IR 05000298/2018011

From kanterella
(Redirected from ML18163A201)
Jump to navigation Jump to search
NRC Design Bases Assurance (Teams) Inspection Report 05000298/2018011
ML18163A201
Person / Time
Site: Cooper Entergy icon.png
Issue date: 06/13/2018
From: Thomas Farnholtz
Region 4 Engineering Branch 1
To: Dent J
Nebraska Public Power District (NPPD)
References
IR 2018011
Preceding documents:
Download: ML18163A201 (32)


Text

June 13, 2018

SUBJECT:

COOPER NUCLEAR STATION - NRC DESIGN BASES ASSURANCE (TEAMS)

INSPECTION REPORT 05000298/2018011

Dear Mr. Dent,

Jr.:

On April 19, 2018, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Cooper Nuclear Station. On April 30, 2018, the NRC inspectors discussed the results of this inspection with Mr. Dan Buman, Director of Nuclear Safety Assurance and other members of your staff. The results of this inspection are documented in the enclosed report.

NRC inspectors documented four findings of very low safety significance (Green) in this report.

These findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2 of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement; and the NRC resident inspectors at the Cooper Nuclear Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; and the NRC resident inspectors at the Cooper Nuclear Station.

J. Dent, Jr.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Thomas R. Farnholtz, Chief Engineering Branch 1 Division of Reactor Safety

Docket: 50-298 License: DPR-46

Enclosure:

Inspection Report 05000298/2018011 w/ Attachment:

Detailed Risk Analysis for NCV 2018011-02

Enclosure

U.S. NUCLEAR REGULATORY COMMISSION

Inspection Report

Docket Number:

05000298

License Number:

DPR-46

Report Number:

05000298/2018011

Enterprise Identifier: I-2018-011-0011

Licensee:

Nebraska Public Power District

Facility:

Cooper Nuclear Station

Location:

Brownville, Nebraska

Inspection Dates:

April 2, 2018, to April 30, 2018

Inspectors:

G. George, Senior Reactor Inspector, Region IV, Team Lead

W. Cullum, Reactor Inspector, Region IV

R. Deese, Senior Reactor Analyst, Region IV

S. Hedger, Emergency Preparedness Inspector, Region IV

M. Riley, Reactor Inspector, Region II

J. Leivo, Contractor, Beckman and Associates

M. Yeminy, Contractor, Beckman and Associates

Approved By:

T. Farnholtz, Chief

Engineering Branch 1

Division of Reactor Safety

SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a Design Bases Assurance (Teams) inspection at Cooper Nuclear Station in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors.

Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information. Findings and violations being considered in the NRCs assessment are summarized in the table below.

List of Findings and Violations

Failure to Correct Extent of Condition of Surge Suppression Varistor Failures Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-01 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, occurred when the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.

Failure to Ensure Adequate Design Control Measures are in Place Associated with RHR Service Water Booster Pump Room Cooling Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-02 Closed H.6 - Human Performance,

Design Margins 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to incorporate malfunctions of the residual heat removal (RHR) service water booster pump (SWBP) room cooling temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained.

Inadequate Design Basis Calculation for the EDG Rooms Temperature Distribution Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-03 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for the licensees failure to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers.

Incorrect Classification of Potential Safety-Related Components Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-04 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the inspectors identified three examples of the licensees failure to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs)in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html.

Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

REACTOR SAFETY

===71111.21MDesign Bases Assurance Inspection (Teams)

From April 2, 2018, to April 30, 2018, the inspectors reviewed the following design attributes associated with risk-significant components, permanent plant modifications, and operating experience.

Components===

(1) 4160V Switchgear 1F

a) Component maintenance history and corrective action program reports

b) Electrical distribution and system load flow/voltage drop calculations

c) Procedures for circuit breaker preventive maintenance, inspection, and testing

d) Equipment qualification specifications

e) Surveillance testing of the loss-of-offsite power instrumentation

(2) Emergency Diesel Generator 1B

a) Design requirements within purchase and manufacturing specifications

b) Surveillance and inservice tests of the air starting subsystem and check valves

c) Surveillance tests of the Fuel Oil subsystem including pumps and level switches

d) Surveillance tests and acceptance criteria of the diesel generator room ventilation system

e) Design calculations of the capacity of air starting system, fuel oil supply system, and room ventilation system

f) Component maintenance history and corrective action program reports g) Failure mode effects of non-safety related pressure relief dampers on diesel generator operation

h) Design piping, electrical, and instrumentation drawings

(3) Residual Heat Removal Pump A

a) Component maintenance history and corrective action program reports

b) Calculations for net positive suction head, maximum flow, and pump performance

c) Inservice test procedures and vendor recommendations for testing frequency

d) Pump curves

e) Heat exchanger thermal performance test procedures and data

(4) Reactor protection system relays for scram discharge volume high level, K1, and reactor vessel low level discharge volume high level, K6A and K6B:

a) Component maintenance history and a sample of corrective action documents

b) Calculations for instrument uncertainties and setpoints

c) Elementary, instrument loop, and instrument piping diagrams

d) Device ratings for the components and auxiliary devices

e) Surveillance procedures and results for calibration, functional tests, and response tests

f) Maintenance procedures and results of preventive maintenance, inspection, and post-maintenance tests

g) Visual inspection of environment and material condition of the relays

Component Large Early Release Frequency (LERF) (1 Sample)

(1) Residual Heat Removal Service Water Booster Pump A:

a) Calculations for room heating, ventilation, and cooling

b) Operating procedures for pump operation during a design bases loss-of-coolant accident coincident with a loss-of-offsite power

c) Pump temperature ratings and pump cooling requirements

d) Calibration and testing history of temperature switches used to indicate high room temperature e) Qualifications of emergency cooling unit and temperature switch associated with room cooling

Permanent Modifications (4 Samples)

(1) Change Evaluation Document 6024460, 4kV Breaker Auxiliary Switch Removal
(2) Change Evaluation Document 6028860, Alternate Decay Heat Removal Subsystem
(3) Change Evaluation Document 6039040, Relocation of Shutdown Cooling Isolation Function
(4) Change Evaluation Document 6039501, Reactor Protection System Test Box

Operating Experience (3 Samples)

(1) NRC Information Notice 2010-27, Ventilation System Preventive Maintenance and Design Issues
(2) NRC Bulletin BL-88-04, Potential Safety-Related Pump Loss
(3) NRC Information Notice 2016-01, Recent Issues Related to the Commercial Grade Dedication of Allen Bradley 700-RTC Relays

Evaluation of Inspection Sample Related Operator Procedures and Actions

(1) Control room operator actions resulting from a simulated break in the service water system header while operating RHR service water booster pump and RHR pumps in suppression pool cooling mode.

a) Control room crew were expected to enter procedures to address flooding in the control building basement.

b) From receipt time of first control building flooding level alarm, actions to secure the RHR service water booster pump and affected train service water pumps were to be completed within 10 and 30 minutes, respectively.

