ML071380478
| ML071380478 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 05/18/2007 |
| From: | Hay M C NRC/RGN-IV/DRP/RPB-C |
| To: | Brian W R Entergy Operations |
| References | |
| IR-07-006 | |
| Download: ML071380478 (32) | |
See also: IR 05000416/2007006
Text
May 18, 2007William R. Brian, Vice President, Operations
Grand Gulf Nuclear Station
Entergy Operations, Inc.
P.O. Box 756
Port Gibson, MS 39150 SUBJECT:GRAND GULF NUCLEAR STATION - NRC SPECIAL INSPECTIONREPORT 05000416/2007006Dear Mr. Brian:
On March 14, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed a specialinspection at your Grand Gulf Nuclear Station facility. This inspection examined activities
associated with the Division I standby diesel generator (SDG) high temperature event that
occurred on January 30, 2007. On this occasion, the SDG experienced elevated temperatures
in the jacket water and lube oil subsystems. The NRC's initial evaluation satisfied the criteria in
NRC Management Directive 8.3, "NRC Incident Investigation Program," for conducting a special
inspection. The basis for initiating this special inspection is further discussed in this report, which is included as Attachment 2. The determination that the inspection would be conducted
was made by the NRC on February 8, 2007, and the inspection started on February 12, 2007.The enclosed inspection report documents the inspection findings, which were discussed onMarch 14, 2007 and again on April 25, 2007, with you and other members of your staff. The
inspection examined activities conducted under your license as they relate to safety and
compliance with the Commission's rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed
personnel.The report documents four findings which were determined to be violations of very low safetysignificance. Because of their very low safety significance and because they were entered into
your corrective action program, the NRC is treating these findings as noncited violations
consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these NCVs, you
should provide a response within 30 days of the date of this inspection report, with the basis for
your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk,
Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear
Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas,
76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission,
Washington DC 20555-0001; and the NRC Resident Inspector at the Grand Gulf Nuclear
Station facility.
Entergy Operations, Inc.- 2 -In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, itsenclosure, and your response (if any) will be made available electronically for public inspection
in the NRC Public Document Room or from the Publicly Available Records (PARS) component
of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).Sincerely,
/RA
Michael C. Hay, ChiefReactor Projects Branch CDocket: 50-416License: NPF-29Enclosure: Inspection Report 05000416/2007006 Attachment 1: Supplemental Information
Attachment 2: Special Inspection Charter
Attachment 3: Significance Determination Evaluationcc w/Enclosure:Executive Vice President
and Chief Operating Officer
Entergy Operations, Inc.
P.O. Box 31995
Jackson, MS 39286-1995
ChiefEnergy & Transportation Branch
Environmental Compliance and
Enforcement Division
Mississippi Department of
Environmental Quality
P.O. Box 10385
Jackson, MS 39289-0385PresidentClaiborne County Board of Supervisors
P.O. Box 339
Port Gibson, MS 39150General Manager, Plant OperationsGrand Gulf Nuclear Station
Entergy Operations, Inc.
P.O. Box 756
Port Gibson, MS 39150
Entergy Operations, Inc.- 3 -Attorney General Department of Justice
State of Louisiana
P.O. Box 94005
Baton Rouge, LA 70804-9005 Office of the GovernorState of Mississippi
Jackson, MS 39205Attorney GeneralAssistant Attorney General
State of Mississippi
P.O. Box 22947
Jackson, MS 39225-2947State Health OfficerState Board of Health
P.O. Box 139
Jackson, MS 39205 DirectorNuclear Safety & Licensing
Entergy Operations, Inc.
1340 Echelon Parkway
Jackson, MS 39213-8298Director, Nuclear Safety AssuranceEntergy Operations, Inc.
P.O. Box 756
Port Gibson, MS 39150Richard Penrod, Senior Environmental Scientist, State Liaison Officer
Office of Environmental Services
Northwestern State University
Russsell Hall, Room 201
Natchitoches, LA 71497
Entergy Operations, Inc.- 4 -Electronic distribution by RIV:Regional Administrator (BSM1)DRP Director (ATH)DRS Director (DDC)DRS Deputy Director (RJC1)Senior Resident Inspector (GBM)Branch Chief, DRP/C (MCH2)Senior Project Engineer, DRP/C (WCW)Team Leader, DRP/TSS (CJP)RITS Coordinator (MSH3)DRS STA (DAP)L. Trocine, OEDO RIV Coordinator (LXT)ROPreports
GG Site Secretary (NAS2)K. Fuller, RC/ACES (KSF)C. Carpenter, D:OE (CAC)G. Vasquez (GMV)OE:EA File (RidsOeMailCenter)SUNSI Review Completed: _WCW__ ADAMS: Yes G No Initials: _WCW__ Publicly Available
G Non-Publicly Available
G Sensitive Non-SensitiveR:\_REACTORS\GG\2007\GG2007-06RP-RWD.wpdRIV:SRI:DRP/ERI:DRP/CSRI:DRP/CSRA:DRSC:DRP/CRWDeeseAJBarrettGBMillerRLBywaterMCHay T-WCWalker E-WCWalker
MCHay for/RA//RA/5/17/075/14/075/16/075/13/075/18/07OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax
Enclosure-1-U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket:50-416Licenses:NPF-29
Report No.:05000416/2007006
Licensee:Entergy Operations, Inc.
Facility:Grand Gulf Nuclear StationLocation:Waterloo Road Port Gibson, Mississippi 39150Dates:February 12 through March 14, 2007
Inspectors:A. Barrett, Resident Inspector, Grand Gulf Nuclear StationR. Bywater, Senior Reactor Analyst
R. Deese, Senior Resident Inspector, Arkansas Nuclear One
G. Miller, Senior Resident Inspector, Grand Gulf Nuclear StationApproved By:Michael C. Hay, ChiefProject Branch C
Division of Reactor Projects
Enclosure-2-SUMMARY OF FINDINGSIR 05000416/2007006; 02/12/07 - 03/14/07; Grand Gulf Nuclear Station; Special Inspection inresponse to Division I Standby Diesel Generator high temperatures on January 30, 2007.The report covered a 4-day period (February 12-15, 2007) of onsite inspection, with inofficereview through March 14, 2007, by a special inspection team consisting of one senior resident
inspector, one resident inspector, and one senior reactor analyst. Four findings were identified.
The significance of most findings is indicated by its color (Green, White, Yellow, Red) using
Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the
significance determination process does not apply may be Green or be assigned a severity
level after NRC's management review. The NRC's program for overseeing the safe operation
of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight
Process," Revision 3, dated July 2000.Summary of EventThe NRC conducted a special inspection to better understand the circumstances surroundinghigh temperatures on the Division I standby diesel generator jacket water and lube oil systems
on January 30, 2007. In accordance with NRC Management Directive 8.3, "NRC Incident
Investigation Program," it was determined that this event involved repetitive failures of
safety-related equipment having potential adverse generic implications and had sufficient risk
significance to warrant a special inspection. A.NRC-Identified and Self-Revealing FindingsCornerstone: Mitigating Systems
- Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,Criterion XVI, "Corrective Action," involving the failure to identify and correct the
cause of elevated temperatures adversely affecting the safety function of the
Division I standby diesel generator that had previously occurred in 1999 and 2004.
