Text

Final Significance Determination
	ML063600175
Person / Time
Site:	Palo Verde
Issue date:	12/22/2006
From:	Mallett B; Region 4 Administrator
To:	James M. Levine; Arizona Public Service Co
References
	EA-06-221, IR-06-011
	Download: ML063600175 (39)
	v • d • e

December 22, 2006 EA-06-221 James M. Levine, Executive Vice President, Generation Mail Station 7602 Arizona Public Service Company P.O. Box 52034 Phoenix, AZ 85072-2034

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - FINAL SIGNIFICANCE DETERMINATION

Dear Mr. Levine:

The U.S. Nuclear Regulatory Commission's (NRC) Inspection Report 05000528; 05000529; 05000530/2006011, dated September 28, 2006, described the results of a special inspection conducted to examine the circumstances associated with chemical fouling of the ultimate heat sink at the Palo Verde Nuclear Generating Station. In this inspection, the NRC found that Arizona Public Service failed to recognize that improper chemistry controls for the emergency spray pond systems in all three nuclear units at the site caused degraded performance over a period of years. Poor emergency spray pond chemistry controls caused chemical fouling of safety-related heat exchangers cooled by the emergency spray pond system, including emergency diesel generator coolers, and essential cooling water heat exchangers. The fouling affected the safety functions of cooling the core and containment during a potential accident, cooling the safety equipment needed to respond to an accident, and cooling the fuel in the spent fuel pool. The report discussed five apparent violations that were being evaluated for further NRC action under the NRCs Significance Determination Process or NRC Enforcement Policy.

In the cover letter of NRCs Inspection Report 05000528; 05000529; 05000530/2006011, the NRC informed Arizona Public Service Company of the NRCs preliminary conclusions, which were based on a Phase 2 significance determination. The NRC required additional information to complete the more rigorous Phase 3 significance determinations. The NRC provided Arizona Public Service Company an opportunity to request a Regulatory and Predecisional Enforcement Conference on this matter which you accepted. In a November 14, 2006, pre-conference letter (ML06320503430), you provided the results of your evaluation of the programmatic and organizational causes of the spray pond issue so that the Regulatory and Predecisional Enforcement Conference could focus on the risk significance of the apparent violations. You agreed to four of the five apparent violations. You also indicated that, based on your evaluation, Essential Cooling Water Heat Exchanger 2B was able to perform its safety function,

Arizona Public Service Company with no increase in risk expected, due to the large margin in the heat exchanger design, favorable credit for eddy current probe cleaning, and actual spray pond and air temperatures.

You, therefore, disagreed with the apparent violation of Technical Specification 3.7.7, Essential Cooling Water System.

A Regulatory and Predecisional Enforcement Conference was held on November 20, 2006, at the NRC Region IV office in Arlington, Texas, to assess the significance and impact of the chemical fouling of equipment in two key systems: (1) essential cooling water heat exchangers and (2) the room chillers for safety related pumps and other room cooling loads. The NRC had previously concluded that the emergency diesel generators had never been fouled enough to be inoperable, and had concluded that the only increase in risk associated with essential cooling water involved Unit 2, Train B during part of 2003. This degraded condition was determined to have the potential to affect the associated essential chiller because the degraded essential cooling water heat exchanger would not have been able to provide adequate cooling to the chiller. Therefore, the conference discussion focused on the causes of the apparent violations, a detailed discussion of heat exchanger fouling rates, a possible heat exchanger cleaning mechanism, and the minimum required capability based on actual conditions during the period when Essential Cooling Water Heat Exchanger 2B was degraded in 2003. The Arizona Public Service Companys staff described corrective actions, the root causes of the violations, and chemical fouling effects. In a November 28, 2006, letter (ML063420493), you provided corrections, clarifications and additional information requested by the NRC during the conference.

The NRC evaluated the five apparent violations for further NRC action under the NRCs Significance Determination Process and NRC Enforcement Policy. The NRC considered the information developed during our followup, as documented in the enclosure, the Arizona Public Service Company position provided in the November 14, 2006, letter (ML06320503430), the information you provided at the Regulatory Conference (see Meeting Summary dated November 29, 2006, ML063390464), and the information provided in a November 28, 2006, letter (ML063420493) following the conference.

From a significance determination perspective, the complexity of the system interactions, the data available, and the need to project capabilities where data was not available resulted in considerable uncertainty in both your risk evaluation and ours. While we agreed with many of the facts and assumptions that formed the basis for your risk determination, we identified areas of disagreement and determined to use more conservative assumptions. The bounding assumptions discussed in the attachment, Phase 3 Significance Determination, are believed to compensate for the uncertainties in the NRCs risk analysis. The NRC has concluded that the most appropriate value for the change in core damage frequency associated with these issues is 2.3 x 10-7 per year, allowing for some incidental cleaning credit, using actual pond and weather conditions during the period of greatest degradation, using midrange credit for operator recovery actions, and using upper bound values (conservative values) for the remaining assumptions. To assess uncertainty, the maximum upper bound for the change in core damage frequency associated with these issues was determined to be 1.3 x 10-6 per year, allowing no credit for incidental cleaning, and using actual spray pond and weather conditions during the period of greatest degradation, and using a high value for failure probability for operator recovery actions, and applying a maximum dependency on pump room cooling. Given

Arizona Public Service Company that the majority of the range of core damage frequency lies within the Green region, and considering the uncertainty involved as defined by the significance determination process, we have concluded that the most appropriate characterization of the significance of this issue is Green, i.e., very low safety significance.

From an enforcement perspective, NRC evaluated your claim that Essential Cooling Water Heat Exchanger 2B was able to perform its safety function due to the large margin in the heat exchanger design, favorable credit for eddy current probe cleaning and actual spray pond, and air temperatures. You therefore disagreed with the apparent violation of Technical Specification 3.7.7, Essential Cooling Water System. Based on the information provided to the NRC, the results of NRCs compliance review and our risk evaluations, the NRC has concluded that heat exchanger fouling caused Essential Cooling Water Heat Exchanger 2B to be incapable of performing its intended safety function as required for Technical Specification compliance. As discussed in the enclosure, our Phase 3 significance determination used a number of assumptions which were less favorable than the assumptions made by your staff in evaluating the heat exchanger capability and cleaning credit, and concluded that Heat Exchanger 2B was inoperable for approximately 78 days in 2003. The enclosure includes details of our review and assessment that is intended to supplement the information provided in the original inspection report for this issue.

The NRC concluded that there were five violations of NRC requirements. These were originally characterized as being associated with a single performance deficiency. The NRC has determined that it is appropriate to recharacterize the apparent violations as separate performance deficiencies in order to properly treat them within the Reactor Oversight Program.

Because these violations were of very low safety significance, have been entered into your corrective action program, and you have identified the root causes and taken appropriate corrective actions, these violations are being treated as noncited violations consistent with Section VI.A of the Enforcement Policy. Cross cutting aspects were identified for four of these five violations, which is described in detail in the enclosure.

Even though we determined that the risk significance was low, in this particular case, the large amount of degradation of these key safety systems for a long period of time is particularly egregious. The performance problems that led to the heat exchanger degradation and the treating of symptoms rather than identifying the cause of the degradation for many years are examples of the same types of performance problems we have identified at Palo Verde Nuclear Generating Station since 2004. These include lack of technical rigor in assessing problems, not reporting problems and entering them into the corrective action program, not adequately determining the extent of problems when they are identified, not performing 10 CFR 50.59 reviews, and not identifying and correcting problems before the NRC points them out to your staff. Your November 14, 2006, letter recognized these concerns and was thorough in identifying the root and contributing causes. While your performance improvement initiatives have actions to address these problems, this case clearly demonstrates that they are not yet effective. This case also shows that important safety related latent equipment failures and degraded conditions continue to be identified by NRC, by self revealing failures, or by events.

As indicated in our Midcycle Assessment Letter (ML062430661), Yellow finding letter (ML051010006), and 95002 followup letter (ML062840601), these types of performance

Arizona Public Service Company problems and their causes are key examples of why the NRC has determined that increased regulatory oversight is still warranted for your site.

If you contest the violations or their significance, you should provide a response within 30 days of the date of this letter, with the basis for your denial, to the US Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, US Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, US Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Palo Verde Nuclear Generating Station.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Please note that the NRC administratively opened Inspection Report 05000528; 05000529; 05000530/2006013 to track time spent reviewing the issues described in this letter. This report number will be closed, and no actual inspection report will be issued.