(2) Operations support center maintenance staff actions resulting from a design basis loss-of-coolant accident to install turbine stop valve shaft adjustment tools as part of aligning the licensees alternate leakage treatment pathway configuration.

a) Qualified staff were expected to implement the procedure attachment for installing the shaft adjustment tools.

b) Qualified staff were expected to use the designated tools for this task to install the tools within 30 minutes of entering the turbine building.

(3) Operations support center actions resulting from a design basis loss-of-coolant accident or loss-of-offsite power event to establish a natural circulation cooling for the RHR service water booster pump room.

a) Qualified staff were directed to develop natural circulation ventilation for the RHR service water booster pump room using procedure 2.3_R-1, Panel/Window: R-1/E-7, Section 1.3.2.

b) From the receipt of the associated RHR service water booster pump room high temperature alarm, qualified staff were directed by procedure to establish the ventilation flow path within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

INSPECTION RESULTS

Failure to Correct Extent of Condition of Surge Suppression Varistor Failures Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-01 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, occurred when the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.

Description:

The inspectors requested design documents supporting the basis for the application and ratings of the electrical surge suppression varistors shown in the 120 Vac reactor protection system (RPS) control circuits elementary diagram 454005876, Revision 22, for certain General Electric Type HFA relays. The licensee provided the following information. From the following information, the inspectors identified:

  • Reactor protection system elementary diagram 454005876, Revision 22, identified a device voltage rating of 175 Vdc. The inspectors identified that no reference to a design specification or a traceable model number was documented to provide critical specifications or qualifications, such as Joule (energy dissipation) ratings.
  • Minor design change MDC 74-31, Voltage Transient Suppression, performed in 1974, allowed the use of surge suppression metal oxide varistors at the discretion of engineering. The MDC 74-31 identified a Special Precaution to verify the General Electric metal oxide varistor is rated for the circuit in which it is applied. The inspectors determined there was no evidence of verification or acceptance criteria for the selection, test, or installation of the devices as stipulated in the Special Precaution and Acceptance Test Procedure of MDC 74-31.

The inspectors determined that no design specifications or analyses for selection or application were available for surge suppressor varistors, for certain General Electric Type HFA relays used in RPS. The devices were shown symbolically on the RPS diagrams, but the diagrams did not present or reference sufficient detail that would provide a link to the complete specifications or a model number for the device, as well as a design basis for its selection and application.

In addressing the inspectors concerns, the licensee provided Condition Report RCR 2002-1665, dated September 11, 2002. This condition report documented a NRC-identified, NCV 50-298/0015-02 and associated condition adverse to quality for the, failure to document and maintain a design standard for surge suppression varistors in the Division 2 emergency diesel [generator] control circuit. As documented in the NCV and Condition Report RCR 2002-1665, the use of incorrect values for these components caused the generator to frequently trip during the shutdown process and thereby be unavailable for immediate restart. The licensees apparent cause evaluation concluded that improperly sized and rated metal oxide varistors installed as surge suppressors resulted in a spurious overspeed trip. The immediate corrective action included the replacement of the varistor in the emergency diesel generator control circuit. However, the condition report identified an extent of condition existed beyond the diesel control circuit, as well as programmatic issues, including unresolved design control issues for surge suppressors.

To correct the extent of condition, the two corrective actions identified in Condition Report RCR 2002-1665 were:

  • Revise [Maintenance Procedure] 7.3.16, Low Voltage Relay Removal and Installation, to require Engineering to verify that installed varistors, when found, are appropriately sized and design information is correctly reflected in controlled drawings. The due date was March 1, 2003.
  • Revise the RPS, DG, and HPCI elementary diagrams to include appropriate design information of installed varistors. The due date was May 1, 2003.

Based on the documents provided during the inspection, the inspectors concluded that these corrective actions had never been effectively implemented. The requirement for engineering to verify the suitability of the ratings was not incorporated in the current revision of Maintenance Procedure 7.3.16 or in other revisions since the corrective action due date.

Additionally, the appropriate design information for surge suppressors was not completely reflected on drawings either directly or by reference. For example, the voltage rating was identified on the drawings, but additional critical characteristics such as Joule ratings or model numbers were not presented or referenced.

Corrective Actions: The licensee performed a historical search to identify surge suppression varistor applications in safety-related control circuits. The licensee then performed informal and bounding calculations based on first principles and component vendor data for the relays, and installed metal oxide varistors. The team concluded that the results of the informal calculations provided reasonable assurance that the surge suppression varistor ratings had ample margin and were suitable for their application and service.

Corrective Action References: Condition Reports CR-CNS-2018-02331 and CR-CNS-2018-02374

Performance Assessment:

Performance Deficiency: The inspectors determined that the failure to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665 to verify that installed surge suppressor varistors were appropriately sized and that design information was correctly reflected in controlled drawings was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to establish, implement, and maintain a design standard for surge suppression varistors used in safety-related control circuits could result in unsuitable selection and application of the device, such that failure of the device could result in shorting of a normally energized relay coil changing the systems to an undesirable state.

Significance: Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, dated June 19, 2012, the inspectors determined that this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a structure, system, or component and operability was maintained.

Cross-cutting Aspect: The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement:

Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.

Contrary to the above, from September 11, 2002, to April 19, 2018, the licensee failed to establish measures to assure that conditions adverse to quality were promptly corrected.

Specifically, the licensee failed to correct conditions adverse to quality associated with the corrective actions identified in Condition Report RCR 2002-1665, to verify that installed surge suppressor varistors were appropriately sized, and that design information was correctly reflected in controlled drawings for the reactor protection system, diesel generator control circuits, and high pressure coolant injection control circuits.

Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Failure to Ensure Adequate Design Control Measures are in Place Associated with RHR Service Water Booster Pump Room Cooling Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-02 Closed H.6 - Human Performance, Design Margins 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to incorporate malfunctions of the RHR service water booster pump room cooling temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained.

