ML081270639: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
 
(Created page by program invented by StriderTol)
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
#REDIRECT [[IR 05000298/2008002]]
{{Adams
| number = ML081270639
| issue date = 05/06/2008
| title = IR 05000298-08-002; on 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications and Postmaintenance Testing
| author name = Chamberlain D
| author affiliation = NRC/RGN-IV/DRP
| addressee name = Minahan S
| addressee affiliation = Nebraska Public Power District (NPPD)
| docket = 05000298
| license number = DPR-046
| contact person =
| case reference number = EA-08-124
| document report number = IR-08-002
| document type = Inspection Report, Letter
| page count = 42
}}
See also: [[see also::IR 05000298/2008002]]
 
=Text=
{{#Wiki_filter:UNITED STATES
                                NUC LE AR RE G UL AT O RY C O M M I S S I O N
                                                    R E GI ON I V
                                        612 EAST LAMAR BLVD , SU I TE 400
                                        AR LI N GTON , TEXAS 76011-4125
                                              May 6, 2008
EA 08-124
Stewart B. Minahan
Vice President - Nuclear and CNO
Nebraska Public Power District
PO Box 98
Brownville NE 68321
SUBJECT:        COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION
                REPORT 05000298/2008002
Dear Mr. Minahan:
On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated
inspection at your Cooper Nuclear Station. The enclosed report documents the inspection
results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant
Operations, and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and
compliance with the Commissions rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed
personnel.
As described in Section 1R19 of this report, the NRC concluded that the failure to establish
adequate procedural controls for the maintenance of electrical connections on diesel generators
led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety
significance of this finding was assessed on the basis of the best available information, including
influential assumptions, using the applicable Significance Determination Process and was
preliminarily determined to be a White (low to moderate safety significance) finding.
Attachment 2 of this report provides a detailed description of the preliminary risk assessment.
In accordance with NRC Inspection Manual Chapter 0609, Significance Determination
Process, we intend to complete our evaluation using the best available information and issue
our final determination of safety significance within 90 days of this letter.
This finding does not represent an immediate safety concern because of the corrective actions
you have taken. These actions included applying thread locking compound to the amphenol
connections on both diesel generators.
Also, this finding constitutes an apparent violation of NRC requirements and is being
considered for escalated enforcement action in accordance with the NRC Enforcement
Policy. The current Enforcement Policy is included on the NRCs Web site at
http://www.nrc.gov/reading-rm/adams.html. This significance determination process
encourages an open dialog between the staff and the licensee, however the dialogue should not
impact the timeliness of the staffs final determination.
 
Nebraska Public Power District                    -2-
Before we make a final decision on this matter, we are providing you an opportunity (1) to
present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive
at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the
finding to the NRC in writing. If you request a Regulatory Conference, it should be held within
30 days of the receipt of this letter and we encourage you to submit documentation at least one
week prior to the conference in an effort to make the conference more efficient and effective. If
a Regulatory Conference is held, it will be open for public observation. If you decide to submit
only a written response, such submittal should be sent to the NRC within 30 days of the receipt
of this letter. If you decline to request a regulatory conference or submit a written response,
your ability to appeal the final SDP determination can be affected, in that by not doing either you
fail to meet the appeal requirements stated in the prerequisite and limitation sections of
Attachment 2 of IMC 0609.
Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision and you will be advised
by separate correspondence of the results of our deliberation on this matter.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for the inspection finding at this time. In addition, please be advised that the number and
characterization of the apparent violation described in the enclosed inspection report may
change as a result of further NRC review.
The report also documents one finding which was evaluated under the risk SDP as having very
low safety significance (Green). The finding was determined to involve a violation of NRC
requirements. However, because of very low safety significance, and because the issue was
entered into your corrective action program, the NRC is treating the issue as a noncited violation
in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject
or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of
this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory
Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the
Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza
Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.
Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector
Office at the Cooper Nuclear Station.
 
Nebraska Public Power District                -3-
In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter
and its enclosure will be made available electronically for public inspection in the NRC
Public Document Room or from the Publicly Available Records (PARS) component of
NRCs document system (ADAMS), accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
                                            Sincerely,
                                            /RA/
                                            Dwight D. Chamberlain, Director
                                            Division of Reactor Projects
Docket No:    50-298
License No:    DPR-46
Enclosure:
NRC Inspection Report 05000298/2008002
w/Attachments:
Attachment 1: Supplemental Information
Attachment 2: Preliminary Risk Assessment
  cc w/enclosure:
                                                                  John C. McClure, Vice President
  Gene Mace
                                                                    and General Counsel
  Nuclear Asset Manager
                                                                  Nebraska Public Power District
  Nebraska Public Power District
                                                                  P.O. Box 499
  P.O. Box 98
                                                                  Columbus, NE 68602-0499
  Brownville, NE 68321
  David Van Der Kamp                                              Michael J. Linder, Director
  Licensing Manager                                              Nebraska Department of
  Nebraska Public Power District                                    Environmental Quality
  P.O. Box 98                                                    P.O. Box 98922
  Brownville, NE 68321                                            Lincoln, NE 68509-8922
                                                                  Julia Schmitt, Manager
                                                                  Radiation Control Program
  Chairman
                                                                  Nebraska Health & Human Services
  Nemaha County Board of Commissioners
                                                                  Dept. of Regulation & Licensing
  Nemaha County Courthouse
                                                                  Division of Public Health Assurance
  1824 N Street
                                                                  301 Centennial Mall, South
  Auburn, NE 68305
                                                                  P.O. Box 95007
                                                                  Lincoln, NE 68509-5007
 
Nebraska Public Power District            -4-
H. Floyd Gilzow
                                              Director, Missouri State Emergency
Deputy Director for Policy
                                                Management Agency
Missouri Department of Natural Resources
                                              P.O. Box 116
P. O. Box 176
                                              Jefferson City, MO 65102-0116
Jefferson City, MO 65102-0176
Chief, Radiation and Asbestos                Melanie Rasmussen, State Liaison Officer/
  Control Section                              Radiation Control Program Director
Kansas Department of Health                  Bureau of Radiological Health
  and Environment                            Iowa Department of Public Health
Bureau of Air and Radiation                  Lucas State Office Building, 5th Floor
1000 SW Jackson, Suite 310                  321 East 12th Street
Topeka, KS 66612-1366                        Des Moines, IA 50319
John F. McCann, Director, Licensing          Keith G. Henke, Planner
Entergy Nuclear Northeast                    Division of Community and Public Health
Entergy Nuclear Operations, Inc.            Office of Emergency Coordination
440 Hamilton Avenue                          930 Wildwood, P.O. Box 570
White Plains, NY 10601-1813                  Jefferson City, MO 65102
                                              Ronald L. McCabe, Chief
Paul V. Fleming, Director of Nuclear        Technological Hazards Branch
  Safety Assurance                            National Preparedness Division
Nebraska Public Power District              DHS/FEMA
P.O. Box 98                                  9221 Ward Parkway
Brownville, NE 68321                        Suite 300
                                              Kansas City, MO 64114-3372
 
Nebraska Public Power District                -5-
Electronic distribution by RIV:
Regional Administrator (Elmo.Collins@nrc.gov)
DRP Director (Dwight.Chamberlain@nrc.gov)
DRS Director (Roy.Caniano@nrc.gov)
DRS Deputy Director (Troy.Pruett@nrc.gov)
Senior Resident Inspector (Nick.Taylor@nrc.gov)
Branch Chief, DRP/C (Rick.Deese@nrc.gov)
Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)
Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)
RITS Coordinator (Marisa.Herrera@nrc.gov)
Only inspection reports to the following:
DRS STA (Dale.Powers@nrc.gov)
J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)
P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)
ROPreports
CNS Site Secretary (Sue.Farmer@nrc.gov)
SUNSI Review Completed: WCW              ADAMS: ; Yes  No        Initials: WCW
; Publicly Available        Non-Publicly Available  Sensitive    ; Non-Sensitive
R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc                                  ML081270639
RIV:SRI:DRP/C RI:DRP/C              SPE:DRP/C DRS:SRA          C:DRS/OB        C:DRS/EB2
NHTaylor          MLChambers WCWalker          MFRunyan      RELantz          LJSmith
E-Walker          /RA/ E-mailed /RA/            /RA/          /RA/            /RA/
4/24/08            4/23/08          4/24 /08    4/24/08        4/24/08          4/23/08
C:DRS/EB1          C:DRS/PSB        C:DRP/C      ACES:SES D:DRP
RLBywater          MPShannon RWDeese            GMVasquez DDChamberlain
/RA/              /RA/                          /RA/          /RA/
4/22/08            4/22/08          4/ /08      4/24/08        5/02/08
OFFICIAL RECORD COPY                  T=Telephone      E=Email            F=Fax
 
              U. S. NUCLEAR REGULATORY COMMISSION
                                REGION IV
Docket No:  05000298
License No:  PR-46
Report No:  5000298/2008002
Licensee:    Nebraska Public Power District
Facility:    Cooper Nuclear Station
Location:    PO Box 98, Brownville, NE 68321
Dates:      January 1 through March 22, 2008
Inspectors:  N. Taylor, Senior Resident Inspector
            M. Chambers, Resident Inspector
            P. Elkmann, Emergency Preparedness Inspector
            M. Runyan, Senior Reactor Analyst
Approved by: D. Chamberlain, Director
            Division of Reactor Projects
                                    -1-                  Enclosure
 
                                        SUMMARY OF FINDINGS
IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications
and Postmaintenance Testing.
This report covers a three-month period of inspection by resident inspectors and announced
baseline inspections by regional inspectors. The significance of most findings is indicated by
their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance
Determination Process. Findings for which the Significance Determination Process does not
apply may be Green or be assigned a severity level after NRC management review. The NRCs
program for overseeing the safe operation of commercial nuclear power reactors is described in
NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.
A.      NRC-Identified and Self-Revealing Findings
        Cornerstone: Mitigating Systems
        *      Green. The inspectors identified a Green noncited violation of Technical
                Specification 5.4.1.a regarding the licensees failure to follow the requirements of
                Maintenance Procedure 7.0.7, Scaffolding Construction and Control.
                Specifically, licensee personnel failed to inspect all existing scaffolds and failed
                to identify multiple scaffolding interactions with safety-related equipment during a
                required annual scaffold inspection on January 21, 2008. This issue was
                entered Into the licensees corrective action program as Condition
                Report CR-CNS-2008-01576.
                The finding is more than minor because if left uncorrected the failure to perform
                annual scaffold inspections could become a more significant safety concern.
                Specifically, annual inspections failed to inspect all existing scaffolds and failed to
                identify multiple scaffolding interactions with safety-related equipment. Using the
                Manual Chapter 0609, Significance Determination Process, Phase 1
                Worksheet, the finding is determined to have a very low safety significance
                because it did not result in the loss of function of a Technical Specification
                required system for greater than its allowed outage time. The cause of this
                finding is related to the human performance crosscutting component of work
                practices because maintenance personnel did not follow the requirements of
                Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).
        *      TBD. Two examples of a self-revealing apparent violation of Technical
                Specification 5.4.1.a were identified regarding the licensees failure to establish
                procedural controls for maintenance of electrical connections on essential
                equipment. In the first example, the licensee failed to include amphenol
                connections within the scope of existing periodic electrical connection inspections
                to identify loosening connections. In the second example, the licensee failed to
                incorporate internal operating experience into work control procedures to ensure
                that diesel generator-mounted amphenol connections were solidly attached
                following maintenance. These failures to establish adequate procedural controls
                led to the trip of Diesel Generator 2 during testing on January 15, 2008. This
                issue was entered into the licensees corrective action program as Condition
                Report CR-CNS 2008-00304.
                                                  -2-                                      Enclosure
 
          The finding affected the mitigating systems cornerstone and is more than minor
          because it is associated with the cornerstone attribute of equipment performance
          and affects the associated cornerstone objective to ensure the availability,
          reliability, and capability of systems that respond to initiating events to prevent
          undesirable consequences. The Phase 1 worksheets in Inspection Manual
          Chapter 0609, "Significance Determination Process," were used to conclude that
          a Phase 2 analysis was required because the finding represents an actual loss of
          safety function of a single train for greater than its Technical Specification
          allowed outage time (7 days). A Phase 2 risk analysis was conducted using the
          guidance of Manual Chapter 0609, Appendix A, Determining the Significance of
          Reactor Inspection Findings for At-Power Situations. Entering the site-specific
          pre-solved table with an assumed exposure time of greater than 30 days yielded
          a result of red, or very high significance. A Phase 3 analysis conducted by a risk
          analyst preliminarily determined the finding to be of white, or low to moderate
          significance. The cause of the finding is related to the corrective action
          component of the crosscutting area of problem identification and resolution in
          that the licensee failed to take appropriate corrective actions for a 2007 NRC
          inspection finding which identified inadequate maintenance procedures for
          checking the tightness of diesel generator electrical connections (P.1(d))
          (Section 71111.19).
B. Licensee-Identified Violations
  No violations of significance were identified.
                                            -3-                                      Enclosure
 
                                          REPORT DETAILS
Summary of Plant Status
The plant began the inspection period at 100 percent power. On February 19, 2008, the plant
began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from
90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump
motor Generator B. The reactor was returned to full power later in the day, where it remained
for the rest of the inspection period.
1.      REACTOR SAFETY
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency
                  Preparedness
1R04 Equipment Alignment (71111.04)
  .1    Quarterly Partial System Walkdowns
    a.  Inspection Scope
        The inspectors selected these systems based on their risk significance relative to the
        reactor safety cornerstones at the time they were inspected. The inspectors attempted
        to identify any discrepancies that could impact the function of the system, and, therefore,
        potentially increase risk. The inspectors reviewed applicable operating procedures,
        system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical
        Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),
        condition reports (CR), and the impact of ongoing work activities on redundant trains of
        equipment in order to identify conditions that could have rendered the systems incapable
        of performing their intended functions. The inspectors also walked down accessible
        portions of the systems to verify system components and support equipment were
        aligned correctly and operable. The inspectors examined the material condition of the
        components and observed operating parameters of equipment to verify that there were
        no obvious deficiencies. The inspectors also verified that the licensee had properly
        identified and resolved equipment alignment problems that could cause initiating events
        or impact the capability of mitigating systems or barriers and entered them into the
        corrective action program (CAP) with the appropriate significance characterization.
        Documents reviewed are listed in the attachment.
        The inspectors performed partial system walkdowns of the following risk-significant
        systems:
        *        January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B
                  during REC HX A limiting condition for operation (LCO)
        *        February 28, 2008, Service Water Train B during Diesel Generator (DG) LCO
        *        March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO
        The inspectors completed three samples.
                                                  -4-                                    Enclosure
 
  b.  Findings
        No findings of significance were identified.
.2    Semi-Annual Complete System Walkdown
  a.  Inspection Scope
        On March 11, 2008 the inspectors performed a complete system alignment inspection of
        the DG 1 to verify the functional capability of the system. This system was selected
        because it was considered both safety-significant and risk-significant in the licensees
        probabilistic risk assessment. The inspectors walked down the system to review
        mechanical and electrical equipment line ups, electrical power availability, system
        pressure and temperature indications, as appropriate, component labeling, component
        lubrication, component and equipment cooling, hangers and supports, operability of
        support systems, and to ensure that ancillary equipment or debris did not interfere with
        equipment operation. A review of a sample of past and outstanding WOs was
        performed to determine whether any deficiencies significantly affected the system
        function. In addition, the inspectors reviewed the CAP database to ensure that system
        equipment alignment problems were being identified and appropriately resolved.
      *        March 11, 2008, DG 1 during DG 2 LCO
      Documents reviewed by the inspectors included:
        *      CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel
              Generator), Revision 70
        These activities constituted one complete system walkdown sample as defined by
        Inspection Procedure 71111.04-05.
  b.  Findings
        No findings of significance were identified.
1R05 Fire Protection (71111.05AQ)
    a. Inspection Scope
        The inspectors conducted fire protection walkdowns which were focused on availability,
        accessibility, and the condition of firefighting equipment.
        The inspectors reviewed areas to assess if the licensee had implemented a fire
        protection program that adequately controlled combustibles and ignition sources within
        the plant, effectively maintained fire detection and suppression capability, maintained
        passive fire protection features in good material condition, and had implemented
        adequate compensatory measures for out of service, degraded or inoperable fire
        protection equipment, systems, or features in accordance with the licensees fire plan.
        The inspectors selected fire areas based on their overall contribution to internal fire risk
        as documented in the plants Individual Plant Examination of External Events with later
        additional insights, their potential to impact equipment which could initiate or mitigate a
                                                  -5-                                    Enclosure
 
      plant transient, or their impact on the plants ability to respond to a security event. Using
      the documents listed in the attachment, the inspectors verified that fire hoses and
      extinguishers were in their designated locations and available for immediate use; that
      fire detectors and sprinklers were unobstructed, that transient material loading was
      within the analyzed limits; and fire doors, dampers, and penetration seals appeared to
      be in satisfactory condition. The inspectors also verified that minor issues identified
      during the inspection were entered into the licensees corrective action program.
      *        February 13, 2008, Fire Zone 2C during fuel movement
      *        March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO
      *        March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO
      *        March 15, 2008, Fire Zone 19C Controlled Access Corridor
      Documents reviewed by the inspectors included:
      *      CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated
              February 28, 2003
      *      CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated
              November 5, 2007
      These activities constituted four quarterly fire protection inspection samples as defined
      by Inspection Procedure 71111.05-05.
  b. Findings
      No findings of significance were identified.
1R07 Annual Heat Sink Performance (71111.07)
  a.  Inspection Scope
      The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify
      that potential deficiencies did not mask the licensees ability to detect degraded
      performance, to identify any common cause issues that had the potential to increase
      risk, and to ensure that the licensee was adequately addressing problems that could
      result in initiating events that would cause an increase in risk. The inspectors reviewed
      the licensees observations as compared against acceptance criteria, the correlation of
      scheduled testing and the frequency of testing, and the impact of instrument
      inaccuracies on test results. Inspectors also verified that test acceptance criteria
      considered differences between test conditions, design conditions, and testing
      conditions.
      *        January 25 and January 21, 2008, A and B REC HX performance tests
      Documents reviewed are listed in the attachment.
      This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.
                                              -6-                                        Enclosure
 
  b. Findings
    No findings of significance were identified.
1R11 Licensed Operator Requalification Program (71111.11)
    Conformance With Simulator Requirements Specified in 10 CFR 55.46
  a. Inspection Scope
    The inspectors observed testing and training of senior reactor operators and reactor
    operators to identify deficiencies and discrepancies in the training, to assess operator
    performance, and to assess the evaluator's critique. The training scenario involved a
    tornado, station blackout and a loss of shutdown cooling.
    *      February 28, 2008, Crew E drill
    Documents reviewed by the inspectors included:
    *      Lesson SKL054-01-28, Tornado, Station Blackout, Loss of Shutdown Cooling
    The inspectors completed one sample.
  b. Findings
    No findings of significance were identified.
1R12 Maintenance Effectiveness (71111.12)
  a. Inspection Scope
    The inspectors evaluated degraded performance issues involving the risk significant
    systems of events such as where ineffective equipment maintenance has resulted in
    valid or invalid automatic actuations of engineered safeguards systems and
    independently verified the licensee's actions to address system performance or condition
    problems in terms of the following:
    *      implementing appropriate work practices;
    *      identifying and addressing common cause failures;
    *      scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
    *      characterizing system reliability issues for performance;
    *      charging unavailability for performance;
    *      trending key parameters for condition monitoring;
    *      ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and
                                              -7-                                      Enclosure
 