Sincerely,

/RA/

Bruce S. Mallett Regional Administrator Dockets: 50-528; 50-529; 50-530 Licenses: NPF-41; NPF-51; NPF-74

Enclosure:

Summary of Assessment and Findings w/

Attachment:

Supplemental Information

Arizona Public Service Company cc:

Steve Olea Arizona Corporation Commission 1200 W. Washington Street Phoenix, AZ 85007 Douglas K. Porter, Senior Counsel Southern California Edison Company Law Department, Generation Resources P.O. Box 800 Rosemead, CA 91770 Chairman Maricopa County Board of Supervisors 301 W. Jefferson, 10th Floor Phoenix, AZ 85003 Aubrey V. Godwin, Director Arizona Radiation Regulatory Agency 4814 South 40 Street Phoenix, AZ 85040 Craig K. Seaman, General Manager Regulatory Affairs and Performance Improvement Palo Verde Nuclear Generating Station Mail Station 7636 P.O. Box 52034 Phoenix, AZ 85072-2034 Jeffrey T. Weikert Assistant General Counsel El Paso Electric Company Mail Location 167 123 W. Mills El Paso, TX 79901 John W. Schumann Los Angeles Department of Water & Power Southern California Public Power Authority P.O. Box 51111, Room 1255-C Los Angeles, CA 90051-0100 John Taylor Public Service Company of New Mexico 2401 Aztec NE, MS Z110 Albuquerque, NM 87107-4224

Arizona Public Service Company Thomas D. Champ Southern California Edison Company 5000 Pacific Coast Hwy, Bldg. D1B San Clemente, CA 92672 Robert Henry Salt River Project 6504 East Thomas Road Scottsdale, AZ 85251 Brian Almon Public Utility Commission William B. Travis Building P.O. Box 13326 1701 North Congress Avenue Austin, TX 78701-3326 Karen O'Regan Environmental Program Manager City of Phoenix Office of Environmental Programs 200 West Washington Street Phoenix, AZ 85003 Matthew Benac Assistant Vice President Nuclear & Generation Services El Paso Electric Company 340 East Palm Lane, Suite 310 Phoenix, AZ 85004

Arizona Public Service Company Electronic distribution by RIV:

Regional Administrator (BSM1)

DRP Director (ATH)

DRS Director (DDC)

DRS Deputy Director (RJC1)

Senior Resident Inspector (GXW2)

Branch Chief, DRP/D (TWP)

Senior Project Engineer, DRP/D (GEW)

Team Leader, DRP/TSS (RVA)

RITS Coordinator (KEG)

DRS STA (DAP)

V. Dricks, PAO (VLD)

D. Cullison, OEDO RIV Coordinator (DGC)

ROPreports PV Site Secretary (PRC)

SUNSI Review Completed: LJS ADAMS: # Yes G No Initials: LJS

Publicly Available G Non-Publicly Available G Sensitive

Non-Sensitive EB2/TL SRA EB2/BC D:DRP D:DRS NOKeefe MRunyan LSmith ATHowell DDChamberlain Unavailable

/RA/

12/22/0612/22/06 12/22/06 12/22/06 12/22/06 RA:RIV BSMallett

/RA/

12/22/06 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

Enclosure

SUMMARY

OF ASSESSMENT AND FINDINGS Summary of Risk Assessments and Final Significance Determination The NRCs Inspection Report 05000528; 529; 530/2006011, dated September 28, 2006, documented the licensees response to the high intake air temperature condition identified in Emergency Diesel Generator 2B on May 17, 2006. The inspection found chemical fouling of safety-related heat exchangers serviced by the emergency spray pond system: including emergency diesel generator coolers and essential cooling water heat exchangers. The fouling indirectly affected cooling of secondary heat loads such as shutdown cooling, spent fuel cooling, and the essential chillers. The NRC found that the licensee had failed to recognize that improperly implemented chemistry controls for the emergency spray pond systems in all three units caused degraded equipment performance over a period of years.

This finding was assessed based on the best available information, including influential assumptions, using the applicable significance determination process (SDP). The finding was preliminarily determined to be a Greater Than Green Finding based on a Phase 2 evaluation in accordance with Inspection Manual Chapter 0609. It was initially estimated that in Unit 2, Train B of essential cooling water was incapable of performing its safety function for 6.8 months in 2003, based on extrapolation of performance data for this heat exchanger. Accident sequences that would cause high pond temperatures, primarily loss-of-coolant accidents, could challenge this system to the point where the essential chiller would fail, causing a loss of room cooling to important mitigating systems. In addition, there was uncertainty associated with the amount of scaling that could occur on any of the affected heat exchangers for all three units during 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident scenario.

The NRC subsequently completed a Phase 3 evaluation and concluded that the finding had very low safety significance as documented in this assessment. The performance deficiency resulted in the fouling and degradation of the Unit 2 Essential Cooling Water Heat Exchanger 2B as well as the Train B emergency diesel generator turbocharger heat exchanger during several months in 2003. Degradation of heat exchangers also occurred in other units and at different times, but these occurrences were not as significant from a risk perspective.

Evaluation of test data confirmed that the safety function of the Train B emergency diesel generator was not affected by the fouled turbocharger heat exchanger. On the other hand, the degradation of the Essential Cooling Water 2B heat exchanger led to a risk-significant condition the assumed failure of the Train B chilled water system following postulated medium or large break loss of coolant accidents. This system provides cooling to vital equipment used to mitigate the consequences of a loss of coolant accident.

The overall risk impact was diminished because the redundant Unit 2 Essential Cooling Water Heat Exchanger 2A was not fouled and was nominally available and reliable during the period of concern. Successful operation of Train A components would result in a satisfactory recovery from all postulated loss of coolant accidents.

The best estimate of risk associated with the performance deficiency was a delta-CDF of 2.3E-7/yr. A sensitivity analysis using more bounding assumptions resulted in a delta-CDF of

Enclosure 8.9E-7 and one using maximum bounding assumptions resulted in a delta-CDF of 1.3E-6. The NRC concluded that the most appropriate characterization of the significance of this issue is Green, i.e., very low safety significance.

The NRC identified uncertainties related to test data extrapolation, the linear chemical fouling degradation rate, assumptions regarding the duration of the condition, cleaning credit for eddy current testing, room temperatures after the loss of the safety chiller, and effectiveness of manual actions needed to prevent tripping of the chillers. Although uncertainties existed in the information used to develop the risk analysis, conservative assumptions were used to bound the uncertainties..

Findings Cornerstone: Mitigating Systems Green. A noncited violation of Technical Specification 3.7.7 was identified because Train B of the essential cooling water system in Unit 2 was not capable of performing its safety function for approximately 78 days ending on September 27, 2003. The degraded performance was due to fouling caused by improper chemical addition in the associated spray pond.

Failure to ensure that this safety-related equipment was operable was a performance deficiency. This finding was more than minor because it impacted the equipment performance attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has very low safety significance. This finding had cross-cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to maintain design margins. This issue was entered into the Corrective Action Program under CRDR 2905161. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000529/2006011-01, EW Train 2B Inoperable Longer than Allowed Outage Time.

Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion XI, "Test Control,"

was identified. Test Procedure 70TI-9EW01, "Thermal Performance Testing of Essential Cooling Water Heat Exchangers," and Procedure 73DP-9ZZ10, "Guidelines for Heat Exchanger Thermal Performance Analysis," were inadequate to ensure the timely determination that the requirements and acceptance limits contained in applicable design documents were met. Specifically, performance testing for Essential Cooling Water Heat Exchanger 2B conducted on March 19, 2002, did not meet the design basis requirements specified in Calculation 13-MC-SP-0307, "SP/EW System Performance Design Bases Analysis," Revision 007, but this was not correctly evaluated to determine whether the system would be capable of performing its design function until August 22, 2002, due to incorrect procedure guidance and lack of requirements to ensure timely

Enclosure evaluation. As a result, this component continued to degrade for 18 months after demonstrating unacceptable performance. This finding had cross cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to ensure nuclear safety.

Failure to properly control testing and properly identify unacceptable performance was a performance deficiency. This finding was more than minor because it impacted the procedure quality attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has a very low safety significance. This issue was entered into the Corrective Action Program under CRDR 2928230. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-02, Inadequate Test Control to Promptly Identify Unacceptable Performance Test Results.

SL-IV. A noncited violation of 10 CFR 50.59 was identified for making nine revisions to Procedure 74DP-9CY04, "System Chemistry Specification," a procedure described in the Updated Final Safety Analysis Report between 1998 and 2004. Specifically, the licensee failed to perform evaluations for Revisions 3, 6, 8, 10, 12, 24, 28, 32, and 36 and performed inadequate evaluations for Revisions 10 and 36, to assess the potential impact of the changes on the safety-related components in the spray pond system.

Each of these changes revised spray pond chemistry parameter limits which were subsequently determined to have contributed to heat exchanger fouling.

Failure to adequately evaluate the impact of changes to the Chemistry Control Program was a performance deficiency. Because this violation had the potential to impact the NRCs regulatory function, and because the associated significance was determined to be Green using Phase 3 of the significance determination process, this violation is being treated as a Severity Level IV violation. This issue was entered into the Corrective Action Program under CRDR 2902498. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000528; 05000529;05000530/2006011-03, 50.59 Reviews Not Performed or Inadequate for Multiple Changes to Spray Pond Chemistry Control Procedure.

Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," was identified. On March 19, 2002, performance testing for Essential Cooling Water Heat Exchanger 2B indicated that the system would not be capable of performing its design function, but this significant condition adverse to quality was not promptly identified, the cause determined, or corrective actions taken to restore the required heat exchanger performance. Specifically, the unacceptable performance was not promptly identified, because the test results were not correctly calculated until August 22, 2002, which was after operating mode changes and returning the unit to power following the outage. When the test results were finalized, the fact was that the design basis

Enclosure capability was not met, was not recognized or entered into the corrective action program. These failures to correct this degraded performance contributed to the continued degradation and eventual loss of function for a period of 78 days. The failure to correct this degraded performance contributed to the continued degradation and eventual loss of function. This finding had cross cutting aspects associated with the Corrective Action Program, for both inadequate identification of problems and inadequate evaluation of the cause, extent, and impact on operability.

