ML071380478
| ML071380478 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 05/18/2007 |
| From: | Hay M NRC/RGN-IV/DRP/RPB-C |
| To: | Brian W Entergy Operations |
| References | |
| IR-07-006 | |
| Download: ML071380478 (32) | |
See also: IR 05000416/2007006
Text
May 18, 2007
William R. Brian, Vice
President, Operations
Grand Gulf Nuclear Station
Entergy Operations, Inc.
P.O. Box 756
Port Gibson, MS 39150
SUBJECT: GRAND GULF NUCLEAR STATION - NRC SPECIAL INSPECTION
REPORT 05000416/2007006
Dear Mr. Brian:
On March 14, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed a special
inspection at your Grand Gulf Nuclear Station facility. This inspection examined activities
associated with the Division I standby diesel generator (SDG) high temperature event that
occurred on January 30, 2007. On this occasion, the SDG experienced elevated temperatures
in the jacket water and lube oil subsystems. The NRC's initial evaluation satisfied the criteria in
NRC Management Directive 8.3, NRC Incident Investigation Program, for conducting a special
inspection. The basis for initiating this special inspection is further discussed in this report,
which is included as Attachment 2. The determination that the inspection would be conducted
was made by the NRC on February 8, 2007, and the inspection started on February 12, 2007.
The enclosed inspection report documents the inspection findings, which were discussed on
March 14, 2007 and again on April 25, 2007, with you and other members of your staff. The
inspection examined activities conducted under your license as they relate to safety and
compliance with the Commission's rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed
personnel.
The report documents four findings which were determined to be violations of very low safety
significance. Because of their very low safety significance and because they were entered into
your corrective action program, the NRC is treating these findings as noncited violations
consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these NCVs, you
should provide a response within 30 days of the date of this inspection report, with the basis for
your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk,
Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear
Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas,
76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission,
Washington DC 20555-0001; and the NRC Resident Inspector at the Grand Gulf Nuclear
Station facility.
Entergy Operations, Inc. -2-
In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, its
enclosure, and your response (if any) will be made available electronically for public inspection
in the NRC Public Document Room or from the Publicly Available Records (PARS) component
of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA
Michael C. Hay, Chief
Reactor Projects Branch C
Docket: 50-416
License: NPF-29
Enclosure: Inspection Report 05000416/2007006
Attachment 1: Supplemental Information
Attachment 2: Special Inspection Charter
Attachment 3: Significance Determination Evaluation
cc w/Enclosure:
Executive Vice President
and Chief Operating Officer
Entergy Operations, Inc.
P.O. Box 31995
Jackson, MS 39286-1995
Chief
Energy & Transportation Branch
Environmental Compliance and
Enforcement Division
Mississippi Department of
Environmental Quality
P.O. Box 10385
Jackson, MS 39289-0385
President
Claiborne County Board of Supervisors
P.O. Box 339
Port Gibson, MS 39150
General Manager, Plant Operations
Grand Gulf Nuclear Station
Entergy Operations, Inc.
P.O. Box 756
Port Gibson, MS 39150
Entergy Operations, Inc. -3-
Attorney General
Department of Justice
State of Louisiana
P.O. Box 94005
Baton Rouge, LA 70804-9005
Office of the Governor
State of Mississippi
Jackson, MS 39205
Attorney General
Assistant Attorney General
State of Mississippi
P.O. Box 22947
Jackson, MS 39225-2947
State Health Officer
State Board of Health
P.O. Box 139
Jackson, MS 39205
Director
Nuclear Safety & Licensing
Entergy Operations, Inc.
1340 Echelon Parkway
Jackson, MS 39213-8298
Director, Nuclear Safety Assurance
Entergy Operations, Inc.
P.O. Box 756
Port Gibson, MS 39150
Richard Penrod, Senior Environmental
Scientist, State Liaison Officer
Office of Environmental Services
Northwestern State University
Russsell Hall, Room 201
Natchitoches, LA 71497
Entergy Operations, Inc. -4-
Electronic distribution by RIV:
Regional Administrator (BSM1)
DRP Director (ATH)
DRS Director (DDC)
DRS Deputy Director (RJC1)
Senior Resident Inspector (GBM)
Branch Chief, DRP/C (MCH2)
Senior Project Engineer, DRP/C (WCW)
Team Leader, DRP/TSS (CJP)
RITS Coordinator (MSH3)
L. Trocine, OEDO RIV Coordinator (LXT)
ROPreports
GG Site Secretary (NAS2)
K. Fuller, RC/ACES (KSF)
C. Carpenter, D:OE (CAC)
G. Vasquez (GMV)
OE:EA File (RidsOeMailCenter)
SUNSI Review Completed: _WCW__ ADAMS: : Yes G No Initials: _WCW__
- Publicly Available G Non-Publicly Available G Sensitive : Non-Sensitive
R:\_REACTORS\GG\2007\GG2007-06RP-RWD.wpd
RIV:SRI:DRP/E RI:DRP/C SRI:DRP/C SRA:DRS C:DRP/C
RWDeese AJBarrett GBMiller RLBywater MCHay
T-WCWalker E-WCWalker MCHay for /RA/ /RA/
5/17/07 5/14/07 5/16/07 5/13/07 5/18/07
OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket: 50-416
Licenses: NPF-29
Report No.: 05000416/2007006
Licensee: Entergy Operations, Inc.
Facility: Grand Gulf Nuclear Station
Location: Waterloo Road
Port Gibson, Mississippi 39150
Dates: February 12 through March 14, 2007
Inspectors: A. Barrett, Resident Inspector, Grand Gulf Nuclear Station
R. Bywater, Senior Reactor Analyst
R. Deese, Senior Resident Inspector, Arkansas Nuclear One
G. Miller, Senior Resident Inspector, Grand Gulf Nuclear Station
Approved By: Michael C. Hay, Chief
Project Branch C
Division of Reactor Projects
-1- Enclosure
SUMMARY OF FINDINGS
IR 05000416/2007006; 02/12/07 - 03/14/07; Grand Gulf Nuclear Station; Special Inspection in
response to Division I Standby Diesel Generator high temperatures on January 30, 2007.
The report covered a 4-day period (February 12-15, 2007) of onsite inspection, with inoffice
review through March 14, 2007, by a special inspection team consisting of one senior resident
inspector, one resident inspector, and one senior reactor analyst. Four findings were identified.
The significance of most findings is indicated by its color (Green, White, Yellow, Red) using
Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the
significance determination process does not apply may be Green or be assigned a severity
level after NRCs management review. The NRC's program for overseeing the safe operation
of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight
Process, Revision 3, dated July 2000.
Summary of Event
The NRC conducted a special inspection to better understand the circumstances surrounding
high temperatures on the Division I standby diesel generator jacket water and lube oil systems
on January 30, 2007. In accordance with NRC Management Directive 8.3, NRC Incident
Investigation Program, it was determined that this event involved repetitive failures of
safety-related equipment having potential adverse generic implications and had sufficient risk
significance to warrant a special inspection.
A. NRC-Identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,
Criterion XVI, Corrective Action, involving the failure to identify and correct the
cause of elevated temperatures adversely affecting the safety function of the
Division I standby diesel generator that had previously occurred in 1999 and 2004.
Subsequently, on January 30, 2007, the Division I standby diesel generator again
experienced elevated temperatures during a surveillance run and was
subsequently declared inoperable. This issue was entered into the licensee's
corrective action program as Condition Report GGN-2007-0378.
