IR 05000416/2007006
Download: ML071380478
Text
May 18, 2007
William R. Brian, Vice President, Operations Grand Gulf Nuclear Station Entergy Operations, Inc.
P.O. Box 756 Port Gibson, MS 39150
SUBJECT: GRAND GULF NUCLEAR STATION - NRC SPECIAL INSPECTIONREPORT 05000416/2007006
Dear Mr. Brian:
On March 14, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed a specialinspection at your Grand Gulf Nuclear Station facility. This inspection examined activities associated with the Division I standby diesel generator (SDG) high temperature event that occurred on January 30, 2007. On this occasion, the SDG experienced elevated temperatures in the jacket water and lube oil subsystems. The NRC's initial evaluation satisfied the criteria in NRC Management Directive 8.3, "NRC Incident Investigation Program," for conducting a special inspection. The basis for initiating this special inspection is further discussed in this report, which is included as Attachment 2. The determination that the inspection would be conducted was made by the NRC on February 8, 2007, and the inspection started on February 12, 2007.The enclosed inspection report documents the inspection findings, which were discussed onMarch 14, 2007 and again on April 25, 2007, with you and other members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.The report documents four findings which were determined to be violations of very low safetysignificance. Because of their very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as noncited violations consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas, 76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the Grand Gulf Nuclear Station facility.
Entergy Operations, Inc.- 2 -In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, itsenclosure, and your response (if any) will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,/RA Michael C. Hay, ChiefReactor Projects Branch CDocket: 50-416License: NPF-29
Enclosure:
Inspection Report 05000416/2007006 Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Significance Determination Evaluationcc w/
Enclosure:
Executive Vice President and Chief Operating Officer Entergy Operations, Inc.
P.O. Box 31995 Jackson, MS 39286-1995ChiefEnergy & Transportation Branch Environmental Compliance and Enforcement Division Mississippi Department of Environmental Quality P.O. Box 10385 Jackson, MS 39289-0385PresidentClaiborne County Board of Supervisors P.O. Box 339 Port Gibson, MS 39150General Manager, Plant OperationsGrand Gulf Nuclear Station Entergy Operations, Inc.
P.O. Box 756 Port Gibson, MS 39150 Entergy Operations, Inc.- 3 -Attorney General Department of Justice State of Louisiana P.O. Box 94005 Baton Rouge, LA 70804-9005 Office of the GovernorState of Mississippi Jackson, MS 39205Attorney GeneralAssistant Attorney General State of Mississippi P.O. Box 22947 Jackson, MS 39225-2947State Health OfficerState Board of Health P.O. Box 139 Jackson, MS 39205 DirectorNuclear Safety & Licensing Entergy Operations, Inc.
1340 Echelon Parkway Jackson, MS 39213-8298Director, Nuclear Safety AssuranceEntergy Operations, Inc.
P.O. Box 756 Port Gibson, MS 39150Richard Penrod, Senior Environmental Scientist, State Liaison Officer Office of Environmental Services Northwestern State University Russsell Hall, Room 201 Natchitoches, LA 71497 Entergy Operations, Inc.- 4 -Electronic distribution by RIV:Regional Administrator (BSM1)DRP Director (ATH)DRS Director (DDC)DRS Deputy Director (RJC1)Senior Resident Inspector (GBM)Branch Chief, DRP/C (MCH2)Senior Project Engineer, DRP/C (WCW)Team Leader, DRP/TSS (CJP)RITS Coordinator (MSH3)DRS STA (DAP)L. Trocine, OEDO RIV Coordinator (LXT)ROPreports GG Site Secretary (NAS2)K. Fuller, RC/ACES (KSF)C. Carpenter, D:OE (CAC)G. Vasquez (GMV)OE:EA File (RidsOeMailCenter)SUNSI Review Completed: _WCW__ ADAMS: YesG No Initials: _WCW__ Publicly Available G Non-Publicly Available G Sensitive Non-SensitiveR:\_REACTORS\GG\2007\GG2007-06RP-RWD.wpdRIV:SRI:DRP/ERI:DRP/CSRI:DRP/CSRA:DRSC:DRP/CRWDeeseAJBarrettGBMillerRLBywaterMCHay T-WCWalker E-WCWalker MCHay for/RA//RA/5/17/075/14/075/16/075/13/075/18/07OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax Enclosure-1-U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket:50-416Licenses:NPF-29 Report No.:05000416/2007006 Licensee:Entergy Operations, Inc.
Facility:Grand Gulf Nuclear StationLocation:Waterloo Road Port Gibson, Mississippi 39150Dates:February 12 through March 14, 2007 Inspectors:A. Barrett, Resident Inspector, Grand Gulf Nuclear StationR. Bywater, Senior Reactor Analyst R. Deese, Senior Resident Inspector, Arkansas Nuclear One G. Miller, Senior Resident Inspector, Grand Gulf Nuclear StationApproved By:Michael C. Hay, ChiefProject Branch C Division of Reactor Projects Enclosure-2-
SUMMARY OF FINDINGS
IR 05000416/2007006; 02/12/07 - 03/14/07; Grand Gulf Nuclear Station; Special Inspection inresponse to Division I Standby Diesel Generator high temperatures on January 30, 2007.The report covered a 4-day period (February 12-15, 2007) of onsite inspection, with inofficereview through March 14, 2007, by a special inspection team consisting of one senior resident inspector, one resident inspector, and one senior reactor analyst. Four findings were identified.
The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC's management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.Summary of EventThe NRC conducted a special inspection to better understand the circumstances surroundinghigh temperatures on the Division I standby diesel generator jacket water and lube oil systems on January 30, 2007. In accordance with NRC Management Directive 8.3, "NRC Incident Investigation Program," it was determined that this event involved repetitive failures of safety-related equipment having potential adverse generic implications and had sufficient risk significance to warrant a special inspection. A.NRC-Identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Green.
The team identified a noncited violation of 10 CFR Part 50, Appendix B,Criterion XVI, "Corrective Action," involving the failure to identify and correct the cause of elevated temperatures adversely affecting the safety function of the Division I standby diesel generator that had previously occurred in 1999 and 2004.