Description:

During a design basis loss-of-cooling accident, the licensee operates the RHR service water booster pump system to provide cooling to the RHR system without an uncontrolled release of radioactive material to the environment. The systems design bases, as stated in Cooper Nuclear Station Updated Safety Analysis Report (USAR) Chapter X, Section 8.2.2, includes the following:

  • No single system component active failure shall be able to prevent the system from achieving its safety objective.
  • The system shall provide an adequate supply of cooling water to the RHR system under all accident and transient conditions.

Standard IEEE 279-1971 provides expectations on what constitutes the plants design basis and defines the single failure criterion. As part of the design basis minimum elements, Section 3(8) states that the following shall be documented:

[T]he malfunctions, accidents, or other unusual eventswhich could physically damage protection system components or could cause environmental changes leading to functional degradation of system performance, and for which provisions must be incorporated to retain necessary protection system action.

Section 4.2 states:

Any single failure within the protection system shall not prevent proper protection system action when required.

Notes further state:

Single failure includes such events as the shorting or open-circuiting of interconnecting signal or power cables. It also includes single credible malfunctions or events that cause a number of consequential component, module, or channel failures.

During a design basis accident, the RHR service water booster pump system room is cooled by the RHR service water booster pump room fan coil unit or by manual operator actions.

The cooling methods, described in USAR Chapter X, Section 10.3.5.4, include the following:

  • The fan coil unit is normally cooled by a recirculation loop to a cooling tower.
  • If the recirculation loop is not available, the cooling coils can be manually aligned with service water.
  • Acceptable room temperatures can be maintained for a single RHR service water booster pump without forced ventilation through operator action to reduce the room heat load and establishment of a natural ventilation flow path.

The cooling tower described in the USAR has not been functional since the late 1980s. On July 29, 2016, the fan coil unit was tagged out of service, to facilitate removal of the cooling tower, and was still out of service at completion of this inspection. Therefore, the only active means of cooling the RHR service water booster pump room, in all accident and transient conditions, was to take the operator action establishing a natural ventilation flow path.

To implement room cooling under all accident and transient conditions, control room operators initiate actions based on annunciator RHR SWBP ROOM HIGH/TEMP (Panel/Window R-1/E-7). This annunciator operates based on a room temperature of 1200F, as indicated by temperature switch HV-TS-1109. The inspectors questioned whether the events that could cause damage to the temperature switch had been documented and what provisions had been incorporated to retain its ability to provide for protective action. Further, the inspectors questioned whether the postulated failure of the temperature switch would constitute a single active failure and whether it is seismically qualified to function during a design basis earthquake.

Section 9.3.4 of the licensees original safety evaluation report, (dated February 14, 1973),states that the RHR service water booster pump system is designed as Seismic Class I, and that RHR Service Water Booster Pump Systems can supply essential cooling water even after failure of all Class II (seismic) systems with which it interfaces and a concurrent failure of an active component in the Class I (seismic) system. No information was provided by the licensee to indicate that the temperature switch had been analyzed during accident conditions, with provisions to retain its ability to provide protective action in those cases.

Further, no indication was provided that the temperature switch was seismically qualified to function after a design basis earthquake. Failure of the switch would result in an active failure that would cause the annunciator to not operate. This would result in not ensuring timely operator action to set up cooling for the RHR service water booster pumps. This set of consequential failures would result in degradation of the RHR service water booster pump system to provide adequate cooling water under all accident and transient conditions.

Corrective Actions: In response to this issue, the licensee revised alarm response, system operating, and emergency operating procedures to establish natural ventilation in the RHR service water booster pump system room on the onset of the loss of normal plant ventilation during accident conditions without relying on the temperature switch.

Corrective Action References: Condition Reports CR-CNS-2018-02034 and CR-CNS-2018-02069

Performance Assessment:

Performance Deficiency: The inspectors determined that the licensees failure to incorporate malfunctions of the RHR service water booster pump room cooling temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained, in accordance with IEEE 279-1971 Section 3, Design Basis, was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to incorporate malfunctions of the temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis would degrade the capability of the RHRSWB system to meet its design function during design basis accidents.

Significance: The inspectors used Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, dated October 7, 2016; and the corresponding Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated June 19, 2012. The inspectors determined the finding represented a potential loss of function; therefore, the NRC senior reactor analyst completed a detailed risk evaluation. The results of the detailed risk evaluation yielded an estimate of the increase in core damage frequency 1.7E-8/year.

Because the increase in core damage frequency was less than 1.0E-7/year, the increase in core damage frequency from external events and the increase in large early release frequency were not analyzed. Based on this evaluation, the performance deficiency screened as having very low safety significance (Green).

Cross-cutting Aspect: The finding had a cross-cutting aspect in the area of human performance associated with Design Margins. Margins are carefully guarded and changed only through a systematic and rigorous process. When the room cooler was tagged out in 2016, the room cooling capability was not evaluated adequately to ensure that design margin was maintained [H.6].

Enforcement:

Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control requires, in part, that measure shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions.

Contrary to the above, from July 29, 2016 to present, the licensee failed to assure applicable regulatory requirements and the design basis were correctly translated into the specifications design of the RHR service water booster pump cooling. Specifically, the licensee failed to incorporate malfunctions of the RHR service water booster pump room temperature switch, which could cause environmental changes leading to functional degradation of system performance, into the design basis to verify the necessary protection system action be retained.

Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Inadequate Design Basis Calculation for the EDG Rooms Temperature Distribution Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-03 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for the licensees failure to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers.

Description:

Design basis calculation NEDC 91-103, DG Room Cooling Without Cooling Coil, Revision 2, evaluated the capacity of the ventilation system to sufficiently cool the emergency diesel generator room. The calculation was performed in order to approve a design change DC 91-23 that disconnected the flow of service water to cooling coils in the ventilation duct.

The calculation determined the required air flow rates and resulting room temperatures of the ventilation system at outside air temperatures of 97°F and 104°F. The calculation was based on an extrapolation of data from the 1988 performance of a Special Test Procedure, which measured temperatures at different locations in the room while the emergency diesel generators were running. The calculation extrapolated the temperatures, assuming maximum outdoor temperatures. The result of the calculation determined that with 97°F inlet air, the temperature of the area around the emergency diesel generators most limiting component was 120.56°F while the temperature of the air exiting the room will be 134°F, at minimum required air flow. According to the calculation, the limiting component, the alternating current generator, had a limiting temperature of 120.60°F, leaving a design margin of 0.04°F.

