Text

December 22, 2006

EA-06-221 James M. Levine, Executive Vice President, Generation Mail Station 7602 Arizona Public Service Company P.O. Box 52034 Phoenix, AZ 85072-2034

SUBJECT: PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - FINALSIGNIFICANCE DETERMINATION

Dear Mr. Levine:

The U.S. Nuclear Regulatory Commission's (NRC) Inspection Report 05000528; 05000529;05000530/2006011, dated September 28, 2006, described the results of a special inspection conducted to examine the circumstances associated with chemical fouling of the ultimate heat sink at the Palo Verde Nuclear Generating Station. In this inspection, the NRC found that Arizona Public Service failed to recognize that improper chemistry controls for the emergency spray pond systems in all three nuclear units at the site caused degraded performance over a period of years. Poor emergency spray pond chemistry controls caused chemical fouling of safety-related heat exchangers cooled by the emergency spray pond system, including emergency diesel generator coolers, and essential cooling water heat exchangers. The fouling affected the safety functions of cooling the core and containment during a potential accident, cooling the safety equipment needed to respond to an accident, and cooling the fuel in the spent fuel pool. The report discussed five apparent violations that were being evaluated for further NRC action under the NRC's Significance Determination Process or NRC Enforcement Policy.In the cover letter of NRC's Inspection Report 05000528; 05000529; 05000530/2006011, theNRC informed Arizona Public Service Company of the NRC's preliminary conclusions, whichwere based on a Phase 2 significance determination. The NRC required additional information to complete the more rigorous Phase 3 significance determinations. The NRC provided Arizona Public Service Company an opportunity to request a Regulatory and Predecisional Enforcement Conference on this matter which you accepted. In a November 14, 2006, pre-conference letter (ML06320503430), you provided the results of your evaluation of the programmatic and organizational causes of the spray pond issue so that the Regulatory and Predecisional Enforcement Conference could focus on the risk significance of the apparent violations. You agreed to four of the five apparent violations. You also indicated that, based on your evaluation, Essential Cooling Water Heat Exchanger 2B was able to perform it's safety function, Arizona Public Service Company-2-with no increase in risk expected, due to the large margin in the heat exchanger design,favorable credit for eddy current probe cleaning, and actual spray pond and air temperatures.

You, therefore, disagreed with the apparent violation of Technical Specification 3.7.7, "Essential Cooling Water System."A Regulatory and Predecisional Enforcement Conference was held on November 20, 2006, atthe NRC Region IV office in Arlington, Texas, to assess the significance and impact of the chemical fouling of equipment in two key systems: (1) essential cooling water heat exchangers and (2) the room chillers for safety related pumps and other room cooling loads. The NRC had previously concluded that the emergency diesel generators had never been fouled enough to be inoperable, and had concluded that the only increase in risk associated with essential cooling water involved Unit 2, Train B during part of 2003. This degraded condition was determined to have the potential to affect the associated essential chiller because the degraded essential cooling water heat exchanger would not have been able to provide adequate cooling to the chiller. Therefore, the conference discussion focused on the causes of the apparent violations, a detailed discussion of heat exchanger fouling rates, a possible heat exchangercleaning mechanism, and the minimum required capability based on actual conditions during the period when Essential Cooling Water Heat Exchanger 2B was degraded in 2003. The Arizona Public Service Company's staff described corrective actions, the root causes of the violations, and chemical fouling effects. In a November 28, 2006, letter (ML063420493), you provided corrections, clarifications and additional information requested by the NRC during the conference.The NRC evaluated the five apparent violations for further NRC action under the NRC'sSignificance Determination Process and NRC Enforcement Policy. The NRC considered the information developed during our followup, as documented in the enclosure, the Arizona Public Service Company position provided in the November 14, 2006, letter (ML06320503430), the information you provided at the Regulatory Conference (see Meeting Summary dated November 29, 2006, ML063390464), and the information provided in a November 28, 2006, letter (ML063420493) following the conference.From a significance determination perspective, the complexity of the system interactions, thedata available, and the need to project capabilities where data was not available resulted in considerable uncertainty in both your risk evaluation and ours. While we agreed with many of the facts and assumptions that formed the basis for your risk determination, we identified areas of disagreement and determined to use more conservative assumptions. The bounding assumptions discussed in the attachment, Phase 3 Significance Determination, are believed to compensate for the uncertainties in the NRC's risk analysis. The NRC has concluded that the most appropriate value for the change in core damage frequency associated with these issues is 2.3 x 10-7 per year, allowing for some incidental cleaning credit, using actual pond andweather conditions during the period of greatest degradation, using midrange credit for operator recovery actions, and using upper bound values (conservative values) for the remaining assumptions. To assess uncertainty, the maximum upper bound for the change in core damage frequency associated with these issues was determined to be 1.3 x 10-6 per year,allowing no credit for incidental cleaning, and using actual spray pond and weather conditions during the period of greatest degradation, and using a high value for failure probability for operator recovery actions, and applying a maximum dependency on pump room cooling. Given Arizona Public Service Company-3-that the majority of the range of core damage frequency lies within the Green region, andconsidering the uncertainty involved as defined by the significance determination process, we have concluded that the most appropriate characterization of the significance of this issue is Green, i.e., very low safety significance.From an enforcement perspective, NRC evaluated your claim that Essential Cooling WaterHeat Exchanger 2B was able to perform its safety function due to the large margin in the heat exchanger design, favorable credit for eddy current probe cleaning and actual spray pond, and air temperatures. You therefore disagreed with the apparent violation of Technical Specification 3.7.7, "Essential Cooling Water System." Based on the information provided to the NRC, the results of NRC's compliance review and our risk evaluations, the NRC has concluded that heat exchanger fouling caused Essential Cooling Water Heat Exchanger 2B to be incapable of performing its intended safety function as required for Technical Specification compliance. As discussed in the enclosure, our Phase 3 significance determination used a number of assumptions which were less favorable than the assumptions made by your staff in evaluating the heat exchanger capability and cleaning credit, and concluded that Heat Exchanger 2B was inoperable for approximately 78 days in 2003. The enclosure includes details of our review and assessment that is intended to supplement the information provided in the original inspection report for this issue.The NRC concluded that there were five violations of NRC requirements. These were originallycharacterized as being associated with a single performance deficiency. The NRC has determined that it is appropriate to recharacterize the apparent violations as separate performance deficiencies in order to properly treat them within the Reactor Oversight Program.

Because these violations were of very low safety significance, have been entered into your corrective action program, and you have identified the root causes and taken appropriate corrective actions, these violations are being treated as noncited violations consistent with Section VI.A of the Enforcement Policy. Cross cutting aspects were identified for four of these five violations, which is described in detail in the enclosure.Even though we determined that the risk significance was low, in this particular case, the largeamount of degradation of these key safety systems for a long period of time is particularly egregious. The performance problems that led to the heat exchanger degradation and the treating of symptoms rather than identifying the cause of the degradation for many years are examples of the same types of performance problems we have identified at Palo Verde Nuclear Generating Station since 2004. These include lack of technical rigor in assessing problems, not reporting problems and entering them into the corrective action program, not adequately determining the extent of problems when they are identified, not performing 10 CFR 50.59 reviews, and not identifying and correcting problems before the NRC points them out to your staff. Your November 14, 2006, letter recognized these concerns and was thorough in identifying the root and contributing causes. While your performance improvement initiatives have actions to address these problems, this case clearly demonstrates that they are not yet effective. This case also shows that important safety related latent equipment failures and degraded conditions continue to be identified by NRC, by self revealing failures, or by events.

As indicated in our Midcycle Assessment Letter (ML062430661), Yellow finding letter (ML051010006), and 95002 followup letter (ML062840601), these types of performance Arizona Public Service Company-4-problems and their causes are key examples of why the NRC has determined that increasedregulatory oversight is still warranted for your site.If you contest the violations or their significance, you should provide a response within 30 daysof the date of this letter, with the basis for your denial, to the US Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, US Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, US Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Palo Verde Nuclear Generating Station.In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letterand its enclosure will be available electronically for public inspection in the NRC PublicDocument Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).Please note that the NRC administratively opened Inspection Report 05000528; 05000529;05000530/2006013 to track time spent reviewing the issues described in this letter. This report number will be closed, and no actual inspection report will be issued.