Subsequently, on January 30, 2007, the Division I standby diesel generator again
experienced elevated temperatures during a surveillance run and was
subsequently declared inoperable. This issue was entered into the licensee's
corrective action program as Condition Report GGN-2007-0378. The finding is greater than minor because it is associated with the mitigatingsystems cornerstone attribute of equipment performance and affects the
cornerstone objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences. The
Phase 1 Worksheets in Manual Chapter 0609, "Significance Determination
Process," were used to conclude that a Phase 2 analysis was required because
the condition represented a loss of safety function of a single train of a Technical
Specification system for greater than its allowed outage time. The inspectors
performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power
Significance Determination Process," of Manual Chapter 0609, "Significance
Determination Process," and the Phase 2 Worksheet for Grand Gulf. The Phase 2
evaluation concluded that the finding was of very low safety significance. A
Phase 3 significance determination analysis also determined the finding was of
very low safety significance. The cause of the finding is related to the problem
Enclosure-3-identification and resolution crosscutting area in that the licensee failed tothoroughly evaluate the problem resulting in ineffective corrective actions being
implemented that failed to prevent recurrence of a significant condition adverse to
quality (Section 3.0).*Green. The team identified a noncited violation of Technical Specification 5.4.1 (a)involving the failure to maintain an adequate alarm response instruction for
standby diesel generator high jacket water temperature. Specifically,
Procedure 04-1-02-1H22-P400, "Alarm Response Instruction, Panel
No.: 1H-22-P400, Safety Related," Revision 109, failed to provide adequate
guidance to manually override the standby diesel generator jacket water cooling
system temperature control valve during emergency conditions. This issue was
entered into the licensee's corrective action program as
Condition Report GG-2007-1837. The finding is greater than minor because it is associated with the mitigatingsystems cornerstone attribute of procedure quality and affects the cornerstone
objective to ensure the availability, reliability, and capability of systems that
respond to initiating events to prevent undesirable consequences. Using Manual
Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, the
finding is determined to have very low safety significance because it did not screen
as potentially risk significant due to a seismic, flooding, or severe weather initiating
events. The cause of the finding is related to the problem identification and
resolution crosscutting area in that the licensee did not take appropriate correctiveactions to adequately address a previously identified safety concern (Section 4.0).*Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,Criterion XVI, "Corrective Action," involving the failure to promptly identify a
condition adverse to quality. Between February 2-15, 2007, the licensee failed to
promptly identify that corrective actions taken in response to a January 30, 2007,
failure of the Division 1 standby diesel generator jacket water cooling system
temperature control valve had not addressed the cause of the valve failure.
Specifically, following the valve's failure, the licensee inappropriately concluded the
valve's internal thermal elements were faulty, replaced the elements, performed
postmaintenance testing, and declared the valve and associated standby diesel
generator operable on February 1, 2007. Subsequent testing of the suspect faulty
thermal elements on February 2 and 13, 2007, found the components were
functional. Following receipt of the testing results, the licensee failed to promptly
identify that replacement of the thermal elements failed to address the cause of
the problem resulting in the failure to evaluate a potential degraded condition
affecting operability of the standby emergency diesel generator. This issue was
entered into the licensee's corrective action program as
Condition Report GGN-2007-2255. The finding is greater than minor because it is associated with the mitigatingsystems cornerstone attribute of equipment performance and affects the associate
cornerstone objective to ensure the availability, reliability, and capability of systems
that respond to initiating events to prevent undesirable consequences. Using
Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet,
the finding is determined to have very low safety significance because the
condition did not screen as potentially risk significant due to a seismic, flooding, or
Enclosure-4-severe weather initiating events. The cause of the finding is related to the problemidentification and resolution crosscutting area in that the licensee did not identify
an issue completely, accurately, and in a timely manner commensurate with its
safety significance resulting in the failure to evaluate a potential degraded
condition for operability (Section 5.0).*Green. The inspectors identified a Green noncited violation of 10 CFR Part 50Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for a failure to
follow procedures which resulted in an inadequate operability evaluation.
Specifically, the evaluation did not include an analysis of conditions that could be
causing the valve to fail, and it provided no assessment of the effect these
conditions would have related to the specified safety function and mission time of
the standby diesel generator. The licensee entered this issue in their corrective
action program as Condition Report GGN-2007-2256.This finding is more than minor because the failure to perform an adequateoperability evaluation, if left uncorrected, could become a more significant safety
concern. Using Manual Chapter 0609, "Significance Determination Process,"
Phase 1 Worksheet, this finding was of very low safety significance since it did not
result in a loss of operability. The cause of this finding has a crosscutting aspect
in the area of human performance associated with decision making because
licensee personnel failed to use conservative assumptions and did not verify the
validity of the underlying assumptions used in making safety-significant decisions
(Section 5.0).B.Licensee-Identified Violations
None
Enclosure-5-REPORT DETAILS1.0SPECIAL INSPECTION SCOPEThe NRC conducted a special inspection at Grand Gulf Nuclear Station (GGNS) tobetter understand the circumstances surrounding the high temperatures observed in the
jacket water system of the Division I standby diesel generator (SDG). The diesel
generator was manually shutdown during a surveillance run on January 30, 2007, when
the jacket water high temperature alarm annunciated. A failed jacket water cooling
system on the SDG could have overheated the diesel, potentially impacting the ability of
the SDG to perform its safety function during a design basis accident. In accordance
with NRC Management Directive 8.3, it was determined that this event had sufficient risk
significance to warrant a special inspection. The team used NRC Inspection Procedure 93812, "Special Inspection Procedure," toconduct the inspection. The special inspection team reviewed procedures, corrective
action documents, operator logs, design documentation, maintenance records, and
procurement records for the Division I SDG. The team interviewed various station
personnel regarding the event. The team reviewed the licencee's preliminary root cause
analysis report, past failure records, extent of condition evaluation, immediate and long
term corrective actions, and industry operating experience. A list of specific documents
reviewed is provided in Attachment 1. The charter for the special inspection is included
as Attachment 2.2.0SYSTEM AND EVENT DESCRIPTION2.1System DescriptionGGNS uses three diesel generators to provide standby power to safety-relatedequipment required to shutdown the reactor, maintain the reactor in a safe shutdown
condition, and mitigate the consequences of an accident. These diesel generators
supply electrical buses designated by division number: Division I, Division II, and
Division III. The Division I and II SDGs are Transamerica Delaval, Incorporated enginesrated at 5740 kw. The engines are DSRV-4 series (16-cylinder, 4-stroke, turbocharged,
and 45 V-type) and are designed to operate at 450 revolutions per minute.The GGNS Transamerica Delaval, Incorporated engines use an independent coolingwater system called the jacket water system to provide cooling water to the diesel
engine, the governor oil cooler, the lube oil cooler, and the turbocharger aftercoolers.
The jacket water system is a closed loop system with an expansion tank that utilizes two
pumps, one engine driven and the other an electrical, alternating current motor-driven
pump. Both pumps have a rated flow of approximately 1800-2100 gallons per
minute (gpm). The jacket water system rejects heat to the standby service water
system through the jacket water heat exchanger. An automatic three-way thermostatic control valve (TCV), manufactured by AmotControls, directs cooling water to the heat exchanger to maintain SDG temperature
between the operating range of 160F to 175F. During operation, approximately200-300 gpm is bypassed by the TCV to the jacket water heat exchanger. Specifically,
thermal elements modulate the valve to maintain cooling water at design temperature.