The Special Test Procedure documented temperature measurements of nine specified locations, where the ninth point was the temperature of the air exiting the room. All eight points measured at different locations around the emergency diesel generator room were substantially lower than the temperature of the air exiting the room, which represents the bulk temperature of the room. Based on the magnitude of temperature differences, the inspectors found the results of the 1988 special test questionable, and as a result, witnessed the surveillance test of the emergency diesel generator at full load on April 16, 2018.

During this April 16 surveillance test, the inspectors and the licensee measured temperatures in areas previously measured by the 1988 special test and the temperature of the air exiting the room. The resulting temperature of the air exiting the room was generally lower than temperatures measured in the vicinity of the emergency diesel generator for the normal ventilation conditions present during the test. Based on these results, the inspectors and the licensee agreed that the existing heat distribution model for the calculation was not accurate.

The licensees preliminary Gothic model reanalysis and the inspectors hand calculation determined room exit temperature should be 128°F, not 134°F.

Additionally, the calculation failed to consider the potential effects on the ventilation system of the non-safety related CO2 dampers in the open position. When the ventilation system starts, the supply fan starts, pressurizing the room, and opening the CO2 dampers installed on each side of the ventilation discharge duct. After a few seconds lag, the discharge fan starts, pressurizing the air inside the discharge duct and closing the CO2 dampers. If the dampers are in the open position, a significant portion of the hot air would be diverted into the room rather than being discharge outdoors. Therefore, increasing the room temperatures.

Since 2004, the licensee recorded at least 11 failures of the CO2 dampers to close or found in the open position. These non-safety related dampers did not undergo scheduled preventive maintenance. Furthermore, the emergency diesel generator surveillance test procedure does not have a step to validate that the CO2 dampers remain closed during the test. The preliminary Gothic model prepared by the licensee determined that if these CO2 dampers are stuck open, the bulk temperature of the room will be increased by 15 degrees F. This would result in bulk room temperature increasing from 128°F to 143°F.

Based on the increased room temperature, the inspectors requested the licensee complete a review of the emergency diesel generator control components to identify which components maximum allowable temperatures would be exceeded. The licensee identified that the temperature challenged the design margin of two ventilation control relays for each emergency diesel generator ventilation system. Based on the conservative design margin of the components maximum allowable temperatures, the components would remain functional.

Corrective Actions: In response to this issue, the licensee completed a preliminary reanalysis to determine that there was no immediate safety concern. The licensees long term corrective actions will be to correct room temperature model including potential failures of CO2 dampers.

Corrective Action References: Condition Report CR-CNS-2018-02308

Performance Assessment:

Performance Deficiency: The inspectors determined that the licensees failure to verify the adequacy of the emergency diesel generator room ventilation by use of alternate or simplified calculation methods, or by a suitable testing program, was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the licensees failure to correctly model the room temperature profile and potential failures of non-safety related CO2 dampers had the potential to lead to exceedance of safety-related components maximum allowable temperatures.

Significance: Using Inspection Manual Chapter 0609, Appendix A, Exhibit 2, dated June 19, 2012, the inspectors determined that this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a structure, system, or component, and operability was maintained.

Cross-cutting Aspect: The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement:

Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.

Contrary to the above, prior to April 19, 2018, the licensee failed to ensure design control measures provide for verifying or checking the adequacy of design of the emergency diesel generator room ventilation system by use of alternate or simplified calculation methods, or by a suitable testing program. Specifically, the licensee incorrectly extrapolated the results of the test program, which led to an incorrect room temperature profile. Additionally, the design calculation did not assume potential failures of the CO2 dampers.

Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.

Incorrect Classification of Potential Safety-Related Components Cornerstone Significance Cross-cutting Aspect Report Section Mitigating Systems

Green NCV 05000298/2018011-04 Closed None 71111.21M-Design Bases Assurance Inspection An NRC-identified, Green, Non-cited Violation of Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control, occurred for failure to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the inspectors identified three examples of the licensees failure to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems.

Description:

The safety-related (or Essential) classification of structures, systems, and components are governed by the following:

  • Cooper Nuclear Station Updated Safety Analysis Report (USAR) Appendix G, Section 2.4.2, Methodology to Identify Safety-Related Structures, Systems, Components, and Parts
  • Cooper Nuclear Station Procedure 3-EN-DC-167, Classification of Structures, Systems, and Components, Revision 4C2

The inspectors identified three examples where the licensee failed follow the methodology listed in Appendix G or Procedure 3-EN-DC-167. The examples are:

Example 1: The licensee failed to classify emergency diesel generator room CO2 pressure relief dampers as safety-related. The safety-related emergency diesel generator ventilation is equipped with safety-related ducts with CO2 pressure relief dampers installed in the duct.

These CO2 pressure relief dampers were not designed, manufactured, delivered, installed, or maintained as safety-related components. Failure of a CO2 damper to close causes some of the discharge air to recirculate back into the room. The combined surface area of the CO2 dampers located on both sides of the discharge duct is equal to the surface area of the safety-related discharge damper located downstream. Failure of the dampers to close will result in safety-related electrical components exceeding maximum allowable room temperatures. Since 2004, the licensee recorded at least 11 failures of the CO2 dampers to close or found in the open position. These non-safety related dampers did not undergo scheduled preventive maintenance. Furthermore, the emergency diesel generator surveillance test procedure does not have a step to validate that the CO2 dampers remain closed during the test. The inspectors determined that the CO2 pressure relief dampers should be classified safety-related in accordance with USAR Appendix G, Section 2.4.2, paragraph

(e) and Procedure 3-EN-DC-167, Section 5.2. Paragraph
(e) requires components in non-safety related systems that are required to provide safety-related functions due to interface requirements shall be determined and classified safety-related.

Procedure 3-EN-DC-167 Section 5.2 [2], Equipment Classification Criteria, requires Essential (safety-related) classification of equipment if the equipment is not required to function but can fail in a manner that would prevent the system from performing it safety-related function.

Example 2: The licensee failed to classify the RHR service water booster pump room emergency fan coil unit as safety-related. During a design basis accident, the RHR service water booster pumps and motors are cooled by the RHR service water booster pump room emergency fan coil unit or by manual operator actions. This fan coil unit and its associated temperature controller, HV-TC-1109, which starts the cooling unit automatically on high temperature, were not installed and maintained as safety-related components. Failure of the fan cooling unit to cool the RHR service water booster pump room will result in the loss of function of at least one train of RHR function without operator actions to recover. The inspectors determined that the RHR service water booster pump room emergency fan coil unit should be classified safety-related in accordance with USAR Appendix G, Section 2.4.2, paragraph

(e) and Procedure 3-EN-DC-167, Section 5.2. Paragraph
(e) requires components in non-safety related systems that are required to provide safety-related functions due to interface requirements shall be determined and classified safety-related.

