ML081270639: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(StriderTol Bot change)
 
Line 18: Line 18:


=Text=
=Text=
{{#Wiki_filter:UNITED STATES
{{#Wiki_filter:May 6, 2008  
                                NUC LE AR RE G UL AT O RY C O M M I S S I O N
EA 08-124  
                                                    R E GI ON I V
Stewart B. Minahan  
                                        612 EAST LAMAR BLVD , SU I TE 400
Vice President - Nuclear and CNO  
                                        AR LI N GTON , TEXAS 76011-4125
Nebraska Public Power District  
                                              May 6, 2008
PO Box 98  
EA 08-124
Brownville NE 68321  
Stewart B. Minahan
Vice President - Nuclear and CNO
SUBJECT:  
Nebraska Public Power District
COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION  
PO Box 98
REPORT 05000298/2008002  
Brownville NE 68321
Dear Mr. Minahan:  
SUBJECT:         COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION
On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated  
                REPORT 05000298/2008002
inspection at your Cooper Nuclear Station. The enclosed report documents the inspection  
Dear Mr. Minahan:
results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant  
On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated
Operations, and other members of your staff.  
inspection at your Cooper Nuclear Station. The enclosed report documents the inspection
The inspection examined activities conducted under your license as they relate to safety and  
results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant
compliance with the Commissions rules and regulations and with the conditions of your license.
Operations, and other members of your staff.
The inspectors reviewed selected procedures and records, observed activities, and interviewed  
The inspection examined activities conducted under your license as they relate to safety and
personnel.  
compliance with the Commissions rules and regulations and with the conditions of your license.
As described in Section 1R19 of this report, the NRC concluded that the failure to establish  
The inspectors reviewed selected procedures and records, observed activities, and interviewed
adequate procedural controls for the maintenance of electrical connections on diesel generators  
personnel.
led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety  
As described in Section 1R19 of this report, the NRC concluded that the failure to establish
significance of this finding was assessed on the basis of the best available information, including  
adequate procedural controls for the maintenance of electrical connections on diesel generators
influential assumptions, using the applicable Significance Determination Process and was  
led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety
preliminarily determined to be a White (low to moderate safety significance) finding.
significance of this finding was assessed on the basis of the best available information, including
Attachment 2 of this report provides a detailed description of the preliminary risk assessment.
influential assumptions, using the applicable Significance Determination Process and was
In accordance with NRC Inspection Manual Chapter 0609, Significance Determination  
preliminarily determined to be a White (low to moderate safety significance) finding.
Process, we intend to complete our evaluation using the best available information and issue  
Attachment 2 of this report provides a detailed description of the preliminary risk assessment.
our final determination of safety significance within 90 days of this letter.  
In accordance with NRC Inspection Manual Chapter 0609, Significance Determination
Process, we intend to complete our evaluation using the best available information and issue
This finding does not represent an immediate safety concern because of the corrective actions  
our final determination of safety significance within 90 days of this letter.
you have taken. These actions included applying thread locking compound to the amphenol  
This finding does not represent an immediate safety concern because of the corrective actions
connections on both diesel generators.  
you have taken. These actions included applying thread locking compound to the amphenol
connections on both diesel generators.
Also, this finding constitutes an apparent violation of NRC requirements and is being
Also, this finding constitutes an apparent violation of NRC requirements and is being
considered for escalated enforcement action in accordance with the NRC Enforcement
considered for escalated enforcement action in accordance with the NRC Enforcement
Policy. The current Enforcement Policy is included on the NRCs Web site at  
Policy. The current Enforcement Policy is included on the NRCs Web site at
http://www.nrc.gov/reading-rm/adams.html. This significance determination process  
http://www.nrc.gov/reading-rm/adams.html. This significance determination process
encourages an open dialog between the staff and the licensee, however the dialogue should not  
encourages an open dialog between the staff and the licensee, however the dialogue should not
impact the timeliness of the staffs final determination.
impact the timeliness of the staffs final determination.
UNITED STATES
NUCLEAR REGULATORY COMMISSION
R E GI ON  I V
612 EAST LAMAR BLVD, SUITE 400
ARLINGTON, TEXAS 76011-4125


Nebraska Public Power District                   -2-
Nebraska Public Power District  
Before we make a final decision on this matter, we are providing you an opportunity (1) to
- 2 -  
present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive
at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the
finding to the NRC in writing. If you request a Regulatory Conference, it should be held within
30 days of the receipt of this letter and we encourage you to submit documentation at least one
week prior to the conference in an effort to make the conference more efficient and effective. If
Before we make a final decision on this matter, we are providing you an opportunity (1) to  
a Regulatory Conference is held, it will be open for public observation. If you decide to submit
present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive  
only a written response, such submittal should be sent to the NRC within 30 days of the receipt
at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the  
of this letter. If you decline to request a regulatory conference or submit a written response,
finding to the NRC in writing. If you request a Regulatory Conference, it should be held within  
your ability to appeal the final SDP determination can be affected, in that by not doing either you
30 days of the receipt of this letter and we encourage you to submit documentation at least one  
fail to meet the appeal requirements stated in the prerequisite and limitation sections of
week prior to the conference in an effort to make the conference more efficient and effective. If  
Attachment 2 of IMC 0609.
a Regulatory Conference is held, it will be open for public observation. If you decide to submit  
Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this
only a written response, such submittal should be sent to the NRC within 30 days of the receipt  
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
of this letter. If you decline to request a regulatory conference or submit a written response,  
continue with our significance determination and enforcement decision and you will be advised
your ability to appeal the final SDP determination can be affected, in that by not doing either you  
by separate correspondence of the results of our deliberation on this matter.
fail to meet the appeal requirements stated in the prerequisite and limitation sections of  
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
Attachment 2 of IMC 0609.  
issued for the inspection finding at this time. In addition, please be advised that the number and
characterization of the apparent violation described in the enclosed inspection report may
Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this  
change as a result of further NRC review.
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will  
The report also documents one finding which was evaluated under the risk SDP as having very
continue with our significance determination and enforcement decision and you will be advised  
low safety significance (Green). The finding was determined to involve a violation of NRC
by separate correspondence of the results of our deliberation on this matter.  
requirements. However, because of very low safety significance, and because the issue was
entered into your corrective action program, the NRC is treating the issue as a noncited violation
Since the NRC has not made a final determination in this matter, no Notice of Violation is being  
in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject
issued for the inspection finding at this time. In addition, please be advised that the number and  
or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of
characterization of the apparent violation described in the enclosed inspection report may  
this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory
change as a result of further NRC review.  
Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the
Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza
The report also documents one finding which was evaluated under the risk SDP as having very  
Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.
low safety significance (Green). The finding was determined to involve a violation of NRC  
Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector
requirements. However, because of very low safety significance, and because the issue was  
Office at the Cooper Nuclear Station.
entered into your corrective action program, the NRC is treating the issue as a noncited violation  
in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject  
or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of  
this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory  
Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the  
Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza  
Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.  
Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector  
Office at the Cooper Nuclear Station.  


Nebraska Public Power District                 -3-
Nebraska Public Power District  
In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter
- 3 -  
and its enclosure will be made available electronically for public inspection in the NRC
Public Document Room or from the Publicly Available Records (PARS) component of
NRCs document system (ADAMS), accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter  
                                            Sincerely,
and its enclosure will be made available electronically for public inspection in the NRC  
                                            /RA/
Public Document Room or from the Publicly Available Records (PARS) component of  
                                            Dwight D. Chamberlain, Director
NRCs document system (ADAMS), accessible from the NRC Web site at  
                                            Division of Reactor Projects
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).  
Docket No:     50-298
Sincerely,  
License No:   DPR-46
Enclosure:
/RA/  
NRC Inspection Report 05000298/2008002
w/Attachments:
Dwight D. Chamberlain, Director  
Attachment 1: Supplemental Information
Division of Reactor Projects  
Attachment 2: Preliminary Risk Assessment
Docket No:  
  cc w/enclosure:
50-298  
                                                                  John C. McClure, Vice President
License No:  
   Gene Mace
DPR-46  
                                                                    and General Counsel
Enclosure:  
  Nuclear Asset Manager
NRC Inspection Report 05000298/2008002  
                                                                  Nebraska Public Power District
w/Attachments:  
  Nebraska Public Power District
Attachment 1: Supplemental Information  
                                                                  P.O. Box 499
Attachment 2: Preliminary Risk Assessment  
  P.O. Box 98
cc w/enclosure:  
                                                                  Columbus, NE 68602-0499
Gene Mace
  Brownville, NE 68321
Nuclear Asset Manager
  David Van Der Kamp                                              Michael J. Linder, Director
Nebraska Public Power District
  Licensing Manager                                              Nebraska Department of
P.O. Box 98
   Nebraska Public Power District                                    Environmental Quality
Brownville, NE  68321
  P.O. Box 98                                                    P.O. Box 98922
John C. McClure, Vice President  
  Brownville, NE 68321                                            Lincoln, NE 68509-8922
   and General Counsel  
                                                                  Julia Schmitt, Manager
Nebraska Public Power District  
                                                                  Radiation Control Program
P.O. Box 499  
  Chairman
Columbus, NE  68602-0499
                                                                  Nebraska Health & Human Services
David Van Der Kamp
  Nemaha County Board of Commissioners
Licensing Manager
                                                                  Dept. of Regulation & Licensing
Nebraska Public Power District
  Nemaha County Courthouse
P.O. Box 98  
                                                                  Division of Public Health Assurance
Brownville, NE 68321  
  1824 N Street
Michael J. Linder, Director  
                                                                  301 Centennial Mall, South
Nebraska Department of
  Auburn, NE 68305
   Environmental Quality  
                                                                  P.O. Box 95007
P.O. Box 98922  
                                                                  Lincoln, NE 68509-5007
Lincoln, NE 68509-8922  
Chairman
Nemaha County Board of Commissioners
Nemaha County Courthouse
1824 N Street
Auburn, NE  68305
Julia Schmitt, Manager  
Radiation Control Program  
Nebraska Health & Human Services  
Dept. of Regulation & Licensing  
Division of Public Health Assurance  
301 Centennial Mall, South  
P.O. Box 95007  
Lincoln, NE 68509-5007  


Nebraska Public Power District           -4-
Nebraska Public Power District  
  H. Floyd Gilzow
- 4 -  
                                              Director, Missouri State Emergency
   
Deputy Director for Policy
                                                Management Agency
Missouri Department of Natural Resources
H. Floyd Gilzow  
                                              P.O. Box 116
Deputy Director for Policy  
P. O. Box 176
Missouri Department of Natural Resources  
                                              Jefferson City, MO 65102-0116
P. O. Box 176  
  Jefferson City, MO 65102-0176
Jefferson City, MO 65102-0176
Chief, Radiation and Asbestos               Melanie Rasmussen, State Liaison Officer/
Director, Missouri State Emergency  
   Control Section                              Radiation Control Program Director
  Management Agency
Kansas Department of Health                  Bureau of Radiological Health
P.O. Box 116
  and Environment                            Iowa Department of Public Health
Jefferson City, MO 65102-0116
Bureau of Air and Radiation                  Lucas State Office Building, 5th Floor
Chief, Radiation and Asbestos  
1000 SW Jackson, Suite 310                  321 East 12th Street
  Control Section
Topeka, KS 66612-1366                        Des Moines, IA 50319
Kansas Department of Health
John F. McCann, Director, Licensing         Keith G. Henke, Planner
  and Environment
Entergy Nuclear Northeast                    Division of Community and Public Health
Bureau of Air and Radiation
Entergy Nuclear Operations, Inc.            Office of Emergency Coordination
1000 SW Jackson, Suite 310
440 Hamilton Avenue                          930 Wildwood, P.O. Box 570
Topeka, KS  66612-1366
White Plains, NY 10601-1813                  Jefferson City, MO 65102
Melanie Rasmussen, State Liaison Officer/  
                                              Ronald L. McCabe, Chief
   Radiation Control Program Director  
Paul V. Fleming, Director of Nuclear         Technological Hazards Branch
Bureau of Radiological Health  
  Safety Assurance                           National Preparedness Division
Iowa Department of Public Health  
Nebraska Public Power District               DHS/FEMA
Lucas State Office Building, 5th Floor  
P.O. Box 98                                 9221 Ward Parkway
321 East 12th Street  
Brownville, NE 68321                         Suite 300
Des Moines, IA 50319  
                                              Kansas City, MO 64114-3372
John F. McCann, Director, Licensing  
Entergy Nuclear Northeast
Entergy Nuclear Operations, Inc.
440 Hamilton Avenue
White Plains, NY  10601-1813
Keith G. Henke, Planner  
Division of Community and Public Health  
Office of Emergency Coordination  
930 Wildwood, P.O. Box 570  
Jefferson City, MO 65102  
Paul V. Fleming, Director of Nuclear  
Safety Assurance  
Nebraska Public Power District  
P.O. Box 98  
Brownville, NE 68321  
Ronald L. McCabe, Chief
Technological Hazards Branch
National Preparedness Division
DHS/FEMA
9221 Ward Parkway
Suite 300  
Kansas City, MO 64114-3372  


