ML081270639

IR 05000298-08-002; on 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications and Postmaintenance Testing

ML081270639
Person / Time
Site:	Cooper
Issue date:	05/06/2008
From:	Chamberlain D NRC/RGN-IV/DRP
To:	Minahan S Nebraska Public Power District (NPPD)
References
EA-08-124 IR-08-002
Download: ML081270639 (42)

See also: IR 05000298/2008002

Text

May 6, 2008 EA 08-124 Stewart B. Minahan Vice President - Nuclear and CNO

Nebraska Public Power District PO Box 98 Brownville NE 68321

SUBJECT: COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION REPORT 05000298/2008002 Dear Mr. Minahan: On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated inspection at your Cooper Nuclear Station. The enclosed report documents the inspection results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant Operations, and other members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. As described in Section 1R19 of this report, the NRC concluded that the failure to establish adequate procedural controls for the maintenance of electrical connections on diesel generators

led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety significance of this finding was assessed on the basis of the best available information, including influential assumptions, using the applicable Significance Determination Process and was preliminarily determined to be a White (low to moderate safety significance) finding. Attachment 2 of this report provides a detailed description of the preliminary risk assessment.

In accordance with NRC Inspection Manual Chapter 0609, "Significance Determination Process," we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of this letter.

This finding does not represent an immediate safety concern because of the corrective actions

you have taken. These actions included applying thread locking compound to the amphenol connections on both diesel generators.

Also, this finding constitutes an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy. The current Enforcement Policy is included on the NRC's Web site at http://www.nrc.gov/reading-rm/adams.html. This significance determination process encourages an open dialog between the staff and the licensee, however the dialogue should not impact the timeliness of the staff's final determination. UNITED STATESNUCLEAR REGULATORY COMMISSIONREGION IV612 EAST LAMAR BLVD, SUITE 400ARLINGTON, TEXAS 76011-4125

Nebraska Public Power District - 2 -

Before we make a final decision on this matter, we are providing you an opportunity (1) to present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit documentation at least one

week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of the receipt of this letter. If you decline to request a regulatory conference or submit a written response, your ability to appeal the final SDP determination can be affected, in that by not doing either you

fail to meet the appeal requirements stated in the prerequisite and limitation sections of Attachment 2 of IMC 0609.

Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberation on this matter.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for the inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review.

The report also documents one

finding which was evaluated under the risk SDP as having very low safety significance (Green). The finding was determined to involve a violation of NRC requirements. However, because of very low safety significance, and because the issue was entered into your corrective action program, the NRC is treating the issue as a noncited violation

in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza

Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector Office at the Cooper Nuclear Station.

Nebraska Public Power District - 3 -

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). Sincerely, /RA/ Dwight D. Chamberlain, Director Division of Reactor Projects Docket No: 50-298 License No: DPR-46 Enclosure: NRC Inspection Report 05000298/2008002 w/Attachments: Attachment 1: Supplemental Information Attachment 2: Preliminary Risk Assessment cc w/enclosure: Gene Mace Nuclear Asset Manager Nebraska Public Power District P.O. Box 98

Brownville, NE 68321 John C. McClure, Vice President and General Counsel Nebraska Public Power District P.O. Box 499 Columbus, NE 68602-0499 David Van Der Kamp Licensing Manager Nebraska Public Power District P.O. Box 98 Brownville, NE 68321 Michael J. Linder, Director Nebraska Department of Environmental Quality P.O. Box 98922 Lincoln, NE 68509-8922 Chairman Nemaha County Board of Commissioners Nemaha County Courthouse 1824 N Street Auburn, NE 68305 Julia Schmitt, Manager Radiation Control Program Nebraska Health & Human Services Dept. of Regulation & Licensing Division of Public Health Assurance

301 Centennial Mall, South P.O. Box 95007 Lincoln, NE 68509-5007

Nebraska Public Power District - 4 -

H. Floyd Gilzow Deputy Director for Policy Missouri Department of Natural Resources P. O. Box 176 Jefferson City, MO 65102-0176 Director, Missouri State Emergency Management Agency P.O. Box 116 Jefferson City, MO 65102-0116 Chief, Radiation and Asbestos Control Section Kansas Department of Health and Environment Bureau of Air and Radiation 1000 SW Jackson, Suite 310

Topeka, KS 66612-1366 Melanie Rasmussen, State Liaison Officer/ Radiation Control Program Director Bureau of Radiological Health Iowa Department of Public Health Lucas State Office Building, 5th Floor 321 East 12th Street

Des Moines, IA 50319 John F. McCann, Director, Licensing Entergy Nuclear Northeast Entergy Nuclear Operations, Inc. 440 Hamilton Avenue White Plains, NY 10601-1813 Keith G. Henke, Planner Division of Community and Public Health Office of Emergency Coordination 930 Wildwood, P.O. Box 570 Jefferson City, MO 65102 Paul V. Fleming, Director of Nuclear Safety Assurance Nebraska Public Power District P.O. Box 98 Brownville, NE 68321 Ronald L. McCabe, Chief Technological Hazards Branch National Preparedness Division DHS/FEMA 9221 Ward Parkway Suite 300

Kansas City, MO 64114-3372

Nebraska Public Power District - 5 -

Electronic distribution by RIV: Regional Administrator (Elmo.Collins@nrc.gov) DRP Director (Dwight.Chamberlain@nrc.gov) DRS Director (Roy.Caniano@nrc.gov) DRS Deputy Director (Troy.Pruett@nrc.gov) Senior Resident Inspector (Nick.Taylor@nrc.gov) Branch Chief, DRP/C (Rick.Deese@nrc.gov) Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov) Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov) RITS Coordinator (Marisa.Herrera@nrc.gov)

Only inspection reports to the following: DRS STA (Dale.Powers@nrc.gov) J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov) P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov) ROPreports CNS Site Secretary (Sue.Farmer@nrc.gov)

SUNSI Review Completed: WCW ADAMS: Yes No Initials: WCW

Publicly Available Non-Publicly Available Sensitive Non-Sensitive

R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc ML081270639 RIV:SRI:DRP/C RI:DRP/C SPE:DRP/C DRS:SRA C:DRS/OB C:DRS/EB2 NHTaylor MLChambers WCWalker MFRunyan RELantz LJSmith E-Walker /RA/ E-maile

d /RA/ /RA/ /RA/ /RA/ 4/24/08 4/23/08 4/24 /08 4/24/08 4/24/08 4/23/08 C:DRS/EB1 C:DRS/PSB C:DRP/C ACES:SES D:DRP RLBywater MPShannon RWDeese GMVasquezDDChamberlain /RA/ /RA/ /RA/ /RA/ 4/22/08 4/22/08 4/ /08 4/24/08 5/02/08 OFFICIAL RECORD COPY T=Telephone E=Email F=Fax

- 1 - Enclosure

U. S. NUCLEAR REGULATORY COMMISSION REGION IV Docket No: 05000298 License No: PR-46 Report No: 5000298/2008002

Licensee: Nebraska Public Power District Facility: Cooper Nuclear Station Location: PO Box 98, Brownville, NE 68321 Dates: January 1 through March 22, 2008 Inspectors: N. Taylor, Senior Resident Inspector M. Chambers, Resident Inspector P. Elkmann, Emergency Preparedness Inspector M. Runyan, Senior Reactor Analyst

Approved by: D. Chamberlain, Director Division of Reactor Projects

- 2 - Enclosure SUMMARY OF FINDINGS

IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications and Postmaintenance Testing. This report covers a three-month period of inspection by resident inspectors and announced baseline inspections by regional inspectors. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the Significance Determination Process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006. A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems * Green. The inspectors identified a Green noncited violation of Technical Specification 5.4.1.a regarding the licensee's failure to follow the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control." Specifically, licensee personnel failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment during a required annual scaffold inspection on January 21, 2008. This issue was entered Into the licensee's corrective action program as Condition Report CR-CNS-2008-01576.