Sincerely,/RA/Bruce S. MallettRegional AdministratorDockets: 50-528; 50-529; 50-530Licenses: NPF-41; NPF-51; NPF-74

Enclosure:

Summary of Assessment and Findings

w/Attachment:

Supplemental Information Arizona Public Service Company-5-cc:Steve Olea Arizona Corporation Commission 1200 W. Washington Street Phoenix, AZ 85007Douglas K. Porter, Senior CounselSouthern California Edison Company Law Department, Generation Resources P.O. Box 800 Rosemead, CA 91770ChairmanMaricopa County Board of Supervisors 301 W. Jefferson, 10th Floor Phoenix, AZ 85003Aubrey V. Godwin, DirectorArizona Radiation Regulatory Agency 4814 South 40 Street Phoenix, AZ 85040Craig K. Seaman, General ManagerRegulatory Affairs and Performance Improvement Palo Verde Nuclear Generating Station Mail Station 7636 P.O. Box 52034 Phoenix, AZ 85072-2034Jeffrey T. WeikertAssistant General Counsel El Paso Electric Company Mail Location 167 123 W. Mills El Paso, TX 79901John W. SchumannLos Angeles Department of Water & Power Southern California Public Power Authority P.O. Box 51111, Room 1255-C Los Angeles, CA 90051-0100John TaylorPublic Service Company of New Mexico 2401 Aztec NE, MS Z110 Albuquerque, NM 87107-4224 Arizona Public Service Company-6-Thomas D. ChampSouthern California Edison Company 5000 Pacific Coast Hwy, Bldg. D1B San Clemente, CA 92672Robert HenrySalt River Project 6504 East Thomas Road Scottsdale, AZ 85251Brian AlmonPublic Utility Commission William B. Travis Building P.O. Box 13326 1701 North Congress Avenue Austin, TX 78701-3326Karen O'ReganEnvironmental Program Manager City of Phoenix Office of Environmental Programs 200 West Washington Street Phoenix, AZ 85003 Matthew BenacAssistant Vice President Nuclear & Generation Services El Paso Electric Company 340 East Palm Lane, Suite 310 Phoenix, AZ 85004 Arizona Public Service Company-7-Electronic distribution by RIV:Regional Administrator (BSM1)DRP Director (ATH)DRS Director (DDC)DRS Deputy Director (RJC1)Senior Resident Inspector (GXW2)Branch Chief, DRP/D (TWP)Senior Project Engineer, DRP/D (GEW)Team Leader, DRP/TSS (RVA)RITS Coordinator (KEG)DRS STA (DAP)V. Dricks, PAO (VLD)D. Cullison, OEDO RIV Coordinator (DGC)ROPreports PV Site Secretary (PRC)SUNSI Review Completed: LJS ADAMS: # YesG No Initials: LJS # Publicly Available G Non-Publicly Available G Sensitive# Non-SensitiveEB2/TLSRAEB2/BCD:DRPD:DRSNO'KeefeMRunyanLSmithATHowellDDChamberlainUnavailable/RA//RA//RA//RA/12/22/0612/22/0612/22/0612/22/0612/22/06RA:RIVBSMallett/RA/12/22/06OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax EnclosureSUMMARY OF ASSESSMENT AND FINDINGSSummary of Risk Assessments and Final Significance DeterminationThe NRC's Inspection Report 05000528; 529; 530/2006011, dated September 28, 2006,documented the licensee's response to the high intake air temperature condition identified in Emergency Diesel Generator 2B on May 17, 2006. The inspection found chemical fouling of safety-related heat exchangers serviced by the emergency spray pond system: including emergency diesel generator coolers and essential cooling water heat exchangers. The fouling indirectly affected cooling of secondary heat loads such as shutdown cooling, spent fuel cooling, and the essential chillers. The NRC found that the licensee had failed to recognize that improperly implemented chemistry controls for the emergency spray pond systems in all three units caused degraded equipment performance over a period of years.This finding was assessed based on the best available information, including influentialassumptions, using the applicable significance determination process (SDP). The finding was preliminarily determined to be a Greater Than Green Finding based on a Phase 2 evaluation in accordance with Inspection Manual Chapter 0609. It was initially estimated that in Unit 2, Train B of essential cooling water was incapable of performing its safety function for 6.8 months in 2003, based on extrapolation of performance data for this heat exchanger. Accident sequences that would cause high pond temperatures, primarily loss-of-coolant accidents, could challenge this system to the point where the essential chiller would fail, causing a loss of room cooling to important mitigating systems. In addition, there was uncertainty associated with the amount of scaling that could occur on any of the affected heat exchangers for all three units during 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident scenario. The NRC subsequently completed a Phase 3 evaluation and concluded that the finding had very low safety significance as documented in this assessment. The performance deficiency resulted in the fouling and degradation of the Unit 2 Essential Cooling Water Heat Exchanger 2B as well as the Train B emergency diesel generator turbocharger heat exchanger during several months in 2003. Degradation of heat exchangers also occurred in other units and at different times, but these occurrences were not as significant from a risk perspective.

Evaluation of test data confirmed that the safety function of the Train B emergency diesel generator was not affected by the fouled turbocharger heat exchanger. On the other hand, the degradation of the Essential Cooling Water 2B heat exchanger led to a risk-significant condition the assumed failure of the Train B chilled water system following postulated medium or large break loss of coolant accidents. This system provides cooling to vital equipment used to mitigate the consequences of a loss of coolant accident.

The overall risk impact was diminished because the redundant Unit 2 Essential Cooling Water Heat Exchanger 2A was not fouled and was nominally available and reliable during the period of concern. Successful operation of Train A components would result in a satisfactory recovery from all postulated loss of coolant accidents.

The best estimate of risk associated with the performance deficiency was a delta-CDF of 2.3E-7/yr. A sensitivity analysis using more bounding assumptions resulted in a delta-CDF of Enclosure-2-8.9E-7 and one using maximum bounding assumptions resulted in a delta-CDF of 1.3E-6. TheNRC concluded that the most appropriate characterization of the significance of this issue is Green, i.e., very low safety significance.

The NRC identified uncertainties related to test data extrapolation, the linear chemical fouling degradation rate, assumptions regarding the duration of the condition, cleaning credit for eddy current testing, room temperatures after the loss of the safety chiller, and effectiveness of manual actions needed to prevent tripping of the chillers. Although uncertainties existed in the information used to develop the risk analysis, conservative assumptions were used to bound the uncertainties..FindingsCornerstone: Mitigating Systems Green. A noncited violation of Technical Specification 3.7.7 was identified becauseTrain B of the essential cooling water system in Unit 2 was not capable of performing its safety function for approximately 78 days ending on September 27, 2003. The degraded performance was due to fouling caused by improper chemical addition in the associated spray pond.Failure to ensure that this safety-related equipment was operable was a performancedeficiency. This finding was more than minor because it impacted the equipment performance attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has very low safety significance. This finding had cross-cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to maintain design margins. This issue was entered into the Corrective Action Program under CRDR 2905161. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000529/2006011-01, EW Train 2B Inoperable Longer than Allowed Outage Time. Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control,"was identified. Test Procedure 70TI-9EW01, "Thermal Performance Testing of Essential Cooling Water Heat Exchangers," and Procedure 73DP-9ZZ10, "Guidelines for Heat Exchanger Thermal Performance Analysis," were inadequate to ensure the timely determination that the requirements and acceptance limits contained in applicable design documents were met. Specifically, performance testing for Essential Cooling Water Heat Exchanger 2B conducted on March 19, 2002, did not meet the design basis requirements specified in Calculation 13-MC-SP-0307, "SP/EW System Performance Design Bases Analysis," Revision 007, but this was not correctly evaluated to determine whether the system would be capable of performing its design function until August 22, 2002, due to incorrect procedure guidance and lack of requirements to ensure timely Enclosure-3-evaluation. As a result, this component continued to degrade for 18 months afterdemonstrating unacceptable performance. This finding had cross cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to ensure nuclear safety. Failure to properly control testing and properly identify unacceptable performance was aperformance deficiency. This finding was more than minor because it impacted the procedure quality attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has a very low safety significance. This issue was entered into the Corrective Action Program under CRDR 2928230. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-02, Inadequate Test Control to Promptly Identify Unacceptable Performance Test Results. SL-IV. A noncited violation of 10 CFR 50.59 was identified for making nine revisions toProcedure 74DP-9CY04, "System Chemistry Specification," a procedure described in the Updated Final Safety Analysis Report between 1998 and 2004. Specifically, the licensee failed to perform evaluations for Revisions 3, 6, 8, 10, 12, 24, 28, 32, and 36 and performed inadequate evaluations for Revisions 10 and 36, to assess the potential impact of the changes on the safety-related components in the spray pond system.

Each of these changes revised spray pond chemistry parameter limits which were subsequently determined to have contributed to heat exchanger fouling.Failure to adequately evaluate the impact of changes to the Chemistry Control Programwas a performance deficiency. Because this violation had the potential to impact the NRC's regulatory function, and because the associated significance was determined to be Green using Phase 3 of the significance determination process, this violation is being treated as a Severity Level IV violation. This issue was entered into the Corrective Action Program under CRDR 2902498. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000528; 05000529;05000530/2006011-03, 50.59 Reviews Not Performed or Inadequate for Multiple Changes to Spray Pond Chemistry Control Procedure.Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "CorrectiveActions," was identified. On March 19, 2002, performance testing for Essential Cooling Water Heat Exchanger 2B indicated that the system would not be capable of performing its design function, but this significant condition adverse to quality was not promptly identified, the cause determined, or corrective actions taken to restore the required heat exchanger performance. Specifically, the unacceptable performance was not promptly identified, because the test results were not correctly calculated until August 22, 2002, which was after operating mode changes and returning the unit to power following the outage. When the test results were finalized, the fact was that the design basis Enclosure-4-capability was not met, was not recognized or entered into the corrective actionprogram. These failures to correct this degraded performance contributed to the continued degradation and eventual loss of function for a period of 78 days. The failure to correct this degraded performance contributed to the continued degradation and eventual loss of function. This finding had cross cutting aspects associated with the Corrective Action Program, for both inadequate identification of problems and inadequate evaluation of the cause, extent, and impact on operability.Failure to properly assess the impact of scaling on safety-related heat exchangerscooled by the spray pond system was a performance deficiency. This finding was more than minor because it impacted the equipment performance attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, the heat exchangers associated with emergency diesel generators and essential cooling water systems in both trains in all units were allowed to degrade and Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has very low safety significance. This issue was entered into the corrective action program under CRDR 2897810. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000528; 05000529;05000530/2006011-04, Inadequate Corrective Action for Degraded EW Heat Exchanger Performance.Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "DesignControl," was identified for failure to correctly evaluate the scaling potential of the safety-

related heat exchangers cooled by the emergency spray pond during a design basis accident. An error in how the licensee interpreted the SEQUIL calculation caused the licensee to incorrectly conclude that scaling would not occur under the conditions established in the chemistry control program. Failure to properly assess the impact of scaling on safety related heat exchangerscooled by the spray pond system was a performance deficiency. This finding was more than minor because it impacted the design control attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, post accident scaling was determined to reduce heat exchanger performance by 2.3 percent of the design capability in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and up to 4 percent during the design mission time. A Phase 3 significance determination process concluded that this finding has very low safety significance. This finding had cross-cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to ensure nuclear safety. This issue was documented in CRDR 2913430. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-05, Inadequate Design Control to Ensure No EW Heat Exchanger Scaling.