    *        verifying appropriate performance criteria for structures, systems, and
              components (SSCs) functions classified as (a)(2) or appropriate and adequate
              goals and corrective actions for systems classified as (a)(1).
    The inspectors assessed performance issues with respect to the reliability, availability,
    and condition monitoring of the system. In addition, the inspectors verified maintenance
    effectiveness issues were entered into the corrective action program with the appropriate
    significance characterization.
    *        March 19, 2008, Reactor protection system (RPS) electronic protection
              assembly (EPA) breaker failures January 12, 2008
    *        March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008
    Documents reviewed by the inspectors included:
    *        Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1
    *        Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC
    This inspection constitutes two quarterly maintenance effectiveness samples as defined
    in Inspection Procedure 71111.12-05.
  b. Findings
    No findings of significance were identified.
1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)
  a. Inspection Scope
    The inspectors reviewed the licensee's evaluation and management of plant risk for the
    maintenance and emergent work activities affecting risk-significant and safety-related
    equipment listed below to verify that the appropriate risk assessments were performed
    prior to removing equipment for work:
    *        March 6, 2008, Inoperability of both DGs on September 11, 2007
    *        March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008
    These activities were selected based on their potential risk significance relative to the
    reactor safety cornerstones. As applicable for each activity, the inspectors verified that
    risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate
    and complete. When emergent work was performed, the inspectors verified that the
    plant risk was promptly reassessed and managed. The inspectors reviewed the scope
    of maintenance work, discussed the results of the assessment with the licensee's
    probabilistic risk analyst or shift technical engineer, and verified plant conditions were
    consistent with the risk assessment. The inspectors also reviewed TS requirements and
    walked down portions of redundant safety systems, when applicable, to verify risk
    analysis assumptions were valid and applicable requirements were met. Documents
    reviewed are listed in the attachment.
    The inspectors completed two samples.
                                                -8-                                      Enclosure
 
  b. Findings
    No findings of significance were identified.
1R15 Operability Evaluations (71111.15)
  a. Inspection Scope
    The inspectors reviewed the following issues:
    The inspectors selected these potential operability issues based on the risk-significance
    of the associated components and systems. The inspectors evaluated the technical
    adequacy of the evaluations to ensure that TS operability was properly justified and the
    subject component or system remained available such that no unrecognized increase in
    risk occurred. The inspectors compared the operability and design criteria in the
    appropriate sections of the TS and UFSAR to the licensees evaluations, to determine
    whether the components or systems were operable. Where compensatory measures
    were required to maintain operability, the inspectors determined whether the measures
    in place would function as intended and were properly controlled. The inspectors
    determined, where appropriate, compliance with bounding limitations associated with the
    evaluations. Additionally, the inspectors also reviewed a sampling of corrective action
    documents to verify that the licensee was identifying and correcting any deficiencies
    associated with operability evaluations.
    *      January 14, 2008, DG 2 operability and common cause evaluation for loss of
            overspeed governor sightglass during run
    *      January 15, 2008, operability evaluation of control room Board C non-essential
            meters without isolation devices in DG 1 and DG 2 essential circuits, on January
            14, 2008
    *      February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in
            DG 2
    *      March 19, 2008, RPS EPA circuit breakers operability evaluations on
            January 25, 2008 and February 6, 2008
    This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.
  b. Findings
    No findings of significance were identified.
1R18 Plant Modifications (71111.18)
    Temporary Modifications
  a. Inspection Scope
    The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs
    to ensure that temporary alterations and configuration changes to the plant conformed to
                                            -9-                                    Enclosure
 
  these guidance documents and the requirements of 10 CFR 50.59. The inspectors:
  (1) verified that the modifications did not have an affect on system operability/availability;
  (2) verified that the installations were consistent with modification documents;
  (3) ensured that the post-installation test results were satisfactory and that the impacts of
  the temporary modifications on permanently installed SSCs were supported by the test;
  and (4) verified that appropriate safety evaluations were completed. The inspectors
  reviewed the following temporary modifications:
  *        March 19, 2008, Long term scaffolding program review
  Documents reviewed by the inspectors included:
  *        Maintenance Procedure 7.0.7, Scaffolding Construction and Control,
            Revision 24
  The inspectors completed one sample.
b. Findings
  Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a
  regarding the licensees failure to follow the requirements of Maintenance Procedure
  7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to
  inspect all existing scaffolds and failed to identify multiple scaffolding interactions with
  safety-related equipment during a required annual scaffold inspection on January 21,
  2008.
  Description. During pre-outage scaffold inspections on February 7, 2008, the licensee
  discovered that some existing scaffolds were not built in accordance with established
  procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had
  been built in contact with safety-related service water piping, RHR piping, pipe hangers,
  electrical conduit and the torus shell. This condition was documented in
  CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of
  the impacted safety systems, the licensee took actions to remove the non-compliant
  scaffold on February 22, 2008, and closed the CR.
  The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and
  Control, Revision 24, contains the following requirement in Paragraph 3.2:
      During the month of January, all erected scaffolds shall have an Industrial
      Safety examination performed to ensure compliance with this procedure. This
      examination is required prior to placing a new tag and entering the scaffold into
      the new calendar year log.
  The inspectors also noted that the required annual examination had been completed on
  January 21, 2008. The maintenance personnel who conducted the examination in
  WO 4552687 documented completion with no discrepancies.
  On March 6, 2008, the inspectors questioned licensee management regarding the
  performance of the annual scaffold examinations. Specifically, the inspectors asked why
  the non-compliant scaffold had not been identified during the required annual scaffold
  examinations. Following this meeting, the licensee conducted a scaffolding walkdown to
                                            - 10 -                                    Enclosure
 
identify any remaining non-compliances. The following additional violations of
Procedure 7.0.7 were discovered during this walkdown:
*        Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had
        a board in contact with high pressure coolant injection steam line drip
        leg piping. Contrary to Procedure 7.0.7, this scaffold had not been
        inspected due to a misperception that only long term scaffolds that
        had been in place greater than 90 days needed to be inspected. The
        licensee documented this condition in CR-CNS-2008-01551.
*        Scaffold 08-06 was discovered to be in contact with safety-related
        conduit and pipe hangers in the torus area. The licensee was unable to
        determine when this scaffold had been installed.
*        Eight examples of non-compliant scaffolding handrails were discovered
        in contact with safety system components in the torus area which had
        been installed in 2002. This example, documented in
        CR-CNS-2008-01563 on March 11, 2008 was not identified by the
        annual examination because it was not included in the scaffold log and
        was therefore not inspected.
The inspectors determined that Procedure 7.0.7 had been violated during the
January 21, 2008 annual scaffolding examination in that the examiner reviewed only
those scaffolds identified in the scaffolding log as Long Term Permanent versus all
erected scaffolds as required by the procedure. As a result, seven existing scaffolds
were not inspected, despite the fact that some of them had been installed for more than
one year at the time of the inspection. In addition, the examiner did not conduct a
thorough inspection to ensure compliance with this procedure. Obvious non-
compliances existed in some of the installed scaffolds that were not identified until
months later.
The inspectors also noted that since handrails built from scaffolding materials do not
meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an
elevated platform, no annual inspections have been performed on these structures.
Analysis. The performance deficiency associated with this finding involved the
licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,
Scaffolding Construction and Control. The finding is more than minor because if left
uncorrected the failure to perform annual scaffold inspections could become a more
significant safety concern. Specifically, annual inspections failed to inspect all existing
scaffolds and failed to identify multiple scaffolding interactions with safety-related
equipment. Using the Manual Chapter 0609, Significance Determination Process,
Phase 1 Worksheet, the finding is determined to have a very low safety significance
because it did not result in the loss of function of a TS required system for greater than
its allowed outage time. The cause of this finding is related to the human performance
crosscutting component of work practices because maintenance personnel did not follow
the requirements of Maintenance Procedure 7.0.7 (H.4(b)).
Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,
and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,
Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,
                                        - 11 -                                    Enclosure
 
    requires that maintenance that can affect the performance of safety-related equipment
    should be properly pre-planned and performed in accordance with written procedures.
    Contrary to this requirement, on January 21, 2008, maintenance personnel violated the
    requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in
    that they did not inspect all required scaffolds or identify obvious non-compliances with
    Procedure 7.0.7. Because the finding is of very low safety significance and has been
    entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated
    as an NCV consistent with Section VI.A of the Enforcement Policy: NCV
    05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.
1R19 Postmaintenance Testing (71111.19)
  a. Inspection Scope
    These activities were selected based upon the SSCs ability to impact risk. The
    inspectors evaluated these activities for the following (as applicable): the effect of testing
    on the plant had been adequately addressed; testing was adequate for the maintenance
    performed; acceptance criteria were clear and demonstrated operational readiness; test
    instrumentation was appropriate; tests were performed as written in accordance with
    properly reviewed and approved procedures; equipment was returned to its operational
    status following testing (temporary modifications or jumpers required for test
    performance were properly removed after test completion), and test documentation was
    properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10
    CFR Part 50 requirements, licensee procedures, and various NRC generic
    communications to ensure that the test results adequately ensured that the equipment
    met the licensing basis and design requirements. In addition, the inspectors reviewed
    corrective action documents associated with postmaintenance tests to determine
    whether the licensee was identifying problems and entering them in the CAP and that
    the problems were being corrected commensurate with their importance to safety.
    Documents reviewed are listed in the attachment.
    The inspectors reviewed the following postmaintenance activities to verify that
    procedures and test activities were adequate to ensure system operability and functional
    capability:
    *      March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008
    *      March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008
    *      March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and
            thermography
    *      March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008
    *      March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008
    The inspectors completed five samples.
                                            - 12 -                                    Enclosure
 
b. Findings
  Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical
  Connections
  Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were
  identified regarding the licensees failure to establish procedural controls for
  maintenance of electrical connections on essential equipment. In the first example, the
  licensee failed to include amphenol connections within the scope of existing periodic
  electrical connection inspections to identify loosening connections. In the second
  example, the licensee failed to incorporate internal operating experience into work
  control procedures to ensure that DG-mounted amphenol connections were solidly
  attached following maintenance. These failures to establish adequate procedural
  controls led to the trip of DG 2 during testing on January 15, 2008.
  Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a
  postmaintenance test. The test was being conducted to verify the ability of DG 2 to
  perform its safety function following repairs to the overspeed governor oil level sight
  glass. The licensee determined that the cause of the trip of DG 2 was a loose
  amphenol-type connection on the relay tachometer speed sensing circuit magnetic
  pickup.
  The licensee determined that this failure was similar in nature to a condition identified
  during previous troubleshooting of DG 2. On December 10, 1995, operations personnel
  initiated a CR to document that the amphenol connector on a DG mounted magnetic
  pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the
  licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors
  and apply thread locking compound to the amphenol threads to keep the connection
  from vibrating loose. The completion of these actions was documented in Minor
  Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions
  were taken to codify the use of thread locking compounds or other measures to prevent
  the amphenol connections from coming unthreaded during engine operation.
  During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm
  was unexpectedly received, as described in CR 4-13285. Minor Maintenance
  WO 003915 was initiated to determine the cause of the unexpected alarm. During
  completion of this WO on December 29, 2000, maintenance personnel replaced the
  relay tachometer and the associated MPU, and the associated amphenol connection
  was disconnected and then reconnected.
  In the first example of this performance deficiency, the inspectors determined that the
  licensees procedures for performing periodic DG electrical examinations were
  inadequate in that they did not include engine-mounted components. Maintenance
  Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was
  created on September 30, 1988 to perform periodic (once per operating cycle)
  preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC
  identified an NCV regarding the licensees failure to establish adequate instructions for
  emergency DG electrical maintenance (see NRC Special Inspection
  Report 05000298/2007007). Two of the three examples described in the NCV dealt with
  inadequate work instructions for checking the tightness of electrical connections on DG
  system components. In response to this NCV, the licensee initiated Corrective Action #8
                                            - 13 -                                  Enclosure
 
under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically
check the DG systems for loose connections. In developing a revision to Maintenance
Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the
licensee made the erroneous assumption that all engine-mounted components have
other maintenance actions that satisfy the intent of the corrective action. As such,
engine-mounted connections were not included in the scope of the inspections in
Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised
procedure was subsequently completed for DG 2 on September 13, 2007. The
assumption was in error and resulted in a recently missed opportunity to discover the
loosening amphenol connection on the DG 2 relay tachometer MPU.
In the second example of this performance deficiency, the licensee determined that the
maintenance procedures used on December 29, 2000 did not contain adequate
guidance to ensure that thread locking compounds or other measures would be utilized
to ensure that the DG amphenol connections did not become unthreaded during engine
operation. The work was not conducted using detailed procedures, and as such the
licensee determined that the amphenol became loose as a result of either inadequate
tightening during the maintenance, or equipment vibration between 2000 and 2008 (due
to thread locking compound not being used), or a combination of both. The licensee has
initiated corrective actions to add the appropriate guidance to Administrative
Procedure 0.40.4, Planning.
Analysis. The performance deficiency associated with this finding involved the
licensees failure to establish procedural controls for maintenance of electrical
connections on essential equipment. In the first example, the licensee failed to include
these amphenol connections within the scope of existing periodic electrical connection
inspections to identify loosening connections. In the second example, the licensee failed
to incorporate internal operating experience into work control procedures to ensure that
DG-mounted amphenol connections were solidly attached following maintenance.
These failures to establish adequate procedural controls led to the trip of DG 2 during
testing on January 15, 2008. The finding is more than minor because it is associated
with the mitigating systems cornerstone attribute of equipment performance and affects
the associated cornerstone objective to ensure the availability, reliability, and capability
of systems that respond to initiating events to prevent undesirable consequences. The
Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"
were used to conclude that a Phase 2 analysis was required because the finding
represents an actual loss of safety function of a single train for greater than its TS
allowed outage time (7 days). A Phase 2 risk analysis was conducted using the
guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor
Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table
with an assumed exposure time of greater than 30 days yielded a result of red, or very
high significance. A Phase 3 analysis conducted by a risk analyst preliminarily
determined the finding to be of white, or low to moderate significance.
The cause of the finding is related to the corrective action component of the crosscutting
area of problem identification and resolution in that the licensee failed to take
appropriate corrective actions for a 2007 NRC inspection finding which identified
inadequate maintenance procedures for checking the tightness of DG electrical
connections (P.1(d)).
                                        - 14 -                                    Enclosure
 
    Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,
    and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,
    Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),
    requires that maintenance affecting performance of safety-related equipment should be
    performed in accordance with written procedures. Contrary to this, since December 29,
    2000, the licensee used inadequate procedural guidance to reassemble amphenol
    connections on DG 2. Additionally, since September 30, 1988, the licensees procedural
    guidance for performing periodic electrical inspections has been inadequate in that it did
    not check the tightness of engine-mounted amphenol connections. These inadequate
    procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue
    was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of
    the findings final safety significance, this finding is identified as Apparent Violation (AV)
    05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of
    Emergency DG Electrical Connections."
1R22 Surveillance Testing (71111.22)
    Routine Surveillance Testing
  a. Inspection Scope
    The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that
    the three surveillance activities listed below demonstrated that the SSCs tested were
    capable of performing their intended safety functions. The inspectors either witnessed
    or reviewed test data to verify that the following significant surveillance test attributes
    were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)
    acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;
    (7) test data; (8) testing frequency and method demonstrated TS operability; (9) test
    equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code
    requirements; (12) engineering evaluations, root causes, and bases for returning tested
    SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;
    and (14) annunciators and alarms setpoints. The inspectors also verified that the
    licensee identified and implemented any needed corrective actions associated with the
    surveillance testing.
    The inspectors observed in-plant activities and reviewed procedures and associated
    records to determine whether: any preconditioning occurred; effects of the testing were
    adequately addressed by control room personnel or engineers prior to the
    commencement of the testing; acceptance criteria were clearly stated, demonstrated
    operational readiness, and were consistent with the system design basis; plant
    equipment calibration was correct, accurate, and properly documented; as left setpoints
    were within required ranges; the calibration frequency was in accordance with TS, the
    UFSAR, procedures, and applicable commitments; measuring and test equipment
    calibration was current; test equipment was used within the required range and
    accuracy; applicable prerequisites described in the test procedures were satisfied; test
    frequencies met TS requirements to demonstrate operability and reliability; tests were
    performed in accordance with the test procedures and other applicable procedures;
    jumpers and lifted leads were controlled and restored where used; test data and results
    were accurate, complete, within limits, and valid; test equipment was removed after
    testing; where applicable, test results not meeting acceptance criteria were addressed
    with an adequate operability evaluation or the system or component was declared
                                              - 15 -                                      Enclosure
 
    inoperable; where applicable for safety-related instrument control surveillance tests,
    reference setting data were accurately incorporated in the test procedure; where
    applicable, actual conditions encountering high resistance electrical contacts were such
    that the intended safety function could still be accomplished; prior procedure changes
    had not provided an opportunity to identify problems encountered during the
    performance of the surveillance or calibration test; equipment was returned to a position
    or status required to support the performance of the safety functions; and all problems
    identified during the testing were appropriately documented and dispositioned in the
    CAP.
    The inspectors reviewed the test results for the following activities to determine whether
    risk-significant systems and equipment were capable of performing their intended safety
    function and to verify testing was conducted in accordance with applicable procedural
    and TS requirements:
    *        January 23, 2008, Scram discharge volume vent valve inservice test (IST)
              performed January 14, 2008
    *        February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,
              2008
    *        March 19, 2008, 6.REC.201 performed January 31, 2008
    *        March 21, 2008, DG 2 monthly operability test performed March 11, 2008
    This inspection constitutes four routine surveillance testing samples as defined in
    Inspection Procedure 71111.22.
  b. Findings
    No findings of significance were identified.
EP4  Emergency Action Level and Emergency Plan Changes (71114.04)
    CNS Emergency Plan Revision 53
  a. Inspection Scope
    The inspector performed an in-office review of Revision 53 to the Cooper Nuclear
    Station Emergency Plan, received January 8, 2008. This revision moved the licensee's
    Joint Information Center (emergency news center) from Columbus, Nebraska, to
    Auburn, Nebraska, revised position duties in the Emergency Operations Facility and
    Joint Information Center, deleted the Technical Information Coordinator (EOF) position,
    revised position titles in the Joint Information Center, added a Letter of Agreement
    between the licensee and the Nebraska City Fire Department, and revised geographical-
    based protective action zones in Missouri, based on an approval letter from Federal
    Emergency Management Agency, Region VII, dated October 10, 2007.
    This revision was compared to its previous revision, to the criteria of NUREG-0654,
    Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and
    Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in
                                              - 16 -                                  Enclosure
 
      10 CFR 50.47(b) to determine if the revision adequately implemented the requirements
      of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and
      did not constitute approval of licensee changes; therefore, this revision is subject to
      future inspection.
      The inspectors completed one sample during the inspection.
  b. Findings
      No findings of significance were identified.
4.    OTHER ACTIVITIES
4OA1 Performance Indicator (PI) Verification (71151)
.1    Data Submission Review
  a. Inspection Scope
      The inspectors performed a review of the data submitted by the licensee for the 4th
      Quarter 2007 PIs for any obvious inconsistencies prior to its public release in
      accordance with Inspection Manual Chapter 0608, Performance Indicator Program.
      This review was performed as part of the inspectors normal plant status activities and,
      as such, did not constitute a separate inspection sample.
  b. Findings
      No findings of significance were identified.
.2    Unplanned Scrams per 7000 Critical Hours
  a. Inspection Scope
      The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical
      hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To
      determine the accuracy of the PI data reported during those periods, PI definitions and
      guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,
      Regulatory Assessment Performance Indicator Guideline, were used. The inspectors
      reviewed the licensees operator narrative logs, issue reports, event reports and NRC
      inspection reports to validate the accuracy of the submittals. The inspectors also
      reviewed the licensees issue report database to determine if any problems had been
      identified with the PI data collected or transmitted for this indicator and none were
      identified.
      This inspection constitutes one unplanned scrams per 7000 critical hours sample as
      defined by Inspection Procedure 71151.
  b. Findings
      No findings of significance were identified.
                                              - 17 -                                  Enclosure
 
.3    Unplanned Transients per 7000 Critical Hours
  a. Inspection Scope
      The inspectors sampled licensee submittals for the unplanned transients per
      7000 critical hours PI for the period from the 1st quarter 2007 through the 4th
      quarter 2007. To determine the accuracy of the PI data reported during those periods,
      PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute
      Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.
      The inspectors reviewed the licensees operator narrative logs, issue reports,
      maintenance rule records, event reports and NRC integrated Inspection reports to
      validate the accuracy of the submittals. The inspectors also reviewed the licensees
      issue report database to determine if any problems had been identified with the PI data
      collected or transmitted for this indicator and none were identified.
      This inspection constitutes one unplanned transients per 7000 critical hours sample as
      defined by Inspection Procedure 71151.
  b. Findings
      No findings of significance were identified.
4OA2 Identification and Resolution of Problems (71152)
      Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency
      Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical
      Protection
.1    Routine Review of Items Entered Into the CAP
  a. Inspection Scope
      The inspectors performed a daily screening of items entered into the licensee's CAP.
      This assessment was accomplished by reviewing CRs and WOs and attending
      corrective action review and work control meetings. The inspectors: (1) verified that
      equipment, human performance, and program issues were being identified by the
      licensee at an appropriate threshold and that the issues were entered into the CAP;
      (2) verified that corrective actions were commensurate with the significance of the issue;
      and (3) identified conditions that might warrant additional followup through other baseline
      inspection procedures.
  b. Findings
      No findings of significance were identified.
.2    Selected Issue Followup Inspection
  a. Inspection Scope
      In addition to the routine review, the inspectors selected the issues listed below for a
      more in-depth review. The inspectors considered the following during the review of the
                                              - 18 -                                  Enclosure
 
      licensee's actions: (1) complete and accurate identification of the problem in a timely
      manner; (2) evaluation and disposition of operability/reportability issues;
      (3) consideration of extent of condition, generic implications, common cause, and
      previous occurrences; (4) classification and prioritization of the resolution of the problem;
      (5) identification of root and contributing causes of the problem; (6) identification of
      corrective actions; and (7) completion of corrective actions in a timely manner.
      *        December 27, 2007, loss of both plant monitoring and information system
              computers
      Documents reviewed by the inspectors included:
      *        Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4
      *        Computer System Operating Procedure 2.6.3, Computer Systems Operation
              and Outage Recovery, Revision 23
      The inspectors completed one sample.
  b. Findings
      No findings of significance were identified.
4OA3 Followup of Events and Notices of Enforcement Discretion (71153)
.1    (Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance
      Leads to Rendering Second Diesel Inoperable
      On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil
      day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,
      control room operators received annunciators due to a rising level in the DG 1 fuel oil
      day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to
      failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel
      Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1
      inoperable. With DG 2 already inoperable, the control room staff properly entered
      Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an
      operable status within 2 hours.
      In an effort to restore operability of DG 1, the licensee elected to attempt repair of the
      leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing
      DG 1 into maintenance lockout and entry into an overall red risk window for the station.
      The repair attempt was unsuccessful, and the control room staff subsequently entered
      Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours and Mode 4
      within 36 hours. Operability of DG 1 was subsequently restored by closing a fuel oil
      system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.
      The licensee initiated this LER due to the loss of safety function (on-site emergency
      power) that occurred during the corrective maintenance attempt on DG 1. The
      inspectors reviewed all aspects of the event, including performance of control room staff,
      planning of the associated WOs, evaluation and mitigation of station risk, configuration
      control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency
                                                - 19 -                                    Enclosure
 
    and emergent work, and relationship to previous work on DG 1. A related violation of
    NRC requirements is discussed in detail in NRC Integrated Inspection Report
    05000298/2007005. This LER is closed.
.2  (Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency
    Filter System Fan Motor Results in Loss of Safety Function
    During a preventative maintenance inspection on December 3, 2007, licensee
    technicians discovered severely overheated motor leads on the Control Room
    Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the
    damaged motor leads, operations staff declared the fan inoperable and determined that
    since CREFS is a single-train safety system, a loss of safety function had occurred.
    Immediate action was taken and the degraded booster fan was replaced. CREFS was
    returned to an operable status on December 4, 2007. The degraded condition was
    determined to have been caused by the improper crimping of the motor lugs by the
    manufacturer prior to installation in the plant. No performance deficiencies were
    identified during the review of this LER. This LER is closed.
4OA6 Management Meetings
    Exit Meeting Summary
    On January 15, 2008, a regional inspector conducted a telephonic exit to present the
    results of the in-office inspection of licensee changes to the emergency plan to
    Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.
    The inspector confirmed that proprietary information was not provided or examined
    during the inspection.
    On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the
    results of the in-office inspection of changes to the licensees emergency plan to
    Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The
    inspector confirmed that proprietary, sensitive, or personal information examined during
    the inspection had been returned to the identified custodian.
    On April 14, 2008, the resident inspectors presented the inspection results to
    Mr. M. Colomb, General Manager of Plant Operations and other members of the
    licensee staff. The licensee acknowledged the issues presented. The inspectors asked
    the licensee whether any materials examined during the inspection should be
    considered proprietary. No proprietary information was identified.
                                              - 20 -                                Enclosure
 
                                  SUPPLEMENTAL INFORMATION
                                    KEY POINTS OF CONTACT
Licensee
John Austin, Manager, Emergency Preparedness Manager
Mark Bergmeier, Operations Support Group Supervisor
Vasant Bhardwaj, Engineering Support Manager
Michael Boyce, Director of Projects
Daniel Buman, System Engineering Manager
Michael Colomb, General Manager of Plant Operations
Jeff Ehlers, Engineer, Electric Systems/I&C
Roman Estrada, Corrective Action and Assessments Manager
Jim Flaherty, Senior Staff Licensing Engineer
Paul Fleming, Director of Nuclear Safety Assurance
Scott Freborg, Valves Engineering Programs Supervisor
Gabe Gardner, Design Engineering Civil Engineering Supervisor
Gary Kline, Director of Engineering
Dave Madsen, Licensing Engineer
Mark F Metzger, Engineer, Electric Systems/I&C
Ole Olson, Engineer, Engineering Support & Risk Management
Raymond Rexroad, Engineer, Electric Systems/I&C
Todd Stevens, Manager-Design Engineering
Mark Unruh, Senior Staff Engineer
David VanDerKamp, Licensing Manager
Marshall VanWinkle, Design Engineering Mechanical Supervisor
Dave Werner, Operations Training Support Supervisor
                    LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
05000298/2008002-02          AV      Failure to Establish Adequate Procedures for Maintenance of
                                      Emergency Diesel Generator Electrical Connections
Closed
05000298/2007-006-00          LER    Procedural Guidance Leads to Rendering Second Diesel
                                      Inoperable
05000298/2007-007-00          LER    Damaged Lead on Emergency Filter System Fan Motor
                                      Results in Loss of Safety Function
Opened and Closed
05000298/2008002-01          NCV    Failure to Follow Scaffold Inspection Procedures
                                LIST OF DOCUMENTS REVIEWED
The following is a partial list of documents reviewed during the inspection. Inclusion on this list
does not imply that the NRC inspector reviewed the documents in their entirety, but rather that
selected sections or portions of the documents were evaluated as part of the overall inspection
                                                  A1-1                                Attachment 1
 
effort. Inclusion of a document on this list does not imply NRC acceptance of the document or
any part of it, unless this is stated in the body of the inspection report.
1R07: Heat Sink Performance
Condition Report
CR-CNS-2008-00029
Procedures
Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger
Performance Analysis, Revision 27
Engineering Procedure 3.34, Heat Exchanger Program, Revision 9
Work Orders
4592135
4592134
1R13: Maintenance Risk Assessments and Emergent Work Control
Procedures
EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2
GOP 2.1.11, Station Operator Tours, Revision 127
Procedure 0.49, Schedule Risk Assessment, Revision 20
Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5
Work Order
WO 4618242
1R19: Post Maintenance Testing
Condition Reports
CR-CNS-2008-00720
CR-CNS-2008-00738
Procedures
SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5
6.EE.606, 250 V Battery Charger Performance Test, Revision 19
MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5
MP 7.3.14, Thermal Examination of Plant Components, Revision 7
                                                  A1-2                            Attachment 1
 
Work Orders
WO 4523441
WO 4532270
WO 4541631
WO 4532754
WO 4581466
1R22: Surveillance Testing
Condition Report
CR-CNS-02007-06517
Procedures
6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing
Test, Revision 12
T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0
T.S. Sec 5.5.6, CNS IST Program
6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24
EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23
CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2
DCD-01, p. B-12, Revision dated October 28, 2006
SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47
6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16
SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52
Work Order
WO 4578012
                                  LIST OF ACRONYMS USED
ASME          American Society of Mechanical Engineers
AV            apparent violation
CAP            corrective action program
CFR            Code of Federal Regulations
CR            condition reports
DG            diesel generator
HX            heat exchange(r)
LCO            limiting condition for operation
LER            licensee event report
NCV            noncited violation
PI            performance indicator
PMT            postmaintenance testing
REC            uranium hexafluoride
RHR            residual heat removal
TS            Technical Specification
UFSAR          Updated Final Safety Analysis Report
WO            work order
                                                A1-3                            Attachment 1
 
                                      Cooper Nuclear Station
                              Failure of EDG 2 Speed Sensing Circuit
                                      SDP Phase 3 Analysis
Performance Deficiency:
Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was
caused by a failure of an amphenol connection on the EDG speed sensing circuit.
Assumptions:
1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only
  during times that the diesel generator was running; specifically in response to the vibration
  of the operating engine. There is no assumption of accelerated degradation associated with
  diesel starts or any degradation while the unit was in standby. It is further assumed that the
  failure was a deterministic outcome set to occur after a specific number of operating hours.
  The diesel was run at the following times:
  09/13/07 - ran for 2 hrs 15 min
  10/15/07 - ran for 5 hrs 45 min
  11/13/07 - ran for 5 hrs 21 min
  12/10/07 - ran for 5 hrs 51 min
  01/14/08 - ran for 5 hrs 21 min (1700)
  01/15/08 - failure less than one minute after starting
  01/16/08- EDG 2 restored to a functional status (1700)
  Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP
  demand, or it was inoperable for maintenance, during the two-day period from January 14 to
  January 16, 2008.
  Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours following a
  LOOP demand at any time during the 35-day period from its last successful surveillance test
  on December 10, 2007 until the test failure that occurred on January 14, 2008.
  Prior to this date, EDG 2 would have run and failed at 11.2 hours during the 27-day period
  from November 13, 2007 to December 10, 2007.
  Prior to this date, EDG 2 would have run and failed at 16.5 hours during the 29-day period
  from October 15, 2007 to November 13, 2007.
  Prior to this date, EDG 2 would have failed to run at 22.3 hours during the 32-day period
  from September 13, 2007 to October 15, 2007.
  Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed
  sensing circuit failure for at least 24 hours, the mission time assumed in the SPAR model.
  Therefore, prior to this date no additional risk impact is assumed.
2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the
  outcome of any of the SPAR core damage sequences, the longest of which is 11 hours (as
  modified by an extension to the battery duration (assumption #3). Adjustments made to the
                                                A2-1                                Attachment 2
 
    performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG
    CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,
    unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,
    including a very small contribution from the action steps of repairing the amphenol
    connection and re-starting the EDG, which are relatively simple.
    The following table presents the diagnosis tabulation:
                            Diagnosis (0.01)  Multiplier  Action (0.001)    Multiplier
Available Time              Expansive          0.01        Nominal          1
Stress                      Extreme            5            High              2
Complexity                  High              5            Nominal          1
Experience/Training          Nominal            1            Nominal          1
Procedures                  Not Available      50          Nominal          1
Ergonomics                  Poor              10          Nominal          1
Product of Multipliers                          125                            2
Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558
Action HEP = 0.001(2) = 0.002
Total HEP = 0.56
    For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit
    failure applies to sequences of 4 hours or greater. The only sequence that is less than 4
    hours is a 30 minute sequence, for which no recovery of the amphenol connection is
    assumed.
    The SPAR model does not distinguish between cutsets that contain two or just one EDG
    failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely
    to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in
    this analysis, this feature of the SPAR model is not altered
3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge
    capability following a station blackout. Based on information received from the licensee, this
    credit was extended to 11 hours. Although the batteries could potentially function beyond
    11 hours under certain conditions other challenges related to the operation of RCIC and
    HPCI in station blackout conditions would be present. These challenges include the
    availability of adequate injection supply water and operational concerns of RCIC under high
    back pressure conditions as a result of the unavailability of suppression pool cooling during
    an extended station blackout event.
4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to
    operate for the period of time before it is assumed to fail from the connector failure during
    the various exposure periods. This introduces a slight inconsistency to the risk estimate, but
    because it would similarly affect both the base and current case, it does not significantly
    influence the result of this analysis.
5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed
    to be independent in nature. The reason for this determination is based on the following
                                                A2-2                                  Attachment 2
 
    reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine
    vibration while the EDG was running. Historically, EDG 2 has experienced vibration
    problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the
    amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very
    unlikely that this type of failure would occur on both EDGs at the same time. The fact that it
    took 7 years of operation for EDG 2 to reach the point of failure also points to the
    unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the
    exposure period of this finding.
    Even if both EDGs were determined to be vulnerable to a speed sensor amphenol
    connection failure, there was no mechanism that would tend to cause both EDGs to fail
    simultaneously. That is, the failure of one amphenol connection would not make failure of
    the other one more likely. Therefore, for this case, the failure of both EDGs from this issue
    would mathematically be modeled by the combined independent failures of both EDGs
    instead of by a classic common cause coupling mechanism. For this case, the estimated
    probability of an independent failure of EDG 1 from a failed amphenol connection during the
    exposure period would be a small number compared to its baseline SPAR fail-to-run
    probability and therefore this application would not appreciably affect the final result.
    Finally, if EDG 1 had experienced problems with this connection, thereby making it
    comparatively vulnerable to the same type of failure; it is likely that the licensee would have
    taken more aggressive actions to address this issue, seeing that it affected both trains of
    emergency power. Therefore, the conditions necessary to create the possibility of a
    common cause failure would also have triggered actions to prevent it.
The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A
cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.
The model was revised by INL to increase the battery life to 11 hours, as discussed above. In
addition, the timing of various sequences was lengthened based on data provided by the
licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),
with an HEP of 0.15. However, based on observations by the senior resident inspector, the
analyst concluded that credit for firewater injection should not be granted. This is because
barely enough time was available to perform the necessary actions and a valve that must be
opened to establish a flow path was non-functional with a stem-disk separation for the entire
period of exposure. There were other valves that could have been used in alternate lineups, but
it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure
the flow path.
Also, changes were made to the containment venting fault tree. In the original version, a loss of
Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the
vent function is possible by taking manual local actions to open the vent valves. The failure
probability of this action was estimated based on an observed evolution conducted in response
to questions concerning this analysis. This observation revealed that the actions needed to
perform this function were dangerous and complex and would be conducted in poor lighting and
high temperatures. Also, operators had little experience. The recovery efforts applied to both a
loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic
events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following
SPAR-H analysis.
                                                A2-3                                  Attachment 2
 
The diagnosis of the need to manually vent containment is obvious based on emergency
operating procedures that direct this action when containment pressure reaches 25 psig.
Operators would be continually monitoring this parameter, and it is very unlikely that the effort to
manually vent containment would not be undertaken at 25 psig and possibly prior to this point.
For the action steps, approximately 8 hours of time are available from the time that containment
pressurizes to 25 psig until containment would fail. The nominal time needed to perform the
manually venting task is estimated at 2 hours. In this case, the relevant SPAR-H category for
time is nominal. Extreme stress is chosen because the effort to manually open the vent valves
involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The
effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to
the valves and performing several manipulations. Operators have little experience with this
evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack
of lighting.
                            Diagnosis (0.01)  Multiplier    Action (0.001)    Multiplier
Available Time              Expansive          0.01          Nominal          1
Stress                      High              2              Extreme          5
Complexity                  Obvious            0.1            Moderate          2
Experience/Training          Nominal            1              Low              3
Procedures                  Nominal            1              Nominal          1
Ergonomics                  Nominal            1              Poor              10
Product of Multipliers                          0.002                            300
Diagnosis HEP = 0.01(.002) = 2.0E-5
Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23
Total HEP = 0.23
To model the failure of the speed sensing circuit and its specific recovery, a new and gate was
added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the
speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of
restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are
considered similar to the same for the various prior exposure periods. The common cause
probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets
containing the independent failure of EDG 2 contribute to the delta CDF of this finding.
Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG
recovery basic events were removed from cutsets that contained an EDG 2 speed sensor
failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure
to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset
of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery
for those sequences.
Internal Events Analysis:
A.      Risk Estimate for the 2-day period between January 14 and January 16, 2006:
        During this 48-hour period, it is assumed that EDG 2 was completely unavailable either
        because of maintenance or because it would have failed within one minute after a LOOP
                                                A2-4                                    Attachment 2
 
  demand. To represent the assumed failure and potential recovery of EDG 2, the new
  basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was
  set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of
  4.172E-4 to ensure that cutsets containing common cause to run events would cancel
  out in the base and current case.
  The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.
B. Risk Estimate for the 35-day period between December 10, 2006 and January 14,
  2007:
  During this exposure period, EDG 2 is assumed to have been capable of running for
  5.35 hours. The LOOP frequency used in the analysis was adjusted to reflect the
  situation that only LOOPs with durations greater than 5.35 hours would result in a risk
  increase attributable to the speed sensor failure.
  The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is
  0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours is
  3.99E-3/yr.
  Resetting event time t=0 to 5.35 hours following the LOOP event requires that the
  recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
  SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
  recovery at 7.35 hours, given that recovery has failed at 5.35 hours.
  An adjustment to account for the diminishment of decay heat must be considered. This
  is because the magnitude of decay heat at 5.35 hours following shutdown is less than in
  the early moments following a reactor trip, and the timing of core damage sequences is
  affected by this fact. In the modified SPAR model, recovery times for offsite power are
  set at the intervals of 30 minutes, 2 hours, 4 hours, and 10 hours. The analyst
  determined that the average decay heat level in the first 30 minutes is approximately two
  times the average level that exists between 5.35 and 6.35 hours following shutdown.
  Therefore, baseline 30-minute SPAR model sequences, that essentially account for
  boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences
  model safety relief valve failures to close, and are based more on inventory control than
  core heat production. Therefore, no adjustment was made for these sequences. The
  analyst determined that decay heat rates leveled out quickly following shutdown and
  could find no basis for adjusting the times associated with the 4 and 10-hour sequences.
  The following table presents the adjusted offsite power non-recovery factors for the
  event times that are relevant in the SPAR core damage cutsets:
                                            A2-5                                Attachment 2
 
        SPAR          SPAR base            SPAR base            SPAR base          Modified
      recovery        offsite power      offsite power        offsite power    SPAR non-
          time        non-recovery        non-recovery at      non-recovery at      recovery
                                            5.35 hours          5.35 hours +      (Column 4
                                                                SPAR recovery      divided by
                                                              time in Column 1    Column 3)
        30 min.            0.7314              0.1112                0.0905 1          0.814
        4 hours            0.1566              0.1112                0.0554            0.498
        5 hours            0.1205              0.1112                0.0487            0.438
        9 hours            0.05789            0.1112                0.0325            0.292
      11 hours            0.04500            0.1112                0.0278            0.250
      1. A SPAR recovery time of 1.0 hours is used, as discussed above, to account for the
            lessening of decay heat
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
      before EDG 2 fails from the speed sensor circuit failure at 5.35 hours, the result for the
      base and the current case that contain an EDG 1 FTS event were multiplied by the
      success probability of recovering EDG 1 in 5.35 hours, which was 0.5934 (1- non-
      recovery probability). This value was then subtracted to obtain a final result for the base
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
      events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours).
      This then would suggest that the EDG recovery terms in the SPAR model would
      coincide with the event time t=0 at 5.35 hours following the onset of the LOOP and
      therefore do not require adjustment.
      The results of this portion of the analysis are presented in the following table:
                CDF/yr            CDF/35 days    EDG1 FTS            EDG1 FTS      Remaining
                                                  Recovered          Recovered/35 CDF (column
                                                  (EDG1 FTS          days          3- column 5)
                                                  Cutset total
                                                  times 0.5934)
Base Case      6.989E-7          6.702E-8        3.686E-8            3.535E-9      6.348E-8
Current Case 1.394E-5            1.337E-6        4.706E-7            4.513E-8      1.292E-6
Delta                                                                                1.229E-6
CDF/35 days
                                                A2-6                                  Attachment 2
 
C. Risk Estimate for the 27-day period between November 13, 2007 and December 10,
  2007:
  During this exposure period, EDG 2 is assumed to have been capable of running for
  11.2 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs
  with durations greater than 11.2 hours would result in a risk increase attributable to the
  speed sensor failure.
  The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is
  0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours is
  1.58E-3/yr.
  Resetting event time t=0 to 11.2 hours following the LOOP event requires that the
  recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
  SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
  recovery at 13.2 hours, given that recovery has failed at 11.2 hours.
  The analyst considered an adjustment to account for the diminishment of decay heat as
  in the 5.35-hour case above. The analyst determined that the average decay heat level
  in the first 30 minutes is approximately three times the average level that exists between
  11 and 12 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
  essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.
  The 2-hour sequences model safety relief valve failures to close, and are based more on
  inventory control than core heat production. Therefore, no adjustment was made for
  these sequences. Sequences of 4 and 10 hours were increased by 30 minutes each
  The following table presents the adjusted offsite power non-recovery factors for the
  event times that are relevant in the SPAR core damage cutsets:
      SPAR          SPAR base          SPAR base          SPAR base          Modified
    recovery        offsite power        offsite power      offsite power    SPAR non-
      time        non-recovery      non-recovery at    non-recovery at      recovery
                                          11.2 hours        11.2 hours +      (Column 4
                                                          SPAR recovery        divided by
                                                        time in Column 1      Column 3)
    30 min.          0.7314              0.0441            0.0377 1          0.855
    4 hours          0.1566              0.0441            0.02922            0.662
    5 hours            0.1205              0.0441            0.02712            0.615
    9 hours          0.05789              0.0441            0.02122            0.481
  11 hours            0.04500              0.0441            0.01912            0.433
      1    A SPAR recovery time of 1.5 hours is used, as discussed above, to account for
          the lessening of decay heat
      2  The SPAR recovery time was increased by 30 minutes.
                                            A2-7                                Attachment 2
 
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
      before EDG 2 fails from the speed sensor circuit failure at 11.2 hours, the result for the
      base and the current case that contain an EDG 1 FTS event were multiplied by the
      success probability of recovering EDG 1 in 11.2 hours, which was 0.7907 (1- non-
      recovery probability). This value was then subtracted to obtain a final result for the base
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
      events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours).
      This then would suggest that the EDG recovery terms in the SPAR model would
      coincide with the event time t=0 at 11.2 hours following the onset of the LOOP and
      therefore do not require adjustment.
      The results of this portion of the analysis are presented in the following table:
                CDF/yr          CDF/27 days      EDG1 FTS        EDG1 FTS          Remaining
                                                  Recovered        Recovered/27 CDF (column
                                                  (EDG1 FTS        days              3- column 5)
                                                  Cutset total
                                                  times 0.7907)
Base Case        4.332E-7        3.204E-8        3.168E-8        2.343E-9          2.970E-8
Current Case 9.216E-6            6.817E-7        4.216E-7          3.119E-8        6.505E-7
Delta                                                                                6.208E-7
CDF/27 days
D.    Risk Estimate for the 29-day period between October 15, 2007 and November 13,
      2007:
      During this exposure period, EDG 2 is assumed to have been capable of running for
      16.5 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs
      with durations greater than 16.5 hours would result in a risk increase attributable to the
      speed sensor failure.
      The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is
      0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours is
      9.87E-4/yr.
      Resetting event time t=0 to 16.5 hours following the LOOP event requires that the
      recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
      SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
      recovery at 18.5 hours, given that recovery has failed at 16.5 hours.
      The analyst considered an adjustment to account for the diminishment of decay heat as
      in the 5.35-hour case above. The analyst determined that the average decay heat level
      in the first 30 minutes is approximately four times the average level that exists between
      16 and 17 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
      essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The
                                                A2-8                                  Attachment 2
 
      2-hour sequences model safety relief valve failures to close, and are based more on
      inventory control than core heat production. Therefore, no adjustment was made for
      these sequences. Sequences of 4 and 10 hours were increased by 60 minutes each
      The following table presents the adjusted offsite power non-recovery factors for the
      event times that are relevant in the SPAR core damage cutsets:
        SPAR          SPAR base            SPAR base            SPAR base          Modified
      recovery        offsite power      offsite power        offsite power    SPAR non-
          time        non-recovery        non-recovery at      non-recovery at      recovery
                                            16.5 hours          16.5 hours +      (Column 4
                                                              SPAR recovery      divided by
                                                              time in Column 1    Column 3)
        30 min.          0.7314              0.0275                0.02411          0.876
        4 hours          0.1566              0.0275                0.02032          0.738
      5 hours            0.1205              0.0275                0.01922          0.698
        9 hours          0.05789            0.0275                0.01602          0.582
      11 hours            0.04500            0.0275                0.01482          0.538
      1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the
      lessening of decay heat
      2. The SPAR recovery time was increased by 60 minutes.
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
      before EDG 2 fails from the speed sensor circuit failure at 16.5 hours, the result for the
      base and the current case that contain an EDG 1 FTS event were multiplied by the
      success probability of recovering EDG 1 in 16.5 hours, which was 0.8760 (1- non-
      recovery probability). This value was then subtracted to obtain a final result for the base
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
      events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours).
      This then would suggest that the EDG recovery terms in the SPAR model would
      coincide with the event time t=0 at 16.5 hours following the onset of the LOOP and
      therefore do not require adjustment.
      The results of this portion of the analysis are presented in the following table:
              CDF/yr            CDF/29 days    EDG1 FTS            EDG1 FTS      Remaining
                                                Recovered          Recovered/29 CDF (column
                                                (EDG1 FTS          days          3- column 5)
                                                Cutset total
                                                times 0.8760)
Base Case      3.263E-7          2.593E-8        2.675E-8            2.125E-9      2.380E-8
                                              A2-9                                  Attachment 2
 
Current Case 7.071E-6              5.618E-7        3.601E-7        2.861E-8        5.332E-7
Delta                                                                                5.094E-7
CDF/29 days
E.    Risk Estimate for the 32-day period between September 13, 2007 and October 15,
      2007:
      During this exposure period, EDG 2 is assumed to have been capable of running for 22.3
      hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with
      durations greater than 22.3 hours would result in a risk increase attributable to the speed
      sensor failure.
      The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is
      0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours is
      6.98E-4/yr.
      Resetting event time t=0 to 22.3 hours following the LOOP event requires that the
      recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
      SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
      recovery at 24.3 hours, given that recovery has failed at 22.3 hours.
      The analyst considered an adjustment to account for the diminishment of decay heat as in
      the 5.35-hour case above. The analyst determined that the average decay heat level in the
      first 30 minutes is approximately four times the average level that exists between 22 and
      23 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
      essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-
      hour sequences model safety relief valve failures to close, and are based more on
      inventory control than core heat production. Therefore, no adjustment was made for these
      sequences. Sequences of 4 and 10 hours were increased by 60 minutes each
      The following table presents the adjusted offsite power non-recovery factors for the event
      times that are relevant in the SPAR core damage cutsets:
          SPAR          SPAR base            SPAR base        SPAR base          Modified
        recovery        offsite power        offsite power      offsite power    SPAR non-
            time        non-recovery        non-recovery at    non-recovery at      recovery
                                              22.3 hours        22.3 hours +      (Column 4
                                                              SPAR recovery        divided by
                                                              time in Column 1    Column 3)
          30 min.          0.7314              0.0194            0.0177 1          0.912
          4 hours          0.1566              0.0194            0.01692            0.871
        5 hours            0.1205              0.0194            0.01492            0.768
          9 hours          0.05789              0.0194            0.01342            0.691
        11 hours          0.04500              0.0194            0.01272            0.655
                                                A2-10                                Attachment 2
 