Failure to properly assess the impact of scaling on safety-related heat exchangers cooled by the spray pond system was a performance deficiency. This finding was more than minor because it impacted the equipment performance attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, the heat exchangers associated with emergency diesel generators and essential cooling water systems in both trains in all units were allowed to degrade and Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has very low safety significance. This issue was entered into the corrective action program under CRDR 2897810. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000528; 05000529;05000530/2006011-04, Inadequate Corrective Action for Degraded EW Heat Exchanger Performance.

Green. A noncited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," was identified for failure to correctly evaluate the scaling potential of the safety-related heat exchangers cooled by the emergency spray pond during a design basis accident. An error in how the licensee interpreted the SEQUIL calculation caused the licensee to incorrectly conclude that scaling would not occur under the conditions established in the chemistry control program.

Failure to properly assess the impact of scaling on safety related heat exchangers cooled by the spray pond system was a performance deficiency. This finding was more than minor because it impacted the design control attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, post accident scaling was determined to reduce heat exchanger performance by 2.3 percent of the design capability in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and up to 4 percent during the design mission time. A Phase 3 significance determination process concluded that this finding has very low safety significance. This finding had cross-cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to ensure nuclear safety. This issue was documented in CRDR 2913430. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-05, Inadequate Design Control to Ensure No EW Heat Exchanger Scaling.

Enclosure DETAILS OF ADDITIONAL ASSESSMENT 1.0

SUMMARY

The NRC performed in-office review in order to complete a Phase 3 significance determination for the circumstances associated with chemical fouling of the emergency spray pond system, which is the ultimate heat sink. The NRC documented one finding with five apparent violations in Special Inspection 05000528; 529; 530/2006011.

Arizona Public Service had failed to recognize that improper chemistry controls for the emergency spray pond systems in all three units caused degraded performance of risk significant equipment over a period of years. Poor emergency spray pond chemistry controls caused chemical fouling and scaling of safety-related heat exchangers cooled by the emergency spray pond system; including, emergency diesel generator coolers, and essential cooling water heat exchangers. The fouling indirectly affected cooling of secondary heat loads such as shutdown cooling, spent fuel cooling and the essential chillers. This enclosure is intended to provide details of the additional review and assessment used to reach the final significance determination.

2.0 SCOPE The NRC evaluated the five apparent violations for further NRC action under the NRCs Significance Determination Process or NRC Enforcement Policy. The NRC considered the information developed during this in-office review, the Arizona Public Service Company position provided in November 14, 2006, letter (ML06320503430), the information provided at the Regulatory Conference (see Meeting Summary dated November 29, 2006, ML063390464), and the information provided in a November 28, 2006, letter (ML063420493) following the conference.

The NRC reviewed the documents listed in the attachment, List of Documents Reviewed, in order to assess heat exchanger degradation from fouling and scaling, the impact of room heat up after postulated loss of the safety chiller and the associated human reliability assessment. The NRC independently evaluated the licensees compliance and significance information as they related to operability of Heat Exchanger 2B.

3.0 EVALUATION After evaluating the minimum required capability based on actual conditions during the period when Essential Cooling Water Heat Exchanger 2B was degraded in 2003, the NRC found that the heat exchanger was not able to perform its safety function, making each of the five apparent violations a valid violation of NRC requirements. The NRC gave less credit than the licensee for use of eddy current test equipment cleaning of heat exchanger tubes.

The NRC also evaluated the licensees significance determination for the five apparent violations using independent analytical methods. The NRC concluded that these violations are characterized as a Green finding, i.e., an issue with very low safety significance.

Enclosure The NRC agreed with many of the facts and assessments that formed the basis for the licensees risk determination; however, the NRC identified uncertainties related to test data extrapolation, the linear chemical fouling degradation rate, assumptions regarding the duration of the condition, cleaning credit for eddy current testing, room temperatures after the loss of the safety chiller, and effectiveness of manual actions needed to prevent tripping of the chillers. The assumptions discussed in the attachment, Phase 3 significance determination, bound the uncertainties.

Even though the NRC determined that the final significance determination is low in this case, the fouling of the heat exchanger degraded its ability to perform its safety function and only the substantial excess capability of the system prevented this from being a more serious safety issue. Each of the apparent violations is discussed below. Each of the violations is associated with the same safety significance determination.

3.1 Operability of Essential Cooling Water Heat Exchangers In their November 14, 2006, letter responding to the apparent violations, the licensee disagreed that this violation occurred. The APS evaluation concluded that Essential Cooling Water Heat Exchanger 2B was able to perform its safety function due to the large margin in the heat exchanger design, favorable credit for eddy current probe cleaning and actual spray pond and air temperatures. This section discusses the basis for the NRC concluding that the system was not capable of performing its intended safety function for a period of 78 days.

The licensee performed an evaluation of the chemical constituents of the foulant found in the heat exchangers of the spray pond system and conservatively estimated the degrading effect of this foulant on heat exchanger performance. The amount of chemical buildup was based on the total amount of chemicals known to have been added to the system. Because the foulant was an amorphous mix that contained water, the licensee conservatively included the blanketing effect of stagnant water in the assumed film by assuming it was 50 percent of the mixture (samples indicated that the foulant was probably 20 to 40 percent water). The NRC reviewed the chemistry results for the period and concluded that the licensee conservatively used the most limiting chemistry results for the Unit 2, Train B spray pond. The methodology, assumptions and results were reviewed and determined to be reasonable. The licensees estimation of the amount of foulant and its heat transfer properties was determined to be reasonable, since it was based on the total amount of chemicals added to the pond, and assumed approximately 26 percent of those chemicals were deposited in the tubes of the heat exchanger of concern. This was considered to be reasonable because it was verified to correlate with the analysis results from laboratory samples of the foulant.

The licensee also evaluated the minimum required heat exchanger performance during the period of concern. This was done by assessing the actual highest daily temperature in the spray pond and the most limiting weather conditions. This information was needed to assess the heat exchanger performance had it actually been called upon to perform its intended safety function. Spray pond temperature data was reviewed to verify that the most limiting values were used. Meteorological data was reviewed and determined to be reasonable for the time of year, particularly as they nearly matched the

Enclosure design basis conditions. As discussed below, the spray pond temperature was significantly below the design basis temperature, so the required heat transfer performance was less than required by the design and license basis to maintain. The spray pond temperature results were reviewed to ensure that the most limiting values were used. It was determined to have been conservative to assume the pond and meteorological data values existed for the entire day, when the peak temperatures actually existed for periods of a few hours. The actual tube plugging in the heat exchanger were verified to be accurately accounted for in the calculation. It was also confirmed that the licensee used the same calculation method and inputs for their evaluation as were used in the design basis evaluation, except where appropriate changes were needed for this case.

The licensee showed that this heat exchanger had been eddy current tested during the outage in April 2002. The licensee provided two different analyses of how this would remove foulant and improve heat transfer. Specifically, based on a single test in Unit 3, the licensee argued that this activity would improve heat transfer to at least +25 percent margin. However, the inspectors noted that there was considerable uncertainty in this analysis. For example, the heat exchangers in Unit 3 used a larger probe, while in Unit 2, the heat exchangers had sleeves inside the tubes at each tube sheet, requiring the use of a smaller probe. The performance test data used to assess the cleaning effect had some uncertainty. Also, using a single test to conclude that the final end state would be obtained by repeating the activity, regardless of other factors, could not be validated. Instead, the NRC determined that a calculation of the volume of the probes path represented a conservative way to estimate the cleaning effect. This assumed that the probe was pushed through each tube once and no credit was given for the conduit. In reality, the probes were pushed through, then pulled back, and the conduit was demonstrated to wipe the tube in multiple spots, but this effect could not be quantified in a high-confidence manner nor were multiple data sets available to obtain an average effect. The NRC concluded that a minimum of 10 percent margin improvement was expected due to passage of the eddy current probe. This was considered a conservative estimate compared to the single set of test data, which indicated that about 30 percent improvement was observed.

Therefore, the capability of EW Heat Exchanger 2B was determined to be as follows:

In April 2002, eddy current testing improved performance margin from the measured value of -9.5 percent to +0.5 percent.

Between April 2002 and September 27, 2003, performance continued to degrade at the same rate as was observed prior to the 2002 outage. This resulted in a final capability of -39 percent margin, compared to design basis requirements.

Using the minimum required heat exchanger performance calculated from pond and weather data, the inspectors determined that the heat exchanger was not capable of removing the required heat loads for approximately 78 days. This included the effects of scaling, discussed below. This was a slightly conservative estimate because the format of the data provided by the licensee required rounding the performance to

-40 percent margin (worse performance) in order to get an answer.

Enclosure Based on the above, the NRC concluded that Essential Cooling Water Heat Exchanger 2B was not capable of performing its intended safety function for an estimated period of 78 days.

Enforcement.

Technical Specification 3.7.7 requires that two trains of essential cooling water be operable in Mode 1, with an allowed outage time for one train of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Contrary to this, Train B of the EW system in Unit 2 was not capable of performing its safety function for approximately 78 days ending on September 27, 2003, when the plant shut down for Refueling Outage 2R11. This issue was entered into the licensee's corrective action program under condition report/disposition report (CRDR) 2905161. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000529/2006011-01, EW Train 2B Inoperable Longer than Allowed Outage Time.

3.2 Control of Heat Exchanger Performance Testing In their November 14, 2006, letter responding to the apparent violations, the licensee admitted this violation.