Enclosure-5-DETAILS OF ADDITIONAL ASSESSMENT1.0SUMMARYThe NRC performed in-office review in order to complete a Phase 3 significancedetermination for the circumstances associated with chemical fouling of the emergency spray pond system, which is the ultimate heat sink. The NRC documented one finding with five apparent violations in Special Inspection 05000528; 529; 530/2006011.

Arizona Public Service had failed to recognize that improper chemistry controls for the emergency spray pond systems in all three units caused degraded performance of risk significant equipment over a period of years. Poor emergency spray pond chemistry controls caused chemical fouling and scaling of safety-related heat exchangers cooled by the emergency spray pond system; including, emergency diesel generator coolers, and essential cooling water heat exchangers. The fouling indirectly affected cooling of secondary heat loads such as shutdown cooling, spent fuel cooling and the essential chillers. This enclosure is intended to provide details of the additional review and assessment used to reach the final significance determination.2.0SCOPEThe NRC evaluated the five apparent violations for further NRC action under the NRC'sSignificance Determination Process or NRC Enforcement Policy. The NRC considered the information developed during this in-office review, the Arizona Public Service Company position provided in November 14, 2006, letter (ML06320503430), the information provided at the Regulatory Conference (see Meeting Summary dated November 29, 2006, ML063390464), and the information provided in a November 28, 2006, letter (ML063420493) following the conference. The NRC reviewed the documents listed in the attachment, List of DocumentsReviewed, in order to assess heat exchanger degradation from fouling and scaling, the impact of room heat up after postulated loss of the safety chiller and the associated human reliability assessment. The NRC independently evaluated the licensee's compliance and significance information as they related to operability of Heat Exchanger 2B. 3.0 EVALUATIONAfter evaluating the minimum required capability based on actual conditions during theperiod when Essential Cooling Water Heat Exchanger 2B was degraded in 2003, the NRC found that the heat exchanger was not able to perform its safety function, making each of the five apparent violations a valid violation of NRC requirements. The NRC gave less credit than the licensee for use of eddy current test equipment cleaning of heat exchanger tubes. The NRC also evaluated the licensee's significance determination for the five apparentviolations using independent analytical methods. The NRC concluded that these violations are characterized as a Green finding, i.e., an issue with very low safety significance.

Enclosure-6-The NRC agreed with many of the facts and assessments that formed the basis for thelicensee's risk determination; however, the NRC identified uncertainties related to test data extrapolation, the linear chemical fouling degradation rate, assumptions regarding the duration of the condition, cleaning credit for eddy current testing, room temperatures after the loss of the safety chiller, and effectiveness of manual actions needed to prevent tripping of the chillers. The assumptions discussed in the attachment, Phase 3 significance determination, bound the uncertainties.Even though the NRC determined that the final significance determination is low in thiscase, the fouling of the heat exchanger degraded its ability to perform its safety function and only the substantial excess capability of the system prevented this from being a more serious safety issue. Each of the apparent violations is discussed below. Each of the violations is associated with the same safety significance determination.3.1Operability of Essential Cooling Water Heat ExchangersIn their November 14, 2006, letter responding to the apparent violations, the licenseedisagreed that this violation occurred. The APS evaluation concluded that Essential Cooling Water Heat Exchanger 2B was able to perform it's safety function due to the large margin in the heat exchanger design, favorable credit for eddy current probe cleaning and actual spray pond and air temperatures. This section discusses the basis for the NRC concluding that the system was not capable of performing its intended safety function for a period of 78 days.The licensee performed an evaluation of the chemical constituents of the foulant foundin the heat exchangers of the spray pond system and conservatively estimated the degrading effect of this foulant on heat exchanger performance. The amount of chemical buildup was based on the total amount of chemicals known to have been added to the system. Because the foulant was an amorphous mix that contained water, the licensee conservatively included the blanketing effect of stagnant water in the assumed film by assuming it was 50 percent of the mixture (samples indicated that the foulant was probably 20 to 40 percent water). The NRC reviewed the chemistry results for the period and concluded that the licensee conservatively used the most limiting chemistry results for the Unit 2, Train B spray pond. The methodology, assumptions and results were reviewed and determined to be reasonable. The licensee's estimation of the amount of foulant and its heat transfer properties was determined to be reasonable, since it was based on the total amount of chemicals added to the pond, and assumed approximately 26 percent of those chemicals were deposited in the tubes of the heat exchanger of concern. This was considered to be reasonable because it was verified to correlate with the analysis results from laboratory samples of the foulant.The licensee also evaluated the minimum required heat exchanger performance duringthe period of concern. This was done by assessing the actual highest daily temperature in the spray pond and the most limiting weather conditions. This information was needed to assess the heat exchanger performance had it actually been called upon to perform its intended safety function. Spray pond temperature data was reviewed to verify that the most limiting values were used. Meteorological data was reviewed and determined to be reasonable for the time of year, particularly as they nearly matched the Enclosure-7-design basis conditions. As discussed below, the spray pond temperature wassignificantly below the design basis temperature, so the required heat transfer performance was less than required by the design and license basis to maintain. The spray pond temperature results were reviewed to ensure that the most limiting values were used. It was determined to have been conservative to assume the pond and meteorological data values existed for the entire day, when the peak temperatures actually existed for periods of a few hours. The actual tube plugging in the heat exchanger were verified to be accurately accounted for in the calculation. It was also confirmed that the licensee used the same calculation method and inputs for their evaluation as were used in the design basis evaluation, except where appropriate changes were needed for this case.The licensee showed that this heat exchanger had been eddy current tested during theoutage in April 2002. The licensee provided two different analyses of how this would remove foulant and improve heat transfer. Specifically, based on a single test in Unit 3, the licensee argued that this activity would improve heat transfer to at least +25 percent margin. However, the inspectors noted that there was considerable uncertainty in this analysis. For example, the heat exchangers in Unit 3 used a larger probe, while in Unit 2, the heat exchangers had sleeves inside the tubes at each tube sheet, requiring the use of a smaller probe. The performance test data used to assess the cleaning effect had some uncertainty. Also, using a single test to conclude that the final end state would be obtained by repeating the activity, regardless of other factors, could not be validated. Instead, the NRC determined that a calculation of the volume of the probe's path represented a conservative way to estimate the cleaning effect. This assumed that the probe was pushed through each tube once and no credit was given for the conduit. In reality, the probes were pushed through, then pulled back, and the conduit was demonstrated to wipe the tube in multiple spots, but this effect could not be quantified in a high-confidence manner nor were multiple data sets available to obtain an average effect. The NRC concluded that a minimum of 10 percent margin improvement was expected due to passage of the eddy current probe. This was considered a conservative estimate compared to the single set of test data, which indicated that about 30 percent improvement was observed.Therefore, the capability of EW Heat Exchanger 2B was determined to be as follows:In April 2002, eddy current testing improved performance margin from themeasured value of -9.5 percent to +0.5 percent.Between April 2002 and September 27, 2003, performance continued to degradeat the same rate as was observed prior to the 2002 outage. This resulted in a final capability of -39 percent margin, compared to design basis requirements.Using the minimum required heat exchanger performance calculated from pond andweather data, the inspectors determined that the heat exchanger was not capable of removing the required heat loads for approximately 78 days. This included the effects of scaling, discussed below. This was a slightly conservative estimate because the format of the data provided by the licensee required rounding the performance to

-40 percent margin (worse performance) in order to get an answer.

Enclosure-8-Based on the above, the NRC concluded that Essential Cooling Water HeatExchanger 2B was not capable of performing its intended safety function for an estimated period of 78 days. Enforcement.Technical Specification 3.7.7 requires that two trains of essential cooling water beoperable in Mode 1, with an allowed outage time for one train of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Contrary to this, Train B of the EW system in Unit 2 was not capable of performing its safety function for approximately 78 days ending on September 27, 2003, when the plant shut down for Refueling Outage 2R11. This issue was entered into the licensee's corrective action program under condition report/disposition report (CRDR) 2905161. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000529/2006011-01, EW Train 2B Inoperable Longer than Allowed Outage Time. 3.2Control of Heat Exchanger Performance TestingIn their November 14, 2006, letter responding to the apparent violations, the licenseeadmitted this violation. The team determined that performance testing for the EW heat exchangers wasscheduled and conducted under a maintenance order. However, calculation of the results and comparison to acceptance criteria was not a scheduled activity. Further, the test results were not administratively tracked to ensure that the unit was not restarted before acceptable performance was documented. As a result, the March 19, 2002, test results were determined after Unit 2 started up from Refueling Outage 2R10. The test results were unexpectedly low, but this was determined to involve a calculation error.