Enclosure-6-The GGNS TCV uses four thermal elements designed to maintain a nominaltemperature of 165F. Each thermal element actuates independently to provideapproximately one-fourth of the valve's full open stroke.2.2Event SummaryOn January 30, 2007, GGNS discovered elevated temperatures in the jacket watersystem of the Division I SDG during a monthly test run following a planned system
outage. The monthly surveillance required power to be loaded in increments of 1000 kw
up to a value greater than 5450 kw and less than 5740 kw. Approximately 5 minutes
after increasing the diesel power load to 4400 kw, the jacket water heat exchanger
outlet high temperature annunciator alarmed at 175F. Per the procedural guidance,the operator reduced load, shutting down the diesel in a few minutes with jacket water
temperature peaking at 180F. This indicates that the temperature was increasing at arate of at least 1F/min. The inspectors determined that GGNS met all TechnicalSpecification requirements during and following the event.GGNS began preparing work orders to inspect the valve internals and replace thethermal elements. During this time, operations completed the Technical Specification
required diesel start for the Division II SDG to verify operability. GGNS removed the
TCV internals, inspecting the thermal elements, the valve gaskets, and internal
assembly. The thermal elements and the gaskets were replaced with new parts and the
valve was reassembled. The resident inspector observed the Division I SDG retest and
verified that it passed the postmaintenance surveillance. The Division I SDG was
declared operable on February 1, 2007.3.0PERFORMANCE DEFICIENCIES RESULTING IN SDG FAILURE a.Inspection ScopeOn July 25, 1999, and September 22, 2004, the Division I SDG experienced hightemperatures in its jacket water and lube oil systems during performance of monthly
surveillance runs. The team reviewed the licensee's corrective actions following each of
these failures to assess their effectiveness with respect to preventing the subsequent
failure that occurred on January 30, 2007. b.FindingsIntroduction. The team identified a Green noncited violation (NCV) of 10 CFR Part 50,Appendix B, Criterion XVI, "Corrective Action," for the failure to prevent recurrence of
elevated temperature events on the Division I SDG after similar events occurred in 1999
and 2004. Description. The team noted that the licensee had documented four previousoccurrences of high temperature events on the Division I SDG since facility operation
began. The team found that documentation associated with two instances that occurred
in the late 1980's did not support meaningful analysis. The two other noted instances
occurring in 1999 and 2004 provided more insights, however, the team noted that these
evaluations were also deficient with respect to identifying the cause of failure.
Enclosure-7-On July 27, 1999, the licensee was conducting a monthly surveillance run of the SDG,when 80 minutes into the run, elevated jacket water and lube oil temperatures occurred
and their respective alarms were received. Operations personnel took action to secure
the SDG and temperatures in the jacket water and lube oil systems were noted to peak
at approximately 190F. The licensee secured the SDG and declared it inoperable. The condition was entered into the licensee's corrective action program (CAP) as
Condition Report (CR) GGN-1999-0768.This CR received a lower tier apparent cause evaluation. The actions taken for theapparent cause evaluation were reviewed by the team and determined to be
inadequate. The apparent cause concluded that two faulty thermal elements may have
caused failure of the TCV. This conclusion was based on the fact that these two
thermal elements looked different than the other thermal elements in the Division I and
Division II SDGs. No other conclusive evidence was cited in the evaluation. The team
noted the licensee made this determination even though subsequent testing of the two
thermal elements found them functional. On the basis of this information, the team
concluded the licensee failed to determine the cause of the SDG high temperature
condition that subsequently resulted in their failure to implement effective corrective
actions to prevent recurrence.On June 22, 2004, during a monthly surveillance run, the licensee experienced elevatedtemperatures in the Division I SDG jacket water and lube oil systems along with their
respective annunciators. Again the licensee took action to secure the SDG and the
jacket water and lube oil temperatures peaked at approximately 190F. The licenseesecured the SDG and declared it inoperable. The licensee entered this condition into
their CAP as CR GGN-2004-2575.The licensee conducted a root cause analysis for this event. The licensee tested thethermal elements and discovered that one was defective and had leaked some of its
paraffin material which rendered the thermal element incapable of actuating.
Additionally, the licensee discovered another thermal element failed to fully actuate
between the design specification of 0.42 to 0.48 inches. This thermal element stroked
0.40 inches. With this information, the licensee concluded that defective thermal
elements were the cause of the SDG high temperatures.The team questioned the validity of the licensee's conclusion that the thermal elementswere the cause. The team determined that since the TCV had two fully functional
thermal elements, in addition to an almost fully functioning third thermal element, that
the TCV would have been capable of opening approximately 75 percent of its full stroke
for the temperatures experienced during the 2004 event. The inspectors reached this
conclusion by adding the minimum full stroke specification for two thermal elements of
0.84 inches (0.42 inches for each thermal element) to the 0.40 inches from the partially
degraded thermal element and comparing this to the 1.625-inch full stroke for the TCV.The team noted that the vendor manual for the TCV recommended setting up the valveto allow full cooling flow with the valve halfway open (equivalent to approximately
0.8 inches of valve travel). The team also noted, that since initial setup of the valve, the
Division I SDG had been derated from its initial design full load capability of
7 megawatts to 5.6 megawatts and, therefore, would require even less cooling flow than
original design specifications. The inspectors concluded with these facts that the SDGshould have had adequate cooling flow with only two fully functional thermal elements.
Enclosure-8-The team was informed by the SDG system engineer that jacket cooling water system flow measurements were performed on the Division I SDG. These measurements were
performed at 5.6 megawatts of loading and showed that approximately 200-300 gpm of
flow were needed to be supplied to the jacket water heat exchanger of the total
1700-2100 gpm flow. The inspectors concluded from a review of the thermostatic valve
throttling characteristic curve that sufficient flow could be supplied with the valve opened
significantly less than half way.When the inspectors combined this flow data with the ability of the remaining fullycapable thermal elements, they concluded that the thermal elements were not the cause
of the high temperature event. The inspectors concluded that the root cause was
incorrect and; therefore, did not allow the licensee to determine the cause of the SDG
high temperatures, and thereby did not allow the licensee to prevent recurrence.Finally, on January 30, 2007, while performing a monthly surveillance run, the licenseeexperienced elevated temperatures in the Division I SDG jacket water and lube oil
systems along respective alarms for the high temperatures. The inspectors concluded
from this that the licensee had not prevented recurrence of a condition which left
uncorrected could have led to the unavailability of the SDG, a key risk-significant,
safety-related mitigating component during a design basis event.Analysis. The performance deficiency associated with this finding involved the licenseenot preventing recurrence of a significant condition adverse to quality. The finding is
greater than minor because it is associated with the mitigating systems cornerstone
attribute of equipment performance and affects the associated cornerstone objective to
ensure the availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. The Phase 1 Worksheets in Manual
Chapter 0609, "Significance Determination Process," were used to conclude that a
Phase 2 analysis was required because the finding represented a loss of safety function
of a single train of a Technical Specification system for greater than its allowed outage
time. The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis
For At Power Significance Determination Process," of Manual Chapter 0609,
"Significance Determination Process," and the Phase 2 Worksheets for Grand Gulf.
The inspectors assumed that the duration of the Division I SDG unavailability was
28 days. Additionally, the inspectors assumed the Division II SDG was unaffected and
operators could not recover the Division I SDG during a postulated high temperature
event. Based on the results of the Phase 2 analysis, the finding was determined to have
very low safety significance (Green). The senior reactor analyst's review of the Phase 2
analysis determined that a more detailed Phase 3 analysis was needed to fully assess
the safety significance. Based on the results of the Phase 3 analysis, the finding was
determined to have very low safety significance (Green). The Phase 3 analysis is
included as Attachment 3 to this report. The cause of the finding is related to the
problem identification and resolution crosscutting area in that the licensee failed tothoroughly evaluate the problem resulting in ineffective corrective actions being
implemented that failed to prevent recurrence of a significant condition adverse to
quality. Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," states, inpart, that for significant conditions adverse to quality, measures shall assure that the
cause of the condition is determined and corrective action taken to preclude repetition.