The finding is more than minor because if left uncorrected the failure to perform annual scaffold inspections could become a more significant safety concern. Specifically, annual inspections failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1

Worksheet, the finding is determined to have a very low safety significance because it did not result in the loss of function of a Technical Specification required system for greater than its allowed outage time. The cause of this finding is related to the human performance crosscutting component of work practices because maintenance personnel did not follow the requirements of

Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).

• TBD. Two examples of a self-revealing apparent violation of Technical Specification 5.4.1.a were identified regarding the licensee's failure to establish procedural controls for maintenance of electrical connections on essential equipment. In the first example, the licensee failed to include amphenol connections within the scope of existing periodic electrical connection inspections to identify loosening connections. In the second example, the licensee failed to incorporate internal operating experience into work control procedures to ensure that diesel generator-mounted amphenol connections were solidly attached following maintenance. These failures to establish adequate procedural controls led to the trip of Diesel Generator 2 during testing on January 15, 2008. This

issue was entered into the licensee's corrective action program as Condition Report CR-CNS 2008-00304.

- 3 - Enclosure

The finding affected the mitigating systems cornerstone and is more than minor because it is associated with the cornerstone attribute of equipment performance and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The Phase 1 worksheets in Inspection Manual

Chapter 0609, "Significance Determination Process," were used to conclude that a Phase 2 analysis was required because the finding represents an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time (7 days). A Phase 2 risk analysis was conducted using the guidance of Manual Chapter 0609, Appendix A, "Determining the Significance of

Reactor Inspection Findings for At-Power Situations." Entering the site-specific pre-solved table with an assumed exposure time of greater than 30 days yielded a result of red, or very high significance. A Phase 3 analysis conducted by a risk analyst preliminarily determined the finding to be of white, or low to moderate significance. The cause of the finding is related to the corrective action component of the crosscutting area of problem identification and resolution in that the licensee failed to take appropriate corrective actions for a 2007 NRC

inspection finding which identified inadequate maintenance procedures for checking the tightness of diesel generator electrical connections (P.1(d)) (Section 71111.19).

B. Licensee-Identified Violations

No violations of significance were identified.

- 4 - Enclosure REPORT DETAILS

Summary of Plant Status

The plant began the inspection period at 100 percent power. On February 19, 2008, the plant began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from 90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump motor Generator B. The reactor was returned to full power later in the day, where it remained

for the rest of the inspection period.

1. REACTOR SAFETY Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness

1R04 Equipment Alignment (71111.04)

.1 Quarterly Partial System Walkdowns

a. Inspection Scope

The inspectors selected these systems based on their risk significance relative to the reactor safety cornerstones at the time they were inspected. The inspectors attempted to identify any discrepancies that could impact the function of the system, and, therefore,

potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs), condition reports (CR), and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable

of performing their intended functions. The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable. The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies. The inspectors also verified that the licensee had properly

identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the corrective action program (CAP) with the appropriate significance characterization. Documents reviewed are listed in the attachment. The inspectors performed partial system walkdowns of the following risk-significant systems: * January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B during REC HX A limiting condition for operation (LCO)

• February 28, 2008, Service Water Train B during Diesel Generator (DG) LCO

• March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO The inspectors completed three samples.

- 5 - Enclosure b. Findings

No findings of significance were identified. .2 Semi-Annual Complete System Walkdown

a. Inspection Scope

On March 11, 2008 the inspectors performed a complete system alignment inspection of the DG 1 to verify the functional capability of the system. This system was selected

because it was considered both safety-significant and risk-significant in the licensee's probabilistic risk assessment. The inspectors walked down the system to review mechanical and electrical equipment line ups, electrical power availability, system pressure and temperature indications, as appropriate, component labeling, component lubrication, component and equipment cooling, hangers and supports, operability of support systems, and to ensure that ancillary equipment or debris did not interfere with equipment operation. A review of a sample of past and outstanding WOs was performed to determine whether any deficiencies significantly affected the system function. In addition, the inspectors reviewed the CAP database to ensure that system equipment alignment problems were being identified and appropriately resolved.

• March 11, 2008, DG 1 during DG 2 LCO Documents reviewed by the inspectors included:

• CNS System Operating Procedure 2.2.20, "Standby AC Power System (Diesel Generator)," Revision 70 These activities constituted one complete system walkdown sample as defined by Inspection Procedure 71111.04-05. b. Findings

No findings of significance were identified. 1R05 Fire Protection (71111.05AQ) a. Inspection Scope

The inspectors conducted fire protection walkdowns which were focused on availability, accessibility, and the condition of firefighting equipment. The inspectors reviewed areas to assess if the licensee had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant, effectively maintained fire detection and suppression capability, maintained passive fire protection features in good material condition, and had implemented

adequate compensatory measures for out of service, degraded or inoperable fire protection equipment, systems, or features in accordance with the licensee's fire plan. The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plant's Individual Plant Examination of External Events with later additional insights, their potential to impact equipment which could initiate or mitigate a

- 6 - Enclosure plant transient, or their impact on the plant's ability to respond to a security event. Using the documents listed in the attachment, the inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use; that fire detectors and sprinklers were unobstructed, that transient material loading was within the analyzed limits; and fire doors, dampers, and penetration seals appeared to be in satisfactory condition. The inspectors also verified that minor issues identified

during the inspection were entered into the licensee's corrective action program.

• February 13, 2008, Fire Zone 2C during fuel movement

• March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO

• March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO

• March 15, 2008, Fire Zone 19C Controlled Access Corridor

Documents reviewed by the inspectors included:

• CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated February 28, 2003

• CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated November 5, 2007 These activities constituted four quarterly fire protection inspection samples as defined by Inspection Procedure 71111.05-05. b. Findings

No findings of significance were identified. 1R07 Annual Heat Sink Performance (71111.07) a. Inspection Scope

The inspectors reviewed the licensee's testing of A and B REC heat exchangers to verify that potential deficiencies did not mask the licensee's ability to detect degraded performance, to identify any common cause issues that had the potential to increase

risk, and to ensure that the licensee was adequately addressing problems that could result in initiating events that would cause an increase in risk. The inspectors reviewed the licensee's observations as compared against acceptance criteria, the correlation of scheduled testing and the frequency of testing, and the impact of instrument inaccuracies on test results. Inspectors also verified that test acceptance criteria considered differences between test conditions, design conditions, and testing conditions.

• January 25 and January 21, 2008, A and B REC HX performance tests Documents reviewed are listed in the attachment. This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.

- 7 - Enclosure b. Findings

No findings of significance were identified. 1R11 Licensed Operator Requalification Program (71111.11) Conformance With Simulator Requirements Specified in 10 CFR 55.46

a. Inspection Scope

The inspectors observed testing and training of senior reactor operators and reactor operators to identify deficiencies and discrepancies in the training, to assess operator performance, and to assess the evaluator's critique. The training scenario involved a tornado, station blackout and a loss of shutdown cooling.

• February 28, 2008, Crew E drill Documents reviewed by the inspectors included:

• Lesson SKL054-01-28, "Tornado, Station Blackout, Loss of Shutdown Cooling" The inspectors completed one sample. b. Findings

No findings of significance were identified. 1R12 Maintenance Effectiveness (71111.12) a. Inspection Scope

The inspectors evaluated degraded performance issues involving the risk significant systems of events such as where ineffective equipment maintenance has resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensee's actions to address system performance or condition

problems in terms of the following:

• implementing appropriate work practices;

• identifying and addressing common cause failures;

• scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;

• characterizing system reliability issues for performance;

• charging unavailability for performance;

• trending key parameters for condition monitoring;

• ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and

- 8 - Enclosure

• verifying appropriate performance criteria for structures, systems, and components (SSCs) functions classified as (a)(2) or appropriate and adequate goals and corrective actions for systems classified as (a)(1). The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the system. In addition, the inspectors verified maintenance effectiveness issues were entered into the corrective action program with the appropriate significance characterization.