Procedure 3-EN-DC-167 Section 5.2 [2], Equipment Classification Criteria, requires Essential (safety-related) classification of equipment if the equipment is not required to function but can fail in a manner that would prevent the system from performing it safety-related function.

Example 3: The licensee failed to classify the RHR service water booster pump room temperature switch HV-TS-1109 as safety-related. During a design basis accident, the RHR service water booster pumps and motors are cooled by the RHR service water booster pump room emergency fan coil unit or by manual operator actions. If the fan coil unit was not available, the USAR credits manual action to provide natural circulation cooling by opening hatches and doors for the room. This natural convection cooling would ensure the safety function of one RHR service water booster pump. The initiation of the manual action occurs on receiving a control room alarm for high room temperature, as indicated by HV-TS-1109.

Failure of the switch to function after a design basis loss-of-cooling accident would delay manual actions to initiate natural convection cooling in an appropriate time that ensures the safety function of one RHR service water booster pump. The inspectors determined that the RHR service water booster pump room temperature switch HV-TS-1109 should be classified safety-related in accordance with USAR Appendix G, Section 2.4.2, paragraph

(e) and Procedure 3-EN-DC-167, Section 5.2. Paragraph
(e) requires components in non-safety related systems that are required to provide safety-related functions due to interface requirements shall be determined and classified safety-related. Procedure 3-EN-DC-167 Section 5.2 [2], Equipment Classification Criteria, requires Essential (safety-related)classification of equipment if the equipment is not required to function but can fail in a manner that would prevent the system from performing it safety-related function.

Corrective Actions: In response to Example 1, the licensee completed a preliminary reanalysis to determine that there was no immediate safety concern. The licensees long term corrective actions will be to correct the room temperature model including potential failures of CO2 dampers. In response to Example 2, the licensee had implemented compensatory measures in place while emergency fan coil unit was out of service; therefore, there was no immediate safety concern. In response to Example 3, the licensee revised alarm response, system operating, and emergency operating procedures to establish natural ventilation in the RHR service water booster pump system room on the onset of the loss of normal plant ventilation during accident conditions without relying on the temperature switch.

Corrective Action References: Condition Reports CR-CNS-2018-02034, CR-CNS-2018-02069, and CR-CNS-2018-02075

Performance Assessment:

Performance Deficiency: The inspectors determined that the failure to classify emergency diesel generator ventilation system and RHR service water booster pump room cooling system components as safety-related (Essential), in accordance with USAR Appendix G, Section 2.4.2, Methodology to Identify Safety-Related Structures, Systems, Components, and Parts and Cooper Nuclear Station Procedure 3-EN-DC-167, Classification of Structures, Systems, and Components, Revision 4C2, was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to classify components as safety-related (Essential) led to configuration control, maintenance, and problem identification practices which degraded the capability of the emergency diesel generator ventilation system and RHR service water booster pumps to perform their design function.

Significance: Using Inspection Manual Chapter 0609, Appendix A, dated June 19, 2012, the team determined that this finding was of very low safety significance (Green) because it was a deficiency affecting the design or qualification of a structures, systems, or components, and operability was maintained.

Cross-cutting Aspect: The inspectors determined that this finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement:

Violation: Title 10, Code of Federal Regulations Part 50, Appendix B, Criterion III, Design Control requires, in part, that measure shall be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions.

Contrary to the above, prior to April 19, 2018, the licensee failed to correctly translate the applicable regulatory requirements and design basis to which this appendix applies are correctly translated into specifications, drawings, procedures and instructions. Specifically, the licensee failed to properly classify potential safety-related components in the emergency diesel generator ventilation system and RHR service water booster pump room cooling systems.

Disposition: This violation is being treated as a NCV, consistent with Section 2.3.2 of the Enforcement Policy.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

On April 19, 2018, the team presented the preliminary results of the Inspection Procedure 71111.21M inspection to Mr. J. Dent, Jr., Site Vice President and Chief Nuclear Officer, and other members of the licensee staff.

On April 30, 2018, the team presented the results of the Inspection Procedure 71111.21M inspection to Mr. D. Buman, Director, Nuclear Safety Assurance and other members of the licensee staff.

DOCUMENTS REVIEWED

IP 71111.21M - Design Bases Assurance Inspection (Teams)

Condition Reports (CR-CNS-)

1994-00762

2002-01665

2012-09956

2012-10656

2013-02959

2013-05725

2013-06870

2015-00604

2015-02085

2015-02090

2015-02106

2015-02366

2015-02373

2015-02393

2015-02883

2015-02947

2016-00820

2016-06248

2016-06251

2016-06680

2016-06989

2016-08010

2017-05040

2017-07520

Inspection Generated Condition Reports (CR-CNS-)

2018-01975

2018-01979

2018-01989

2018-02003

2018-02004

2018-02033

2018-02034

2018-02034

2018-02035

2018-02056

2018-02063

2018-02064

2018-02069

2018-02069

2018-02074

2018-02075

2018-02076

2018-02097

2018-02163

2018-02293

2018-02308

2018-02314

2018-02315

2018-02316

Work Orders

281699

4551512

4733240

4850159

4908185

4908614

4943761

4944185

4946822

4948722

5030026

5031812

5039857

5056976

5059028

5059032

5059855

5060013

5062381

5072414

5075220

5085176

5089053

5097666

5102533

5113147

5118603

5119820

21779

22463

23397

23676

25110

5167111

Procedures

Number

Title

Revision

Or Date

15.MS.201

MSIV Leakage Pathway Valve Testing

2, 3, 4

2.0.3

Conduct of Operations

2.1.11.1

Turbine Building Data

154

2.1.22

Recovering from a Group I Isolation

2.2.59

Plant Air System

2.2.69.3

RHR Suppression Pool Cooling and Containment Spray

2.2.70

RHR Service Water Booster Pump System

76, 85

2.2.70

RHR Service Water Booster Pump System

2, 85

2.2.73

Standby Gas Treatment System

2.3_RHR-

GLND-1

RHR Gland Water Supply - Annunciator Panel 1A

3.1

Engineering Procedure

Procedures

Number

Title

Revision

Or Date

3-EN-DC-115

Engineering Change Process

15C11

3-EN-DC-147

Engineering Reports

5C1

3-EN-DC-167

Classification of Structures Systems and Components

4C2

3-EN-DC-306

Acceptance of Commercial-Grade Items/Services in Safety-

Related Applications

5C1

5.1BREAK

Pipe Break Outside Secondary Containment

5.2FUEL

Fuel Failure

5.3EMPWR

Emergency Power During Modes 1, 2, or 3

66, 67

5.4FIRE-SD

Procedure -Fire Induced Shutdown From Outside Control

Room

6.1RPS.307

Surveillance Procedure: Low-High Water Level Channel

Calibration (Div 1) [WOs 4850159, 4944185, 5030026]