Contrary to the above, after the occurrence of high temperature conditions on the
Enclosure-9-Division I SDG on July 27, 1999, and June 22, 2004, the licensee failed to assure thatthe cause of these significant conditions adverse to quality were determined and that
corrective actions were taken to preclude repetition. Specifically, the licensee failed to
prevent the occurrence of a similar high temperature event on January 30, 2007. This
failure resulted in the Division I SDG being inoperable between January 2-30, 2007.
The root cause involved the licensee's inappropriate determination of the thermal
elements being the cause of the Division I SDG failures. The corrective actions to
restore compliance included replacing TCV FCV-501A on March 2, 2007. Because the
finding is of very low safety significance and has been entered into the licensee's CAP
as CR GGN-2007-0378, this violation is being treated as an NCV consistent with
Section VI.A of the Enforcement Policy: NCV 05000416/2007006-01, "Failure to
Prevent Recurrence of High Standby Diesel Generator Temperatures." 4.0OPERATOR RECOVERY a.Inspection ScopeThe team assessed the licensee's ability to recover the SDG from the high temperatureconditions had the conditions occurred during an event. In this effort, the inspectors
reviewed the revision of the alarm response instruction for high jacket water
temperatures on the SDG in effect on January 30, 2007, along with prior revisions to the
alarm response instruction. The inspectors also questioned operators shortly after
January 30, 2007, on how to perform the alarm response instruction. Finally, the
inspectors walked down the SDG rooms after January 30, 2007, to check for adequate
staging of necessary equipment to perform the steps of the alarm response instruction. b.FindingsIntroduction. The team identified a Green NCV of Grand Gulf TechnicalSpecification 5.4.1 (a) pertaining to an inadequate alarm response instruction for high
SDG jacket water temperature prior to the high temperature event on the Division I SDG
on January 30, 2007.Description. On June 22, 2004, while running the Division I SDG during a monthlysurveillance run, the SDG experienced high jacket water and lube oil temperatures
along with a high jacket water temperature alarm. The licensee entered this condition
into their CAP as CR GGN-2004-2575. The licensee took corrective action to attempt to address the cause of the SDG hightemperatures, and also took corrective action to improve the content of the alarm
response instruction for SDG high jacket water temperatures. Because this procedural
guidance was lacking during this 2004 high temperature event, operators did not have
clear guidance on how to respond to the event and the SDG was only secured when the
operations shift manager ordered the SDG shutdown. Revision 106 of the alarm
response instruction for high jacket water temperature was inadequate in that it did not
give guidance on how operators should respond to high jacket water temperatures
during emergency and nonemergency situations.In response to the assigned corrective action, operations procedure writers madechanges to the alarm response instruction for SDG high jacket water temperature.
These changes included providing instructions on how to manually override the SDG
Enclosure-10-jacket water TCV FCV-501. Revision 107 of the high jacket water outlet temperaturealarm response instruction added steps for removing the valve cap, adjusting the valve
position, and monitoring system temperatures upon receiving alarms for elevated
temperatures in the SDG jacket water system. The corrective action was closed when
the alarm response instruction was revised.On January 30, 2007, while performing a monthly surveillance run of the Division I SDG,the SDG experienced another high temperature jacket water event. Operators secured
the SDG in accordance with Revision 107, which gives them guidance to secure the
SDG on receipt of high temperatures in a nonemergency situation. After the event, the
resident inspectors questioned three operations personnel, including one senior reactor
operator, as to how they would have carried out the alarm response instruction in an
emergency situation. The operators were unfamiliar on how to perform the specific
subparts of the step which delineates manually overriding the TCV FCV-501. The
inspectors identified procedural inadequacies in the alarm response instruction. These
are listed below:*No details on removing TCV cap*Unclear information on the direction to turn the TCV
- No information was given regarding the number of turns that should be made.
- No specified parameter to monitor while manually operating the TCV
- The instructions did not identify how to remove the locknut on the TCVAlthough not reflective of the quality of the alarm response instruction, the inspectorsalso discovered that not all of the required tools were available to perform the manual
override operation. In noting the lack of detailed guidance in the procedure and the
unavailability of tools required by the procedure to perform these critical steps, the
inspectors concluded that the alarm response instruction for the SDG TCV was
inadequate.Analysis. The performance deficiency associated with this finding involved the licenseenot maintaining an adequate procedure. The finding is greater than minor because it is
associated with the mitigating systems cornerstone attribute of procedure quality and
affects the associated cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to initiating events to prevent undesirable
consequences. Using Manual Chapter 0609, "Significance Determination Process,"
Phase 1 Worksheet, the finding is determined to have very low safety significance
because it did not screen as potentially risk significant due to a seismic, flooding, or
severe weather initiating events. The cause of the finding is related to the problem
identification and resolution crosscutting area in that the licensee did not take
appropriate corrective actions to adequately address a previously identified safety
concern.Enforcement. Grand Gulf Technical Specification 5.4.1 (a) requires that writtenprocedures be established, implemented, and maintained covering the activities
specified in Appendix A, "Typical Procedures for Pressurized Water Reactors and
Boiling Water Reactors," of Regulatory Guide 1.33, "Quality Assurance Program
Requirements (Operation)," dated February 1978. Regulatory Guide 1.33, Appendix A,
Section 5, "Procedures for Abnormal, Offnormal, or Alarm Conditions," requires
procedures for safety-related annunciators to have written procedures which contain
immediate operation action and long-range actions. Contrary to this, prior to
Enclosure-11-January 30, 2007, Procedure 04-1-02-1H22-P400, "Alarm Response Instruction,Panel 1H-22-P400, Safety Related," Revision 107, was not adequate. Specifically, the
procedure did not provide adequate guidance for immediate operation action and
long-range action for manually overriding the SDG TCV. The root cause involved not
ensuring all needed instructions were included in the procedure revision. The corrective
actions to restore compliance included properly revising the procedure and training
operators on manual operation of the valve. Because the finding is of very low safety
significance and has been entered into the licensee's CAP as CR GGN-2007-1837, this
violation is being treated as an NCV consistent with Section VI.A of the Enforcement
Policy: NCV 05000416/2007006-02, "Inadequate Alarm Response Instruction for SD
Generator High Jacket Water Temperature." 5.0CORRECTIVE ACTIONS FOLLOWING SDG FAILURES a.Inspection ScopeThe team assessed the licensee's immediate and long-term planned corrective actionsassociated with the Division I SDG failure that occurred on January 30, 2007. The team
assessed the engineering and operations departments' implementation of the operability
determination (OD) process immediately after the failure and then after identifying that
the maintenance they had conducted to the TCV may not have corrected the cause of
the failure. This assessment was performed through interviews, review of operator logs,
corrective action documents, ODs, work orders, and related documents. b.Findings (1)Failure To Identify Actions Taken After SDG Inoperability Were InadequateIntroduction. The inspectors identified a Green NCV of 10 CFR Part 50, Appendix B,Criterion XVI, "Corrective Action," for the licensee's failure to identify that their corrective