• March 19, 2008, Reactor protection system (RPS) electronic protection assembly (EPA) breaker failures January 12, 2008

• March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008

Documents reviewed by the inspectors included:

• Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1

• Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC

This inspection constitutes two quarterly maintenance effectiveness samples as defined in Inspection Procedure 71111.12-05. b. Findings

No findings of significance were identified. 1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13) a. Inspection Scope

The inspectors reviewed the licensee's evaluation and management of plant risk for the maintenance and emergent work activities affecting risk-significant and safety-related equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:

• March 6, 2008, Inoperability of both DGs on September 11, 2007

• March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008

These activities were selected based on their potential risk significance relative to the

reactor safety cornerstones. As applicable for each activity, the inspectors verified that risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate and complete. When emergent work was performed, the inspectors verified that the plant risk was promptly reassessed and managed. The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical engineer, and verified plant conditions were consistent with the risk assessment. The inspectors also reviewed TS requirements and

walked down portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met. Documents reviewed are listed in the attachment.

The inspectors completed two samples.

- 9 - Enclosure b. Findings

No findings of significance were identified. 1R15 Operability Evaluations (71111.15) a. Inspection Scope

The inspectors reviewed the following issues: The inspectors selected these potential operability issues based on the risk-significance of the associated components and systems. The inspectors evaluated the technical adequacy of the evaluations to ensure that TS operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the TS and UFSAR to the licensee's evaluations, to determine

whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Additionally, the inspectors also reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.

• January 14, 2008, DG 2 operability and common cause evaluation for loss of overspeed governor sightglass during run

• January 15, 2008, operability evaluation of control room Board C non-essential meters without isolation devices in DG 1 and DG 2 essential circuits, on January 14, 2008 * February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in DG 2 * March 19, 2008, RPS EPA circuit breakers operability evaluations on January 25, 2008 and February 6, 2008 This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05. b. Findings

No findings of significance were identified. 1R18 Plant Modifications (71111.18) Temporary Modifications

a. Inspection Scope

The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs to ensure that temporary alterations and configuration changes to the plant conformed to

- 10 - Enclosure these guidance documents and the requirements of 10 CFR 50.59. The inspectors: (1) verified that the modifications did not have an affect on system operability/availability; (2) verified that the installations were consistent with modification documents; (3) ensured that the post-installation test results were satisfactory and that the impacts of the temporary modifications on permanently installed SSCs were supported by the test; and (4) verified that appropriate safety evaluations were completed. The inspectors

reviewed the following temporary modifications:

• March 19, 2008, Long term scaffolding program review

Documents reviewed by the inspectors included:

• Maintenance Procedure 7.0.7, "Scaffolding Construction and Control," Revision 24 The inspectors completed one sample. b. Findings

Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a regarding the licensee's failure to follow the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control." Specifically, licensee personnel failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment during a required annual scaffold inspection on January 21, 2008. Description. During pre-outage scaffold inspections on February 7, 2008, the licensee discovered that some existing scaffolds were not built in accordance with established procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had been built in contact with safety-related service water piping, RHR piping, pipe hangers, electrical conduit and the torus shell. This condition was documented in CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of

the impacted safety systems, the licensee took actions to remove the non-compliant scaffold on February 22, 2008, and closed the CR.

The inspectors noted that Maintenance Procedure 7.0.7, "Scaffolding Construction and Control," Revision 24, contains the following requirement in Paragraph 3.2:

During the month of January, all erected scaffolds shall have an Industrial Safety examination performed to ensure compliance with this procedure. This examination is required prior to placing a new tag and entering the scaffold into the new calendar year log.

The inspectors also noted that the required annual examination had been completed on January 21, 2008. The maintenance personnel who conducted the examination in WO 4552687 documented completion with no discrepancies.

On March 6, 2008, the inspectors questioned licensee management regarding the performance of the annual scaffold examinations. Specifically, the inspectors asked why the non-compliant scaffold had not been identified during the required annual scaffold examinations. Following this meeting, the licensee conducted a scaffolding walkdown to

- 11 - Enclosure identify any remaining non-compliances. The following additional violations of Procedure 7.0.7 were discovered during this walkdown:

• Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had a board in contact with high pressure coolant injection steam line drip leg piping. Contrary to Procedure 7.0.7, this scaffold had not been inspected due to a misperception that only "long term" scaffolds that had been in place greater than 90 days needed to be inspected. The

licensee documented this condition in CR-CNS-2008-01551.

• Scaffold 08-06 was discovered to be in contact with safety-related conduit and pipe hangers in the torus area. The licensee was unable to determine when this scaffold had been installed.

• Eight examples of non-compliant scaffolding handrails were discovered in contact with safety system components in the torus area which had been installed in 2002. This example, documented in

CR-CNS-2008-01563 on March 11, 2008 was not identified by the annual examination because it was not included in the scaffold log and was therefore not inspected.

The inspectors determined that Procedure 7.0.7 had been violated during the

January 21, 2008 annual scaffolding examination in that the examiner reviewed only those scaffolds identified in the scaffolding log as "Long Term Permanent" versus "all erected scaffolds" as required by the procedure. As a result, seven existing scaffolds were not inspected, despite the fact that some of them had been installed for more than one year at the time of the inspection. In addition, the examiner did not conduct a thorough inspection to "ensure compliance with this procedure." Obvious non-compliances existed in some of the installed scaffolds that were not identified until

months later.

The inspectors also noted that since handrails built from scaffolding materials do not meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an elevated platform, no annual inspections have been performed on these structures.

Analysis. The performance deficiency associated with this finding involved the licensee's failure to comply with the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control." The finding is more than minor because if left uncorrected the failure to perform annual scaffold inspections could become a more

significant safety concern. Specifically, annual inspections failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, the finding is determined to have a very low safety significance because it did not result in the loss of function of a TS required system for greater than

its allowed outage time. The cause of this finding is related to the human performance crosscutting component of work practices because maintenance personnel did not follow the requirements of Maintenance Procedure 7.0.7 (H.4(b)).

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented, and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,

- 12 - Enclosure requires that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with written procedures. Contrary to this requirement, on January 21, 2008, maintenance personnel violated the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control," in that they did not inspect all required scaffolds or identify obvious non-compliances with Procedure 7.0.7. Because the finding is of very low safety significance and has been

entered into the licensee's CAP as CR-CNS-2008-01576, this violation is being treated as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures."

1R19 Postmaintenance Testing (71111.19)

a. Inspection Scope

These activities were selected based upon the SSCs ability to impact risk. The inspectors evaluated these activities for the following (as applicable): the effect of testing on the plant had been adequately addressed; testing was adequate for the maintenance performed; acceptance criteria were clear and demonstrated operational readiness; test

instrumentation was appropriate; tests were performed as written in accordance with properly reviewed and approved procedures; equipment was returned to its operational status following testing (temporary modifications or jumpers required for test performance were properly removed after test completion), and test documentation was properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10

CFR Part 50 requirements, licensee procedures, and various NRC generic communications to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements. In addition, the inspectors reviewed corrective action documents associated with postmaintenance tests to determine whether the licensee was identifying problems and entering them in the CAP and that

the problems were being corrected commensurate with their importance to safety. Documents reviewed are listed in the attachment. The inspectors reviewed the following postmaintenance activities to verify that procedures and test activities were adequate to ensure system operability and functional capability:

• March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008

• March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008

• March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and thermography

• March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008

• March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008

The inspectors completed five samples.

- 13 - Enclosure b. Findings

Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical Connections

Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were identified regarding the licensee's failure to establish procedural controls for

maintenance of electrical connections on essential equipment. In the first example, the licensee failed to include amphenol connections within the scope of existing periodic electrical connection inspections to identify loosening connections. In the second example, the licensee failed to incorporate internal operating experience into work control procedures to ensure that DG-mounted amphenol connections were solidly

attached following maintenance. These failures to establish adequate procedural controls led to the trip of DG 2 during testing on January 15, 2008.

Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a postmaintenance test. The test was being conducted to verify the ability of DG 2 to perform its safety function following repairs to the overspeed governor oil level sight glass. The licensee determined that the cause of the trip of DG 2 was a loose

amphenol-type connection on the relay tachometer speed sensing circuit magnetic pickup. The licensee determined that this failure was similar in nature to a condition identified during previous troubleshooting of DG 2. On December 10, 1995, operations personnel initiated a CR to document that the amphenol connector on a DG mounted magnetic pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors and apply thread locking compound to the amphenol threads to keep the connection from vibrating loose. The completion of these actions was documented in Minor

Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions were taken to codify the use of thread locking compounds or other measures to prevent the amphenol connections from coming unthreaded during engine operation.

During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm

was unexpectedly received, as described in CR 4-13285. Minor Maintenance WO 003915 was initiated to determine the cause of the unexpected alarm. During completion of this WO on December 29, 2000, maintenance personnel replaced the relay tachometer and the associated MPU, and the associated amphenol connection was disconnected and then reconnected.

In the first example of this performance deficiency, the inspectors determined that the licensee's procedures for performing periodic DG electrical examinations were inadequate in that they did not include engine-mounted components. Maintenance Procedure 7.3.8.2, "Diesel Generator Electrical Examination and Maintenance," was created on September 30, 1988 to perform periodic (once per operating cycle) preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC

identified an NCV regarding the licensee's failure to establish adequate instructions for emergency DG electrical maintenance (see NRC Special Inspection Report 05000298/2007007). Two of the three examples described in the NCV dealt with inadequate work instructions for checking the tightness of electrical connections on DG system components. In response to this NCV, the licensee initiated Corrective Action #8

- 14 - Enclosure under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically check the DG systems for loose connections. In developing a revision to Maintenance Procedure 7.3.8.2, "Diesel Generator Electrical Examination and Maintenance," the licensee made the erroneous assumption that all engine-mounted components have other maintenance actions that satisfy the intent of the corrective action. As such, engine-mounted connections were not included in the scope of the inspections in

Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised procedure was subsequently completed for DG 2 on September 13, 2007. The assumption was in error and resulted in a recently missed opportunity to discover the loosening amphenol connection on the DG 2 relay tachometer MPU.

In the second example of this performance deficiency, the licensee determined that the maintenance procedures used on December 29, 2000 did not contain adequate guidance to ensure that thread locking compounds or other measures would be utilized to ensure that the DG amphenol connections did not become unthreaded during engine operation. The work was not conducted using detailed procedures, and as such the licensee determined that the amphenol became loose as a result of either inadequate tightening during the maintenance, or equipment vibration between 2000 and 2008 (due

to thread locking compound not being used), or a combination of both. The licensee has initiated corrective actions to add the appropriate guidance to Administrative Procedure 0.40.4, "Planning."

Analysis. The performance deficiency associated with this finding involved the licensee's failure to establish procedural controls for maintenance of electrical connections on essential equipment. In the first example, the licensee failed to include these amphenol connections within the scope of existing periodic electrical connection inspections to identify loosening connections. In the second example, the licensee failed to incorporate internal operating experience into work control procedures to ensure that

DG-mounted amphenol connections were solidly attached following maintenance. These failures to establish adequate procedural controls led to the trip of DG 2 during testing on January 15, 2008. The finding is more than minor because it is associated with the mitigating systems cornerstone attribute of equipment performance and affects the associated cornerstone objective to ensure the availability, reliability, and capability

of systems that respond to initiating events to prevent undesirable consequences. The Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process," were used to conclude that a Phase 2 analysis was required because the finding represents an actual loss of safety function of a single train for greater than its TS allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, "Determining the Significance of Reactor Inspection Findings for At-Power Situations." Entering the site-specific pre-solved table with an assumed exposure time of greater than 30 days yielded a result of red, or very high significance. A Phase 3 analysis conducted by a risk analyst preliminarily determined the finding to be of white, or low to moderate significance.

The cause of the finding is related to the corrective action component of the crosscutting

area of problem identification and resolution in that the licensee failed to take appropriate corrective actions for a 2007 NRC inspection finding which identified inadequate maintenance procedures for checking the tightness of DG electrical connections (P.1(d)).

- 15 - Enclosure Enforcement. TS 5.4.1.a requires that written procedures be established, implemented, and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a), requires that maintenance affecting performance of safety-related equipment should be performed in accordance with written procedures. Contrary to this, since December 29, 2000, the licensee used inadequate procedural guidance to reassemble amphenol

connections on DG 2. Additionally, since September 30, 1988, the licensee's procedural guidance for performing periodic electrical inspections has been inadequate in that it did not check the tightness of engine-mounted amphenol connections. These inadequate procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue was entered into the licensee's CAP as CR-CNS-2008-00304. Pending determination of

the finding's final safety significance, this finding is identified as Apparent Violation (AV)05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical Connections."

1R22 Surveillance Testing (71111.22) Routine Surveillance Testing

a. Inspection Scope

The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that the three surveillance activities listed below demonstrated that the SSCs tested were capable of performing their intended safety functions. The inspectors either witnessed or reviewed test data to verify that the following significant surveillance test attributes were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)

acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls; (7) test data; (8) testing frequency and method demonstrated TS operability; (9) test equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code requirements; (12) engineering evaluations, root causes, and bases for returning tested SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;

and (14) annunciators and alarms setpoints. The inspectors also verified that the licensee identified and implemented any needed corrective actions associated with the surveillance testing.

The inspectors observed in-plant activities and reviewed procedures and associated

records to determine whether: any preconditioning occurred; effects of the testing were adequately addressed by control room personnel or engineers prior to the commencement of the testing; acceptance criteria were clearly stated, demonstrated operational readiness, and were consistent with the system design basis; plant equipment calibration was correct, accurate, and properly documented; as left setpoints

were within required ranges; the calibration frequency was in accordance with TS, the UFSAR, procedures, and applicable commitments; measuring and test equipment calibration was current; test equipment was used within the required range and accuracy; applicable prerequisites described in the test procedures were satisfied; test frequencies met TS requirements to demonstrate operability and reliability; tests were performed in accordance with the test procedures and other applicable procedures; jumpers and lifted leads were controlled and restored where used; test data and results

were accurate, complete, within limits, and valid; test equipment was removed after testing; where applicable, test results not meeting acceptance criteria were addressed with an adequate operability evaluation or the system or component was declared

- 16 - Enclosure inoperable; where applicable for safety-related instrument control surveillance tests, reference setting data were accurately incorporated in the test procedure; where applicable, actual conditions encountering high resistance electrical contacts were such that the intended safety function could still be accomplished; prior procedure changes had not provided an opportunity to identify problems encountered during the performance of the surveillance or calibration test; equipment was returned to a position

or status required to support the performance of the safety functions; and all problems identified during the testing were appropriately documented and dispositioned in the CAP. The inspectors reviewed the test results for the following activities to determine whether risk-significant systems and equipment were capable of performing their intended safety function and to verify testing was conducted in accordance with applicable procedural and TS requirements:

• January 23, 2008, Scram discharge volume vent valve inservice test (IST) performed January 14, 2008

• February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31, 2008 * March 19, 2008, 6.REC.201 performed January 31, 2008

• March 21, 2008, DG 2 monthly operability test performed March 11, 2008

This inspection constitutes four routine surveillance testing samples as defined in

Inspection Procedure 71111.22. b. Findings

No findings of significance were identified. EP4 Emergency Action Level and Emergency Plan Changes (71114.04) CNS Emergency Plan Revision 53

a. Inspection Scope

The inspector performed an in-office review of Revision 53 to the Cooper Nuclear Station Emergency Plan, received January 8, 2008. This revision moved the licensee's Joint Information Center (emergency news center) from Columbus, Nebraska, to Auburn, Nebraska, revised position duties in the Emergency Operations Facility and Joint Information Center, deleted the Technical Information Coordinator (EOF) position, revised position titles in the Joint Information Center, added a Letter of Agreement

between the licensee and the Nebraska City Fire Department, and revised geographical-based protective action zones in Missouri, based on an approval letter from Federal Emergency Management Agency, Region VII, dated October 10, 2007.