6.1RPS.310

Surveillance Procedure: South SDV High Water Level Switches

and Transmitters Examination and Channel Calibration (Div 1)

[WOs 4908614, 4946822, 5031812]

6.1RPS.311

Surveillance Procedure: RPS Instrument Channel Response

Time (Run Mode)(Div 1) [WOs 4908185, 4943761, 5072414]

6.1RPS.312

Surveillance Procedure: RPS Instrument Channel Response

Time (Shutdown)(Div 1) [WO 4281699]

6.1RPS.707

Surveillance Procedure: Reactor Vessel Low-High Water Level

Channel Functional Test (Div 1)[WOs, 5085176, 5097666,

5113147]

6.1RPS.710

Surveillance Procedure: South SDV High Water Level Switches

and Transmitters Channel Functional Test (Div 1) [WOs

5089053, 5102533, 5118603]

6.2 DG.105

Diesel Generator Starting Air Compressor Operability (IST) (Div

2)

6.2 DG.401

Diesel Generator Fuel Oil Transfer Pump IST Flow Test (Div 2)

6.2 DG.402

IST Closure Testing of DGSA Receiver Inlet Check Valves (Div

2)

6.2HV.602

Air Flow Test of Fan Coil Unit HV-DG-1D (Div 2)

7.1.8

Rigging and Lifting Program

7.13.17.1

4160 Breaker Examination

7.13.17.3

Replacing 4160V Breakers

7.3.16

Low Voltage Relay Removal and Installation

7.3.16

Low Voltage Relay Removal and Installation

800000023083 Maintenance Plan, Visual Inspection of Relays [WO 4948722]

06/08/15

Procedures

Number

Title

Revision

Or Date

Alarm

Procedure

2.3_B-3

Panel B - Annunciator B-3

Alarm

Procedure

2.3_R-1

Panel R - Annunciator R-1

16, 18

EOP 5.8,

Secondary Containment Control, Radioactivity Release Control

(5A)

EOP 5.8,

Primary Containment Control (3A)

EOP 5.8.10

Average Drywell Temperature Calculation

Drawings

(Number)

Title

Revision or

Date

2011 sheet 1

Flow Diagram Turbine oil Purification and Transfer System and

Diesel oil System

24 sheet 2

Flow Diagram HVAC Miscellaneous Buildings

N38

2040

Sheet 1 Flow Diagram Residual Heat Removal System

2040

Sheet 1 Iso Key Flow Diagram Residual Heat Removal System

2077

Flow Diagram - Diesel Generator Building Service water Starting

Air Fuel Oil Sump System and Roof Drains

N78

21

HVAC Plan and Sections Diesel Generator Building Heating

Boiler Room

N03

28147

RHR Pump Curves

2/06/1973

2006649

Arrangement Drawing, RPS Trip System A

2006650

Arrangement Drawing, RPS Trip System B

2203102

Scram Discharge Instrument Volume Flow Diagram

N06

2243047

Level Switch Specifications

N01

2243048

Level Switch Specifications

N01

453236930

Cooper Nuclear Station Panel K & R Annunciator Input Loop

Diagram ANN-MUX-13

N03

454003632

Flow Diagram, Control Rod Drive Hydraulic System

454003919

Cooper Nuclear Station Control Elementary Diagrams

AB

454003974

Cooper Nuclear Station, Turbine Generator Building Operating

Floor, Lighting and CCTV Plan (3108, Sh. 1)

AC/21

454003975

Cooper Nuclear Station, Turbine Generator Building Operating

Floor - Lighting Plan Sheet 2 (3109)

AB/10

Drawings

(Number)

Title

Revision or

Date

454005876

Elementary Diagram, Reactor Protection System

454006449

Elementary Diagram, Reactor Protection System

N14

454006451

Elementary Diagram, Reactor Protection System

454006561

Elementary Diagram, Primary Containment Isolation System

454006562

Electrical Diagram, Primary Containment Isolation System

454006580

Elementary Diagram, Reactor Protection System

454203115

Scram Discharge Volume North Header Instrument Piping

454203116

Scram Discharge Volume South Header Instrument Piping

29E211BB

Process Diagram Residual Heat Removal System

2-71212PI

Sheet 2DG

Diesel Generator Building Units 1-HV-DG-1B and 1D

CNS-BLDG-

456

Floor/Roof Plan 932 - 6 (Critical SWGR Rooms) Reactor

Building

N02

CNS-MS-43

Leakage Path from Outboard MSIVs, Cooper Nuclear Station

N05

DR-2016-0444

EE-PNL-AA3 125 VDC Load & Fuse Schedule

DR-2016-0498

Auxiliary One Line Diagram MCC Z SWGR 1A 1B 1E & Critical

SWGR 1F 1G

DR-2017-0001

Relay Settings for 4160V Bus 1F

DR-2017-0196

4160V Switchgear Elementary Diagram

M82317

Residual Heat Removal Heat Exchanger

M82454

Residual Heat Removal Heat Exchanger

MEC3000407

R01-P-MSIV

Leakage

Pathway

MSIV Leakage Pathway to the Condenser

09/01/11

Calculations

Number

Title

Revision

or Date

EE-02-078

Engineering Evaluation, Justification for Measuring Tape on Scram

Discharge Instrument Volumes

11/04/03

EE-15-048

Engineering Evaluation, DG-REL-DG1(14RY1) Use-as-is

Evaluation

NEDC 00-003

CNS Aux. Power System Load Flow and Voltage Analysis

NEDC 00-029

Post-LOCA MSIV Leakage Path to Main Condenser

NEDC 00-111

CNS Auxiliary Power System AC Loads

NEDC 01-006

MSIV Leakage Pathway Piping System Walkdown and Evaluation

Packages

Calculations

Number

Title

Revision

or Date

NEDC 02-064

Post-LOCA Operator Action Time Limits for Configuration of MSIV

Leakage Pathway

NEDC 02-068

Review of Westinghouse Letter for Turbine Stop Valve Shaft for

Post-LOCA Sealing Force

NEDC 07-082

Radiological Dose Analysis for a Loss-of-Coolant Accident (LOCA)