          1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the
          lessening of decay heat
          2. The SPAR recovery time was increased by 60 minutes.
    To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
    before EDG 2 fails from the speed sensor circuit failure at 22.3 hours, the result for the base
    and the current case that contain an EDG 1 FTS event were multiplied by the success
    probability of recovering EDG 1 in 22.3 hours, which was 0.9267 (1- non-recovery
    probability). This value was then subtracted to obtain a final result for the base and current
    case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event
    before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,
    the methodology used effectively assumes that for EDG 1 fail to run events, the failure
    occurs more or less at the same time that EDG 2 fails (22.3 hours). This then would
    suggest that the EDG recovery terms in the SPAR model would coincide with the event time
    t=0 at 22.3 hours following the onset of the LOOP and therefore do not require adjustment.
        The results of this portion of the analysis are presented in the following table:
                  CDF/yr          CDF/32 days    EDG1 FTS          EDG1 FTS          Remaining
                                                  Recovered        Recovered/32 CDF (column
                                                  (EDG1 FTS        days              3- column 5)
                                                  Cutset total
                                                  times 0.9267)
Base Case        2.745E-7        2.407E-8        2.402E-8          2.106E-9          2.196E-8
Current Case 6.033E-6              5.289E-7        3.262E-7          2.860E-8        5.003E-7
Delta                                                                                  4.783E-7
CDF/32 days
The following table presents the aggregate internal events result:
        TIME PERIOD                    DAYS OF EXPOSURE                        DELTA CDF
      01/14/08 - 01/16/08                          2                            1.528E-7
      12/10/07 - 01/14/08                        35                            1.229E-6
      11/13/07 - 12/10/07                        27                            6.208E-7
      10/15/07 - 11/13/07                        29                            5.094E-7
      09/13/07 - 10/15/07                        32                            4.783E-7
                Total Internal Events Delta-CDF                                  2.990E-6
External Events Analysis:
The risk increase from fire initiating events was reviewed and determined to have a small impact
on the risk of the finding. Two fire scenarios were identified where equipment damage could
cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a
control room fire that affected either Vertical Board F or Board C. The second was a fire in the
Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote
because of the confined specificity of their locations and the fact that a combination of hot shorts
of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced
in this manner would be likely to succeed for the station blackout sequences that comprise the
majority of the risk, because a minimum of 11 hours of battery power would be available, power
                                                A2-11                                  Attachment 2
 
would presumably be available in the switchyard, and the breaker manipulations needed to
complete this task would be possible and within the capability of an augmented plant staff that
would respond to the event.
Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2
power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no
change in risk from the finding.
The other type of fires that would result in a LOOP are those that require an evacuation of the
control room. In this case, plant procedures require offsite power to be isolated from the vital
buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With
the assumption that the Division 2 EDG will fail 5.35 hours into the event, a station blackout
would occur at this time. The sequences that could lead to core damage would include a failure
of the Division 1 EDG, such that ultimate success in averting core damage would rely on
recovery of either EDG or of offsite power. A review of the onsite electrical distribution system
did not reveal any particular difficulties in restoring switchyard power to the vital buses in this
scenario, especially given that many hours are available to accomplish this task. The licensee
confirmed that for all postulated fire scenarios that would require evacuation of the control room,
a undamaged and available power pathway exists from the switchyard through the emergency
transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish
this task would take only a few minutes.
In general, the fire risk importance for this finding is small compared to that associated with
internal events because onsite fires do not remove the availability of offsite power in the
switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is
presumed to occur as a consequence of such events as severe weather or significant electrical
grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially
non-functional (no run time remaining) is small because of a very low initiating event probability.
The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact
on overall plant risk. When adjusted for the exposure period of this finding, the cumulative
baseline core damage frequency for the zones that had the potential for a control room
evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was
approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used
several bounding assumptions. The analyst qualitatively assumed that the increase in risk from
having EDG 2 in a status where it is assumed to fail at 5.35 hours would likely be somewhat
less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated
by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours is
well less than 10 percent. Based on these considerations, the analyst concluded that the risk
related to fires would not be sufficiently large to change the risk characterization of this finding.
The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.
As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope
of the seismic risk particular to this finding. The generic median earthquake acceleration
assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at
Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency
assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered
by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is
capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an
earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would
remove offsite power but not damage other equipment important to safe shutdown. In the
                                                  A2-12                                Attachment 2
 
internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours
duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours
duration would likely have recovery characteristics closely matching that from an earthquake.
The ratio between these two frequencies is 44. Based on this, the analyst qualitatively
concluded that the risk associated with seismic events would be small compared to the internal
result.
Flooding could be a concern because of the proximity to the Missouri River. However, floods
that would remove offsite power would also likely flood the EDG compartments and therefore
not result in a significant change to the risk associated with the finding. The switchyard
elevation is below that of the power block by several feet, but it is not likely that a slight
inundation of the switchyard would cause a loss of offsite power. The low frequency of floods
within the thin slice of water elevations that would remove offsite power for at least 5.35 hours
but not debilitate the diesel generators indicates that external flooding would not add
appreciably to the risk of this finding.
Based on the above, the analyst determined that external events did not add significantly to the
risk of the finding.
Large Early Release Frequency:
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for
the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences
to determine an estimate of the change in large early release frequency caused by the finding.
The LERF consequences of this performance deficiency were similar to those documented in a
previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service
water pumps. The final determination letter was issued on March 31, 2005 and is located in
ADAMS, Accession No. ML050910127. The following excerpt from this document addressed
the LERF issue:
        The NRC reevaluated the portions of the preliminary significance determination related
        to the change in LERF. In the regulatory conference, the licensee argued that the
        dominant sequences were not contributors to the LERF. Therefore, there was no
        change in LERF resulting from the subject performance deficiency. Their argument was
        based on the longer than usual core damage sequences, providing for additional time to
        core damage, and the relatively short time estimated to evacuate the close in population
        surrounding Cooper Nuclear Station.
        LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment
        Integrity Significance Determination Process as: the frequency of those accidents
        leading to significant, unmitigated release from containment in a time frame prior to the
        effective evacuation of the close-in population such that there is a potential for early
        health effect. The NRC noted that the dominant core damage sequences documented
        in the preliminary significance determination were long sequences that took greater than
        12 hours to proceed to reactor pressure vessel breach. The shortest calculated interval
        from the time reactor conditions would have met the requirements for entry into a
        general emergency (requiring the evacuation) until the time of postulated containment
        rupture was 3.5 hours. The licensee stated that the average evacuation time for Cooper,
        from the declaration of a General Emergency was 62 minutes.
                                                A2-13                                    Attachment 2
 
        The NRC determined that, based on a 62-minute average evacuation time, effective
        evacuation of the close-in population could be achieved within 3.5 hours. Therefore, the
        dominant core damage sequences affected by the subject performance deficiency were
        not LERF contributors. As such, the NRCs best estimate determination of the change in
        LERF resulting from the performance deficiency was zero.
In the current analysis, the total contribution of the 30-minute sequences for the 35-day period
(when 5.35 hours of EDG run time remained) to the current case CDF is only 0.54% of the total.
That is, almost all of the risk associated with this performance deficiency involves sequences of
duration 5.35 hours or longer following the loss of all ac power.
The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of
these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the
two-hour sequences comprise only 0.3 percent of the total.
Consequently, the analyst determined that the risk associated with large early release was very
small.
References:
SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004
GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)
Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1
NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of
Loss of Offsite Power Events: 1986-2004"
Peer Review:
See-Meng Wong, NRR
George McDonald, NRR
                                                A2-14                                Attachment 2
}}

Latest revision as of 17:05, 14 November 2019

IR 05000298-08-002; on 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications and Postmaintenance Testing
ML081270639
Person / Time
Site: Cooper Entergy icon.png
Issue date: 05/06/2008
From: Chamberlain D
NRC/RGN-IV/DRP
To: Minahan S
Nebraska Public Power District (NPPD)
References
EA-08-124 IR-08-002
Download: ML081270639 (42)
v • d • e


See also: IR 05000298/2008002

Text

UNITED STATES

NUC LE AR RE G UL AT O RY C O M M I S S I O N

R E GI ON I V

612 EAST LAMAR BLVD , SU I TE 400

AR LI N GTON , TEXAS 76011-4125

May 6, 2008

EA 08-124

Stewart B. Minahan

Vice President - Nuclear and CNO

Nebraska Public Power District

PO Box 98

Brownville NE 68321

SUBJECT: COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION

REPORT 05000298/2008002

Dear Mr. Minahan:

On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated

inspection at your Cooper Nuclear Station. The enclosed report documents the inspection

results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant

Operations, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and

compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed

personnel.

As described in Section 1R19 of this report, the NRC concluded that the failure to establish

adequate procedural controls for the maintenance of electrical connections on diesel generators

led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety

significance of this finding was assessed on the basis of the best available information, including

influential assumptions, using the applicable Significance Determination Process and was

preliminarily determined to be a White (low to moderate safety significance) finding.

Attachment 2 of this report provides a detailed description of the preliminary risk assessment.

In accordance with NRC Inspection Manual Chapter 0609, Significance Determination

Process, we intend to complete our evaluation using the best available information and issue

our final determination of safety significance within 90 days of this letter.

This finding does not represent an immediate safety concern because of the corrective actions

you have taken. These actions included applying thread locking compound to the amphenol

connections on both diesel generators.

Also, this finding constitutes an apparent violation of NRC requirements and is being

considered for escalated enforcement action in accordance with the NRC Enforcement

Policy. The current Enforcement Policy is included on the NRCs Web site at

http://www.nrc.gov/reading-rm/adams.html. This significance determination process

encourages an open dialog between the staff and the licensee, however the dialogue should not

impact the timeliness of the staffs final determination.

Nebraska Public Power District -2-

Before we make a final decision on this matter, we are providing you an opportunity (1) to

present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive

at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the

finding to the NRC in writing. If you request a Regulatory Conference, it should be held within

30 days of the receipt of this letter and we encourage you to submit documentation at least one

week prior to the conference in an effort to make the conference more efficient and effective. If

a Regulatory Conference is held, it will be open for public observation. If you decide to submit

only a written response, such submittal should be sent to the NRC within 30 days of the receipt

of this letter. If you decline to request a regulatory conference or submit a written response,

your ability to appeal the final SDP determination can be affected, in that by not doing either you

fail to meet the appeal requirements stated in the prerequisite and limitation sections of

Attachment 2 of IMC 0609.

Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this

letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will

continue with our significance determination and enforcement decision and you will be advised

by separate correspondence of the results of our deliberation on this matter.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being

issued for the inspection finding at this time. In addition, please be advised that the number and

characterization of the apparent violation described in the enclosed inspection report may

change as a result of further NRC review.

The report also documents one finding which was evaluated under the risk SDP as having very

low safety significance (Green). The finding was determined to involve a violation of NRC

requirements. However, because of very low safety significance, and because the issue was

entered into your corrective action program, the NRC is treating the issue as a noncited violation

in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject

or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of

this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory

Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the

Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza

Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector

Office at the Cooper Nuclear Station.

Nebraska Public Power District -3-

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter

and its enclosure will be made available electronically for public inspection in the NRC

Public Document Room or from the Publicly Available Records (PARS) component of

NRCs document system (ADAMS), accessible from the NRC Web site at

http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Dwight D. Chamberlain, Director

Division of Reactor Projects

Docket No: 50-298

License No: DPR-46

Enclosure:

NRC Inspection Report 05000298/2008002

w/Attachments:

Attachment 1: Supplemental Information

Attachment 2: Preliminary Risk Assessment

cc w/enclosure:

John C. McClure, Vice President

Gene Mace

and General Counsel

Nuclear Asset Manager

Nebraska Public Power District

Nebraska Public Power District

P.O. Box 499

P.O. Box 98

Columbus, NE 68602-0499

Brownville, NE 68321

David Van Der Kamp Michael J. Linder, Director

Licensing Manager Nebraska Department of

Nebraska Public Power District Environmental Quality

P.O. Box 98 P.O. Box 98922

Brownville, NE 68321 Lincoln, NE 68509-8922

Julia Schmitt, Manager

Radiation Control Program

Chairman

Nebraska Health & Human Services

Nemaha County Board of Commissioners

Dept. of Regulation & Licensing

Nemaha County Courthouse

Division of Public Health Assurance

1824 N Street

301 Centennial Mall, South

Auburn, NE 68305

P.O. Box 95007

Lincoln, NE 68509-5007

Nebraska Public Power District -4-

H. Floyd Gilzow

Director, Missouri State Emergency

Deputy Director for Policy

Management Agency

Missouri Department of Natural Resources

P.O. Box 116

P. O. Box 176

Jefferson City, MO 65102-0116

Jefferson City, MO 65102-0176

Chief, Radiation and Asbestos Melanie Rasmussen, State Liaison Officer/

Control Section Radiation Control Program Director

Kansas Department of Health Bureau of Radiological Health

and Environment Iowa Department of Public Health

Bureau of Air and Radiation Lucas State Office Building, 5th Floor

1000 SW Jackson, Suite 310 321 East 12th Street

Topeka, KS 66612-1366 Des Moines, IA 50319

John F. McCann, Director, Licensing Keith G. Henke, Planner

Entergy Nuclear Northeast Division of Community and Public Health

Entergy Nuclear Operations, Inc. Office of Emergency Coordination

440 Hamilton Avenue 930 Wildwood, P.O. Box 570

White Plains, NY 10601-1813 Jefferson City, MO 65102

Ronald L. McCabe, Chief

Paul V. Fleming, Director of Nuclear Technological Hazards Branch

Safety Assurance National Preparedness Division

Nebraska Public Power District DHS/FEMA

P.O. Box 98 9221 Ward Parkway

Brownville, NE 68321 Suite 300

Kansas City, MO 64114-3372

Nebraska Public Power District -5-

Electronic distribution by RIV:

Regional Administrator (Elmo.Collins@nrc.gov)

DRP Director (Dwight.Chamberlain@nrc.gov)

DRS Director (Roy.Caniano@nrc.gov)

DRS Deputy Director (Troy.Pruett@nrc.gov)

Senior Resident Inspector (Nick.Taylor@nrc.gov)

Branch Chief, DRP/C (Rick.Deese@nrc.gov)

Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)

Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

Only inspection reports to the following:

DRS STA (Dale.Powers@nrc.gov)

J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)

P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)

ROPreports

CNS Site Secretary (Sue.Farmer@nrc.gov)

SUNSI Review Completed: WCW ADAMS: ; Yes No Initials: WCW

Publicly Available Non-Publicly Available Sensitive  ; Non-Sensitive

R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc ML081270639

RIV:SRI:DRP/C RI:DRP/C SPE:DRP/C DRS:SRA C:DRS/OB C:DRS/EB2

NHTaylor MLChambers WCWalker MFRunyan RELantz LJSmith

E-Walker /RA/ E-mailed /RA/ /RA/ /RA/ /RA/

4/24/08 4/23/08 4/24 /08 4/24/08 4/24/08 4/23/08

C:DRS/EB1 C:DRS/PSB C:DRP/C ACES:SES D:DRP

RLBywater MPShannon RWDeese GMVasquez DDChamberlain

/RA/ /RA/ /RA/ /RA/

4/22/08 4/22/08 4/ /08 4/24/08 5/02/08

OFFICIAL RECORD COPY T=Telephone E=Email F=Fax

U. S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket No: 05000298

License No: PR-46

Report No: 5000298/2008002

Licensee: Nebraska Public Power District

Facility: Cooper Nuclear Station

Location: PO Box 98, Brownville, NE 68321

Dates: January 1 through March 22, 2008

Inspectors: N. Taylor, Senior Resident Inspector

M. Chambers, Resident Inspector

P. Elkmann, Emergency Preparedness Inspector

M. Runyan, Senior Reactor Analyst

Approved by: D. Chamberlain, Director

Division of Reactor Projects

-1- Enclosure

SUMMARY OF FINDINGS

IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications

and Postmaintenance Testing.

This report covers a three-month period of inspection by resident inspectors and announced

baseline inspections by regional inspectors. The significance of most findings is indicated by

their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance

Determination Process. Findings for which the Significance Determination Process does not

apply may be Green or be assigned a severity level after NRC management review. The NRCs

program for overseeing the safe operation of commercial nuclear power reactors is described in

NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

  • Green. The inspectors identified a Green noncited violation of Technical

Specification 5.4.1.a regarding the licensees failure to follow the requirements of

Maintenance Procedure 7.0.7, Scaffolding Construction and Control.

Specifically, licensee personnel failed to inspect all existing scaffolds and failed

to identify multiple scaffolding interactions with safety-related equipment during a

required annual scaffold inspection on January 21, 2008. This issue was

entered Into the licensees corrective action program as Condition

Report CR-CNS-2008-01576.

The finding is more than minor because if left uncorrected the failure to perform

annual scaffold inspections could become a more significant safety concern.

Specifically, annual inspections failed to inspect all existing scaffolds and failed to

identify multiple scaffolding interactions with safety-related equipment. Using the

Manual Chapter 0609, Significance Determination Process, Phase 1

Worksheet, the finding is determined to have a very low safety significance

because it did not result in the loss of function of a Technical Specification

required system for greater than its allowed outage time. The cause of this

finding is related to the human performance crosscutting component of work

practices because maintenance personnel did not follow the requirements of

Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).

  • TBD. Two examples of a self-revealing apparent violation of Technical

Specification 5.4.1.a were identified regarding the licensees failure to establish

procedural controls for maintenance of electrical connections on essential

equipment. In the first example, the licensee failed to include amphenol

connections within the scope of existing periodic electrical connection inspections

to identify loosening connections. In the second example, the licensee failed to

incorporate internal operating experience into work control procedures to ensure

that diesel generator-mounted amphenol connections were solidly attached

following maintenance. These failures to establish adequate procedural controls

led to the trip of Diesel Generator 2 during testing on January 15, 2008. This

issue was entered into the licensees corrective action program as Condition

Report CR-CNS 2008-00304.

-2- Enclosure

The finding affected the mitigating systems cornerstone and is more than minor

because it is associated with the cornerstone attribute of equipment performance

and affects the associated cornerstone objective to ensure the availability,

reliability, and capability of systems that respond to initiating events to prevent

undesirable consequences. The Phase 1 worksheets in Inspection Manual

Chapter 0609, "Significance Determination Process," were used to conclude that

a Phase 2 analysis was required because the finding represents an actual loss of

safety function of a single train for greater than its Technical Specification

allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, Determining the Significance of

Reactor Inspection Findings for At-Power Situations. Entering the site-specific

pre-solved table with an assumed exposure time of greater than 30 days yielded

a result of red, or very high significance. A Phase 3 analysis conducted by a risk

analyst preliminarily determined the finding to be of white, or low to moderate

significance. The cause of the finding is related to the corrective action

component of the crosscutting area of problem identification and resolution in

that the licensee failed to take appropriate corrective actions for a 2007 NRC

inspection finding which identified inadequate maintenance procedures for

checking the tightness of diesel generator electrical connections (P.1(d))

(Section 71111.19).