Nebraska Public Power District                 -5-
Nebraska Public Power District  
Electronic distribution by RIV:
- 5 -  
Regional Administrator (Elmo.Collins@nrc.gov)
DRP Director (Dwight.Chamberlain@nrc.gov)
DRS Director (Roy.Caniano@nrc.gov)
DRS Deputy Director (Troy.Pruett@nrc.gov)
Electronic distribution by RIV:  
Senior Resident Inspector (Nick.Taylor@nrc.gov)
Regional Administrator (Elmo.Collins@nrc.gov)  
Branch Chief, DRP/C (Rick.Deese@nrc.gov)
DRP Director (Dwight.Chamberlain@nrc.gov)  
Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)
DRS Director (Roy.Caniano@nrc.gov)  
Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)
DRS Deputy Director (Troy.Pruett@nrc.gov)  
RITS Coordinator (Marisa.Herrera@nrc.gov)
Senior Resident Inspector (Nick.Taylor@nrc.gov)  
Only inspection reports to the following:
Branch Chief, DRP/C (Rick.Deese@nrc.gov)  
DRS STA (Dale.Powers@nrc.gov)
Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)  
J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)
Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)  
P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)
RITS Coordinator (Marisa.Herrera@nrc.gov)  
ROPreports
CNS Site Secretary (Sue.Farmer@nrc.gov)
Only inspection reports to the following:  
SUNSI Review Completed: WCW               ADAMS: ; Yes No       Initials: WCW
DRS STA (Dale.Powers@nrc.gov)  
; Publicly Available       Non-Publicly Available  Sensitive   ; Non-Sensitive
J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)  
R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc                                 ML081270639
P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)  
RIV:SRI:DRP/C RI:DRP/C             SPE:DRP/C DRS:SRA           C:DRS/OB         C:DRS/EB2
ROPreports  
NHTaylor           MLChambers WCWalker           MFRunyan       RELantz         LJSmith
CNS Site Secretary (Sue.Farmer@nrc.gov)  
E-Walker           /RA/ E-mailed /RA/           /RA/           /RA/             /RA/
4/24/08           4/23/08         4/24 /08     4/24/08       4/24/08         4/23/08
C:DRS/EB1         C:DRS/PSB       C:DRP/C     ACES:SES D:DRP
RLBywater         MPShannon RWDeese             GMVasquez DDChamberlain
/RA/               /RA/                         /RA/           /RA/
4/22/08           4/22/08         4/ /08       4/24/08       5/02/08
OFFICIAL RECORD COPY                   T=Telephone       E=Email             F=Fax
SUNSI Review Completed:     WCW       ADAMS: ; Yes   No     Initials:     WCW  
; Publicly Available  
Non-Publicly Available  Sensitive  
; Non-Sensitive  
R:\\_REACTORS\\_CNS\\2008\\CN2008-002RP-NHT.doc                                 ML081270639  
RIV:SRI:DRP/C RI:DRP/C  
SPE:DRP/C  
DRS:SRA  
C:DRS/OB  
C:DRS/EB2  
NHTaylor  
MLChambers WCWalker  
MFRunyan  
RELantz  
LJSmith  
E-Walker  
/RA/ E-mailed /RA/  
/RA/  
/RA/  
/RA/  
4/24/08  
4/23/08  
4/24 /08  
4/24/08  
4/24/08  
4/23/08  
C:DRS/EB1  
C:DRS/PSB  
C:DRP/C  
ACES:SES  
D:DRP  
RLBywater  
MPShannon  
RWDeese  
GMVasquez
DDChamberlain
/RA/  
/RA/  
/RA/  
/RA/  
4/22/08  
4/22/08  
4/   /08  
4/24/08  
5/02/08  
OFFICIAL RECORD COPY             T=Telephone             E=Email               F=Fax


              U. S. NUCLEAR REGULATORY COMMISSION
                                REGION IV
Docket No:   05000298
License No: PR-46
- 1 -
Report No:   5000298/2008002
Enclosure
Licensee:   Nebraska Public Power District
Facility:   Cooper Nuclear Station
U. S. NUCLEAR REGULATORY COMMISSION  
Location:   PO Box 98, Brownville, NE 68321
REGION IV  
Dates:       January 1 through March 22, 2008
Docket No:  
Inspectors:  N. Taylor, Senior Resident Inspector
05000298  
            M. Chambers, Resident Inspector
License No:  
            P. Elkmann, Emergency Preparedness Inspector
PR-46  
            M. Runyan, Senior Reactor Analyst
Report No:  
Approved by: D. Chamberlain, Director
5000298/2008002  
            Division of Reactor Projects
Licensee:  
                                    -1-                  Enclosure
Nebraska Public Power District  
Facility:  
Cooper Nuclear Station  
Location:  
PO Box 98, Brownville, NE 68321  
Dates:  
January 1 through March 22, 2008  
Inspectors:  
   
N. Taylor, Senior Resident Inspector  
M. Chambers, Resident Inspector  
P. Elkmann, Emergency Preparedness Inspector  
M. Runyan, Senior Reactor Analyst  
Approved by:  
D. Chamberlain, Director  
Division of Reactor Projects  


                                        SUMMARY OF FINDINGS
IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications
and Postmaintenance Testing.
This report covers a three-month period of inspection by resident inspectors and announced
- 2 -
baseline inspections by regional inspectors. The significance of most findings is indicated by
Enclosure
their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance
SUMMARY OF FINDINGS  
Determination Process. Findings for which the Significance Determination Process does not
apply may be Green or be assigned a severity level after NRC management review. The NRCs
program for overseeing the safe operation of commercial nuclear power reactors is described in
IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications  
NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.
and Postmaintenance Testing.  
A.     NRC-Identified and Self-Revealing Findings
This report covers a three-month period of inspection by resident inspectors and announced  
        Cornerstone: Mitigating Systems
baseline inspections by regional inspectors. The significance of most findings is indicated by  
        *       Green. The inspectors identified a Green noncited violation of Technical
their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance  
                Specification 5.4.1.a regarding the licensees failure to follow the requirements of
Determination Process. Findings for which the Significance Determination Process does not  
                Maintenance Procedure 7.0.7, Scaffolding Construction and Control.
apply may be Green or be assigned a severity level after NRC management review. The NRCs  
                Specifically, licensee personnel failed to inspect all existing scaffolds and failed
program for overseeing the safe operation of commercial nuclear power reactors is described in  
                to identify multiple scaffolding interactions with safety-related equipment during a
NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.  
                required annual scaffold inspection on January 21, 2008. This issue was
A.  
                entered Into the licensees corrective action program as Condition
NRC-Identified and Self-Revealing Findings  
                Report CR-CNS-2008-01576.
Cornerstone: Mitigating Systems  
                The finding is more than minor because if left uncorrected the failure to perform
*  
                annual scaffold inspections could become a more significant safety concern.
Green. The inspectors identified a Green noncited violation of Technical  
                Specifically, annual inspections failed to inspect all existing scaffolds and failed to
Specification 5.4.1.a regarding the licensees failure to follow the requirements of  
                identify multiple scaffolding interactions with safety-related equipment. Using the
Maintenance Procedure 7.0.7, Scaffolding Construction and Control.
                Manual Chapter 0609, Significance Determination Process, Phase 1
Specifically, licensee personnel failed to inspect all existing scaffolds and failed  
                Worksheet, the finding is determined to have a very low safety significance
to identify multiple scaffolding interactions with safety-related equipment during a  
                because it did not result in the loss of function of a Technical Specification
required annual scaffold inspection on January 21, 2008. This issue was  
                required system for greater than its allowed outage time. The cause of this
entered Into the licensees corrective action program as Condition  
                finding is related to the human performance crosscutting component of work
Report CR-CNS-2008-01576.  
                practices because maintenance personnel did not follow the requirements of
                Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).
        *       TBD. Two examples of a self-revealing apparent violation of Technical
The finding is more than minor because if left uncorrected the failure to perform  
                Specification 5.4.1.a were identified regarding the licensees failure to establish
annual scaffold inspections could become a more significant safety concern.
                procedural controls for maintenance of electrical connections on essential
Specifically, annual inspections failed to inspect all existing scaffolds and failed to  
                equipment. In the first example, the licensee failed to include amphenol
identify multiple scaffolding interactions with safety-related equipment. Using the  
                connections within the scope of existing periodic electrical connection inspections
Manual Chapter 0609, Significance Determination Process, Phase 1  
                to identify loosening connections. In the second example, the licensee failed to
Worksheet, the finding is determined to have a very low safety significance  
                incorporate internal operating experience into work control procedures to ensure
because it did not result in the loss of function of a Technical Specification  
                that diesel generator-mounted amphenol connections were solidly attached
required system for greater than its allowed outage time. The cause of this  
                following maintenance. These failures to establish adequate procedural controls
finding is related to the human performance crosscutting component of work  
                led to the trip of Diesel Generator 2 during testing on January 15, 2008. This
practices because maintenance personnel did not follow the requirements of  
                issue was entered into the licensees corrective action program as Condition
Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).  
                Report CR-CNS 2008-00304.
                                                  -2-                                      Enclosure
*  
TBD. Two examples of a self-revealing apparent violation of Technical  
Specification 5.4.1.a were identified regarding the licensees failure to establish  
procedural controls for maintenance of electrical connections on essential  
equipment. In the first example, the licensee failed to include amphenol  
connections within the scope of existing periodic electrical connection inspections  
to identify loosening connections. In the second example, the licensee failed to  
incorporate internal operating experience into work control procedures to ensure  
that diesel generator-mounted amphenol connections were solidly attached  
following maintenance. These failures to establish adequate procedural controls  
led to the trip of Diesel Generator 2 during testing on January 15, 2008. This  
issue was entered into the licensees corrective action program as Condition  
Report CR-CNS 2008-00304.  


          The finding affected the mitigating systems cornerstone and is more than minor
          because it is associated with the cornerstone attribute of equipment performance
          and affects the associated cornerstone objective to ensure the availability,
          reliability, and capability of systems that respond to initiating events to prevent
- 3 -
          undesirable consequences. The Phase 1 worksheets in Inspection Manual
Enclosure
          Chapter 0609, "Significance Determination Process," were used to conclude that
          a Phase 2 analysis was required because the finding represents an actual loss of
          safety function of a single train for greater than its Technical Specification
The finding affected the mitigating systems cornerstone and is more than minor  
          allowed outage time (7 days). A Phase 2 risk analysis was conducted using the
because it is associated with the cornerstone attribute of equipment performance  
          guidance of Manual Chapter 0609, Appendix A, Determining the Significance of
and affects the associated cornerstone objective to ensure the availability,  
          Reactor Inspection Findings for At-Power Situations. Entering the site-specific
reliability, and capability of systems that respond to initiating events to prevent  
          pre-solved table with an assumed exposure time of greater than 30 days yielded
undesirable consequences. The Phase 1 worksheets in Inspection Manual  
          a result of red, or very high significance. A Phase 3 analysis conducted by a risk
Chapter 0609, "Significance Determination Process," were used to conclude that  
          analyst preliminarily determined the finding to be of white, or low to moderate
a Phase 2 analysis was required because the finding represents an actual loss of  
          significance. The cause of the finding is related to the corrective action
safety function of a single train for greater than its Technical Specification  
          component of the crosscutting area of problem identification and resolution in
allowed outage time (7 days). A Phase 2 risk analysis was conducted using the  
          that the licensee failed to take appropriate corrective actions for a 2007 NRC
guidance of Manual Chapter 0609, Appendix A, Determining the Significance of  
          inspection finding which identified inadequate maintenance procedures for
Reactor Inspection Findings for At-Power Situations. Entering the site-specific  
          checking the tightness of diesel generator electrical connections (P.1(d))
pre-solved table with an assumed exposure time of greater than 30 days yielded  
          (Section 71111.19).
a result of red, or very high significance. A Phase 3 analysis conducted by a risk  
B. Licensee-Identified Violations
analyst preliminarily determined the finding to be of white, or low to moderate  
  No violations of significance were identified.
significance. The cause of the finding is related to the corrective action  
                                            -3-                                      Enclosure
component of the crosscutting area of problem identification and resolution in  
that the licensee failed to take appropriate corrective actions for a 2007 NRC  
inspection finding which identified inadequate maintenance procedures for  
checking the tightness of diesel generator electrical connections (P.1(d))  
(Section 71111.19).  
B.  
Licensee-Identified Violations  
No violations of significance were identified.  


                                          REPORT DETAILS
Summary of Plant Status
The plant began the inspection period at 100 percent power. On February 19, 2008, the plant
began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from
- 4 -
90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump
Enclosure
motor Generator B. The reactor was returned to full power later in the day, where it remained
REPORT DETAILS  
for the rest of the inspection period.
Summary of Plant Status  
1.       REACTOR SAFETY
The plant began the inspection period at 100 percent power. On February 19, 2008, the plant  
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency
began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from  
                  Preparedness
90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump  
1R04 Equipment Alignment (71111.04)
motor Generator B. The reactor was returned to full power later in the day, where it remained  
  .1     Quarterly Partial System Walkdowns
for the rest of the inspection period.  
    a.   Inspection Scope
        The inspectors selected these systems based on their risk significance relative to the
1.  
        reactor safety cornerstones at the time they were inspected. The inspectors attempted
REACTOR SAFETY  
        to identify any discrepancies that could impact the function of the system, and, therefore,
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency  
        potentially increase risk. The inspectors reviewed applicable operating procedures,
Preparedness  
        system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical
        Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),
1R04 Equipment Alignment (71111.04)  
        condition reports (CR), and the impact of ongoing work activities on redundant trains of
.1  
        equipment in order to identify conditions that could have rendered the systems incapable
Quarterly Partial System Walkdowns  
        of performing their intended functions. The inspectors also walked down accessible
a.  
        portions of the systems to verify system components and support equipment were
Inspection Scope  
        aligned correctly and operable. The inspectors examined the material condition of the
The inspectors selected these systems based on their risk significance relative to the  
        components and observed operating parameters of equipment to verify that there were
reactor safety cornerstones at the time they were inspected. The inspectors attempted  
        no obvious deficiencies. The inspectors also verified that the licensee had properly
to identify any discrepancies that could impact the function of the system, and, therefore,  
        identified and resolved equipment alignment problems that could cause initiating events
potentially increase risk. The inspectors reviewed applicable operating procedures,  
        or impact the capability of mitigating systems or barriers and entered them into the
system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical  
        corrective action program (CAP) with the appropriate significance characterization.
Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),  
        Documents reviewed are listed in the attachment.
condition reports (CR), and the impact of ongoing work activities on redundant trains of  
        The inspectors performed partial system walkdowns of the following risk-significant
equipment in order to identify conditions that could have rendered the systems incapable  
        systems:
of performing their intended functions. The inspectors also walked down accessible  
        *         January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B
portions of the systems to verify system components and support equipment were  
                  during REC HX A limiting condition for operation (LCO)
aligned correctly and operable. The inspectors examined the material condition of the  
        *         February 28, 2008, Service Water Train B during Diesel Generator (DG) LCO
components and observed operating parameters of equipment to verify that there were  
        *         March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO
no obvious deficiencies. The inspectors also verified that the licensee had properly  
        The inspectors completed three samples.
identified and resolved equipment alignment problems that could cause initiating events  
                                                  -4-                                    Enclosure
or impact the capability of mitigating systems or barriers and entered them into the  
corrective action program (CAP) with the appropriate significance characterization.
Documents reviewed are listed in the attachment.  
The inspectors performed partial system walkdowns of the following risk-significant  
systems:  
*  
January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B  
during REC HX A limiting condition for operation (LCO)  
*  
February 28, 2008, Service Water Train B during Diesel Generator (DG) LCO  
*  
March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO  
The inspectors completed three samples.  


