ML050050287

IR 05000528-04-014, 05000529-04-014, 05000530-04-014, 08/23/04 - 12/08/04; Palo Verde Nuclear Generating Station, Units 1, 2, and 3; Special Inspection in Response to Discovery of Voided Containment Sump Safety Injection Recirculation Pipin

ML050050287
Person / Time
Site:	Palo Verde
Issue date:	01/05/2005
From:	Howell A NRC/RGN-IV/DRP
To:	Overbeck G Arizona Public Service Co
References
EA-04-221 IR-04-014
Download: ML050050287 (53)

See also: IR 05000528/2004014

Text

January 5, 2005

EA-04-221

Gregg R. Overbeck, Senior Vice

President, Nuclear

Arizona Public Service Company

P.O. Box 52034

Phoenix, AZ 85072-2034

SUBJECT: PALO VERDE NUCLEAR GENERATING STATION, NRC SPECIAL

INSPECTION REPORT 05000528/2004014, 05000529/2004014, AND

05000530/2004014; PRELIMINARY GREATER THAN GREEN FINDING

Dear Mr. Overbeck:

On August 23-27, 2004, the U.S. Nuclear Regulatory Commission (NRC) conducted the onsite

portion of a special inspection at your Palo Verde Nuclear Generating Station (PVNGS). In-

office inspection reviews and onsite observations of your pump testing program continued

through December 8, 2004. The enclosed report documents the inspection findings which were

discussed with you and members of your staff on December 9, 2004. The inspection was

conducted in response to the discovery that a significant volume of containment sump safety

injection suction piping was void of water. The failure to maintain this piping full could have

challenged the ability of the high pressure safety injection and containment spray systems in

performing their safety functions during certain design basis accident conditions. As discussed

in detail in the enclosed report, because the underlying safety concern was corrected on

August 4, 2004, and does not represent a current safety concern, the inspection focused on

your response to this condition, your root cause and extent of condition reviews, and the

identification of any generic issues related to design and operating practices that resulted in this

condition.

The enclosed inspection report discusses four findings, one of which appears to have Greater

than Green safety significance. As described in Section 02 of the report, this finding involved

the potential failure to maintain design control of the containment sump safety injection suction

piping at all three PVNGS units. Specifically, a significant portion of this piping was not

consistently maintained full of water since initial operation of all three units. This finding was

assessed based on the best available information, including influential assumptions, using the

applicable Significance Determination Process and was preliminarily determined to be a

Greater than Green finding. The basis for NRCs preliminary significance determination is

described in the enclosed report. In conjunction with this finding, the NRC identified an

apparent violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control.

Arizona Public Service Company -2-

The report also describes a finding that involved the failure to perform a written safety

evaluation and receive NRC approval prior to implementing changes to procedures in 1992

which involved draining, and maintaining drained, a significant segment of containment sump

safety injection suction piping. In conjunction with this finding, the NRC identified an apparent

violation of 10 CFR 50.59, which requires NRC approval prior to making certain changes to the

facility as described in the Updated Final Safety Analysis Report.

Both apparent violations of NRC requirements are being considered for escalated enforcement

action in accordance with the General Statement of Policy and Procedure for NRC

Enforcement Actions (Enforcement Policy), NUREG-1600. The policy is available at NRCs

website at www.nrc.gov/what-we-do/regulatory/enforcement.html. We note that only the

apparent 10 CFR 50.59 violation, because it may have impacted the regulatory process (see

Section IV.A. of the Enforcement Policy), is a candidate for assignment of a severity level and

possible monetary civil penalty. However, based on its age, the potential for application of a

monetary civil penalty associated with this apparent violation is still under review.

Before the NRC makes final decisions regarding the significance or enforcement actions for

either of these apparent violations, you have an opportunity to present to the NRC your

perspectives on the apparent violations, including the facts and assumptions used by the NRC

to arrive at the findings and their significance, during a public conference. On December 21,

2004, Mr. Scott Bauer of your staff contacted Mr. Scott Schwind of my staff to inform us that

Arizona Public Service Company was requesting the opportunity to meet with the NRC in a

public conference. As a result, a conference has been scheduled for January 27, 2005, in the

NRCs Region IV office in Arlington, Texas. The conference will be open to public observation

and a meeting notice, as well as a press release, will be issued to announce it.

The NRC has received your letter, dated December 27, 2004, which provided information

related to your follow-on actions to characterize the impacts of the voided condition. This

information included the preliminary results of your pump testing program, associated analysis,

and an assessment of the safety significance of this issue. We will review and assess this

information before making a final significance determination of the degraded condition.

However, in order to develop a more complete understanding of your preliminary assessment,

we require additional information. As a result, in addition to the information provided in this

letter, we request that you specifically address the following areas: (1) a comprehensive

account of the differences between the as-found configuration of the affected systems and the

test configurations, including but not limited to the differences in components, process

parameters, system operation and control, power usage, indications, and environmental

conditions; (2) an assessment of these differences, including the bases, relative to any final

conclusions that you may reach regarding system operability and the risk significance of the

voided conditions that actually existed; (3) any differences between the predicted test results

and the actual test results; and (4) a more comprehensive discussion of the scaling factors

used to establish the test conditions for the full scale pump tests (e.g., system resistance). We

also request that you address any potential negative impacts stemming from water hammer

conditions that may have resulted from system operation under the voided conditions that

actually existed. We encourage you to submit this, and any other supporting documentation, to

the NRC at least one week prior to the conference in an effort to make the conference more

efficient and effective.

Arizona Public Service Company -3-

With respect to the apparent 10 CFR 50.59 violation, you should plan to address the

information that would be relevant to NRCs severity level determination and civil penalty

decision. This may include, for example, information regarding whether a violation occurred,

information relevant to its significance, the circumstances surrounding identification, and

information related to any corrective actions taken or planned. We request that you include a

discussion of actions taken to address other recent performance deficiencies in implementing

the requirements of 10 CFR 50.59, as documented in this and other NRC inspection reports

(NRC Inspection Reports 05000528/2004006; 05000529/2004006; 05000530/2004006 and

05000528/2004013; 05000529/2004013; 05000530/2004013).

Since the NRC has not made a final determination in these matters, a Notice of Violation is not

being issued for these inspection findings at this time. In addition, please be advised that the

number and characterization of apparent violations described in the enclosed inspection report

may change as a result of further NRC review.

In addition to the apparent violations being considered for escalated enforcement action, the

NRC identified two additional findings during this inspection which also involved violations of

NRC requirements. One of these was evaluated under the risk significance determination

process as having very low safety significance (Green). The remaining finding, because it

involved 10 CFR 50.59, was processed under the Enforcement Policy and is documented as a

Severity Level IV violation. However, because of the very low safety significance of these

violations and because they were entered into your corrective action program, the NRC is

treating these as noncited violations (NCVs), consistent with Section VI.A of the Enforcement

Policy. These NCVs are described in the subject inspection report. If you contest the violations

or the significance of these NCVs, you should provide a response within 30 days of the date of

this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory

Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the

Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza

Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident

Inspector at the Palo Verde Nuclear Generating Station facility.

One of these two NCVs involved a failure to implement your condition reporting and operability

determination procedures. This violation was determined to be Green because of the short

duration in which it existed before compensatory measures were implemented. Specifically,

plant engineers failed to notify the control room operators of the voided condition in a timely

manner and, once notified, the impact on operability was not promptly determined. Given the

close interrelationship between this finding and the two apparent violations being considered for

escalated enforcement action, we request that you present your perspectives on this finding

during the conference, including whether you agree that the finding constitutes a violation of

NRC requirements.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its

enclosure will be available electronically for public inspection in the NRC Public Document

Arizona Public Service Company -4-

Room or from the Publicly Available Records (PARS) component of NRC's document

system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-

rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Arthur T. Howell III, Director

Division of Reactor Projects

Dockets: 50-528

50-529

50-530

Licenses: NPF-41

NPF-51

NPF-74

Enclosure:

NRC Inspection Report 05000529/2004-14

cc w/enclosure:

Steve Olea

Arizona Corporation Commission

1200 W. Washington Street

Phoenix, AZ 85007

Douglas K. Porter, Senior Counsel

Southern California Edison Company

Law Department, Generation Resources

P.O. Box 800

Rosemead, CA 91770

Chairman

Maricopa County Board of Supervisors

301 W. Jefferson, 10th Floor

Phoenix, AZ 85003

Aubrey V. Godwin, Director

Arizona Radiation Regulatory Agency

4814 South 40 Street

Phoenix, AZ 85040

Arizona Public Service Company -5-

M. Dwayne Carnes, Director

Regulatory Affairs/Nuclear Assurance

Palo Verde Nuclear Generating Station

Mail Station 7636

P.O. Box 52034

Phoenix, AZ 85072-2034

Hector R. Puente

Vice President, Power Generation

El Paso Electric Company

310 E. Palm Lane, Suite 310

Phoenix, AZ 85004

Jeffrey T. Weikert

Assistant General Counsel

El Paso Electric Company

Mail Location 167

123 W. Mills

El Paso, TX 79901

John W. Schumann

Los Angeles Department of Water & Power

Southern California Public Power Authority

P.O. Box 51111, Room 1255-C

Los Angeles, CA 90051-0100

John Taylor

Public Service Company of New Mexico

2401 Aztec NE, MS Z110

Albuquerque, NM 87107-4224

Cheryl Adams

Southern California Edison Company

5000 Pacific Coast Hwy. Bldg. DIN

San Clemente, CA 92672

Robert Henry

Salt River Project

6504 East Thomas Road

Scottsdale, AZ 85251

Arizona Public Service Company -6-

Brian Almon

Public Utility Commission

William B. Travis Building

P.O. Box 13326

1701 North Congress Avenue

Austin, TX 78701-3326

Chief, Technological Services Branch

FEMA Region IX

1111 Broadway, Suite 1200

Oakland, CA 94607-4052

Arizona Public Service Company -7-

Electronic distribution by RIV:

Regional Administrator (BSM1)

DRP Director (ATH)

DRS Director (DDC)

Senior Resident Inspector (NLS)

Branch Chief, DRP/D (SCS)

Senior Project Engineer, DRP/D (CJP)

Team Leader, DRP/TSS (RVA)

RITS Coordinator (KEG)

DRS STA (DAP)

J. Dixon-Herrity, OEDO RIV Coordinator (JLD)

Assisting PV Site Secretary (VLH)

W. A. Maier, RSLO (WAM)

G. F. Sanborn, D:ACES (GFS)

K. D. Smith, RC (KDS1)

F. J. Congel, OE (FJC)

OE:EA File (RidsOeMailCenter)

ADAMS: / Yes G No Initials: ath

/ Publicly Available G Non-Publicly Available G Sensitive / Non-Sensitive

R:\_PV\2004\PV2004-14RP-MCH.wpd

RIV:SRI:DRP/E SRA:DRS C:DRP/D D:DRS D:ACES D:DRP

MCHay DPLoveless SCSchwind DDChamberlain GFSanborn ATHowell

SCSchwind for /RA/ /RA/ /RA/ /RA/ /RA/

1/5/05 1/5/05 1/5/05 1/5/05 1/5/05 1/5/05

OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

ENCLOSURE

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-528, 50-529, 50-530

License: NPF-41, NPF-51, NPF-74

Report No.: 05000528/2004014, 05000529/2004014, and 05000530/2004014

Licensee: Arizona Public Service Company

Facility: Palo Verde Nuclear Generating Station, Units 1, 2, and 3

Location: 5951 S. Wintersburg Road

Tonopah, Arizona

Dates: August 23-27, 2004, with in-office inspection through December ,

2004

Team Leader: M. C. Hay, Senior Resident Inspector, Waterford 3

Inspectors: G. B. Miller, Resident Inspector, Grand Gulf

Accompanying J. J. Shea, Project Manager, Office of Nuclear Reactor Regulation

Personnel:

Approved By: Arthur T. Howell III, Director

Division of Reactor Projects

CONTENTS

SUMMARY OF FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

01 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

01.1 Summary of Discovery and Response to the Voided Condition . . . . . . . . . . . . . . 1

01.2 Description of Containment Recirculation Function . . . . . . . . . . . . . . . . . . . . . . . 2

02 Failure to Maintain Design Control of the Containment Sump Safety Injection Recirculation

Piping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

03 Implementation of Operability Determination Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

04 Implementation of 10 CFR 50.59 Evaluation Program . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

04.1 Failure to Perform 50.59 Evaluations for Changes to the Facility Implemented

Following Identification of Voided Condition . . . . . . . . . . . . . . . . . . . . . . . . . . 11

04.2 Failure to Perform 10 CFR 50.59 Evaluations for Procedural Change Involving

Draining the Containment Sump Recirculation Suction Piping . . . . . . . . . . . . 14

05 Evaluation of Operating Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

06 Meetings, Including Exit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

ATTACHMENT A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

Supplemental Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1

ATTACHMENT B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1

Figure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B-1

ATTACHMENT C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1

Inspection Charter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1

ATTACHMENT D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1

Phase 2 and Phase 3 Risk Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1

SUMMARY OF FINDINGS

IR 05000528/2004014, 05000529/2004014, 05000530/2004014, 08/23/04 - 12/08/04; Palo

Verde Nuclear Generating Station, Units 1, 2, and 3; Special Inspection in response to

discovery of voided containment sump safety injection recirculation piping.