The team determined that performance testing for the EW heat exchangers was scheduled and conducted under a maintenance order. However, calculation of the results and comparison to acceptance criteria was not a scheduled activity. Further, the test results were not administratively tracked to ensure that the unit was not restarted before acceptable performance was documented. As a result, the March 19, 2002, test results were determined after Unit 2 started up from Refueling Outage 2R10. The test results were unexpectedly low, but this was determined to involve a calculation error.

When the error was corrected with results, which indicated low performance, the test method was evaluated. On August 22, 2002, the test package was completed and verified to demonstrate -9.5 percent capability. This untimely determination of unacceptable performance did not trigger a review of operability, nor was continued degradation considered. As a result, this component continued to degrade for 18 months after demonstrating unacceptable performance. Had this determination been made prior to the end of the outage, corrective actions could have been taken to clean the tubes. Technical Specifications require that both trains be operable prior to making plant mode changes, so the unit should not have be restarted with this condition, had it been identified.

This violation affected all three units because they used the same procedure, although the example cited is from only Unit 2 because it represented the most significant example.

Enclosure Enforcement.

Part 50 of Title 10 of the Code of Federal Regulations, Appendix B, Criterion XI, "Test Control," requires that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. Test results are required to be documented and evaluated to assure that test requirements have been satisfied. Test Procedure 70TI-9EW01, "Thermal Performance Testing of Essential Cooling Water Heat Exchangers," contained instructions for conducting performance testing.

Procedure 73DP-9ZZ10, "Guidelines for Heat Exchanger Thermal Performance Analysis," contained instructions for calculating the results of EW heat exchanger performance testing and verifying them against the design basis requirements in Calculation 13-MC-SP-0307, "SP/EW System Performance Design Bases Analysis,"

Revision 007.

Contrary to this, the results of performance testing for EW Heat Exchanger 2B conducted on March 19, 2002, did not meet the design basis requirements, but this was not correctly evaluated to determine whether the system would be capable of performing its design function until August 22, 2002. As a result, Unit 2 was allowed to restart and run an entire operating cycle without correcting the degraded performance. This issue has been entered into the licensee's corrective action program under CRDR 2928230.

Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-02, Inadequate Test Control to Promptly Identify Unacceptable Performance Test Results.

This finding had cross-cutting aspects in the area of Human Performance, under the Resource attribute, because the licensee failed to ensure that adequate procedures were available to ensure nuclear safety.

3.3 Evaluation of Chemistry Control Procedure Changes In their November 14, 2006, letter responding to the apparent violations, the licensee admitted this violation.

Enforcement.

10 CFR 50.59 [2001 version] states, in part, that the licensee may make changes to the facility as described in the final safety analysis report (as updated), without prior NRC approval, provided the change does not result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system or component important to safety previously evaluated in the final safety analysis report (as updated). It further requires, in part, that records of changes in procedures be maintained, and these records must include a written evaluation which provides the bases for the determination that the change does not require a license amendment.

Enclosure Part 50.59(a)(1) of Title 10 of the Code of Regulations [1992 version] states, in part, that the holder of a license authorizing operation of a production or utilization facility may:

(1) make changes in the facility as described in the safety analysis report, (2) make changes in the procedures as described in the safety analysis report, and (3) conduct tests or experiments not described in the safety analysis report, without prior Commission approval, unless the proposed change, test, or experiment involves a change in the Technical Specifications incorporated in the license or an unreviewed safety question. A proposed change, test, or experiment shall be deemed to involve an unreviewed safety question: (1) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; (2) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (3) if the margin of safety as defined in the basis for any Technical Specifications is reduced. This regulation also required certain records be maintained, and that these records must include a written safety evaluation which provides the bases for the determination that the change, test, or experiment does not involve an unreviewed safety question.

The Palo Verde Nuclear Generating Station Updated Final Safety Analysis Report (UFSAR), Section 9.2.1.2.F, specified that the spray pond system would be protected from organic fouling and inorganic buildup by proper water treatment.

Procedure 74DP-9CY04, "System Chemistry Specification," implemented the licensee's water treatment program, including chemical limits and addition frequencies, in order to control corrosion and fouling in the emergency spray pond system.

Contrary to the above, between 1998 and 2006, the licensee made multiple changes to the chemistry control program specified in Procedure 74DP-9CY04, "System Chemistry Specification," which resulted in changes to the facility as described in the UFSAR that increased the probability of a malfunction of equipment important to safety previously evaluated in the safety analysis report. In addition, the licensee failed to perform an adequate written safety evaluation which provided the bases for the determination that the changes made did not involve an unreviewed safety question (pre-2001 requirement) or that the change did not require a license amendment (2001 version).

These changes were made without adequately assessing the impact to the safety-related systems affected by the changes. Revisions 3, 6, 8, 10, 12, 24, 28, 32, and 36 to this procedure made changes which affected spray pond chemistry parameter limits which were subsequently determined to have contributed to heat exchanger fouling that was identified during tests and inspections conducted between 1998 and May, 2006.

Specifically:

Revisions 3, 6, 8, 12, 24, 28, and 32 were made without any documented 10 CFR 50.59 review. These revisions contained changes to chemistry limits in the spray pond, which had the potential to negatively impact fouling and, therefore, were required to be evaluated per 10 CFR 50.59. These included changing pH, phosphate, and zinc limits, and instructions on the frequency of dispersant additions.

Enclosure

The screening performed for Revision 10 was inadequate because the revision increased the maximum allowable pH in Unit 1, but the screening dated June 30, 1999, did not evaluate this aspect of the revision. This limit had been lowered in Revision 6 to account for the decision to use well water as the makeup source for the Unit 2 spray pond. This water source had a significantly higher alkalinity, and the lower pH was determined to be necessary to avoid scaling at the time the modification was implemented.

The screening performed for Revision 36 was inadequate because the revision increased the maximum allowable zinc concentration by a factor of two, but Screening Number S-06-0049, Revision 1, did not address this aspect of the revision. Excessive zinc additions were subsequently determined to be a primary cause of fouling.

The NRC also evaluated the examples of this violation against the current 10 CFR 50.59 requirements, because NRC policy is to exercise discretion for violations of 10 CFR 50.59 that predate the current rule if the involved circumstances do not indicate that the current rule would have been violated. The NRC concluded that the changesmade prior to 2001 would have violated both versions of the rule, because changes to Procedure 74DP-9CY04, "System Chemistry Specification," resulted in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system or component important to safety.

This issue was documented in CRDR 2902498. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000528; 05000529;05000530/2006011-03, 10 CFR 50.59 Reviews Not Performed or Inadequate for Multiple Changes to Spray Pond Chemistry Control Procedure.

The safety significance of the violation of 10 CFR 50.59 described in the original assessment is based largely on the risk significance of the associated changes to the facility, as discussed in Supplement I of the NRC Enforcement Policy. Because the risk significance of the associated changes to the chemistry control program resulted in heat exchanger fouling which was determined to be Green, this violation has been classified at Severity Level IV, in accordance with theNRC Enforcement Policy. Further, because changes were made to the Chemistry Control Program without adequate 50.59 evaluations under both the old rule and the new rule, and were determined to be violations under both rules, no discretion was exercised in this case.

3.4 Response Within the Corrective Action Program In their November 14, 2006, letter responding to the apparent violations, the licensee admitted this violation.

This violation affected all three units, and is further discussed in NRC Inspection Report 05000528; 05000529; 05000530/2006011. The example cited only lists Unit 2 as the most significant example.

Enclosure Enforcement.

Part 50 of Title 10 of the Code of Regulations, Appendix B, Criterion XVI, "Corrective Actions," requires that significant conditions adverse to quality shall be promptly identified, and that the cause shall be determined and corrective action shall be taken to preclude repetition.

Contrary to this, on March 19, 2002, performance testing for Essential Cooling Water Heat Exchanger 2B indicated that the system would not be capable of performing its design function, but this significant condition adverse to quality was not promptly identified, the cause determined, or corrective actions taken to restore the required heat exchanger performance. Specifically, the unacceptable performance was not promptly identified, because the test results were not correctly calculated until August 22, 2002, which was after operating mode changes and returning the unit to power following the outage. When the test results were finalized, the fact that the design basis capability was not met, was not recognized and entered into the corrective action program. These failures to correct this degraded performance contributed to the continued degradation and eventual loss of function. This issue was entered into the corrective action program under CRDR 2897810. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-04, Inadequate Identification and Corrective Action for Degraded EW Heat Exchanger Performance.

This finding had cross-cutting aspects associated with the Corrective Action Program, for both inadequate identification of problems, and inadequate evaluation of the cause, extent, and impact on operability.

Failure to properly assess the impact of scaling on safety related heat exchangers cooled by the spray pond system was a performance deficiency. This finding was more than minor because it impacted the equipment performance attribute of the Mitigating Systems Cornerstone objective to maintain the availability and reliability of systems needed to mitigate accidents. Specifically, the heat exchangers associated with emergency diesel generators and essential cooling water systems in both trains in all units were allowed to degrade and Essential Cooling Water Train B in Unit 2 was estimated to have been incapable of performing its function under existing conditions for approximately 78 days. A Phase 3 significance determination process concluded that this finding has very low safety significance. This issue was entered into the corrective action program under CRDR 2897810. This is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-04, Inadequate Corrective Action for Degraded EW Heat Exchanger Performance.

Enclosure 3.5 Design Verification for Scaling Prevention During the special inspection, the team questioned whether the existing chemistry controls were adequate to prevent scaling in components cooled by the spray pond system once a design basis accident started. This was a concern because approximately 85 percent of the water in the spray pond is lost and chemicals would be expected to concentrate. In reviewing this, the licensee identified that the 1994 design calculation used to conclude that scaling would not occur was in error, and scaling was possible.