The finding is greater than minor because it is associated with the mitigating
systems cornerstone attribute of equipment performance and affects the
cornerstone objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences. The
Phase 1 Worksheets in Manual Chapter 0609, Significance Determination
Process, were used to conclude that a Phase 2 analysis was required because
the condition represented a loss of safety function of a single train of a Technical
Specification system for greater than its allowed outage time. The inspectors
performed a Phase 2 analysis using Appendix A, Technical Basis For At Power
Significance Determination Process, of Manual Chapter 0609, Significance
Determination Process, and the Phase 2 Worksheet for Grand Gulf. The Phase 2
evaluation concluded that the finding was of very low safety significance. A
Phase 3 significance determination analysis also determined the finding was of
very low safety significance. The cause of the finding is related to the problem
-2- Enclosure
identification and resolution crosscutting area in that the licensee failed to
thoroughly evaluate the problem resulting in ineffective corrective actions being
implemented that failed to prevent recurrence of a significant condition adverse to
quality (Section 3.0).
- Green. The team identified a noncited violation of Technical Specification 5.4.1 (a)
involving the failure to maintain an adequate alarm response instruction for
standby diesel generator high jacket water temperature. Specifically,
Procedure 04-1-02-1H22-P400, Alarm Response Instruction, Panel
No.: 1H-22-P400, Safety Related, Revision 109, failed to provide adequate
guidance to manually override the standby diesel generator jacket water cooling
system temperature control valve during emergency conditions. This issue was
entered into the licensee's corrective action program as
Condition Report GG-2007-1837.
The finding is greater than minor because it is associated with the mitigating
systems cornerstone attribute of procedure quality and affects the cornerstone
objective to ensure the availability, reliability, and capability of systems that
respond to initiating events to prevent undesirable consequences. Using Manual
Chapter 0609, Significance Determination Process, Phase 1 Worksheet, the
finding is determined to have very low safety significance because it did not screen
as potentially risk significant due to a seismic, flooding, or severe weather initiating
events. The cause of the finding is related to the problem identification and
resolution crosscutting area in that the licensee did not take appropriate corrective
actions to adequately address a previously identified safety concern (Section 4.0).
- Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,
Criterion XVI, Corrective Action, involving the failure to promptly identify a
condition adverse to quality. Between February 2-15, 2007, the licensee failed to
promptly identify that corrective actions taken in response to a January 30, 2007,
failure of the Division 1 standby diesel generator jacket water cooling system
temperature control valve had not addressed the cause of the valve failure.
Specifically, following the valves failure, the licensee inappropriately concluded the
valves internal thermal elements were faulty, replaced the elements, performed
postmaintenance testing, and declared the valve and associated standby diesel
generator operable on February 1, 2007. Subsequent testing of the suspect faulty
thermal elements on February 2 and 13, 2007, found the components were
functional. Following receipt of the testing results, the licensee failed to promptly
identify that replacement of the thermal elements failed to address the cause of
the problem resulting in the failure to evaluate a potential degraded condition
affecting operability of the standby emergency diesel generator. This issue was
entered into the licensee's corrective action program as
Condition Report GGN-2007-2255.
The finding is greater than minor because it is associated with the mitigating
systems cornerstone attribute of equipment performance and affects the associate
cornerstone objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences. Using
Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheet,
the finding is determined to have very low safety significance because the
condition did not screen as potentially risk significant due to a seismic, flooding, or
-3- Enclosure
severe weather initiating events. The cause of the finding is related to the problem
identification and resolution crosscutting area in that the licensee did not identify
an issue completely, accurately, and in a timely manner commensurate with its
safety significance resulting in the failure to evaluate a potential degraded
condition for operability (Section 5.0).
- Green. The inspectors identified a Green noncited violation of 10 CFR Part 50
Appendix B, Criterion V, Instructions, Procedures, and Drawings, for a failure to
follow procedures which resulted in an inadequate operability evaluation.
Specifically, the evaluation did not include an analysis of conditions that could be
causing the valve to fail, and it provided no assessment of the effect these
conditions would have related to the specified safety function and mission time of
the standby diesel generator. The licensee entered this issue in their corrective
action program as Condition Report GGN-2007-2256.
This finding is more than minor because the failure to perform an adequate
operability evaluation, if left uncorrected, could become a more significant safety
concern. Using Manual Chapter 0609, Significance Determination Process,
Phase 1 Worksheet, this finding was of very low safety significance since it did not
result in a loss of operability. The cause of this finding has a crosscutting aspect
in the area of human performance associated with decision making because
licensee personnel failed to use conservative assumptions and did not verify the
validity of the underlying assumptions used in making safety-significant decisions
(Section 5.0).
B. Licensee-Identified Violations
None
-4- Enclosure
REPORT DETAILS
1.0 SPECIAL INSPECTION SCOPE
The NRC conducted a special inspection at Grand Gulf Nuclear Station (GGNS) to
better understand the circumstances surrounding the high temperatures observed in the
jacket water system of the Division I standby diesel generator (SDG). The diesel
generator was manually shutdown during a surveillance run on January 30, 2007, when
the jacket water high temperature alarm annunciated. A failed jacket water cooling
system on the SDG could have overheated the diesel, potentially impacting the ability of
the SDG to perform its safety function during a design basis accident. In accordance
with NRC Management Directive 8.3, it was determined that this event had sufficient risk
significance to warrant a special inspection.
The team used NRC Inspection Procedure 93812, Special Inspection Procedure, to
conduct the inspection. The special inspection team reviewed procedures, corrective
action documents, operator logs, design documentation, maintenance records, and
procurement records for the Division I SDG. The team interviewed various station
personnel regarding the event. The team reviewed the licencees preliminary root cause
analysis report, past failure records, extent of condition evaluation, immediate and long
term corrective actions, and industry operating experience. A list of specific documents
reviewed is provided in Attachment 1. The charter for the special inspection is included
as Attachment 2.
2.0 SYSTEM AND EVENT DESCRIPTION
2.1 System Description
GGNS uses three diesel generators to provide standby power to safety-related
equipment required to shutdown the reactor, maintain the reactor in a safe shutdown
condition, and mitigate the consequences of an accident. These diesel generators
supply electrical buses designated by division number: Division I, Division II, and
Division III. The Division I and II SDGs are Transamerica Delaval, Incorporated engines
rated at 5740 kw. The engines are DSRV-4 series (16-cylinder, 4-stroke, turbocharged,
and 45E V-type) and are designed to operate at 450 revolutions per minute.
The GGNS Transamerica Delaval, Incorporated engines use an independent cooling
water system called the jacket water system to provide cooling water to the diesel
engine, the governor oil cooler, the lube oil cooler, and the turbocharger aftercoolers.
The jacket water system is a closed loop system with an expansion tank that utilizes two
pumps, one engine driven and the other an electrical, alternating current motor-driven
pump. Both pumps have a rated flow of approximately 1800-2100 gallons per
minute (gpm). The jacket water system rejects heat to the standby service water
system through the jacket water heat exchanger.
An automatic three-way thermostatic control valve (TCV), manufactured by Amot
Controls, directs cooling water to the heat exchanger to maintain SDG temperature
between the operating range of 160EF to 175EF. During operation, approximately
200-300 gpm is bypassed by the TCV to the jacket water heat exchanger. Specifically,
thermal elements modulate the valve to maintain cooling water at design temperature.
-5- Enclosure
The GGNS TCV uses four thermal elements designed to maintain a nominal
temperature of 165EF. Each thermal element actuates independently to provide
approximately one-fourth of the valves full open stroke.