B. Licensee-Identified Violations

No violations of significance were identified.

-3- Enclosure

REPORT DETAILS

Summary of Plant Status

The plant began the inspection period at 100 percent power. On February 19, 2008, the plant

began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from

90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump

motor Generator B. The reactor was returned to full power later in the day, where it remained

for the rest of the inspection period.

1. REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency

Preparedness

1R04 Equipment Alignment (71111.04)

.1 Quarterly Partial System Walkdowns

a. Inspection Scope

The inspectors selected these systems based on their risk significance relative to the

reactor safety cornerstones at the time they were inspected. The inspectors attempted

to identify any discrepancies that could impact the function of the system, and, therefore,

potentially increase risk. The inspectors reviewed applicable operating procedures,

system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical

Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),

condition reports (CR), and the impact of ongoing work activities on redundant trains of

equipment in order to identify conditions that could have rendered the systems incapable

of performing their intended functions. The inspectors also walked down accessible

portions of the systems to verify system components and support equipment were

aligned correctly and operable. The inspectors examined the material condition of the

components and observed operating parameters of equipment to verify that there were

no obvious deficiencies. The inspectors also verified that the licensee had properly

identified and resolved equipment alignment problems that could cause initiating events

or impact the capability of mitigating systems or barriers and entered them into the

corrective action program (CAP) with the appropriate significance characterization.

Documents reviewed are listed in the attachment.

The inspectors performed partial system walkdowns of the following risk-significant

systems:

  • January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B

during REC HX A limiting condition for operation (LCO)

The inspectors completed three samples.

-4- Enclosure

b. Findings

No findings of significance were identified.

.2 Semi-Annual Complete System Walkdown

a. Inspection Scope

On March 11, 2008 the inspectors performed a complete system alignment inspection of

the DG 1 to verify the functional capability of the system. This system was selected

because it was considered both safety-significant and risk-significant in the licensees

probabilistic risk assessment. The inspectors walked down the system to review

mechanical and electrical equipment line ups, electrical power availability, system

pressure and temperature indications, as appropriate, component labeling, component

lubrication, component and equipment cooling, hangers and supports, operability of

support systems, and to ensure that ancillary equipment or debris did not interfere with

equipment operation. A review of a sample of past and outstanding WOs was

performed to determine whether any deficiencies significantly affected the system

function. In addition, the inspectors reviewed the CAP database to ensure that system

equipment alignment problems were being identified and appropriately resolved.

  • March 11, 2008, DG 1 during DG 2 LCO

Documents reviewed by the inspectors included:

  • CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel

Generator), Revision 70

These activities constituted one complete system walkdown sample as defined by

Inspection Procedure 71111.04-05.

b. Findings

No findings of significance were identified.

1R05 Fire Protection (71111.05AQ)

a. Inspection Scope

The inspectors conducted fire protection walkdowns which were focused on availability,

accessibility, and the condition of firefighting equipment.

The inspectors reviewed areas to assess if the licensee had implemented a fire

protection program that adequately controlled combustibles and ignition sources within

the plant, effectively maintained fire detection and suppression capability, maintained

passive fire protection features in good material condition, and had implemented

adequate compensatory measures for out of service, degraded or inoperable fire

protection equipment, systems, or features in accordance with the licensees fire plan.

The inspectors selected fire areas based on their overall contribution to internal fire risk

as documented in the plants Individual Plant Examination of External Events with later

additional insights, their potential to impact equipment which could initiate or mitigate a

-5- Enclosure

plant transient, or their impact on the plants ability to respond to a security event. Using

the documents listed in the attachment, the inspectors verified that fire hoses and

extinguishers were in their designated locations and available for immediate use; that

fire detectors and sprinklers were unobstructed, that transient material loading was

within the analyzed limits; and fire doors, dampers, and penetration seals appeared to

be in satisfactory condition. The inspectors also verified that minor issues identified

during the inspection were entered into the licensees corrective action program.

  • February 13, 2008, Fire Zone 2C during fuel movement
  • March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO
  • March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO
  • March 15, 2008, Fire Zone 19C Controlled Access Corridor

Documents reviewed by the inspectors included:

  • CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated

February 28, 2003

  • CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated

November 5, 2007

These activities constituted four quarterly fire protection inspection samples as defined

by Inspection Procedure 71111.05-05.

b. Findings

No findings of significance were identified.

1R07 Annual Heat Sink Performance (71111.07)

a. Inspection Scope

The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify

that potential deficiencies did not mask the licensees ability to detect degraded

performance, to identify any common cause issues that had the potential to increase

risk, and to ensure that the licensee was adequately addressing problems that could

result in initiating events that would cause an increase in risk. The inspectors reviewed

the licensees observations as compared against acceptance criteria, the correlation of

scheduled testing and the frequency of testing, and the impact of instrument

inaccuracies on test results. Inspectors also verified that test acceptance criteria

considered differences between test conditions, design conditions, and testing

conditions.

  • January 25 and January 21, 2008, A and B REC HX performance tests

Documents reviewed are listed in the attachment.

This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.

-6- Enclosure

b. Findings

No findings of significance were identified.

1R11 Licensed Operator Requalification Program (71111.11)

Conformance With Simulator Requirements Specified in 10 CFR 55.46

a. Inspection Scope

The inspectors observed testing and training of senior reactor operators and reactor

operators to identify deficiencies and discrepancies in the training, to assess operator

performance, and to assess the evaluator's critique. The training scenario involved a

tornado, station blackout and a loss of shutdown cooling.

  • February 28, 2008, Crew E drill

Documents reviewed by the inspectors included:

The inspectors completed one sample.

b. Findings

No findings of significance were identified.

1R12 Maintenance Effectiveness (71111.12)

a. Inspection Scope

The inspectors evaluated degraded performance issues involving the risk significant

systems of events such as where ineffective equipment maintenance has resulted in

valid or invalid automatic actuations of engineered safeguards systems and

independently verified the licensee's actions to address system performance or condition

problems in terms of the following:

  • implementing appropriate work practices;
  • identifying and addressing common cause failures;
  • scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
  • characterizing system reliability issues for performance;
  • charging unavailability for performance;
  • trending key parameters for condition monitoring;

-7- Enclosure

  • verifying appropriate performance criteria for structures, systems, and

components (SSCs) functions classified as (a)(2) or appropriate and adequate

goals and corrective actions for systems classified as (a)(1).

The inspectors assessed performance issues with respect to the reliability, availability,

and condition monitoring of the system. In addition, the inspectors verified maintenance

effectiveness issues were entered into the corrective action program with the appropriate

significance characterization.

assembly (EPA) breaker failures January 12, 2008

  • March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008

Documents reviewed by the inspectors included:

  • Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1
  • Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC

This inspection constitutes two quarterly maintenance effectiveness samples as defined

in Inspection Procedure 71111.12-05.

b. Findings

No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)

a. Inspection Scope

The inspectors reviewed the licensee's evaluation and management of plant risk for the

maintenance and emergent work activities affecting risk-significant and safety-related

equipment listed below to verify that the appropriate risk assessments were performed

prior to removing equipment for work:

  • March 6, 2008, Inoperability of both DGs on September 11, 2007

These activities were selected based on their potential risk significance relative to the

reactor safety cornerstones. As applicable for each activity, the inspectors verified that

risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate

and complete. When emergent work was performed, the inspectors verified that the

plant risk was promptly reassessed and managed. The inspectors reviewed the scope

of maintenance work, discussed the results of the assessment with the licensee's

probabilistic risk analyst or shift technical engineer, and verified plant conditions were

consistent with the risk assessment. The inspectors also reviewed TS requirements and

walked down portions of redundant safety systems, when applicable, to verify risk

analysis assumptions were valid and applicable requirements were met. Documents

reviewed are listed in the attachment.

The inspectors completed two samples.

-8- Enclosure

b. Findings

No findings of significance were identified.

1R15 Operability Evaluations (71111.15)

a. Inspection Scope

The inspectors reviewed the following issues:

The inspectors selected these potential operability issues based on the risk-significance

of the associated components and systems. The inspectors evaluated the technical

adequacy of the evaluations to ensure that TS operability was properly justified and the

subject component or system remained available such that no unrecognized increase in

risk occurred. The inspectors compared the operability and design criteria in the

appropriate sections of the TS and UFSAR to the licensees evaluations, to determine

whether the components or systems were operable. Where compensatory measures

were required to maintain operability, the inspectors determined whether the measures

in place would function as intended and were properly controlled. The inspectors

determined, where appropriate, compliance with bounding limitations associated with the

evaluations. Additionally, the inspectors also reviewed a sampling of corrective action

documents to verify that the licensee was identifying and correcting any deficiencies

associated with operability evaluations.

  • January 14, 2008, DG 2 operability and common cause evaluation for loss of

overspeed governor sightglass during run

  • January 15, 2008, operability evaluation of control room Board C non-essential

meters without isolation devices in DG 1 and DG 2 essential circuits, on January

14, 2008

  • February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in

DG 2

  • March 19, 2008, RPS EPA circuit breakers operability evaluations on

January 25, 2008 and February 6, 2008

This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.

b. Findings

No findings of significance were identified.

1R18 Plant Modifications (71111.18)

Temporary Modifications

a. Inspection Scope

The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs

to ensure that temporary alterations and configuration changes to the plant conformed to

-9- Enclosure

these guidance documents and the requirements of 10 CFR 50.59. The inspectors:

(1) verified that the modifications did not have an affect on system operability/availability;

(2) verified that the installations were consistent with modification documents;

(3) ensured that the post-installation test results were satisfactory and that the impacts of

the temporary modifications on permanently installed SSCs were supported by the test;

and (4) verified that appropriate safety evaluations were completed. The inspectors

reviewed the following temporary modifications:

Documents reviewed by the inspectors included:

  • Maintenance Procedure 7.0.7, Scaffolding Construction and Control,

Revision 24

The inspectors completed one sample.

b. Findings

Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a

regarding the licensees failure to follow the requirements of Maintenance Procedure

7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to

inspect all existing scaffolds and failed to identify multiple scaffolding interactions with

safety-related equipment during a required annual scaffold inspection on January 21,

2008.

Description. During pre-outage scaffold inspections on February 7, 2008, the licensee

discovered that some existing scaffolds were not built in accordance with established

procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had

been built in contact with safety-related service water piping, RHR piping, pipe hangers,

electrical conduit and the torus shell. This condition was documented in

CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of

the impacted safety systems, the licensee took actions to remove the non-compliant

scaffold on February 22, 2008, and closed the CR.

The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and

Control, Revision 24, contains the following requirement in Paragraph 3.2:

During the month of January, all erected scaffolds shall have an Industrial

Safety examination performed to ensure compliance with this procedure. This

examination is required prior to placing a new tag and entering the scaffold into

the new calendar year log.

The inspectors also noted that the required annual examination had been completed on

January 21, 2008. The maintenance personnel who conducted the examination in

WO 4552687 documented completion with no discrepancies.

On March 6, 2008, the inspectors questioned licensee management regarding the

performance of the annual scaffold examinations. Specifically, the inspectors asked why

the non-compliant scaffold had not been identified during the required annual scaffold

examinations. Following this meeting, the licensee conducted a scaffolding walkdown to

- 10 - Enclosure

identify any remaining non-compliances. The following additional violations of

Procedure 7.0.7 were discovered during this walkdown:

  • Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had

a board in contact with high pressure coolant injection steam line drip

leg piping. Contrary to Procedure 7.0.7, this scaffold had not been

inspected due to a misperception that only long term scaffolds that

had been in place greater than 90 days needed to be inspected. The

licensee documented this condition in CR-CNS-2008-01551.

  • Scaffold 08-06 was discovered to be in contact with safety-related

conduit and pipe hangers in the torus area. The licensee was unable to

determine when this scaffold had been installed.

  • Eight examples of non-compliant scaffolding handrails were discovered

in contact with safety system components in the torus area which had

been installed in 2002. This example, documented in

CR-CNS-2008-01563 on March 11, 2008 was not identified by the

annual examination because it was not included in the scaffold log and

was therefore not inspected.

The inspectors determined that Procedure 7.0.7 had been violated during the

January 21, 2008 annual scaffolding examination in that the examiner reviewed only

those scaffolds identified in the scaffolding log as Long Term Permanent versus all

erected scaffolds as required by the procedure. As a result, seven existing scaffolds

were not inspected, despite the fact that some of them had been installed for more than

one year at the time of the inspection. In addition, the examiner did not conduct a

thorough inspection to ensure compliance with this procedure. Obvious non-

compliances existed in some of the installed scaffolds that were not identified until

months later.

The inspectors also noted that since handrails built from scaffolding materials do not

meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an

elevated platform, no annual inspections have been performed on these structures.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,

Scaffolding Construction and Control. The finding is more than minor because if left

uncorrected the failure to perform annual scaffold inspections could become a more

significant safety concern. Specifically, annual inspections failed to inspect all existing

scaffolds and failed to identify multiple scaffolding interactions with safety-related

equipment. Using the Manual Chapter 0609, Significance Determination Process,

Phase 1 Worksheet, the finding is determined to have a very low safety significance

because it did not result in the loss of function of a TS required system for greater than

its allowed outage time. The cause of this finding is related to the human performance

crosscutting component of work practices because maintenance personnel did not follow

the requirements of Maintenance Procedure 7.0.7 (H.4(b)).

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,

and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,

Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,

- 11 - Enclosure

requires that maintenance that can affect the performance of safety-related equipment

should be properly pre-planned and performed in accordance with written procedures.

Contrary to this requirement, on January 21, 2008, maintenance personnel violated the

requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in

that they did not inspect all required scaffolds or identify obvious non-compliances with

Procedure 7.0.7. Because the finding is of very low safety significance and has been

entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated

as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.

1R19 Postmaintenance Testing (71111.19)

a. Inspection Scope

These activities were selected based upon the SSCs ability to impact risk. The

inspectors evaluated these activities for the following (as applicable): the effect of testing

on the plant had been adequately addressed; testing was adequate for the maintenance

performed; acceptance criteria were clear and demonstrated operational readiness; test

instrumentation was appropriate; tests were performed as written in accordance with

properly reviewed and approved procedures; equipment was returned to its operational

status following testing (temporary modifications or jumpers required for test

performance were properly removed after test completion), and test documentation was

properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10

CFR Part 50 requirements, licensee procedures, and various NRC generic

communications to ensure that the test results adequately ensured that the equipment

met the licensing basis and design requirements. In addition, the inspectors reviewed

corrective action documents associated with postmaintenance tests to determine

whether the licensee was identifying problems and entering them in the CAP and that

the problems were being corrected commensurate with their importance to safety.

Documents reviewed are listed in the attachment.

The inspectors reviewed the following postmaintenance activities to verify that

procedures and test activities were adequate to ensure system operability and functional

capability:

  • March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008
  • March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008
  • March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and

thermography

  • March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008
  • March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008

The inspectors completed five samples.

- 12 - Enclosure

b. Findings

Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical

Connections

Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were

identified regarding the licensees failure to establish procedural controls for

maintenance of electrical connections on essential equipment. In the first example, the

licensee failed to include amphenol connections within the scope of existing periodic

electrical connection inspections to identify loosening connections. In the second

example, the licensee failed to incorporate internal operating experience into work

control procedures to ensure that DG-mounted amphenol connections were solidly

attached following maintenance. These failures to establish adequate procedural

controls led to the trip of DG 2 during testing on January 15, 2008.

Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a

postmaintenance test. The test was being conducted to verify the ability of DG 2 to

perform its safety function following repairs to the overspeed governor oil level sight

glass. The licensee determined that the cause of the trip of DG 2 was a loose

amphenol-type connection on the relay tachometer speed sensing circuit magnetic

pickup.

The licensee determined that this failure was similar in nature to a condition identified

during previous troubleshooting of DG 2. On December 10, 1995, operations personnel

initiated a CR to document that the amphenol connector on a DG mounted magnetic

pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the

licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors

and apply thread locking compound to the amphenol threads to keep the connection

from vibrating loose. The completion of these actions was documented in Minor

Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions

were taken to codify the use of thread locking compounds or other measures to prevent

the amphenol connections from coming unthreaded during engine operation.

During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm

was unexpectedly received, as described in CR 4-13285. Minor Maintenance

WO 003915 was initiated to determine the cause of the unexpected alarm. During

completion of this WO on December 29, 2000, maintenance personnel replaced the

relay tachometer and the associated MPU, and the associated amphenol connection

was disconnected and then reconnected.