The report covered a 5-day period (August 23-27, 2004) of onsite inspection, with in-office

review through December 8, 2004, by a special inspection team consisting of one senior

resident inspector, one resident inspector, and one specialist from the Office of Nuclear Reactor

Regulation. Four findings were identified. The significance of most findings is indicated by their

color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance

Determination Process." Findings for which the significance determination process does not

apply may be Green or be assigned a severity level after NRC management's review. The

NRCs program for overseeing the safe operation of commercial nuclear power reactors is

described in NUREG-649, "Reactor Oversight Process," Revision 3, dated July 2000.

A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

• TBD The team identified an apparent violation of 10 CFR Part 50, Appendix B,

Criterion III, "Design Control," for the failure to establish measures to assure

design basis information was translated into specifications, drawings,

procedures, and instructions. Specifically, the licensee failed to maintain the

safety injection sump suction piping full of water in accordance with the Updated

Final Safety Analysis Report. This nonconformance had the potential to

significantly affect the available net positive suction head described in the

Updated Final Safety Analysis Report for the high pressure safety injection and

containment spray pumps, since the analysis assumed the piping would be

maintained full of water.

This finding is more than minor because it is associated with the equipment

performance attribute of the Mitigating Systems cornerstone and adversely

affects the cornerstone objective of ensuring the availability, reliability, and

capability of systems that respond to initiating events. The finding has a

potential safety significance greater than very low significance (i.e., Greater than

Green) based on the results of a Significance Determination Process, Phase 3

analysis.

• Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion V, "Instructions, Procedures, and Drawings," involving the failure of

engineering and operations personnel to implement requirements in the stations

condition reporting and operability determination procedures following

identification of a degraded condition. Specifically, engineering personnel did not

promptly notify operations personnel of a condition that impacted the safety

function of the high pressure safety injection and containment spray systems. In

addition, operations personnel did not complete an immediate assessment of

operability once they were informed of the degraded condition. This finding had

crosscutting aspects associated with problem identification and resolution, since

engineering personnel did not forward corrective action program documents

-2-

regarding the degraded condition to the control room in a timely manner and

operations personnel did not complete a prompt operability assessment. This

finding also involved crosscutting aspects associated human performance, since

engineering and operations personnel did not adequately communicate the

status of the engineering departments efforts to review the degraded condition.

This finding is more than minor because it is associated with the equipment

performance attribute of the Mitigating Systems cornerstone and adversely

affects the cornerstone objective of ensuring the availability, reliability, and

capability of systems that respond to initiating events. This finding has very low

safety significance based on the results of a Significance Determination Process,

Phase 3 analysis.

• SL-IV. The team identified three examples of a noncited, Severity Level IV

violation of 10 CFR 50.59 requirements involving the failure to perform written

safety evaluations prior to implementing changes to the facility. The first

example involved a change for using manual actions in lieu of automatic actions

as compensatory measures to support the safety functions of the high pressure

safety injection and containment spray systems during postulated design basis

loss-of-coolant accident conditions following a recirculation actuation signal. The

second example involved operation of emergency core cooling systems with a

10-20 cubic foot void in the suction piping. The third example involved the failure

to perform a written safety evaluation for changes involving filling the

containment sump with borated water to a level above the containment sump

safety injection recirculation piping. These changes were implemented in

response to identifying that the safety injection system was not being maintained

full of water.

In accordance with Inspection Manual Chapter 0612, Appendix B, Issue

Disposition Screening, the team determined that traditional enforcement applied

because this finding may have impacted the NRCs ability to perform its

regulatory function. The severity level of this finding was assessed as having

very low safety significance reflective of a Severity Level IV violation. This

determination was based in part on use of the significance determination

process.

• AV. The team identified an apparent violation of 10 CFR 50.59 requirements for

the licensee's failure to perform a written safety evaluation and receive NRC

approval prior to implementing changes to the facility in 1992 which involved

draining, and maintaining drained, a significant segment of containment sump

safety injection recirculation piping during normal plant operations. This change

resulted in the failure to maintain the safety injection piping full of water in

accordance with the Updated Final Safety Analysis Report. This represented an

unreviewed safety question since it increased the probability of a malfunction of

equipment important to safety previously evaluated in the safety analysis report.

In accordance with Inspection Manual Chapter 0612, Appendix B, Issue

Disposition Screening, the team determined that traditional enforcement applied

-3-

because this finding may have impacted the NRCs ability to perform its

regulatory function. This is an apparent violation pending the results of a

predecisional enforcement conference.

REPORT DETAILS

01 Background

01.1 Summary of Discovery and Response to the Voided Condition

During the week of July 12, 2004, NRC inspectors at the Waterford 3 Steam Electric Station

identified that a segment of containment sump safety injection recirculation piping was

inappropriately maintained in a voided condition. Engineering personnel from Waterford 3

established communications with other Combustion Engineering facilities of similar design to

determine if the condition was a generic design issue. Waterford 3 contacted the Palo Verde

Nuclear Generating Station (PVNGS) on July 22, 2004.

On July 28, 2004, PVNGS identified that a significant segment of containment sump safety

injection recirculation piping in all three units was maintained void of water and began searching

licensing basis information in an unsuccessful attempt to locate a technical basis for the voided

configuration.

On the afternoon of July 29, 2004, PVNGS engineering personnel determined that the voided

condition could potentially affect operability of the high pressure safety injection (HPSI) and

containment spray (CS) systems and placed the condition into the corrective action program.

On the morning of July 30, 2004, operations personnel were initially informed of the voided

condition. On the evening of July 30, 2004, operations personnel performed an initial

operability evaluation and determined that the HPSI and CS systems were operable provided

compensatory manual actions were implemented in lieu of automatic actions during system

operation.

On July 31, 2004, PVNGS notified the NRC of the adverse condition in accordance with

10 CFR 50.72(b)(3)(v) notification requirements. Specifically, this notification stated that the

voided condition could have prevented the fulfillment of the safety function to remove residual

heat and mitigate the consequences of a loss-of-coolant accident (LOCA). From August 1-4,

2004, PVNGS implemented corrective actions to fill the voided containment sump safety

injection recirculation piping at all three operating units.

In accordance with NRC Management Directive 8.3, NRC Incident Investigation Program, the

NRC determined that a special inspection was warranted on the basis of the potential safety

significance of the voided condition. The special inspection charter is included as Attachment C

to this report. The inspection team completed all items in the inspection scope during the on-

site inspection, with the exception of reviewing the licensees determination of the cause of

design deficiencies and determining if the licensees root cause analysis and corrective actions

addressed the extent of condition for air voiding of safety systems. These items had not been

completed by the licensee and therefore were the subject of in-office reviews by the inspectors.

In response to this degraded condition, the licensee initiated a project to perform engineering

analyses and full scale pump tests in an effort to characterize the adverse impacts of the voided

condition on the HPSI and CS systems.

-2-

01.2 Description of Containment Recirculation Function

Following a LOCA, water discharged from the reactor coolant system will collect on the

containment floor and within the containment sump. On high containment pressure or low

pressurizer pressure, a safety injection actuation signal automatically starts the high and low

pressure safety injection pumps. Additionally, the CS pumps will automatically start on high

containment pressure. These pumps initially draw a suction from the refueling water tank.

The low pressure safety injection and HPSI pumps supply relatively cool water to the reactor

core to protect the fuel cladding. To protect the containment barrier function, the CS pumps

supply water to spray headers in containment to mitigate containment pressure and

temperature excursions following the LOCA. When the refueling water tank level decreases to

approximately 10 percent, a recirculation actuation signal (RAS) automatically stops the low

pressure safety injection pumps and transfers the HPSI and CS pumps suction source to the

containment sump.

02 Failure to Maintain Design Control of the Containment Sump Safety Injection

Recirculation Piping

a. Inspection Scope

The team reviewed design documentation and analyses, the Updated Final Safety

Analysis Report (UFSAR), Technical Specifications, NRC safety evaluation reports, and

other relevant documentation pertaining to the licensing and design basis of the HPSI

and CS systems.

b. Findings

Introduction. The team identified an apparent violation of 10 CFR Part 50, Appendix B,

Criterion III, "Design Control," with a safety significance potentially Greater than Green,

regarding the failure to establish measures to assure design basis information was

translated into specifications and procedures.

Description. As discussed in Section 01.1, following discussions with Waterford 3,

PVNGS identified that a significant segment of containment sump safety injection

recirculation piping was maintained in a voided condition at all three units. On July 29,

2004, Condition Report/Disposition Request (CRDR) 2726509 was initiated to document

the deficiency in the corrective action program. The CRDR stated that, following a RAS,

the voided condition could potentially affect the operation of the pumps due to cavitation

and/or air binding and result in a water hammer event. This condition affected

approximately 115 cubic feet of the containment sump recirculation suction piping

between the inside containment isolation valves (SI-673 and SI-675) and the outside

containment check valves (SI-205 and SI-206) (see Attachment B for details). This

represented approximately 30 percent of the total volume of suction piping from the

containment sump to the pumps.

Section 6.3 of the UFSAR, Emergency Core Cooling System, states that the safety

injection piping will be maintained filled with water. Additionally, Section 6.3 states that,

-3-

during recirculation mode, the available net positive suction head (NPSH) for the CS and

HPSI pumps is 25.8 feet and 28.8 feet, respectively. The team reviewed Calculations

13-MC-SI-017 and 13-MC-SI-018, regarding available NPSH for the HPSI and

CS pumps, and noted that the available NPSH results were calculated based on the

assumption that the piping would be full of water. The team also reviewed PVNGS NRC

Safety Evaluation Report, Section 6.3, Emergency Core Cooling System, which states,

During normal operation, the ECCS lines will be maintained in a filled condition.

Suitable vents are provided and administrative procedures will require that ECCS lines

be returned to a filled condition following events such as maintenance that require

draining of any of the lines. The inspectors reviewed system drawings and noted that

vent and fill lines were available to support maintaining the voided sump suction piping

filled with water.

Based on discussions with the licensee and a review of documentation, the team

determined that the licensee had not consistently maintained the containment sump

recirculation piping full of water. This determination was based on the following:

• Every 18 months, during refueling outages, emergency core cooling

system (ECCS) leakage testing is performed. The purpose of the test is to

inspect ECCS piping outside of containment that is in contact with the

recirculation sump inventory during LOCA conditions to determine the total

leakage from the piping and components. This test was implemented in

accordance with Surveillance Procedure 40ST-9SI09, ECCS Systems Leak

Test. This procedure pressurizes the piping between the containment sump

inboard and outboard isolation valves with demineralized water. Following the

surveillance, the procedure directed draining the piping. The team noted that the

instructions to drain the piping were added to the surveillance procedure during a

revision in 1992. As discussed in Section 04.2 of this report, no written safety

evaluation was performed, as required by 10 CFR 50.59, for this procedure

change.

• Every quarter the licensee strokes the containment sump isolation valves in

accordance with Surveillance Procedures 73ST-9XI03 and 73ST-9XI04,

SI Train Valves-Inservice Test. This procedure allowed water to flow into the

containment sump from the suction piping while the inboard containment sump

isolation valve was open. There was no requirement to refill the piping between

the containment sump isolation valves. During interviews, the team was

informed that water had to be removed from the containment sumps during

refueling outages. To prevent water from flowing to the containment sump

during testing, the licensee revised the ECCS leakage test to intentionally drain

the suction piping following test completion as previously discussed.

Based on this information, the team concluded that the licensee failed to maintain

adequate control of the design of the containment sump safety injection recirculation

piping. Specifically, the piping was not maintained full of water during normal plant

operation in accordance with the licensing and design basis.

-4-

Analysis. This finding is considered to be a performance deficiency because the

licensee failed to implement measures to maintain the design of the containment sump

safety injection recirculation suction piping. In accordance with Inspection Manual

Chapter 0612, Section 05.03, Screen for Minor Issues, the inspectors reviewed the

sample minor findings in Appendix E, Example of Minor Issues. This performance

deficiency was similar to Example 3.b, because it was a design discrepancy that

occurred because of an oversight by the licensee. However, the subject deficiency met

the not minor if, criteria in that the operation of the systems was adversely affected by

the performance deficiency.