2.2 Event Summary
On January 30, 2007, GGNS discovered elevated temperatures in the jacket water
system of the Division I SDG during a monthly test run following a planned system
outage. The monthly surveillance required power to be loaded in increments of 1000 kw
up to a value greater than 5450 kw and less than 5740 kw. Approximately 5 minutes
after increasing the diesel power load to 4400 kw, the jacket water heat exchanger
outlet high temperature annunciator alarmed at 175EF. Per the procedural guidance,
the operator reduced load, shutting down the diesel in a few minutes with jacket water
temperature peaking at 180EF. This indicates that the temperature was increasing at a
rate of at least 1EF/min. The inspectors determined that GGNS met all Technical
Specification requirements during and following the event.
GGNS began preparing work orders to inspect the valve internals and replace the
thermal elements. During this time, operations completed the Technical Specification
required diesel start for the Division II SDG to verify operability. GGNS removed the
TCV internals, inspecting the thermal elements, the valve gaskets, and internal
assembly. The thermal elements and the gaskets were replaced with new parts and the
valve was reassembled. The resident inspector observed the Division I SDG retest and
verified that it passed the postmaintenance surveillance. The Division I SDG was
declared operable on February 1, 2007.
3.0 PERFORMANCE DEFICIENCIES RESULTING IN SDG FAILURE
a. Inspection Scope
On July 25, 1999, and September 22, 2004, the Division I SDG experienced high
temperatures in its jacket water and lube oil systems during performance of monthly
surveillance runs. The team reviewed the licensees corrective actions following each of
these failures to assess their effectiveness with respect to preventing the subsequent
failure that occurred on January 30, 2007.
b. Findings
Introduction. The team identified a Green noncited violation (NCV) of 10 CFR Part 50,
Appendix B, Criterion XVI, Corrective Action, for the failure to prevent recurrence of
elevated temperature events on the Division I SDG after similar events occurred in 1999
and 2004.
Description. The team noted that the licensee had documented four previous
occurrences of high temperature events on the Division I SDG since facility operation
began. The team found that documentation associated with two instances that occurred
in the late 1980's did not support meaningful analysis. The two other noted instances
occurring in 1999 and 2004 provided more insights, however, the team noted that these
evaluations were also deficient with respect to identifying the cause of failure.
-6- Enclosure
On July 27, 1999, the licensee was conducting a monthly surveillance run of the SDG,
when 80 minutes into the run, elevated jacket water and lube oil temperatures occurred
and their respective alarms were received. Operations personnel took action to secure
the SDG and temperatures in the jacket water and lube oil systems were noted to peak
at approximately 190EF. The licensee secured the SDG and declared it inoperable.
The condition was entered into the licensees corrective action program (CAP) as
Condition Report (CR) GGN-1999-0768.
This CR received a lower tier apparent cause evaluation. The actions taken for the
apparent cause evaluation were reviewed by the team and determined to be
inadequate. The apparent cause concluded that two faulty thermal elements may have
caused failure of the TCV. This conclusion was based on the fact that these two
thermal elements looked different than the other thermal elements in the Division I and
Division II SDGs. No other conclusive evidence was cited in the evaluation. The team
noted the licensee made this determination even though subsequent testing of the two
thermal elements found them functional. On the basis of this information, the team
concluded the licensee failed to determine the cause of the SDG high temperature
condition that subsequently resulted in their failure to implement effective corrective
actions to prevent recurrence.
On June 22, 2004, during a monthly surveillance run, the licensee experienced elevated
temperatures in the Division I SDG jacket water and lube oil systems along with their
respective annunciators. Again the licensee took action to secure the SDG and the
jacket water and lube oil temperatures peaked at approximately 190EF. The licensee
secured the SDG and declared it inoperable. The licensee entered this condition into
their CAP as CR GGN-2004-2575.
The licensee conducted a root cause analysis for this event. The licensee tested the
thermal elements and discovered that one was defective and had leaked some of its
paraffin material which rendered the thermal element incapable of actuating.
Additionally, the licensee discovered another thermal element failed to fully actuate
between the design specification of 0.42 to 0.48 inches. This thermal element stroked
0.40 inches. With this information, the licensee concluded that defective thermal
elements were the cause of the SDG high temperatures.
The team questioned the validity of the licensees conclusion that the thermal elements
were the cause. The team determined that since the TCV had two fully functional
thermal elements, in addition to an almost fully functioning third thermal element, that
the TCV would have been capable of opening approximately 75 percent of its full stroke
for the temperatures experienced during the 2004 event. The inspectors reached this
conclusion by adding the minimum full stroke specification for two thermal elements of
0.84 inches (0.42 inches for each thermal element) to the 0.40 inches from the partially
degraded thermal element and comparing this to the 1.625-inch full stroke for the TCV.
The team noted that the vendor manual for the TCV recommended setting up the valve
to allow full cooling flow with the valve halfway open (equivalent to approximately
0.8 inches of valve travel). The team also noted, that since initial setup of the valve, the
Division I SDG had been derated from its initial design full load capability of
7 megawatts to 5.6 megawatts and, therefore, would require even less cooling flow than
original design specifications. The inspectors concluded with these facts that the SDG
should have had adequate cooling flow with only two fully functional thermal elements.
-7- Enclosure
The team was informed by the SDG system engineer that jacket cooling water system
flow measurements were performed on the Division I SDG. These measurements were
performed at 5.6 megawatts of loading and showed that approximately 200-300 gpm of
flow were needed to be supplied to the jacket water heat exchanger of the total
1700-2100 gpm flow. The inspectors concluded from a review of the thermostatic valve
throttling characteristic curve that sufficient flow could be supplied with the valve opened
significantly less than half way.
When the inspectors combined this flow data with the ability of the remaining fully
capable thermal elements, they concluded that the thermal elements were not the cause
of the high temperature event. The inspectors concluded that the root cause was
incorrect and; therefore, did not allow the licensee to determine the cause of the SDG
high temperatures, and thereby did not allow the licensee to prevent recurrence.
Finally, on January 30, 2007, while performing a monthly surveillance run, the licensee
experienced elevated temperatures in the Division I SDG jacket water and lube oil
systems along respective alarms for the high temperatures. The inspectors concluded
from this that the licensee had not prevented recurrence of a condition which left
uncorrected could have led to the unavailability of the SDG, a key risk-significant,
safety-related mitigating component during a design basis event.
Analysis. The performance deficiency associated with this finding involved the licensee
not preventing recurrence of a significant condition adverse to quality. The finding is
greater than minor because it is associated with the mitigating systems cornerstone
attribute of equipment performance and affects the associated cornerstone objective to
ensure the availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. The Phase 1 Worksheets in Manual
Chapter 0609, Significance Determination Process, were used to conclude that a
Phase 2 analysis was required because the finding represented a loss of safety function
of a single train of a Technical Specification system for greater than its allowed outage
time. The inspectors performed a Phase 2 analysis using Appendix A, Technical Basis
For At Power Significance Determination Process, of Manual Chapter 0609,
Significance Determination Process, and the Phase 2 Worksheets for Grand Gulf.
The inspectors assumed that the duration of the Division I SDG unavailability was
28 days. Additionally, the inspectors assumed the Division II SDG was unaffected and
operators could not recover the Division I SDG during a postulated high temperature
event. Based on the results of the Phase 2 analysis, the finding was determined to have
very low safety significance (Green). The senior reactor analyst's review of the Phase 2
analysis determined that a more detailed Phase 3 analysis was needed to fully assess
the safety significance. Based on the results of the Phase 3 analysis, the finding was
determined to have very low safety significance (Green). The Phase 3 analysis is
included as Attachment 3 to this report. The cause of the finding is related to the
problem identification and resolution crosscutting area in that the licensee failed to
thoroughly evaluate the problem resulting in ineffective corrective actions being
implemented that failed to prevent recurrence of a significant condition adverse to
quality.
Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, states, in
part, that for significant conditions adverse to quality, measures shall assure that the
cause of the condition is determined and corrective action taken to preclude repetition.
Contrary to the above, after the occurrence of high temperature conditions on the
-8- Enclosure
Division I SDG on July 27, 1999, and June 22, 2004, the licensee failed to assure that
the cause of these significant conditions adverse to quality were determined and that
corrective actions were taken to preclude repetition. Specifically, the licensee failed to
prevent the occurrence of a similar high temperature event on January 30, 2007. This
failure resulted in the Division I SDG being inoperable between January 2-30, 2007.
The root cause involved the licensees inappropriate determination of the thermal
elements being the cause of the Division I SDG failures. The corrective actions to
restore compliance included replacing TCV FCV-501A on March 2, 2007. Because the
finding is of very low safety significance and has been entered into the licensees CAP
as CR GGN-2007-0378, this violation is being treated as an NCV consistent with
Section VI.A of the Enforcement Policy: NCV 05000416/2007006-01, Failure to
Prevent Recurrence of High Standby Diesel Generator Temperatures.
4.0 OPERATOR RECOVERY
a. Inspection Scope
The team assessed the licensees ability to recover the SDG from the high temperature
conditions had the conditions occurred during an event. In this effort, the inspectors
reviewed the revision of the alarm response instruction for high jacket water
temperatures on the SDG in effect on January 30, 2007, along with prior revisions to the
alarm response instruction. The inspectors also questioned operators shortly after
January 30, 2007, on how to perform the alarm response instruction. Finally, the
inspectors walked down the SDG rooms after January 30, 2007, to check for adequate
staging of necessary equipment to perform the steps of the alarm response instruction.
b. Findings
Introduction. The team identified a Green NCV of Grand Gulf Technical
Specification 5.4.1 (a) pertaining to an inadequate alarm response instruction for high
SDG jacket water temperature prior to the high temperature event on the Division I SDG
on January 30, 2007.
Description. On June 22, 2004, while running the Division I SDG during a monthly
surveillance run, the SDG experienced high jacket water and lube oil temperatures
along with a high jacket water temperature alarm. The licensee entered this condition
into their CAP as CR GGN-2004-2575.
The licensee took corrective action to attempt to address the cause of the SDG high
temperatures, and also took corrective action to improve the content of the alarm
response instruction for SDG high jacket water temperatures. Because this procedural
guidance was lacking during this 2004 high temperature event, operators did not have
clear guidance on how to respond to the event and the SDG was only secured when the
operations shift manager ordered the SDG shutdown. Revision 106 of the alarm
response instruction for high jacket water temperature was inadequate in that it did not
give guidance on how operators should respond to high jacket water temperatures
during emergency and nonemergency situations.
In response to the assigned corrective action, operations procedure writers made
changes to the alarm response instruction for SDG high jacket water temperature.
These changes included providing instructions on how to manually override the SDG
-9- Enclosure
jacket water TCV FCV-501. Revision 107 of the high jacket water outlet temperature
alarm response instruction added steps for removing the valve cap, adjusting the valve
position, and monitoring system temperatures upon receiving alarms for elevated
temperatures in the SDG jacket water system. The corrective action was closed when
the alarm response instruction was revised.
On January 30, 2007, while performing a monthly surveillance run of the Division I SDG,
the SDG experienced another high temperature jacket water event. Operators secured
the SDG in accordance with Revision 107, which gives them guidance to secure the
SDG on receipt of high temperatures in a nonemergency situation. After the event, the
resident inspectors questioned three operations personnel, including one senior reactor
operator, as to how they would have carried out the alarm response instruction in an
emergency situation. The operators were unfamiliar on how to perform the specific
subparts of the step which delineates manually overriding the TCV FCV-501. The
inspectors identified procedural inadequacies in the alarm response instruction. These
are listed below:
- No details on removing TCV cap
- Unclear information on the direction to turn the TCV
- No information was given regarding the number of turns that should be made.
- No specified parameter to monitor while manually operating the TCV
- The instructions did not identify how to remove the locknut on the TCV
Although not reflective of the quality of the alarm response instruction, the inspectors
also discovered that not all of the required tools were available to perform the manual
override operation. In noting the lack of detailed guidance in the procedure and the
unavailability of tools required by the procedure to perform these critical steps, the
inspectors concluded that the alarm response instruction for the SDG TCV was
inadequate.
Analysis. The performance deficiency associated with this finding involved the licensee
not maintaining an adequate procedure. The finding is greater than minor because it is
associated with the mitigating systems cornerstone attribute of procedure quality and
affects the associated cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to initiating events to prevent undesirable
consequences. Using Manual Chapter 0609, Significance Determination Process,
Phase 1 Worksheet, the finding is determined to have very low safety significance
because it did not screen as potentially risk significant due to a seismic, flooding, or
severe weather initiating events. The cause of the finding is related to the problem
identification and resolution crosscutting area in that the licensee did not take
appropriate corrective actions to adequately address a previously identified safety
concern.
Enforcement. Grand Gulf Technical Specification 5.4.1 (a) requires that written
procedures be established, implemented, and maintained covering the activities
specified in Appendix A, Typical Procedures for Pressurized Water Reactors and
Boiling Water Reactors, of Regulatory Guide 1.33, Quality Assurance Program
Requirements (Operation), dated February 1978. Regulatory Guide 1.33, Appendix A,
Section 5, Procedures for Abnormal, Offnormal, or Alarm Conditions, requires
procedures for safety-related annunciators to have written procedures which contain
immediate operation action and long-range actions. Contrary to this, prior to
-10- Enclosure
January 30, 2007, Procedure 04-1-02-1H22-P400, Alarm Response Instruction,
Panel 1H-22-P400, Safety Related, Revision 107, was not adequate. Specifically, the
procedure did not provide adequate guidance for immediate operation action and
long-range action for manually overriding the SDG TCV. The root cause involved not
ensuring all needed instructions were included in the procedure revision. The corrective
actions to restore compliance included properly revising the procedure and training
operators on manual operation of the valve. Because the finding is of very low safety
significance and has been entered into the licensees CAP as CR GGN-2007-1837, this
violation is being treated as an NCV consistent with Section VI.A of the Enforcement
Policy: NCV 05000416/2007006-02, Inadequate Alarm Response Instruction for SD
Generator High Jacket Water Temperature.
5.0 CORRECTIVE ACTIONS FOLLOWING SDG FAILURES
a. Inspection Scope
The team assessed the licensees immediate and long-term planned corrective actions
associated with the Division I SDG failure that occurred on January 30, 2007. The team
assessed the engineering and operations departments implementation of the operability
determination (OD) process immediately after the failure and then after identifying that
the maintenance they had conducted to the TCV may not have corrected the cause of
the failure. This assessment was performed through interviews, review of operator logs,
corrective action documents, ODs, work orders, and related documents.
b. Findings
(1) Failure To Identify Actions Taken After SDG Inoperability Were Inadequate
Introduction. The inspectors identified a Green NCV of 10 CFR Part 50, Appendix B,
Criterion XVI, Corrective Action, for the licensees failure to identify that their corrective
action after the January 2007 high temperature event on the Division I SDG were not
adequate.