at Cooper Nuclear Station

2, 4

NEDC 07-082

Radiological Dose Analysis for a Loss-of-Coolant Accident (LOCA)

at Cooper Nuclear Station

NEDC 07-090

Fuel Oil Transfer Pump NPSH

NEDC 09-010

ECCS Suction Strainer Heat Loss Analysis with Alternate

Methodology

NEDC 09-102

Internal Flooding - HELB, MELB, and Feedwater Line Break

NEDC 11-072

DGSA Accumulator Capacity and Starts

NEDC 87-052

DG Storage Tank Fuel capacities

NEDC 87-131C

25 VDC Division I Load and Voltage Study

NEDC 87-131D

25 VDC Division II Load and Voltage Study

NEDC 87-133

NPPD Review of CYGNA Calculation for RHR and CS Pump

Motor Acceleration Time

NEDC 88-298

Review of S&L Calc 8206-E1 Control Bldg Heat Loads

NEDC 88-298

Review of S&L Calc 8206-E1 Control Building Heat Loads

NEDC 88-299A

Review of S&L Calc No. COOLC-01 Rev. 6 HVAC Load

Calculation for Control Building EL 903 -6

NEDC 88-299A

Review of S&L Calc Number COOLC-01 HVAC Load Calculation

for Control Building EL 903-6

NEDC 89-1828

Max Flow Through the RHR Pumps

NEDC 90-068

DG Room Heat Load

NEDC 90-384

NBI-LIS-101A, B, C, D, Level 3 Setpoint Calculation

NEDC 91-103

DG Room Cooling Without Cooling Coil

NEDC 91-290

RHR Loop B Test Calculations

NEDC 92-050A

Scram Discharge Instrument Volume High Water Level Setpoint

Calculation

NEDC 92-050B

Scram Discharge Instrument Volume High Water Level/Rod

Withdrawal Block Level Switch Setpoint Calculation

NEDC 92-063

Maximum SWBP Room Temperatures with No Cooling from

Control Building HVAC

NEDC 92-063

Maximum SWBP Room Temperature w/ No Cooling from Control

Building HVAC

1, 2

Calculations

Number

Title

Revision

or Date

NEDC 92-064

Transient Temperature Rise in SWBP Room

NEDC 92-202

RHR Loop A Test Calculations

NEDC 93-178

Drywell Fibrous Insulation

NEDC 94-034D

Small Steam Line Break (SSLB) Analysis

NEDC 94-231

RHR Pumps NPSH Maximum Flow Calculation

NEDC 97-012

DG Fuel On-Site Storage

NEDC 97-044A

NPSH Margins for the RHR and CS Pumps

NEDC 97-044A

NPSH Margins for the RHR and CS Pumps

R4C1

NEDC 97-044A

NPSH Margins for the RHR and CS Pumps

R4C2

NEDC 97-044A

NPSH Margins for the RHR and CS Pumps

R4C3

NEDC 97-044A

NPSH Margins for the RHR and CS Pumps

R4C4

NEDC 98-005

Min Flow Line Capacity for RHR Pumps During Single and Parallel

Pump Operation

R1

NEDC 98-005

Min Flow Line Capacity for RHR Pumps During Single and Parallel

Pump Operation

NEDC-32914P

Maximum Extended Load Line Limit and Increased Core Flow for

Cooper Nuclear Station

01/2000

NEDO-10320

The General Electric Pressure Suppression Containment

Analytical Model

05/1971

NEDO-10329

Loss-of-Coolant Accident & Emergency Core Cooling Models for

General Electric Boiling Water Reactors

04/1971

NEDO-21888

Mark I Containment Program Load Definition Report

TE-10594270

Technical Evaluation, Dedication Package CGI-10594270

(Amphenol connector)

TE-10777780

Technical Evaluation, Dedication Package CGI-10777780

(Amphenol connector)

Engineering

Changes

Number

Title

Revision or

Date

EC 6024460

4kV Breaker Auxiliary Switch Removal

11/26/2008

EC 6039040

Relocation of Shutdown Cooling Isolation Function

EC 6039501

RPS Test Panels

MDC 74-31

Minor Design Change: Voltage Transient Suppression

Miscellaneous

Number

Title

Revision or

Date

RHR-P-A IST

2015

RHR-P-A IST

2016

Miscellaneous

Number

Title

Revision or

Date

RHR-P-A IST

2017

RHR-P-A IST

2018

Action Way

Tracking #: LO

2016-0035-004

Vulnerability Review: Recent Issues Related to the

Commercial Grade Dedication of Allen Bradley 700-RTC

Relays [IN 2016-01]

CNS Letter

CNSS887255

Supplemental Response to IE Bulletin 84-02

06/29/1988

CNS Letter

NLS8400018

NPPD Response to IE Bulletin 84-02, Failures of General

Electric Type HFA Relays in Use in Class 1E Safety Systems

07/16/1984

CNS-PSA-014

Cooper Nuclear Station Human Reliability Analysis

DC 88-053B

Sustained Elevated Ambients in the Critical Switchgear Rooms

Reference Letter

2/21/1989

EE 06-025

Implementation of Alternate Source Term LOCA Analysis

Engineering

Evaluation

Number 01-147

Summary of Main Steam Isolation Valve (MSIV) Leakage

Pathway to the Condenser Seismic Qualification

EPM Report

EQDI-3273

Report on Review of Existing Equipment Qualification Master

Equipment List - Attachments 1 & 2

09/20/83

Franklin

Research Center

TER-C5506-69

Technical Evaluation Report, BWR Scram Discharge Volume

Long-Term Modifications, NPPD Cooper Nuclear Station [p.