The inspectors evaluated the issue using the Significance Determination Process

Phase 1 Screening Worksheet for the Initiating Events, Mitigating Systems, and Barrier

Integrity cornerstones provided in Manual Chapter 0609, Appendix A, "Significance

Determination of Reactor Inspection Findings for At-Power Situations." The screening

indicated that a Phase 2 analysis was required because the performance deficiency is

assumed to degrade two cornerstones. Specifically, the degradation of the HPSI

system is associated with the equipment performance attribute of the Mitigating

Systems cornerstone and adversely affects the cornerstone objective of ensuring the

availability, reliability, and capability of systems that respond to initiating events by

reducing the capability of injecting to the reactor during recirculation. The degradation

of the containment spray system is associated with the barrier performance attribute of

the Barrier Integrity cornerstone and adversely affects the cornerstone objective of

providing reasonable assurance that physical design barriers protect the public from

radionuclide releases caused by accidents or events by degrading the heat removal and

pressure control functions for the primary containment.

The Phase 2 analysis assumed a loss of HPSI and CS pumps following a RAS. Full

credit for recovery of the failed HPSI and CS systems was used even though venting of

the system would likely require entry into a pump room with post-LOCA radiological

conditions. Under some circumstances recovery may not be possible at all during the

mission time because the pumps may become damaged beyond use. The Phase 2

analysis indicated that the significance of the finding was potentially Greater than Green.

The dominate accident sequences involved a LOCA followed by a failure of the

containment heat removal and high pressure recirculation functions. Based on these

results, a Phase 3 analysis was conducted by a regional senior reactor analyst;

however, due to uncertainties in the influential assumptions used for this analysis, the

preliminary significance of this finding continues to be Greater than Green. The

assumptions used in the Phase 2 and 3 analyses are documented in Attachment D to

this report.

Enforcement. 10 CFR Part 50, Appendix B, Criterion III, Design Control requires that

measures shall be established to assure that applicable regulatory requirements and the

design basis are correctly translated into specifications, drawings, procedures, and

instructions. The UFSAR, Section 6.3, Emergency Core Cooling System, states that

the safety injection piping will be maintained filled with water. Contrary to this, the

licensee failed to establish measures to assure this design basis information for the

ECCSs was translated into specifications, drawings, procedures, and instructions.

Specifically, the licensee failed to maintain the safety injection piping full of water in

-5-

accordance with the UFSAR. This nonconformance significantly affected the available

net positive suction head described in the UFSAR for the safety injection pumps, since

the analysis assumed the piping would be maintained full of water. This condition

existed at all three units from initial plant operation through July 2004, at which time

corrective actions were implemented to fill the voided piping. Units 1, 2, and 3 initial

plant operations commenced in 1985, 1986, and 1987, respectively. Pending

determination of the findings final safety significance, this finding is identified as

Apparent Violation (AV) 05000528,529,530/2004014-01, for failing to maintain design

control of containment sump recirculation piping. Based on the best available

information and the applicable Significance Determination Process, this issue was

preliminarily determined to be a Greater than Green finding. This issue was entered into

the licensee's corrective action program as CRDR 2726509.

03 Implementation of Operability Determination Program

a. Inspection Scope

The team assessed the engineering and operations departments implementation of the

operability determination process after the identification of the adverse condition

involving the voided containment sump recirculation piping. This assessment was

performed through interviews and a review of operator logs, operability determinations,

and related documents. In addition, the team conducted an independent assessment of

system operability.

b. Findings

Introduction. The team identified a Green noncited violation of 10 CFR Part 50,

Appendix B, Criterion V, "Instructions, Procedures, and Drawings" for the failure to

follow the condition reporting and operability determination procedures.

Description. Engineering personnel failed to implement the requirements of the

condition reporting and operability determination procedures in several respects, while

trying to resolve issues associated with the voided condition. Design engineering

personnel failed to promptly inform the control room shift managers of a degraded

condition that could adversely affect the operability of the HPSI and CS systems. On

July 27, 2004, design engineers recognized that a significant segment (approximately

30 percent) of the containment sump recirculation piping was maintained void of water.

After a 2-day review of design documentation, they were unable to locate a justification

for the existence of the void. On the basis of interviews, it did not appear that any

substantive information regarding this condition was communicated to operations

personnel during the 2-day review period.

The safety injection system design engineer initiated CRDR 2726509 at 3:27 p.m. on

July 29, to document that the degraded condition could cause cavitation and/or air

binding of the HPSI and CS pumps and possibly a water hammer event. Administrative

Procedure 90DP-0IP10, Condition Reporting, Revision 19, Section 3.1.2, required that

the originator promptly notify the shift manager of the affected unit upon the discovery of

a degraded condition (i.e., loss of quality or function). The design engineer did not bring

-6-

this CRDR to the attention of any of the shift managers. On July 29, the design

engineering section leader was informed that a CRDR had been initiated documenting

that the safety injection system was in an unanalyzed condition. Administrative

Procedure 90DP-0IP10 required that the originators leader ensure that the shift

manager of the affected unit was notified of the degraded condition. The section leader

took no actions to ensure operations personnel were promptly informed of the degraded

condition. When interviewed by the team, the section leader stated that he did not

inform operations personnel since he still believed that documentation already existed

which would justify the current system configuration and demonstrate operability of

HPSI and CS. He also stated that he wanted to further validate the concern before

discussing it with operations personnel because of the substantial impact it would have

on the operation of all three units if his assumption was incorrect. As discussed further

in this report, this assumption was incorrect in that there was no existing documentation

that provided a basis for the acceptability for the voided configuration. The section

leader stated that his first action on the morning of July 30 was to discuss the voiding

concern documented in CRDR 2726509 with operations personnel. This occurred

around 7 a.m. on July 30.

Once operations had been notified of the condition, engineering began to assess

operability of the HPSI and CS systems. Procedure 40DP-9OP26, Operability

Determination, specified that, The operability determination process shall call for

immediately declaring equipment inoperable when reasonable expectation of operability

does not exist or mounting evidence suggests that the final analysis will conclude that

the equipment cannot perform its specified safety function(s). Subsequent evaluation

may restore the systems, structures, and components (SSC) to an operable status.

Throughout the evaluation process on July 30 evidence was mounting that suggested

that the HPSI and CS systems were inoperable. However, this was not communicated

to the control room in a timely manner and no action was taken to declare the systems

inoperable during this period.

Engineerings first priority on July 30 was to determine if the air void would remain in the

suction piping or be displaced back into containment. Engineering concluded that the

void would not migrate back to containment because of the high water velocity

conditions following a RAS. This was the first indication that operability of the systems

might not be justified. Engineering then focused on assessing the behavior of the air

void through the containment sump safety injection recirculation piping. Based on a

technical paper in the Journal of Fluids Engineering, they concluded that the combined

total flow of the HPSI and CS pumps would result in sufficient fluid velocity to sweep the

bubble intact through the horizontal section of piping and into a vertical piping section

between the containment sump and the pumps. This analysis was completed at

approximately 2 p.m. on July 30 and was the second indication that operability of the

systems might not be justified. Engineering had yet to determine if the void would

migrate intact through the vertical piping and into the pumps. In addition, the analytical

method for vertical piping discussed in the Journal of Fluids Engineering appeared to be

too complex to complete in one day. An engineer involved in analyzing this condition

stated that, even if the void were to remain in the vertical piping section, there would

most likely be some entrainment of air bubbles in the pipe flow. However, the flow

-7-

calculations for a turbulent air-water mixture would have taken weeks to perform. This

was the third indication that operability of the systems might not be justified.

The inspectors concluded that the analysis demonstrating that the air void would be

swept intact through the horizontal piping toward the safety injection pumps constituted

mounting evidence suggesting that the equipment could not perform its safety function,

since neither outcome for the vertical piping calculation resulted in a reasonable

assurance of operability. In discussions with the inspection team, the operations

manager and the Units 1 and 2 shift managers stated that engineering personnel did not

inform them of these in-process analysis results. Both shift managers and the

operations manager stated that, if they had been aware of these conditions, then they

would have declared both the HPSI and CS systems inoperable in accordance with the

operability determination procedure and entered Technical Specification 3.0.3.

The team also concluded that the operability determination procedure was not followed

by operations personnel. CRDR 2726509 was reviewed by all three control room

operating crews the morning of July 30 after the design engineering section leader

notified the operations department of the voided section of containment sump safety

injection recirculation piping. The CRDR stated that the trapped air volume in the

suction piping could potentially be forced into the safety injection pumps during a LOCA,

causing cavitation and/or air binding of the pumps in addition to causing a water

hammer event. The CRDR also identified the need to determine ECCS operability and,

if necessary, develop contingency actions to reduce the likelihood of post-RAS air

entrainment into the safety injection system. Despite their awareness of this condition,

operations personnel did not assess and document operability of HPSI and CS systems

until the end of the shift at 6:45 p.m. This delay in assessing operability was attributed

to the fact that engineering did not fully communicate the status of their evaluation to

operations.

In addition, the shift managers did not pursue resolution or periodic status updates of

the significantly degraded condition from engineering. During interviews with the Units 1

and 2 shift managers, the following statements were made with respect to the events

that transpired on July 30:

• One shift manager did not know engineering was trying to characterize the

voided condition through analysis or that engineering was encountering

problems demonstrating that the void would not migrate back into containment

following a RAS. The shift manager was not informed that compensatory

measures were being considered by engineering to provide a basis for

operability. If the manager had known engineering was encountering these

difficulties, then he would have declared the HPSI and CS systems inoperable

and entered Technical Specification 3.0.3.

• Another shift manager stated that if he had known that engineering had identified

that the void would not go back into containment following a RAS, then he would

not have hesitated to declare the systems inoperable.

-8-

The analysis for the void behavior in the vertical section of piping was completed by

5 p.m., concluding that the fluid velocity would not be sufficient to draw the air void

through the piping as an intact bubble. Engineering also identified the need for

compensatory measures involving the use of manual operator actions in lieu of

automatic actions to support the operability of the HPSI and CS systems. The

compensatory measure required operators to manually open the inboard containment

sump isolation valves following a LOCA but prior to the RAS in an attempt to allow the

suction piping to fill with water along with the containment sump. A 10-20 cubic foot

void would remain, corresponding to the volume between the outboard containment

sump isolation valve and the downstream check valve. Engineering concluded that a

reasonable assurance of operability existed based on the results of the vertical piping

analysis and engineering judgment that the smaller void (10-20 cubic foot) would not

result in an unacceptable void fraction affecting NPSH requirements for the HPSI and

CS pumps.

At 6:45 p.m., on July 30, 2004, after briefing the incoming operations crew on the

compensatory measure, the HPSI and CS systems were declared operable. The log

entry stated that the operability determination was based on the compensatory

measures that were implemented at 6:45 p.m., as well as the results of a calculation that

concluded the remaining air void in the outboard section of the piping would not be

entrained with the fluid flow due to low fluid velocities. When the inspection team

requested a copy of this calculation, the team was informed that the log entry was in

error and that this conclusion was actually based on engineering judgment. No

calculation had been performed to assess the effects of air entrainment from the vertical

section of voided piping. Operators did not request to review the calculation prior to

concluding that the HPSI and CS pumps were operable. The team also noted that the

final operability determination did not address the possibility of a water hammer event

due to the voided condition even though this concern was also documented in

CRDR 2726509.

The team conducted an independent assessment of operability for the HPSI and CS

system with the voided condition in the suction piping. The technical paper from the

Journal of Fluids Engineering referenced in engineerings evaluation did contain a

reasonable discussion of flow regimes in horizontal piping; however, its treatment of void

behavior in vertical piping was questionable. In fact, the authors stated that the flow

regimes in the vertical case are difficult to handle theoretically and probably require an

extensive experimental investigation before an empirical description can be obtained.

In addition, the inspectors noted that the data discussed in the paper for the vertical

case was developed from experiments using gravity-driven flow through clear acrylic

piping with a maximum diameter of 89 mm (3.5 in.). This did not compare closely to the

plant configuration, which involves flow driven by pumps through 24-inch steel piping.

The team concluded that this was insufficient technical justification for using this model

to analyze the void behavior in the vertical section of pipe.

The inspectors also reviewed NUREG/CR-2792, An Assessment of Residual Heat

Removal and Containment Spray Pump Performance Under Air and Debris Ingestion

Conditions, and made the following conclusions:

-9-

• For a wide range of operating flow rates, residual heat removal and CS pumps

should handle volumetric air quantities up to 2 percent with negligible

degradation in performance.

• For air quantities greater than 2 percent, performance degradation of pumps

varies substantially depending on design and operating conditions.

• For very low flow rates (less than about 50 percent of best efficiency point), the

presence of air may cause air binding in a pump.

• Small quantities of ingested air will increase the NPSH requirements for a pump.

A correction factor for NPSH requirements is proposed.

• Industrial experience and the technical literature provide corroborative data to

support these findings on the behavior of pumps in air/water mixtures.