Subsequently, on January 30, 2007, the Division I standby diesel generator again experienced elevated temperatures during a surveillance run and was subsequently declared inoperable. This issue was entered into the licensee's corrective action program as Condition Report GGN-2007-0378. The finding is greater than minor because it is associated with the mitigatingsystems cornerstone attribute of equipment performance and affects the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The Phase 1 Worksheets in Manual Chapter 0609, "Significance Determination Process," were used to conclude that a Phase 2 analysis was required because the condition represented a loss of safety function of a single train of a Technical Specification system for greater than its allowed outage time. The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power Significance Determination Process," of Manual Chapter 0609, "Significance Determination Process," and the Phase 2 Worksheet for Grand Gulf. The Phase 2 evaluation concluded that the finding was of very low safety significance. A Phase 3 significance determination analysis also determined the finding was of very low safety significance. The cause of the finding is related to the problem Enclosure-3-identification and resolution crosscutting area in that the licensee failed tothoroughly evaluate the problem resulting in ineffective corrective actions being implemented that failed to prevent recurrence of a significant condition adverse to quality (Section 3.0).*Green. The team identified a noncited violation of Technical Specification 5.4.1 (a)involving the failure to maintain an adequate alarm response instruction for standby diesel generator high jacket water temperature. Specifically,
Procedure 04-1-02-1H22-P400, "Alarm Response Instruction, Panel No.: 1H-22-P400, Safety Related," Revision 109, failed to provide adequate guidance to manually override the standby diesel generator jacket water cooling system temperature control valve during emergency conditions. This issue was entered into the licensee's corrective action program as Condition Report GG-2007-1837. The finding is greater than minor because it is associated with the mitigatingsystems cornerstone attribute of procedure quality and affects the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, the finding is determined to have very low safety significance because it did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating events. The cause of the finding is related to the problem identification and resolution crosscutting area in that the licensee did not take appropriate correctiveactions to adequately address a previously identified safety concern (Section 4.0).*Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,Criterion XVI, "Corrective Action," involving the failure to promptly identify a condition adverse to quality. Between February 2-15, 2007, the licensee failed to promptly identify that corrective actions taken in response to a January 30, 2007, failure of the Division 1 standby diesel generator jacket water cooling system temperature control valve had not addressed the cause of the valve failure.
Specifically, following the valve's failure, the licensee inappropriately concluded the valve's internal thermal elements were faulty, replaced the elements, performed postmaintenance testing, and declared the valve and associated standby diesel generator operable on February 1, 2007. Subsequent testing of the suspect faulty thermal elements on February 2 and 13, 2007, found the components were functional. Following receipt of the testing results, the licensee failed to promptly identify that replacement of the thermal elements failed to address the cause of the problem resulting in the failure to evaluate a potential degraded condition affecting operability of the standby emergency diesel generator. This issue was entered into the licensee's corrective action program as Condition Report GGN-2007-2255. The finding is greater than minor because it is associated with the mitigatingsystems cornerstone attribute of equipment performance and affects the associate cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, the finding is determined to have very low safety significance because the condition did not screen as potentially risk significant due to a seismic, flooding, or Enclosure-4-severe weather initiating events. The cause of the finding is related to the problemidentification and resolution crosscutting area in that the licensee did not identify an issue completely, accurately, and in a timely manner commensurate with its safety significance resulting in the failure to evaluate a potential degraded condition for operability (Section 5.0).*Green. The inspectors identified a Green noncited violation of 10 CFR Part 50Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for a failure to follow procedures which resulted in an inadequate operability evaluation.
Specifically, the evaluation did not include an analysis of conditions that could be causing the valve to fail, and it provided no assessment of the effect these conditions would have related to the specified safety function and mission time of the standby diesel generator. The licensee entered this issue in their corrective action program as Condition Report GGN-2007-2256.This finding is more than minor because the failure to perform an adequateoperability evaluation, if left uncorrected, could become a more significant safety concern. Using Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, this finding was of very low safety significance since it did not result in a loss of operability. The cause of this finding has a crosscutting aspect in the area of human performance associated with decision making because licensee personnel failed to use conservative assumptions and did not verify the validity of the underlying assumptions used in making safety-significant decisions (Section 5.0).
B.Licensee-Identified Violations
None Enclosure-5-
REPORT DETAILS
1.0SPECIAL INSPECTION SCOPEThe NRC conducted a special inspection at Grand Gulf Nuclear Station (GGNS) tobetter understand the circumstances surrounding the high temperatures observed in the jacket water system of the Division I standby diesel generator (SDG). The diesel generator was manually shutdown during a surveillance run on January 30, 2007, when the jacket water high temperature alarm annunciated. A failed jacket water cooling system on the SDG could have overheated the diesel, potentially impacting the ability of the SDG to perform its safety function during a design basis accident.
In accordance with NRC Management Directive 8.3, it was determined that this event had sufficient risk significance to warrant a special inspection.
The team used NRC Inspection Procedure 93812, "Special Inspection Procedure," toconduct the inspection. The special inspection team reviewed procedures, corrective action documents, operator logs, design documentation, maintenance records, and procurement records for the Division I SDG. The team interviewed various station personnel regarding the event. The team reviewed the licencee's preliminary root cause analysis report, past failure records, extent of condition evaluation, immediate and long term corrective actions, and industry operating experience. A list of specific documents reviewed is provided in Attachment 1. The charter for the special inspection is included as Attachment 2.2.0SYSTEM AND EVENT DESCRIPTION2.1System DescriptionGGNS uses three diesel generators to provide standby power to safety-relatedequipment required to shutdown the reactor, maintain the reactor in a safe shutdown condition, and mitigate the consequences of an accident. These diesel generators supply electrical buses designated by division number: Division I, Division II, and Division III. The Division I and II SDGs are Transamerica Delaval, Incorporated enginesrated at 5740 kw. The engines are DSRV-4 series (16-cylinder, 4-stroke, turbocharged, and 45 V-type) and are designed to operate at 450 revolutions per minute.The GGNS Transamerica Delaval, Incorporated engines use an independent coolingwater system called the jacket water system to provide cooling water to the diesel engine, the governor oil cooler, the lube oil cooler, and the turbocharger aftercoolers.
The jacket water system is a closed loop system with an expansion tank that utilizes two pumps, one engine driven and the other an electrical, alternating current motor-driven pump. Both pumps have a rated flow of approximately 1800-2100 gallons per minute (gpm). The jacket water system rejects heat to the standby service water system through the jacket water heat exchanger. An automatic three-way thermostatic control valve (TCV), manufactured by AmotControls, directs cooling water to the heat exchanger to maintain SDG temperature between the operating range of 160F to 175F. During operation, approximately200-300 gpm is bypassed by the TCV to the jacket water heat exchanger. Specifically, thermal elements modulate the valve to maintain cooling water at design temperature.
-6-The GGNS TCV uses four thermal elements designed to maintain a nominaltemperature of 165F.