  b.   Findings
        No findings of significance were identified.
.2     Semi-Annual Complete System Walkdown
  a.   Inspection Scope
- 5 -
        On March 11, 2008 the inspectors performed a complete system alignment inspection of
Enclosure
        the DG 1 to verify the functional capability of the system. This system was selected
b.  
        because it was considered both safety-significant and risk-significant in the licensees
Findings  
        probabilistic risk assessment. The inspectors walked down the system to review
No findings of significance were identified.  
        mechanical and electrical equipment line ups, electrical power availability, system
.2  
        pressure and temperature indications, as appropriate, component labeling, component
Semi-Annual Complete System Walkdown  
        lubrication, component and equipment cooling, hangers and supports, operability of
a.  
        support systems, and to ensure that ancillary equipment or debris did not interfere with
Inspection Scope  
        equipment operation. A review of a sample of past and outstanding WOs was
On March 11, 2008 the inspectors performed a complete system alignment inspection of  
        performed to determine whether any deficiencies significantly affected the system
the DG 1 to verify the functional capability of the system. This system was selected  
        function. In addition, the inspectors reviewed the CAP database to ensure that system
because it was considered both safety-significant and risk-significant in the licensees  
        equipment alignment problems were being identified and appropriately resolved.
probabilistic risk assessment. The inspectors walked down the system to review  
      *       March 11, 2008, DG 1 during DG 2 LCO
mechanical and electrical equipment line ups, electrical power availability, system  
      Documents reviewed by the inspectors included:
pressure and temperature indications, as appropriate, component labeling, component  
        *     CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel
lubrication, component and equipment cooling, hangers and supports, operability of  
              Generator), Revision 70
support systems, and to ensure that ancillary equipment or debris did not interfere with  
        These activities constituted one complete system walkdown sample as defined by
equipment operation. A review of a sample of past and outstanding WOs was  
        Inspection Procedure 71111.04-05.
performed to determine whether any deficiencies significantly affected the system  
  b.   Findings
function. In addition, the inspectors reviewed the CAP database to ensure that system  
        No findings of significance were identified.
equipment alignment problems were being identified and appropriately resolved.  
1R05 Fire Protection (71111.05AQ)
*  
    a. Inspection Scope
March 11, 2008, DG 1 during DG 2 LCO
        The inspectors conducted fire protection walkdowns which were focused on availability,
Documents reviewed by the inspectors included:  
        accessibility, and the condition of firefighting equipment.
*  
        The inspectors reviewed areas to assess if the licensee had implemented a fire
CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel  
        protection program that adequately controlled combustibles and ignition sources within
Generator), Revision 70  
        the plant, effectively maintained fire detection and suppression capability, maintained
These activities constituted one complete system walkdown sample as defined by  
        passive fire protection features in good material condition, and had implemented
Inspection Procedure 71111.04-05.  
        adequate compensatory measures for out of service, degraded or inoperable fire
b.  
        protection equipment, systems, or features in accordance with the licensees fire plan.
Findings  
        The inspectors selected fire areas based on their overall contribution to internal fire risk
No findings of significance were identified.  
        as documented in the plants Individual Plant Examination of External Events with later
1R05 Fire Protection (71111.05AQ)  
        additional insights, their potential to impact equipment which could initiate or mitigate a
a. Inspection Scope  
                                                  -5-                                    Enclosure
The inspectors conducted fire protection walkdowns which were focused on availability,  
accessibility, and the condition of firefighting equipment.  
The inspectors reviewed areas to assess if the licensee had implemented a fire  
protection program that adequately controlled combustibles and ignition sources within  
the plant, effectively maintained fire detection and suppression capability, maintained  
passive fire protection features in good material condition, and had implemented  
adequate compensatory measures for out of service, degraded or inoperable fire  
protection equipment, systems, or features in accordance with the licensees fire plan.
The inspectors selected fire areas based on their overall contribution to internal fire risk  
as documented in the plants Individual Plant Examination of External Events with later  
additional insights, their potential to impact equipment which could initiate or mitigate a  


      plant transient, or their impact on the plants ability to respond to a security event. Using
      the documents listed in the attachment, the inspectors verified that fire hoses and
      extinguishers were in their designated locations and available for immediate use; that
      fire detectors and sprinklers were unobstructed, that transient material loading was
- 6 -
      within the analyzed limits; and fire doors, dampers, and penetration seals appeared to
Enclosure
      be in satisfactory condition. The inspectors also verified that minor issues identified
plant transient, or their impact on the plants ability to respond to a security event. Using  
      during the inspection were entered into the licensees corrective action program.
the documents listed in the attachment, the inspectors verified that fire hoses and  
      *       February 13, 2008, Fire Zone 2C during fuel movement
extinguishers were in their designated locations and available for immediate use; that  
      *       March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO
fire detectors and sprinklers were unobstructed, that transient material loading was  
      *       March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO
within the analyzed limits; and fire doors, dampers, and penetration seals appeared to  
      *       March 15, 2008, Fire Zone 19C Controlled Access Corridor
be in satisfactory condition. The inspectors also verified that minor issues identified  
      Documents reviewed by the inspectors included:
during the inspection were entered into the licensees corrective action program.  
      *       CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated
*  
              February 28, 2003
February 13, 2008, Fire Zone 2C during fuel movement  
      *       CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated
              November 5, 2007
*  
      These activities constituted four quarterly fire protection inspection samples as defined
March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO  
      by Inspection Procedure 71111.05-05.
*  
  b. Findings
March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO  
      No findings of significance were identified.
*  
1R07 Annual Heat Sink Performance (71111.07)
March 15, 2008, Fire Zone 19C Controlled Access Corridor  
  a. Inspection Scope
      The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify
Documents reviewed by the inspectors included:  
      that potential deficiencies did not mask the licensees ability to detect degraded
      performance, to identify any common cause issues that had the potential to increase
*  
      risk, and to ensure that the licensee was adequately addressing problems that could
CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated  
      result in initiating events that would cause an increase in risk. The inspectors reviewed
February 28, 2003  
      the licensees observations as compared against acceptance criteria, the correlation of
      scheduled testing and the frequency of testing, and the impact of instrument
*  
      inaccuracies on test results. Inspectors also verified that test acceptance criteria
CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated  
      considered differences between test conditions, design conditions, and testing
November 5, 2007  
      conditions.
These activities constituted four quarterly fire protection inspection samples as defined  
      *       January 25 and January 21, 2008, A and B REC HX performance tests
by Inspection Procedure 71111.05-05.  
      Documents reviewed are listed in the attachment.
b. Findings  
      This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.
No findings of significance were identified.  
                                              -6-                                        Enclosure
1R07 Annual Heat Sink Performance (71111.07)  
a.  
Inspection Scope  
The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify  
that potential deficiencies did not mask the licensees ability to detect degraded  
performance, to identify any common cause issues that had the potential to increase  
risk, and to ensure that the licensee was adequately addressing problems that could  
result in initiating events that would cause an increase in risk. The inspectors reviewed  
the licensees observations as compared against acceptance criteria, the correlation of  
scheduled testing and the frequency of testing, and the impact of instrument  
inaccuracies on test results. Inspectors also verified that test acceptance criteria  
considered differences between test conditions, design conditions, and testing  
conditions.  
*  
January 25 and January 21, 2008, A and B REC HX performance tests  
Documents reviewed are listed in the attachment.  
This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.  


  b. Findings
    No findings of significance were identified.
1R11 Licensed Operator Requalification Program (71111.11)
    Conformance With Simulator Requirements Specified in 10 CFR 55.46
- 7 -
  a. Inspection Scope
Enclosure
    The inspectors observed testing and training of senior reactor operators and reactor
b.  
    operators to identify deficiencies and discrepancies in the training, to assess operator
Findings  
    performance, and to assess the evaluator's critique. The training scenario involved a
No findings of significance were identified.  
    tornado, station blackout and a loss of shutdown cooling.
1R11 Licensed Operator Requalification Program (71111.11)  
    *       February 28, 2008, Crew E drill
Conformance With Simulator Requirements Specified in 10 CFR 55.46  
    Documents reviewed by the inspectors included:
a.  
    *       Lesson SKL054-01-28, Tornado, Station Blackout, Loss of Shutdown Cooling
Inspection Scope  
    The inspectors completed one sample.
The inspectors observed testing and training of senior reactor operators and reactor  
  b. Findings
operators to identify deficiencies and discrepancies in the training, to assess operator  
    No findings of significance were identified.
performance, and to assess the evaluator's critique. The training scenario involved a  
1R12 Maintenance Effectiveness (71111.12)
tornado, station blackout and a loss of shutdown cooling.  
  a. Inspection Scope
    The inspectors evaluated degraded performance issues involving the risk significant
*  
    systems of events such as where ineffective equipment maintenance has resulted in
February 28, 2008, Crew E drill  
    valid or invalid automatic actuations of engineered safeguards systems and
Documents reviewed by the inspectors included:  
    independently verified the licensee's actions to address system performance or condition
*  
    problems in terms of the following:
Lesson SKL054-01-28, Tornado, Station Blackout, Loss of Shutdown Cooling  
    *       implementing appropriate work practices;
The inspectors completed one sample.  
    *       identifying and addressing common cause failures;
b.  
    *       scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
Findings  
    *       characterizing system reliability issues for performance;
No findings of significance were identified.  
    *       charging unavailability for performance;
1R12 Maintenance Effectiveness (71111.12)  
    *       trending key parameters for condition monitoring;
a.  
    *       ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and
Inspection Scope  
                                              -7-                                      Enclosure
The inspectors evaluated degraded performance issues involving the risk significant  
systems of events such as where ineffective equipment maintenance has resulted in  
valid or invalid automatic actuations of engineered safeguards systems and  
independently verified the licensee's actions to address system performance or condition  
problems in terms of the following:  
*  
implementing appropriate work practices;  
*  
identifying and addressing common cause failures;  
*  
scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;  
*  
characterizing system reliability issues for performance;  
*  
charging unavailability for performance;  
*  
trending key parameters for condition monitoring;  
*  
ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and  


    *       verifying appropriate performance criteria for structures, systems, and
              components (SSCs) functions classified as (a)(2) or appropriate and adequate
              goals and corrective actions for systems classified as (a)(1).
    The inspectors assessed performance issues with respect to the reliability, availability,
- 8 -
    and condition monitoring of the system. In addition, the inspectors verified maintenance
Enclosure
    effectiveness issues were entered into the corrective action program with the appropriate
*  
    significance characterization.
verifying appropriate performance criteria for structures, systems, and  
    *       March 19, 2008, Reactor protection system (RPS) electronic protection
components (SSCs) functions classified as (a)(2) or appropriate and adequate  
              assembly (EPA) breaker failures January 12, 2008
goals and corrective actions for systems classified as (a)(1).  
    *       March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008
The inspectors assessed performance issues with respect to the reliability, availability,  
    Documents reviewed by the inspectors included:
and condition monitoring of the system. In addition, the inspectors verified maintenance  
    *       Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1
effectiveness issues were entered into the corrective action program with the appropriate  
    *       Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC
significance characterization.  
    This inspection constitutes two quarterly maintenance effectiveness samples as defined
*  
    in Inspection Procedure 71111.12-05.
March 19, 2008, Reactor protection system (RPS) electronic protection  
  b. Findings
assembly (EPA) breaker failures January 12, 2008  
    No findings of significance were identified.
1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)
*  
  a. Inspection Scope
March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008  
    The inspectors reviewed the licensee's evaluation and management of plant risk for the
    maintenance and emergent work activities affecting risk-significant and safety-related
Documents reviewed by the inspectors included:  
    equipment listed below to verify that the appropriate risk assessments were performed
*  
    prior to removing equipment for work:
Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1  
    *       March 6, 2008, Inoperability of both DGs on September 11, 2007
*  
    *       March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008
Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC  
    These activities were selected based on their potential risk significance relative to the
    reactor safety cornerstones. As applicable for each activity, the inspectors verified that
This inspection constitutes two quarterly maintenance effectiveness samples as defined  
    risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate
in Inspection Procedure 71111.12-05.  
    and complete. When emergent work was performed, the inspectors verified that the
b.  
    plant risk was promptly reassessed and managed. The inspectors reviewed the scope
Findings  
    of maintenance work, discussed the results of the assessment with the licensee's
No findings of significance were identified.  
    probabilistic risk analyst or shift technical engineer, and verified plant conditions were
1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)  
    consistent with the risk assessment. The inspectors also reviewed TS requirements and
a.  
    walked down portions of redundant safety systems, when applicable, to verify risk
Inspection Scope  
    analysis assumptions were valid and applicable requirements were met. Documents
The inspectors reviewed the licensee's evaluation and management of plant risk for the  
    reviewed are listed in the attachment.
maintenance and emergent work activities affecting risk-significant and safety-related  
    The inspectors completed two samples.
equipment listed below to verify that the appropriate risk assessments were performed  
                                                -8-                                      Enclosure
prior to removing equipment for work:  
*  
March 6, 2008, Inoperability of both DGs on September 11, 2007  
*  
March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008  
These activities were selected based on their potential risk significance relative to the  
reactor safety cornerstones. As applicable for each activity, the inspectors verified that  
risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate  
and complete. When emergent work was performed, the inspectors verified that the  
plant risk was promptly reassessed and managed. The inspectors reviewed the scope  
of maintenance work, discussed the results of the assessment with the licensee's  
probabilistic risk analyst or shift technical engineer, and verified plant conditions were  
consistent with the risk assessment. The inspectors also reviewed TS requirements and  
walked down portions of redundant safety systems, when applicable, to verify risk  
analysis assumptions were valid and applicable requirements were met. Documents  
reviewed are listed in the attachment.
The inspectors completed two samples.  