When the error was corrected with results, which indicated low performance, the test method was evaluated. On August 22, 2002, the test package was completed and verified to demonstrate -9.5 percent capability. This untimely determination of unacceptable performance did not trigger a review of operability, nor was continued degradation considered. As a result, this component continued to degrade for 18 months after demonstrating unacceptable performance. Had this determination been made prior to the end of the outage, corrective actions could have been taken to clean the tubes. Technical Specifications require that both trains be operable prior to making plant mode changes, so the unit should not have be restarted with this condition, had it been identified.This violation affected all three units because they used the same procedure, althoughthe example cited is from only Unit 2 because it represented the most significant example.

Enclosure-9-Enforcement.Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion XI, "TestControl," requires that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Test results are required to be documented and evaluated to assure that test requirements have been satisfied. Test Procedure 70TI-9EW01, "Thermal Performance Testing of Essential Cooling Water Heat Exchangers," contained instructions for conducting performance testing.

Procedure 73DP-9ZZ10, "Guidelines for Heat Exchanger Thermal Performance Analysis," contained instructions for calculating the results of EW heat exchanger performance testing and verifying them against the design basis requirements in Calculation 13-MC-SP-0307, "SP/EW System Performance Design Bases Analysis,"

Revision 007. Contrary to this, the results of performance testing for EW Heat Exchanger 2Bconducted on March 19, 2002, did not meet the design basis requirements, but this was not correctly evaluated to determine whether the system would be capable of performing its design function until August 22, 2002. As a result, Unit 2 was allowed to restart and run an entire operating cycle without correcting the degraded performance. This issue has been entered into the licensee's corrective action program under CRDR 2928230.

Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-02, Inadequate Test Control to Promptly Identify Unacceptable Performance Test Results.This finding had cross-cutting aspects in the area of Human Performance, under theResource attribute, because the licensee failed to ensure that adequate procedures were available to ensure nuclear safety. 3.3Evaluation of Chemistry Control Procedure ChangesIn their November 14, 2006, letter responding to the apparent violations, the licenseeadmitted this violation. Enforcement.10 CFR 50.59 [2001 version] states, in part, that the licensee may make changes to thefacility as described in the final safety analysis report (as updated), without prior NRC approval, provided the change does not result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system or component important to safety previously evaluated in the final safety analysis report (as updated). It further requires, in part, that records of changes in procedures be maintained, and these records must include a written evaluation which provides the bases for the determination that the change does not require a license amendment.

Enclosure-10-Part 50.59(a)(1) of Title 10 of the Code of Regulations [1992 version] states, in part, thatthe holder of a license authorizing operation of a production or utilization facility may:

(1) make changes in the facility as described in the safety analysis report, (2) make changes in the procedures as described in the safety analysis report, and (3) conduct tests or experiments not described in the safety analysis report, without prior Commission approval, unless the proposed change, test, or experiment involves a change in the Technical Specifications incorporated in the license or an unreviewed safety question. A proposed change, test, or experiment shall be deemed to involve an unreviewed safety question: (1) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; (2) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (3) if the margin of safety as defined in the basis for any Technical Specifications is reduced. This regulation also required certain records be maintained, and that these records must include a written safety evaluation which provides the bases for the determination that the change, test, or experiment does not involve an unreviewed safety question. The Palo Verde Nuclear Generating Station Updated Final Safety AnalysisReport (UFSAR), Section 9.2.1.2.F, specified that the spray pond system would be protected from organic fouling and inorganic buildup by proper water treatment.

Procedure 74DP-9CY04, "System Chemistry Specification," implemented the licensee's water treatment program, including chemical limits and addition frequencies, in order to control corrosion and fouling in the emergency spray pond system.Contrary to the above, between 1998 and 2006, the licensee made multiple changes tothe chemistry control program specified in Procedure 74DP-9CY04, "System Chemistry Specification," which resulted in changes to the facility as described in the UFSAR that increased the probability of a malfunction of equipment important to safety previously evaluated in the safety analysis report. In addition, the licensee failed to perform an adequate written safety evaluation which provided the bases for the determination that the changes made did not involve an unreviewed safety question (pre-2001 requirement) or that the change did not require a license amendment (2001 version).

These changes were made without adequately assessing the impact to the safety-

related systems affected by the changes. Revisions 3, 6, 8, 10, 12, 24, 28, 32, and 36 to this procedure made changes which affected spray pond chemistry parameter limits which were subsequently determined to have contributed to heat exchanger fouling that was identified during tests and inspections conducted between 1998 and May, 2006.

Specifically:*Revisions 3, 6, 8, 12, 24, 28, and 32 were made without any documented10 CFR 50.59 review. These revisions contained changes to chemistry limits in the spray pond, which had the potential to negatively impact fouling and, therefore, were required to be evaluated per 10 CFR 50.59. These included changing pH, phosphate, and zinc limits, and instructions on the frequency of dispersant additions.

Enclosure-11-*The screening performed for Revision 10 was inadequate because the revisionincreased the maximum allowable pH in Unit 1, but the screening dated June 30, 1999, did not evaluate this aspect of the revision. This limit had been lowered in Revision 6 to account for the decision to use well water as the makeup source for the Unit 2 spray pond. This water source had a significantly higher alkalinity, and the lower pH was determined to be necessary to avoid scaling at the time the modification was implemented.*The screening performed for Revision 36 was inadequate because the revisionincreased the maximum allowable zinc concentration by a factor of two, but Screening Number S-06-0049, Revision 1, did not address this aspect of the revision. Excessive zinc additions were subsequently determined to be a primary cause of fouling. The NRC also evaluated the examples of this violation against the current 10 CFR 50.59requirements, because NRC policy is to exercise discretion for violations of 10 CFR 50.59 that predate the current rule if the involved circumstances do not indicate that the current rule would have been violated. The NRC concluded that the changesmade prior to 2001 would have violated both versions of the rule, because changes to Procedure 74DP-9CY04, "System Chemistry Specification," resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system or component important to safety.This issue was documented in CRDR 2902498. Because this violation was of very lowsafety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000528; 05000529;05000530/2006011-03, 10 CFR 50.59 Reviews Not Performed or Inadequate for Multiple Changes to Spray Pond Chemistry Control Procedure. The safety significance of the violation of 10 CFR 50.59 described in the originalassessment is based largely on the risk significance of the associated changes to the facility, as discussed in Supplement I of the NRC Enforcement Policy. Because the risk significance of the associated changes to the chemistry control program resulted in heat exchanger fouling which was determined to be Green, this violation has been classified at Severity Level IV, in accordance with theNRC Enforcement Policy. Further, because changes were made to the Chemistry Control Program without adequate 50.59 evaluations under both the old rule and the new rule, and were determined to be violations under both rules, no discretion was exercised in this case.3.4Response Within the Corrective Action ProgramIn their November 14, 2006, letter responding to the apparent violations, the licenseeadmitted this violation. This violation affected all three units, and is further discussed in NRC InspectionReport 05000528; 05000529; 05000530/2006011. The example cited only lists Unit 2 as the most significant example.

Enclosure-12-Enforcement.Part 50 of Title 10 of the Code of Regulations, Appendix B, Criterion XVI, "CorrectiveActions," requires that significant conditions adverse to quality shall be promptly identified, and that the cause shall be determined and corrective action shall be taken to preclude repetition. Contrary to this, on March 19, 2002, performance testing for Essential Cooling WaterHeat Exchanger 2B indicated that the system would not be capable of performing its design function, but this significant condition adverse to quality was not promptly identified, the cause determined, or corrective actions taken to restore the required heat exchanger performance. Specifically, the unacceptable performance was not promptly identified, because the test results were not correctly calculated until August 22, 2002, which was after operating mode changes and returning the unit to power following the outage. When the test results were finalized, the fact that the design basis capability was not met, was not recognized and entered into the corrective action program. These failures to correct this degraded performance contributed to the continued degradation and eventual loss of function. This issue was entered into the corrective action program under CRDR 2897810. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-04, Inadequate Identification and Corrective Action for Degraded EW Heat Exchanger Performance.This finding had cross-cutting aspects associated with the Corrective Action Program,for both inadequate identification of problems, and inadequate evaluation of the cause, extent, and impact on operability.Failure to properly assess the impact of scaling on safety related heat exchangerscooled by the spray pond system was a performance deficiency. This finding was more than minor because it impacted the equipment performance attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, the heat exchangers associated with emergency diesel generators and essential cooling water systems in both trains in all units were allowed to degrade and Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has very low safety significance. This issue was entered into the corrective action program under CRDR 2897810. This is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-04, Inadequate Corrective Action for Degraded EW Heat Exchanger Performance.