Each thermal element actuates independently to provideapproximately one-fourth of the valve's full open stroke.2.2Event SummaryOn January 30, 2007, GGNS discovered elevated temperatures in the jacket watersystem of the Division I SDG during a monthly test run following a planned system outage. The monthly surveillance required power to be loaded in increments of 1000 kw up to a value greater than 5450 kw and less than 5740 kw. Approximately 5 minutes after increasing the diesel power load to 4400 kw, the jacket water heat exchanger outlet high temperature annunciator alarmed at 175F. Per the procedural guidance,the operator reduced load, shutting down the diesel in a few minutes with jacket water temperature peaking at 180F. This indicates that the temperature was increasing at arate of at least 1F/min. The inspectors determined that GGNS met all TechnicalSpecification requirements during and following the event.GGNS began preparing work orders to inspect the valve internals and replace thethermal elements. During this time, operations completed the Technical Specification required diesel start for the Division II SDG to verify operability. GGNS removed the TCV internals, inspecting the thermal elements, the valve gaskets, and internal assembly. The thermal elements and the gaskets were replaced with new parts and the valve was reassembled. The resident inspector observed the Division I SDG retest and verified that it passed the postmaintenance surveillance. The Division I SDG was declared operable on February 1, 2007.3.0PERFORMANCE DEFICIENCIES RESULTING IN SDG FAILURE
a. Inspection Scope
On July 25, 1999, and September 22, 2004, the Division I SDG experienced hightemperatures in its jacket water and lube oil systems during performance of monthly surveillance runs. The team reviewed the licensee's corrective actions following each of these failures to assess their effectiveness with respect to preventing the subsequent failure that occurred on January 30, 2007.
b. Findings
Introduction.
The team identified a Green noncited violation (NCV) of 10 CFR Part 50,Appendix B, Criterion XVI, "Corrective Action," for the failure to prevent recurrence of elevated temperature events on the Division I SDG after similar events occurred in 1999 and 2004.
Description.
The team noted that the licensee had documented four previousoccurrences of high temperature events on the Division I SDG since facility operation began. The team found that documentation associated with two instances that occurred in the late 1980's did not support meaningful analysis. The two other noted instances occurring in 1999 and 2004 provided more insights, however, the team noted that these evaluations were also deficient with respect to identifying the cause of failure.
-7-On July 27, 1999, the licensee was conducting a monthly surveillance run of the SDG,when 80 minutes into the run, elevated jacket water and lube oil temperatures occurred and their respective alarms were received. Operations personnel took action to secure the SDG and temperatures in the jacket water and lube oil systems were noted to peak at approximately 190F. The licensee secured the SDG and declared it inoperable. The condition was entered into the licensee's corrective action program (CAP) as Condition Report (CR) GGN-1999-0768.This CR received a lower tier apparent cause evaluation. The actions taken for theapparent cause evaluation were reviewed by the team and determined to be inadequate. The apparent cause concluded that two faulty thermal elements may have caused failure of the TCV. This conclusion was based on the fact that these two thermal elements looked different than the other thermal elements in the Division I and Division II SDGs. No other conclusive evidence was cited in the evaluation. The team noted the licensee made this determination even though subsequent testing of the two thermal elements found them functional. On the basis of this information, the team concluded the licensee failed to determine the cause of the SDG high temperature condition that subsequently resulted in their failure to implement effective corrective actions to prevent recurrence.On June 22, 2004, during a monthly surveillance run, the licensee experienced elevatedtemperatures in the Division I SDG jacket water and lube oil systems along with their respective annunciators. Again the licensee took action to secure the SDG and the jacket water and lube oil temperatures peaked at approximately 190F. The licenseesecured the SDG and declared it inoperable. The licensee entered this condition into their CAP as CR GGN-2004-2575.The licensee conducted a root cause analysis for this event. The licensee tested thethermal elements and discovered that one was defective and had leaked some of its paraffin material which rendered the thermal element incapable of actuating.
Additionally, the licensee discovered another thermal element failed to fully actuate between the design specification of 0.42 to 0.48 inches. This thermal element stroked 0.40 inches. With this information, the licensee concluded that defective thermal elements were the cause of the SDG high temperatures.The team questioned the validity of the licensee's conclusion that the thermal elementswere the cause. The team determined that since the TCV had two fully functional thermal elements, in addition to an almost fully functioning third thermal element, that the TCV would have been capable of opening approximately 75 percent of its full stroke for the temperatures experienced during the 2004 event. The inspectors reached this conclusion by adding the minimum full stroke specification for two thermal elements of 0.84 inches (0.42 inches for each thermal element) to the 0.40 inches from the partially degraded thermal element and comparing this to the 1.625-inch full stroke for the TCV.The team noted that the vendor manual for the TCV recommended setting up the valveto allow full cooling flow with the valve halfway open (equivalent to approximately 0.8 inches of valve travel). The team also noted, that since initial setup of the valve, the Division I SDG had been derated from its initial design full load capability of 7 megawatts to 5.6 megawatts and, therefore, would require even less cooling flow than original design specifications. The inspectors concluded with these facts that the SDGshould have had adequate cooling flow with only two fully functional thermal elements.
-8-The team was informed by the SDG system engineer that jacket cooling water system flow measurements were performed on the Division I SDG. These measurements were performed at 5.6 megawatts of loading and showed that approximately 200-300 gpm of flow were needed to be supplied to the jacket water heat exchanger of the total 1700-2100 gpm flow. The inspectors concluded from a review of the thermostatic valve throttling characteristic curve that sufficient flow could be supplied with the valve opened significantly less than half way.When the inspectors combined this flow data with the ability of the remaining fullycapable thermal elements, they concluded that the thermal elements were not the cause of the high temperature event. The inspectors concluded that the root cause was incorrect and; therefore, did not allow the licensee to determine the cause of the SDG high temperatures, and thereby did not allow the licensee to prevent recurrence.Finally, on January 30, 2007, while performing a monthly surveillance run, the licenseeexperienced elevated temperatures in the Division I SDG jacket water and lube oil systems along respective alarms for the high temperatures. The inspectors concluded from this that the licensee had not prevented recurrence of a condition which left uncorrected could have led to the unavailability of the SDG, a key risk-significant, safety-related mitigating component during a design basis event.Analysis. The performance deficiency associated with this finding involved the licenseenot preventing recurrence of a significant condition adverse to quality. The finding is greater than minor because it is associated with the mitigating systems cornerstone attribute of equipment performance and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The Phase 1 Worksheets in Manual Chapter 0609, "Significance Determination Process," were used to conclude that a Phase 2 analysis was required because the finding represented a loss of safety function of a single train of a Technical Specification system for greater than its allowed outage time. The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power Significance Determination Process," of Manual Chapter 0609,
"Significance Determination Process," and the Phase 2 Worksheets for Grand Gulf.
The inspectors assumed that the duration of the Division I SDG unavailability was 28 days. Additionally, the inspectors assumed the Division II SDG was unaffected and operators could not recover the Division I SDG during a postulated high temperature event. Based on the results of the Phase 2 analysis, the finding was determined to have very low safety significance (Green). The senior reactor analyst's review of the Phase 2 analysis determined that a more detailed Phase 3 analysis was needed to fully assess the safety significance. Based on the results of the Phase 3 analysis, the finding was determined to have very low safety significance (Green). The Phase 3 analysis is included as Attachment 3 to this report. The cause of the finding is related to the problem identification and resolution crosscutting area in that the licensee failed tothoroughly evaluate the problem resulting in ineffective corrective actions being implemented that failed to prevent recurrence of a significant condition adverse to quality.
Enforcement.