The inputs, assumptions, and results of the licensees calculations used to evaluate the scaling potential were reviewed. This study conservatively used the most limiting chemistry sample results obtained during the period of concern. These chemical concentration values were then adjusted for the expected water losses from the spray pond during the 27-day mission time of the spray pond during a simulated worst-case loss-of-coolant accident (the most limiting accident). Using the resulting concentrations, the analysis then evaluated the scaling potential by conservatively assuming that the scaling occurred instantaneously based on the highest concentration for each day. This concluded that as much as 2.3 percent degradation in heat transfer capability (using the design basis heat exchanger performance as 100 percent) could occur in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The NRC determined that the inputs used the most limiting chemistry sample results for the period by reviewing Spray Pond 2B chemistry sample results for the period. The assumptions used were conservative. Most significant among the assumptions was the fact that the licensee assumed that all scale formed instantaneously when the constituents solubility limit was exceeded, when in reality this would occur over a much longer period. Since scaling was most limiting in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , this assumption caused the results to conservatively over-predict scaling and have a larger impact on risk. Based on the above, the results of the licensees analysis were determined to be reasonable.

Based on these results, it was concluded that this was a violation. It was also concluded that this violation affected all three units.

Enforcement.

Part 50 of Title 10 of the Code of Regulations, Appendix B, Criterion III, requires that design control measures be established to verify the adequacy of design of structures, systems and components. A SEQUIL calculation was intended to demonstrate that the heat exchangers cooled by the emergency spray pond system would be capable of transferring the required heat load to the spray pond because scaling would not occur during a design basis accident.

Contrary to this, the calculation used an improper setting which caused the calculated result to incorrectly show that scaling would not occur. This issue was documented in CRDR 2913430. This violation has the potential to increase the exposure time when EW Heat Exchanger 2B was incapable of performing its safety function, since the exposure time did not account for any impact because of scaling. There is uncertainty

Enclosure associated with the amount of scaling that could occur on any of the affected heat exchangers for all three units during 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident scenario. This issue was entered into the corrective action program under CRDR 2897810. Because this violation was of very low safety significance and has been entered into the corrective action program, it is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000528; 05000529;05000530/2006011-05, Inadequate Design Control to Ensure No EW Heat Exchanger Scaling.

ATTACHMENT: SUPPLEMENTAL INFORMATION

Attachment A-1 SUPPLEMENTAL INFORMATION LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED Opened and Closed 05000529/2006011-01 NCV EW Train 2B Inoperable Longer than Allowed Outage Time 05000528; 05000529; NCV Inadequate Test Control to Promptly 05000530/2006011-02 Identify Unacceptable Performance Test Results 05000528; 05000529; NCV 10 CFR 50.59 Reviews Not Performed or 05000530/2006011-03 Inadequate for Multiple Changes to Spray Pond Chemistry Control Procedure 05000528; 05000529; NCV Inadequate Identification and Corrective 05000530/2006011-04 Action for Degraded EW Heat Exchanger Performance 05000528; 05000529; NCV Inadequate Design Control to Ensure No 05000530/2006011-05 EW Heat Exchanger Scaling Closed 05000529/2006011-01 AV EW Train 2B Inoperable Longer than Allowed Outage Time 05000528; 05000529; AV Inadequate Test Control to Promptly 05000530/2006011-02 Identify Unacceptable Performance Test Results 05000528; 05000529; AV 50.59 Reviews Not Performed or 05000530/2006011-03 Inadequate for Multiple Changes to Spray Pond Chemistry Control Procedure 05000528; 05000529; AV Inadequate Identification and Corrective 05000530/2006011-04 Action for Degraded EW Heat Exchanger Performance 05000528; 05000529; AV Inadequate Design Control to Ensure No 05000530/2006011-05 EW Heat Exchanger Scaling

Attachment A-2 SUPPLEMENTAL INFORMATION LIST OF DOCUMENTS REVIEWED The following documents were selected and reviewed by the inspectors to accomplish the objectives and scope of the inspection and to support any findings:

Calculation 02-MS-B052, Essential Cooling Water Heat Exchanger U Study, Revision 0 EPRI Report 1014505, Assessment of Palo Verde Nuclear Generating Station Essential Cooling Water Heat Exchangers, dated October 2006 EPRI letter: Technical Review of Material to Support Assessment of Palo Verde Essential Water Heat Exchanger Performance, dated September 12, 2006 Preliminary Assessment of DBA Scaling Degradation in the 2EWB Heat Exchanger for the 2N11 Operating Cycle, by John Hughey, dated September 13, 2006 PVNGS PRA Memo: A Simple Eddy Current Cleaning Model for the Essential Cooling Water Heat Exchanger, dated November 15, 2006 PVNGS Assessment: EW heat Exchanger Eddy Current Cleaning (Alternate Method),

November 2006 Palo Verde Nuclear Generating Station Unit 2 Balance of Plant Heat Exchanger Eddy Current Examinations, Tenth Refueling Outage, March 2002 EW Heat Exchanger Performance Test Results (73DP-9ZZ10, Appendix A):

Heat Exchanger:

Date:

2B 4/99 1A 4/2/01 2B 3/19/02 3A 4/2/03 1A 4/3/04 3A 4/27/03 1A 5/5/04 3A 11/23/04 2B 4/2/05 2B 10/18/05 PNNGS Technical Specification 3.7.7 and associated Bases CRDR 2864575 CRDR 2902498 Root Cause Report for CRDR 2897810

Attachment A-3 EPRI Report 1014505, Assessment of Palo Verde Nuclear Generating Station Essential Cooling Water Heat Exchangers, dated October 2006 SP Piping Inspection Results for U2R13, 10/18/06 Southwest Research Institute letter: Final results of Analysis for Samples Received 06/12/06 &

06/13/06, dated June 29, 2006 Calculation 13-NS-C082, Significance Determination for Unit 2 EWB HX Degraded Performance, Revision 0 Calculation 13-NS-B098, At-power PRA System Study for the HVAC Room Coolers, Revision 2 Calculation 13-MC-HJ-0003, HJ System Heat Load and Equipment Selection Criteria, Revision 5 Calculation 13-MC-HJ-256, Control Room and Switchgear Room temperature Rise Study, Revision 2 Calculation 13-MC-HJ-260, Temperature in DC Equipment Room for PRA Study, Revision 2 Calculation 13-MS-A107, Loss of Essential Chillers Study, Revision 0 PRA Assessment Results Memo 448-00687-MAB/AVD dated November 10, 2006 Westinghouse Report EQ-EV-2-CVER, Assessment of Palo Verde Motor Functionality at Elevated temperatures, Revision 1, dated November 2006 PVNGS letter 102-05593-JML/SAB/JAP/DFH to NRC responding to apparent violations in EA 06-221, dated November 14, 2006 PVNGS Updated Final Safety Analysis Report, Revision 16 APS Presentation Slides for the NRC Regulatory and Predecisional Enforcement Conference held on November 20, 2006 APS letter 102-05600-JML/TNW/GAM to NRC, dated November 28, 2006

Attachment A-4 SUPPLEMENTAL INFORMATION PHASE 3 SIGNIFICANCE DETERMINATION The NRC completed a Phase 3 significance determination, which was independently checked and then approved in accordance with Manual Chapter 0609. The results are summarized below for the five violations which led to the loss of function for Essential Cooling Water Heat Exchanger 2B. Although uncertainties existed in the information used to develop the risk analysis, the use of conservative assumptions bounded the uncertainties such that the finding was determined to be of very low safety significance.

Summary This finding was assessed based on the best available information, including influential assumptions, using the applicable Significance Determination Process (SDP). The finding was preliminarily determined to be a Greater Than Green Finding based on a Phase 2 evaluation in accordance with Inspection Manual Chapter 0609. It was estimated that in Unit 2, Train B of essential cooling water was incapable of performing its safety function for 6.8 months in 2003, based on extrapolation of performance data for this heat exchanger. Accident sequences that would cause high pond temperatures, primarily loss-of-coolant accidents, could challenge this system to the point where the essential chiller would fail, causing a loss of room cooling to important mitigating systems. In addition, there was uncertainty associated with the amount of scaling that could occur on any of the affected heat exchangers for all three units during 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of an accident scenario.

The NRC subsequently completed a Phase 3 evaluation and concluded that the finding had very low safety significance as documented in this assessment. The performance deficiency resulted in the fouling and degradation of the Unit 2 Essential Cooling Water Heat Exchanger 2B as well as the Train B emergency diesel generator turbocharger heat exchanger during several months in 2003. Degradation of heat exchangers also occurred in other units and at different times, but these occurrences were not as significant from a risk perspective.

Evaluation of test data confirmed that the safety function of the Train B emergency diesel generator was not affected by the fouled turbocharger heat exchanger. On the other hand, the degradation of the Essential Cooling Water 2B heat exchanger led to a risk-significant condition-the assumed failure of the Train B chilled water system following postulated medium or large break loss of coolant accidents. This system provides cooling to vital equipment used to mitigate the consequences of a loss of coolant accident.

The overall risk impact was diminished because the redundant Unit 2 Essential Cooling Water Heat Exchanger 2A was not fouled and was nominally available and reliable during the period of concern. Successful operation of Train A components would result in a satisfactory recovery from all postulated loss of coolant accidents.