Description. On January 30, 2007, the Division I SDG experienced the high temperature
event. Operators shut down the SDG and declared it inoperable in an effort to
troubleshoot the cause of the high temperatures. During their troubleshooting and
maintenance, the licensee cleaned and inspected the internals of TCV FCV-501, and
replaced the valves thermal elements and o-rings. After reviewing the conduct of this
maintenance, reviewing input from engineering personnel as to the operability of the
SDG, and conducting a satisfactory surveillance run, operations personnel declared the
SDG operable.
The licensee entered the high temperature event on the Division I SDG in their CAP as
CR GGN-2007-0378 and began a root cause determination to find the cause of the
failure. In this effort, the licensee tested the thermal elements from the TCV for the
SDG at GGNS on February 2, 2007. This testing did not identify any failures of the
thermal elements. At that point, the licensee did not recognize, as an organization, that
their implemented corrective actions failed to fix the failure mechanism. The resident
inspectors subsequently questioned the operability with the licensee at which time they
stated they were sending the thermal elements to the vendor for further testing and
-11- Enclosure
were waiting on those additional testing results. The inspectors considered that the
licensee missed an opportunity to identify that the SDG was not fully operable at this
time.
On February 9, 2007, the additional vendor testing identified no thermal element
failures. Engineering department personnel developed a white paper later that day and
distributed to selected site personnel. The white paper stated that binding of the valve
appeared to be the cause of the failure. Licensee personnel, including representatives
from the operations department, evaluated the white paper, but did not exercise their
processes to evaluate this condition in their CAP. As a result, the licensee did not
formally question the operability of the valve in an OD. The inspectors considered that
the licensee missed another opportunity to identify that the SDG was not fully operable
at this time.
The special inspection team was sanctioned by NRC Region IVs management and
arrived on site on February 12, 2007. As part of their charter, the inspection began to
question operability of the SDG since it appeared that the thermal elements were
definitely suspect as the cause of the SDG high temperature event. On February 14,
2007, the team questioned operability. Operations, engineering, and licensing
department personnel questioned by the inspectors stated there was no conclusive
information on the failure mechanism, and the decision was made to wait for completion
of the root cause investigation prior to considering the valve degraded. The inspectors
considered that the licensee missed yet another opportunity to identify that the SDG was
not fully operable at this time.
On February 15, 2007, the special inspection team debriefed plant management and
discussed their concern that the valve was potentially degraded and that the inspectors
questioned the licensees evaluation of the operability. Following this debrief, the
licensee entered the condition into their corrective action process as
CR GGN-2007-0660 and performed an operability evaluation, in which the licensee
declared the SDG degraded but operable based on engineering judgement. The
inspectors considered that the licensee had gone nearly 2 weeks with mounting
evidence that the thermal elements were not the cause of the SDG failure yet had not
taken action to enter this deficient condition into their CAP.
Analysis. The performance deficiency associated with this finding involved the
licensees failure to identify a significant condition adverse to quality. The finding is
greater than minor because it is associated with the mitigating systems cornerstone
attribute of equipment performance and affects the associated cornerstone objective to
ensure the availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. Using Manual Chapter 0609,
Significance Determination Process, Phase 1 Worksheet, the finding is determined to
have very low safety significance because the condition did not screen as potentially risk
significant due to a seismic, flooding, or severe weather initiating events. The cause of
the finding is related to the problem identification and resolution crosscutting area in that
the licensee did not identify an issue completely, accurately, and in a timely manner
commensurate with its safety significance resulting in the failure to evaluate a potential
degraded condition for operability.
Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires,
in part, that measures be established to assure that conditions adverse to quality, are
-12- Enclosure
promptly identified and corrected. Contrary to the above, between February 2-15, 2007,
the licensee did not promptly identify the fact that their corrective actions were not
addressing the cause of the Division I SDG high temperature event based on evidence
that the thermal elements of TCV FCV-501 were not the faulty subcomponent of the
valve. The root cause involved the licensees reliance on successful valve operation
after performing similar TCV maintenance. The corrective actions to restore compliance
included the licensee reassessing their OD of the SDG and replacing the TCV on
March 2, 2007. Because the finding is of very low safety significance and has been
entered into the licensees CAP as CR GGN-2007-2255, this violation is being treated
as an NCV consistent with Section VI.A of the Enforcement Policy:
NCV 05000416/200706-03, Failure to Promptly Identify a Degraded Condition.
(2) Failure To Follow Procedures Resulting In An Inadequate Operability Evaluation
Introduction. The inspectors identified a Green NCV of 10 CFR Part 50 Appendix B,
Criterion V, for a failure to follow procedures which resulted in an inadequate operability
evaluation.
Description. On February 15, 2007, the licensee initiated CR GGN-2007-0660 in
response to the high failure frequency of the jacket water TCV on the Division I SDG.
Control room operators performed an immediate OD and declared the SDG operable
based on engineering judgement. The operators completed a Reasonable Expectation
of Operability form in accordance with Procedure EN-OP-104, Operability
Determinations, Revision 2, and documented the basis of the OD as the maintenance
that had recently been performed on the valve and the short length of time until the next
scheduled maintenance window relative to the observed failure frequency. Operators
issued a corrective action to the engineering staff to provide a detailed technical
justification for the calculated failure frequency of the TCV or, alternatively, to provide a
detailed technical explanation for how the recently performed maintenance on the valve
would prevent future failures when previous maintenance activities had not.
The engineering staff completed the operability evaluation on February 16, 2007.
Control room operators immediately declared the SDG operable, stating the corrective
action response provided sound basis for the operability of the equipment. The
inspectors reviewed the operability evaluation and noted the technical justifications for
the valve failure frequency and the maintenance performed appeared to have been
copied nearly verbatim from the original Reasonable Expectation of Operability form.
The inspectors concluded the evaluation provided virtually no new information beyond
what had already been documented in the CR and was therefore an incomplete
response to the corrective action assignment.
The inspectors further noted the operability evaluation did not include an analysis of
what could have been causing the TCV to fail, and it provided no assessment of the
effect the degraded condition would have related to the specified safety function and
mission time of the SDG. The evaluation also failed to consider the risk of the
engineering judgement being wrong. The inspectors concluded the acceptance of
evaluation by operators was contrary to Procedure EN-LI-102, Corrective Action
Process, Revision 8, which required the assigners of corrective actions to ensure the
response was complete and adequate before closing the corrective action assignment.
-13- Enclosure
The inspectors expressed the above concerns to licensee management. On
February 28, 2007, the licensee declared the Division I SDG inoperable in lieu of
performing a complex evaluation of compensatory actions. The jacket water
temperature control valve was replaced on March 2, 2007.
Analysis. The failure to require an adequate corrective action response per station
procedures was a performance deficiency. This finding is more than minor because the
failure to perform an adequate operability evaluation, if left uncorrected, could become a
more significant safety concern. Using Manual Chapter 0609, Significance
Determination Process, Phase 1 Worksheet, this finding was of very low safety
significance since it did not result in a loss of operability. The cause of this finding has
a crosscutting aspect in the area of human performance associated with decision
making because licensee personnel failed to use conservative assumptions and did not
verify the validity of the underlying assumptions used in making safety-significant
decisions.
Enforcement. 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures and
Drawings, states, in part, that activities affecting quality shall be prescribed by
documented instructions and shall be accomplished in accordance with those
instructions. Contrary to the above, on February 16, 2007, licensee operators failed to
implement Section 5.8[4] of Procedure EN-LI-102, Corrective Action Process,
Revision 8, which required assigners of corrective actions to ensure required actions are
complete and corrective action responses are adequate. Because this violation was of
very low safety significance and was entered in the corrective action program as
CR GGN-2007-2256, this violation is being treated as a NCV consistent with
Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2007006-04, Failure to
Follow Procedures Resulting in an Inadequate Operability Evaluation.