10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," states, inpart, that for significant conditions adverse to quality, measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.
Contrary to the above, after the occurrence of high temperature conditions on the
-9-Division I SDG on July 27, 1999, and June 22, 2004, the licensee failed to assure thatthe cause of these significant conditions adverse to quality were determined and that corrective actions were taken to preclude repetition. Specifically, the licensee failed to prevent the occurrence of a similar high temperature event on January 30, 2007. This failure resulted in the Division I SDG being inoperable between January 2-30, 2007.
The root cause involved the licensee's inappropriate determination of the thermal elements being the cause of the Division I SDG failures. The corrective actions to restore compliance included replacing TCV FCV-501A on March 2, 2007. Because the finding is of very low safety significance and has been entered into the licensee's CAP as CR GGN-2007-0378, this violation is being treated as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000416/2007006-01, "Failure to Prevent Recurrence of High Standby Diesel Generator Temperatures." 4.0OPERATOR RECOVERY
a. Inspection Scope
The team assessed the licensee's ability to recover the SDG from the high temperatureconditions had the conditions occurred during an event. In this effort, the inspectors reviewed the revision of the alarm response instruction for high jacket water temperatures on the SDG in effect on January 30, 2007, along with prior revisions to the alarm response instruction. The inspectors also questioned operators shortly after January 30, 2007, on how to perform the alarm response instruction. Finally, the inspectors walked down the SDG rooms after January 30, 2007, to check for adequate staging of necessary equipment to perform the steps of the alarm response instruction.
b. Findings
Introduction.
The team identified a Green NCV of Grand Gulf TechnicalSpecification 5.4.1 (a) pertaining to an inadequate alarm response instruction for high SDG jacket water temperature prior to the high temperature event on the Division I SDG on January 30, 2007.Description. On June 22, 2004, while running the Division I SDG during a monthlysurveillance run, the SDG experienced high jacket water and lube oil temperatures along with a high jacket water temperature alarm. The licensee entered this condition into their CAP as CR GGN-2004-2575. The licensee took corrective action to attempt to address the cause of the SDG hightemperatures, and also took corrective action to improve the content of the alarm response instruction for SDG high jacket water temperatures.
Because this procedural guidance was lacking during this 2004 high temperature event, operators did not have clear guidance on how to respond to the event and the SDG was only secured when the operations shift manager ordered the SDG shutdown. Revision 106 of the alarm response instruction for high jacket water temperature was inadequate in that it did not give guidance on how operators should respond to high jacket water temperatures during emergency and nonemergency situations.In response to the assigned corrective action, operations procedure writers madechanges to the alarm response instruction for SDG high jacket water temperature.
These changes included providing instructions on how to manually override the SDG
-10-jacket water TCV FCV-501. Revision 107 of the high jacket water outlet temperaturealarm response instruction added steps for removing the valve cap, adjusting the valve position, and monitoring system temperatures upon receiving alarms for elevated temperatures in the SDG jacket water system. The corrective action was closed when the alarm response instruction was revised.On January 30, 2007, while performing a monthly surveillance run of the Division I SDG,the SDG experienced another high temperature jacket water event. Operators secured the SDG in accordance with Revision 107, which gives them guidance to secure the SDG on receipt of high temperatures in a nonemergency situation. After the event, the resident inspectors questioned three operations personnel, including one senior reactor operator, as to how they would have carried out the alarm response instruction in an emergency situation. The operators were unfamiliar on how to perform the specific subparts of the step which delineates manually overriding the TCV FCV-501. The inspectors identified procedural inadequacies in the alarm response instruction. These are listed below:*No details on removing TCV cap*Unclear information on the direction to turn the TCV
- No information was given regarding the number of turns that should be made.
- No specified parameter to monitor while manually operating the TCV
- The instructions did not identify how to remove the locknut on the TCVAlthough not reflective of the quality of the alarm response instruction, the inspectorsalso discovered that not all of the required tools were available to perform the manual override operation. In noting the lack of detailed guidance in the procedure and the unavailability of tools required by the procedure to perform these critical steps, the inspectors concluded that the alarm response instruction for the SDG TCV was inadequate.Analysis. The performance deficiency associated with this finding involved the licenseenot maintaining an adequate procedure. The finding is greater than minor because it is associated with the mitigating systems cornerstone attribute of procedure quality and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Manual Chapter 0609, "Significance Determination Process,"
Phase 1 Worksheet, the finding is determined to have very low safety significance because it did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating events. The cause of the finding is related to the problem identification and resolution crosscutting area in that the licensee did not take appropriate corrective actions to adequately address a previously identified safety concern.Enforcement. Grand Gulf Technical Specification 5.4.1 (a) requires that writtenprocedures be established, implemented, and maintained covering the activities specified in Appendix A, "Typical Procedures for Pressurized Water Reactors and Boiling Water Reactors," of Regulatory Guide 1.33, "Quality Assurance Program Requirements (Operation)," dated February 1978. Regulatory Guide 1.33, Appendix A, Section 5, "Procedures for Abnormal, Offnormal, or Alarm Conditions," requires procedures for safety-related annunciators to have written procedures which contain immediate operation action and long-range actions. Contrary to this, prior to
-11-January 30, 2007, Procedure 04-1-02-1H22-P400, "Alarm Response Instruction,Panel 1H-22-P400, Safety Related," Revision 107, was not adequate. Specifically, the procedure did not provide adequate guidance for immediate operation action and long-range action for manually overriding the SDG TCV. The root cause involved not ensuring all needed instructions were included in the procedure revision. The corrective actions to restore compliance included properly revising the procedure and training operators on manual operation of the valve. Because the finding is of very low safety significance and has been entered into the licensee's CAP as CR GGN-2007-1837, this violation is being treated as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000416/2007006-02, "Inadequate Alarm Response Instruction for SD Generator High Jacket Water Temperature." 5.0CORRECTIVE ACTIONS FOLLOWING SDG FAILURES
a. Inspection Scope
The team assessed the licensee's immediate and long-term planned corrective actionsassociated with the Division I SDG failure that occurred on January 30, 2007. The team assessed the engineering and operations departments' implementation of the operability determination (OD) process immediately after the failure and then after identifying that the maintenance they had conducted to the TCV may not have corrected the cause of the failure. This assessment was performed through interviews, review of operator logs, corrective action documents, ODs, work orders, and related documents.