Enclosure-13-3.5Design Verification for Scaling PreventionDuring the special inspection, the team questioned whether the existing chemistrycontrols were adequate to prevent scaling in components cooled by the spray pond system once a design basis accident started. This was a concern because approximately 85 percent of the water in the spray pond is lost and chemicals would be expected to concentrate. In reviewing this, the licensee identified that the 1994 design calculation used to conclude that scaling would not occur was in error, and scaling was possible.The inputs, assumptions, and results of the licensee's calculations used to evaluate thescaling potential were reviewed. This study conservatively used the most limiting chemistry sample results obtained during the period of concern. These chemical concentration values were then adjusted for the expected water losses from the spray pond during the 27-day mission time of the spray pond during a simulated worst-case loss-of-coolant accident (the most limiting accident). Using the resulting concentrations, the analysis then evaluated the scaling potential by conservatively assuming that the scaling occurred instantaneously based on the highest concentration for each day. This concluded that as much as 2.3 percent degradation in heat transfer capability (using the design basis heat exchanger performance as 100 percent) could occur in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The NRC determined that the inputs used the most limiting chemistry sample results for the period by reviewing Spray Pond 2B chemistry sample results for the period. The assumptions used were conservative. Most significant among the assumptions was the fact that the licensee assumed that all scale formed instantaneously when the constituents' solubility limit was exceeded, when in reality this would occur over a much longer period. Since scaling was most limiting in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , this assumption caused the results to conservatively over-predict scaling and have a larger impact on risk. Based on the above, the results of the licensee's analysis were determined to be reasonable.Based on these results, it was concluded that this was a violation. It was also concludedthat this violation affected all three units. Enforcement.Part 50 of Title 10 of the Code of Regulations, Appendix B, Criterion III, requires thatdesign control measures be established to verify the adequacy of design of structures, systems and components. A SEQUIL calculation was intended to demonstrate that the heat exchangers cooled by the emergency spray pond system would be capable of transferring the required heat load to the spray pond because scaling would not occur during a design basis accident. Contrary to this, the calculation used an improper setting which caused the calculatedresult to incorrectly show that scaling would not occur. This issue was documented in CRDR 2913430. This violation has the potential to increase the exposure time when EW Heat Exchanger 2B was incapable of performing its safety function, since the exposure time did not account for any impact because of scaling. There is uncertainty Enclosure-14-associated with the amount of scaling that could occur on any of the affected heatexchangers for all three units during 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident scenario. This issue was entered into the corrective action program under CRDR 2897810. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-05, Inadequate Design Control to Ensure No EW Heat Exchanger Scaling. ATTACHMENT: SUPPLEMENTAL INFORMATION AttachmentA-1SUPPLEMENTAL INFORMATIONLIST OF ITEMS OPENED, CLOSED, AND DISCUSSEDOpened and Closed05000529/2006011-01NCVEW Train 2B Inoperable Longer thanAllowed Outage Time 05000528; 05000529;NCVInadequate Test Control to Promptly05000530/2006011-02Identify Unacceptable Performance TestResults 05000528; 05000529;NCV10 CFR 50.59 Reviews Not Performed or05000530/2006011-03Inadequate for Multiple Changes to SprayPond Chemistry Control Procedure05000528; 05000529;NCVInadequate Identification and Corrective05000530/2006011-04Action for Degraded EW Heat ExchangerPerformance 05000528; 05000529;NCVInadequate Design Control to Ensure No05000530/2006011-05EW Heat Exchanger ScalingClosed05000529/2006011-01AVEW Train 2B Inoperable Longer thanAllowed Outage Time05000528; 05000529;AVInadequate Test Control to Promptly05000530/2006011-02Identify Unacceptable Performance TestResults05000528; 05000529;AV50.59 Reviews Not Performed or05000530/2006011-03 Inadequate for Multiple Changes to SprayPond Chemistry Control Procedure 05000528; 05000529;AVInadequate Identification and Corrective05000530/2006011-04Action for Degraded EW Heat ExchangerPerformance05000528; 05000529;AVInadequate Design Control to Ensure No05000530/2006011-05 EW Heat Exchanger Scaling AttachmentA-2SUPPLEMENTAL INFORMATIONLIST OF DOCUMENTS REVIEWEDThe following documents were selected and reviewed by the inspectors to accomplish theobjectives and scope of the inspection and to support any findings:Calculation 02-MS-B052, Essential Cooling Water Heat Exchanger U Study, Revision 0 EPRI Report 1014505, Assessment of Palo Verde Nuclear Generating Station EssentialCooling Water Heat Exchangers, dated October 2006EPRI letter: Technical Review of Material to Support Assessment of Palo Verde EssentialWater Heat Exchanger Performance, dated September 12, 2006Preliminary Assessment of DBA Scaling Degradation in the 2EWB Heat Exchanger for the2N11 Operating Cycle, by John Hughey, dated September 13, 2006PVNGS PRA Memo: A Simple Eddy Current Cleaning Model for the Essential Cooling WaterHeat Exchanger, dated November 15, 2006PVNGS Assessment: EW heat Exchanger Eddy Current Cleaning (Alternate Method),November 2006Palo Verde Nuclear Generating Station Unit 2 Balance of Plant Heat Exchanger Eddy CurrentExaminations, Tenth Refueling Outage, March 2002EW Heat Exchanger Performance Test Results (73DP-9ZZ10, Appendix A):Heat Exchanger:Date:2B4/991A4/2/01 2B3/19/02 3A4/2/03 1A4/3/04 3A4/27/03 1A5/5/04 3A11/23/04 2B4/2/05 2B10/18/05PNNGS Technical Specification 3.7.7 and associated Bases CRDR 2864575 CRDR 2902498 Root Cause Report for CRDR 2897810 AttachmentA-3EPRI Report 1014505, Assessment of Palo Verde Nuclear Generating Station EssentialCooling Water Heat Exchangers, dated October 2006SP Piping Inspection Results for U2R13, 10/18/06 Southwest Research Institute letter: Final results of Analysis for Samples Received 06/12/06 &06/13/06, dated June 29, 2006Calculation 13-NS-C082, Significance Determination for Unit 2 EWB HX DegradedPerformance, Revision 0Calculation 13-NS-B098, At-power PRA System Study for the HVAC Room Coolers, Revision 2Calculation 13-MC-HJ-0003, HJ System Heat Load and Equipment Selection Criteria,Revision 5Calculation 13-MC-HJ-256, Control Room and Switchgear Room temperature Rise Study,Revision 2Calculation 13-MC-HJ-260, Temperature in DC Equipment Room for PRA Study, Revision 2 Calculation 13-MS-A107, Loss of Essential Chillers Study, Revision 0 PRA Assessment Results Memo 448-00687-MAB/AVD dated November 10, 2006 Westinghouse Report EQ-EV-2-CVER, Assessment of Palo Verde Motor Functionality atElevated temperatures, Revision 1, dated November 2006PVNGS letter 102-05593-JML/SAB/JAP/DFH to NRC responding to apparent violations in EA06-221, dated November 14, 2006PVNGS Updated Final Safety Analysis Report, Revision 16 APS Presentation Slides for the NRC Regulatory and Predecisional Enforcement Conferenceheld on November 20, 2006APS letter 102-05600-JML/TNW/GAM to NRC, dated November 28, 2006 AttachmentA-4SUPPLEMENTAL INFORMATIONPHASE 3 SIGNIFICANCE DETERMINATIONThe NRC completed a Phase 3 significance determination, which was independentlychecked and then approved in accordance with Manual Chapter 0609. The results are summarized below for the five violations which led to the loss of function for Essential Cooling Water Heat Exchanger 2B. Although uncertainties existed in the information used to develop the risk analysis, the use of conservative assumptions bounded the uncertainties such that the finding was determined to be of very low safety significance.SummaryThis finding was assessed based on the best available information, including influentialassumptions, using the applicable Significance Determination Process (SDP). The finding was preliminarily determined to be a Greater Than Green Finding based on a Phase 2 evaluation in accordance with Inspection Manual Chapter 0609. It was estimated that in Unit 2, Train B of essential cooling water was incapable of performing its safety function for 6.8 months in 2003, based on extrapolation of performance data for this heat exchanger. Accident sequences that would cause high pond temperatures, primarily loss-of-coolant accidents, could challenge this system to the point where the essential chiller would fail, causing a loss of room cooling to important mitigating systems. In addition, there was uncertainty associated with the amount of scaling that could occur on any of the affected heat exchangers for all three units during 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident scenario.The NRC subsequently completed a Phase 3 evaluation and concluded that the findinghad very low safety significance as documented in this assessment. The performance deficiency resulted in the fouling and degradation of the Unit 2 Essential Cooling Water Heat Exchanger 2B as well as the Train B emergency diesel generator turbocharger heat exchanger during several months in 2003. Degradation of heat exchangers also occurred in other units and at different times, but these occurrences were not as significant from a risk perspective. Evaluation of test data confirmed that the safety function of the Train B emergency diesel generator was not affected by the fouled turbocharger heat exchanger. On the other hand, the degradation of the Essential Cooling Water 2B heat exchanger led to a risk-significant condition- the assumed failure of the Train B chilled water system following postulated medium or large break loss of coolant accidents. This system provides cooling to vital equipment used to mitigate the consequences of a loss of coolant accident. The overall risk impact was diminished because the redundant Unit 2 Essential Cooling Water Heat Exchanger 2A was not fouled and was nominally available and reliable during the period of concern. Successful operation of Train A components would result in a satisfactory recovery from all postulated loss of coolant accidents.