  b. Findings
    No findings of significance were identified.
1R15 Operability Evaluations (71111.15)
  a. Inspection Scope
- 9 -
    The inspectors reviewed the following issues:
Enclosure
    The inspectors selected these potential operability issues based on the risk-significance
b.  
    of the associated components and systems. The inspectors evaluated the technical
Findings  
    adequacy of the evaluations to ensure that TS operability was properly justified and the
No findings of significance were identified.  
    subject component or system remained available such that no unrecognized increase in
1R15 Operability Evaluations (71111.15)  
    risk occurred. The inspectors compared the operability and design criteria in the
a.  
    appropriate sections of the TS and UFSAR to the licensees evaluations, to determine
Inspection Scope  
    whether the components or systems were operable. Where compensatory measures
The inspectors reviewed the following issues:  
    were required to maintain operability, the inspectors determined whether the measures
The inspectors selected these potential operability issues based on the risk-significance  
    in place would function as intended and were properly controlled. The inspectors
of the associated components and systems. The inspectors evaluated the technical  
    determined, where appropriate, compliance with bounding limitations associated with the
adequacy of the evaluations to ensure that TS operability was properly justified and the  
    evaluations. Additionally, the inspectors also reviewed a sampling of corrective action
subject component or system remained available such that no unrecognized increase in  
    documents to verify that the licensee was identifying and correcting any deficiencies
risk occurred. The inspectors compared the operability and design criteria in the  
    associated with operability evaluations.
appropriate sections of the TS and UFSAR to the licensees evaluations, to determine  
    *       January 14, 2008, DG 2 operability and common cause evaluation for loss of
whether the components or systems were operable. Where compensatory measures  
            overspeed governor sightglass during run
were required to maintain operability, the inspectors determined whether the measures  
    *       January 15, 2008, operability evaluation of control room Board C non-essential
in place would function as intended and were properly controlled. The inspectors  
            meters without isolation devices in DG 1 and DG 2 essential circuits, on January
determined, where appropriate, compliance with bounding limitations associated with the  
            14, 2008
evaluations. Additionally, the inspectors also reviewed a sampling of corrective action  
    *       February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in
documents to verify that the licensee was identifying and correcting any deficiencies  
            DG 2
associated with operability evaluations.  
    *       March 19, 2008, RPS EPA circuit breakers operability evaluations on
*  
            January 25, 2008 and February 6, 2008
January 14, 2008, DG 2 operability and common cause evaluation for loss of  
    This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.
overspeed governor sightglass during run  
  b. Findings
*  
    No findings of significance were identified.
January 15, 2008, operability evaluation of control room Board C non-essential  
1R18 Plant Modifications (71111.18)
meters without isolation devices in DG 1 and DG 2 essential circuits, on January  
    Temporary Modifications
14, 2008  
  a. Inspection Scope
*  
    The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs
February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in  
    to ensure that temporary alterations and configuration changes to the plant conformed to
DG 2  
                                            -9-                                    Enclosure
*  
March 19, 2008, RPS EPA circuit breakers operability evaluations on  
January 25, 2008 and February 6, 2008  
This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.  
b.  
Findings  
No findings of significance were identified.  
1R18 Plant Modifications (71111.18)  
Temporary Modifications  
a.  
Inspection Scope  
The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs  
to ensure that temporary alterations and configuration changes to the plant conformed to  


  these guidance documents and the requirements of 10 CFR 50.59. The inspectors:
  (1) verified that the modifications did not have an affect on system operability/availability;
  (2) verified that the installations were consistent with modification documents;
  (3) ensured that the post-installation test results were satisfactory and that the impacts of
- 10 -
  the temporary modifications on permanently installed SSCs were supported by the test;
Enclosure
  and (4) verified that appropriate safety evaluations were completed. The inspectors
these guidance documents and the requirements of 10 CFR 50.59. The inspectors:  
  reviewed the following temporary modifications:
(1) verified that the modifications did not have an affect on system operability/availability;  
  *       March 19, 2008, Long term scaffolding program review
(2) verified that the installations were consistent with modification documents;  
  Documents reviewed by the inspectors included:
(3) ensured that the post-installation test results were satisfactory and that the impacts of  
  *       Maintenance Procedure 7.0.7, Scaffolding Construction and Control,
the temporary modifications on permanently installed SSCs were supported by the test;  
            Revision 24
and (4) verified that appropriate safety evaluations were completed. The inspectors  
  The inspectors completed one sample.
reviewed the following temporary modifications:  
b. Findings
*  
  Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a
March 19, 2008, Long term scaffolding program review  
  regarding the licensees failure to follow the requirements of Maintenance Procedure
  7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to
Documents reviewed by the inspectors included:  
  inspect all existing scaffolds and failed to identify multiple scaffolding interactions with
*  
  safety-related equipment during a required annual scaffold inspection on January 21,
Maintenance Procedure 7.0.7, Scaffolding Construction and Control,  
  2008.
Revision 24  
  Description. During pre-outage scaffold inspections on February 7, 2008, the licensee
The inspectors completed one sample.  
  discovered that some existing scaffolds were not built in accordance with established
b.  
  procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had
Findings  
  been built in contact with safety-related service water piping, RHR piping, pipe hangers,
Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a  
  electrical conduit and the torus shell. This condition was documented in
regarding the licensees failure to follow the requirements of Maintenance Procedure  
  CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of
7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to  
  the impacted safety systems, the licensee took actions to remove the non-compliant
inspect all existing scaffolds and failed to identify multiple scaffolding interactions with  
  scaffold on February 22, 2008, and closed the CR.
safety-related equipment during a required annual scaffold inspection on January 21,  
  The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and
2008.  
  Control, Revision 24, contains the following requirement in Paragraph 3.2:
      During the month of January, all erected scaffolds shall have an Industrial
Description. During pre-outage scaffold inspections on February 7, 2008, the licensee  
      Safety examination performed to ensure compliance with this procedure. This
discovered that some existing scaffolds were not built in accordance with established  
      examination is required prior to placing a new tag and entering the scaffold into
procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had  
      the new calendar year log.
been built in contact with safety-related service water piping, RHR piping, pipe hangers,  
  The inspectors also noted that the required annual examination had been completed on
electrical conduit and the torus shell. This condition was documented in  
  January 21, 2008. The maintenance personnel who conducted the examination in
CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of  
  WO 4552687 documented completion with no discrepancies.
the impacted safety systems, the licensee took actions to remove the non-compliant  
  On March 6, 2008, the inspectors questioned licensee management regarding the
scaffold on February 22, 2008, and closed the CR.  
  performance of the annual scaffold examinations. Specifically, the inspectors asked why
  the non-compliant scaffold had not been identified during the required annual scaffold
The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and  
  examinations. Following this meeting, the licensee conducted a scaffolding walkdown to
Control, Revision 24, contains the following requirement in Paragraph 3.2:  
                                            - 10 -                                    Enclosure
During the month of January, all erected scaffolds shall have an Industrial  
Safety examination performed to ensure compliance with this procedure. This  
examination is required prior to placing a new tag and entering the scaffold into  
the new calendar year log.  
The inspectors also noted that the required annual examination had been completed on  
January 21, 2008. The maintenance personnel who conducted the examination in  
WO 4552687 documented completion with no discrepancies.  
On March 6, 2008, the inspectors questioned licensee management regarding the  
performance of the annual scaffold examinations. Specifically, the inspectors asked why  
the non-compliant scaffold had not been identified during the required annual scaffold  
examinations. Following this meeting, the licensee conducted a scaffolding walkdown to  


identify any remaining non-compliances. The following additional violations of
Procedure 7.0.7 were discovered during this walkdown:
*       Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had
        a board in contact with high pressure coolant injection steam line drip
- 11 -
        leg piping. Contrary to Procedure 7.0.7, this scaffold had not been
Enclosure
        inspected due to a misperception that only long term scaffolds that
identify any remaining non-compliances. The following additional violations of  
        had been in place greater than 90 days needed to be inspected. The
Procedure 7.0.7 were discovered during this walkdown:  
        licensee documented this condition in CR-CNS-2008-01551.
*       Scaffold 08-06 was discovered to be in contact with safety-related
*  
        conduit and pipe hangers in the torus area. The licensee was unable to
Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had  
        determine when this scaffold had been installed.
a board in contact with high pressure coolant injection steam line drip  
*       Eight examples of non-compliant scaffolding handrails were discovered
leg piping. Contrary to Procedure 7.0.7, this scaffold had not been  
        in contact with safety system components in the torus area which had
inspected due to a misperception that only long term scaffolds that  
        been installed in 2002. This example, documented in
had been in place greater than 90 days needed to be inspected. The  
        CR-CNS-2008-01563 on March 11, 2008 was not identified by the
licensee documented this condition in CR-CNS-2008-01551.  
        annual examination because it was not included in the scaffold log and
        was therefore not inspected.
*  
The inspectors determined that Procedure 7.0.7 had been violated during the
Scaffold 08-06 was discovered to be in contact with safety-related  
January 21, 2008 annual scaffolding examination in that the examiner reviewed only
conduit and pipe hangers in the torus area. The licensee was unable to  
those scaffolds identified in the scaffolding log as Long Term Permanent versus all
determine when this scaffold had been installed.  
erected scaffolds as required by the procedure. As a result, seven existing scaffolds
were not inspected, despite the fact that some of them had been installed for more than
*  
one year at the time of the inspection. In addition, the examiner did not conduct a
Eight examples of non-compliant scaffolding handrails were discovered  
thorough inspection to ensure compliance with this procedure. Obvious non-
in contact with safety system components in the torus area which had  
compliances existed in some of the installed scaffolds that were not identified until
been installed in 2002. This example, documented in  
months later.
CR-CNS-2008-01563 on March 11, 2008 was not identified by the  
The inspectors also noted that since handrails built from scaffolding materials do not
annual examination because it was not included in the scaffold log and  
meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an
was therefore not inspected.  
elevated platform, no annual inspections have been performed on these structures.
Analysis. The performance deficiency associated with this finding involved the
The inspectors determined that Procedure 7.0.7 had been violated during the  
licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,
January 21, 2008 annual scaffolding examination in that the examiner reviewed only  
Scaffolding Construction and Control. The finding is more than minor because if left
those scaffolds identified in the scaffolding log as Long Term Permanent versus all  
uncorrected the failure to perform annual scaffold inspections could become a more
erected scaffolds as required by the procedure. As a result, seven existing scaffolds  
significant safety concern. Specifically, annual inspections failed to inspect all existing
were not inspected, despite the fact that some of them had been installed for more than  
scaffolds and failed to identify multiple scaffolding interactions with safety-related
one year at the time of the inspection. In addition, the examiner did not conduct a  
equipment. Using the Manual Chapter 0609, Significance Determination Process,
thorough inspection to ensure compliance with this procedure. Obvious non-
Phase 1 Worksheet, the finding is determined to have a very low safety significance
compliances existed in some of the installed scaffolds that were not identified until  
because it did not result in the loss of function of a TS required system for greater than
months later.  
its allowed outage time. The cause of this finding is related to the human performance
crosscutting component of work practices because maintenance personnel did not follow
The inspectors also noted that since handrails built from scaffolding materials do not  
the requirements of Maintenance Procedure 7.0.7 (H.4(b)).
meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an  
Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,
elevated platform, no annual inspections have been performed on these structures.  
and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,
Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,
Analysis. The performance deficiency associated with this finding involved the  
                                        - 11 -                                    Enclosure
licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,  
Scaffolding Construction and Control. The finding is more than minor because if left  
uncorrected the failure to perform annual scaffold inspections could become a more  
significant safety concern. Specifically, annual inspections failed to inspect all existing  
scaffolds and failed to identify multiple scaffolding interactions with safety-related  
equipment. Using the Manual Chapter 0609, Significance Determination Process,  
Phase 1 Worksheet, the finding is determined to have a very low safety significance  
because it did not result in the loss of function of a TS required system for greater than  
its allowed outage time. The cause of this finding is related to the human performance  
crosscutting component of work practices because maintenance personnel did not follow  
the requirements of Maintenance Procedure 7.0.7 (H.4(b)).  
Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,  
and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,  
Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,  