b. Findings
(1)Failure To Identify Actions Taken After SDG Inoperability Were InadequateIntroduction. The inspectors identified a Green NCV of 10 CFR Part 50, Appendix B,Criterion XVI, "Corrective Action," for the licensee's failure to identify that their corrective action after the January 2007 high temperature event on the Division I SDG were not adequate.Description. On January 30, 2007, the Division I SDG experienced the high temperatureevent. Operators shut down the SDG and declared it inoperable in an effort to troubleshoot the cause of the high temperatures. During their troubleshooting and maintenance, the licensee cleaned and inspected the internals of TCV FCV-501, and replaced the valves thermal elements and o-rings. After reviewing the conduct of this maintenance, reviewing input from engineering personnel as to the operability of the SDG, and conducting a satisfactory surveillance run, operations personnel declared the SDG operable. The licensee entered the high temperature event on the Division I SDG in their CAP asCR GGN-2007-0378 and began a root cause determination to find the cause of the failure. In this effort, the licensee tested the thermal elements from the TCV for the SDG at GGNS on February 2, 2007. This testing did not identify any failures of the thermal elements. At that point, the licensee did not recognize, as an organization, that their implemented corrective actions failed to fix the failure mechanism. The resident inspectors subsequently questioned the operability with the licensee at which time they stated they were sending the thermal elements to the vendor for further testing and
-12-were waiting on those additional testing results. The inspectors considered that thelicensee missed an opportunity to identify that the SDG was not fully operable at this time.On February 9, 2007, the additional vendor testing identified no thermal elementfailures. Engineering department personnel developed a white paper later that day and distributed to selected site personnel. The white paper stated that binding of the valve appeared to be the cause of the failure. Licensee personnel, including representatives from the operations department, evaluated the white paper, but did not exercise their processes to evaluate this condition in their CAP. As a result, the licensee did not formally question the operability of the valve in an OD. The inspectors considered that the licensee missed another opportunity to identify that the SDG was not fully operable at this time.The special inspection team was sanctioned by NRC Region IV's management andarrived on site on February 12, 2007. As part of their charter, the inspection began to question operability of the SDG since it appeared that the thermal elements were definitely suspect as the cause of the SDG high temperature event. On February 14, 2007, the team questioned operability. Operations, engineering, and licensing department personnel questioned by the inspectors stated there was no conclusive information on the failure mechanism, and the decision was made to wait for completion of the root cause investigation prior to considering the valve degraded. The inspectors considered that the licensee missed yet another opportunity to identify that the SDG was not fully operable at this time.On February 15, 2007, the special inspection team debriefed plant management anddiscussed their concern that the valve was potentially degraded and that the inspectors questioned the licensee's evaluation of the operability. Following this debrief, the licensee entered the condition into their corrective action process as CR GGN-2007-0660 and performed an operability evaluation, in which the licensee declared the SDG degraded but operable based on engineering judgement. The inspectors considered that the licensee had gone nearly 2 weeks with mounting evidence that the thermal elements were not the cause of the SDG failure yet had not taken action to enter this deficient condition into their CAP.
Analysis.
The performance deficiency associated with this finding involved thelicensee's failure to identify a significant condition adverse to quality. The finding is greater than minor because it is associated with the mitigating systems cornerstone attribute of equipment performance and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.
Using Manual Chapter 0609,
"Significance Determination Process," Phase 1 Worksheet, the finding is determined to have very low safety significance because the condition did not screen as potentially risk significant due to a seismic, flooding, or severe weather initiating events. The cause of the finding is related to the problem identification and resolution crosscutting area in thatthe licensee did not identify an issue completely, accurately, and in a timely manner commensurate with its safety significance resulting in the failure to evaluate a potential degraded condition for operability.Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires,in part, that measures be established to assure that conditions adverse to quality, are
-13-promptly identified and corrected. Contrary to the above, between February 2-15, 2007,the licensee did not promptly identify the fact that their corrective actions were not addressing the cause of the Division I SDG high temperature event based on evidence that the thermal elements of TCV FCV-501 were not the faulty subcomponent of the valve. The root cause involved the licensee's reliance on successful valve operation after performing similar TCV maintenance. The corrective actions to restore compliance included the licensee reassessing their OD of the SDG and replacing the TCV on March 2, 2007. Because the finding is of very low safety significance and has been entered into the licensee's CAP as CR GGN-2007-2255, this violation is being treated as an NCV consistent with Section VI.A of the Enforcement Policy:
NCV 05000416/200706-03, "Failure to Promptly Identify a Degraded Condition." (2)Failure To Follow Procedures Resulting In An Inadequate Operability EvaluationIntroduction. The inspectors identified a Green NCV of 10 CFR Part 50 Appendix B,Criterion V, for a failure to follow procedures which resulted in an inadequate operability evaluation.Description. On February 15, 2007, the licensee initiated CR GGN-2007-0660 inresponse to the high failure frequency of the jacket water TCV on the Division I SDG.
Control room operators performed an immediate OD and declared the SDG operable based on engineering judgement. The operators completed a Reasonable Expectation of Operability form in accordance with Procedure EN-OP-104, "Operability Determinations," Revision 2, and documented the basis of the OD as the maintenance that had recently been performed on the valve and the short length of time until the next scheduled maintenance window relative to the observed failure frequency. Operators issued a corrective action to the engineering staff to provide a detailed technical justification for the calculated failure frequency of the TCV or, alternatively, to provide a detailed technical explanation for how the recently performed maintenance on the valve would prevent future failures when previous maintenance activities had not.The engineering staff completed the operability evaluation on February 16, 2007. Control room operators immediately declared the SDG operable, stating the corrective action response provided sound basis for the operability of the equipment. The inspectors reviewed the operability evaluation and noted the technical justifications for the valve failure frequency and the maintenance performed appeared to have been copied nearly verbatim from the original Reasonable Expectation of Operability form.
The inspectors concluded the evaluation provided virtually no new information beyond what had already been documented in the CR and was therefore an incomplete response to the corrective action assignment.The inspectors further noted the operability evaluation did not include an analysis ofwhat could have been causing the TCV to fail, and it provided no assessment of the effect the degraded condition would have related to the specified safety function and mission time of the SDG. The evaluation also failed to consider the risk of the engineering judgement being wrong. The inspectors concluded the acceptance of evaluation by operators was contrary to Procedure EN-LI-102, "Corrective Action Process," Revision 8, which required the assigners of corrective actions to ensure the response was complete and adequate before closing the corrective action assignment.
-14-The inspectors expressed the above concerns to licensee management. OnFebruary 28, 2007, the licensee declared the Division I SDG inoperable in lieu of performing a complex evaluation of compensatory actions. The jacket water temperature control valve was replaced on March 2, 2007.Analysis. The failure to require an adequate corrective action response per stationprocedures was a performance deficiency. This finding is more than minor because the failure to perform an adequate operability evaluation, if left uncorrected, could become a more significant safety concern. Using Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, this finding was of very low safety significance since it did not result in a loss of operability.