AttachmentA-5 The best estimate of risk associated with the performance deficiency was a delta-CDF of 2.3E-7/yr. A sensitivity using more bounding assumptions resulted in a delta-CDF of 8.9E-7, and one using the maximum bounding assumptions resulted in a delta-CDF of 1.3E-6. The NRC concluded that the performance deficiency is characterized as a Green finding, i.e., an issue with very low safety significance. The NRC identified uncertainties related to test data extrapolation, the linear chemical fouling degradation rate, assumptions regarding the duration of the condition, cleaning credit for eddy current testing, room temperatures after the loss of the safety chiller, and effectiveness of manual actions needed to prevent tripping of the chillers. Although uncertainties existed in the information used to develop the risk analysis, the use of conservative assumptions compensated for the uncertainties such that the finding was determined to be of very low safety significance.Assumptions-A linear rate of fouling/scaling and loss of heat transfer capability was assumed,although it was likely that there was a greater amount of fouling that occurred early followed by a decreasing rate with time. This is because the velocity of fluid through the tubes would tend to increase as the effective diameter decreases, thereby increasing the rate of sloughing of the soft slime layer, which would eventually equal the deposition rate. However, the assumption of linear degradation was bounding because it produced a higher assumed final state of degradation and therefore a greater number of days of exposure utilized in the risk evaluation. Initially, an exposure period of 6.8 months was calculated based on the linear degradation assumption. The exposure period was later refined as discussed below.-The Train B EW heat exchanger was never completely incapable of removingheat. In its most degraded condition, it was still capable of removing some decay heat. Therefore, the function of the Train B shutdown cooling heat exchanger was retained, such that plant cooldown on this heat exchanger alone, given a loss of Train A equipment, was available, though the cooldown would have been extended in time.-During the time that the Train B EW heat exchanger was degraded, the Train AEW heat exchanger was capable of performing as designed and is therefore assumed to have nominal reliability and availability. Therefore, the plant in its degraded condition was still capable of performing all of its design basis functions, including transition to cold shutdown. The consequence of the degraded condition was a loss of redundancy or defense in depth.- There were no cumulative outages or overlaps of degradations that would havebeen more severe with respect to risk in any 1-year period.

AttachmentA-6-Essential cooling water heat exchanger outlet temperatures less than135 degrees F causes no impact on supported systems.-Essential cooling water heat exchanger outlet temperatures greater than135 degrees F will cause the emergency chilled water system (CWS) chiller to surge and trip. This is assumed to be an unrecoverable failure.-Essential cooling water heat exchanger outlet temperatures greater than135 degrees F will not impact shutdown cooling (decay heat removal), although the reactor cooling system cooldown will be extended.-Essential cooling water heat exchanger outlet temperature will exceed 135degrees F only if shutdown cooling loads are applied. All other EW heat loads are very small compared to decay heat.Note: Essential cooling water cools the shutdown cooling heat exchangerand the CWS (chilled water) heat exchanger. In turn, CWS provides room cooling for the emergency core cooling system (ECCS) pumprooms (high pressure safety injection (HPSI), low pressure safety injection (LPSI), containment spray (CS), EW, Train A of auxiliary feedwater (AF-B), and vital switchgear ventilation systems).- Credit was not applied for splitting decay heat loads onto both trains of shutdowncooling or throttling flow through the shutdown cooling heat exchanger to limit decay heat load.The standardized plant analysis risk (SPAR) model for Palo Verde Nuclear GeneratingStation provides an operator recovery for room ventilation for HPSI, LPSI, and CS in the event of loss of the CWS system (chilled water) for alternate room cooling (natural convection). The action is to open the door to the room and has an assumed human reliability assessment (HRA) failure probability of 6E-3. However, a similar recovery for the EW pump room ventilation is not provided in the model. Therefore, a loss of CWS is assumed to fail the EW pump in that train, which then removes flow and function from the shutdown cooling heat exchanger. This eliminates decay heat removal capability for the affected train. The analyst contacted the Idaho National Laboratory (NRC contractor for the SPARmodels) and the licensee to confirm the SPAR modeling of the EW pump dependency on room cooling. The information gathered from Idaho National Laboratory and the licensee suggestedthat the SPAR model was incorrect in assigning no recovery for the EW pumps upon loss of CWS. Consequently, the analyst revised the SPAR model to add an operator recovery for alternate room cooling (opening the door) for the EW (Train A and B)

AttachmentA-7system with a failure probability of 6E-3 (same as for other pumps whose rooms arecooled by CWS).Based on information developed by the inspection team, the analyst assumed that onlyloss-of-coolant accidents (LOCAs) (large, medium, and small) would result in the potential for EW heat exchanger outlet temperatures to exceed 135 degrees F. [Steam generator tube rupture and main steam line break events can also result in high EW heat exchanger outlet temperatures if operators fail to manage the shutdown cooling evolution, but because of several factors, including that the HRA for this action is approximately the same for both the base and degraded condition, the change in risk from these events is very small compared to LOCAs] For small break LOCAs, the licensee provided information indicating that EW exit temperatures of 135 degrees F would not be exceeded unless operators fail to follow procedures to limit this temperature to 125 degrees F. Annunciators will alert operators to this condition and it is a proceduralized step performed routinely by the operators during every shutdown.

For the full spectrum of small-break LOCAs , the steam generators remain available to remove decay heat as long as the feedwater/auxiliary feedwater system is available to keep the steam generators filled. Based on this information, the analyst assumed that risk associated with the performance deficiency for small-break LOCAs very closely approximated the risk associated with the baseline small-break LOCAs. The licensee also reported that the change in risk attributable to small-break LOCAs in their analysis was negligible compared to the larger-sized breaks. Therefore, only large LOCA and medium LOCA sequences were quantified in the SPAR model. This is discussed further below.The loss of the CWS is assumed to be the only risk-significant event caused by thefouling of the Train B EW heat exchanger. There were no other affected loads that had a non-negligible bearing on the risk of the finding (though as explained above, the shutdown cooling heat exchanger performance would have been partially degraded by the higher than normal EW temperatures such that the ensuing RCS cooldown would have been extended, but this condition was not judged to affect the risk significance of the finding).The licensee documented an analysis of the risk associated with the performancedeficiency in Calculation 13-NS-C082, "Significance Determination for Unit 2 EWB HX Degraded Performance," Revision 0, dated November 14, 2006. The licensee presented a summary of the analysis to the NRC during a regulatory conference on November 20, 2006.The analyst reviewed the calculation and supporting documents. The following pointsare important in understanding the methodology used by the licensee and the elements relevant to making a decision regarding the risk of the finding:-Credit was taken for the incidental cleaning of the Unit 2 Train B EW heatexchanger resulting from the performance of eddy current testing (ECT). This AttachmentA-8testing was performed subsequent to the final performance test of the heatexchanger that was used by the NRC to extrapolate heat exchanger capacity to determine the period of time that it was potentially unable to perform its safety function.During the conference, the licensee displayed a simulated heat exchanger tubeand ECT probe to demonstrate the likelihood that the introduction of this device into every tube of the heat exchanger would likely remove some of the soft-consistency zinc-calcium-phosphate slime that was building up on the inside of the tubes. Using data from an ECT test before and after performance tests of the Unit 3 Train A EW heat exchanger, the licensee calculated that the ECT cleaning effect would result in the heat exchanger having a 25 percent margin above its design value. It was assumed that the end state after the testing would be more or less independent of the initial state, because the probe and cable would remove more of the slime if it was thicker at the time of the test.Any cleaning effect attributable to ECT testing would result in a decrease in the6.8-month exposure period assumed in the original preliminary NRC Phase 3 analysis. However, the analyst did not agree that the testing results associated with the Unit 3 Train A EW heat exchanger were necessarily indicative of the effect that it had on the Unit 2 Train B EW heat exchanger. First, a single data point is not statistically convincing, and second, the Unit 2 Train B EW heat exchanger is sleeved on the tube ends and, therefore, a smaller diameter ECT probe was used. This would imply less contact between the probe and the tube walls occurred, although the cable would be expected to have made contact in a similar manner irrespective of the probe diameter. Third, the heat loads used for this test were small, leading to potentially large measurement uncertainties.

Based on review of the information presented, the analyst recommended that a 9 percent cleaning effect, as a conservative lower bound, should be credited for the ECT testing that was performed on the Unit 2 Train B EW heat exchanger.-In lieu of assuming worst-case design basis conditions throughout the period oftime that the Unit 2 Train B EW heat exchanger was degraded, the licensee used actual meteorological data to calculate a minimum U-value that was necessary to avoid post-DBA conditions that would result in a loss of the Train B chilled water system. For the case of crediting no ECT cleaning effect, this resulted in a reduction of the exposure period from 6.8 months to 105 days.Given that the study incorporated an extended period of time encompassing theentirety of the hottest summer months, this approach was considered acceptable.Note: the period of degradation occurred in 2003 and does not reflect recent orcurrent conditions of the heat exchanger.

