 Exit Meeting Summary

On September 5, 2013, the inspectors presented the inspection results to Mr. R. Anderson and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors confirmed that none of the potential report input discussed was considered proprietary.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

R. Anderson, Site Vice President

G. Pry, Plant General Manager

K. Peveler, Nuclear Oversight Manager (Acting)

R. Wheaton, Operations Site Director

K. Kleinheinz, Site Engineering Director

M. Davis, Emergency Preparedness and Licensing Manager

P. Hansen, Performance Improvement Manager

G. Hawkins, Systems Engineering Manager

R. Nelson, Site Communications Manager

B. Murrell, Licensing Analyst

Nextera Energy

D. Curtland, General Manager of Fleet Engineering

S. Catron, Fleet Licensing Manager

A. Julka, Fleet PRA Manager

Nuclear Regulatory Commission

C. Lipa, Chief, Reactor Projects Branch 1, Region III

D. Passehl, Senior Reactor Analyst, Region III

Attachment 1

LIST OF ITEMS

Opened

05000331/2013010-01 AV A Standby Diesel Generator Lube Oil Heat Exchanger Gasket Failure (Section 1R12)

Closed

05000331/2013002-01 URI A Standby Diesel Generator Lube Oil Heat Exchanger Gasket Failure (Section 1R12)

Discussed

None.

Attachment 1