The cause of this finding has a crosscutting aspect in the area of human performance associated with decisionmaking because licensee personnel failed to use conservative assumptions and did not verify the validity of the underlying assumptions used in making safety-significant decisions.Enforcement. 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures andDrawings," states, in part, that activities affecting quality shall be prescribed by documented instructions and shall be accomplished in accordance with those instructions. Contrary to the above, on February 16, 2007, licensee operators failed to implement Section 5.8[4] of Procedure EN-LI-102, "Corrective Action Process,"
Revision 8, which required assigners of corrective actions to ensure required actions are complete and corrective action responses are adequate. Because this violation was of very low safety significance and was entered in the corrective action program as CR GGN-2007-2256, this violation is being treated as a NCV consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2007006-04, "Failure to Follow Procedures Resulting in an Inadequate Operability Evaluation."4OA6 Meetings, Including ExitOn March 14, 2007, the initial results of this inspection were presented to Mr. R. Brian,Vice President, Operations, and other members of his staff who acknowledged the findings. Additionally on April 25, 2007, the final results of this inspection were presented to Mr. J. Reed, General Manager, Plant Operations, and other members of his staff who acknowledged the findings. The inspector asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified. ATTACHMENT 1:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
- C. Abbott, Acting Quality Assurance Manager
- D. Barfield, Director, Nuclear Safety Assurance
- B. Blanche, Operations Shift Manager
- C. Bottemiller, Manager, Plant Licensing
- R. Brian, Vice President, Operations
- F. Bryan, Project Manager
- R. Collins, Operations Manager
- J. Edwards, Minority Owner Representative, SMEPA
- C. Ellsaesser, Manager, Planning, Scheduling, and Outages
- P. Griffith, Senior Engineer
- E. Harris, Manager, Corrective Actions and Assessments
- M. Krupa, Director, Engineering
- M. Larson, Senior Licensing Specialist
- J. Reed, General Manager, Plant Operations
- M. Rohrer, Manager, System Engineering
- G. Smith, Senior Engineer
- G. Swords, Root Cause Analysis Evaluator
- F. Weaver, Assistant Operations Manager
- D. Wiles, Director, Engineering
- R. Wright, Engineering Supervisor
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened and
Closed
- 05000416/FIN-2007006-01NCVFailure to Prevent Recurrence of High Standby DieselGenerator Temperatures (Section 3.0)
- 05000416/FIN-2007006-02NCVInadequate Alarm Response Instruction for SDG HighJacket Water Temperature (Section 4.0)
- 05000416/FIN-2007006-03NCVFailure to Promptly Identify a Degraded Condition(Section 5.0)
- 05000416/FIN-2007006-04NCVFailure to Follow Procedures Resulting in an InadequateOperability Evaluation (Section 5.0)
LIST OF DOCUMENTS REVIEWED
ProceduresNumberTitleRevision02-S-1-28Diesel Generator Start Log204-1-02-1H22-P400Alarm Response Instruction, Panel No.: 1H-22-P400,Safety Related10604-1-02-1H22-P400Alarm Response Instruction, Panel No.: 1H-22-P400,Safety Related10704-1-02-1H22-P400Alarm Response Instruction, Panel No.: 1H-22-P400,Safety Related10907-S-24-P75-F501-1Jacket Water Thermostatic Valve Thermal ElementReplacement506-OP-1P75-M-0001Standby Diesel Generator 11 Function Test12806-OP-1P75-M-0002Standby Diesel Generator 12 Functional Test106
- EN-LI-102Corrective Action Process108
- EN-OP-104Operability Determinations2CRsCR-GGN-1993-0195CR-GGN-2004-1949CR-GGN-2005-2208CR-GGN-1998-0446CR-GGN-2004-2525CR-GGN-2005-2331
- CR-GGN-1998-0608CR-GGN-2004-2575CR-GGN-2005-2563
- CR-GGN-1999-0768CR-GGN-2004-2581CR-GGN-2005-2785
- CR-GGN-1999-0817CR-GGN-2004-2620CR-GGN-2005-2786
- CR-GGN-1999-0966CR-GGN-2004-2775CR-GGN-2005-2850
- CR-GGN-1999-1229CR-GGN-2004-2854CR-GGN-2005-2880
- CR-GGN-2000-0133CR-GGN-2004-3088CR-GGN-2005-2991
- CR-GGN-2000-0170CR-GGN-2004-3324CR-GGN-2005-3078
- CR-GGN-2001-1705CR-GGN-2004-3352CR-GGN-2005-5272
- CR-GGN-2002-0551CR-GGN-2004-3353CR-GGN-2005-5443
- CR-GGN-2002-0557CR-GGN-2004-3360CR-GGN-2006-0776
- CR-GGN-2002-0891CR-GGN-2004-4116CR-GGN-2006-0852
- 1A1-3CR-GGN-2002-1224CR-GGN-2004-4596CR-GGN-2006-0952CR-GGN-2002-1821CR-GGN-2004-4610CR-GGN-2006-1461
- CR-GGN-2002-2041CR-GGN-2004-4616CR-GGN-2006-3101
- CR-GGN-2003-1004CR-GGN-2005-0160CR-GGN-2006-4082
- CR-GGN-2003-1074CR-GGN-2005-0345CR-GGN-2007-0378
- CR-GGN-2003-1088CR-GGN-2005-0554CR-GGN-2007-0400
- CR-GGN-2003-1164CR-GGN-2005-1225CR-GGN-2007-0417
- CR-GGN-2003-1395CR-GGN-2005-1554CR-GGN-2007-0427
- CR-GGN-2004-1586CR-GGN-2005-1730Industry Information/Operational ExperienceComanche Peak Steam Electric Station Smartform
- SMF-2000-002502-00Licensee Event Report 86-033-00, Manually Shut Down During Surveillance Test Due to HighLube Oil TemperatureLicensee Event Report 91-010-00, Technical Specification Required Shutdown Due to anInoperable Standby Diesel GeneratorNRC Information Notice 91-85, Potential Failures of Thermostatic Control Valves for DieselGenerator Jacket WaterNRC Information Notice 82-56, Robertshaw Thermostatic Flow Control Valves Part 21 Report 1997-04-0, Seabrook Station, "Supplement to Diesel Generator Special Report"Work Orders/Maintenance Work OrdersMWO 03536Receipt inspection of Amot Type-D Serial Number A761MWO 34475Rework and replace power elements
- MWO 50207Division I temperature control valve adjustment
- MWO 51507Rebuild spare valve assembly
- MWO 64290Remove and rebuild valve internals
- MWO 81841Installation of new power elements
- WO 46758Replace thermal elements
- WO 67751 Replace thermal elements
- WO 207466Low jacket water temperature troubleshootingDrawingsNumberTitleRevisionM-1070AStandby Diesel Generator System39M-1070CStandby Diesel Generator System18
- M-1093BHigh Pressure Core Spray Diesel Generator System24
- C641Amot Type 8D4Miscellaneous InformationAECM 88/0099, Letter from John G. Cesare, Jr., Director of Nuclear Licensing to USNRC,dated May 4, 1988, "Diesel Shutdown Due to High Lube Oil Temperature"Calculation E-DCP 82/5020-1, "Transient Loading on Diesel Generators During LoadSequencing"Engineering Report
- GGNS-01-0001, "Study to Determine Feasibility of Extending Frequenciesof Division I and Division II Standby Diesel Generator Outage Related Maintenance Inspections," Revision 0Grand Gulf Nuclear Station IR-88-4-3
- Grand Gulf Nuclear Station Inservice Testing Bases Document, Program SectionN0.CEP-IST-1, Revision 4GTC 2004/00091, Additional testing of SDG thermal elements
- Maintenance Personnel Interviews, February 9, 2007
- Purchase Order 11517
- Purchase Order 10067787
- Standby Diesel Generator Start Logs (Divisions I and II)
- Texas Utilities Certificate of Conformance for Order S02915836S2