This revision was compared to its previous revision, to the criteria of NUREG-0654,

"Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants," Revision 1, and to the standards in

- 17 - Enclosure 10 CFR 50.47(b) to determine if the revision adequately implemented the requirements of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and did not constitute approval of licensee changes; therefore, this revision is subject to future inspection.

The inspectors completed one sample during the inspection.

b. Findings

No findings of significance were identified. 4. OTHER ACTIVITIES 4OA1 Performance Indicator (PI) Verification (71151) .1 Data Submission Review

a. Inspection Scope

The inspectors performed a review of the data submitted by the licensee for the 4th Quarter 2007 PIs for any obvious inconsistencies prior to its public release in accordance with Inspection Manual Chapter 0608, "Performance Indicator Program." This review was performed as part of the inspectors' normal plant status activities and, as such, did not constitute a separate inspection sample. b. Findings

No findings of significance were identified. .2 Unplanned Scrams per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical hours PI for the period from the 1

st quarter 2007 through the 4

th quarter 2007. To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02, "Regulatory Assessment Performance Indicator Guideline," were used. The inspectors reviewed the licensee's operator narrative logs, issue reports, event reports and NRC

inspection reports to validate the accuracy of the submittals. The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the PI data collected or transmitted for this indicator and none were identified. This inspection constitutes one unplanned scrams per 7000 critical hours sample as defined by Inspection Procedure 71151. b. Findings

No findings of significance were identified.

- 18 - Enclosure .3 Unplanned Transients per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the unplanned transients per 7000 critical hours PI for the period from the 1

st quarter 2007 through the 4

th quarter 2007. To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute

Document 99-02, "Regulatory Assessment Performance Indicator Guideline," were used. The inspectors reviewed the licensee's operator narrative logs, issue reports, maintenance rule records, event reports and NRC integrated Inspection reports to validate the accuracy of the submittals. The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the PI data

collected or transmitted for this indicator and none were identified.

This inspection constitutes one unplanned transients per 7000 critical hours sample as defined by Inspection Procedure 71151. b. Findings

No findings of significance were identified. 4OA2 Identification and Resolution of Problems (71152) Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical Protection .1 Routine Review of Items Entered Into the CAP

a. Inspection Scope

The inspectors performed a daily screening of items entered into the licensee's CAP. This assessment was accomplished by reviewing CRs and WOs and attending corrective action review and work control meetings. The inspectors: (1) verified that equipment, human performance, and program issues were being identified by the licensee at an appropriate threshold and that the issues were entered into the CAP; (2) verified that corrective actions were commensurate with the significance of the issue;

and (3) identified conditions that might warrant additional followup through other baseline inspection procedures.

b. Findings

No findings of significance were identified.

.2 Selected Issue Followup Inspection

a. Inspection Scope

In addition to the routine review, the inspectors selected the issues listed below for a more in-depth review. The inspectors considered the following during the review of the

- 19 - Enclosure licensee's actions: (1) complete and accurate identification of the problem in a timely manner; (2) evaluation and disposition of operability/reportability issues; (3) consideration of extent of condition, generic implications, common cause, and previous occurrences; (4) classification and prioritization of the resolution of the problem; (5) identification of root and contributing causes of the problem; (6) identification of corrective actions; and (7) completion of corrective actions in a timely manner.

• December 27, 2007, loss of both plant monitoring and information system computers Documents reviewed by the inspectors included:

• Abnormal Procedure 2.4 COMP, "Computer Malfunction," Revision 4

• Computer System Operating Procedure 2.6.3, "Computer Systems Operation and Outage Recovery," Revision 23

The inspectors completed one sample.

b. Findings

No findings of significance were identified. 4OA3 Followup of Events and Notices of Enforcement Discretion (71153) .1 (Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance Leads to Rendering Second Diesel Inoperable

On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil day tank following extensive maintenance on DG 2. While filling the DG 2 day tank, control room operators received annunciators due to a rising level in the DG 1 fuel oil day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, "Diesel Generator Fuel Oil Transfer Pump IST Flow Test - Div 2," the licensee declared DG 1

inoperable. With DG 2 already inoperable, the control room staff properly entered Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

In an effort to restore operability of DG 1, the licensee elected to attempt repair of the

leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing DG 1 into maintenance lockout and entry into an overall red risk window for the station. The repair attempt was unsuccessful, and the control room staff subsequently entered Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Operability of DG 1 was subsequently restored by closing a fuel oil

system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.

The licensee initiated this LER due to the loss of safety function (on-site emergency power) that occurred during the corrective maintenance attempt on DG 1. The inspectors reviewed all aspects of the event, including performance of control room staff,

planning of the associated WOs, evaluation and mitigation of station risk, configuration control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency

- 20 - Enclosure and emergent work, and relationship to previous work on DG 1. A related violation of NRC requirements is discussed in detail in NRC Integrated Inspection Report 05000298/2007005. This LER is closed.

.2 (Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency Filter System Fan Motor Results in Loss of Safety Function

During a preventative maintenance inspection on December 3, 2007, licensee technicians discovered severely overheated motor leads on the Control Room Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the damaged motor leads, operations staff declared the fan inoperable and determined that

since CREFS is a single-train safety system, a loss of safety function had occurred. Immediate action was taken and the degraded booster fan was replaced. CREFS was returned to an operable status on December 4, 2007. The degraded condition was determined to have been caused by the improper crimping of the motor lugs by the manufacturer prior to installation in the plant. No performance deficiencies were identified during the review of this LER. This LER is closed. 4OA6 Management Meetings

Exit Meeting Summary

On January 15, 2008, a regional inspector conducted a telephonic exit to present the results of the in-office inspection of licensee changes to the emergency plan to Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings. The inspector confirmed that proprietary information was not provided or examined

during the inspection.

On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the results of the in-office inspection of changes to the licensee's emergency plan to Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The

inspector confirmed that proprietary, sensitive, or personal information examined during the inspection had been returned to the identified custodian.

On April 14, 2008, the resident inspectors presented the inspection results to Mr. M. Colomb, General Manager of Plant Operations and other members of the

licensee staff. The licensee acknowledged the issues presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

A1-1 Attachment 1 SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT

Licensee John Austin, Manager, Emergency Preparedness Manager

Mark Bergmeier, Operations Support Group Supervisor Vasant Bhardwaj, Engineering Support Manager Michael Boyce, Director of Projects Daniel Buman, System Engineering Manager Michael Colomb, General Manager of Plant Operations

Jeff Ehlers, Engineer, Electric Systems/I&C Roman Estrada, Corrective Action and Assessments Manager Jim Flaherty, Senior Staff Licensing Engineer Paul Fleming, Director of Nuclear Safety Assurance Scott Freborg, Valves Engineering Programs Supervisor Gabe Gardner, Design Engineering Civil Engineering Supervisor Gary Kline, Director of Engineering

Dave Madsen, Licensing Engineer Mark F Metzger, Engineer, Electric Systems/I&C Ole Olson, Engineer, Engineering Support & Risk Management Raymond Rexroad, Engineer, Electric Systems/I&C Todd Stevens, Manager-Design Engineering

Mark Unruh, Senior Staff Engineer David VanDerKamp, Licensing Manager Marshall VanWinkle, Design Engineering Mechanical Supervisor Dave Werner, Operations Training Support Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened 05000298/2008002-02 AV Failure to Establish Adequate Procedures for Maintenance of Emergency Diesel Generator Electrical Connections

Closed 05000298/2007-006-00 LER Procedural Guidance Leads to Rendering Second Diesel Inoperable 05000298/2007-007-00 LER Damaged Lead on Emergency Filter System Fan Motor Results in Loss of Safety Function

Opened and Closed

05000298/2008002-01 NCV Failure to Follow Scaffold Inspection Procedures

LIST OF DOCUMENTS REVIEWED The following is a partial list of documents reviewed during the inspection. Inclusion on this list does not imply that the NRC inspector reviewed the documents in their entirety, but rather that selected sections or portions of the documents were evaluated as part of the overall inspection

A1-2 Attachment 1 effort. Inclusion of a document on this list does not imply NRC acceptance of the document or any part of it, unless this is stated in the body of the inspection report.