Attachment A-5 The best estimate of risk associated with the performance deficiency was a delta-CDF of 2.3E-7/yr. A sensitivity using more bounding assumptions resulted in a delta-CDF of 8.9E-7, and one using the maximum bounding assumptions resulted in a delta-CDF of 1.3E-6. The NRC concluded that the performance deficiency is characterized as a Green finding, i.e., an issue with very low safety significance.

The NRC identified uncertainties related to test data extrapolation, the linear chemical fouling degradation rate, assumptions regarding the duration of the condition, cleaning credit for eddy current testing, room temperatures after the loss of the safety chiller, and effectiveness of manual actions needed to prevent tripping of the chillers. Although uncertainties existed in the information used to develop the risk analysis, the use of conservative assumptions compensated for the uncertainties such that the finding was determined to be of very low safety significance.

Assumptions A linear rate of fouling/scaling and loss of heat transfer capability was assumed, although it was likely that there was a greater amount of fouling that occurred early followed by a decreasing rate with time. This is because the velocity of fluid through the tubes would tend to increase as the effective diameter decreases, thereby increasing the rate of sloughing of the soft slime layer, which would eventually equal the deposition rate. However, the assumption of linear degradation was bounding because it produced a higher assumed final state of degradation and therefore a greater number of days of exposure utilized in the risk evaluation. Initially, an exposure period of 6.8 months was calculated based on the linear degradation assumption. The exposure period was later refined as discussed below.

The Train B EW heat exchanger was never completely incapable of removing heat. In its most degraded condition, it was still capable of removing some decay heat. Therefore, the function of the Train B shutdown cooling heat exchanger was retained, such that plant cooldown on this heat exchanger alone, given a loss of Train A equipment, was available, though the cooldown would have been extended in time.

During the time that the Train B EW heat exchanger was degraded, the Train A EW heat exchanger was capable of performing as designed and is therefore assumed to have nominal reliability and availability. Therefore, the plant in its degraded condition was still capable of performing all of its design basis functions, including transition to cold shutdown. The consequence of the degraded condition was a loss of redundancy or defense in depth.

There were no cumulative outages or overlaps of degradations that would have been more severe with respect to risk in any 1-year period.

Attachment A-6 Essential cooling water heat exchanger outlet temperatures less than 135 degrees F causes no impact on supported systems.

Essential cooling water heat exchanger outlet temperatures greater than 135 degrees F will cause the emergency chilled water system (CWS) chiller to surge and trip. This is assumed to be an unrecoverable failure.

Essential cooling water heat exchanger outlet temperatures greater than 135 degrees F will not impact shutdown cooling (decay heat removal), although the reactor cooling system cooldown will be extended.

Essential cooling water heat exchanger outlet temperature will exceed 135 degrees F only if shutdown cooling loads are applied. All other EW heat loads are very small compared to decay heat.

Note: Essential cooling water cools the shutdown cooling heat exchanger and the CWS (chilled water) heat exchanger. In turn, CWS provides room cooling for the emergency core cooling system (ECCS) pump rooms (high pressure safety injection (HPSI), low pressure safety injection (LPSI), containment spray (CS), EW, Train A of auxiliary feedwater (AF-B), and vital switchgear ventilation systems).

Credit was not applied for splitting decay heat loads onto both trains of shutdown cooling or throttling flow through the shutdown cooling heat exchanger to limit decay heat load.

The standardized plant analysis risk (SPAR) model for Palo Verde Nuclear Generating Station provides an operator recovery for room ventilation for HPSI, LPSI, and CS in the event of loss of the CWS system (chilled water) for alternate room cooling (natural convection). The action is to open the door to the room and has an assumed human reliability assessment (HRA) failure probability of 6E-3. However, a similar recovery for the EW pump room ventilation is not provided in the model. Therefore, a loss of CWS is assumed to fail the EW pump in that train, which then removes flow and function from the shutdown cooling heat exchanger. This eliminates decay heat removal capability for the affected train.

The analyst contacted the Idaho National Laboratory (NRC contractor for the SPAR models) and the licensee to confirm the SPAR modeling of the EW pump dependency on room cooling.

The information gathered from Idaho National Laboratory and the licensee suggested that the SPAR model was incorrect in assigning no recovery for the EW pumps upon loss of CWS. Consequently, the analyst revised the SPAR model to add an operator recovery for alternate room cooling (opening the door) for the EW (Train A and B)

Attachment A-7 system with a failure probability of 6E-3 (same as for other pumps whose rooms are cooled by CWS).

Based on information developed by the inspection team, the analyst assumed that only loss-of-coolant accidents (LOCAs) (large, medium, and small) would result in the potential for EW heat exchanger outlet temperatures to exceed 135 degrees F. [Steam generator tube rupture and main steam line break events can also result in high EW heat exchanger outlet temperatures if operators fail to manage the shutdown cooling evolution, but because of several factors, including that the HRA for this action is approximately the same for both the base and degraded condition, the change in risk from these events is very small compared to LOCAs] For small break LOCAs, the licensee provided information indicating that EW exit temperatures of 135 degrees F would not be exceeded unless operators fail to follow procedures to limit this temperature to 125 degrees F. Annunciators will alert operators to this condition and it is a proceduralized step performed routinely by the operators during every shutdown.

For the full spectrum of small-break LOCAs, the steam generators remain available to remove decay heat as long as the feedwater/auxiliary feedwater system is available to keep the steam generators filled. Based on this information, the analyst assumed that risk associated with the performance deficiency for small-break LOCAs very closely approximated the risk associated with the baseline small-break LOCAs. The licensee also reported that the change in risk attributable to small-break LOCAs in their analysis was negligible compared to the larger-sized breaks. Therefore, only large LOCA and medium LOCA sequences were quantified in the SPAR model. This is discussed further below.

The loss of the CWS is assumed to be the only risk-significant event caused by the fouling of the Train B EW heat exchanger. There were no other affected loads that had a non-negligible bearing on the risk of the finding (though as explained above, the shutdown cooling heat exchanger performance would have been partially degraded by the higher than normal EW temperatures such that the ensuing RCS cooldown would have been extended, but this condition was not judged to affect the risk significance of the finding).

The licensee documented an analysis of the risk associated with the performance deficiency in Calculation 13-NS-C082, Significance Determination for Unit 2 EWB HX Degraded Performance, Revision 0, dated November 14, 2006. The licensee presented a summary of the analysis to the NRC during a regulatory conference on November 20, 2006.

The analyst reviewed the calculation and supporting documents. The following points are important in understanding the methodology used by the licensee and the elements relevant to making a decision regarding the risk of the finding:

Credit was taken for the incidental cleaning of the Unit 2 Train B EW heat exchanger resulting from the performance of eddy current testing (ECT). This

Attachment A-8 testing was performed subsequent to the final performance test of the heat exchanger that was used by the NRC to extrapolate heat exchanger capacity to determine the period of time that it was potentially unable to perform its safety function.

During the conference, the licensee displayed a simulated heat exchanger tube and ECT probe to demonstrate the likelihood that the introduction of this device into every tube of the heat exchanger would likely remove some of the soft-consistency zinc-calcium-phosphate slime that was building up on the inside of the tubes. Using data from an ECT test before and after performance tests of the Unit 3 Train A EW heat exchanger, the licensee calculated that the ECT cleaning effect would result in the heat exchanger having a 25 percent margin above its design value. It was assumed that the end state after the testing would be more or less independent of the initial state, because the probe and cable would remove more of the slime if it was thicker at the time of the test.

Any cleaning effect attributable to ECT testing would result in a decrease in the 6.8-month exposure period assumed in the original preliminary NRC Phase 3 analysis. However, the analyst did not agree that the testing results associated with the Unit 3 Train A EW heat exchanger were necessarily indicative of the effect that it had on the Unit 2 Train B EW heat exchanger. First, a single data point is not statistically convincing, and second, the Unit 2 Train B EW heat exchanger is sleeved on the tube ends and, therefore, a smaller diameter ECT probe was used. This would imply less contact between the probe and the tube walls occurred, although the cable would be expected to have made contact in a similar manner irrespective of the probe diameter. Third, the heat loads used for this test were small, leading to potentially large measurement uncertainties.

Based on review of the information presented, the analyst recommended that a 9 percent cleaning effect, as a conservative lower bound, should be credited for the ECT testing that was performed on the Unit 2 Train B EW heat exchanger.

In lieu of assuming worst-case design basis conditions throughout the period of time that the Unit 2 Train B EW heat exchanger was degraded, the licensee used actual meteorological data to calculate a minimum U-value that was necessary to avoid post-DBA conditions that would result in a loss of the Train B chilled water system. For the case of crediting no ECT cleaning effect, this resulted in a reduction of the exposure period from 6.8 months to 105 days.

Given that the study incorporated an extended period of time encompassing the entirety of the hottest summer months, this approach was considered acceptable.

Note: the period of degradation occurred in 2003 and does not reflect recent or current conditions of the heat exchanger.

Attachment A-9 An important question was whether a certain sized break of the reactor coolant system was necessary to create the heat loads that would cause elevated EW temperatures (135 degrees F) that would subsequently result in loss of the chilled water system. As discussed above, a loss of the chilled water system represents a total expression of the risk imparted by the performance deficiency; that is, if the chilled water system survives, the risk is assumed to be equal to the baseline risk. In the original NRC analysis, it was assumed that small-break LOCAs would not result in a challenge to the chilled water system and therefore only medium and large break LOCA sequences were quantified.