4OA6 Meetings, Including Exit
On March 14, 2007, the initial results of this inspection were presented to Mr. R. Brian,
Vice President, Operations, and other members of his staff who acknowledged the
findings. Additionally on April 25, 2007, the final results of this inspection were
presented to Mr. J. Reed, General Manager, Plant Operations, and other members of
his staff who acknowledged the findings. The inspector asked the licensee whether any
of the material examined during the inspection should be considered proprietary. No
proprietary information was identified.
ATTACHMENT 1: SUPPLEMENTAL INFORMATION
ATTACHMENT 2: SPECIAL INSPECTION CHARTER
ATTACHMENT 3: SIGNIFICANCE DETERMINATION EVALUATION
-14- Enclosure
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
C. Abbott, Acting Quality Assurance Manager
D. Barfield, Director, Nuclear Safety Assurance
B. Blanche, Operations Shift Manager
C. Bottemiller, Manager, Plant Licensing
R. Brian, Vice President, Operations
F. Bryan, Project Manager
R. Collins, Operations Manager
J. Edwards, Minority Owner Representative, SMEPA
C. Ellsaesser, Manager, Planning, Scheduling, and Outages
P. Griffith, Senior Engineer
E. Harris, Manager, Corrective Actions and Assessments
M. Krupa, Director, Engineering
M. Larson, Senior Licensing Specialist
J. Reed, General Manager, Plant Operations
M. Rohrer, Manager, System Engineering
G. Smith, Senior Engineer
G. Swords, Root Cause Analysis Evaluator
F. Weaver, Assistant Operations Manager
D. Wiles, Director, Engineering
R. Wright, Engineering Supervisor
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened and Closed
05000416/2007006-01 NCV Failure to Prevent Recurrence of High Standby Diesel
Generator Temperatures (Section 3.0)05000416/2007006-02 NCV Inadequate Alarm Response Instruction for SDG High
Jacket Water Temperature (Section 4.0)05000416/2007006-03 NCV Failure to Promptly Identify a Degraded Condition
(Section 5.0)05000416/2007006-04 NCV Failure to Follow Procedures Resulting in an Inadequate
Operability Evaluation (Section 5.0)
A1-1 Attachment 1
LIST OF DOCUMENTS REVIEWED
Procedures
Number Title Revision
02-S-1-28 Diesel Generator Start Log 2
04-1-02-1H22-P400 Alarm Response Instruction, Panel No.: 1H-22-P400, 106
Safety Related
04-1-02-1H22-P400 Alarm Response Instruction, Panel No.: 1H-22-P400, 107
Safety Related
04-1-02-1H22-P400 Alarm Response Instruction, Panel No.: 1H-22-P400, 109
Safety Related
07-S-24-P75-F501-1 Jacket Water Thermostatic Valve Thermal Element 5
Replacement
06-OP-1P75-M-0001 Standby Diesel Generator 11 Function Test 128
06-OP-1P75-M-0002 Standby Diesel Generator 12 Functional Test 106
EN-LI-102 Corrective Action Process 108
EN-OP-104 Operability Determinations 2
CRs
CR-GGN-1993-0195 CR-GGN-2004-1949 CR-GGN-2005-2208
CR-GGN-1998-0446 CR-GGN-2004-2525 CR-GGN-2005-2331
CR-GGN-1998-0608 CR-GGN-2004-2575 CR-GGN-2005-2563
CR-GGN-1999-0768 CR-GGN-2004-2581 CR-GGN-2005-2785
CR-GGN-1999-0817 CR-GGN-2004-2620 CR-GGN-2005-2786
CR-GGN-1999-0966 CR-GGN-2004-2775 CR-GGN-2005-2850
CR-GGN-1999-1229 CR-GGN-2004-2854 CR-GGN-2005-2880
CR-GGN-2000-0133 CR-GGN-2004-3088 CR-GGN-2005-2991
CR-GGN-2000-0170 CR-GGN-2004-3324 CR-GGN-2005-3078
CR-GGN-2001-1705 CR-GGN-2004-3352 CR-GGN-2005-5272
CR-GGN-2002-0551 CR-GGN-2004-3353 CR-GGN-2005-5443
CR-GGN-2002-0557 CR-GGN-2004-3360 CR-GGN-2006-0776
CR-GGN-2002-0891 CR-GGN-2004-4116 CR-GGN-2006-0852
A1-2 Attachment 1
CR-GGN-2002-1224 CR-GGN-2004-4596 CR-GGN-2006-0952
CR-GGN-2002-1821 CR-GGN-2004-4610 CR-GGN-2006-1461
CR-GGN-2002-2041 CR-GGN-2004-4616 CR-GGN-2006-3101
CR-GGN-2003-1004 CR-GGN-2005-0160 CR-GGN-2006-4082
CR-GGN-2003-1074 CR-GGN-2005-0345 CR-GGN-2007-0378
CR-GGN-2003-1088 CR-GGN-2005-0554 CR-GGN-2007-0400
CR-GGN-2003-1164 CR-GGN-2005-1225 CR-GGN-2007-0417
CR-GGN-2003-1395 CR-GGN-2005-1554 CR-GGN-2007-0427
CR-GGN-2004-1586 CR-GGN-2005-1730
Industry Information/Operational Experience
Comanche Peak Steam Electric Station Smartform SMF-2000-002502-00
Licensee Event Report 86-033-00, Manually Shut Down During Surveillance Test Due to High
Lube Oil Temperature
Licensee Event Report 91-010-00, Technical Specification Required Shutdown Due to an
Inoperable Standby Diesel Generator
NRC Information Notice 91-85, Potential Failures of Thermostatic Control Valves for Diesel
Generator Jacket Water
NRC Information Notice 82-56, Robertshaw Thermostatic Flow Control Valves
Part 21 Report 1997-04-0, Seabrook Station, Supplement to Diesel Generator Special Report
Work Orders/Maintenance Work Orders
MWO 03536 Receipt inspection of Amot Type-D Serial Number A761
MWO 34475 Rework and replace power elements
MWO 50207 Division I temperature control valve adjustment
MWO 51507 Rebuild spare valve assembly
MWO 64290 Remove and rebuild valve internals
MWO 81841 Installation of new power elements
WO 46758 Replace thermal elements
WO 67751 Replace thermal elements
A1-3 Attachment 1
WO 81761 Replace thermal elements
WO 102717 Re-torque flange bolting
WO 207466 Low jacket water temperature troubleshooting
Drawings
Number Title Revision
M-1070A Standby Diesel Generator System 39
M-1070C Standby Diesel Generator System 18
M-1093B High Pressure Core Spray Diesel Generator System 24
C641 Amot Type 8D 4
Miscellaneous Information
AECM 88/0099, Letter from John G. Cesare, Jr., Director of Nuclear Licensing to USNRC,
dated May 4, 1988, Diesel Shutdown Due to High Lube Oil Temperature
Calculation E-DCP 82/5020-1, Transient Loading on Diesel Generators During Load
Sequencing
Engineering Report GGNS-01-0001, Study to Determine Feasibility of Extending Frequencies
of Division I and Division II Standby Diesel Generator Outage Related Maintenance
Inspections, Revision 0
Grand Gulf Nuclear Station IR-88-4-3
Grand Gulf Nuclear Station Inservice Testing Bases Document, Program Section
N0.CEP-IST-1, Revision 4
GTC 2004/00091, Additional testing of SDG thermal elements
Maintenance Personnel Interviews, February 9, 2007
Purchase Order 11517
Purchase Order 10067787
Standby Diesel Generator Start Logs (Divisions I and II)
Texas Utilities Certificate of Conformance for Order S02915836S2
Vendor Manual 460000452, Amot Model 8D Thermostatic Valve
A1-4 Attachment 1
LIST OF ACRONYMS
CAP corrective action program
CFR Code of Federal Regulations
CR condition report
GGNS Grand Gulf Nuclear Station
gpm gallons per minute
NCV noncited violation
NRC U.S. Nuclear Regulatory Commission
SDG standby diesel generator
TCV thermostatic control valve
A1-5 Attachment 1
February 8, 2007
MEMORANDUM TO: Richard W. Deese, Senior Resident Inspector, Arkansas Nuclear One
Project Branch E, Division of Reactor Projects
Andrew J. Barrett, Resident Inspector, Grand Gulf Nuclear Station
Project Branch C, Division of Reactor Projects
FROM: Arthur T. Howell III, Director, Division of Reactor Projects AVegel for /RA/
SUBJECT: SPECIAL INSPECTION CHARTER TO EVALUATE THE GRAND
GULF NUCLEAR STATION EMERGENCY DIESEL GENERATOR
FAILURE
A Special Inspection Team is being chartered in response to the Grand Gulf Nuclear Station
emergency diesel generator (EDG) failure. The diesel had to be manually tripped during
surveillance testing on January 30, 2007. You are hereby designated as the Special Inspection
Team members. Mr. Deese is designated as the team leader. The assigned SRA to support
the team is Russ Bywater.