AttachmentA-9-An important question was whether a certain sized break of the reactor coolantsystem was necessary to create the heat loads that would cause elevated EW temperatures (135 degrees F) that would subsequently result in loss of the chilled water system. As discussed above, a loss of the chilled water system represents a total expression of the risk imparted by the performance deficiency; that is, if the chilled water system survives, the risk is assumed to be equal to the baseline risk. In the original NRC analysis, it was assumed that small-break LOCAs would not result in a challenge to the chilled water system and therefore only medium and large break LOCA sequences were quantified.The licensee presented thermodynamic model results that demonstrated that forsmall break LOCAs, EW heat exchanger outlet temperatures in excess of 135 degrees F are not expected to occur as long as operators follow their initial procedure to limit the EW heat exchanger outlet temperature to less than 125 degrees F. The probability of success of this action is very high, given that it is a well-known, often-performed, and specifically-proceduralized step that isprompted by an annunciator. From a PRA perspective, the operator failureprobability for this action is small enough that scenarios that include this failed action are insignificant to the overall quantification of risk.The success of limiting EW heat exchanger outlet temperatures is contingent onthe continued availability of the steam generators for reactor cooling system natural circulation cooling. The break size used to define the spectrum of small breaks is embedded in the design of the system, meaning that the steam generators are expected to be available as long as main or auxiliary feedwater is available to keep the steam generators filled. With this analysis, the probability of losing all secondary injection sources is too small to have an important impact on the risk result.Based on the above considerations, the analyst determined that the originalassumption that small break LOCAs are not important to the risk of the finding was confirmed.-The licensee evaluated the effect of elevated temperatures on equipment in theECCS pump rooms and control building following a loss of essential cooling resulting from a hypothetical failure of Train B chilled water system. In general, the analysis showed a large margin existed between the highest expected room temperatures (no credit was taken for alternate room cooling to the ECCS pump rooms) and the limiting thermal condition of the vulnerable equipment. The exceptions are discussed as follows:A.The oil sight glasses on the LPSI and CS pumps were determined to besusceptible to failure after approximately 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at a temperature of 150 degrees F. The heat-up calculation for these rooms estimated a maximum ambient temperature of 146 degrees F.

AttachmentA-10Given the uncertainty bands for both the durability of the sight glassesand the heat-up of the room, the analyst determined that a loss of the chilled water system could likely result in a failure of the LPSI and CS pumps within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the event, Therefore, within the risk analysis, a failure of these two pumps upon loss of the chilled water system was assumed as a bounding case. At the same time, nominal reliability credit for all other essential pumps is considered reasonable.This is a bounding assumption for two reasons. The SPAR model makesno provision for these pumps running for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months post-accident and effectively assumes that they are lost immediately. The risk impact of these pumps failing at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is much less than that occurring from an immediate failure. Also, the LPSI pump is secured following the initiation of sump recirculation (and therefore before the chilled water system is assumed to be lost) and would likely be available following the postulated failure of the CS pump at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . At this time, the LPSI pump would replace the function of the CS pump.B.The following equipment located in the control building was cited as beingvulnerable to failure as follows:RoomLimitingTemperatureTime to Temperature LimitControl Room119F6 hrs. 50 min.15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months (doors open)DC Equipment Room122F11 hrs.Switchgear Room125F21 hrs. 40 min.Battery Room122F24 hrs.The times listed are following loss of the chilled water system, which isexpected to occur approximately two hours subsequent to a medium or large break LOCA. The sequences leading to this condition include a loss of cooling from the Train A chilled water system for reasons other than those associated with this performance deficiency. It is noted that the licensee's analysis assumes no recovery of the Train A chilled water system upon failure as is also the case for Train B.Loss of any of the four rooms listed would likely result in core damage. Operators would have to take actions to preclude this outcome. Two strategies are available: bypass the safety injection actuation AttachmentA-11signal (SIAS) signal to the individual supply and return dampersassociated with the normal control building cooling system (which would have been automatically isolated from the SIAS) by using jumpers on circuit cards located in the control room cabinets, or by resetting the SIAS. Resetting the SIAS could cause undesirable repercussions and would thus likely be the second choice. Unavailability of the normal control building cooling system resulting from a LOOP or another reason would have an insignificant impact on the risk assessment because it is small in magnitude compared to the probability of failing to restore its function given that it is available.The licensee used a reference to NUREG/CR-1278 to conclude that the probability of operators failing to restore normal cooling to the control room is 0.14. This method was not rigorous in that it did not consider the full spectrum of performance shaping factors that would be expected to influence the outcome. The analyst performed a separate estimate using the SPAR-H methodology, assuming nominal time available (at least sixhours are available to perform the action and, according to the licensee and later confirmed by NRC inspectors, a procedure could be developed and implemented within two hours as a nominal case), high stress, an incomplete procedure, and a moderately complicated task. This resulted in a failure probability of 0.08. Given the ease of diagnosis (heating up of the control room), the highlikelihood that operators would open the control room doors (invoking 10 CFR 50.54(x)) that would extend the time available to 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months (11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months for the dc equipment room), the expectation of additional personnel arriving from Units 1 and 3 and from offsite, the expected manning of the Technical Support Center (TSC) within two hours, the fact that the bypass operation procedure is not beyond the skill levels of many engineers onsite, and the fact that the backup action of bypassing the SIAS is available if needed, the analyst concluded that the non-recovery probability of 0.14 was a reasonable estimate.-The licensee performed a sensitivity analysis using their PRA model and variousassumptions related to ECT cleaning and equipment survivability. The results are reproduced below:

AttachmentA-12HeatExchangermargin atend ofexposureperiodPercentcleaningcredit forECTExposuretimebased onactualmet. data(days)Equipment failed as as a result of loss of roomcoolingNoneHPSILPSICSHPSIEWAFBAll-30%19%000000-35%14%392.8E-83.3E-73.6E-74.5E-74.6E-7

-40%9%785.6E-86.6E-77.3E-79.0E-79.2E-7

-45%4%886.3E-87.5E-78.2E-71.0E-61.0E-6

-49%None1057.5E-88.9E-79.8E-71.2E-61.2E-6Based on the discussion above, the analyst assumed a 9 percent cleaning creditfor ECT and assumed in the bounding case that the LPSI and CS pumps would be lost in the B train following a loss of the Train B chilled water system. These assumptions would yield a delta-CDF of 7.3E-7 based on the licensee's PRA model. [note: it is recognized that the assumption that the Train B LPSI and CS pumps would fail on a loss of room cooling would imply that the A Train LPSI and CS pumps would also fail on loss of the Train A chilled water system (which would presumably fail from some other cause). The licensee's analysis incorporates this concept]. Analysis Using the Palo Verde Nuclear Generating Station SPAR ModelThe headquarters staff revised/corrected the SPAR model of record (referenced below)with assistance from Idaho National Laboratory as discussed below:i.EW System Fault Tree.(1)Under the gate ECW-A, created an AND gate ECW-A-RM ('LOSSOF ROOM COOLING TO EW PUMP A"). Inputs to the AND gate are:(a)CWS-A ("ESSENTIAL CHILLED WATER TRAIN AFAILURES") - a transfer gate to the CW fault tree.

AttachmentA-13(b)HVC-XHE-XM-ROOM ("OPERATOR FAILS TO BLOCKOPEN PUMP ROOM DOORS") an existing HRA basic event with an HEP of 6.00 x 10-3 .(2)Likewise for ECW-B, an AND gate ECW-B-RM ('LOSS OF ROOMCOOLING TO EW PUMP B") was created. Inputs to the AND gate are:(a)CWS-B ("ESSENTIAL CHILLED WATER TRAIN BFAILURES") - a transfer gate to the CW fault tree.(b)HVC-XHE-XM-ROOM ("OPERATOR FAILS TO BLOCKOPEN PUMP ROOM DOORS") an existing HRA basic event with an HEP of 6.00 x 10-3 .(3)Removed CWS-A and CWS-B direct inputs to gates ECW-A andECW-B, respectively.ii.ACP-PB-A-AC Fault Tree(1)Under top gate of ACP-PB-A-AC, created an AND gateACP-PBA-AC-RM ("LOSS OF SWGR RM COOLING TO PBA").

Inputs to the AND gate are:(a)HVC-XHE-XM-PBA ("FAILURE TO OPEN ALIGNALTERNATE COOLING TO SWGR RM A - LICENSEE") a new HRA value using the Licensee's HEP value of 0.14.

Although the degradation was seen for the "B" train, it was included here for completeness.(b)CWS-A ("ESSENTIAL CHILLED WATER TRAIN AFAILURES") - a transfer gate to the CW fault tree.iii.ACP-PB-B-AC Fault Tree(1)Under top gate of ACP-PB-B-AC, created an AND gateACP-PBB-AC-RM ("LOSS OF SWGR RM COOLING TO PBB").

Inputs to the AND gate are:(a)HVC-XHE-XM-PBB ("FAILURE TO OPEN ALIGNALTERNATE COOLING TO SWGR RM B - LICENSEE") a new HRA value using the Licensee's HEP value of 0.14. (b)CWS-B ("ESSENTIAL CHILLED WATER TRAIN BFAILURES") - a transfer gate to the CW fault tree.

AttachmentA-14iv.LPI-MDPA Fault Tree(1)Under top gate of LPI-MDPA ("FAILURES OF LPI MDP A"),corrected 4.16kV power transfer gate from ACP-PBB-AC ("41160V AC BUS PBB POWER FAILS") to ACP-PBA-AC ("4160V AC BUS PBA POWER FAILS"). v.LPI-DIS Fault Tree(1)Under gate LPI-MOV-1A-F ("LPI INJECTION TO LOOP 1AUNAVAILABLE"), corrected 4.16kV power transfer gate from ACP-PBB-AC ("41160V AC BUS PBB POWER FAILS") to ACP-PBA-AC ("4160V AC BUS PBA POWER FAILS"). Loop 1A injection MOV-635 is powered from Train A (Group 1). Failure of MOV-635 is set to logical TRUE when quantifying LLOCA and MLOCA sequences.(2)Under gate LPI-MOV-2A-F ("LPI INJECTION TO LOOP 2AUNAVAILABLE"), corrected 4.16kV power transfer gate from ACP-PBA-AC ("4160V AC BUS PBA POWER FAILS") to ACP-PBB-AC ("41160V AC BUS PBB POWER FAILS").