- Vendor Manual
- 460000452, Amot Model 8D Thermostatic Valve
LIST OF ACRONYMS
CAPcorrective action programCFRCode of Federal RegulationsCRcondition report
- GGN [[]]
SGrand Gulf Nuclear Station
gpmgallons per minute
- NR [[]]
CU.S. Nuclear Regulatory Commission
ODoperability determination
SDGstandby diesel generator
TCVthermostatic control valve
A2-1Attachment 2February 8,
- 2007MEMORA [[]]
- NDUM [[]]
- TO Richard W. Deese, Senior Resident Inspector, Arkansas Nuclear OneProject Branch E, Division of Reactor ProjectsAndrew J. Barrett, Resident Inspector, Grand Gulf Nuclear StationProject Branch C, Division of Reactor Projects
- INSPEC [[]]
- TION [[]]
- TO [[]]
- EVALUA [[]]
- TE [[]]
- THE [[]]
- EMERGE [[]]
- NCY [[]]
- DIESEL [[]]
- FAILUR [[]]
EA Special Inspection Team is being chartered in response to the Grand Gulf Nuclear Station emergency diesel generator (EDG) failure. The diesel had to be manually tripped during
surveillance testing on January 30, 2007. You are hereby designated as the Special Inspection
Team members. Mr. Deese is designated as the team leader. The assigned SRA to support
the team is Russ Bywater.A.BasisOn January 30, 2007, during performance of a monthly surveillance test, EDG 1 wasmanually shut down by operators due to a jacket water high water temperature alarm
and indications of temperatures rising significantly faster than normal. The licensee
determined that the condition resulted from a faulty thermostatic temperature control
valve (TCV) that supplies cooling water to the EDG jacket water cooling system. The
licensee has preliminarily identified the cause of the failure to be the thermal elements
inside the
TCV failures in 1999 and 2004.
These failures resulted in replacing the thermal elements. Based on the most recent
failure of the thermal elements on EDG 1 and previous licensee efforts to identify and
correct EDG thermal element problems, it is questionable whether the effectiveness of
the licensee's corrective actions has been adequate. Failure of these
EDG failures due to overheating, resulting in crankcase explosions.
One such occurrence is documented in NRC Information Notice 91-85, "Potential
Failures of Thermostatic Control Valves for Diesel Generator Jacket Cooling Water."
A2-2Attachment
EDG thermostatic valveproblems, evaluating the cause of these problems and implementation of
corrective actions to resolve identified problems.c.Identify and assess additional actions planned by the licensee in response torepetitive problems with the
TCV, including the timeline for completion of
these actions.d.Assess the licensee's root cause evaluation, the extent of condition, and thelicensee's common mode evaluation.e.Evaluate pertinent industry operating experience and potential precursors to theJanuary 30 event, including the effectiveness of licensee actions taken in
response to the operating experience.f.Determine if there are any potential generic issues related to the failure of theEDG 1 thermostatic control valve. Promptly communicate any potential generic
issues to Region IV management.g.Determine if the Technical Specifications were met when the diesel wasmanually secured prior to tripping on high temperature.h.Collect data as necessary to support a risk analysis.C.GuidanceInspection Procedure 93812, "Special Inspection," provides additional guidance to beused by the Special Inspection Team. Your duties will be as described in Inspection
Procedure 93812. The inspection should emphasize fact-finding in its review of the
circumstances surrounding the event. It is not the responsibility of the team to examine
the regulatory process. Safety concerns identified that are not directly related to the
event should be reported to the Region
- IV office for appropriate action.The Team will report to the site, conduct an entrance, and begin inspection no later than February 12, 2007. While on site, you will provide daily status briefings to Region
IV
management, who will coordinate with the Office of Nuclear Reactor Regulation, to
ensure that all other parties are kept informed. A report documenting the results of the
inspection should be issued within 30 days of the completion of the inspection.
A2-3Attachment 2This Charter may be modified should the team develop significant new information thatwarrants review. Should you have any questions concerning this Charter, contact me at
(817) 860-8144.
A3-1Attachment 3Attachment 3: Significance Determination Evaluation Significance Determination Process (SDP)Phase 1 ScreeningThe finding was more than minor because it affected the equipment performanceattribute of the mitigating system cornerstone due to the impact on availability and
reliability of the emergency diesel generator. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Determining theSignificance of Reactor Inspection Findings for At-Power Situations," dated March 23,
2007, the inspectors conducted a SDP Phase 1 screening and determined that the
finding resulted in loss of the safety function of Division 1 Standby Diesel
Generator (DG) for greater than the Technical Specification allowed outage time.
Consequently, a Phase
- 2 SDP risk significance estimation was required.Phase 2 Risk Significance EstimationInternal Events and Large Early Release Frequency (
LERF)
In the Phase
RIV senior reactor analyst (SRA)performed a Phase 2 evaluation using the Risk-Informed Inspection Notebook for Grand
Gulf Nuclear Station, Revision 2.01, (SDP Phase 2 Notebook) and its associated
"Phase 2 Pre-solved Table."Assumptions:
- Exposure TimeThe time between the last successful Division I DG surveillance test onJanuary 2, 2007, and the January 30, 2007, surveillance test during which the
Division I
DG keep-warm system
design and its operation while the engine was in a standby condition, the
inspectors determined that the keep-warm system maintained coolant
temperature below the setpoint of the temperature control valve. This meant that
the temperature control valve would not have operated while the engine was in a
standby condition. Therefore, the inspectors concluded that the temperature
control valve (and the DG) could reasonably been known to have been
nonfunctional for a 28-day exposure period. Therefore, the inspectors used a
"3-30 days" exposure time in the Phase 2 Evaluation when determining the
appropriate Initiating Event Likelihood (IEL).*Recovery CreditThe high-temperature trip of the
LOOP. The inspectors determined that
after an emergency start, operators would not be capable of diagnosing the
A3-2Attachment 3problem and locally operating the temperature control valve prior to failure of theDG due to excessive temperature. Therefore, recovery was not credited.Phase 2 SDP Evaluation Method:
The Division I
IMC 0609, Appendix A, the pre-solved table could be used directly to
assess the finding. The table identified that the finding was "CDF-dominant."