NUREG/CR 2792 also stated that the performance of centrifugal pumps is known to

degrade with increasing vapor or gas content in the fluid. The amount of degradation is

a function of various parameters; the important ones being pump design, specific speed,

flow rate, inlet pressure, and fluid properties. A general guideline commonly adhered to

by the pump industry is that, for air ingestion levels less than about 2 percent by volume,

degradation is not a concern at normal flow rates; for air ingestion between 2 percent

and 15 percent, performance is dependent on pump design; and for air ingestion greater

than 15 percent, most centrifugal pumps are fully degraded. It is also generally

recognized that for NPSH values close to those required by the pump, air ingestion has

a noticeable effect on performance.

In addition, the team referred to Regulatory Guide 1.82, Water Sources for Long-Term

Recirculation Cooling Following a Loss-Of-Coolant Accident, Revision 2, to estimate the

effects of the air void on available NPSH for the HPSI and CS pumps. Based on this

guidance, the inspectors concluded that the potential existed for a loss of required

NPSH to the pumps, resulting in degradation and/or air binding of the SI pumps.

The inspectors noted that the initial operability determination logged at 6:45 p.m. only

addressed the 10-20 cubic feet voided condition that would result from the

compensatory measure. No operability determination was performed to specifically

address the basis for operability for the original voided condition of approximately

115 cubic feet.

Analysis. The failure to implement the condition reporting and operability determination

procedures following identification of a degraded condition was a performance

deficiency. This finding is more than minor because it adversely affected the equipment

performance attribute of the Mitigating Systems cornerstone and the configuration

control attribute of the Barrier Integrity cornerstone. Specifically, a degraded HPSI

system affects the Mitigating Systems cornerstone objective associated with long-term

core decay heat removal, and a degraded CS system affects the Barrier Integrity

cornerstone objectives associated with containment heat removal and pressure control

-10-

functions. Using Phase 1 worksheets from NRC Manual Chapter 0609, "Significance

Determination Process," the team determined that a Phase 2 analysis was required

since two Reactor Safety Cornerstones were affected.

The Phase 2 analysis determined that the finding potentially had more than very low

safety significance; therefore, a Phase 3 analysis was completed by a regional senior

reactor analyst. The finding was assumed to have existed from the time the CRDR was

initiated until the final operability determination was made, or approximately one day.

The Phase 3 analysis determined that the change in core damage frequency per year

stemming from the voided piping was potentially Greater than Green; however, since

this specific finding was assumed to exist for only one day, this finding was determined

to be of very low safety significance or Green. Attachment D to this report provides

additional detail regarding the Phase 2 and Phase 3 analyses.

This finding involved crosscutting aspects associated with problem identification and

resolution because engineering personnel failed to ensure that corrective action

program documents describing the degraded condition were forwarded to the control

room in a timely manner. In addition, operations personnel did not complete a prompt

operability assessment. This finding also had crosscutting aspects associated with

human performance based on the lack of communications between engineering and

operations personnel while evaluating the degraded condition.

Enforcement. 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and

Drawings," states that activities affecting quality shall be prescribed by documented

procedures of a type appropriate to the circumstances and shall be accomplished in

accordance with these procedures. Contrary to this, the licensee performed activities

affecting quality that were not in accordance with documented procedures. Specifically:

Administrative Procedure 40DP-90P26, Operability Determination, Revision 12,

Section 1.4 states, Whenever it is discovered that the operability of a system, structure,

or component is impacted or questioned, then the individuals leader and the Control

Room shall be immediately notified.

Administrative Procedure 90DP-0IP10, Condition Reporting, Revision 19, Section 3.1.2

states, If the condition meets either of the following criteria: (1) The condition requires

immediate action to ensure the safety of the plant personnel or equipment, or (2) the

condition is a nonconforming condition, or may cause a degraded condition (i.e., loss of

quality or function), in a plant system, structure, or component, then the originator shall

promptly notify the Shift Manager of the affected unit(s). Section 3.2.1 states, The

originators leader shall ensure the Shift Manager of the affected unit(s) is notified, if

required by Section 3.1.2.

Procedure 40DP-90P26, Operability Determination, Section 1 required, in part, that:

(1) To continue operation while an operability determination is being made, there

must be reasonable expectation that the system is operable and that the

determination process will support that expectation.

-11-

(2) The process of operability determination is continuous and consists of the

verification of operability by surveillance and formal determinations whenever a

condition calls into question the system, structure, or components (SSC) ability

to perform its specified function.

(3) The operability determination process shall call for immediately declaring

equipment inoperable when reasonable expectation of operability does not exist

or mounting evidence suggests that the final analysis will conclude that the

equipment cannot perform its specified safety function.

(4) Upon notification, the shift manager\STA shall perform an initial operability

determination and document the results in the Unit Log. In most cases, the

decision should be made immediately and must be made by the end of the shift.

Contrary to these requirements, on July 29-30, 2004: (1) engineering personnel failed

to immediately inform the shift manager of the affected units after identifying that a

voided condition could adversely affect the operability of the HPSI and CS pumps;

(2) the licensee continued to operate the facility without a reasonable assurance of

operability; (3) operations personnel did not implement a continuous operability

determination process; (4) operations personnel did not declare the HPSI and CS

systems inoperable even though mounting evidence suggested the final analysis would

conclude equipment would not perform it's intended safety function; and (5) operations

personnel did not perform an initial operability determination for the as-found conditions

of the HPSI and CS systems. The failure to follow procedural guidance is considered a

violation of 10 CFR Part 50, Appendix B, Criterion V. Because this finding is of very low

safety significance and has been entered into the corrective action program as

CRDRs 2733983 and 2734037, this violation is being treated as a noncited violation

consistent with Section VI.A of the NRC Enforcement Policy: NCV

05000528,529,530/2004014-02, Failure to Follow Procedure.

04 Implementation of 10 CFR 50.59 Evaluation Program

04.1 Failure to Perform 50.59 Evaluations for Changes to the Facility Implemented Following

Identification of Voided Condition

Introduction. The team identified three examples of a violation of 10 CFR 50.59

requirements involving the failure to perform written safety evaluations prior to

implementing changes to the facility.

Details. As discussed in Section 03, the licensee initiated CRDR 2726509 on

July 29, 2004, to document that the voided condition of the containment sump safety

injection recirculation piping could potentially affect the safety function of the HPSI and

CS pumps during postaccident conditions following a RAS. On July 30 at 6:45 p.m.,

operations personnel determined that the affected systems were operable based on

compensatory measures and engineering judgment. The compensatory measures

required operators to manually open the inboard containment sump isolation valves

(SI-673 and SI-675) following a containment spray actuation signal and prior to a RAS.

The compensatory measure would allow the majority of the voided pipe to fill with sump

-12-

water, leaving a much smaller 10-20 cubic foot void. Upon a RAS, the outboard

containment sump isolation valves would automatically open, the low pressure injection

pumps would automatically stop, and the containment sump would then support suction

requirements for the HPSI and CS pumps in the containment recirculation mode of

operation. Engineering personnel determined that the remaining 10-20 cubic feet of air

between the outboard containment sump isolation valves and their downstream check

valves would not adversely affect the design function of the HPSI and CS pumps. No

calculations were performed to support this conclusion and the licensee was unable to

provide any basis for this conclusion other than engineering judgment.

The team reviewed Screening/Evaluation Log Number S-04-0204, which was initiated to

assess these compensatory measures. The licensee completed the 10 CFR 50.59

screening for this change on July 31 at 6 p.m. The compensatory measures were

implemented the day before, on July 30, at 6:45 p.m. Administrative Procedure 40DP-

9OP26, Operability Determinations, Revision 12, Appendix C, Section 2, stated that a

10 CFR 50.59 Screening/Evaluation must be performed for the use of compensatory

measures that are used to maintain operability. In addition, Administrative Procedure

93DP-0LC07, 10 CFR 50.59 and 72.48 Screenings and Evaluations, Revision 7,

required the performance of 10 CFR 50.59 screenings and evaluations prior to

implementation of the changes that were performed. The licensee stated that the

requirements of 10 CFR 50.59 were discussed prior to implementing the change;

however, they determined that a 10 CFR 50.59 evaluation was not required. The

decision was documented the day after the change was made. The inspection team

disagreed with the licensees conclusion. Specifically, the team concluded that a

10 CFR 50.59 evaluation was required to be documented prior to the change.

Based on a review of NEI (Nuclear Energy Institute) 96-07, Guidelines for 10 CFR 50.59 Evaluations, Revision 1, which is endorsed by NRC Regulatory Guide 1.187,

Guidance for Implementation of 10 CFR 50.59, Changes, Tests, and Experiments, the

team determined that the licensee failed to adequately evaluate Question 2 on their

10 CFR 50.59 screening form. Question 2 stated, Does the proposed activity involve a

change to a procedure described in the Power Production Facility Licensing Documents

that adversely affects how SSC design functions are performed or controlled? The

licensee answered this question No. UFSAR Section 6.3.2.7 states that the two

modes of operation for the HPSI and CS systems, injection and recirculation, are

automatically initiated by an SAIS and a RAS, respectively. Section 4.2.1.2 of

NEI 96-07 states, "For purposes of 10 CFR 50.59 screening, changes that

fundamentally alter (replace) the existing means of performing or controlling design

functions should be conservatively treated as adverse and screened in. Such changes

include replacement of automatic action by manual action changes." Based on these

statements, the team concluded that the licensees 10 CFR 50.59 screening

inappropriately determined that a written safety evaluation was not required.

In addition, the compensatory measures did not result in complete removal of the air

void in the suction piping. Following the manual actions to open the inboard

containment sump isolation valves, a 10-20 cubic foot voided section of suction piping

would remain between each outboard containment sump isolation valve and its

respective downstream check valve (see Attachment B for details). The HPSI and CS

-13-

NPSH analyses (13-MC-SI-017, Safety Injection System Interface Requirements

Calculation, Revision 4, and 13-MC-SI-018, Containment Spray System Interface

Requirements Calculation, Revision 5) were both based on an assumption that suction

piping would be full of water. This condition was a change to the facility as described in

UFSAR, which also required a written safety evaluation.

Following implementation of the compensatory measures, the licensee determined that

filling the piping from the inboard containment sump isolation valves to the downstream

check valves would place the system in a safer condition and satisfy the original design

basis of the systems. Operations Procedure 40OP-SI02, Recovery from Shutdown

Cooling to Normal Operating Lineup, was revised to provide instructions for filling the

piping. The licensee subsequently realized that the inboard containment sump isolation

valves would not be leak tight; therefore, the decision was made to fill a portion of the

containment sump to a level slightly above the suction piping. A revision to

Maintenance Procedure 40OP-SI02 was implemented to provide procedural guidance to

perform this activity. The licensee failed to realize that filling a portion of the

containment sump was a change to the facility and therefore would require a

10 CFR 50.59 screening. Between August 1-4, the licensee completed the filling activity

on all three units. During discussions with the NRC, the licensee realized that they had

made changes to the facility as described in the UFSAR that should have been reviewed

in accordance with 10 CFR 50.59 requirements. On August 12, the licensee completed

the 10 CFR 50.59 screening of the change made to fill a portion of the containment

sumps with water and determined that a 10 CFR 50.59 evaluation was not required.

The inspection team disagreed with the conclusion that an evaluation was not required.

Analysis. The failure to implement the requirements of 10 CFR 50.59 was a

performance deficiency. This finding is more than minor because it is associated with

the equipment performance attribute of the Mitigating Systems cornerstone and

adversely affects the cornerstone objective of ensuring the availability, reliability, and

capability of systems that respond to initiating events. In accordance with Inspection

Manual Chapter 0612, Appendix B, Issue Disposition Screening, the team determined

that traditional enforcement applied because this issue may have impacted the NRCs

ability to perform its regulatory function.

The severity level of this finding was based, in part, on the significance determination

process. The examples involving replacing manual actions in lieu of automatic actions

and operation with a 10-20 cubic foot void in the suction piping were assessed using the

Phase 1 worksheet from Inspection Manual Chapter 0609, "Significance Determination

Process." The team determined that a Phase 2 analysis was required because both the

Mitigating Systems and Barrier Integrity cornerstones were potentially affected. The

Phase 2 analysis determined that these findings were potentially Greater than Green;

therefore, a Phase 3 analysis was completed by a regional senior reactor analyst. The

Phase 3 analysis determined that these issues were of very low safety significance

based on a similar analysis used in Section 03 of this report, since it only took a few

days before all the compensatory measures were established. The third example

involving filling the containment sump with borated water was also considered to be of

very low safety significance since this change did not adversely impact the design or

operation of the ECCS.

-14-

Enforcement. 10 CFR 50.59(d)(1) states that the licensee shall maintain records of

changes in the facility, of changes in procedures, and of tests and experiments made

pursuant to paragraph (c) of this section. These records must include a written

evaluation which provides the bases for the determination that the change, test, or

experiment does not require a license amendment pursuant to paragraph (c)(2) of this

section. Contrary to this requirement: (1) the licensee did not perform a written

evaluation prior to implementing compensatory measures involving the use of manual

actions in lieu of automatic actions, as described in the UFSAR, to support the safety

functions of the HPSI and CS systems; (2) the licensee did not perform a written

evaluation for operation of the HPSI and CS systems with a 10-20 cubic foot void in the

suction piping; and (3) the licensee did not perform a written evaluation for filling a

portion of the containment sump. These represent three examples of a violation of 10

CFR 50.59 requirements and are being treated as a Severity Level IV violation.