1R07: Heat Sink Performance

Condition Report

CR-CNS-2008-00029 Procedures

Performance Evaluation Procedure 13.15.1, "Reactor Equipment Cooling Heat Exchanger Performance Analysis," Revision 27

Engineering Procedure 3.34, "Heat Exchanger Program," Revision 9

Work Orders

4592135 4592134 1R13: Maintenance Risk Assessments and Emergent Work Control

Procedures

EP5.1 WEATHER, "Operation During Weather Watches and Warnings," Revision 2 GOP 2.1.11, "Station Operator Tours," Revision 127

Procedure 0.49, "Schedule Risk Assessment," Revision 20 Procedure 0-PROTECT-EQP, "Protected Equipment Program," Revision 5

Work Order

WO 4618242

1R19: Post Maintenance Testing

Condition Reports

CR-CNS-2008-00720 CR-CNS-2008-00738

Procedures

SP 6.1HV.601, "Air Flow Test of Fan Coil Unit FC-R-1F (Div 1)," Revision 5 6.EE.606, "250 V Battery Charger Performance Test," Revision 19 MP 7.5.33, "SW-MO-650MV Dynamic Test," Revision 5 MP 7.3.14, "Thermal Examination of Plant Components," Revision 7

A1-3 Attachment 1 Work Orders

WO 4523441 WO 4532270 WO 4541631 WO 4532754

WO 4581466

1R22: Surveillance Testing

Condition Report

CR-CNS-02007-06517

Procedures

6.CAD.201, "North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing Test", Revision 12 T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0

T.S. Sec 5.5.6, CNS IST Program 6.1DG.401, "Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1)," Revision 24 EP 3.9, "ASME OM Code Testing of Pumps and Valves,," Revision 23 CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2 DCD-01, p. B-12, Revision dated October 28, 2006

SOP 2.2.12, "Diesel Fuel Oil transfer System," Revision 47 6.REC.201, "REC Motor Operated Valve Operability Test (IST)," Revision16 SR 6.2DG.101, "Diesel Generator 31 Day Operability Test (IST) (Div 2)," Revision 52

Work Order

WO 4578012

LIST OF ACRONYMS USED ASME American Society of Mechanical Engineers AV apparent violation CAP corrective action program

CFR Code of Federal Regulations

CR condition reports DG diesel generator

HX heat exchange(r) LCO limiting condition for operation LER licensee event report NCV noncited violation PI performance indicator PMT postmaintenance testing REC uranium hexafluoride

RHR residual heat removal TS Technical Specification UFSAR Updated Final Safety Analysis Report WO work order

A2-1 Attachment 2 Cooper Nuclear Station Failure of EDG 2 Speed Sensing Circuit SDP Phase 3 Analysis

Performance Deficiency:

Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was caused by a failure of an amphenol connection on the EDG speed sensing circuit.

Assumptions:

1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only during times that the diesel generator was running; specifically in response to the vibration of the operating engine. There is no assumption of accelerated degradation associated with diesel starts or any degradation while the unit was in standby. It is further assumed that the failure was a deterministic outcome set to occur after a specific number of operating hours.

The diesel was run at the following times:

09/13/07 - ran for 2 hrs 15 min 10/15/07 - ran for 5 hrs 45 min 11/13/07 - ran for 5 hrs 21 min 12/10/07 - ran for 5 hrs 51 min

01/14/08 - ran for 5 hrs 21 min (1700) 01/15/08 - failure less than one minute after starting 01/16/08- EDG 2 restored to a functional status (1700)

Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP

demand, or it was inoperable for maintenance, during the two-day period from January 14 to January 16, 2008.

Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following a LOOP demand at any time during the 35-day period from its last successful surveillance test

on December 10, 2007 until the test failure that occurred on January 14, 2008.

Prior to this date, EDG 2 would have run and failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the 27-day period from November 13, 2007 to December 10, 2007.

Prior to this date, EDG 2 would have run and failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during the 29-day period from October 15, 2007 to November 13, 2007.

Prior to this date, EDG 2 would have failed to run at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during the 32-day period from September 13, 2007 to October 15, 2007.

Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed

sensing circuit failure for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the mission time assumed in the SPAR model. Therefore, prior to this date no additional risk impact is assumed.

2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the outcome of any of the SPAR core damage sequences, the longest of which is 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> (as

modified by an extension to the battery duration (assumption #3). Adjustments made to the

A2-2 Attachment 2 performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training, unavailable procedures, and missing ergonomics) returned a failure probability of 0.56, including a very small contribution from the action steps of repairing the amphenol connection and re-starting the EDG, which are relatively simple.

The following table presents the diagnosis tabulation:

Diagnosis (0.01) Multiplier Action (0.001) Multiplier Available Time Expansive 0.01 Nominal 1 Stress Extreme 5 High 2 Complexity High 5 Nominal 1 Experience/Training Nominal 1 Nominal 1 Procedures Not Available 50 Nominal 1 Ergonomics Poor

10 Nominal 1 Product of Multipliers 125 2

Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558 Action HEP = 0.001(2) = 0.002

Total HEP = 0.56

For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit failure applies to sequences of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or greater. The only sequence that is less than 4 hours is a 30 minute sequence, for which no recovery of the amphenol connection is assumed. The SPAR model does not distinguish between cutsets that contain two or just one EDG

failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in this analysis, this feature of the SPAR model is not altered

3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge capability following a station blackout. Based on information received from the licensee, this credit was extended to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Although the batteries could potentially function beyond 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> under certain conditions other challenges related to the operation of RCIC and HPCI in station blackout conditions would be present. These challenges include the availability of adequate injection supply water and operational concerns of RCIC under high

back pressure conditions as a result of the unavailability of suppression pool cooling during an extended station blackout event.

4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to operate for the period of time before it is assumed to fail from the connector failure during

the various exposure periods. This introduces a slight inconsistency to the risk estimate, but because it would similarly affect both the base and current case, it does not significantly influence the result of this analysis.

5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed to be independent in nature. The reason for this determination is based on the following

A2-3 Attachment 2 reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine vibration while the EDG was running. Historically, EDG 2 has experienced vibration problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very unlikely that this type of failure would occur on both EDGs at the same time. The fact that it took 7 years of operation for EDG 2 to reach the point of failure also points to the

unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the exposure period of this finding.

Even if both EDGs were determined to be vulnerable to a speed sensor amphenol connection failure, there was no mechanism that would tend to cause both EDGs to fail

simultaneously. That is, the failure of one amphenol connection would not make failure of the other one more likely. Therefore, for this case, the failure of both EDGs from this issue would mathematically be modeled by the combined independent failures of both EDGs instead of by a classic common cause coupling mechanism. For this case, the estimated probability of an independent failure of EDG 1 from a failed amphenol connection during the exposure period would be a small number compared to its baseline SPAR fail-to-run probability and therefore this application would not appreciably affect the final result.

Finally, if EDG 1 had experienced problems with this connection, thereby making it comparatively vulnerable to the same type of failure; it is likely that the licensee would have taken more aggressive actions to address this issue, seeing that it affected both trains of emergency power. Therefore, the conditions necessary to create the possibility of a

common cause failure would also have triggered actions to prevent it.