Therefore, no additional review was required for
- LE [[]]
RF consideration. For a 3 - 30 day
exposure time, the pre-solved table identified that the significance of the finding was
Green with respect to CDF. The dominant sequence (with an equivalent risk
contribution of 7) involved a station blackout (LOOP with failure of the Division I, II,
and
- III [[]]
- RC [[]]
IC, and failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This
sequence is represented as:
REC1.LERF
As described above, the finding was
LERF assessment wasrequired.External Events
Neither the Grand Gulf SDP Phase 2 Notebook nor the pre-solved table includesscreening capability for external events or other initiating events. Because the risk
contribution of the finding due to internal events was green with significance greater
than 1E-7/year, additional evaluation was required to determine if external initiators
could be risk significant. Experience has shown using the Risk-Informed Inspection
Notebooks that accounting for external initiators could result in increasing the risk
significance of an inspection finding by as much as one order of magnitude. The SRA
determined that the most efficient method of accounting for external initiators was to
perform a Phase 3 analysis, while using the guidance provided in IMC 0609,
Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Attachment 3, "User Guidance for Screening of External Events Risk
Contributions."Phase 3 SDP AnalysisInternal Events
Assumptions:
- Exposure TimeBased on the available information from the inspectors and the licensee's rootcause assessment, and after review by other risk analysts from the Office of
Nuclear Reactor Regulation, the finding was assumed best represented by a
14-day (T/2) exposure time. This was because the analysts could not
A3-3Attachment 3conclusively determine from the information provided that the temperaturecontrol valve was in a "certain-to-fail" condition following the January 2, 2007,
surveillance, or if the valve had some higher random failure probability.
Therefore, a 14-day exposure time was assumed. *Recovery CreditAs in the Phase 2 Evaluation, no operator recovery credit was assumed.*Common-Cause Failure ConsiderationThe temperature control valves for the Division I and Division
- II [[]]
III DG temperature control
valve, although from the same manufacturer and of the same principle of
operation, was an
BOC 170-01 valve, with different design and
function. Therefore, no common-cause failure mechanism was considered
applicable to the Division
- III [[]]
DG. However, common-cause was assumed
applicable to the Division
- II [[]]
DG. In other words, the failure of the Division I
- RA [[]]
Handbook, a component failure should only be modeled as an independent
failure if the cause is well understood and there is no possibility that the same
circumstance exists in other components in the same common-cause component
group.Phase 3 SDP Analysis Method:
Internal Events
For the Phase
SPAR) model for Grand Gulf Nuclear Station, Revision 3.31, dated October 10, 2006,
to estimate the risk associated with the finding. Average test and maintenance was
assumed and a cutset truncation of 1.0E-12 was used. The finding was modeled by
setting the basic events for the Division I
TRUE and the
Division I DG failure-to-run equal to 1.0. These changes would invoke appropriate
changes to address consideration of common-cause failures as discussed above.
Another change involved setting a basic event in the
- SP [[]]
AR model that was no longer
applicable to
- FAL [[]]
SE. This event, discovered during a cutset-level review of the results,
involved operator action to bypass
- RC [[]]
IC isolation on high steam tunnel temperature.
The licensee provided a calculation that indicated that steam tunnel temperature would
not reach isolation setpoint temperature in time to be of concern and therefore, did not
need to be modeled for this analysis. The resulting internal event analysis was an
increase in the core damage frequency of 4.05E-7/yr for a 14-day exposure period. The
dominant sequence (contributing about 25 percent of the total increase in core damage
frequency) involved a
- III [[]]
DGs, and
failure to recover a DG or offsite power within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
A3-4Attachment
- LE [[]]
DG failures, and failure to recover a DG or offsite power within 30 minutes
when
- RC [[]]
IC had failed to start. The resulting increase in core damage frequency
associated with this sequence was less than 1E-7/yr. Therefore, in accordance with
IMC 0609, Appendix H, "Containment Integrity Significance Determination Process," this
finding was not significant with respect to
- LE [[]]
RF.External Events (Including Internal Flooding)
SeismicUsing information from
IPEEE(Individual Plant Examination of External Events) the SRA determined that the finding
may have been substantial enough to alter the Phase 2 result because the Division I DG
was on the licensee's seismic safe shutdown list, was used to mitigate the
consequences of a loss of offsite AC power during a seismic event, and the exposure
time was greater than 3 days. However, when the SRA evaluated the seismic
contribution using the "Seismic Event Modeling and Seismic Risk Quantification
Handbook" of the
CDF of a
seismically-induced
II DG for a 14-day
exposure period was in the mid E-9/year range. Therefore, the seismic risk contribution
of the finding is insignificant relative to the internal events result.FloodUsing
- IMC 0609, Appendix A, Attachment 3, Table 3.1, "Plant Specific Flood Scenariosand Initiator Frequencies," the
SRA determined that the Division I DG was not a
structure, system, or component identified as critical to avoiding core damage for any
flood scenario of significance. Therefore, flood risk contribution was screened out from
further consideration.FireThe Division I DG is in the protected train of the post-fire safe shutdown path. Therefore, the finding was potentially significant with respect to its contribution from fire
events.The licensee has a fire PRA which has the capability of assessing the risk impact ofnonfunctional equipment for fires in all fire areas with the exception of the control room.
For control room fires, the licensee can use its fire PRA to calculate conditional core
damage prababilities for the control room fire groups identified in the
- IPE [[]]
EE. The
licensee provided this information to the SRA to assess the risk contribution due to fires
with the Division I
SRA considered this information provided by
A3-5Attachment 3the licensee to be the "best available information" in the context of
NRC staff's
preliminary significance determination in a timely manner.The results of the fire analysis with the Division I
CDF = 1.34E-7/yearother fire areas:delta CDF = 5.75E-8/year
total fire contribution:delta
IMC 0609, Appendix A,Attachment A, the SRA concluded the total contribution to risk significance of this finding
due to external initiators was approximately 1.92E-7/year.Total Estimated Change in Core Damage Frequency
The total risk contribution of the finding is expressed as the summation of the internalevents contribution and the external events contribution. This result is:Internal Events: delta
CDF = 1.92E-7/yearTotal:delta CDF = 5.97E-7/year
In conclusion, the risk significance of this finding with respect to increase in coredamage frequency is of very low safety significance (Green).Licensee's Risk EvaluationThe licensee evaluated the finding in two ways. The first case assumed the Division IDG was not functional for 14 days. The second case evaluated a "degraded" condition
of the Division I DG rather than it being not functional resulting in an increased
unreliability (increased failure-to-start probability) for an extended period prior to the
January 30, 2007, test failure. Using this approach, the licensee evaluated past
surveillance testing data and estimated that the increase in the failure-to-start probability
for the Division I DG due to the performance deficiency was 2.94E-2. For this case, the
licensee used a 1-year exposure time, the maximum exposure time generally used in
SDP evaluations.The licensee's results for these cases were as follows:
A3-6Attachment 3Case 1 (DG I notfunctional for 14days)Case 2 (DG I increased