Loop 2A injection MOV-615 is powered from Train B (Group 2). The analyst used the Palo Verde Nuclear Generating Station SPAR model,Revision 3.21, dated October 28, 2005. Truncation of 1.0E-12 was used. Average test and maintenance was assumed. SPAR model changes were made for this specific case as discussed above.The analyst assessed the risk associated with various assumptions. The following tablepresents the results of this effort. In the base model, loss of ECCS pumps has a dependency for operators to open the door to the pump room, with an HRA of 6E-3.

Therefore, for the "no pumps lost" column in the table, this dependency is retained. For the cases where a pump is assumed lost, the basic event for the fail-to-run event was set to TRUE and the associated common cause event was set to its baseline value.

The HRA for operators restoring normal cooling to the control room is shown with two values, 0.14 as was assumed in the licensee's analysis, and 0.20, which was considered a bounding case. The analyst believed that the 0.14 value was reasonable as discussed above. For cutsets where the Train A chilled water system fails (independently from the spray pond and emergency cooling water systems), an assumption is made that the pumps assumed lost by the Train B chilled water failure are also lost in Train A. This was accomplished by performing a post-processing of the cutsets.

AttachmentA-15Credit forECTCleaningNumber ofExposureDaysRestore Normal Cooling toControl Building HRA= 0.14Restore Normal Cooling toControl Building HRA= 0.20NoECCSPumpsLost(Only CWSLost)(1.06E-6/yr)Loss ofLPSI, CS(3.54E-6/yr)Loss ofLPSI,CS,ECW,HPI(4.35E-6/yr)NoECCSPumpsLost(Only CWSLost)(1.51E-6/yr)Loss ofLPSI,CS(4.16E-6/yr)Loss ofLPSI,CS,ECW,HPI(4.63E-6)01053.0E-71.0E-61.3E-64.3E-71.2E-61.3E-69%782.3E-77.6E-79.3E-73.2E-78.9E-79.9E-714%391.1E-73.8E-74.6E-71.6E-74.4E-74.9E-7The analyst considered the value associated with a 9 percent ECT cleaning effect, anHRA of 0.20, and a presumed loss of the Train B LPSI and CS pumps to be a bounding estimate of risk (8.9E-7). A best estimate would credit an HRA value of 0.14 and include the assumption that the combination of the Train B CS and LPSI pumps would provide greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of functional service after room cooling is lost. The risk expressed by this set of assumptions would be essentially equivalent to that shown in the "no pumps lost" column. Therefore, the analyst concluded that the best estimate of risk was a delta-CDF of 2.3E-7/yr. for internal initiators, and because of the lack of risk associated with external initiators, as discussed below, this also expresses the best estimate of the total risk of the finding.External EventsThe plant-specific SDP worksheets do not currently include initiating events related tofire, flooding, severe weather, seismic, or other external initiating events. In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.5, "Screen for the Potential Risk Contribution Due to External Initiating Events," experience with using the Site Specific Risk-Informed Inspection Notebooks has indicated that accounting for external initiators could result in increasing the risk significance attributed to an inspection finding by as much as one order of magnitude. The analyst determined qualitatively that external events would not add appreciably tothe risk of the finding because of the low probability that they would cause or occur in conjunction with a loss of coolant accident.

AttachmentA-16Large Early ReleaseIn accordance with Manual Chapter 0609, Appendix G, for PWRs with large, drycontainments, only sequences associated with steam generator tube ruptures or inter-

system LOCAs are likely to result in a large early release. Because these sequences are not associated with risk increases resulting from this performance deficiency, the analyst determined that large early release was not relevant to this analysis. [Steam generator tube rupture events present a risk increase associated with the finding, but their contribution in the licensee's analysis was well less than 1E-7/yr. The analyst determined that the risk associated with tube rupture events would be similar to baseline risk, because in both cases, operators are challenged to control EW exit temperatures in a manner similar to a normal shutdown evolution, only that in the degraded heat exchanger case, less time is available to react to the situation, though the high EW temperature alarms would still be timely in prompting this action. Also, the operators transfer to shutdown cooling following a tube rupture later in the event than in a normal AttachmentA-17SUPPLEMENTAL INFORMATIONUNCERTAINTY ASSESSMENTEssential Cooling Water Heat Exchanger 2B was measured as having 9.5 percent lesscapability than required under design conditions in April, 2002. Shortly after completing this performance test, eddy current testing was performed on this heat exchanger, which would have removed some of the foulant. The licensee's assessment concluded that this would restore the heat exchanger to 25 percent positive margin based on a single test in Unit 3.

However, due to the dissimilar eddy current probe sizes used in these two units and the uncertainty of the cleaning effect and repeatability, NRC concluded that only about 10 percent margin improvement could be conservatively credited. This was based on a simplified geometry analysis which the licensee performed, but chose not to present at the conference.

The NRC concluded that this analysis credited wiping by the eddy current probe, but not the flexible conduit housing the cable, because the effect of the conduit could not be reliably quantified. Therefore, our analysis of Essential Cooling Water Heat Exchanger 2B used the following performance history:*In April, 2002, the -9.5 percent margin was improved by 10 percent to+0.5 percent, due to inadvertent cleaning that occurred during eddy current testing.*From April, 2002, until October, 2003, degradation due to fouling continued atthe same rate determined by the previous two Essential Cooling Water Heat Exchanger 2B performance test results.This resulted in degrading to -39 percent margin compared to design basis conditions. However, because the conservative design basis conditions assumed for local weather and spray pond temperature did not exist during the period of concern, our analysis included these factors in determining the actual minimum required heat exchanger performance. The licensee's analysis provided a conservative calculation of the minimum required heat exchanger performance using conservative weather and pond data, as well as an estimation of the time during which this minimum was not met. Because this data was provided in finite increments which did not match -39 percent margin, the NRC conservatively used -40 percent. This resulted in an exposure time of 78 days when this heat exchanger was not capable of performing its intended function as required. This included an additional conservatism because the graph was created in a way that calculated a slightly longer exposure time than would have been calculated using the degradation rate the NRC assumed. As a consequence of this level of degradation, essential cooling water could have exceed135 degrees Fahrenheit. For large and medium break loss-of-coolant accidents, this was assumed to result in an unrecoverable failure of the essential chiller. For a small break loss-of-coolant accident, the NRC determined that operator training and procedures would result in operators being able to reliably control cooldown rate to preclude tripping the chiller.

For large and medium break loss-of-coolant accidents, chiller failure was expected to cause AttachmentA-18loss of room cooling, notably in safety-related pump rooms, the control room, and ac and dcelectrical equipment rooms. These were evaluated as follows:*In the high pressure safety injection, auxiliary feedwater, essential cooling water,and essential chilled water pump rooms, the peak temperature predicted with loss of cooling was not high enough to cause pump failure.*In the low pressure safety injection and containment spray pump rooms,elevated temperatures were expected to cause sight glass leakage. Our analysis conservatively assumed that both these pumps would fail immediately after containment recirculation started.*The electrical equipment rooms and control room were expected to exceedlimiting temperatures within 6 to 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months after loss of room cooling. Simple actions to open doors and use portable fans could extend this time, but restoration of cooling via the normal ventilation system was required. Portions of the steps necessary to perform this task were not proceduralized at the time of this degraded condition. However, the licensee was able to demonstrate that personnel available in the Technical Support Center (which would be staffed during the scenarios of concern) would be able to identify the actions needed in about an hour, and the steps could be reliably performed in an additional hour.

The NRC independently assessed these actions, and determined a range of human reliability values, which are further discussed in the attached report.

Although NRC assigned a conservative probability, the NRC still concluded that these steps could be performed reliably under the expected conditions and within the time available.The NRC agreed with the licensee's conservative estimation of additional degradation due toscaling after a design basis accident started. This effect was assumed to be additive with the pre-existing fouling. The NRC determined this to be conservative, since the foulant would blanket the tube face and make it more difficult for the scale-forming constituents of the cooling water to reach the higher temperatures needed to form scale. The scaling effect was included as a penalty in the minimum required heat exchanger performance curve in calculating exposure time.Finally, because the degradation level and exposure time were sensitive to the uncertainty ofthe heat exchanger performance test data used in this analysis, NRC performed sensitivity studies. Based on these, NRC concluded that the worst-case test uncertainties did not have sufficient impact on risk to increase the result to a White finding.

IR 05000528/2006013

Text

Dear Mr. Levine:

Enclosure:

w/Attachment:

Navigation menu

v t e Inspection Report - Palo Verde - 2006013
80 \| 81 \| 82 \| 83 \| 84 \| 85 \| 86 \| 87 \| 88 \| 89 \| 90 \| 91 \| 92 \| 93 \| 94 \| 95 \| 96 \| 97 \| 98 \| 99 00 \| 01 \| 02 \| 03 \| 04 \| 05 \| 06 \| 07 \| 08 \| 09 \| 10 \| 11 \| 12 \| 13 \| 14 \| 15 \| 16 \| 17 \| 18 \| 19 \| 20 \| 21 \| 22 \| 23 \| 24 \|
2006 Quarterly Integrated 1Q (0) 2Q (0) 3Q (2) 4Q (0) Assessments Mid Cycle End of Cycle 29(0) 7(0) 8(0) 9(0) 10(1) 11(1) 12(3) 13(0) 28(0) Security 401(0) Operator Exams Emergency Planning Other

IR 05000528/2006013

Text

Dear Mr. Levine:

Enclosure:

w/Attachment:

Navigation menu

Search