11, surveillance criteria for scram discharge system]]

01/05/82

GE Letter

C960911

CNS Setpoint Analysis

09/11/96

Lesson Number

COR002-23-02

(1481)

OPS Residual Heat Removal System

Lesson Plan:

MEC3000407

MSIV Leakage Pathway to the Condenser

LO 2016-0035-

036

IN 2016-08 Inadequate Work Practices Resulting in Faulted

Circuit Breaker Connection

---

LRP-PNL-(9-15)

CNS Screening Evaluation Worksheet Ch A RPIS & RPS

Vertical Board 9-15

LRP-PNL-(9-17)

CNS Screening Evaluation Worksheet Ch B PCIS & RPS

Vertical Board 9-17

NEDC-31858P-A

BWROG Report for Increasing MSIV Leakage Rate Limits and

Elimination of Leakage Control Systems

08/1999

NLS8800347

Response to NRC Bulletin 88-04

07/08/1988

NPPD Submittal

to NRC

IE Bulletin 80-14, Degradation of BWR Scram Discharge

Volume Capability Proposed Technical Specifications

10/21/1980

Miscellaneous

Number

Title

Revision or

Date

Procedure

Change Request

6.RHR.308

10/09/2014

Procedure

Change Request

6.1DG.302

03/15/2017

Procedure

Change Request

6.1SW.301

10/10/2017

R3-764-9

Qualification Test Report, ITT Barton Model 764 Differential

Pressure Electronic Transmtter

10/05/1982

Screening

Evaluation

Worksheet

4160V Switchgear

2/09/1996

TAC No. M69439

Plant Specific Evaluation Report for USI A-46 Program

Implementation at Cooper Nuclear Station

09/30/1999

TQD # 0655ELE,

SAP #552

ERO - Electrical Maintenance OSC Pool Personnel

TQD # 0655IAC,

SAP #1126

ERO - IAC Maintenance OSC Pool Personnel

TQD #0655MEC,

SAP # 154

ERO - Mechanical Maintenance OSC Pool Personnel

TQD #0655UTL,

SAP #953

ERO - Utility Maintenance OSC Pool Personnel

Vendor Documents

Number

Title

Revision or

Date

4500187217

Certificate of Conformance Backdraft Dampers

4500187217

Purchase Order Backdraft Dampers

2/01/2015

GE 234A9303NS

Sheet 22: Instrument Data Sheet, Scram Discharge Level

GE Application Note

200.60

GE-MOV Varistors - Voltage Tansient Suppressors

08/75

GE Application Note

200.72

Using GE-MOV Varistors to Extend Contact Life

08/75

GE Catalog Cut

HFA 100 Multicontact Auxiliary Relays

GE SIL 044S4R2

HFA Relay Magnetic Coil Assembly Replacement and

Relay Adjustments

07/10/84

GE Transient

Voltage

Suppression

Manual

GE-MOV II Metal Oxide Varistors for Transient Voltage

Protection, Ratings and Characteristics Table: L Series

[Data Sheet, p. 139]

3rd Edition

GEH 2024F

Multi-Contact Auxiliary Relay Type HFA 51

2/99

Vendor Documents

Number

Title

Revision or

Date

GEI 68749B

Multi-Contact Auxiliary Relay Types HFA65D & HFA65E

06/95

GEK 45484

Multi-Contact Auxiliary Relay Type HFA151

03/94

GEK 45486A

Multi-Contact Auxiliary Relay Type HFA154

11/88

VM-0004

RHR Pumps

VM-1750

GE Relay Composite Manual

VM-1763

GE Power Circuit Breaker Composite Manual

DETAILED RISK ANALYSIS FOR NCV 2018011-02

Failure to Ensure Adequate Design Control Measures are in Place Associated with RHR

Service Water Booster Pump Room Cooling

For the detailed risk evaluation, the analyst changed the base condition of the Cooper SPAR

model to reflect a hypothetical, single failure proof configuration where two temperature

elements existed for Control Building basement high room temperature annunciation and two

temperature elements existed for emergency cooler fan actuation. The temperature elements

were modeled with failure rates which were consistent with other temperature elements in the

SPAR Template 2015, Version 1, with a value of 1.7E-3. Specific changes the analyst made

were:

Sub-fault trees for Residual Heat Removal Service Water Booster pump failures

resulting from high room temperature were added. This sub-fault trees included logic

which modeled that the Residual Heat Removal Service Water Booster pumps would fail

due to high room temperature in the Control Building basement when the following

failed:

o Normal room cooling,

o Emergency room cooling, and

o Alternate room cooling

The sub-fault tree logic represented normal cooling failing on:

o Losses of offsite power

o Failures to run

o Failures to start

o Being in test and maintenance

The sub-fault tree logic represented emergency cooling failing on:

o Failures to run

o Failures to start

o Being in test and maintenance

o Failures of two temperature elements which start the emergency fan (both

independent and common cause failures)

The sub-fault tree logic represented alternate room cooling failing on:

o Operators failing to take timely or any action to establish alternate room cooling

o Failures of two temperature elements which actuate the room temperature

annunciator to cue the operator to take action (both independent and common

cause failures)

The performance deficiency was then modeled by applying ignore failure model logic to the

redundant temperature element basic events and the temperature element common cause

failure basic events to represent the existing, non-single failure proof configuration. Also, the

analyst increased the failure rate of the remaining sole temperature elements to that of the 95th

percentile of the distribution of temperature elements in the distribution from SPAR Template

2015, Version 1, with a value of 3.33E-3, to represent a lower quality standard for the existing

temperature elements. These changes when applied over a one-year exposure period yielded

and estimate of the increase in core damage frequency 1.7E-8/year.

The dominant core damage sequences were losses of offsite power. Operator action to recover

suppression pool cooling and operator action to vent containment were the remaining means to

mitigate the initiators. These analyses were run on the Cooper SPAR model, Version 8.55, as

modified above, ran on SAPHIRE 8.1.6. Because the increase in core damage frequency was

less than 1.0E-7/year, the increase in core damage frequency from external events and the

increase in large early release frequency were not analyzed.

ML18163A201

SUNSI Review

ADAMS:

Non-Publicly Available

Non-Sensitive

Keyword:

By: GAG

Yes No

Publicly Available

Sensitive

NRC-002

OFFICE

SRI:R4/DRS/EB1

RI:R4/DRS/EB1

RI:R2/DRS/EB2

SRA:R4/DRS/PSB2

SRA:DRS/PSB2

NAME

GGeorge

WCullum

MRiley

SHedger

RDeese

SIGNATURE

/RA/

/RA/

/RA/

/RA/

/RA/

DATE

06/08/2018

06/09/18

06/09/18

06/09/18

06/09/18

OFFICE

C:R4/DRS/EB1

C:R4/DRP/PBC

C:R4/DRS/EB1

NAME

TFarnholtz

JKozal

TFarnholtz

SIGNATURE

/RA/

/RA by CYoung

Acting For/

/RA/

DATE

06/11/18

06/11/18

06/13/18