    requires that maintenance that can affect the performance of safety-related equipment
    should be properly pre-planned and performed in accordance with written procedures.
    Contrary to this requirement, on January 21, 2008, maintenance personnel violated the
    requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in
- 12 -
    that they did not inspect all required scaffolds or identify obvious non-compliances with
Enclosure
    Procedure 7.0.7. Because the finding is of very low safety significance and has been
requires that maintenance that can affect the performance of safety-related equipment  
    entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated
should be properly pre-planned and performed in accordance with written procedures.  
    as an NCV consistent with Section VI.A of the Enforcement Policy: NCV
Contrary to this requirement, on January 21, 2008, maintenance personnel violated the  
    05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.
requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in  
1R19 Postmaintenance Testing (71111.19)
that they did not inspect all required scaffolds or identify obvious non-compliances with  
  a. Inspection Scope
Procedure 7.0.7. Because the finding is of very low safety significance and has been  
    These activities were selected based upon the SSCs ability to impact risk. The
entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated  
    inspectors evaluated these activities for the following (as applicable): the effect of testing
as an NCV consistent with Section VI.A of the Enforcement Policy: NCV  
    on the plant had been adequately addressed; testing was adequate for the maintenance
05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.  
    performed; acceptance criteria were clear and demonstrated operational readiness; test
    instrumentation was appropriate; tests were performed as written in accordance with
1R19 Postmaintenance Testing (71111.19)  
    properly reviewed and approved procedures; equipment was returned to its operational
    status following testing (temporary modifications or jumpers required for test
a.  
    performance were properly removed after test completion), and test documentation was
Inspection Scope  
    properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10
    CFR Part 50 requirements, licensee procedures, and various NRC generic
These activities were selected based upon the SSCs ability to impact risk. The  
    communications to ensure that the test results adequately ensured that the equipment
inspectors evaluated these activities for the following (as applicable): the effect of testing  
    met the licensing basis and design requirements. In addition, the inspectors reviewed
on the plant had been adequately addressed; testing was adequate for the maintenance  
    corrective action documents associated with postmaintenance tests to determine
performed; acceptance criteria were clear and demonstrated operational readiness; test  
    whether the licensee was identifying problems and entering them in the CAP and that
instrumentation was appropriate; tests were performed as written in accordance with  
    the problems were being corrected commensurate with their importance to safety.
properly reviewed and approved procedures; equipment was returned to its operational  
    Documents reviewed are listed in the attachment.
status following testing (temporary modifications or jumpers required for test  
    The inspectors reviewed the following postmaintenance activities to verify that
performance were properly removed after test completion), and test documentation was  
    procedures and test activities were adequate to ensure system operability and functional
properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10  
    capability:
CFR Part 50 requirements, licensee procedures, and various NRC generic  
    *       March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008
communications to ensure that the test results adequately ensured that the equipment  
    *       March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008
met the licensing basis and design requirements. In addition, the inspectors reviewed  
    *       March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and
corrective action documents associated with postmaintenance tests to determine  
            thermography
whether the licensee was identifying problems and entering them in the CAP and that  
    *       March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008
the problems were being corrected commensurate with their importance to safety.
    *       March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008
Documents reviewed are listed in the attachment.  
    The inspectors completed five samples.
The inspectors reviewed the following postmaintenance activities to verify that  
                                            - 12 -                                    Enclosure
procedures and test activities were adequate to ensure system operability and functional  
capability:  
*  
March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008  
*  
March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008  
*  
March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and  
thermography  
*  
March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008  
*  
March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008  
The inspectors completed five samples.  


b. Findings
  Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical
  Connections
  Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were
- 13 -
  identified regarding the licensees failure to establish procedural controls for
Enclosure
  maintenance of electrical connections on essential equipment. In the first example, the
b.  
  licensee failed to include amphenol connections within the scope of existing periodic
Findings  
  electrical connection inspections to identify loosening connections. In the second
Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical  
  example, the licensee failed to incorporate internal operating experience into work
Connections  
  control procedures to ensure that DG-mounted amphenol connections were solidly
  attached following maintenance. These failures to establish adequate procedural
Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were  
  controls led to the trip of DG 2 during testing on January 15, 2008.
identified regarding the licensees failure to establish procedural controls for  
  Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a
maintenance of electrical connections on essential equipment. In the first example, the  
  postmaintenance test. The test was being conducted to verify the ability of DG 2 to
licensee failed to include amphenol connections within the scope of existing periodic  
  perform its safety function following repairs to the overspeed governor oil level sight
electrical connection inspections to identify loosening connections. In the second  
  glass. The licensee determined that the cause of the trip of DG 2 was a loose
example, the licensee failed to incorporate internal operating experience into work  
  amphenol-type connection on the relay tachometer speed sensing circuit magnetic
control procedures to ensure that DG-mounted amphenol connections were solidly  
  pickup.
attached following maintenance. These failures to establish adequate procedural  
  The licensee determined that this failure was similar in nature to a condition identified
controls led to the trip of DG 2 during testing on January 15, 2008.  
  during previous troubleshooting of DG 2. On December 10, 1995, operations personnel
  initiated a CR to document that the amphenol connector on a DG mounted magnetic
Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a  
  pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the
postmaintenance test. The test was being conducted to verify the ability of DG 2 to  
  licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors
perform its safety function following repairs to the overspeed governor oil level sight  
  and apply thread locking compound to the amphenol threads to keep the connection
glass. The licensee determined that the cause of the trip of DG 2 was a loose  
  from vibrating loose. The completion of these actions was documented in Minor
amphenol-type connection on the relay tachometer speed sensing circuit magnetic  
  Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions
pickup.  
  were taken to codify the use of thread locking compounds or other measures to prevent
  the amphenol connections from coming unthreaded during engine operation.
The licensee determined that this failure was similar in nature to a condition identified  
  During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm
during previous troubleshooting of DG 2. On December 10, 1995, operations personnel  
  was unexpectedly received, as described in CR 4-13285. Minor Maintenance
initiated a CR to document that the amphenol connector on a DG mounted magnetic  
  WO 003915 was initiated to determine the cause of the unexpected alarm. During
pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the  
  completion of this WO on December 29, 2000, maintenance personnel replaced the
licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors  
  relay tachometer and the associated MPU, and the associated amphenol connection
and apply thread locking compound to the amphenol threads to keep the connection  
  was disconnected and then reconnected.
from vibrating loose. The completion of these actions was documented in Minor  
  In the first example of this performance deficiency, the inspectors determined that the
Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions  
  licensees procedures for performing periodic DG electrical examinations were
were taken to codify the use of thread locking compounds or other measures to prevent  
  inadequate in that they did not include engine-mounted components. Maintenance
the amphenol connections from coming unthreaded during engine operation.  
  Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was
  created on September 30, 1988 to perform periodic (once per operating cycle)
During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm  
  preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC
was unexpectedly received, as described in CR 4-13285. Minor Maintenance  
  identified an NCV regarding the licensees failure to establish adequate instructions for
WO 003915 was initiated to determine the cause of the unexpected alarm. During  
  emergency DG electrical maintenance (see NRC Special Inspection
completion of this WO on December 29, 2000, maintenance personnel replaced the  
  Report 05000298/2007007). Two of the three examples described in the NCV dealt with
relay tachometer and the associated MPU, and the associated amphenol connection  
  inadequate work instructions for checking the tightness of electrical connections on DG
was disconnected and then reconnected.  
  system components. In response to this NCV, the licensee initiated Corrective Action #8
                                            - 13 -                                  Enclosure
In the first example of this performance deficiency, the inspectors determined that the  
licensees procedures for performing periodic DG electrical examinations were  
inadequate in that they did not include engine-mounted components. Maintenance  
Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was  
created on September 30, 1988 to perform periodic (once per operating cycle)  
preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC  
identified an NCV regarding the licensees failure to establish adequate instructions for  
emergency DG electrical maintenance (see NRC Special Inspection  
Report 05000298/2007007). Two of the three examples described in the NCV dealt with  
inadequate work instructions for checking the tightness of electrical connections on DG  
system components. In response to this NCV, the licensee initiated Corrective Action #8  


under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically
check the DG systems for loose connections. In developing a revision to Maintenance
Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the
licensee made the erroneous assumption that all engine-mounted components have
- 14 -
other maintenance actions that satisfy the intent of the corrective action. As such,
Enclosure
engine-mounted connections were not included in the scope of the inspections in
under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically  
Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised
check the DG systems for loose connections. In developing a revision to Maintenance  
procedure was subsequently completed for DG 2 on September 13, 2007. The
Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the  
assumption was in error and resulted in a recently missed opportunity to discover the
licensee made the erroneous assumption that all engine-mounted components have  
loosening amphenol connection on the DG 2 relay tachometer MPU.
other maintenance actions that satisfy the intent of the corrective action. As such,  
In the second example of this performance deficiency, the licensee determined that the
engine-mounted connections were not included in the scope of the inspections in  
maintenance procedures used on December 29, 2000 did not contain adequate
Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised  
guidance to ensure that thread locking compounds or other measures would be utilized
procedure was subsequently completed for DG 2 on September 13, 2007. The  
to ensure that the DG amphenol connections did not become unthreaded during engine
assumption was in error and resulted in a recently missed opportunity to discover the  
operation. The work was not conducted using detailed procedures, and as such the
loosening amphenol connection on the DG 2 relay tachometer MPU.  
licensee determined that the amphenol became loose as a result of either inadequate
tightening during the maintenance, or equipment vibration between 2000 and 2008 (due
In the second example of this performance deficiency, the licensee determined that the  
to thread locking compound not being used), or a combination of both. The licensee has
maintenance procedures used on December 29, 2000 did not contain adequate  
initiated corrective actions to add the appropriate guidance to Administrative
guidance to ensure that thread locking compounds or other measures would be utilized  
Procedure 0.40.4, Planning.
to ensure that the DG amphenol connections did not become unthreaded during engine  
Analysis. The performance deficiency associated with this finding involved the
operation. The work was not conducted using detailed procedures, and as such the  
licensees failure to establish procedural controls for maintenance of electrical
licensee determined that the amphenol became loose as a result of either inadequate  
connections on essential equipment. In the first example, the licensee failed to include
tightening during the maintenance, or equipment vibration between 2000 and 2008 (due  
these amphenol connections within the scope of existing periodic electrical connection
to thread locking compound not being used), or a combination of both. The licensee has  
inspections to identify loosening connections. In the second example, the licensee failed
initiated corrective actions to add the appropriate guidance to Administrative  
to incorporate internal operating experience into work control procedures to ensure that
Procedure 0.40.4, Planning.  
DG-mounted amphenol connections were solidly attached following maintenance.
These failures to establish adequate procedural controls led to the trip of DG 2 during
Analysis. The performance deficiency associated with this finding involved the  
testing on January 15, 2008. The finding is more than minor because it is associated
licensees failure to establish procedural controls for maintenance of electrical  
with the mitigating systems cornerstone attribute of equipment performance and affects
connections on essential equipment. In the first example, the licensee failed to include  
the associated cornerstone objective to ensure the availability, reliability, and capability
these amphenol connections within the scope of existing periodic electrical connection  
of systems that respond to initiating events to prevent undesirable consequences. The
inspections to identify loosening connections. In the second example, the licensee failed  
Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"
to incorporate internal operating experience into work control procedures to ensure that  
were used to conclude that a Phase 2 analysis was required because the finding
DG-mounted amphenol connections were solidly attached following maintenance.
represents an actual loss of safety function of a single train for greater than its TS
These failures to establish adequate procedural controls led to the trip of DG 2 during  
allowed outage time (7 days). A Phase 2 risk analysis was conducted using the
testing on January 15, 2008. The finding is more than minor because it is associated  
guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor
with the mitigating systems cornerstone attribute of equipment performance and affects  
Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table
the associated cornerstone objective to ensure the availability, reliability, and capability  
with an assumed exposure time of greater than 30 days yielded a result of red, or very
of systems that respond to initiating events to prevent undesirable consequences. The  
high significance. A Phase 3 analysis conducted by a risk analyst preliminarily
Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"  
determined the finding to be of white, or low to moderate significance.
were used to conclude that a Phase 2 analysis was required because the finding  
The cause of the finding is related to the corrective action component of the crosscutting
represents an actual loss of safety function of a single train for greater than its TS  
area of problem identification and resolution in that the licensee failed to take
allowed outage time (7 days). A Phase 2 risk analysis was conducted using the  
appropriate corrective actions for a 2007 NRC inspection finding which identified
guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor  
inadequate maintenance procedures for checking the tightness of DG electrical
Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table  
connections (P.1(d)).
with an assumed exposure time of greater than 30 days yielded a result of red, or very  
                                        - 14 -                                    Enclosure
high significance. A Phase 3 analysis conducted by a risk analyst preliminarily  
determined the finding to be of white, or low to moderate significance.
The cause of the finding is related to the corrective action component of the crosscutting  
area of problem identification and resolution in that the licensee failed to take  
appropriate corrective actions for a 2007 NRC inspection finding which identified  
inadequate maintenance procedures for checking the tightness of DG electrical  
connections (P.1(d)).  


    Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,
    and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,
    Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),
    requires that maintenance affecting performance of safety-related equipment should be
- 15 -
    performed in accordance with written procedures. Contrary to this, since December 29,
Enclosure
    2000, the licensee used inadequate procedural guidance to reassemble amphenol
Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,  
    connections on DG 2. Additionally, since September 30, 1988, the licensees procedural
and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,  
    guidance for performing periodic electrical inspections has been inadequate in that it did
Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),  
    not check the tightness of engine-mounted amphenol connections. These inadequate
requires that maintenance affecting performance of safety-related equipment should be  
    procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue
performed in accordance with written procedures. Contrary to this, since December 29,  
    was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of
2000, the licensee used inadequate procedural guidance to reassemble amphenol  
    the findings final safety significance, this finding is identified as Apparent Violation (AV)
connections on DG 2. Additionally, since September 30, 1988, the licensees procedural  
    05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of
guidance for performing periodic electrical inspections has been inadequate in that it did  
    Emergency DG Electrical Connections."
not check the tightness of engine-mounted amphenol connections. These inadequate  
1R22 Surveillance Testing (71111.22)
procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue  
    Routine Surveillance Testing
was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of  
  a. Inspection Scope
the findings final safety significance, this finding is identified as Apparent Violation (AV)  
    The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that
05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of  
    the three surveillance activities listed below demonstrated that the SSCs tested were
Emergency DG Electrical Connections."
    capable of performing their intended safety functions. The inspectors either witnessed
    or reviewed test data to verify that the following significant surveillance test attributes
1R22 Surveillance Testing (71111.22)  
    were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)
Routine Surveillance Testing  
    acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;
a.  
    (7) test data; (8) testing frequency and method demonstrated TS operability; (9) test
Inspection Scope  
    equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code
The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that  
    requirements; (12) engineering evaluations, root causes, and bases for returning tested
the three surveillance activities listed below demonstrated that the SSCs tested were  
    SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;
capable of performing their intended safety functions. The inspectors either witnessed  
    and (14) annunciators and alarms setpoints. The inspectors also verified that the
or reviewed test data to verify that the following significant surveillance test attributes  
    licensee identified and implemented any needed corrective actions associated with the
were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)  
    surveillance testing.
acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;  
    The inspectors observed in-plant activities and reviewed procedures and associated
(7) test data; (8) testing frequency and method demonstrated TS operability; (9) test  
    records to determine whether: any preconditioning occurred; effects of the testing were
equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code  
    adequately addressed by control room personnel or engineers prior to the
requirements; (12) engineering evaluations, root causes, and bases for returning tested  
    commencement of the testing; acceptance criteria were clearly stated, demonstrated
SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;
    operational readiness, and were consistent with the system design basis; plant
and (14) annunciators and alarms setpoints. The inspectors also verified that the  
    equipment calibration was correct, accurate, and properly documented; as left setpoints
licensee identified and implemented any needed corrective actions associated with the  
    were within required ranges; the calibration frequency was in accordance with TS, the
surveillance testing.  
    UFSAR, procedures, and applicable commitments; measuring and test equipment
    calibration was current; test equipment was used within the required range and
The inspectors observed in-plant activities and reviewed procedures and associated  
    accuracy; applicable prerequisites described in the test procedures were satisfied; test
records to determine whether: any preconditioning occurred; effects of the testing were  
    frequencies met TS requirements to demonstrate operability and reliability; tests were
adequately addressed by control room personnel or engineers prior to the  
    performed in accordance with the test procedures and other applicable procedures;
commencement of the testing; acceptance criteria were clearly stated, demonstrated  
    jumpers and lifted leads were controlled and restored where used; test data and results
operational readiness, and were consistent with the system design basis; plant  
    were accurate, complete, within limits, and valid; test equipment was removed after
equipment calibration was correct, accurate, and properly documented; as left setpoints  
    testing; where applicable, test results not meeting acceptance criteria were addressed
were within required ranges; the calibration frequency was in accordance with TS, the  
    with an adequate operability evaluation or the system or component was declared
UFSAR, procedures, and applicable commitments; measuring and test equipment  
                                              - 15 -                                      Enclosure
calibration was current; test equipment was used within the required range and  
accuracy; applicable prerequisites described in the test procedures were satisfied; test  
frequencies met TS requirements to demonstrate operability and reliability; tests were  
performed in accordance with the test procedures and other applicable procedures;  
jumpers and lifted leads were controlled and restored where used; test data and results  
were accurate, complete, within limits, and valid; test equipment was removed after  
testing; where applicable, test results not meeting acceptance criteria were addressed  
with an adequate operability evaluation or the system or component was declared  


    inoperable; where applicable for safety-related instrument control surveillance tests,
    reference setting data were accurately incorporated in the test procedure; where
    applicable, actual conditions encountering high resistance electrical contacts were such
    that the intended safety function could still be accomplished; prior procedure changes
- 16 -
    had not provided an opportunity to identify problems encountered during the
Enclosure
    performance of the surveillance or calibration test; equipment was returned to a position
inoperable; where applicable for safety-related instrument control surveillance tests,  
    or status required to support the performance of the safety functions; and all problems
reference setting data were accurately incorporated in the test procedure; where  
    identified during the testing were appropriately documented and dispositioned in the
applicable, actual conditions encountering high resistance electrical contacts were such  
    CAP.
that the intended safety function could still be accomplished; prior procedure changes  
    The inspectors reviewed the test results for the following activities to determine whether
had not provided an opportunity to identify problems encountered during the  
    risk-significant systems and equipment were capable of performing their intended safety
performance of the surveillance or calibration test; equipment was returned to a position  
    function and to verify testing was conducted in accordance with applicable procedural
or status required to support the performance of the safety functions; and all problems  
    and TS requirements:
identified during the testing were appropriately documented and dispositioned in the  
    *       January 23, 2008, Scram discharge volume vent valve inservice test (IST)
CAP.  
              performed January 14, 2008
The inspectors reviewed the test results for the following activities to determine whether  
    *       February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,
risk-significant systems and equipment were capable of performing their intended safety  
              2008
function and to verify testing was conducted in accordance with applicable procedural  
    *       March 19, 2008, 6.REC.201 performed January 31, 2008
and TS requirements:  
    *       March 21, 2008, DG 2 monthly operability test performed March 11, 2008
*  
    This inspection constitutes four routine surveillance testing samples as defined in
January 23, 2008, Scram discharge volume vent valve inservice test (IST)  
    Inspection Procedure 71111.22.
performed January 14, 2008  
  b. Findings
    No findings of significance were identified.
*  
EP4 Emergency Action Level and Emergency Plan Changes (71114.04)
February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,  
    CNS Emergency Plan Revision 53
2008  
  a. Inspection Scope
    The inspector performed an in-office review of Revision 53 to the Cooper Nuclear
*  
    Station Emergency Plan, received January 8, 2008. This revision moved the licensee's
March 19, 2008, 6.REC.201 performed January 31, 2008  
    Joint Information Center (emergency news center) from Columbus, Nebraska, to
    Auburn, Nebraska, revised position duties in the Emergency Operations Facility and
*  
    Joint Information Center, deleted the Technical Information Coordinator (EOF) position,
March 21, 2008, DG 2 monthly operability test performed March 11, 2008  
    revised position titles in the Joint Information Center, added a Letter of Agreement
    between the licensee and the Nebraska City Fire Department, and revised geographical-
This inspection constitutes four routine surveillance testing samples as defined in  
    based protective action zones in Missouri, based on an approval letter from Federal
Inspection Procedure 71111.22.  
    Emergency Management Agency, Region VII, dated October 10, 2007.
b.  
    This revision was compared to its previous revision, to the criteria of NUREG-0654,
Findings  
    Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and
No findings of significance were identified.  
    Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in
EP4  
                                              - 16 -                                  Enclosure
Emergency Action Level and Emergency Plan Changes (71114.04)  
CNS Emergency Plan Revision 53  
a.  
Inspection Scope  
The inspector performed an in-office review of Revision 53 to the Cooper Nuclear  
Station Emergency Plan, received January 8, 2008. This revision moved the licensee's  
Joint Information Center (emergency news center) from Columbus, Nebraska, to  
Auburn, Nebraska, revised position duties in the Emergency Operations Facility and  
Joint Information Center, deleted the Technical Information Coordinator (EOF) position,  
revised position titles in the Joint Information Center, added a Letter of Agreement  
between the licensee and the Nebraska City Fire Department, and revised geographical-
based protective action zones in Missouri, based on an approval letter from Federal  
Emergency Management Agency, Region VII, dated October 10, 2007.  
This revision was compared to its previous revision, to the criteria of NUREG-0654,  
Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and  
Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in  


      10 CFR 50.47(b) to determine if the revision adequately implemented the requirements
      of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and
      did not constitute approval of licensee changes; therefore, this revision is subject to
      future inspection.
- 17 -
      The inspectors completed one sample during the inspection.
Enclosure
  b. Findings
10 CFR 50.47(b) to determine if the revision adequately implemented the requirements  
      No findings of significance were identified.
of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and  
4.   OTHER ACTIVITIES
did not constitute approval of licensee changes; therefore, this revision is subject to  
4OA1 Performance Indicator (PI) Verification (71151)
future inspection.  
.1   Data Submission Review
  a. Inspection Scope
      The inspectors performed a review of the data submitted by the licensee for the 4th
The inspectors completed one sample during the inspection.  
      Quarter 2007 PIs for any obvious inconsistencies prior to its public release in
      accordance with Inspection Manual Chapter 0608, Performance Indicator Program.
b.  
      This review was performed as part of the inspectors normal plant status activities and,
Findings  
      as such, did not constitute a separate inspection sample.
No findings of significance were identified.  
  b. Findings
4.  
      No findings of significance were identified.
OTHER ACTIVITIES  
.2   Unplanned Scrams per 7000 Critical Hours
4OA1 Performance Indicator (PI) Verification (71151)  
  a. Inspection Scope
.1  
      The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical
Data Submission Review  
      hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To
a.  
      determine the accuracy of the PI data reported during those periods, PI definitions and
Inspection Scope  
      guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,
The inspectors performed a review of the data submitted by the licensee for the 4th  
      Regulatory Assessment Performance Indicator Guideline, were used. The inspectors
Quarter 2007 PIs for any obvious inconsistencies prior to its public release in  
      reviewed the licensees operator narrative logs, issue reports, event reports and NRC
accordance with Inspection Manual Chapter 0608, Performance Indicator Program.  
      inspection reports to validate the accuracy of the submittals. The inspectors also
This review was performed as part of the inspectors normal plant status activities and,  
      reviewed the licensees issue report database to determine if any problems had been
as such, did not constitute a separate inspection sample.  
      identified with the PI data collected or transmitted for this indicator and none were
b.  
      identified.
Findings  
      This inspection constitutes one unplanned scrams per 7000 critical hours sample as
No findings of significance were identified.  
      defined by Inspection Procedure 71151.
.2  
  b. Findings
Unplanned Scrams per 7000 Critical Hours  
      No findings of significance were identified.
a.  
                                              - 17 -                                  Enclosure
Inspection Scope  
The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical  
hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To  
determine the accuracy of the PI data reported during those periods, PI definitions and  
guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,  
Regulatory Assessment Performance Indicator Guideline, were used. The inspectors  
reviewed the licensees operator narrative logs, issue reports, event reports and NRC  
inspection reports to validate the accuracy of the submittals. The inspectors also  
reviewed the licensees issue report database to determine if any problems had been  
identified with the PI data collected or transmitted for this indicator and none were  
identified.  
This inspection constitutes one unplanned scrams per 7000 critical hours sample as  
defined by Inspection Procedure 71151.  
b.  
Findings  
No findings of significance were identified.  


.3   Unplanned Transients per 7000 Critical Hours
  a. Inspection Scope
      The inspectors sampled licensee submittals for the unplanned transients per
      7000 critical hours PI for the period from the 1st quarter 2007 through the 4th
- 18 -
      quarter 2007. To determine the accuracy of the PI data reported during those periods,
Enclosure
      PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute
.3  
      Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.
Unplanned Transients per 7000 Critical Hours  
      The inspectors reviewed the licensees operator narrative logs, issue reports,
a.  
      maintenance rule records, event reports and NRC integrated Inspection reports to
Inspection Scope  
      validate the accuracy of the submittals. The inspectors also reviewed the licensees
The inspectors sampled licensee submittals for the unplanned transients per  
      issue report database to determine if any problems had been identified with the PI data
7000 critical hours PI for the period from the 1st quarter 2007 through the 4th  
      collected or transmitted for this indicator and none were identified.
quarter 2007. To determine the accuracy of the PI data reported during those periods,  
      This inspection constitutes one unplanned transients per 7000 critical hours sample as
PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute  
      defined by Inspection Procedure 71151.
Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.
  b. Findings
The inspectors reviewed the licensees operator narrative logs, issue reports,  
      No findings of significance were identified.
maintenance rule records, event reports and NRC integrated Inspection reports to  
4OA2 Identification and Resolution of Problems (71152)
validate the accuracy of the submittals. The inspectors also reviewed the licensees  
      Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency
issue report database to determine if any problems had been identified with the PI data  
      Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical
collected or transmitted for this indicator and none were identified.  
      Protection
This inspection constitutes one unplanned transients per 7000 critical hours sample as  
.1   Routine Review of Items Entered Into the CAP
defined by Inspection Procedure 71151.  
  a. Inspection Scope
b.  
      The inspectors performed a daily screening of items entered into the licensee's CAP.
Findings  
      This assessment was accomplished by reviewing CRs and WOs and attending
No findings of significance were identified.  
      corrective action review and work control meetings. The inspectors: (1) verified that
4OA2 Identification and Resolution of Problems (71152)  
      equipment, human performance, and program issues were being identified by the
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency  
      licensee at an appropriate threshold and that the issues were entered into the CAP;
Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical  
      (2) verified that corrective actions were commensurate with the significance of the issue;
Protection  
      and (3) identified conditions that might warrant additional followup through other baseline
.1  
      inspection procedures.
Routine Review of Items Entered Into the CAP  
  b. Findings
a.  
      No findings of significance were identified.
Inspection Scope  
.2   Selected Issue Followup Inspection
The inspectors performed a daily screening of items entered into the licensee's CAP.
  a. Inspection Scope
This assessment was accomplished by reviewing CRs and WOs and attending  
      In addition to the routine review, the inspectors selected the issues listed below for a
corrective action review and work control meetings. The inspectors: (1) verified that  
      more in-depth review. The inspectors considered the following during the review of the
equipment, human performance, and program issues were being identified by the  
                                              - 18 -                                  Enclosure
licensee at an appropriate threshold and that the issues were entered into the CAP;  
(2) verified that corrective actions were commensurate with the significance of the issue;  
and (3) identified conditions that might warrant additional followup through other baseline  
inspection procedures.  
    b. Findings  
No findings of significance were identified.  
.2  
Selected Issue Followup Inspection
    a. Inspection Scope  
In addition to the routine review, the inspectors selected the issues listed below for a  
more in-depth review. The inspectors considered the following during the review of the  