The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.

The model was revised by INL to increase the battery life to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />, as discussed above. In addition, the timing of various sequences was lengthened based on data provided by the licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0), with an HEP of 0.15. However, based on observations by the senior resident inspector, the analyst concluded that credit for firewater injection should not be granted. This is because

barely enough time was available to perform the necessary actions and a valve that must be opened to establish a flow path was non-functional with a stem-disk separation for the entire period of exposure. There were other valves that could have been used in alternate lineups, but it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure the flow path.

Also, changes were made to the containment venting fault tree. In the original version, a loss of Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the vent function is possible by taking manual local actions to open the vent valves. The failure probability of this action was estimated based on an observed evolution conducted in response to questions concerning this analysis. This observation revealed that the actions needed to perform this function were dangerous and complex and would be conducted in poor lighting and

high temperatures. Also, operators had little experience. The recovery efforts applied to both a loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following SPAR-H analysis.

A2-4 Attachment 2 The diagnosis of the need to manually vent containment is obvious based on emergency operating procedures that direct this action when containment pressure reaches 25 psig. Operators would be continually monitoring this parameter, and it is very unlikely that the effort to manually vent containment would not be undertaken at 25 psig and possibly prior to this point.

For the action steps, approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of time are available from the time that containment

pressurizes to 25 psig until containment would fail. The nominal time needed to perform the manually venting task is estimated at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In this case, the relevant SPAR-H category for time is nominal. Extreme stress is chosen because the effort to manually open the vent valves involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to

the valves and performing several manipulations. Operators have little experience with this evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack of lighting.

Diagnosis (0.01) Multiplier Action (0.001) Multiplier Available Time Expansive 0.01 Nominal 1 Stress High 2 Extreme 5 Complexity Obvious 0.1 Moderate 2 Experience/Training Nominal 1 Low 3 Procedures Nominal 1 Nominal 1 Ergonomics Nominal 1 Poor 10 Product of Multipliers 0.002 300

Diagnosis HEP = 0.01(.002) = 2.0E-5 Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23

Total HEP = 0.23

To model the failure of the speed sensing circuit and its specific recovery, a new "and" gate was added to the "EDG 1B Faults" fault tree, with an input from two basic events (one modeling the speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are considered similar to the same for the various prior exposure periods. The common cause

probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets containing the independent failure of EDG 2 contribute to the delta CDF of this finding.

Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG recovery basic events were removed from cutsets that contained an EDG 2 speed sensor

failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery for those sequences.

Internal Events Analysis

A. Risk Estimate for the 2-day period between January 14 and January 16, 2006

During this 48-hour period, it is assumed that EDG 2 was completely unavailable either

because of maintenance or because it would have failed within one minute after a LOOP

A2-5 Attachment 2 demand. To represent the assumed failure and potential recovery of EDG 2, the new basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was set to 0.56.

The basis event EPS-DGN-CF-RUN was reset to its base case value of 4.172E-4 to ensure that cutsets containing common cause to run events would cancel out in the base and current case.

The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.

B. Risk Estimate for the 35-day period between December 10, 2006 and January 14, 2007: During this exposure period, EDG 2 is assumed to have been capable of running for 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />. The LOOP frequency used in the analysis was adjusted to reflect the situation that only LOOPs with durations greater than 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would result in a risk increase attributable to the speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is 0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

3.99E-3/yr.

Resetting event time t=0 to 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the LOOP event requires that the recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 7.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, given that recovery has failed at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />.

An adjustment to account for the diminishment of decay heat must be considered. This is because the magnitude of decay heat at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown is less than in the early moments following a reactor trip, and the timing of core damage sequences is

affected by this fact. In the modified SPAR model, recovery times for offsite power are set at the intervals of 30 minutes, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The analyst determined that the average decay heat level in the first 30 minutes is approximately two times the average level that exists between 5.35 and 6.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown. Therefore, baseline 30-minute SPAR model sequences, that essentially account for

boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences model safety relief valve failures to close, and are based more on inventory control than core heat production. Therefore, no adjustment was made for these sequences. The analyst determined that decay heat rates leveled out quickly following shutdown and could find no basis for adjusting the times associated with the 4 and 10-hour sequences.

The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:

A2-6 Attachment 2

SPAR recovery time SPAR base offsite power non-recovery

SPAR base offsite power non-recovery at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> SPAR base offsite power non-recovery at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.1112 0.0905

1 0.814 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.1112 0.0554 0.498 5 hours 0.1205 0.1112 0.0487 0.438 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.1112 0.0325 0.292 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.1112 0.0278 0.250

1. A SPAR recovery time of 1.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the lessening of decay heat

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, the result for the base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, which was 0.5934 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also, the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />). This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the onset of the LOOP and therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/35 days EDG1 FTS Recovered (EDG1 FTS Cutset total

times 0.5934) EDG1 FTS Recovered/35 days Remaining CDF (column 3- column 5) Base Case 6.989E-7 6.702E-8 3.686E-8 3.535E-9 6.348E-8 Current Case 1.394E-5 1.337E-6 4.706E-7 4.513E-8 1.292E-6

Delta CDF/35 days 1.229E-6

A2-7 Attachment 2 C. Risk Estimate for the 27-day period between November 13, 2007 and December 10, 2007: During this exposure period, EDG 2 is assumed to have been capable of running for 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs with durations greater than 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is 0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is 1.58E-3/yr.

Resetting event time t=0 to 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the LOOP event requires that the recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-recovery at 13.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, given that recovery has failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level in the first 30 minutes is approximately three times the average level that exists between 11 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences. The 2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 30 minutes each

The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:

SPAR recovery time SPAR base offsite power non-recovery

SPAR base offsite power non-recovery at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> SPAR base offsite power non-recovery at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.0441 0.0377

1 0.855 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0441 0.0292

2 0.662 5 hours 0.1205 0.0441 0.0271

2 0.615 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0441 0.0212

2 0.481 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0441 0.0191

2 0.433 1 A SPAR recovery time of 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is used, as discussed above, to account for the lessening of decay heat 2 The SPAR recovery time was increased by 30 minutes.

A2-8 Attachment 2 To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, the result for the base and the current case that contain an EDG 1 FTS event were multiplied by the success probability of recovering EDG 1 in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which was 0.7907 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also, the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours). This then would suggest that the EDG recovery terms in the SPAR model would coincide with the event time t=0 at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/27 days EDG1 FTS Recovered

(EDG1 FTS Cutset total times 0.7907) EDG1 FTS Recovered/27

days Remaining CDF (column

3- column 5) Base Case 4.332E-7 3.204E-8 3.168E-8 2.343E-9 2.970E-8 Current Case 9.216E-6 6.817E-7 4.216E-7 3.119E-8 6.505E-7

Delta CDF/27 days 6.208E-7 D. Risk Estimate for the 29-day period between October 15, 2007 and November 13, 2007: During this exposure period, EDG 2 is assumed to have been capable of running for 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> would result in a risk increase attributable to the speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is 0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is

9.87E-4/yr.