Because these examples are of very low safety significance and have been entered into

the corrective action program as CRDRs 2734089 and 2729600, this violation is being

treated as a noncited violation in accordance with Section VI.A of the Enforcement

Policy. This violation is identified as NCV 05000528, 529, 530/2004014-03, Failure to

Perform Written Safety Evaluation in Accordance with 10 CFR 50.59.

04.2 Failure to Perform 10 CFR 50.59 Evaluations for Procedural Change Involving Draining

the Containment Sump Recirculation Suction Piping

Introduction. The team identified an apparent violation of 10 CFR 50.59 requirements

for the failure to perform a written safety evaluation and receive NRC approval prior to

implementing changes in 1992 which involved draining, and maintaining drained, a

significant segment of containment sump safety injection recirculation piping during

normal plant operations.

Details. The team questioned wether the voided containment sump recirculation suction

piping condition had ever been identified and entered into the corrective action process

or any other processes and evaluated prior to the most recent discovery of the problem

in July of 2004. The licensee provided the team with documentation that a procedure

revision had been implemented in 1992 in which requirements were incorporated into an

ECCS leak test surveillance procedure that required draining the containment sump

suction piping following the test. Specifically, Instruction Change Request 61008 was

initiated to process the procedure revision for Surveillance Test Procedure SI09, ECCS

Leak Test. The licensee inappropriately determined that draining and maintaining

drained the suction piping following the leak test was not a change to the facility as

described in the safety analysis report. The inspection team based this assessment on

the following:

• Leaving the containment sump recirculation piping in the voided configuration

adversely affected the design basis function of the HPSI and CS systems. This

introduced an unreviewed safety question in that it increased the probability of

occurrence of a malfunction of equipment important to safety previously

evaluated in the UFSAR.

-15-

• The UFSAR, Section 6.3, Emergency Core Cooling System, states in part, that,

the safety injection piping will be maintained filled with water.

• The UFSAR, Section 6.3, states that the available net positive suction head for

the containment spray and HPSI pumps are 25.8 feet and 28.8 feet, respectively,

during recirculation mode. The HPSI and CS pumps net positive suction head

analyses, Calculations 13-MC-SI-017 and 13-MC-SI-018, were calculated based

on the assumption that the piping would be full of water.

The team determined that this procedure change request provided the licensee with an

opportunity to identify that the voided condition could adversely affect the operability of

the CS and HPSI pumps following a RAS. The licensee failed to adequately review

design basis documentation to identify that the voided condition placed the CS and

HPSI systems in an unanalyzed condition following a RAS. The team also noted that

this change request identified that the ASME Section XI stroke testing performed on the

containment sump isolation valves also resulted in the voided condition and the licensee

failed to question the adequacy of leaving the piping in the degraded configuration.

Analysis. The failure to implement the requirements of 10 CFR 50.59 was a

performance deficiency. This finding is more than minor because it is associated with

the equipment performance attribute of the Mitigating Systems cornerstone and

adversely affects the cornerstone objective of ensuring the availability, reliability, and

capability of systems that respond to initiating events. In accordance with Inspection

Manual Chapter 0612, Appendix B, Issue Disposition Screening, the team determined

that traditional enforcement should be applied because this issue impacted the NRCs

ability to perform its regulatory function at the time the change was made. Specifically,

the team determined that the change to the facility involved draining, and maintaining

drained, a significant segment of containment sump recirculation piping following

surveillance activities resulted in a change that would have required NRC approval prior

to implementation.

This finding was not suitable for evaluation using the significance determination process.

As discussed in Section 02, the physical configuration of the plant which resulted from

this finding is potentially Greater than Green.

Enforcement. This issue involved the licensees failure to adequately evaluate and

control changes to the facility prior to March, 2001; therefore, the issue was evaluated

against the 10 CFR 50.59 requirements that were in effect in 1992. 10 CFR 50.59(a)(1)

states that the holder of a license authorizing operation of a production or utilization

facility may: (1) make changes in the facility as described in the safety analysis report,

(2) make changes in the procedures as described in the safety analysis report, and

(3) conduct tests or experiments not described in the safety analysis report, without prior

Commission approval, unless the proposed change, test, or experiment involves a

change in the Technical Specifications incorporated in the license or an unreviewed

safety question. A proposed change, test, or experiment shall be deemed to involve an

unreviewed safety question: (1) if the probability of occurrence or the consequences of

an accident or malfunction of equipment important to safety previously evaluated in the

safety analysis report may be increased; (2) if a possibility for an accident or malfunction

-16-

of a different type than any evaluated previously in the safety analysis report may be

created; or (3) if the margin of safety as defined in the basis for any Technical

Specification is reduced. PVNGS UFSAR, Section 6.3, Emergency Core Cooling

System, states, in part, that the safety injection piping will be maintained filled with

water.

Contrary to the above, the licensee failed to perform a written safety evaluation and

obtain Commission approval prior to implementing procedural changes that resulted in

an unreviewed safety question. Specifically, in 1992 changes were made to

Surveillance Procedure SI09, ECCS Leak Test, which drained, and maintained

drained, a significant segment of safety injection piping following ECCS leakage

surveillance testing. These changes affected the available net positive suction head

analysis described in the UFSAR for the safety injection pumps, which are important to

safety, since the analysis assumed the piping would be maintained full of water. This

represented an unreviewed safety question since it increased the probability of a

malfunction of equipment important to safety previously evaluated in the safety analysis

report.

This finding was also evaluated against the current 10 CFR 50.59 requirement, which

states that a licensee shall obtain a license amendment pursuant to 10 CFR 50.90 prior

to implementing a proposed change, test, or experiment if the change, test, or

experiment would result in more than a minimal increase in the likelihood of occurrence

of a malfunction of an SSC important to safety previously evaluated in the final safety

analysis report. Contrary to this, the licensee implemented changes to Surveillance

Procedure SI09, ECCS Leak Test, that more than minimally increased the likelihood of

occurrence of a malfunction of an SSC important to safety.

This violation of requirements is being treated as an apparent violation of 10 CFR 50.59,

05000528, 529, 530/2004014-04, Failure to Obtain Prior NRC Approval for a Change to

the Facility Involving Maintaining a Significant Segment of Containment Sump Safety

Injection Recirculation Piping Void of Water.

05 Evaluation of Operating Experience

a. Inspection Scope

The team performed a review of licensee evaluations and required submittals with

respect to NRC generic guidance related to NPSH concerns affecting the ECCS and CS

systems. Specific NRC generic guidance included:

• Generic Letter 97-04, Assurance of Sufficient Net Positive Suction Head for

Emergency Core Cooling and Containment Heat Removal Pumps

• Information Notice (IN) 87-63, Inadequate Net Positive Suction Head in Low

Pressure Safety Systems

-17-

• IN 96-55, Inadequate Net Positive Suction Head of Emergency Core Cooling

and Containment Heat Removal Pumps Under Design Basis Accident

Conditions

b. Observations

Introduction. The licensee missed a number of opportunities to identify that the voided

containment sump recirculation piping could adversely affect the safety function of the

ECCS and containment heat removal systems.

Description. The team reviewed the licensee's response to Generic Letter 97-04,

Assurance of Sufficient Net Positive Suction Head for Emergency Core Cooling and

Containment Heat Removal Pumps. The Generic Letter discussed examples in which

licensees had either made changes to plant configurations and operating conditions or

made errors in their NPSH calculations that could adversely affect the safety function of

the ECCS system and the CS system under accident conditions. In light of these

discrepancies, the Generic Letter requested that licensees review their current design

basis analyses used to determine available NPSH. The letter stated that new NPSH

analyses are neither requested nor required to be performed; however, new NPSH

analysis may be warranted if an addressee determines that changes in plant design or

procedures have occurred which may have reduced the available NPSH.

The team determined that the licensee, in developing its response to this Generic Letter,

missed an opportunity to identify that changes made to the facility had adversely

affected the available NPSH for the HPSI and CS pumps. Specifically, as previously

discussed, in 1992 the licensee revised Surveillance Test Procedure SI09, ECCS Leak

Test, to maintain a significant segment of containment sump safety injection

recirculation piping in a voided configuration following leakage testing. Maintaining this

voided configuration invalidated the analysis of NPSH initially reviewed and approved by

the NRC. The original licensing and design basis assumed that the systems would be

maintained in a water filled condition.

IN 96-55, Inadequate Net Positive Suction Head of Emergency Core Cooling and

Containment Heat Removal Pumps Under Design Basis Accident Conditions,

addresses the potential for insufficient NPSH for ECCS pumps and identifies concerns

that licensees who credit containment overpressure to ensure adequate NPSH may not

be supported by detailed containment pressure temperature analyses. The licensee

initiated a CRDR to evaluate applicability of this condition to PVNGS. This evaluation

concluded that the concerns identified in the IN were not applicable to PVNGS.

Although the focus of IN 96-55 differed from the voided condition in the ECCS sump

suction piping, it presented an opportunity to evaluate the inconsistency between their

design basis and voided condition. Because the licensees evaluation of IN 96-55 was

too narrowly focused, licensee personnel missed another opportunity to identify that the

voided piping impacted the NPSH for the ECCS pumps.

IN 87-63, Inadequate Net Positive Suction Head in Low Pressure Safety Systems,

discussed problems that could result in inadequate NPSH at the inlet to low pressure

pumps following a LOCA. PVNGS performed no written evaluation of this issue.

-18-

Although IN 87-63 did not explicitly discuss conditions similar to the voided piping

condition found at PVNGS, it presented another opportunity for the licensee to evaluate

their ECCS configuration. The licensee missed this opportunity to identify and correct

the discrepancy between the design basis and the actual configuration of their ECCS.

06 Meetings, Including Exit

On December 9, 2004, the special inspection team leader presented the inspection

results to Mr. Overbeck and other members of his staff. The team leader confirmed that

the inspectors were provided with information that the licensee considered to be

proprietary. This information was associated with the full scale pump testing which was

incomplete at the time of the exit meeting.

ATTACHMENT A

Supplemental Information

KEY POINTS OF CONTACT

Licensee Personnel

S. Bauer, Department Leader, Regulatory Affairs

P. Borchert, Director, Work Management

R. Buzard, Senior Consultant, Regulatory Affairs

D. Carnes, Director, Regulatory Affairs, Nuclear Assurance

S. Coppock, Section Leader, System Engineering

D. Fam, Department Leader, Design Engineering

D. Gregoire, 50.59 Program Manager

M. Gribsby, Unit Department Leader, Operations

R. Henry, Site Rep., SRP

J. Levine, Executive Vice President, Generation

K. Manne, Senior Attorney, PNW

D. Marks, Section Leader, Regulatory Affairs

D. Mauldin, Vice President, Engineering and Support

J. Mellody, Department Leader, Communications

G. Overbeck, Senior Vice President, Nuclear

W. Peabody, Consultant

S. Peace, Consultant, Owner Services

S. Pittalwala, Director, Project Engineering

M. Radspinner, Section Leader, System Engineering

T. Radtke, Director, Operations

J. Scott, Department Leader, Nuclear Assurance

M. Shea, Director, Maintenance

E. Shore, Site Rep., EPE

D. Smith, Plant Manager

M. Sontag, Department Leader, Nuclear Assurance

G. Sowers, Section Leader, PRA

K. Sweeney, Section Leader, System Engineering

D. Vogt, Section Leader, Operations STA

T. Weber, Section Leader, Regulatory Affairs, Licensing

D. Wheeler, Section Leader, Nuclear Assurance

M. Winsor, Director, Engineering

NRC

J. Melfi, Resident Inspector, Palo Verde Nuclear Generating Station

C. Osterholtz, Senior Resident Inspector, San Onofre Nuclear Generating Station

N. Salgado, Senior Resident Inspector, Palo Verde Nuclear Generating Station

S. Schwind, Chief, Project Branch D, Division of Reactor Projects

T. Vegel, Deputy Director, Division of Reactor Projects

A-1 Attachment

ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000528,529,530/ AV Failure to Maintain Design Control of Containment Sump

2004014-01 Recirculation Piping

05000528,529,530/ NCV Failure to Follow Procedure

2004014-02

05000528,529,530/ NCV Failure to Perform Written Safety Evaluation in Accordance

2004014-03 with 10 CFR 50.59 Requirements

05000528,529,530/ AV Failure to Obtain Prior NRC Approval for a Change to the

2004014-04 Facility Involving Maintaining a Significant Segment of

Containment Sump Safety Injection Recirculation Piping

Void of Water

Closed

05000528,529,530/ NCV Failure to Follow Procedure

2004014-02

05000528,529,530/ NCV Failure to Perform Written Safety Evaluation in Accordance

2004014-03 with 10 CFR 50.59 Requirements

LIST OF DOCUMENTS REVIEWED

Procedures:

01DP-OAP01, Procedure Process, Revision 14

40DP-9OP26, Operability Determination, Revision 12

40EP-9EO03, Loss of Coolant Accident, Revision 16

40EP-9EO09, Functional Recovery, Revision 21

40OP-9SI02, Recovery from Shutdown Cooling to Normal Operating Lineup, Revisions 49 and

50

90DP-0IP10, Condition Reporting, Revision 19

A-2 Attachment

93DP-0LC07, 10 CFR 50.59 and 72.48 Screenings and Evaluations, Revision 7

Analysis:

13-MC-SI-017, Safety Injection System Interface Requirements Calculation, Revision 4

13-MC-SI-018, Containment Spray System Interface Requirements Calculation, Revision 5

CRDRs:

370221, 2726509, 2729600, 2731156, 2733983, 2734037

Miscellaneous:

10 CFR 50.59 Screening/Evaluation S-04-0204, Revision 0

10 CFR 50.59 Screening/Evaluation S-04-0207, Revision 0

Instruction Change Request 61008

NEI 96-07, Guidelines for 10 CFR 50.59 Implementation, Revision 1

NRC Generic Letter 96-06, Assurance of Equipment Operability and Containment Integrity

During Design-Basis Accident Conditions

NRC Generic Letter 97-04, Assurance of Sufficient Net Positive Suction Head for Emergency

Core Cooling and Containment Heat Removal Pumps

NRC Information Notice 97-78, Crediting of Operator Actions in Place of Automatic Actions

and Modifications of Operator Actions, Including Response Times

NRC Inspection Manual Part 9900 Technical Guidance, Operable/Operability: Ensuring the

Functional Capability of a System or Component, 1991

NUREG-0897, Containment Emergency Sump Performance, 1985

NUREG/CR-2792, An Assessment of Residual Heat Removal and Containment Spray Pump

Performance Under Air and Debris Conditions, 1982

Operability Determination 2728663, Revisions 0 and Revision 1

VTD-I075-0007, High Pressure Safety Injection Pumps Technical Manual, Revision 0

Wallis, et al, Conditions for a Pipe to Run Full When Discharging Liquid Into a Space Filled

With Gas, Journal of Fluids Engineering, June 1977

A-3 Attachment

LIST OF ACRONYMS

AV apparent violation

CFR Code of Federal Regulations

CRDR condition report/disposition request

CS containment spray

ECCS emergency core cooling system

HPSI High Pressure Safety Injection

IN information notice

LOCA loss of coolant accident

NPSH net positive suction head

NRC Nuclear Regulatory Commission

PVNGS Palo Verde Nuclear Generating Station

RAS recirculation actuation signal

SSC structure, system, or component

UFSAR Updated Final Safety Analysis Report

A-4 Attachment

ATTACHMENT B

Figure

B-1 Attachment

ATTACHMENT C

Inspection Charter

August 11, 2004

MEMORANDUM TO: Michael Hay, Senior Resident Inspector

Waterford 3 Steam Electric Station

Geoffery Miller, Resident Inspector

Grand Gulf Nuclear Power Plant

FROM: Arthur T. Howell III, Director /RA/ CSMarschall for

Division of Reactor Projects

SUBJECT: SPECIAL INSPECTION CHARTER TO EVALUATE PALO VERDE

UNITS 1, 2, AND 3 VOIDED CONDITION DISCOVERED IN THE

POST-LOCA RECIRCULATION PIPING FROM THE CONTAINMENT

SUMP

In response to the discovery that during a Recirculation Actuation Signal (RAS) the trapped

volume of air between the containment sump suction line isolation valves and the downstream

check valve could enter the operating high pressure safety injection (HPSI) and containment

spray (CS) pumps, a Special Inspection Team is being chartered. You are hereby designated

as the Special Inspection Team members. Mike Hay is designated as the team leader.

A. Basis

On July 29, 2004, Palo Verde Nuclear Generating Station identified (CRDR 2726509) a

pocket of air trapped between the containment sump inboard isolation motor operated

valve and the containment sump check valve. This trapped air, if forced into the HPSI

or CS pump suction, could result in degradation of the pumps and/or lead to a water

hammer event. Technical Specifications 3.5.3 and 3.6.6 require both trains of HPSI and

CS to be operable during power operations in Modes 1 through 3.

This Special Inspection Team is chartered to compare the as-found conditions to the

licensing basis for the containment sump suction, determine if there are generic safety

implications associated with voiding the suction piping, and review the licensees

compensatory measures following discovery of the condition.

C-1 Attachment

B. Scope

The team is expected to address the following:

1. Develop a complete sequence of events related to the discovery of the voided

condition and follow-up actions taken by the licensee.

2. Compare operating experience involving air voiding of emergency core cooling

system suction piping to actions implemented at Palo Verde. Determine if there

are any generic issues related to the design and operating practices that resulted

in the voiding of the containment sump suction piping. Promptly communicate

any potential generic issues to regional management.

3. Review the licensees determination of the cause of design deficiencies and

operating practices that allowed the voiding condition to exist. Independently

verify key assumptions and facts. Determine if the licensees root cause analysis

and corrective actions have addressed the extent of condition for air voiding of

safety systems.

4. Determine if the Technical Specifications were met for the air voided condition

and following the implementation of compensatory measures.

5. Determine if the supporting analyses for the licensees compensatory measures

were made in accordance with 10 CFR 50.59.

6. Review the calculations the licensee used to evaluate the voided condition.

Assess the key factors associated with the total volume of trapped air, the

expected flow rates of the HPSI and CS pumps, the size and orientation of the

sump suction piping, and the impact on pump operability.

7. Collect data necessary to support a risk analysis. Specifically obtain information

associated with the degree to which the HPSI and CS pumps were affected, the

ability to recover failed pumps, and the dominant accident sequences.

C. Guidance

Inspection Procedure 93812, "Special Inspection," provides additional guidance to be

used by the Special Inspection Team. Your duties will be as described in Inspection

Procedure 93812. The inspection should emphasize fact-finding in its review of the

circumstances surrounding the event. It is not the responsibility of the team to examine

the regulatory process. Safety concerns identified that are not directly related to the

event should be reported to the Region IV office for appropriate action.

The Team will report to the site, conduct an entrance, and begin inspection no later than

August 23, 2004. The inspection will include a review of the licensees calculations

associated with the transportability of the air pocket. This is not expected to be

completed until following the teams initial visit. While on site, you will provide daily

status briefings to Region IV management, who will coordinate with the Office of Nuclear

C-2 Attachment

Reactor Regulation, to ensure that all other parties are kept informed. A report

documenting the results of the inspection should be issued within 30 days of the

completion of the inspection.

This Charter may be modified should the team develop significant new information that

warrants review. Should you have any questions concerning this Charter, contact me at

(817) 860-8248.

cc via E-mail:

B. Mallett

T. Gwynn

M. Fields

C. Marschall

D. Chamberlain

J. Clark

V. Dricks

W. Maier

N. Salgado

W. Jones

C. Paulk

J. Shea

R. Laura

C-3 Attachment

ATTACHMENT D

Phase 2 and Phase 3 Risk Assessments

In accordance with MC 0612, Power Reactor Inspection Reports, the assumptions used in the

Phases 2 and 3 analyses, as well as the dominant core damage sequences resulting from the

analyses, are provided below.

Phase 2 Assumptions and Dominant Core Damage Sequences

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, "User Guidance

for Determining the Significance of Reactor Inspection Findings for At-Power

Situations," the inspectors evaluated the subject finding using the Risk-Informed

Inspection Notebook for Palo Verde Nuclear Generating Station, Revision The

following assumptions were made:

• The air in the sump suction piping would be drawn into the suction of the high

pressure safety injection and containment spray pumps following a recirculation

actuation signal, causing them to fail via air binding or cavitation.

• Operators would be capable of recovering the pumps. The time available would

be greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> given the time after shutdown. Recovery may not have

been possible in all scenarios; however, full recover credit was used as a

bounding assumption.

• The condition existed for most of the life of the plant. Therefore, the exposure

time window used was >30 days.

• The low pressure recirculation function remained available. The automatic

operation of the containment spray and high pressure safety injection pumps

would clear the air bubble from the suction piping that affects the low pressure

safety injection pumps.

• Initiating event likelihoods were not affected by this performance deficiency.

• No mitigating equipment was affected by this performance deficiency prior to a

recirculation actuation signal.

Table 2 of the risk-informed notebook requires that the following accident sequences be

evaluated when the emergency core cooling systems are affected: SLOCA, MLOCA,

LLOCA, LOPW and LONCW. Using Table 1 with an exposure time of greater than

30 days, the inspectors identified the following Initiating Event Likelihoods (IELs) for use

in the estimation:

D-1 Attachment

Table 2.a: Phase 2 Initiating Event

Frequencies

Accident Sequence IEL

SLOCA 3

MLOCA 4

LLOCA 5

LOPW 3

LONCW 2

The resulting accident sequence analysis is summarized below, which

indicated a finding that was potentially Greater than Green. As a result, a

Phase 3 analysis was performed, as documented on pages D-3 through

D-17.

Table 2.b: Phase 2 Results

Initiating Event Sequence Mitigating Functions

SLOCA 1 CHR

SLOCA 2 HPR

SLOCA 4 HPSI - CHR

MLOCA 2 CHR

MLOCA 3 HPR

LLOCA 2 CHR

LLOCA 3 HPR - LPR

LOPW 3 RCPT - CHR

LOPW 4 RCPT - HPR

LONCW 3 PCS - RCPT - CHR

LONCW 4 PCD - RCPT - HPR

D-2 Attachment

Phase 3 Analysis

Internal Initiating Events

Assumptions:

The results from the notebook estimation were compared with an evaluation developed

using a Standardized Plant Analysis Risk (SPAR) model simulation of the failure of

emergency core cooling systems upon a recirculation actuation signal, as well as an

assessment of the licensees evaluation provided by the licensee's probabilistic risk

assessment staff. The SPAR runs were based on the following analyst assumptions:

b The SPAR Model, Revision 3.03, was used to assess the significance of this

event. This model, including the component test and maintenance basic events,

represents an appropriate tool for evaluation of the subject finding.

c NUREG/CR-5496, Evaluation of Loss of Offsite Power Events at Nuclear Power

Plants: 1980 - 1996, contains the NRCs current best estimate of both the

likelihood of each of the loss of offsite power (LOOP) classes (i.e., plant-

centered, grid related, and severe weather) and their recovery probabilities.

d

e

f The conditional probability of operators failing to properly diagnose and restore

the high pressure safety injection pumps was 24%. The analyst used the

SPAR-H method to calculate this probability. He assumed that the nominal

diagnosis failure rate of 0.01 and the nominal action failure rate of 0.001 are

multiplied by the following performance shaping factors:

' Available Time for Diagnosis: 10

' Available Time for Action: 10

The available time was assumed to be barely adequate to complete the

diagnosis because the operators would have to identify the need to trip

the pumps in a very short period of time in order to prevent possible

D-3 Attachment

damage to the pumps beyond use. If the need to trip the pumps was

identified, then determining that the pumps needed to be vented was

considered to be an action.

The available time to take action was also assumed to be barely

adequate. The analyst assumed that, once operators shut down the

pumps, it would take approximately 30 minutes to identify that venting

was necessary, an additional 30 minutes would be required for metal

temperatures to drop below boiling so that venting could take place, and

finally 30 minutes to vent the pump given the large volume of air/steam

that would need to be vented.

' Stress: 2

Stress under the conditions postulated would be high. A LOCA would be

ongoing. Multiple alarms would be initiated as the four primary

emergency core cooling system pumps fail during the swapover to

recirculation. Additionally, operators would understand that the

consequences of their actions would represent a threat to plant safety.

' Complexity for diagnosis: 1

' Complexity for action: 2

The complexity of the tasks necessary to properly diagnose this condition

was determined to be nominal. The analyst noted that control board

indications would show that flow was not moving forward and that

operators would be required to trip the pumps. During action, however,

operators would have to identify that the cause of the failure was voiding,

understand that the high head pumps needed to be cooled prior to proper

venting, and vent for an appropriate period of time. Therefore, the

analyst determined that this action was moderately complex.

f The probability of operators failing to properly diagnose and restore the

containment spray pumps was calculated to be 2.4%. The analyst used the

same methods and calculations as used to determine the conditional probability

of recovering the high pressure safety injection. Because containment spray is

not needed as quickly as the high pressure safety injection pumps, the time

available for both the action and the diagnosis steps were set to nominal

(assuming that the pumps were accessible and had not catastrophically failed).

g The condition existed for the life of the plant. Therefore, an exposure time of

1 year (the reactor oversight process assessment period) was used.

h Plant equipment was assumed to have been available at their average test and

maintenance frequencies.

i All accident initiators that could lead to recirculation were considered applicable.