The licensee presented thermodynamic model results that demonstrated that for small break LOCAs, EW heat exchanger outlet temperatures in excess of 135 degrees F are not expected to occur as long as operators follow their initial procedure to limit the EW heat exchanger outlet temperature to less than 125 degrees F. The probability of success of this action is very high, given that it is a well-known, often-performed, and specifically-proceduralized step that is prompted by an annunciator. From a PRA perspective, the operator failure probability for this action is small enough that scenarios that include this failed action are insignificant to the overall quantification of risk.

The success of limiting EW heat exchanger outlet temperatures is contingent on the continued availability of the steam generators for reactor cooling system natural circulation cooling. The break size used to define the spectrum of small breaks is embedded in the design of the system, meaning that the steam generators are expected to be available as long as main or auxiliary feedwater is available to keep the steam generators filled. With this analysis, the probability of losing all secondary injection sources is too small to have an important impact on the risk result.

Based on the above considerations, the analyst determined that the original assumption that small break LOCAs are not important to the risk of the finding was confirmed.

The licensee evaluated the effect of elevated temperatures on equipment in the ECCS pump rooms and control building following a loss of essential cooling resulting from a hypothetical failure of Train B chilled water system. In general, the analysis showed a large margin existed between the highest expected room temperatures (no credit was taken for alternate room cooling to the ECCS pump rooms) and the limiting thermal condition of the vulnerable equipment. The exceptions are discussed as follows:

A.

The oil sight glasses on the LPSI and CS pumps were determined to be susceptible to failure after approximately 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at a temperature of 150 degrees F. The heat-up calculation for these rooms estimated a maximum ambient temperature of 146 degrees F.

Attachment A-10 Given the uncertainty bands for both the durability of the sight glasses and the heat-up of the room, the analyst determined that a loss of the chilled water system could likely result in a failure of the LPSI and CS pumps within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the event, Therefore, within the risk analysis, a failure of these two pumps upon loss of the chilled water system was assumed as a bounding case. At the same time, nominal reliability credit for all other essential pumps is considered reasonable.

This is a bounding assumption for two reasons. The SPAR model makes no provision for these pumps running for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months post-accident and effectively assumes that they are lost immediately. The risk impact of these pumps failing at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is much less than that occurring from an immediate failure. Also, the LPSI pump is secured following the initiation of sump recirculation (and therefore before the chilled water system is assumed to be lost) and would likely be available following the postulated failure of the CS pump at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . At this time, the LPSI pump would replace the function of the CS pump.

B.

The following equipment located in the control building was cited as being vulnerable to failure as follows:

Room Limiting Temperature Time to Temperature Limit Control Room 119F 6 hrs. 50 min.

15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months (doors open)

DC Equipment Room 122F 11 hrs.

Switchgear Room 125F 21 hrs. 40 min.

Battery Room 122F 24 hrs.

The times listed are following loss of the chilled water system, which is expected to occur approximately two hours subsequent to a medium or large break LOCA. The sequences leading to this condition include a loss of cooling from the Train A chilled water system for reasons other than those associated with this performance deficiency. It is noted that the licensees analysis assumes no recovery of the Train A chilled water system upon failure as is also the case for Train B.

Loss of any of the four rooms listed would likely result in core damage.

Operators would have to take actions to preclude this outcome. Two strategies are available: bypass the safety injection actuation

Attachment A-11 signal (SIAS) signal to the individual supply and return dampers associated with the normal control building cooling system (which would have been automatically isolated from the SIAS) by using jumpers on circuit cards located in the control room cabinets, or by resetting the SIAS. Resetting the SIAS could cause undesirable repercussions and would thus likely be the second choice. Unavailability of the normal control building cooling system resulting from a LOOP or another reason would have an insignificant impact on the risk assessment because it is small in magnitude compared to the probability of failing to restore its function given that it is available.

The licensee used a reference to NUREG/CR-1278 to conclude that the probability of operators failing to restore normal cooling to the control room is 0.14. This method was not rigorous in that it did not consider the full spectrum of performance shaping factors that would be expected to influence the outcome. The analyst performed a separate estimate using the SPAR-H methodology, assuming nominal time available (at least six hours are available to perform the action and, according to the licensee and later confirmed by NRC inspectors, a procedure could be developed and implemented within two hours as a nominal case), high stress, an incomplete procedure, and a moderately complicated task. This resulted in a failure probability of 0.08.

Given the ease of diagnosis (heating up of the control room), the high likelihood that operators would open the control room doors (invoking 10 CFR 50.54(x)) that would extend the time available to 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months (11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months for the dc equipment room), the expectation of additional personnel arriving from Units 1 and 3 and from offsite, the expected manning of the Technical Support Center (TSC) within two hours, the fact that the bypass operation procedure is not beyond the skill levels of many engineers onsite, and the fact that the backup action of bypassing the SIAS is available if needed, the analyst concluded that the non-recovery probability of 0.14 was a reasonable estimate.

The licensee performed a sensitivity analysis using their PRA model and various assumptions related to ECT cleaning and equipment survivability. The results are reproduced below:

Attachment A-12 Heat Exchanger margin at end of exposure period Percent cleaning credit for ECT Exposure time based on actual met. data (days)

Equipment failed as as a result of loss of room cooling None HPSI LPSI CS HPSI EW AFB All

-30%

19%

0 0

-35%

14%

39 2.8E-8 3.3E-7 3.6E-7 4.5E-7 4.6E-7

-40%

9%

78 5.6E-8 6.6E-7 7.3E-7 9.0E-7 9.2E-7

-45%

4%

88 6.3E-8 7.5E-7 8.2E-7 1.0E-6 1.0E-6

-49%

None 105 7.5E-8 8.9E-7 9.8E-7 1.2E-6 1.2E-6 Based on the discussion above, the analyst assumed a 9 percent cleaning credit for ECT and assumed in the bounding case that the LPSI and CS pumps would be lost in the B train following a loss of the Train B chilled water system. These assumptions would yield a delta-CDF of 7.3E-7 based on the licensees PRA model. [note: it is recognized that the assumption that the Train B LPSI and CS pumps would fail on a loss of room cooling would imply that the A Train LPSI and CS pumps would also fail on loss of the Train A chilled water system (which would presumably fail from some other cause). The licensees analysis incorporates this concept].

Analysis Using the Palo Verde Nuclear Generating Station SPAR Model The headquarters staff revised/corrected the SPAR model of record (referenced below) with assistance from Idaho National Laboratory as discussed below:

i.

EW System Fault Tree.

(1)

Under the gate ECW-A, created an AND gate ECW-A-RM (LOSS OF ROOM COOLING TO EW PUMP A). Inputs to the AND gate are:

(a)

CWS-A (ESSENTIAL CHILLED WATER TRAIN A FAILURES) - a transfer gate to the CW fault tree.

Attachment A-13 (b)

HVC-XHE-XM-ROOM (OPERATOR FAILS TO BLOCK OPEN PUMP ROOM DOORS) an existing HRA basic event with an HEP of 6.00 x 10-3.

(2)

Likewise for ECW-B, an AND gate ECW-B-RM (LOSS OF ROOM COOLING TO EW PUMP B) was created. Inputs to the AND gate are:

(a)

CWS-B (ESSENTIAL CHILLED WATER TRAIN B FAILURES) - a transfer gate to the CW fault tree.

(b)

HVC-XHE-XM-ROOM (OPERATOR FAILS TO BLOCK OPEN PUMP ROOM DOORS) an existing HRA basic event with an HEP of 6.00 x 10-3.

(3)

Removed CWS-A and CWS-B direct inputs to gates ECW-A and ECW-B, respectively.

ii.

ACP-PB-A-AC Fault Tree (1)

Under top gate of ACP-PB-A-AC, created an AND gate ACP-PBA-AC-RM (LOSS OF SWGR RM COOLING TO PBA).

Inputs to the AND gate are:

(a)

HVC-XHE-XM-PBA (FAILURE TO OPEN ALIGN ALTERNATE COOLING TO SWGR RM A - LICENSEE) a new HRA value using the Licensees HEP value of 0.14.

Although the degradation was seen for the B train, it was included here for completeness.

(b)

CWS-A (ESSENTIAL CHILLED WATER TRAIN A FAILURES) - a transfer gate to the CW fault tree.

iii.

ACP-PB-B-AC Fault Tree (1)

Under top gate of ACP-PB-B-AC, created an AND gate ACP-PBB-AC-RM (LOSS OF SWGR RM COOLING TO PBB).

Inputs to the AND gate are:

(a)

HVC-XHE-XM-PBB (FAILURE TO OPEN ALIGN ALTERNATE COOLING TO SWGR RM B - LICENSEE) a new HRA value using the Licensees HEP value of 0.14.

(b)

CWS-B (ESSENTIAL CHILLED WATER TRAIN B FAILURES) - a transfer gate to the CW fault tree.

Attachment A-14 iv.

LPI-MDPA Fault Tree (1)

Under top gate of LPI-MDPA (FAILURES OF LPI MDP A),

corrected 4.16kV power transfer gate from ACP-PBB-AC (41160V AC BUS PBB POWER FAILS) to ACP-PBA-AC (4160V AC BUS PBA POWER FAILS).

v.