action after the January 2007 high temperature event on the Division I SDG were not
adequate.Description. On January 30, 2007, the Division I SDG experienced the high temperatureevent. Operators shut down the SDG and declared it inoperable in an effort to
troubleshoot the cause of the high temperatures. During their troubleshooting and
maintenance, the licensee cleaned and inspected the internals of TCV FCV-501, and
replaced the valves thermal elements and o-rings. After reviewing the conduct of this
maintenance, reviewing input from engineering personnel as to the operability of the
SDG, and conducting a satisfactory surveillance run, operations personnel declared the
SDG operable. The licensee entered the high temperature event on the Division I SDG in their CAP asCR GGN-2007-0378 and began a root cause determination to find the cause of the
failure. In this effort, the licensee tested the thermal elements from the TCV for the
SDG at GGNS on February 2, 2007. This testing did not identify any failures of the
thermal elements. At that point, the licensee did not recognize, as an organization, that
their implemented corrective actions failed to fix the failure mechanism. The resident
inspectors subsequently questioned the operability with the licensee at which time they
stated they were sending the thermal elements to the vendor for further testing and
Enclosure-12-were waiting on those additional testing results. The inspectors considered that thelicensee missed an opportunity to identify that the SDG was not fully operable at this
time.On February 9, 2007, the additional vendor testing identified no thermal elementfailures. Engineering department personnel developed a white paper later that day and
distributed to selected site personnel. The white paper stated that binding of the valve
appeared to be the cause of the failure. Licensee personnel, including representatives
from the operations department, evaluated the white paper, but did not exercise their
processes to evaluate this condition in their CAP. As a result, the licensee did not
formally question the operability of the valve in an OD. The inspectors considered that
the licensee missed another opportunity to identify that the SDG was not fully operable
at this time.The special inspection team was sanctioned by NRC Region IV's management andarrived on site on February 12, 2007. As part of their charter, the inspection began to
question operability of the SDG since it appeared that the thermal elements were
definitely suspect as the cause of the SDG high temperature event. On February 14,
2007, the team questioned operability. Operations, engineering, and licensing
department personnel questioned by the inspectors stated there was no conclusive
information on the failure mechanism, and the decision was made to wait for completion
of the root cause investigation prior to considering the valve degraded. The inspectors
considered that the licensee missed yet another opportunity to identify that the SDG was
not fully operable at this time.On February 15, 2007, the special inspection team debriefed plant management anddiscussed their concern that the valve was potentially degraded and that the inspectors
questioned the licensee's evaluation of the operability. Following this debrief, the
licensee entered the condition into their corrective action process as
CR GGN-2007-0660 and performed an operability evaluation, in which the licensee
declared the SDG degraded but operable based on engineering judgement. The
inspectors considered that the licensee had gone nearly 2 weeks with mounting
evidence that the thermal elements were not the cause of the SDG failure yet had not
taken action to enter this deficient condition into their CAP. Analysis. The performance deficiency associated with this finding involved thelicensee's failure to identify a significant condition adverse to quality. The finding is
greater than minor because it is associated with the mitigating systems cornerstone
attribute of equipment performance and affects the associated cornerstone objective to
ensure the availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. Using Manual Chapter 0609,
"Significance Determination Process," Phase 1 Worksheet, the finding is determined to
have very low safety significance because the condition did not screen as potentially risk
significant due to a seismic, flooding, or severe weather initiating events. The cause of
the finding is related to the problem identification and resolution crosscutting area in thatthe licensee did not identify an issue completely, accurately, and in a timely manner
commensurate with its safety significance resulting in the failure to evaluate a potential
degraded condition for operability.Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires,in part, that measures be established to assure that conditions adverse to quality, are
Enclosure-13-promptly identified and corrected. Contrary to the above, between February 2-15, 2007,the licensee did not promptly identify the fact that their corrective actions were not
addressing the cause of the Division I SDG high temperature event based on evidence
that the thermal elements of TCV FCV-501 were not the faulty subcomponent of the
valve. The root cause involved the licensee's reliance on successful valve operation
after performing similar TCV maintenance. The corrective actions to restore compliance
included the licensee reassessing their OD of the SDG and replacing the TCV on
March 2, 2007. Because the finding is of very low safety significance and has been
entered into the licensee's CAP as CR GGN-2007-2255, this violation is being treated
as an NCV consistent with Section VI.A of the Enforcement Policy:
NCV 05000416/200706-03, "Failure to Promptly Identify a Degraded Condition." (2)Failure To Follow Procedures Resulting In An Inadequate Operability EvaluationIntroduction. The inspectors identified a Green NCV of 10 CFR Part 50 Appendix B,Criterion V, for a failure to follow procedures which resulted in an inadequate operability
evaluation.Description. On February 15, 2007, the licensee initiated CR GGN-2007-0660 inresponse to the high failure frequency of the jacket water TCV on the Division I SDG.
Control room operators performed an immediate OD and declared the SDG operable
based on engineering judgement. The operators completed a Reasonable Expectation
of Operability form in accordance with Procedure EN-OP-104, "Operability
Determinations," Revision 2, and documented the basis of the OD as the maintenance
that had recently been performed on the valve and the short length of time until the next
scheduled maintenance window relative to the observed failure frequency. Operators
issued a corrective action to the engineering staff to provide a detailed technical
justification for the calculated failure frequency of the TCV or, alternatively, to provide a
detailed technical explanation for how the recently performed maintenance on the valve
would prevent future failures when previous maintenance activities had not.The engineering staff completed the operability evaluation on February 16, 2007. Control room operators immediately declared the SDG operable, stating the corrective
action response provided sound basis for the operability of the equipment. The
inspectors reviewed the operability evaluation and noted the technical justifications for
the valve failure frequency and the maintenance performed appeared to have been
copied nearly verbatim from the original Reasonable Expectation of Operability form.
The inspectors concluded the evaluation provided virtually no new information beyond
what had already been documented in the CR and was therefore an incomplete
response to the corrective action assignment.The inspectors further noted the operability evaluation did not include an analysis ofwhat could have been causing the TCV to fail, and it provided no assessment of the
effect the degraded condition would have related to the specified safety function and
mission time of the SDG. The evaluation also failed to consider the risk of the
engineering judgement being wrong. The inspectors concluded the acceptance of
evaluation by operators was contrary to Procedure EN-LI-102, "Corrective Action
Process," Revision 8, which required the assigners of corrective actions to ensure the
response was complete and adequate before closing the corrective action assignment.