D-4 Attachment

j Although this finding is applicable to all three Palo Verde units, the performance

deficiency was evaluated for a single unit only because the reactor oversight

process is conducted separately on each unit.

Analysis:

Evaluation of Change in Risk

The SPAR Revision 3.03 model was modified to include updated loss of offsite power

curves as published in NUREG CR-5496, as stated in Assumption b. The changes to

the loss of offsite power recovery actions and other modifications to the SPAR model

were documented in Table 2. This revision was incorporated into a base case update,

making the revised model the baseline for this evaluation. The resulting baseline core

damage frequency, CDFbase, was 4.04 x 10-9 /hr.

The analyst changed this modified model by setting the common cause failure to run

basic event for the containment spray pumps (CSR-MDP-CF-RUN) to the recovery

probability (2.4 x 10-2). Additionally, the analyst set the basic event HPR-MOV-CF-RWT

to its recovery probability of 24%. This event is the functional equivalent to failing the

pumps during recirculation. However, it does not fail high pressure injection function as

adjusting the failure to run probability for the pumps. The modified SPAR model was

requantified with the resulting current case conditional core damage frequency, CDFcase,

of 5.85 x 10-9 /hr.

The change in core damage frequency (CDF) from the model was:

CDF = CDFcase - CDFbase

= 5.85 x 10-9 - 4.04 x 10-9 = 1.81 x 10-9 /hr

Therefore, the total change in core damage frequency over the exposure time that was

related to this finding was calculated as:

CDF = 1.81 x 10-9 /hr * 8760 hr/yr = 1.59 x 10-5 for a 1 year exposure time

The preliminary risk significance of this finding is presented in Table 3.a. The dominant

cutsets from the internal risk model are shown in Table 3.b.

D-5 Attachment

Table 2.c: Baseline Revisions to SPAR Model

Basic Event Title Original Revised

IE-LOOP Loss of Offsite Power Initiator 5.20 x 10-6/hr 6.32 x 10-6/hr

EPS-DGN-FR-FTRM Diesel Generator Fails to Run - 3.5 hrs. 13.5 hrs.

Middle Time Frame*

EPS-DGN-FR-FTRL Diesel Generator Fails to Run - 1 x 10-6 hrs. 1.2 hrs.

Long Time Frame*

OEP-XHE-NOREC-ST Operator Fails to Recover AC 5.8 x 10-1 5.67 x 10-1

Power in the Short Term

OEP-XHE-NOREC-SL Operator Fails to Recover AC 5.78 x 10-1 6.57 x 10-1

Power before Seal LOCA

OEP-XHE-NOREC-BD Operator Fails to Recover AC 1.1 x 10-1 3.15 x 10-1

Power before Battery Depletion

OEP-XHE-NOREC-3H Operator Fails to Recover AC 6.5 x 10-2 1.86 x 10-1

Power in 3 Hours

RCP-MDP-LK-SEALS RCP Seals Fail without Cooling 1.8 x 10-2 4.09 x 10-2

and Injection

• Diesel Mission Time was increased from 2.5 to 15.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in accordance with NUREG/CR-

5496

Table 3.a: Evaluation Model Results

Model Result Core Damage LERF1

Frequency

SPAR 3.03, Baseline: Internal Risk 4.0 x 10-9/hr N/A

Revised

Internal Events Risk 5.9 x 10-9/hr N/A

TOTAL Internal Risk (CDF) 1.6 x 10-5 N/A

TOTAL External Risk (CDF)2 8.8 x 10-6 N/A

TOTAL Internal and External Change 2.5 x 10-5 N/A

NOTE 1: None of the dominant core damage sequences analyzed were determined to be

significant with respect to the large-early release frequency using Manual Chapter 0609,

Appendix H.

NOTE 2: The CDF from external events was estimated using the risk values from internal

initiators. The methods used should be considered bounding.

D-6 Attachment

Table 3.b: Top Risk Cutsets

Initiating Event Sequence Sequence Importance

Number

3 HPR 1.1 x 10-9

Medium LOCA

4 CSR 1.1 x 10-10

7 SRV-COOLDOWN-HPR 1.7 x 10-10

4 SRV-SDC-HPR 1.3 x 10-10

Transient

8 SRV-COOLDOWN-CSR 1.7 x 10-11

5 SRV-SDC-CSR 1.3 x 10-11

6 CSR 1.5 x 10-10

Large LOCA

5 HPR-LPR 1.4 x 10-11

6 COOLDOWN-HPR 5.5 x 10-11

3 SDC-HPR 4.0 x 10-11

Small LOCA

7 COOLDOWN-CSR 5.5 x 10-12

4 SDC-CSR 4.0 x 10-12

11 RCPSL1-OEP3H-HPR 8.3 x 10-12

Loss of Offsite Power

4 RCPSL1-SDC-HPR 2.8 x 10-12

External Initiating Events:

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, step 2.5,

"Screening for the Potential Risk Contribution Due to External Initiating Events," the

analyst assessed the impact of external initiators because the Phase 2 SDP result

provided a Risk Significance Estimation of 7 or greater.

The analyst determined that, for the subject performance deficiency to cause an

increase in plant risk from an external initiator, the initiator had to do one of three things:

(1) Cause an increase in the likelihood of an internal event affected by the

performance deficiency;

(2) Affect the reliability or availability of mitigating equipment used to mitigate the

initiators from the internal events evaluation; or

(3) Cause a new sequence that would result in the need for recirculation.

D-7 Attachment

The analyst reviewed the major external initiators that could affect the Palo Verde site.

Using the Palo Verde Individual Plant Examination of External Events (IPEEE) and the

analysts judgment and knowledge of the site, the analyst concluded that no new

sequences that would require recirculation would be initiated by external events.

However, increases in the likelihood of internal initiators, as well as effects on mitigating

equipment were identified. The analyst evaluated each external initiator to determine its

affect on the major internal events assessed by the SPAR. Each external event was

then evaluated to determine if the plant response could be affected by the performance

deficiency. Table 3.c provides the results of the initial screening:

Table 3.c: External Events Screening

SPAR Initiator

LONCW LOPC SLOCA MLOCA LLOCA TRANS LOOP

External Event

Seismic NEG NEG YES NEG NEG NEG NEG

High Winds NO NO NO NO NO BASE BASE

Internal Floods IEL IEL NO NO NO NEG NO

External Floods NO NO NO NO NO NO NO

Internal Fire NO YES YES NO NO BASE NEG

External Fire NO NO NO NO NO NEG NEG

Transportation NO NO NO NO NO NEG NEG

Other External NO NO NO NO NO BASE BASE

Notes:

1. NO / External initiator would not affect the subject internal event.

2. YES / External initiator could result in subject internal event and could affect mitigating

equipment.

3. IEL / External event could result in the subject internal event but not affect mitigating

equipment.

4. NEG / External initiator could result in the subject initiator, but has a frequency so low

that it would have negligible change on the internal event likelihood.

5. BASE / External event could result in subject initiator, but the effect was assumed to be

part of baseline risk of the plant.

D-8 Attachment

Transportation Incidents, External Fires:

The analyst determined that events that were initiated and remained outside of the

plant, by their nature, would not be expected to cause a plant system pipe break. Also,

the likelihood of having an external event occur simultaneously with a major pipe break

was considered to be negligible. Therefore, the analyst concluded that these events

would only affect plant transients and losses of offsite power. However, transportation

incidents and/or external fires causing plant initiators while at power are rare

occurrences, compared to the likelihood of equipment and weather-related events. As a

result, the change in initiating event likelihood would be very low.

The analyst reviewed the major sequences that were affected by the subject

performance deficiency. For transients, the dominant failures involved stuck-open

safety-relief valves. The analyst assumed that the potential for an external fire or

transportation accident to induce a stuck-open valve to be negligible. Likewise, the

analyst reviewed the sequence cutsets for loss of offsite power initiated sequences.

These sequences involved a reactor coolant pump seal failure resulting from the loss of

power. Therefore, the analyst determined that the only affect for these external events

would be the increase in initiating event likelihood.

In the IPEEE, the licensee used the screening methodology suggested in Generic Letter 88-20, Supplement 4, to evaluate these events. The licensee concluded that

transportation events were not significant threats for severe accident. The IPEEE was

silent on external fire. However, based on the analysts experience and judgment, the

analyst determined that external fire loading surrounding the plant was insufficient to

cause a loss of offsite power. Based on the licensees methodology, their result

correlates to a core damage frequency of less than 1 x 10-6. This corroborated the

analyst assumption that the increase in risk associated with the subject performance

deficiency was negligible with respect to transportation events and external fires.

External Floods:

The analyst assumed that, because of the topography of the site and the nature of the

desert, all external floods will drain or be quickly absorbed by the environment.

Therefore, there would be no affect on the initiating event likelihoods for any initiator.

In the IPEEE, the licensee used the screening methodology suggested in Generic Letter 88-20, Supplement 4, to evaluate these events. The licensee concluded that site

flooding was not a significant threat for severe accident because the effect of the

probable maximum precipitation, based on Hershfields statistics of extreme events, was

less limiting than the design basis calculations from the Updated Final Safety Analysis

Report. This corroborated the analysts assumption that external flooding had no

expected affect on total risk.

Internal Floods:

The analyst determined that Internal Floods have a potential to affect the initiating event

frequency of loss of cooling water systems and plant transients. However, internal

D-9 Attachment

floods would cause a similar effect on plant mitigating equipment, with or without the

performance deficiency. Additionally, there is a low frequency of the external event and

the resulting low likelihood that a flood takes out all equipment to cause a complete loss

of cooling water systems. The high likelihood of a transient from other causes results in

a negligible change in the initiating event likelihood. However, equipment related losses

of cooling water systems are quite often driven by the same piping breaks that cause an

internal flooding initiator.

According to the Idaho National Engineering and Environmental Laboratorys study

published in NUREG/CR-5750, Rates of Initiating Events at U. S. Nuclear Power

Plants: 1987-1995, loss of open-loop cooling water systems occur at a rate of 9.6 x 10-4

events per year. This is greater than the expected rate of piping failures large enough

to cause substantial flooding in the pump areas. As a result and to bound the risk

estimate, the analyst assumed that the impact of internal flooding initiated loss of

nuclear or plant cooling water systems on the core damage frequency was no more than

equal to the effect from internal events, regardless of whether the performance

deficiency existed. The impact of these initiators is discussed under the quantification

section below.

High Winds:

The analyst determined that events that were initiated and remained outside of the

plant, by their nature, would not be expected to cause a plant system pipe break. Also,

the likelihood of having an external event occur simultaneously with a major pipe break

was considered to be negligible. Therefore, the analyst concluded that these events

would only affect plant transients and losses of offsite power. The analyst reviewed the

major sequences that were affected by the subject performance deficiency. For

transients, the dominant failures involved stuck-open safety-relief valves. The analyst

assumed that the potential for high winds to induce a stuck-open valve was negligible.

Likewise, the analyst reviewed the sequence cutsets for loss of offsite power initiated

sequences. These sequences involved a reactor coolant pump seal failure resulting

from the loss of power. The analyst determined that high winds would not increase the

likelihood of a reactor coolant pump seal failure. Therefore, the only effect for these

external events would be the increase in initiating event likelihood.

The analyst also assumed that high wind events happen frequently enough that the

impact of these severe weather events are already incorporated into the initiating event

frequencies. Therefore, the total impact of high winds on the increase in core damage

frequency related to the subject performance deficiency was evaluated as part of the

internal initiating events review.

Seismic:

The analyst assumed that the normal engineering factors and resulting rigidity that were

built into the Palo Verde units were sufficient to protect the plant from all but the most

severe of seismic events. Given the location of Palo Verde to known faults, seismic

events with a magnitude greater than the review level earthquake were expected to

occur at a frequency of 3 x 10-5/year. All Seismic Category 1 structures were built to

D-10 Attachment

withstand this review level earthquake, with appropriate engineering margin. Therefore,

the analyst assumed that the likelihood of a seismic event causing an initiator by

affecting Seismic Category 1 equipment was low and that the change in risk associated

with the subject finding would be negligible. This is primarily based on the assumption

that a seismic event large enough to cause a major piping rupture would most likely

result in core damage. As a result, the only affect for seismic events considered by the

analyst was the increase in initiating event likelihood of plant transients and loss of

offsite power.

Additionally, because of the low frequency of seismic events and the low likelihood that

seismic events would cause a loss of mitigating equipment, combined with the relatively

high likelihood of a transient or loss of offsite power, the change in initiating event

likelihood would be very low. The frequency of transients and loss of offsite power

events are several orders of magnitude higher than that of severe seismic events. As a

result, the analyst assumed that the increase in risk associated with the subject

performance deficiency was negligible with respect to seismic events.