A. Basis
On January 30, 2007, during performance of a monthly surveillance test, EDG 1 was
manually shut down by operators due to a jacket water high water temperature alarm
and indications of temperatures rising significantly faster than normal. The licensee
determined that the condition resulted from a faulty thermostatic temperature control
valve (TCV) that supplies cooling water to the EDG jacket water cooling system. The
licensee has preliminarily identified the cause of the failure to be the thermal elements
inside the TCV. The licensee has experienced previous TCV failures in 1999 and 2004.
These failures resulted in replacing the thermal elements. Based on the most recent
failure of the thermal elements on EDG 1 and previous licensee efforts to identify and
correct EDG thermal element problems, it is questionable whether the effectiveness of
the licensees corrective actions has been adequate.
Failure of these TCV thermal elements has also previously occurred at other nuclear
facilities, resulting in EDG failures due to overheating, resulting in crankcase explosions.
One such occurrence is documented in NRC Information Notice 91-85, Potential
Failures of Thermostatic Control Valves for Diesel Generator Jacket Cooling Water.
A2-1 Attachment 2
B. Scope
The team is expected to address the following:
a. Develop an understanding of the EDG degraded conditions and failures related
to TCV problems.
b. Assess licensee effectiveness in identifying previous EDG thermostatic valve
problems, evaluating the cause of these problems and implementation of
corrective actions to resolve identified problems.
c. Identify and assess additional actions planned by the licensee in response to
repetitive problems with the EDG 1 TCV, including the timeline for completion of
these actions.
d. Assess the licensees root cause evaluation, the extent of condition, and the
licensees common mode evaluation.
e. Evaluate pertinent industry operating experience and potential precursors to the
January 30 event, including the effectiveness of licensee actions taken in
response to the operating experience.
f. Determine if there are any potential generic issues related to the failure of the
EDG 1 thermostatic control valve. Promptly communicate any potential generic
issues to Region IV management.
g. Determine if the Technical Specifications were met when the diesel was
manually secured prior to tripping on high temperature.
h. Collect data as necessary to support a risk analysis.
C. Guidance
Inspection Procedure 93812, Special Inspection, provides additional guidance to be
used by the Special Inspection Team. Your duties will be as described in Inspection
Procedure 93812. The inspection should emphasize fact-finding in its review of the
circumstances surrounding the event. It is not the responsibility of the team to examine
the regulatory process. Safety concerns identified that are not directly related to the
event should be reported to the Region IV office for appropriate action.
The Team will report to the site, conduct an entrance, and begin inspection no later than
February 12, 2007. While on site, you will provide daily status briefings to Region IV
management, who will coordinate with the Office of Nuclear Reactor Regulation, to
ensure that all other parties are kept informed. A report documenting the results of the
inspection should be issued within 30 days of the completion of the inspection.
A2-2 Attachment 2
This Charter may be modified should the team develop significant new information that
warrants review. Should you have any questions concerning this Charter, contact me at
(817) 860-8144.
A2-3 Attachment 2
Attachment 3: Significance Determination Evaluation
Significance Determination Process (SDP)
Phase 1 Screening
The finding was more than minor because it affected the equipment performance
attribute of the mitigating system cornerstone due to the impact on availability and
reliability of the emergency diesel generator.
In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Determining the
Significance of Reactor Inspection Findings for At-Power Situations, dated March 23,
2007, the inspectors conducted a SDP Phase 1 screening and determined that the
finding resulted in loss of the safety function of Division 1 Standby Diesel
Generator (DG) for greater than the Technical Specification allowed outage time.
Consequently, a Phase 2 SDP risk significance estimation was required.
Phase 2 Risk Significance Estimation
Internal Events and Large Early Release Frequency (LERF)
In the Phase 2 SDP evaluation, the inspectors and a RIV senior reactor analyst (SRA)
performed a Phase 2 evaluation using the Risk-Informed Inspection Notebook for Grand
Gulf Nuclear Station, Revision 2.01, (SDP Phase 2 Notebook) and its associated
Phase 2 Pre-solved Table.
Assumptions:
- Exposure Time
The time between the last successful Division I DG surveillance test on
January 2, 2007, and the January 30, 2007, surveillance test during which the
Division I DG failed was 28 days. Based on review of the DG keep-warm system
design and its operation while the engine was in a standby condition, the
inspectors determined that the keep-warm system maintained coolant
temperature below the setpoint of the temperature control valve. This meant that
the temperature control valve would not have operated while the engine was in a
standby condition. Therefore, the inspectors concluded that the temperature
control valve (and the DG) could reasonably been known to have been
nonfunctional for a 28-day exposure period. Therefore, the inspectors used a
3-30 days exposure time in the Phase 2 Evaluation when determining the
appropriate Initiating Event Likelihood (IEL).
- Recovery Credit
The high-temperature trip of the DG is bypassed during emergency start of the
engine, as would be expected during a LOOP. The inspectors determined that
after an emergency start, operators would not be capable of diagnosing the
A3-1 Attachment 3
problem and locally operating the temperature control valve prior to failure of the
DG due to excessive temperature. Therefore, recovery was not credited.
Phase 2 SDP Evaluation Method:
The Division I DG was identified as a target in the Phase 2 pre-solved table. Per the
guidance in IMC 0609, Appendix A, the pre-solved table could be used directly to
assess the finding. The table identified that the finding was CDF-dominant.
Therefore, no additional review was required for LERF consideration. For a 3 - 30 day
exposure time, the pre-solved table identified that the significance of the finding was
Green with respect to CDF. The dominant sequence (with an equivalent risk
contribution of 7) involved a station blackout (LOOP with failure of the Division I, II,
and III DGs), failure of RCIC, and failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This
sequence is represented as: LOOP - EAC 1&2 -EDG3 - RCIC - REC1.
As described above, the finding was CDF-dominant. No LERF assessment was
required.