Enclosure-14-The inspectors expressed the above concerns to licensee management. OnFebruary 28, 2007, the licensee declared the Division I SDG inoperable in lieu of
performing a complex evaluation of compensatory actions. The jacket water
temperature control valve was replaced on March 2, 2007.Analysis. The failure to require an adequate corrective action response per stationprocedures was a performance deficiency. This finding is more than minor because the
failure to perform an adequate operability evaluation, if left uncorrected, could become a
more significant safety concern. Using Manual Chapter 0609, "Significance
Determination Process," Phase 1 Worksheet, this finding was of very low safety
significance since it did not result in a loss of operability. The cause of this finding has
a crosscutting aspect in the area of human performance associated with decisionmaking because licensee personnel failed to use conservative assumptions and did not
verify the validity of the underlying assumptions used in making safety-significant
decisions.Enforcement. 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures andDrawings," states, in part, that activities affecting quality shall be prescribed by
documented instructions and shall be accomplished in accordance with those
instructions. Contrary to the above, on February 16, 2007, licensee operators failed to
implement Section 5.8[4] of Procedure EN-LI-102, "Corrective Action Process,"
Revision 8, which required assigners of corrective actions to ensure required actions are
complete and corrective action responses are adequate. Because this violation was of
very low safety significance and was entered in the corrective action program as
CR GGN-2007-2256, this violation is being treated as a NCV consistent with
Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2007006-04, "Failure to
Follow Procedures Resulting in an Inadequate Operability Evaluation."4OA6 Meetings, Including ExitOn March 14, 2007, the initial results of this inspection were presented to Mr. R. Brian,Vice President, Operations, and other members of his staff who acknowledged the
findings. Additionally on April 25, 2007, the final results of this inspection were
presented to Mr. J. Reed, General Manager, Plant Operations, and other members of
his staff who acknowledged the findings. The inspector asked the licensee whether any
of the material examined during the inspection should be considered proprietary. No
proprietary information was identified. ATTACHMENT 1: SUPPLEMENTAL INFORMATIONATTACHMENT 2: SPECIAL INSPECTION CHARTER
ATTACHMENT 3: SIGNIFICANCE DETERMINATION EVALUATION
Attachment 1A1-1SUPPLEMENTAL INFORMATIONKEY POINTS OF CONTACTLicensee PersonnelC. Abbott, Acting Quality Assurance ManagerD. Barfield, Director, Nuclear Safety Assurance
B. Blanche, Operations Shift Manager
C. Bottemiller, Manager, Plant Licensing
R. Brian, Vice President, Operations
F. Bryan, Project Manager
R. Collins, Operations Manager
J. Edwards, Minority Owner Representative, SMEPA
C. Ellsaesser, Manager, Planning, Scheduling, and Outages
P. Griffith, Senior Engineer
E. Harris, Manager, Corrective Actions and Assessments
M. Krupa, Director, Engineering
M. Larson, Senior Licensing Specialist
J. Reed, General Manager, Plant Operations
M. Rohrer, Manager, System Engineering
G. Smith, Senior Engineer
G. Swords, Root Cause Analysis Evaluator
F. Weaver, Assistant Operations Manager
D. Wiles, Director, Engineering
R. Wright, Engineering SupervisorLIST OF ITEMS OPENED, CLOSED, AND DISCUSSEDOpened and Closed05000416/2007006-01NCVFailure to Prevent Recurrence of High Standby DieselGenerator Temperatures (Section 3.0)05000416/2007006-02NCVInadequate Alarm Response Instruction for SDG HighJacket Water Temperature (Section 4.0)05000416/2007006-03NCVFailure to Promptly Identify a Degraded Condition(Section 5.0)05000416/2007006-04NCVFailure to Follow Procedures Resulting in an InadequateOperability Evaluation (Section 5.0)
Attachment 1A1-2LIST OF DOCUMENTS REVIEWEDProceduresNumberTitleRevision02-S-1-28Diesel Generator Start Log204-1-02-1H22-P400Alarm Response Instruction, Panel No.: 1H-22-P400,Safety Related
10604-1-02-1H22-P400Alarm Response Instruction, Panel No.: 1H-22-P400,Safety Related
10704-1-02-1H22-P400Alarm Response Instruction, Panel No.: 1H-22-P400,Safety Related
10907-S-24-P75-F501-1Jacket Water Thermostatic Valve Thermal ElementReplacement
506-OP-1P75-M-0001Standby Diesel Generator 11 Function Test12806-OP-1P75-M-0002Standby Diesel Generator 12 Functional Test106
EN-LI-102Corrective Action Process108
EN-OP-104Operability Determinations2
CRsCR-GGN-1993-0195CR-GGN-2004-1949CR-GGN-2005-2208CR-GGN-1998-0446CR-GGN-2004-2525CR-GGN-2005-2331
CR-GGN-1998-0608CR-GGN-2004-2575CR-GGN-2005-2563
CR-GGN-1999-0768CR-GGN-2004-2581CR-GGN-2005-2785
CR-GGN-1999-0817CR-GGN-2004-2620CR-GGN-2005-2786
CR-GGN-1999-0966CR-GGN-2004-2775CR-GGN-2005-2850
CR-GGN-1999-1229CR-GGN-2004-2854CR-GGN-2005-2880
CR-GGN-2000-0133CR-GGN-2004-3088CR-GGN-2005-2991
CR-GGN-2000-0170CR-GGN-2004-3324CR-GGN-2005-3078
CR-GGN-2001-1705CR-GGN-2004-3352CR-GGN-2005-5272
CR-GGN-2002-0551CR-GGN-2004-3353CR-GGN-2005-5443
CR-GGN-2002-0557CR-GGN-2004-3360CR-GGN-2006-0776
CR-GGN-2002-0891CR-GGN-2004-4116CR-GGN-2006-0852
Attachment 1A1-3CR-GGN-2002-1224CR-GGN-2004-4596CR-GGN-2006-0952CR-GGN-2002-1821CR-GGN-2004-4610CR-GGN-2006-1461
CR-GGN-2002-2041CR-GGN-2004-4616CR-GGN-2006-3101
CR-GGN-2003-1004CR-GGN-2005-0160CR-GGN-2006-4082
CR-GGN-2003-1074CR-GGN-2005-0345CR-GGN-2007-0378
CR-GGN-2003-1088CR-GGN-2005-0554CR-GGN-2007-0400
CR-GGN-2003-1164CR-GGN-2005-1225CR-GGN-2007-0417
CR-GGN-2003-1395CR-GGN-2005-1554CR-GGN-2007-0427
CR-GGN-2004-1586CR-GGN-2005-1730Industry Information/Operational ExperienceComanche Peak Steam Electric Station Smartform SMF-2000-002502-00Licensee Event Report 86-033-00, Manually Shut Down During Surveillance Test Due to HighLube Oil TemperatureLicensee Event Report 91-010-00, Technical Specification Required Shutdown Due to anInoperable Standby Diesel GeneratorNRC Information Notice 91-85, Potential Failures of Thermostatic Control Valves for DieselGenerator Jacket WaterNRC Information Notice 82-56, Robertshaw Thermostatic Flow Control Valves
Part 21 Report 1997-04-0, Seabrook Station, "Supplement to Diesel Generator Special Report"Work Orders/Maintenance Work OrdersMWO 03536Receipt inspection of Amot Type-D Serial Number A761MWO 34475Rework and replace power elements
MWO 50207Division I temperature control valve adjustment
MWO 51507Rebuild spare valve assembly
MWO 64290Remove and rebuild valve internals
MWO 81841Installation of new power elements
WO 46758Replace thermal elements
WO 67751 Replace thermal elements
Attachment 1A1-4WO 81761Replace thermal elementsWO 102717Re-torque flange bolting
WO 207466Low jacket water temperature troubleshootingDrawingsNumberTitleRevisionM-1070AStandby Diesel Generator System39M-1070CStandby Diesel Generator System18
M-1093BHigh Pressure Core Spray Diesel Generator System24
C641Amot Type 8D4Miscellaneous InformationAECM 88/0099, Letter from John G. Cesare, Jr., Director of Nuclear Licensing to USNRC,dated May 4, 1988, "Diesel Shutdown Due to High Lube Oil Temperature"Calculation E-DCP 82/5020-1, "Transient Loading on Diesel Generators During LoadSequencing"Engineering Report GGNS-01-0001, "Study to Determine Feasibility of Extending Frequenciesof Division I and Division II Standby Diesel Generator Outage Related Maintenance
Inspections," Revision 0Grand Gulf Nuclear Station IR-88-4-3
Grand Gulf Nuclear Station Inservice Testing Bases Document, Program SectionN0.CEP-IST-1, Revision 4GTC 2004/00091, Additional testing of SDG thermal elements
Maintenance Personnel Interviews, February 9, 2007
Purchase Order 11517
Purchase Order 10067787
Standby Diesel Generator Start Logs (Divisions I and II)
Texas Utilities Certificate of Conformance for Order S02915836S2
Vendor Manual 460000452, Amot Model 8D Thermostatic Valve
Attachment 1A1-5LIST OF ACRONYMSCAPcorrective action program
CFRCode of Federal RegulationsCRcondition report
GGNSGrand Gulf Nuclear Station
gpmgallons per minute
NCVnoncited violation
NRCU.S. Nuclear Regulatory Commission
ODoperability determination
SDGstandby diesel generator
TCVthermostatic control valve
A2-1Attachment 2February 8, 2007MEMORANDUM TO:Richard W. Deese, Senior Resident Inspector, Arkansas Nuclear OneProject Branch E, Division of Reactor ProjectsAndrew J. Barrett, Resident Inspector, Grand Gulf Nuclear StationProject Branch C, Division of Reactor ProjectsFROM:Arthur T. Howell III, Director, Division of Reactor Projects AVegel for /RA/ SUBJECT: SPECIAL INSPECTION CHARTER TO EVALUATE THE GRANDGULF NUCLEAR STATION EMERGENCY DIESEL GENERATOR
FAILUREA Special Inspection Team is being chartered in response to the Grand Gulf Nuclear Station emergency diesel generator (EDG) failure. The diesel had to be manually tripped during
surveillance testing on January 30, 2007. You are hereby designated as the Special Inspection
Team members. Mr. Deese is designated as the team leader. The assigned SRA to support
the team is Russ Bywater.A.BasisOn January 30, 2007, during performance of a monthly surveillance test, EDG 1 wasmanually shut down by operators due to a jacket water high water temperature alarm
and indications of temperatures rising significantly faster than normal. The licensee
determined that the condition resulted from a faulty thermostatic temperature control
valve (TCV) that supplies cooling water to the EDG jacket water cooling system. The
licensee has preliminarily identified the cause of the failure to be the thermal elements
inside the TCV. The licensee has experienced previous TCV failures in 1999 and 2004.