      licensee's actions: (1) complete and accurate identification of the problem in a timely
      manner; (2) evaluation and disposition of operability/reportability issues;
      (3) consideration of extent of condition, generic implications, common cause, and
      previous occurrences; (4) classification and prioritization of the resolution of the problem;
- 19 -
      (5) identification of root and contributing causes of the problem; (6) identification of
Enclosure
      corrective actions; and (7) completion of corrective actions in a timely manner.
licensee's actions: (1) complete and accurate identification of the problem in a timely  
      *       December 27, 2007, loss of both plant monitoring and information system
manner; (2) evaluation and disposition of operability/reportability issues;  
              computers
(3) consideration of extent of condition, generic implications, common cause, and  
      Documents reviewed by the inspectors included:
previous occurrences; (4) classification and prioritization of the resolution of the problem;  
      *       Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4
(5) identification of root and contributing causes of the problem; (6) identification of  
      *       Computer System Operating Procedure 2.6.3, Computer Systems Operation
corrective actions; and (7) completion of corrective actions in a timely manner.  
              and Outage Recovery, Revision 23
      The inspectors completed one sample.
*  
  b. Findings
December 27, 2007, loss of both plant monitoring and information system  
      No findings of significance were identified.
computers  
4OA3 Followup of Events and Notices of Enforcement Discretion (71153)
Documents reviewed by the inspectors included:  
.1   (Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance
*  
      Leads to Rendering Second Diesel Inoperable
Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4  
      On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil
      day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,
*  
      control room operators received annunciators due to a rising level in the DG 1 fuel oil
Computer System Operating Procedure 2.6.3, Computer Systems Operation  
      day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to
and Outage Recovery, Revision 23  
      failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel
      Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1
The inspectors completed one sample.  
      inoperable. With DG 2 already inoperable, the control room staff properly entered
      Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an
b.  
      operable status within 2 hours.
Findings  
      In an effort to restore operability of DG 1, the licensee elected to attempt repair of the
No findings of significance were identified.  
      leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing
4OA3 Followup of Events and Notices of Enforcement Discretion (71153)  
      DG 1 into maintenance lockout and entry into an overall red risk window for the station.
.1  
      The repair attempt was unsuccessful, and the control room staff subsequently entered
(Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance  
      Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours and Mode 4
Leads to Rendering Second Diesel Inoperable  
      within 36 hours. Operability of DG 1 was subsequently restored by closing a fuel oil
      system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.
On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil  
      The licensee initiated this LER due to the loss of safety function (on-site emergency
day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,  
      power) that occurred during the corrective maintenance attempt on DG 1. The
control room operators received annunciators due to a rising level in the DG 1 fuel oil  
      inspectors reviewed all aspects of the event, including performance of control room staff,
day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to  
      planning of the associated WOs, evaluation and mitigation of station risk, configuration
failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel  
      control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency
Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1  
                                                - 19 -                                    Enclosure
inoperable. With DG 2 already inoperable, the control room staff properly entered  
Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an  
operable status within 2 hours.  
In an effort to restore operability of DG 1, the licensee elected to attempt repair of the  
leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing  
DG 1 into maintenance lockout and entry into an overall red risk window for the station.
The repair attempt was unsuccessful, and the control room staff subsequently entered  
Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours and Mode 4  
within 36 hours. Operability of DG 1 was subsequently restored by closing a fuel oil  
system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.  
The licensee initiated this LER due to the loss of safety function (on-site emergency  
power) that occurred during the corrective maintenance attempt on DG 1. The  
inspectors reviewed all aspects of the event, including performance of control room staff,  
planning of the associated WOs, evaluation and mitigation of station risk, configuration  
control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency  


    and emergent work, and relationship to previous work on DG 1. A related violation of
    NRC requirements is discussed in detail in NRC Integrated Inspection Report
    05000298/2007005. This LER is closed.
.2   (Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency
- 20 -
    Filter System Fan Motor Results in Loss of Safety Function
Enclosure
    During a preventative maintenance inspection on December 3, 2007, licensee
and emergent work, and relationship to previous work on DG 1. A related violation of  
    technicians discovered severely overheated motor leads on the Control Room
NRC requirements is discussed in detail in NRC Integrated Inspection Report  
    Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the
05000298/2007005. This LER is closed.  
    damaged motor leads, operations staff declared the fan inoperable and determined that
    since CREFS is a single-train safety system, a loss of safety function had occurred.
.2  
    Immediate action was taken and the degraded booster fan was replaced. CREFS was
(Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency  
    returned to an operable status on December 4, 2007. The degraded condition was
Filter System Fan Motor Results in Loss of Safety Function  
    determined to have been caused by the improper crimping of the motor lugs by the
    manufacturer prior to installation in the plant. No performance deficiencies were
During a preventative maintenance inspection on December 3, 2007, licensee  
    identified during the review of this LER. This LER is closed.
technicians discovered severely overheated motor leads on the Control Room  
4OA6 Management Meetings
Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the  
    Exit Meeting Summary
damaged motor leads, operations staff declared the fan inoperable and determined that  
    On January 15, 2008, a regional inspector conducted a telephonic exit to present the
since CREFS is a single-train safety system, a loss of safety function had occurred.
    results of the in-office inspection of licensee changes to the emergency plan to
Immediate action was taken and the degraded booster fan was replaced. CREFS was  
    Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.
returned to an operable status on December 4, 2007. The degraded condition was  
    The inspector confirmed that proprietary information was not provided or examined
determined to have been caused by the improper crimping of the motor lugs by the  
    during the inspection.
manufacturer prior to installation in the plant. No performance deficiencies were  
    On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the
identified during the review of this LER. This LER is closed.  
    results of the in-office inspection of changes to the licensees emergency plan to
4OA6 Management Meetings  
    Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The
Exit Meeting Summary  
    inspector confirmed that proprietary, sensitive, or personal information examined during
On January 15, 2008, a regional inspector conducted a telephonic exit to present the  
    the inspection had been returned to the identified custodian.
results of the in-office inspection of licensee changes to the emergency plan to  
    On April 14, 2008, the resident inspectors presented the inspection results to
Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.
    Mr. M. Colomb, General Manager of Plant Operations and other members of the
The inspector confirmed that proprietary information was not provided or examined  
    licensee staff. The licensee acknowledged the issues presented. The inspectors asked
during the inspection.  
    the licensee whether any materials examined during the inspection should be
    considered proprietary. No proprietary information was identified.
On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the  
                                              - 20 -                                Enclosure
results of the in-office inspection of changes to the licensees emergency plan to  
Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The  
inspector confirmed that proprietary, sensitive, or personal information examined during  
the inspection had been returned to the identified custodian.  
On April 14, 2008, the resident inspectors presented the inspection results to  
Mr. M. Colomb, General Manager of Plant Operations and other members of the  
licensee staff. The licensee acknowledged the issues presented. The inspectors asked  
the licensee whether any materials examined during the inspection should be  
considered proprietary. No proprietary information was identified.  


                                  SUPPLEMENTAL INFORMATION
                                    KEY POINTS OF CONTACT
Licensee
A1-1
John Austin, Manager, Emergency Preparedness Manager
Attachment 1
Mark Bergmeier, Operations Support Group Supervisor
SUPPLEMENTAL INFORMATION  
Vasant Bhardwaj, Engineering Support Manager
KEY POINTS OF CONTACT  
Michael Boyce, Director of Projects
Daniel Buman, System Engineering Manager
Licensee  
Michael Colomb, General Manager of Plant Operations
Jeff Ehlers, Engineer, Electric Systems/I&C
John Austin, Manager, Emergency Preparedness Manager  
Roman Estrada, Corrective Action and Assessments Manager
Mark Bergmeier, Operations Support Group Supervisor  
Jim Flaherty, Senior Staff Licensing Engineer
Vasant Bhardwaj, Engineering Support Manager  
Paul Fleming, Director of Nuclear Safety Assurance
Michael Boyce, Director of Projects  
Scott Freborg, Valves Engineering Programs Supervisor
Daniel Buman, System Engineering Manager  
Gabe Gardner, Design Engineering Civil Engineering Supervisor
Michael Colomb, General Manager of Plant Operations  
Gary Kline, Director of Engineering
Jeff Ehlers, Engineer, Electric Systems/I&C  
Dave Madsen, Licensing Engineer
Roman Estrada, Corrective Action and Assessments Manager  
Mark F Metzger, Engineer, Electric Systems/I&C
Jim Flaherty, Senior Staff Licensing Engineer  
Ole Olson, Engineer, Engineering Support & Risk Management
Paul Fleming, Director of Nuclear Safety Assurance  
Raymond Rexroad, Engineer, Electric Systems/I&C
Scott Freborg, Valves Engineering Programs Supervisor  
Todd Stevens, Manager-Design Engineering
Gabe Gardner, Design Engineering Civil Engineering Supervisor  
Mark Unruh, Senior Staff Engineer
Gary Kline, Director of Engineering  
David VanDerKamp, Licensing Manager
Dave Madsen, Licensing Engineer  
Marshall VanWinkle, Design Engineering Mechanical Supervisor
Mark F Metzger, Engineer, Electric Systems/I&C  
Dave Werner, Operations Training Support Supervisor
Ole Olson, Engineer, Engineering Support & Risk Management
                    LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Raymond Rexroad, Engineer, Electric Systems/I&C  
Opened
Todd Stevens, Manager-Design Engineering  
05000298/2008002-02           AV     Failure to Establish Adequate Procedures for Maintenance of
Mark Unruh, Senior Staff Engineer  
                                      Emergency Diesel Generator Electrical Connections
David VanDerKamp, Licensing Manager  
Closed
Marshall VanWinkle, Design Engineering Mechanical Supervisor  
05000298/2007-006-00         LER     Procedural Guidance Leads to Rendering Second Diesel
Dave Werner, Operations Training Support Supervisor  
                                      Inoperable
05000298/2007-007-00         LER     Damaged Lead on Emergency Filter System Fan Motor
                                      Results in Loss of Safety Function
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED  
Opened and Closed
05000298/2008002-01           NCV     Failure to Follow Scaffold Inspection Procedures
Opened  
                                LIST OF DOCUMENTS REVIEWED
05000298/2008002-02  
The following is a partial list of documents reviewed during the inspection. Inclusion on this list
AV  
does not imply that the NRC inspector reviewed the documents in their entirety, but rather that
Failure to Establish Adequate Procedures for Maintenance of  
selected sections or portions of the documents were evaluated as part of the overall inspection
Emergency Diesel Generator Electrical Connections  
                                                  A1-1                                Attachment 1
Closed  
05000298/2007-006-00  
LER  
Procedural Guidance Leads to Rendering Second Diesel  
Inoperable  
05000298/2007-007-00  
LER  
Damaged Lead on Emergency Filter System Fan Motor  
Results in Loss of Safety Function  
Opened and Closed  
05000298/2008002-01  
NCV  
Failure to Follow Scaffold Inspection Procedures  
LIST OF DOCUMENTS REVIEWED  
The following is a partial list of documents reviewed during the inspection. Inclusion on this list  
does not imply that the NRC inspector reviewed the documents in their entirety, but rather that  
selected sections or portions of the documents were evaluated as part of the overall inspection  


effort. Inclusion of a document on this list does not imply NRC acceptance of the document or
any part of it, unless this is stated in the body of the inspection report.
1R07: Heat Sink Performance
A1-2
Condition Report
Attachment 1
CR-CNS-2008-00029
effort. Inclusion of a document on this list does not imply NRC acceptance of the document or  
Procedures
any part of it, unless this is stated in the body of the inspection report.  
Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger
Performance Analysis, Revision 27
1R07: Heat Sink Performance
Engineering Procedure 3.34, Heat Exchanger Program, Revision 9
Condition Report  
Work Orders
4592135
CR-CNS-2008-00029  
4592134
Procedures  
1R13: Maintenance Risk Assessments and Emergent Work Control
Procedures
Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger  
EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2
Performance Analysis, Revision 27  
GOP 2.1.11, Station Operator Tours, Revision 127
Procedure 0.49, Schedule Risk Assessment, Revision 20
Engineering Procedure 3.34, Heat Exchanger Program, Revision 9  
Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5
Work Order
Work Orders  
WO 4618242
1R19: Post Maintenance Testing
4592135  
Condition Reports
4592134  
CR-CNS-2008-00720
1R13: Maintenance Risk Assessments and Emergent Work Control
CR-CNS-2008-00738
Procedures  
Procedures
SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5
EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2  
6.EE.606, 250 V Battery Charger Performance Test, Revision 19
GOP 2.1.11, Station Operator Tours, Revision 127  
MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5
Procedure 0.49, Schedule Risk Assessment, Revision 20  
MP 7.3.14, Thermal Examination of Plant Components, Revision 7
Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5
                                                  A1-2                            Attachment 1
Work Order  
WO 4618242  
1R19: Post Maintenance Testing  
Condition Reports  
CR-CNS-2008-00720  
CR-CNS-2008-00738  
Procedures  
SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5  
6.EE.606, 250 V Battery Charger Performance Test, Revision 19  
MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5  
MP 7.3.14, Thermal Examination of Plant Components, Revision 7  