In the first example of this performance deficiency, the inspectors determined that the

licensees procedures for performing periodic DG electrical examinations were

inadequate in that they did not include engine-mounted components. Maintenance

Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was

created on September 30, 1988 to perform periodic (once per operating cycle)

preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC

identified an NCV regarding the licensees failure to establish adequate instructions for

emergency DG electrical maintenance (see NRC Special Inspection

Report 05000298/2007007). Two of the three examples described in the NCV dealt with

inadequate work instructions for checking the tightness of electrical connections on DG

system components. In response to this NCV, the licensee initiated Corrective Action #8

- 13 - Enclosure

under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically

check the DG systems for loose connections. In developing a revision to Maintenance

Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the

licensee made the erroneous assumption that all engine-mounted components have

other maintenance actions that satisfy the intent of the corrective action. As such,

engine-mounted connections were not included in the scope of the inspections in

Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised

procedure was subsequently completed for DG 2 on September 13, 2007. The

assumption was in error and resulted in a recently missed opportunity to discover the

loosening amphenol connection on the DG 2 relay tachometer MPU.

In the second example of this performance deficiency, the licensee determined that the

maintenance procedures used on December 29, 2000 did not contain adequate

guidance to ensure that thread locking compounds or other measures would be utilized

to ensure that the DG amphenol connections did not become unthreaded during engine

operation. The work was not conducted using detailed procedures, and as such the

licensee determined that the amphenol became loose as a result of either inadequate

tightening during the maintenance, or equipment vibration between 2000 and 2008 (due

to thread locking compound not being used), or a combination of both. The licensee has

initiated corrective actions to add the appropriate guidance to Administrative

Procedure 0.40.4, Planning.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to establish procedural controls for maintenance of electrical

connections on essential equipment. In the first example, the licensee failed to include

these amphenol connections within the scope of existing periodic electrical connection

inspections to identify loosening connections. In the second example, the licensee failed

to incorporate internal operating experience into work control procedures to ensure that

DG-mounted amphenol connections were solidly attached following maintenance.

These failures to establish adequate procedural controls led to the trip of DG 2 during

testing on January 15, 2008. The finding is more than minor because it is associated

with the mitigating systems cornerstone attribute of equipment performance and affects

the associated cornerstone objective to ensure the availability, reliability, and capability

of systems that respond to initiating events to prevent undesirable consequences. The

Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"

were used to conclude that a Phase 2 analysis was required because the finding

represents an actual loss of safety function of a single train for greater than its TS

allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor

Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table

with an assumed exposure time of greater than 30 days yielded a result of red, or very

high significance. A Phase 3 analysis conducted by a risk analyst preliminarily

determined the finding to be of white, or low to moderate significance.

The cause of the finding is related to the corrective action component of the crosscutting

area of problem identification and resolution in that the licensee failed to take

appropriate corrective actions for a 2007 NRC inspection finding which identified

inadequate maintenance procedures for checking the tightness of DG electrical

connections (P.1(d)).

- 14 - Enclosure

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,

and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,

Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),

requires that maintenance affecting performance of safety-related equipment should be

performed in accordance with written procedures. Contrary to this, since December 29,

2000, the licensee used inadequate procedural guidance to reassemble amphenol

connections on DG 2. Additionally, since September 30, 1988, the licensees procedural

guidance for performing periodic electrical inspections has been inadequate in that it did

not check the tightness of engine-mounted amphenol connections. These inadequate

procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue

was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of

the findings final safety significance, this finding is identified as Apparent Violation (AV)05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of

Emergency DG Electrical Connections."

1R22 Surveillance Testing (71111.22)

Routine Surveillance Testing

a. Inspection Scope

The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that

the three surveillance activities listed below demonstrated that the SSCs tested were

capable of performing their intended safety functions. The inspectors either witnessed

or reviewed test data to verify that the following significant surveillance test attributes

were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)

acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;

(7) test data; (8) testing frequency and method demonstrated TS operability; (9) test

equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code

requirements; (12) engineering evaluations, root causes, and bases for returning tested

SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;

and (14) annunciators and alarms setpoints. The inspectors also verified that the

licensee identified and implemented any needed corrective actions associated with the

surveillance testing.

The inspectors observed in-plant activities and reviewed procedures and associated

records to determine whether: any preconditioning occurred; effects of the testing were

adequately addressed by control room personnel or engineers prior to the

commencement of the testing; acceptance criteria were clearly stated, demonstrated

operational readiness, and were consistent with the system design basis; plant

equipment calibration was correct, accurate, and properly documented; as left setpoints

were within required ranges; the calibration frequency was in accordance with TS, the

UFSAR, procedures, and applicable commitments; measuring and test equipment

calibration was current; test equipment was used within the required range and

accuracy; applicable prerequisites described in the test procedures were satisfied; test

frequencies met TS requirements to demonstrate operability and reliability; tests were

performed in accordance with the test procedures and other applicable procedures;

jumpers and lifted leads were controlled and restored where used; test data and results

were accurate, complete, within limits, and valid; test equipment was removed after

testing; where applicable, test results not meeting acceptance criteria were addressed

with an adequate operability evaluation or the system or component was declared

- 15 - Enclosure

inoperable; where applicable for safety-related instrument control surveillance tests,

reference setting data were accurately incorporated in the test procedure; where

applicable, actual conditions encountering high resistance electrical contacts were such

that the intended safety function could still be accomplished; prior procedure changes

had not provided an opportunity to identify problems encountered during the

performance of the surveillance or calibration test; equipment was returned to a position

or status required to support the performance of the safety functions; and all problems

identified during the testing were appropriately documented and dispositioned in the

CAP.

The inspectors reviewed the test results for the following activities to determine whether

risk-significant systems and equipment were capable of performing their intended safety

function and to verify testing was conducted in accordance with applicable procedural

and TS requirements:

performed January 14, 2008

  • February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,

2008

  • March 19, 2008, 6.REC.201 performed January 31, 2008
  • March 21, 2008, DG 2 monthly operability test performed March 11, 2008

This inspection constitutes four routine surveillance testing samples as defined in

Inspection Procedure 71111.22.

b. Findings

No findings of significance were identified.

EP4 Emergency Action Level and Emergency Plan Changes (71114.04)

CNS Emergency Plan Revision 53

a. Inspection Scope

The inspector performed an in-office review of Revision 53 to the Cooper Nuclear

Station Emergency Plan, received January 8, 2008. This revision moved the licensee's

Joint Information Center (emergency news center) from Columbus, Nebraska, to

Auburn, Nebraska, revised position duties in the Emergency Operations Facility and

Joint Information Center, deleted the Technical Information Coordinator (EOF) position,

revised position titles in the Joint Information Center, added a Letter of Agreement

between the licensee and the Nebraska City Fire Department, and revised geographical-

based protective action zones in Missouri, based on an approval letter from Federal

Emergency Management Agency, Region VII, dated October 10, 2007.

This revision was compared to its previous revision, to the criteria of NUREG-0654,

Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and

Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in

- 16 - Enclosure

10 CFR 50.47(b) to determine if the revision adequately implemented the requirements

of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and

did not constitute approval of licensee changes; therefore, this revision is subject to

future inspection.

The inspectors completed one sample during the inspection.

b. Findings

No findings of significance were identified.

4. OTHER ACTIVITIES

4OA1 Performance Indicator (PI) Verification (71151)

.1 Data Submission Review

a. Inspection Scope

The inspectors performed a review of the data submitted by the licensee for the 4th

Quarter 2007 PIs for any obvious inconsistencies prior to its public release in

accordance with Inspection Manual Chapter 0608, Performance Indicator Program.

This review was performed as part of the inspectors normal plant status activities and,

as such, did not constitute a separate inspection sample.

b. Findings

No findings of significance were identified.

.2 Unplanned Scrams per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical

hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To

determine the accuracy of the PI data reported during those periods, PI definitions and

guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,

Regulatory Assessment Performance Indicator Guideline, were used. The inspectors

reviewed the licensees operator narrative logs, issue reports, event reports and NRC

inspection reports to validate the accuracy of the submittals. The inspectors also

reviewed the licensees issue report database to determine if any problems had been

identified with the PI data collected or transmitted for this indicator and none were

identified.

This inspection constitutes one unplanned scrams per 7000 critical hours sample as

defined by Inspection Procedure 71151.

b. Findings

No findings of significance were identified.

- 17 - Enclosure

.3 Unplanned Transients per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the unplanned transients per

7000 critical hours PI for the period from the 1st quarter 2007 through the 4th

quarter 2007. To determine the accuracy of the PI data reported during those periods,

PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute

Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.

The inspectors reviewed the licensees operator narrative logs, issue reports,

maintenance rule records, event reports and NRC integrated Inspection reports to

validate the accuracy of the submittals. The inspectors also reviewed the licensees

issue report database to determine if any problems had been identified with the PI data

collected or transmitted for this indicator and none were identified.

This inspection constitutes one unplanned transients per 7000 critical hours sample as

defined by Inspection Procedure 71151.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems (71152)

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency

Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical

Protection

.1 Routine Review of Items Entered Into the CAP

a. Inspection Scope

The inspectors performed a daily screening of items entered into the licensee's CAP.

This assessment was accomplished by reviewing CRs and WOs and attending

corrective action review and work control meetings. The inspectors: (1) verified that

equipment, human performance, and program issues were being identified by the

licensee at an appropriate threshold and that the issues were entered into the CAP;

(2) verified that corrective actions were commensurate with the significance of the issue;

and (3) identified conditions that might warrant additional followup through other baseline

inspection procedures.

b. Findings

No findings of significance were identified.

.2 Selected Issue Followup Inspection

a. Inspection Scope

In addition to the routine review, the inspectors selected the issues listed below for a

more in-depth review. The inspectors considered the following during the review of the

- 18 - Enclosure

licensee's actions: (1) complete and accurate identification of the problem in a timely

manner; (2) evaluation and disposition of operability/reportability issues;

(3) consideration of extent of condition, generic implications, common cause, and

previous occurrences; (4) classification and prioritization of the resolution of the problem;

(5) identification of root and contributing causes of the problem; (6) identification of

corrective actions; and (7) completion of corrective actions in a timely manner.

  • December 27, 2007, loss of both plant monitoring and information system

computers

Documents reviewed by the inspectors included:

  • Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4
  • Computer System Operating Procedure 2.6.3, Computer Systems Operation

and Outage Recovery, Revision 23

The inspectors completed one sample.

b. Findings

No findings of significance were identified.

4OA3 Followup of Events and Notices of Enforcement Discretion (71153)

.1 (Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance

Leads to Rendering Second Diesel Inoperable

On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil

day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,

control room operators received annunciators due to a rising level in the DG 1 fuel oil

day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to

failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel

Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1

inoperable. With DG 2 already inoperable, the control room staff properly entered

Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an

operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

In an effort to restore operability of DG 1, the licensee elected to attempt repair of the

leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing

DG 1 into maintenance lockout and entry into an overall red risk window for the station.

The repair attempt was unsuccessful, and the control room staff subsequently entered

Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4

within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Operability of DG 1 was subsequently restored by closing a fuel oil

system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.

The licensee initiated this LER due to the loss of safety function (on-site emergency

power) that occurred during the corrective maintenance attempt on DG 1. The

inspectors reviewed all aspects of the event, including performance of control room staff,

planning of the associated WOs, evaluation and mitigation of station risk, configuration

control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency

- 19 - Enclosure

and emergent work, and relationship to previous work on DG 1. A related violation of

NRC requirements is discussed in detail in NRC Integrated Inspection Report 05000298/2007005. This LER is closed.

.2 (Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency

Filter System Fan Motor Results in Loss of Safety Function

During a preventative maintenance inspection on December 3, 2007, licensee

technicians discovered severely overheated motor leads on the Control Room

Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the

damaged motor leads, operations staff declared the fan inoperable and determined that

since CREFS is a single-train safety system, a loss of safety function had occurred.

Immediate action was taken and the degraded booster fan was replaced. CREFS was

returned to an operable status on December 4, 2007. The degraded condition was

determined to have been caused by the improper crimping of the motor lugs by the

manufacturer prior to installation in the plant. No performance deficiencies were

identified during the review of this LER. This LER is closed.

4OA6 Management Meetings

Exit Meeting Summary

On January 15, 2008, a regional inspector conducted a telephonic exit to present the

results of the in-office inspection of licensee changes to the emergency plan to

Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.

The inspector confirmed that proprietary information was not provided or examined

during the inspection.

On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the

results of the in-office inspection of changes to the licensees emergency plan to

Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The

inspector confirmed that proprietary, sensitive, or personal information examined during

the inspection had been returned to the identified custodian.

On April 14, 2008, the resident inspectors presented the inspection results to

Mr. M. Colomb, General Manager of Plant Operations and other members of the

licensee staff. The licensee acknowledged the issues presented. The inspectors asked

the licensee whether any materials examined during the inspection should be

considered proprietary. No proprietary information was identified.

- 20 - Enclosure

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

John Austin, Manager, Emergency Preparedness Manager

Mark Bergmeier, Operations Support Group Supervisor

Vasant Bhardwaj, Engineering Support Manager

Michael Boyce, Director of Projects

Daniel Buman, System Engineering Manager

Michael Colomb, General Manager of Plant Operations

Jeff Ehlers, Engineer, Electric Systems/I&C

Roman Estrada, Corrective Action and Assessments Manager

Jim Flaherty, Senior Staff Licensing Engineer

Paul Fleming, Director of Nuclear Safety Assurance

Scott Freborg, Valves Engineering Programs Supervisor

Gabe Gardner, Design Engineering Civil Engineering Supervisor

Gary Kline, Director of Engineering

Dave Madsen, Licensing Engineer

Mark F Metzger, Engineer, Electric Systems/I&C

Ole Olson, Engineer, Engineering Support & Risk Management

Raymond Rexroad, Engineer, Electric Systems/I&C

Todd Stevens, Manager-Design Engineering

Mark Unruh, Senior Staff Engineer

David VanDerKamp, Licensing Manager

Marshall VanWinkle, Design Engineering Mechanical Supervisor

Dave Werner, Operations Training Support Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000298/2008002-02 AV Failure to Establish Adequate Procedures for Maintenance of

Emergency Diesel Generator Electrical Connections

Closed

05000298/2007-006-00 LER Procedural Guidance Leads to Rendering Second Diesel

Inoperable

05000298/2007-007-00 LER Damaged Lead on Emergency Filter System Fan Motor

Results in Loss of Safety Function

Opened and Closed

05000298/2008002-01 NCV Failure to Follow Scaffold Inspection Procedures

LIST OF DOCUMENTS REVIEWED

The following is a partial list of documents reviewed during the inspection. Inclusion on this list

does not imply that the NRC inspector reviewed the documents in their entirety, but rather that

selected sections or portions of the documents were evaluated as part of the overall inspection

A1-1 Attachment 1

effort. Inclusion of a document on this list does not imply NRC acceptance of the document or

any part of it, unless this is stated in the body of the inspection report.

1R07: Heat Sink Performance

Condition Report

CR-CNS-2008-00029

Procedures

Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger

Performance Analysis, Revision 27

Engineering Procedure 3.34, Heat Exchanger Program, Revision 9

Work Orders

4592135

4592134

1R13: Maintenance Risk Assessments and Emergent Work Control

Procedures

EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2

GOP 2.1.11, Station Operator Tours, Revision 127

Procedure 0.49, Schedule Risk Assessment, Revision 20

Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5

Work Order

WO 4618242

1R19: Post Maintenance Testing

Condition Reports

CR-CNS-2008-00720

CR-CNS-2008-00738

Procedures

SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5

6.EE.606, 250 V Battery Charger Performance Test, Revision 19

MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5

MP 7.3.14, Thermal Examination of Plant Components, Revision 7

A1-2 Attachment 1

Work Orders

WO 4523441

WO 4532270

WO 4541631

WO 4532754

WO 4581466

1R22: Surveillance Testing

Condition Report

CR-CNS-02007-06517

Procedures

6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing

Test, Revision 12

T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0

T.S. Sec 5.5.6, CNS IST Program

6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24

EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23

CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2

DCD-01, p. B-12, Revision dated October 28, 2006

SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47

6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16

SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52

Work Order

WO 4578012

LIST OF ACRONYMS USED

ASME American Society of Mechanical Engineers

AV apparent violation

CAP corrective action program

CFR Code of Federal Regulations

CR condition reports

DG diesel generator

HX heat exchange(r)

LCO limiting condition for operation

LER licensee event report

NCV noncited violation

PI performance indicator

PMT postmaintenance testing

REC uranium hexafluoride

RHR residual heat removal

TS Technical Specification

UFSAR Updated Final Safety Analysis Report

WO work order

A1-3 Attachment 1

Cooper Nuclear Station

Failure of EDG 2 Speed Sensing Circuit

SDP Phase 3 Analysis

Performance Deficiency:

Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was

caused by a failure of an amphenol connection on the EDG speed sensing circuit.

Assumptions:

1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only

during times that the diesel generator was running; specifically in response to the vibration

of the operating engine. There is no assumption of accelerated degradation associated with

diesel starts or any degradation while the unit was in standby. It is further assumed that the

failure was a deterministic outcome set to occur after a specific number of operating hours.

The diesel was run at the following times:

09/13/07 - ran for 2 hrs 15 min

10/15/07 - ran for 5 hrs 45 min

11/13/07 - ran for 5 hrs 21 min

12/10/07 - ran for 5 hrs 51 min

01/14/08 - ran for 5 hrs 21 min (1700)

01/15/08 - failure less than one minute after starting

01/16/08- EDG 2 restored to a functional status (1700)

Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP

demand, or it was inoperable for maintenance, during the two-day period from January 14 to

January 16, 2008.

Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following a

LOOP demand at any time during the 35-day period from its last successful surveillance test

on December 10, 2007 until the test failure that occurred on January 14, 2008.

Prior to this date, EDG 2 would have run and failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the 27-day period

from November 13, 2007 to December 10, 2007.

Prior to this date, EDG 2 would have run and failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during the 29-day period

from October 15, 2007 to November 13, 2007.

Prior to this date, EDG 2 would have failed to run at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during the 32-day period

from September 13, 2007 to October 15, 2007.

Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed

sensing circuit failure for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the mission time assumed in the SPAR model.

Therefore, prior to this date no additional risk impact is assumed.

2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the

outcome of any of the SPAR core damage sequences, the longest of which is 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> (as

modified by an extension to the battery duration (assumption #3). Adjustments made to the

A2-1 Attachment 2

performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG

CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,

unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,

including a very small contribution from the action steps of repairing the amphenol

connection and re-starting the EDG, which are relatively simple.

The following table presents the diagnosis tabulation:

Diagnosis (0.01) Multiplier Action (0.001) Multiplier

Available Time Expansive 0.01 Nominal 1

Stress Extreme 5 High 2

Complexity High 5 Nominal 1

Experience/Training Nominal 1 Nominal 1

Procedures Not Available 50 Nominal 1

Ergonomics Poor 10 Nominal 1

Product of Multipliers 125 2

Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558

Action HEP = 0.001(2) = 0.002

Total HEP = 0.56

For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit

failure applies to sequences of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or greater. The only sequence that is less than 4

hours is a 30 minute sequence, for which no recovery of the amphenol connection is

assumed.

The SPAR model does not distinguish between cutsets that contain two or just one EDG

failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely

to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in

this analysis, this feature of the SPAR model is not altered

3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge

capability following a station blackout. Based on information received from the licensee, this

credit was extended to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Although the batteries could potentially function beyond

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> under certain conditions other challenges related to the operation of RCIC and

HPCI in station blackout conditions would be present. These challenges include the

availability of adequate injection supply water and operational concerns of RCIC under high

back pressure conditions as a result of the unavailability of suppression pool cooling during

an extended station blackout event.

4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to

operate for the period of time before it is assumed to fail from the connector failure during

the various exposure periods. This introduces a slight inconsistency to the risk estimate, but

because it would similarly affect both the base and current case, it does not significantly

influence the result of this analysis.

5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed

to be independent in nature. The reason for this determination is based on the following

A2-2 Attachment 2

reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine

vibration while the EDG was running. Historically, EDG 2 has experienced vibration

problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the

amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very

unlikely that this type of failure would occur on both EDGs at the same time. The fact that it

took 7 years of operation for EDG 2 to reach the point of failure also points to the

unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the

exposure period of this finding.

Even if both EDGs were determined to be vulnerable to a speed sensor amphenol

connection failure, there was no mechanism that would tend to cause both EDGs to fail

simultaneously. That is, the failure of one amphenol connection would not make failure of

the other one more likely. Therefore, for this case, the failure of both EDGs from this issue

would mathematically be modeled by the combined independent failures of both EDGs

instead of by a classic common cause coupling mechanism. For this case, the estimated

probability of an independent failure of EDG 1 from a failed amphenol connection during the

exposure period would be a small number compared to its baseline SPAR fail-to-run

probability and therefore this application would not appreciably affect the final result.

Finally, if EDG 1 had experienced problems with this connection, thereby making it

comparatively vulnerable to the same type of failure; it is likely that the licensee would have

taken more aggressive actions to address this issue, seeing that it affected both trains of

emergency power. Therefore, the conditions necessary to create the possibility of a

common cause failure would also have triggered actions to prevent it.

The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A

cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.

The model was revised by INL to increase the battery life to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />, as discussed above. In

addition, the timing of various sequences was lengthened based on data provided by the

licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),

with an HEP of 0.15. However, based on observations by the senior resident inspector, the

analyst concluded that credit for firewater injection should not be granted. This is because

barely enough time was available to perform the necessary actions and a valve that must be

opened to establish a flow path was non-functional with a stem-disk separation for the entire

period of exposure. There were other valves that could have been used in alternate lineups, but

it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure

the flow path.

Also, changes were made to the containment venting fault tree. In the original version, a loss of

Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the

vent function is possible by taking manual local actions to open the vent valves. The failure

probability of this action was estimated based on an observed evolution conducted in response

to questions concerning this analysis. This observation revealed that the actions needed to

perform this function were dangerous and complex and would be conducted in poor lighting and

high temperatures. Also, operators had little experience. The recovery efforts applied to both a

loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic

events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following

SPAR-H analysis.

A2-3 Attachment 2

The diagnosis of the need to manually vent containment is obvious based on emergency

operating procedures that direct this action when containment pressure reaches 25 psig.

Operators would be continually monitoring this parameter, and it is very unlikely that the effort to

manually vent containment would not be undertaken at 25 psig and possibly prior to this point.

For the action steps, approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of time are available from the time that containment

pressurizes to 25 psig until containment would fail. The nominal time needed to perform the

manually venting task is estimated at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In this case, the relevant SPAR-H category for

time is nominal. Extreme stress is chosen because the effort to manually open the vent valves

involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The

effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to

the valves and performing several manipulations. Operators have little experience with this

evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack

of lighting.

Diagnosis (0.01) Multiplier Action (0.001) Multiplier

Available Time Expansive 0.01 Nominal 1

Stress High 2 Extreme 5

Complexity Obvious 0.1 Moderate 2

Experience/Training Nominal 1 Low 3

Procedures Nominal 1 Nominal 1

Ergonomics Nominal 1 Poor 10

Product of Multipliers 0.002 300

Diagnosis HEP = 0.01(.002) = 2.0E-5

Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23

Total HEP = 0.23

To model the failure of the speed sensing circuit and its specific recovery, a new and gate was

added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the

speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of

restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are

considered similar to the same for the various prior exposure periods. The common cause

probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets

containing the independent failure of EDG 2 contribute to the delta CDF of this finding.

Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG

recovery basic events were removed from cutsets that contained an EDG 2 speed sensor

failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure

to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset

of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery

for those sequences.

Internal Events Analysis:

A. Risk Estimate for the 2-day period between January 14 and January 16, 2006:

During this 48-hour period, it is assumed that EDG 2 was completely unavailable either

because of maintenance or because it would have failed within one minute after a LOOP

A2-4 Attachment 2

demand. To represent the assumed failure and potential recovery of EDG 2, the new

basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was

set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of

4.172E-4 to ensure that cutsets containing common cause to run events would cancel

out in the base and current case.

The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.

B. Risk Estimate for the 35-day period between December 10, 2006 and January 14,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />. The LOOP frequency used in the analysis was adjusted to reflect the

situation that only LOOPs with durations greater than 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would result in a risk

increase attributable to the speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is

0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

3.99E-3/yr.

Resetting event time t=0 to 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 7.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, given that recovery has failed at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />.

An adjustment to account for the diminishment of decay heat must be considered. This

is because the magnitude of decay heat at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown is less than in

the early moments following a reactor trip, and the timing of core damage sequences is

affected by this fact. In the modified SPAR model, recovery times for offsite power are

set at the intervals of 30 minutes, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The analyst

determined that the average decay heat level in the first 30 minutes is approximately two

times the average level that exists between 5.35 and 6.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown.

Therefore, baseline 30-minute SPAR model sequences, that essentially account for

boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences

model safety relief valve failures to close, and are based more on inventory control than

core heat production. Therefore, no adjustment was made for these sequences. The

analyst determined that decay heat rates leveled out quickly following shutdown and

could find no basis for adjusting the times associated with the 4 and 10-hour sequences.

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

A2-5 Attachment 2

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.1112 0.0905 1 0.814

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.1112 0.0554 0.498

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.1112 0.0487 0.438

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.1112 0.0325 0.292

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.1112 0.0278 0.250

1. A SPAR recovery time of 1.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, which was 0.5934 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/35 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/35 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.5934)

Base Case 6.989E-7 6.702E-8 3.686E-8 3.535E-9 6.348E-8

Current Case 1.394E-5 1.337E-6 4.706E-7 4.513E-8 1.292E-6

Delta 1.229E-6

CDF/35 days

A2-6 Attachment 2

C. Risk Estimate for the 27-day period between November 13, 2007 and December 10,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is

0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is

1.58E-3/yr.

Resetting event time t=0 to 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 13.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, given that recovery has failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level

in the first 30 minutes is approximately three times the average level that exists between

11 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.

The 2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for

these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 30 minutes each

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.0441 0.0377 1 0.855

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0441 0.02922 0.662

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.0441 0.02712 0.615

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0441 0.02122 0.481

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0441 0.01912 0.433

1 A SPAR recovery time of 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is used, as discussed above, to account for

the lessening of decay heat

2 The SPAR recovery time was increased by 30 minutes.

A2-7 Attachment 2

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which was 0.7907 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/27 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/27 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.7907)

Base Case 4.332E-7 3.204E-8 3.168E-8 2.343E-9 2.970E-8

Current Case 9.216E-6 6.817E-7 4.216E-7 3.119E-8 6.505E-7

Delta 6.208E-7

CDF/27 days

D. Risk Estimate for the 29-day period between October 15, 2007 and November 13,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is

0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is

9.87E-4/yr.

Resetting event time t=0 to 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 18.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, given that recovery has failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level

in the first 30 minutes is approximately four times the average level that exists between

16 and 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The

A2-8 Attachment 2

2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for

these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.0275 0.02411 0.876

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0275 0.02032 0.738

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.0275 0.01922 0.698

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0275 0.01602 0.582

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0275 0.01482 0.538

1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, which was 0.8760 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/29 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/29 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.8760)

Base Case 3.263E-7 2.593E-8 2.675E-8 2.125E-9 2.380E-8

A2-9 Attachment 2

Current Case 7.071E-6 5.618E-7 3.601E-7 2.861E-8 5.332E-7

Delta 5.094E-7

CDF/29 days

E. Risk Estimate for the 32-day period between September 13, 2007 and October 15,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for 22.3

hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with

durations greater than 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> would result in a risk increase attributable to the speed

sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is

0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> is

6.98E-4/yr.

Resetting event time t=0 to 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 24.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, given that recovery has failed at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as in

the 5.35-hour case above. The analyst determined that the average decay heat level in the

first 30 minutes is approximately four times the average level that exists between 22 and

23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-

hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for these

sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the event

times that are relevant in the SPAR core damage cutsets:

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.0194 0.0177 1 0.912

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0194 0.01692 0.871

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.0194 0.01492 0.768

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0194 0.01342 0.691

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0194 0.01272 0.655

A2-10 Attachment 2

1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, the result for the base

and the current case that contain an EDG 1 FTS event were multiplied by the success

probability of recovering EDG 1 in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, which was 0.9267 (1- non-recovery

probability). This value was then subtracted to obtain a final result for the base and current

case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event

before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,

the methodology used effectively assumes that for EDG 1 fail to run events, the failure

occurs more or less at the same time that EDG 2 fails (22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />). This then would

suggest that the EDG recovery terms in the SPAR model would coincide with the event time

t=0 at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the onset of the LOOP and therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/32 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/32 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.9267)

Base Case 2.745E-7 2.407E-8 2.402E-8 2.106E-9 2.196E-8

Current Case 6.033E-6 5.289E-7 3.262E-7 2.860E-8 5.003E-7

Delta 4.783E-7

CDF/32 days

The following table presents the aggregate internal events result:

TIME PERIOD DAYS OF EXPOSURE DELTA CDF

01/14/08 - 01/16/08 2 1.528E-7

12/10/07 - 01/14/08 35 1.229E-6

11/13/07 - 12/10/07 27 6.208E-7

10/15/07 - 11/13/07 29 5.094E-7

09/13/07 - 10/15/07 32 4.783E-7

Total Internal Events Delta-CDF 2.990E-6

External Events Analysis:

The risk increase from fire initiating events was reviewed and determined to have a small impact

on the risk of the finding. Two fire scenarios were identified where equipment damage could

cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a

control room fire that affected either Vertical Board F or Board C. The second was a fire in the

Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote

because of the confined specificity of their locations and the fact that a combination of hot shorts

of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced

in this manner would be likely to succeed for the station blackout sequences that comprise the

majority of the risk, because a minimum of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> of battery power would be available, power

A2-11 Attachment 2

would presumably be available in the switchyard, and the breaker manipulations needed to

complete this task would be possible and within the capability of an augmented plant staff that

would respond to the event.

Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2

power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no

change in risk from the finding.

The other type of fires that would result in a LOOP are those that require an evacuation of the

control room. In this case, plant procedures require offsite power to be isolated from the vital

buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With

the assumption that the Division 2 EDG will fail 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> into the event, a station blackout

would occur at this time. The sequences that could lead to core damage would include a failure

of the Division 1 EDG, such that ultimate success in averting core damage would rely on

recovery of either EDG or of offsite power. A review of the onsite electrical distribution system

did not reveal any particular difficulties in restoring switchyard power to the vital buses in this

scenario, especially given that many hours are available to accomplish this task. The licensee

confirmed that for all postulated fire scenarios that would require evacuation of the control room,

a undamaged and available power pathway exists from the switchyard through the emergency

transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish

this task would take only a few minutes.

In general, the fire risk importance for this finding is small compared to that associated with

internal events because onsite fires do not remove the availability of offsite power in the

switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is

presumed to occur as a consequence of such events as severe weather or significant electrical

grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially

non-functional (no run time remaining) is small because of a very low initiating event probability.

The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact

on overall plant risk. When adjusted for the exposure period of this finding, the cumulative

baseline core damage frequency for the zones that had the potential for a control room

evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was

approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used

several bounding assumptions. The analyst qualitatively assumed that the increase in risk from

having EDG 2 in a status where it is assumed to fail at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would likely be somewhat

less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated

by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

well less than 10 percent. Based on these considerations, the analyst concluded that the risk

related to fires would not be sufficiently large to change the risk characterization of this finding.

The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.

As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope

of the seismic risk particular to this finding. The generic median earthquake acceleration

assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at

Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency

assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered

by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is

capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an

earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would

remove offsite power but not damage other equipment important to safe shutdown. In the

A2-12 Attachment 2

internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

duration would likely have recovery characteristics closely matching that from an earthquake.

The ratio between these two frequencies is 44. Based on this, the analyst qualitatively

concluded that the risk associated with seismic events would be small compared to the internal

result.

Flooding could be a concern because of the proximity to the Missouri River. However, floods

that would remove offsite power would also likely flood the EDG compartments and therefore

not result in a significant change to the risk associated with the finding. The switchyard

elevation is below that of the power block by several feet, but it is not likely that a slight

inundation of the switchyard would cause a loss of offsite power. The low frequency of floods

within the thin slice of water elevations that would remove offsite power for at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

but not debilitate the diesel generators indicates that external flooding would not add

appreciably to the risk of this finding.

Based on the above, the analyst determined that external events did not add significantly to the

risk of the finding.

Large Early Release Frequency:

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for

the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences

to determine an estimate of the change in large early release frequency caused by the finding.

The LERF consequences of this performance deficiency were similar to those documented in a

previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service

water pumps. The final determination letter was issued on March 31, 2005 and is located in

ADAMS, Accession No. ML050910127. The following excerpt from this document addressed

the LERF issue:

The NRC reevaluated the portions of the preliminary significance determination related

to the change in LERF. In the regulatory conference, the licensee argued that the

dominant sequences were not contributors to the LERF. Therefore, there was no

change in LERF resulting from the subject performance deficiency. Their argument was

based on the longer than usual core damage sequences, providing for additional time to

core damage, and the relatively short time estimated to evacuate the close in population

surrounding Cooper Nuclear Station.

LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment

Integrity Significance Determination Process as: the frequency of those accidents

leading to significant, unmitigated release from containment in a time frame prior to the

effective evacuation of the close-in population such that there is a potential for early

health effect. The NRC noted that the dominant core damage sequences documented

in the preliminary significance determination were long sequences that took greater than

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to proceed to reactor pressure vessel breach. The shortest calculated interval

from the time reactor conditions would have met the requirements for entry into a

general emergency (requiring the evacuation) until the time of postulated containment

rupture was 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The licensee stated that the average evacuation time for Cooper,

from the declaration of a General Emergency was 62 minutes.

A2-13 Attachment 2

The NRC determined that, based on a 62-minute average evacuation time, effective

evacuation of the close-in population could be achieved within 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Therefore, the

dominant core damage sequences affected by the subject performance deficiency were

not LERF contributors. As such, the NRCs best estimate determination of the change in

LERF resulting from the performance deficiency was zero.

In the current analysis, the total contribution of the 30-minute sequences for the 35-day period

(when 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> of EDG run time remained) to the current case CDF is only 0.54% of the total.

That is, almost all of the risk associated with this performance deficiency involves sequences of

duration 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> or longer following the loss of all ac power.

The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of

these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the

two-hour sequences comprise only 0.3 percent of the total.

Consequently, the analyst determined that the risk associated with large early release was very

small.

References:

SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004

GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)

Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1

NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of

Loss of Offsite Power Events: 1986-2004"

Peer Review:

See-Meng Wong, NRR

George McDonald, NRR

A2-14 Attachment 2

Retrieved from "https://kanterella.com/w/index.php?title=ML081270639&oldid=2157483"