These failures resulted in replacing the thermal elements. Based on the most recent
failure of the thermal elements on EDG 1 and previous licensee efforts to identify and
correct EDG thermal element problems, it is questionable whether the effectiveness of
the licensee's corrective actions has been adequate. Failure of these TCV thermal elements has also previously occurred at other nuclearfacilities, resulting in EDG failures due to overheating, resulting in crankcase explosions.
One such occurrence is documented in NRC Information Notice 91-85, "Potential
Failures of Thermostatic Control Valves for Diesel Generator Jacket Cooling Water."
A2-2Attachment 2B.ScopeThe team is expected to address the following:a.Develop an understanding of the EDG degraded conditions and failures relatedto TCV problems.b.Assess licensee effectiveness in identifying previous EDG thermostatic valveproblems, evaluating the cause of these problems and implementation of
corrective actions to resolve identified problems.c.Identify and assess additional actions planned by the licensee in response torepetitive problems with the EDG 1 TCV, including the timeline for completion of
these actions.d.Assess the licensee's root cause evaluation, the extent of condition, and thelicensee's common mode evaluation.e.Evaluate pertinent industry operating experience and potential precursors to theJanuary 30 event, including the effectiveness of licensee actions taken in
response to the operating experience.f.Determine if there are any potential generic issues related to the failure of theEDG 1 thermostatic control valve. Promptly communicate any potential generic
issues to Region IV management.g.Determine if the Technical Specifications were met when the diesel wasmanually secured prior to tripping on high temperature.h.Collect data as necessary to support a risk analysis.C.GuidanceInspection Procedure 93812, "Special Inspection," provides additional guidance to beused by the Special Inspection Team. Your duties will be as described in Inspection
Procedure 93812. The inspection should emphasize fact-finding in its review of the
circumstances surrounding the event. It is not the responsibility of the team to examine
the regulatory process. Safety concerns identified that are not directly related to the
event should be reported to the Region IV office for appropriate action.The Team will report to the site, conduct an entrance, and begin inspection no later than February 12, 2007. While on site, you will provide daily status briefings to Region IV
management, who will coordinate with the Office of Nuclear Reactor Regulation, to
ensure that all other parties are kept informed. A report documenting the results of the
inspection should be issued within 30 days of the completion of the inspection.
A2-3Attachment 2This Charter may be modified should the team develop significant new information thatwarrants review. Should you have any questions concerning this Charter, contact me at
(817) 860-8144.
A3-1Attachment 3Attachment 3: Significance Determination Evaluation Significance Determination Process (SDP)Phase 1 ScreeningThe finding was more than minor because it affected the equipment performanceattribute of the mitigating system cornerstone due to the impact on availability and
reliability of the emergency diesel generator. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, "Determining theSignificance of Reactor Inspection Findings for At-Power Situations," dated March 23,
2007, the inspectors conducted a SDP Phase 1 screening and determined that the
finding resulted in loss of the safety function of Division 1 Standby Diesel
Generator (DG) for greater than the Technical Specification allowed outage time.
Consequently, a Phase 2 SDP risk significance estimation was required.Phase 2 Risk Significance EstimationInternal Events and Large Early Release Frequency (LERF)
In the Phase 2 SDP evaluation, the inspectors and a RIV senior reactor analyst (SRA)performed a Phase 2 evaluation using the Risk-Informed Inspection Notebook for Grand
Gulf Nuclear Station, Revision 2.01, (SDP Phase 2 Notebook) and its associated
"Phase 2 Pre-solved Table."
Assumptions:
- Exposure TimeThe time between the last successful Division I DG surveillance test onJanuary 2, 2007, and the January 30, 2007, surveillance test during which the
Division I DG failed was 28 days. Based on review of the DG keep-warm system
design and its operation while the engine was in a standby condition, the
inspectors determined that the keep-warm system maintained coolant
temperature below the setpoint of the temperature control valve. This meant that
the temperature control valve would not have operated while the engine was in a
standby condition. Therefore, the inspectors concluded that the temperature
control valve (and the DG) could reasonably been known to have been
nonfunctional for a 28-day exposure period. Therefore, the inspectors used a
"3-30 days" exposure time in the Phase 2 Evaluation when determining the
appropriate Initiating Event Likelihood (IEL).*Recovery CreditThe high-temperature trip of the DG is bypassed during emergency start of theengine, as would be expected during a LOOP. The inspectors determined that
after an emergency start, operators would not be capable of diagnosing the
A3-2Attachment 3problem and locally operating the temperature control valve prior to failure of theDG due to excessive temperature. Therefore, recovery was not credited.Phase 2 SDP Evaluation Method:
The Division I DG was identified as a target in the Phase 2 pre-solved table. Per theguidance in IMC 0609, Appendix A, the pre-solved table could be used directly to
assess the finding. The table identified that the finding was "CDF-dominant."
Therefore, no additional review was required for LERF consideration. For a 3 - 30 day
exposure time, the pre-solved table identified that the significance of the finding was
Green with respect to CDF. The dominant sequence (with an equivalent risk
contribution of 7) involved a station blackout (LOOP with failure of the Division I, II,
and III DGs), failure of RCIC, and failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This
sequence is represented as: LOOP - EAC 1&2 -EDG3 - RCIC - REC1.