External Events
Neither the Grand Gulf SDP Phase 2 Notebook nor the pre-solved table includes
screening capability for external events or other initiating events. Because the risk
contribution of the finding due to internal events was green with significance greater
than 1E-7/year, additional evaluation was required to determine if external initiators
could be risk significant. Experience has shown using the Risk-Informed Inspection
Notebooks that accounting for external initiators could result in increasing the risk
significance of an inspection finding by as much as one order of magnitude. The SRA
determined that the most efficient method of accounting for external initiators was to
perform a Phase 3 analysis, while using the guidance provided in IMC 0609,
Appendix A, Attachment 3, User Guidance for Screening of External Events Risk
Contributions.
Phase 3 SDP Analysis
Internal Events
Assumptions:
- Exposure Time
Based on the available information from the inspectors and the licensee's root
cause assessment, and after review by other risk analysts from the Office of
Nuclear Reactor Regulation, the finding was assumed best represented by a
14-day (T/2) exposure time. This was because the analysts could not
A3-2 Attachment 3
conclusively determine from the information provided that the temperature
control valve was in a certain-to-fail condition following the January 2, 2007,
surveillance, or if the valve had some higher random failure probability.
Therefore, a 14-day exposure time was assumed.
- Recovery Credit
As in the Phase 2 Evaluation, no operator recovery credit was assumed.
- Common-Cause Failure Consideration
The temperature control valves for the Division I and Division II DGs were both
AMOT Model 8DOC 165-01 valves. The Division III DG temperature control
valve, although from the same manufacturer and of the same principle of
operation, was an AMOT Model 4BOC 170-01 valve, with different design and
function. Therefore, no common-cause failure mechanism was considered
applicable to the Division III DG. However, common-cause was assumed
applicable to the Division II DG. In other words, the failure of the Division I DG
could not be modeled as an independent failure. Consistent with the RASP
Handbook, a component failure should only be modeled as an independent
failure if the cause is well understood and there is no possibility that the same
circumstance exists in other components in the same common-cause component
group.
Phase 3 SDP Analysis Method:
Internal Events
For the Phase 3 SDP analysis, the SRA used the NRC's simplified plant analysis risk
(SPAR) model for Grand Gulf Nuclear Station, Revision 3.31, dated October 10, 2006,
to estimate the risk associated with the finding. Average test and maintenance was
assumed and a cutset truncation of 1.0E-12 was used. The finding was modeled by
setting the basic events for the Division I DG failure-to-start equal to TRUE and the
Division I DG failure-to-run equal to 1.0. These changes would invoke appropriate
changes to address consideration of common-cause failures as discussed above.
Another change involved setting a basic event in the SPAR model that was no longer
applicable to FALSE. This event, discovered during a cutset-level review of the results,
involved operator action to bypass RCIC isolation on high steam tunnel temperature.
The licensee provided a calculation that indicated that steam tunnel temperature would
not reach isolation setpoint temperature in time to be of concern and therefore, did not
need to be modeled for this analysis. The resulting internal event analysis was an
increase in the core damage frequency of 4.05E-7/yr for a 14-day exposure period. The
dominant sequence (contributing about 25 percent of the total increase in core damage
frequency) involved a LOOP, followed by failure of the Division I, II, and III DGs, and
failure to recover a DG or offsite power within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
A3-3 Attachment 3
Core damage sequences involving a potential contribution to LERF were considered.
The dominant core damage sequence that was a potential LERF contributor involved a
LOOP with DG failures, and failure to recover a DG or offsite power within 30 minutes
when RCIC had failed to start. The resulting increase in core damage frequency
associated with this sequence was less than 1E-7/yr. Therefore, in accordance with
IMC 0609, Appendix H, Containment Integrity Significance Determination Process, this
finding was not significant with respect to LERF.
External Events (Including Internal Flooding)
Seismic
Using information from IMC 0609, Appendix A, Attachment 3, and the licensee's IPEEE
(Individual Plant Examination of External Events) the SRA determined that the finding
may have been substantial enough to alter the Phase 2 result because the Division I DG
was on the licensee's seismic safe shutdown list, was used to mitigate the
consequences of a loss of offsite AC power during a seismic event, and the exposure
time was greater than 3 days. However, when the SRA evaluated the seismic
contribution using the Seismic Event Modeling and Seismic Risk Quantification
Handbook of the RASP External Events Handbook, the estimated delta CDF of a
seismically-induced LOOP with a random failure of the Division II DG for a 14-day
exposure period was in the mid E-9/year range. Therefore, the seismic risk contribution
of the finding is insignificant relative to the internal events result.
Flood
Using IMC 0609, Appendix A, Attachment 3, Table 3.1, Plant Specific Flood Scenarios
and Initiator Frequencies, the SRA determined that the Division I DG was not a
structure, system, or component identified as critical to avoiding core damage for any
flood scenario of significance. Therefore, flood risk contribution was screened out from
further consideration.
Fire
The Division I DG is in the protected train of the post-fire safe shutdown path.
Therefore, the finding was potentially significant with respect to its contribution from fire
events.
The licensee has a fire PRA which has the capability of assessing the risk impact of
nonfunctional equipment for fires in all fire areas with the exception of the control room.
For control room fires, the licensee can use its fire PRA to calculate conditional core
damage prababilities for the control room fire groups identified in the IPEEE. The
licensee provided this information to the SRA to assess the risk contribution due to fires
with the Division I DG out of service. The SRA considered this information provided by
A3-4 Attachment 3
the licensee to be the best available information in the context of IMC 0609 goals of
obtaining from the licensee readily available information to best inform the NRC staff's
preliminary significance determination in a timely manner.
The results of the fire analysis with the Division I DG nonfunctional for 14 days were as
follows:
control room fires: delta CDF = 1.34E-7/year
other fire areas: delta CDF = 5.75E-8/year
total fire contribution: delta CDF = 1.92E-7/year
Based on the above evaluation and guidance provided in IMC 0609, Appendix A,
Attachment A, the SRA concluded the total contribution to risk significance of this finding
due to external initiators was approximately 1.92E-7/year.
Total Estimated Change in Core Damage Frequency
The total risk contribution of the finding is expressed as the summation of the internal
events contribution and the external events contribution. This result is:
Internal Events: delta CDF = 4.05E-7/year
External Events: delta CDF = 1.92E-7/year
Total: delta CDF = 5.97E-7/year
In conclusion, the risk significance of this finding with respect to increase in core
damage frequency is of very low safety significance (Green).
Licensee's Risk Evaluation
The licensee evaluated the finding in two ways. The first case assumed the Division I
DG was not functional for 14 days. The second case evaluated a degraded condition
of the Division I DG rather than it being not functional resulting in an increased
unreliability (increased failure-to-start probability) for an extended period prior to the
January 30, 2007, test failure. Using this approach, the licensee evaluated past
surveillance testing data and estimated that the increase in the failure-to-start probability
for the Division I DG due to the performance deficiency was 2.94E-2. For this case, the
licensee used a 1-year exposure time, the maximum exposure time generally used in
SDP evaluations.
The licensee's results for these cases were as follows:
A3-5 Attachment 3
Case 1 (DG I not Case 2 (DG I increased FTS probability for 1
functional for 14 year)
days)
Internal Events 3.59E-7/year 2.6E-7/year
delta CDF
External Events 1.91E-7/year 1.7E-7/year
(Fire) delta CDF
Total delta CDF 5.5E-7/year 4.3E-7/year
In either case, the results were in agreement with the SRAs analysis and also
supported the conclusion that the finding was of very low safety significance (Green).
A3-6 Attachment 3