In the IPEEE, the licensee used the EPRI seismic margins assessment methodology to

evaluate these events. The licensee concluded that the plant could respond properly to

all seismic events, up to and including the review level earthquake. The EPRI method,

assumes that there is a potential for the review level earthquake to cause a small-break

loss of coolant accident. In reviewing the plant response to this event, the licensee

determined that high-pressure recirculation was a required function for responding to

this event. The analyst assumed that the EPRI evaluation was conservative and that

there was a probability that the reactor coolant system would survive earthquakes larger

than the review level earthquake. Therefore, the analyst assumed that a seismically

induced small-break loss of coolant accident could result at a rate of 3 x 10-5/year. The

impact of this failure is discussed under the quantification section below.

Internal Fire:

The analyst evaluated the potential for internal fires to cause an initiating event that

would affect the change in risk associated with the subject performance deficiency. The

analyst assumed that the probability of an internal fire causing a loss of nuclear cooling

water was extremely low, based on normal system separation. The analyst assumed

that internal fires could not cause a medium or large-break loss of coolant accident.

The analyst also assumed that the probability of an internal fire causing a loss of offsite

power was extremely low, because of equipment separation inside the plant.

The analyst assumed that the probability of an internal fire resulting in a stuck-open

safety-relief valve that was not recoverable, that the relief valve caused a plant transient,

and that operators were unable to take the plant to cold shutdown conditions prior to

recirculation was extremely low. Therefore, the effect of internal fires was considered to

be negligible with respect to the dominant transient sequences. The analyst also

assumed that internal fire events happen frequently enough that the impact of these

events are already incorporated into the initiating event frequency for a transient.

Therefore, most of the impact of internal fires on the increase in core damage frequency

related to plant transients was evaluated as part of the internal initiating events review.

D-11 Attachment

The analyst determined that internal fires could result in a small-break loss of coolant

accident. The postulated scenario includes a control room fire that results in the

evacuation of the main control room. The potential to induce a reactor coolant pump

seal failure can be high in these scenarios. However, recent studies by Combustion

Engineering indicate that these seals would not result in a small-break loss of coolant

accident under these conditions.

The analyst assumed that an internal fire could cause the complete loss of the plant

cooling water system. However, the effect of this event would be no different if it were

caused by an internal fire than it would if it were initiated by equipment related problems.

Therefore, the analyst determined that the only effect of these external events would be

the increase in initiating event likelihood. The analyst determined that the increase in

initiating event frequency was potentially large enough that the effect of the subject

performance deficiency could not be ruled out. This scenario was explored further in the

quantification section below.

Other External Initiators:

The analyst reviewed other external initiators to determine if they had the potential to

cause one of the three effects that would cause an increase in risk related to the subject

performance deficiency. The initiators review included: lightning, sand storms, extreme

heat, and roof ponding. The effects of these initiators were determined, qualitatively, to

either be negligible, or to already be included in the internal events initiating event

frequency.

External Events Quantification:

The analyst used the assumptions made for each external event category and estimated

the maximum increase in core damage frequency for each of the dominant internal

event initiators. The results are documented in Table 3.d. The quantification of each

bounding estimate is described below:

' Small-Break Loss of Coolant Accidents (SLOCA)

As stated above, internal fires have the potential of resulting in a small-break

loss of coolant accident. However, the analyst determined that the only impact

would be an increase in the likelihood of a small-break loss of coolant accident.

Given that the fires reviewed would occur at a frequency lower than the expected

frequency of random breaks, the analyst assumed that the increase in risk would

be bounded by the change in risk associated with the subject performance

deficiency quantified for internal events (9.14 x 10-7).

As stated above the analyst assumed that the only external events that could

result in an SLOCA were internal fires and seismic events.

The analyst used the SPAR model to quantify the conditional core damage

probability for a small-break loss of coolant accident in a beyond-design-basis

D-12 Attachment

earthquake. The result was 2.64 x 10-1. This is dominated by the loss of the

high-pressure recirculation function at a rate of 24% per demand. Therefore, the

assumed upper bound was estimated as follows:

3 x 10-5/year * 2.64 x 10-1 = 7.90 x 10-6 over the exposure period.

Given that the increase resulting from internal fires is statistically independent

from seismic events, the results can be added to determine that total external

events contribution to SLOCAs.

9.14 x 10-7 + 7.9 x 10-6 = 8.81 x 10-6

' Medium-Break Loss of Coolant Accidents (MLOCA)

As stated above, the analyst assumed that the external events would not result

in an MLOCA.

' Large-Break Loss of Coolant Accidents (LLOCA)

As stated above, the analyst assumed that the external events would not result

in an LLOCA.

' Plant Transients

As stated above, many of the external initiators reviewed cause an increase in

the initiating event likelihood for plant transients. Because the frequency of

seismic events, internal floods, external fires, and transportation issues is so low

compared to that of equipment and human error related plant transients, the

impact from these external initiators is considered negligible.

High winds, internal fires, and certain other external events have occurred at

such a high rate throughout the industry that the analyst believes they are well

represented in the published plant transient initiating event frequencies. This

resulted in the effect on risk, related to the subject performance deficiency, being

fully quantified during the internal events analysis.

Therefore, the total effect of external initiators on the change in core damage

frequency from plant transients related to the subject performance deficiency

was determined to be negligible.

' Loss of Offsite Power

As stated above, many of the external initiators reviewed appear to cause an

increase in the initiating event likelihood for a loss of offsite power. Because the

frequency of seismic events, external fires, and transportation issues is so low

compared to equipment and human error related loss of offsite power events, the

impact from these external initiators is considered negligible.

D-13 Attachment

High winds and certain other external events have occurred at such a high rate

throughout the industry that the analyst believes they are well represented in the

published loss of offsite power initiating event frequencies. This resulted in the

effect on risk related to the subject performance deficiency being fully quantified

during the internal events analysis.

Finally, the analyst assumed that internal fires were not likely to increase the

probability of a loss of offsite power significantly because of the normal

separation of plant equipment and because the published initiating events

frequencies would include the contribution from large switchyard fires.

Therefore, the total effect of external initiators on the change in core damage

frequency from loss of offsite power events related to the subject performance

deficiency was determined to be negligible.

' Loss of Plant Cooling Water System

As stated above, the analyst assumed that the effect from the subject

performance deficiency on a loss of plant cooling water initiating event would be

an increase in the initiating event frequency from an internal flood or an internal

fire affecting all system pumps. The increase in risk from internal floods is

assumed to be bounded by the change in core damage frequency from the

equipment related initiator (1.22 x 10-9).

According to the Idaho National Engineering and Environmental Laboratorys

study published in NUREG/CR-5750, Rates of Initiating Events at U. S. Nuclear

Power Plants: 1987-1995, loss of open-loop cooling water systems occur at a

rate of 9.6 x 10-4 events per year. The analyst determined that the probability of

a large oil fire causing a loss of plant cooling water system initiating event was at

least an order of magnitude lower because the fire had to initiate, cause spilling

of oil, and spread rapidly enough to damage system equipment, but not so

rapidly that it would extinguish before causing a loss of the entire system.

Therefore, the analyst estimated that the increase in core damage frequency

from an internal fire would be no greater than the internally initiated change in

risk. However, because of the uncertainties in the data and to ensure that the

risk is appropriately bounded, the analyst assumed that the change in core

damage frequency could be as much as 10 times higher than for internally

initiated events alone (1.22 x 10-8).

Given that the increase resulting from internal fires is statistically independent

from that of internal floods, the results can be added to determine the total

external events contribution to SLOCAs.

1.22 x 10-9 + 1.22 x 10-8 = 1.34 x 10-8

D-14 Attachment

' Loss of Nuclear Cooling Water System

For loss of nuclear cooling water events, the internal events contribution to the

change in core damage frequency was evaluated to be 1.22 x 10-9/year. As

stated above, the analyst assumed that internal floods had the potential to

increase the initiating event frequency by no more than that of internal events

because the frequency of large piping failures tends to be smaller than the

published failure rate of open loop cooling water systems. Therefore, the analyst

assigned the change in core damage frequency from external events causing a

loss of nuclear cooling water initiator to be equal to that of the internal events

change in risk (1.22 x 10-9 /year ). This was considered a bounding value.

Table 3.d: External Events CDF Estimation

Internal Initiator Internal CDF External CDF Cumulative

External CDF

SLOCA 9.14 x 10-7 8.8 x 10-6 8.8 x 10-6

MLOCA 1.06 x 10-5 -0- 8.8 x 10-6

LLOCA 1.32 x 10-6 -0- 8.8 x 10-6

Transients 2.87 x 10-6 -0- 8.8 x 10-6

LOOP 1.02 x 10-7 -0- 8.8 x 10-6

LOPC 4.95 x 10-10 1.34 x 10-8 8.8 x 10-6

LONCW 1.22 x 10-9 1.22 x 10-9 8.8 x 10-6

NOTE: All CDF values are unitless probabilities of the change in risk over the exposure

time assumed (one year).

Risk Contribution from Large Early Release Frequency

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, step 2.6,

"Screening for the Potential Risk Contribution Due to LERF," the analyst assessed the

impact of large early release frequency because the Phase 2 SDP result provided a risk

significance estimation of 7.

In PWR large, dry containments, only a subset of core damage accidents can lead to

large, unmitigated releases from containment that have the potential to cause prompt

fatalities prior to population evacuation. Core damage sequences of particular concern

for this type of containments are intersystem loss of coolant accidents and steam

generator tube ruptures. By their nature, steam generator tube ruptures and other

containment bypass loss of coolant accidents do not provide water to the containment

sump. Therefore, the subject finding does not impact those accident initiators.

D-15 Attachment

In accordance with Manual Chapter 0609, Appendix H, "Containment Integrity SDP," the

analyst determined that this was a Type A finding, because the finding affected the plant

core damage frequency. The analyst evaluated both the risk-informed notebook results

and the SPAR results and determined that there were no LERF potential sequences as

described in Appendix H, Table 5.1, Phase 1 Screening - Type A Findings at Full

Power. Therefore, the analyst determined that the subject performance deficiency was

not significant to the large-early release frequency.

Licensees Risk Assessment

The analyst discussed the results of this analysis with the Palo Verde PRA Supervisor.

The licensees initial result was consistent with this analysis, given that the analysts

assumptions were correct. However, on December 23, 2004, the licensee provided the

analyst with a draft analysis that indicated substantially different results. The new

analysis took into consideration the results of a test program established and conducted

by the licensee to better understand the impact of having air in the suction lines. The

licensee calculated a CDF of 3 x 10-6 over the one year exposure period.

The analyst noted the following key differences in assumptions used by the licensee:

19. The analyst assumed that the high-head safety injection pumps would fail

following any recirculation actuation signal. The licensee stated that test results

show the pumps would have continued to operate under all scenarios with the

exception of SLOCAs that involve other than stuck-open relief valves.

20. The analyst assumed that the containment spray pumps would also fail following

any recirculation actuation signal. The licensee stated that test results show

these pumps would have continued to operate under all accident conditions.

21. The analyst assumed that following air binding, the high head pumps might be

available and capable of being recovered by operator action. The licensee

assumed that, once failed, the pumps would not be recoverable.

The analyst noted that these assumptions are critical to the final result of the analysis.

The licensee submitted the documentation of tests and analyses supporting these

assumptions on December 27, 2004. The NRC staff will review the data and discuss

these critical assumptions in more detail with the licensee prior to making a final

significance determination related to the subject finding.

Sensitivity

The analyst reviewed the evaluation results and determined that the total calculated risk

related to the performance deficiency was dominated by the high pressure recirculation

function. As such, the most critical assumptions were that both high pressure pumps

failed and the recovery applied. The analyst used the SPAR model to modify these

assumptions to determine the effect on the final result. Table 3.e provides the results:

D-16 Attachment

Table 3.e: Internal Events Sensitivity to Assumptions

Assumption Change Original CDF Revised CDF

2 HPSI Pumps Fail 1 HPSI Pump Fails 1.6 x 10-5 2.6 x 10-6

HPSI Nonrecovery is 24% 2.4% (Nominal Time)2 1.6 x 10-5 2.9 x 10-6

HPSI Nonrecovery is 24% HPSI Pumps are Not 1.6 x 10-5 6.1 x 10-5

Recoverable1

All Pumps are Recoverable HPSI and CS Pumps are 1.6 x 10-5 8.2 x 10-5

Not Recoverable1

CS Nonrecovery is 2.4% CS Pumps are Not 1.6 x 10-5 8.2 x 10-5

Recoverable1

CS Nonrecovery is 2.4% CS Pumps are Available at 1.6 x 10-5 1.2 x 10-5

Their Nominal Rate2

NOTES:

1 - Assumes pumps are damaged beyond use

2 - Assumes pumps are available for recovery at the stated rate

D-17 Attachment