As described above, the finding was CDF-dominant. No LERF assessment wasrequired.External Events
Neither the Grand Gulf SDP Phase 2 Notebook nor the pre-solved table includesscreening capability for external events or other initiating events. Because the risk
contribution of the finding due to internal events was green with significance greater
than 1E-7/year, additional evaluation was required to determine if external initiators
could be risk significant. Experience has shown using the Risk-Informed Inspection
Notebooks that accounting for external initiators could result in increasing the risk
significance of an inspection finding by as much as one order of magnitude. The SRA
determined that the most efficient method of accounting for external initiators was to
perform a Phase 3 analysis, while using the guidance provided in IMC 0609,
Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Attachment 3, "User Guidance for Screening of External Events Risk
Contributions."Phase 3 SDP AnalysisInternal Events
Assumptions:
- Exposure TimeBased on the available information from the inspectors and the licensee's rootcause assessment, and after review by other risk analysts from the Office of
Nuclear Reactor Regulation, the finding was assumed best represented by a
14-day (T/2) exposure time. This was because the analysts could not
A3-3Attachment 3conclusively determine from the information provided that the temperaturecontrol valve was in a "certain-to-fail" condition following the January 2, 2007,
surveillance, or if the valve had some higher random failure probability.
Therefore, a 14-day exposure time was assumed. *Recovery CreditAs in the Phase 2 Evaluation, no operator recovery credit was assumed.*Common-Cause Failure ConsiderationThe temperature control valves for the Division I and Division II DGs were bothAMOT Model 8DOC 165-01 valves. The Division III DG temperature control
valve, although from the same manufacturer and of the same principle of
operation, was an AMOT Model 4BOC 170-01 valve, with different design and
function. Therefore, no common-cause failure mechanism was considered
applicable to the Division III DG. However, common-cause was assumed
applicable to the Division II DG. In other words, the failure of the Division I DG
could not be modeled as an independent failure. Consistent with the RASP
Handbook, a component failure should only be modeled as an independent
failure if the cause is well understood and there is no possibility that the same
circumstance exists in other components in the same common-cause component
group.Phase 3 SDP Analysis Method:
Internal Events
For the Phase 3 SDP analysis, the SRA used the NRC's simplified plant analysis risk(SPAR) model for Grand Gulf Nuclear Station, Revision 3.31, dated October 10, 2006,
to estimate the risk associated with the finding. Average test and maintenance was
assumed and a cutset truncation of 1.0E-12 was used. The finding was modeled by
setting the basic events for the Division I DG failure-to-start equal to TRUE and the
Division I DG failure-to-run equal to 1.0. These changes would invoke appropriate
changes to address consideration of common-cause failures as discussed above.
Another change involved setting a basic event in the SPAR model that was no longer
applicable to FALSE. This event, discovered during a cutset-level review of the results,
involved operator action to bypass RCIC isolation on high steam tunnel temperature.
The licensee provided a calculation that indicated that steam tunnel temperature would
not reach isolation setpoint temperature in time to be of concern and therefore, did not
need to be modeled for this analysis. The resulting internal event analysis was an
increase in the core damage frequency of 4.05E-7/yr for a 14-day exposure period. The
dominant sequence (contributing about 25 percent of the total increase in core damage
frequency) involved a LOOP, followed by failure of the Division I, II, and III DGs, and
failure to recover a DG or offsite power within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
A3-4Attachment 3
LERFCore damage sequences involving a potential contribution to LERF were considered. The dominant core damage sequence that was a potential LERF contributor involved a
LOOP with DG failures, and failure to recover a DG or offsite power within 30 minutes
when RCIC had failed to start. The resulting increase in core damage frequency
associated with this sequence was less than 1E-7/yr. Therefore, in accordance with
IMC 0609, Appendix H, "Containment Integrity Significance Determination Process," this
finding was not significant with respect to LERF.External Events (Including Internal Flooding)
SeismicUsing information from IMC 0609, Appendix A, Attachment 3, and the licensee's IPEEE(Individual Plant Examination of External Events) the SRA determined that the finding
may have been substantial enough to alter the Phase 2 result because the Division I DG
was on the licensee's seismic safe shutdown list, was used to mitigate the
consequences of a loss of offsite AC power during a seismic event, and the exposure
time was greater than 3 days. However, when the SRA evaluated the seismic
contribution using the "Seismic Event Modeling and Seismic Risk Quantification
Handbook" of the RASP External Events Handbook, the estimated delta CDF of a
seismically-induced LOOP with a random failure of the Division II DG for a 14-day
exposure period was in the mid E-9/year range. Therefore, the seismic risk contribution
of the finding is insignificant relative to the internal events result.
FloodUsing IMC 0609, Appendix A, Attachment 3, Table 3.1, "Plant Specific Flood Scenariosand Initiator Frequencies," the SRA determined that the Division I DG was not a
structure, system, or component identified as critical to avoiding core damage for any
flood scenario of significance. Therefore, flood risk contribution was screened out from
further consideration.FireThe Division I DG is in the protected train of the post-fire safe shutdown path. Therefore, the finding was potentially significant with respect to its contribution from fire
events.The licensee has a fire PRA which has the capability of assessing the risk impact ofnonfunctional equipment for fires in all fire areas with the exception of the control room.
For control room fires, the licensee can use its fire PRA to calculate conditional core
damage prababilities for the control room fire groups identified in the IPEEE. The
licensee provided this information to the SRA to assess the risk contribution due to fires
with the Division I DG out of service. The SRA considered this information provided by
A3-5Attachment 3the licensee to be the "best available information" in the context of IMC 0609 goals ofobtaining from the licensee readily available information to best inform the NRC staff's
preliminary significance determination in a timely manner.The results of the fire analysis with the Division I DG nonfunctional for 14 days were asfollows:control room fires:delta CDF = 1.34E-7/yearother fire areas:delta CDF = 5.75E-8/year
total fire contribution:delta CDF = 1.92E-7/yearBased on the above evaluation and guidance provided in IMC 0609, Appendix A,Attachment A, the SRA concluded the total contribution to risk significance of this finding
due to external initiators was approximately 1.92E-7/year.Total Estimated Change in Core Damage Frequency
The total risk contribution of the finding is expressed as the summation of the internalevents contribution and the external events contribution. This result is:Internal Events: delta CDF = 4.05E-7/yearExternal Events: delta CDF = 1.92E-7/yearTotal:delta CDF = 5.97E-7/year
In conclusion, the risk significance of this finding with respect to increase in coredamage frequency is of very low safety significance (Green).Licensee's Risk EvaluationThe licensee evaluated the finding in two ways. The first case assumed the Division IDG was not functional for 14 days. The second case evaluated a "degraded" condition
of the Division I DG rather than it being not functional resulting in an increased
unreliability (increased failure-to-start probability) for an extended period prior to the
January 30, 2007, test failure. Using this approach, the licensee evaluated past
surveillance testing data and estimated that the increase in the failure-to-start probability
for the Division I DG due to the performance deficiency was 2.94E-2. For this case, the
licensee used a 1-year exposure time, the maximum exposure time generally used in
SDP evaluations.The licensee's results for these cases were as follows:
A3-6Attachment 3Case 1 (DG I notfunctional for 14days)Case 2 (DG I increased FTS probability for 1year)Internal Eventsdelta CDF3.59E-7/year2.6E-7/yearExternal Events(Fire) delta CDF1.91E-7/year1.7E-7/yearTotal delta CDF5.5E-7/year4.3E-7/yearIn either case, the results were in agreement with the SRA's analysis and alsosupported the conclusion that the finding was of very low safety significance (Green).