LPI-DIS Fault Tree (1)

Under gate LPI-MOV-1A-F (LPI INJECTION TO LOOP 1A UNAVAILABLE), corrected 4.16kV power transfer gate from ACP-PBB-AC (41160V AC BUS PBB POWER FAILS) to ACP-PBA-AC (4160V AC BUS PBA POWER FAILS). Loop 1A injection MOV-635 is powered from Train A (Group 1). Failure of MOV-635 is set to logical TRUE when quantifying LLOCA and MLOCA sequences.

(2)

Under gate LPI-MOV-2A-F (LPI INJECTION TO LOOP 2A UNAVAILABLE), corrected 4.16kV power transfer gate from ACP-PBA-AC (4160V AC BUS PBA POWER FAILS) to ACP-PBB-AC (41160V AC BUS PBB POWER FAILS).

Loop 2A injection MOV-615 is powered from Train B (Group 2).

The analyst used the Palo Verde Nuclear Generating Station SPAR model, Revision 3.21, dated October 28, 2005. Truncation of 1.0E-12 was used. Average test and maintenance was assumed. SPAR model changes were made for this specific case as discussed above.

The analyst assessed the risk associated with various assumptions. The following table presents the results of this effort. In the base model, loss of ECCS pumps has a dependency for operators to open the door to the pump room, with an HRA of 6E-3.

Therefore, for the no pumps lost column in the table, this dependency is retained. For the cases where a pump is assumed lost, the basic event for the fail-to-run event was set to TRUE and the associated common cause event was set to its baseline value.

The HRA for operators restoring normal cooling to the control room is shown with two values, 0.14 as was assumed in the licensees analysis, and 0.20, which was considered a bounding case. The analyst believed that the 0.14 value was reasonable as discussed above. For cutsets where the Train A chilled water system fails (independently from the spray pond and emergency cooling water systems), an assumption is made that the pumps assumed lost by the Train B chilled water failure are also lost in Train A. This was accomplished by performing a post-processing of the cutsets.

Attachment A-15 Credit for ECT Cleaning Number of Exposure Days Restore Normal Cooling to Control Building HRA= 0.14 Restore Normal Cooling to Control Building HRA= 0.20 No ECCS Pumps Lost (Only CWS Lost)

(1.06E-6/yr)

Loss of LPSI, CS (3.54E-6/yr)

Loss of LPSI,CS,

ECW, HPI (4.35E-6/yr)

No ECCS Pumps Lost (Only CWS Lost)

(1.51E-6/yr)

Loss of

LPSI, CS (4.16E-6/yr)

Loss of

LPSI, CS,

ECW, HPI (4.63E-6) 0 105 3.0E-7 1.0E-6 1.3E-6 4.3E-7 1.2E-6 1.3E-6 9%

78 2.3E-7 7.6E-7 9.3E-7 3.2E-7 8.9E-7 9.9E-7 14%

39 1.1E-7 3.8E-7 4.6E-7 1.6E-7 4.4E-7 4.9E-7 The analyst considered the value associated with a 9 percent ECT cleaning effect, an HRA of 0.20, and a presumed loss of the Train B LPSI and CS pumps to be a bounding estimate of risk (8.9E-7). A best estimate would credit an HRA value of 0.14 and include the assumption that the combination of the Train B CS and LPSI pumps would provide greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of functional service after room cooling is lost. The risk expressed by this set of assumptions would be essentially equivalent to that shown in the no pumps lost column. Therefore, the analyst concluded that the best estimate of risk was a delta-CDF of 2.3E-7/yr. for internal initiators, and because of the lack of risk associated with external initiators, as discussed below, this also expresses the best estimate of the total risk of the finding.

External Events The plant-specific SDP worksheets do not currently include initiating events related to fire, flooding, severe weather, seismic, or other external initiating events. In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.5, "Screen for the Potential Risk Contribution Due to External Initiating Events," experience with using the Site Specific Risk-Informed Inspection Notebooks has indicated that accounting for external initiators could result in increasing the risk significance attributed to an inspection finding by as much as one order of magnitude.

The analyst determined qualitatively that external events would not add appreciably to the risk of the finding because of the low probability that they would cause or occur in conjunction with a loss of coolant accident.

Attachment A-16 Large Early Release In accordance with Manual Chapter 0609, Appendix G, for PWRs with large, dry containments, only sequences associated with steam generator tube ruptures or inter-system LOCAs are likely to result in a large early release. Because these sequences are not associated with risk increases resulting from this performance deficiency, the analyst determined that large early release was not relevant to this analysis. [Steam generator tube rupture events present a risk increase associated with the finding, but their contribution in the licensees analysis was well less than 1E-7/yr. The analyst determined that the risk associated with tube rupture events would be similar to baseline risk, because in both cases, operators are challenged to control EW exit temperatures in a manner similar to a normal shutdown evolution, only that in the degraded heat exchanger case, less time is available to react to the situation, though the high EW temperature alarms would still be timely in prompting this action. Also, the operators transfer to shutdown cooling following a tube rupture later in the event than in a normal

Attachment A-17 SUPPLEMENTAL INFORMATION UNCERTAINTY ASSESSMENT Essential Cooling Water Heat Exchanger 2B was measured as having 9.5 percent less capability than required under design conditions in April, 2002. Shortly after completing this performance test, eddy current testing was performed on this heat exchanger, which would have removed some of the foulant. The licensees assessment concluded that this would restore the heat exchanger to 25 percent positive margin based on a single test in Unit 3.

However, due to the dissimilar eddy current probe sizes used in these two units and the uncertainty of the cleaning effect and repeatability, NRC concluded that only about 10 percent margin improvement could be conservatively credited. This was based on a simplified geometry analysis which the licensee performed, but chose not to present at the conference.

The NRC concluded that this analysis credited wiping by the eddy current probe, but not the flexible conduit housing the cable, because the effect of the conduit could not be reliably quantified. Therefore, our analysis of Essential Cooling Water Heat Exchanger 2B used the following performance history:

In April, 2002, the -9.5 percent margin was improved by 10 percent to

+0.5 percent, due to inadvertent cleaning that occurred during eddy current testing.

From April, 2002, until October, 2003, degradation due to fouling continued at the same rate determined by the previous two Essential Cooling Water Heat Exchanger 2B performance test results.

This resulted in degrading to -39 percent margin compared to design basis conditions.

However, because the conservative design basis conditions assumed for local weather and spray pond temperature did not exist during the period of concern, our analysis included these factors in determining the actual minimum required heat exchanger performance. The licensees analysis provided a conservative calculation of the minimum required heat exchanger performance using conservative weather and pond data, as well as an estimation of the time during which this minimum was not met. Because this data was provided in finite increments which did not match -39 percent margin, the NRC conservatively used -40 percent. This resulted in an exposure time of 78 days when this heat exchanger was not capable of performing its intended function as required. This included an additional conservatism because the graph was created in a way that calculated a slightly longer exposure time than would have been calculated using the degradation rate the NRC assumed.

As a consequence of this level of degradation, essential cooling water could have exceed 135 degrees Fahrenheit. For large and medium break loss-of-coolant accidents, this was assumed to result in an unrecoverable failure of the essential chiller. For a small break loss-of-coolant accident, the NRC determined that operator training and procedures would result in operators being able to reliably control cooldown rate to preclude tripping the chiller.

For large and medium break loss-of-coolant accidents, chiller failure was expected to cause

Attachment A-18 loss of room cooling, notably in safety-related pump rooms, the control room, and ac and dc electrical equipment rooms. These were evaluated as follows:

In the high pressure safety injection, auxiliary feedwater, essential cooling water, and essential chilled water pump rooms, the peak temperature predicted with loss of cooling was not high enough to cause pump failure.

In the low pressure safety injection and containment spray pump rooms, elevated temperatures were expected to cause sight glass leakage. Our analysis conservatively assumed that both these pumps would fail immediately after containment recirculation started.

The electrical equipment rooms and control room were expected to exceed limiting temperatures within 6 to 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months after loss of room cooling. Simple actions to open doors and use portable fans could extend this time, but restoration of cooling via the normal ventilation system was required. Portions of the steps necessary to perform this task were not proceduralized at the time of this degraded condition. However, the licensee was able to demonstrate that personnel available in the Technical Support Center (which would be staffed during the scenarios of concern) would be able to identify the actions needed in about an hour, and the steps could be reliably performed in an additional hour.

The NRC independently assessed these actions, and determined a range of human reliability values, which are further discussed in the attached report.

Although NRC assigned a conservative probability, the NRC still concluded that these steps could be performed reliably under the expected conditions and within the time available.

The NRC agreed with the licensees conservative estimation of additional degradation due to scaling after a design basis accident started. This effect was assumed to be additive with the pre-existing fouling. The NRC determined this to be conservative, since the foulant would blanket the tube face and make it more difficult for the scale-forming constituents of the cooling water to reach the higher temperatures needed to form scale. The scaling effect was included as a penalty in the minimum required heat exchanger performance curve in calculating exposure time.

Finally, because the degradation level and exposure time were sensitive to the uncertainty of the heat exchanger performance test data used in this analysis, NRC performed sensitivity studies. Based on these, NRC concluded that the worst-case test uncertainties did not have sufficient impact on risk to increase the result to a White finding.

ML063600175

Contents

Text

SUBJECT:

Dear Mr. Levine:

Enclosure:

Attachment:

SUMMARY

SUMMARY

Navigation menu

ML063600175

Text

SUBJECT:

Dear Mr. Levine:

Enclosure:

Attachment:

SUMMARY

SUMMARY

Navigation menu

Search