Resetting event time t=0 to 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the LOOP event requires that the recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-recovery at 18.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, given that recovery has failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as in the 5.35-hour case above. The analyst determined that the average decay heat level in the first 30 minutes is approximately four times the average level that exists between 16 and 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The

A2-9 Attachment 2 2-hour sequences model safety relief valve failures to close, and are based more on inventory control than core heat production. Therefore, no adjustment was made for these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:

SPAR recovery time SPAR base offsite power non-recovery

SPAR base offsite power non-recovery at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> SPAR base offsite power non-recovery at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.0275 0.0241

1 0.876 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0275 0.0203

2 0.738 5 hours 0.1205 0.0275 0.0192

2 0.698 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0275 0.0160

2 0.582 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0275 0.0148

2 0.538 1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the lessening of decay heat 2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the success probability of recovering EDG 1 in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, which was 0.8760 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours). This then would suggest that the EDG recovery terms in the SPAR model would coincide with the event time t=0 at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the onset of the LOOP and therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/29 days EDG1 FTS Recovered (EDG1 FTS Cutset total times 0.8760) EDG1 FTS Recovered/29 days Remaining CDF (column 3- column 5) Base Case 3.263E-7 2.593E-8 2.675E-8 2.125E-9 2.380E-8

A2-10 Attachment 2 Current Case 7.071E-6 5.618E-7 3.601E-7 2.861E-8 5.332E-7

Delta CDF/29 days 5.094E-7 E. Risk Estimate for the 32-day period between September 13, 2007 and October 15, 2007: During this exposure period, EDG 2 is assumed to have been capable of running for 22.3

hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with durations greater than 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> would result in a risk increase attributable to the speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is 0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> is 6.98E-4/yr.

Resetting event time t=0 to 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-recovery at 24.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, given that recovery has failed at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as in

the 5.35-hour case above. The analyst determined that the average decay heat level in the first 30 minutes is approximately four times the average level that exists between 22 and 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:

SPAR recovery time SPAR base offsite power non-recovery

SPAR base offsite power non-recovery at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> SPAR base offsite power non-recovery at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.0194 0.0177

1 0.912 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0194 0.0169

2 0.871 5 hours 0.1205 0.0194 0.0149

2 0.768 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0194 0.0134

2 0.691 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0194 0.0127

2 0.655

A2-11 Attachment 2 1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the lessening of decay heat 2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, the result for the base

and the current case that contain an EDG 1 FTS event were multiplied by the success probability of recovering EDG 1 in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, which was 0.9267 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,

the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (22.3 hours). This then would suggest that the EDG recovery terms in the SPAR model would coincide with the event time t=0 at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the onset of the LOOP and therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/32 days EDG1 FTS Recovered (EDG1 FTS Cutset total times 0.9267) EDG1 FTS Recovered/32 days Remaining CDF (column 3- column 5) Base Case 2.745E-7 2.407E-8 2.402E-8 2.106E-9 2.196E-8 Current Case 6.033E-6 5.289E-7 3.262E-7 2.860E-8 5.003E-7

Delta CDF/32 days 4.783E-7 The following table presents the aggregate internal events result:

TIME PERIOD DAYS OF EXPOSURE DELTA CDF 01/14/08 - 01/16/08 2 1.528E-7 12/10/07 - 01/14/08 35 1.229E-6 11/13/07 - 12/10/07 27 6.208E-7 10/15/07 - 11/13/07 29 5.094E-7 09/13/07 - 10/15/07 32 4.783E-7 Total Internal Events Delta-CDF 2.990E-6

External Events Analysis

The risk increase from fire initiating events was reviewed and determined to have a small impact on the risk of the finding. Two fire scenarios were identified where equipment damage could cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a control room fire that affected either Vertical Board F or Board C. The second was a fire in the

Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote because of the confined specificity of their locations and the fact that a combination of hot shorts of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced in this manner would be likely to succeed for the station blackout sequences that comprise the majority of the risk, because a minimum of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> of battery power would be available, power

A2-12 Attachment 2 would presumably be available in the switchyard, and the breaker manipulations needed to complete this task would be possible and within the capability of an augmented plant staff that would respond to the event.

Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2 power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no

change in risk from the finding.

The other type of fires that would result in a LOOP are those that require an evacuation of the control room. In this case, plant procedures require offsite power to be isolated from the vital buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With

the assumption that the Division 2 EDG will fail 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> into the event, a station blackout would occur at this time. The sequences that could lead to core damage would include a failure of the Division 1 EDG, such that ultimate success in averting core damage would rely on recovery of either EDG or of offsite power. A review of the onsite electrical distribution system did not reveal any particular difficulties in restoring switchyard power to the vital buses in this scenario, especially given that many hours are available to accomplish this task. The licensee confirmed that for all postulated fire scenarios that would require evacuation of the control room,

a undamaged and available power pathway exists from the switchyard through the emergency transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish this task would take only a few minutes.

In general, the fire risk importance for this finding is small compared to that associated with

internal events because onsite fires do not remove the availability of offsite power in the switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is presumed to occur as a consequence of such events as severe weather or significant electrical grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially non-functional (no run time remaining) is small because of a very low initiating event probability.

The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact on overall plant risk. When adjusted for the exposure period of this finding, the cumulative baseline core damage frequency for the zones that had the potential for a control room evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was

approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used several bounding assumptions. The analyst qualitatively assumed that the increase in risk from having EDG 2 in a status where it is assumed to fail at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would likely be somewhat less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

well less than 10 percent. Based on these considerations, the analyst concluded that the risk related to fires would not be sufficiently large to change the risk characterization of this finding.

The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue. As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope of the seismic risk particular to this finding. The generic median earthquake acceleration assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at

Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would

remove offsite power but not damage other equipment important to safe shutdown. In the

A2-13 Attachment 2 internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> duration would likely have recovery characteristics closely matching that from an earthquake. The ratio between these two frequencies is 44. Based on this, the analyst qualitatively concluded that the risk associated with seismic events would be small compared to the internal result.

Flooding could be a concern because of the proximity to the Missouri River. However, floods that would remove offsite power would also likely flood the EDG compartments and therefore not result in a significant change to the risk associated with the finding. The switchyard elevation is below that of the power block by several feet, but it is not likely that a slight inundation of the switchyard would cause a loss of offsite power. The low frequency of floods within the thin slice of water elevations that would remove offsite power for at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> but not debilitate the diesel generators indicates that external flooding would not add appreciably to the risk of this finding.

Based on the above, the analyst determined that external events did not add significantly to the risk of the finding.

Large Early Release Frequency

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences

to determine an estimate of the change in large early release frequency caused by the finding.

The LERF consequences of this performance deficiency were similar to those documented in a previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service water pumps. The final determination letter was issued on March 31, 2005 and is located in

ADAMS, Accession No. ML050910127. The following excerpt from this document addressed the LERF issue:

The NRC reevaluated the portions of the preliminary significance determination related to the change in LERF. In the regulatory conference, the licensee argued that the

dominant sequences were not contributors to the LERF. Therefore, there was no change in LERF resulting from the subject performance deficiency. Their argument was based on the longer than usual core damage sequences, providing for additional time to core damage, and the relatively short time estimated to evacuate the close in population surrounding Cooper Nuclear Station.

LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process" as: "the frequency of those accidents leading to significant, unmitigated release from containment in a time frame prior to the effective evacuation of the close-in population such that there is a potential for early health effect." The NRC noted that the dominant core damage sequences documented in the preliminary significance determination were long sequences that took greater than

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to proceed to reactor pressure vessel breach. The shortest calculated interval from the time reactor conditions would have met the requirements for entry into a general emergency (requiring the evacuation) until the time of postulated containment rupture was 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The licensee stated that the average evacuation time for Cooper, from the declaration of a General Emergency was 62 minutes.

A2-14 Attachment 2 The NRC determined that, based on a 62-minute average evacuation time, effective evacuation of the close-in population could be achieved within 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Therefore, the dominant core damage sequences affected by the subject performance deficiency were not LERF contributors. As such, the NRC's best estimate determination of the change in LERF resulting from the performance deficiency was zero.

In the current analysis, the total contribution of the 30-minute sequences for the 35-day period (when 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> of EDG run time remained) to the current case CDF is only 0.54% of the total. That is, almost all of the risk associated with this performance deficiency involves sequences of duration 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> or longer following the loss of all ac power.

The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the two-hour sequences comprise only 0.3 percent of the total.

Consequently, the analyst determined that the risk associated with large early release was very small. References

SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004 GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary) Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1

NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-2004"

Peer Review

See-Meng Wong, NRR George McDonald, NRR