Work Orders
WO 4523441
WO 4532270
A1-3
WO 4541631
Attachment 1
WO 4532754
Work Orders  
WO 4581466
1R22: Surveillance Testing
WO 4523441  
Condition Report
WO 4532270  
CR-CNS-02007-06517
WO 4541631  
Procedures
WO 4532754  
6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing
WO 4581466  
Test, Revision 12
T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0
1R22: Surveillance Testing
T.S. Sec 5.5.6, CNS IST Program
Condition Report  
6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24
EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23
CR-CNS-02007-06517  
CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2
DCD-01, p. B-12, Revision dated October 28, 2006
Procedures  
SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47
6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16
6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing  
SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52
Test, Revision 12  
Work Order
T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0  
WO 4578012
T.S. Sec 5.5.6, CNS IST Program  
                                  LIST OF ACRONYMS USED
6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24  
ASME           American Society of Mechanical Engineers
EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23  
AV             apparent violation
CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2  
CAP           corrective action program
DCD-01, p. B-12, Revision dated October 28, 2006  
CFR           Code of Federal Regulations
SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47  
CR             condition reports
6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16  
DG             diesel generator
SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52  
HX             heat exchange(r)
LCO           limiting condition for operation
Work Order  
LER           licensee event report
NCV           noncited violation
WO 4578012  
PI             performance indicator
PMT           postmaintenance testing
LIST OF ACRONYMS USED  
REC           uranium hexafluoride
ASME
RHR           residual heat removal
American Society of Mechanical Engineers  
TS             Technical Specification
AV  
UFSAR         Updated Final Safety Analysis Report
WO             work order
apparent violation  
                                                A1-3                            Attachment 1
CAP  
corrective action program  
CFR  
Code of Federal Regulations  
CR  
condition reports  
DG  
diesel generator  
HX  
heat exchange(r)  
LCO  
limiting condition for operation  
LER  
licensee event report  
NCV  
noncited violation  
PI  
performance indicator  
PMT  
postmaintenance testing  
REC  
uranium hexafluoride  
RHR  
residual heat removal  
TS  
Technical Specification  
UFSAR  
Updated Final Safety Analysis Report  
WO  
work order  


                                      Cooper Nuclear Station
                              Failure of EDG 2 Speed Sensing Circuit
                                      SDP Phase 3 Analysis
A2-1
Performance Deficiency:
Attachment 2
Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was
Cooper Nuclear Station  
caused by a failure of an amphenol connection on the EDG speed sensing circuit.
Failure of EDG 2 Speed Sensing Circuit  
Assumptions:
SDP Phase 3 Analysis  
1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only
  during times that the diesel generator was running; specifically in response to the vibration
Performance Deficiency:
  of the operating engine. There is no assumption of accelerated degradation associated with
  diesel starts or any degradation while the unit was in standby. It is further assumed that the
Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was  
  failure was a deterministic outcome set to occur after a specific number of operating hours.
caused by a failure of an amphenol connection on the EDG speed sensing circuit.  
  The diesel was run at the following times:
  09/13/07 - ran for 2 hrs 15 min
Assumptions:  
  10/15/07 - ran for 5 hrs 45 min
  11/13/07 - ran for 5 hrs 21 min
1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only  
  12/10/07 - ran for 5 hrs 51 min
during times that the diesel generator was running; specifically in response to the vibration  
  01/14/08 - ran for 5 hrs 21 min (1700)
of the operating engine. There is no assumption of accelerated degradation associated with  
  01/15/08 - failure less than one minute after starting
diesel starts or any degradation while the unit was in standby. It is further assumed that the  
  01/16/08- EDG 2 restored to a functional status (1700)
failure was a deterministic outcome set to occur after a specific number of operating hours.  
  Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP
  demand, or it was inoperable for maintenance, during the two-day period from January 14 to
The diesel was run at the following times:  
  January 16, 2008.
  Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours following a
09/13/07 - ran for 2 hrs 15 min  
  LOOP demand at any time during the 35-day period from its last successful surveillance test
10/15/07 - ran for 5 hrs 45 min  
  on December 10, 2007 until the test failure that occurred on January 14, 2008.
11/13/07 - ran for 5 hrs 21 min  
  Prior to this date, EDG 2 would have run and failed at 11.2 hours during the 27-day period
12/10/07 - ran for 5 hrs 51 min  
  from November 13, 2007 to December 10, 2007.
01/14/08 - ran for 5 hrs 21 min (1700)  
  Prior to this date, EDG 2 would have run and failed at 16.5 hours during the 29-day period
01/15/08 - failure less than one minute after starting  
  from October 15, 2007 to November 13, 2007.
01/16/08- EDG 2 restored to a functional status (1700)                
  Prior to this date, EDG 2 would have failed to run at 22.3 hours during the 32-day period
  from September 13, 2007 to October 15, 2007.
Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP  
  Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed
demand, or it was inoperable for maintenance, during the two-day period from January 14 to  
  sensing circuit failure for at least 24 hours, the mission time assumed in the SPAR model.
January 16, 2008.  
  Therefore, prior to this date no additional risk impact is assumed.
2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the
Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours following a  
  outcome of any of the SPAR core damage sequences, the longest of which is 11 hours (as
LOOP demand at any time during the 35-day period from its last successful surveillance test  
  modified by an extension to the battery duration (assumption #3). Adjustments made to the
on December 10, 2007 until the test failure that occurred on January 14, 2008.  
                                                A2-1                                Attachment 2
Prior to this date, EDG 2 would have run and failed at 11.2 hours during the 27-day period  
from November 13, 2007 to December 10, 2007.
Prior to this date, EDG 2 would have run and failed at 16.5 hours during the 29-day period  
from October 15, 2007 to November 13, 2007.  
Prior to this date, EDG 2 would have failed to run at 22.3 hours during the 32-day period  
from September 13, 2007 to October 15, 2007.  
Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed  
sensing circuit failure for at least 24 hours, the mission time assumed in the SPAR model.
Therefore, prior to this date no additional risk impact is assumed.  
2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the  
outcome of any of the SPAR core damage sequences, the longest of which is 11 hours (as  
modified by an extension to the battery duration (assumption #3). Adjustments made to the  


    performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG
    CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,
    unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,
A2-2
    including a very small contribution from the action steps of repairing the amphenol
Attachment 2
    connection and re-starting the EDG, which are relatively simple.
performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG  
    The following table presents the diagnosis tabulation:
CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,  
                            Diagnosis (0.01)   Multiplier   Action (0.001)   Multiplier
unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,  
Available Time               Expansive         0.01         Nominal           1
including a very small contribution from the action steps of repairing the amphenol  
Stress                       Extreme           5           High             2
connection and re-starting the EDG, which are relatively simple.  
Complexity                   High               5           Nominal           1
Experience/Training         Nominal           1           Nominal           1
The following table presents the diagnosis tabulation:  
Procedures                   Not Available     50           Nominal           1
Ergonomics                   Poor               10           Nominal           1
Product of Multipliers                         125                           2
Diagnosis (0.01)  
Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558
Multiplier  
Action HEP = 0.001(2) = 0.002
Action (0.001)  
Total HEP = 0.56
Multiplier  
    For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit
Available Time  
    failure applies to sequences of 4 hours or greater. The only sequence that is less than 4
Expansive  
    hours is a 30 minute sequence, for which no recovery of the amphenol connection is
0.01  
    assumed.
Nominal  
    The SPAR model does not distinguish between cutsets that contain two or just one EDG
1  
    failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely
Stress  
    to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in
Extreme  
    this analysis, this feature of the SPAR model is not altered
5  
3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge
High  
    capability following a station blackout. Based on information received from the licensee, this
2  
    credit was extended to 11 hours. Although the batteries could potentially function beyond
Complexity  
    11 hours under certain conditions other challenges related to the operation of RCIC and
High  
    HPCI in station blackout conditions would be present. These challenges include the
5  
    availability of adequate injection supply water and operational concerns of RCIC under high
Nominal  
    back pressure conditions as a result of the unavailability of suppression pool cooling during
1  
    an extended station blackout event.
Experience/Training  
4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to
Nominal  
    operate for the period of time before it is assumed to fail from the connector failure during
1  
    the various exposure periods. This introduces a slight inconsistency to the risk estimate, but
Nominal  
    because it would similarly affect both the base and current case, it does not significantly
1  
    influence the result of this analysis.
Procedures  
5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed
Not Available  
    to be independent in nature. The reason for this determination is based on the following
50  
                                                A2-2                                  Attachment 2
Nominal  
1  
Ergonomics  
Poor  
10  
Nominal  
1  
Product of Multipliers  
125  
2  
Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558  
Action HEP = 0.001(2) = 0.002  
Total HEP = 0.56  
For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit  
failure applies to sequences of 4 hours or greater. The only sequence that is less than 4
hours is a 30 minute sequence, for which no recovery of the amphenol connection is  
assumed.  
The SPAR model does not distinguish between cutsets that contain two or just one EDG  
failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely  
to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in  
this analysis, this feature of the SPAR model is not altered  
3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge  
capability following a station blackout. Based on information received from the licensee, this  
credit was extended to 11 hours. Although the batteries could potentially function beyond  
11 hours under certain conditions other challenges related to the operation of RCIC and  
HPCI in station blackout conditions would be present. These challenges include the  
availability of adequate injection supply water and operational concerns of RCIC under high  
back pressure conditions as a result of the unavailability of suppression pool cooling during  
an extended station blackout event.  
4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to  
operate for the period of time before it is assumed to fail from the connector failure during  
the various exposure periods. This introduces a slight inconsistency to the risk estimate, but  
because it would similarly affect both the base and current case, it does not significantly  
influence the result of this analysis.  
5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed  
to be independent in nature.   The reason for this determination is based on the following  


    reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine
    vibration while the EDG was running. Historically, EDG 2 has experienced vibration
    problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the
A2-3
    amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very
Attachment 2
    unlikely that this type of failure would occur on both EDGs at the same time. The fact that it
reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine  
    took 7 years of operation for EDG 2 to reach the point of failure also points to the
vibration while the EDG was running. Historically, EDG 2 has experienced vibration  
    unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the
problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the  
    exposure period of this finding.
amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very  
    Even if both EDGs were determined to be vulnerable to a speed sensor amphenol
unlikely that this type of failure would occur on both EDGs at the same time. The fact that it  
    connection failure, there was no mechanism that would tend to cause both EDGs to fail
took 7 years of operation for EDG 2 to reach the point of failure also points to the  
    simultaneously. That is, the failure of one amphenol connection would not make failure of
unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the  
    the other one more likely. Therefore, for this case, the failure of both EDGs from this issue
exposure period of this finding.
    would mathematically be modeled by the combined independent failures of both EDGs
    instead of by a classic common cause coupling mechanism. For this case, the estimated
Even if both EDGs were determined to be vulnerable to a speed sensor amphenol  
    probability of an independent failure of EDG 1 from a failed amphenol connection during the
connection failure, there was no mechanism that would tend to cause both EDGs to fail  
    exposure period would be a small number compared to its baseline SPAR fail-to-run
simultaneously. That is, the failure of one amphenol connection would not make failure of  
    probability and therefore this application would not appreciably affect the final result.
the other one more likely. Therefore, for this case, the failure of both EDGs from this issue  
    Finally, if EDG 1 had experienced problems with this connection, thereby making it
would mathematically be modeled by the combined independent failures of both EDGs  
    comparatively vulnerable to the same type of failure; it is likely that the licensee would have
instead of by a classic common cause coupling mechanism. For this case, the estimated  
    taken more aggressive actions to address this issue, seeing that it affected both trains of
probability of an independent failure of EDG 1 from a failed amphenol connection during the  
    emergency power. Therefore, the conditions necessary to create the possibility of a
exposure period would be a small number compared to its baseline SPAR fail-to-run  
    common cause failure would also have triggered actions to prevent it.
probability and therefore this application would not appreciably affect the final result.  
The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A
cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.
Finally, if EDG 1 had experienced problems with this connection, thereby making it  
The model was revised by INL to increase the battery life to 11 hours, as discussed above. In
comparatively vulnerable to the same type of failure; it is likely that the licensee would have  
addition, the timing of various sequences was lengthened based on data provided by the
taken more aggressive actions to address this issue, seeing that it affected both trains of  
licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),
emergency power. Therefore, the conditions necessary to create the possibility of a  
with an HEP of 0.15. However, based on observations by the senior resident inspector, the
common cause failure would also have triggered actions to prevent it.  
analyst concluded that credit for firewater injection should not be granted. This is because
barely enough time was available to perform the necessary actions and a valve that must be
The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A  
opened to establish a flow path was non-functional with a stem-disk separation for the entire
cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.  
period of exposure. There were other valves that could have been used in alternate lineups, but
it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure
The model was revised by INL to increase the battery life to 11 hours, as discussed above. In  
the flow path.
addition, the timing of various sequences was lengthened based on data provided by the  
Also, changes were made to the containment venting fault tree. In the original version, a loss of
licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),  
Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the
with an HEP of 0.15. However, based on observations by the senior resident inspector, the  
vent function is possible by taking manual local actions to open the vent valves. The failure
analyst concluded that credit for firewater injection should not be granted. This is because  
probability of this action was estimated based on an observed evolution conducted in response
barely enough time was available to perform the necessary actions and a valve that must be  
to questions concerning this analysis. This observation revealed that the actions needed to
opened to establish a flow path was non-functional with a stem-disk separation for the entire  
perform this function were dangerous and complex and would be conducted in poor lighting and
period of exposure. There were other valves that could have been used in alternate lineups, but  
high temperatures. Also, operators had little experience. The recovery efforts applied to both a
it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure  
loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic
the flow path.  
events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following
SPAR-H analysis.
Also, changes were made to the containment venting fault tree. In the original version, a loss of  
                                                A2-3                                  Attachment 2
Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the  
vent function is possible by taking manual local actions to open the vent valves. The failure  
probability of this action was estimated based on an observed evolution conducted in response  
to questions concerning this analysis. This observation revealed that the actions needed to  
perform this function were dangerous and complex and would be conducted in poor lighting and  
high temperatures. Also, operators had little experience. The recovery efforts applied to both a  
loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic  
events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following  
SPAR-H analysis.  


The diagnosis of the need to manually vent containment is obvious based on emergency
operating procedures that direct this action when containment pressure reaches 25 psig.
Operators would be continually monitoring this parameter, and it is very unlikely that the effort to
A2-4
manually vent containment would not be undertaken at 25 psig and possibly prior to this point.
Attachment 2
For the action steps, approximately 8 hours of time are available from the time that containment
The diagnosis of the need to manually vent containment is obvious based on emergency  
pressurizes to 25 psig until containment would fail. The nominal time needed to perform the
operating procedures that direct this action when containment pressure reaches 25 psig.
manually venting task is estimated at 2 hours. In this case, the relevant SPAR-H category for
Operators would be continually monitoring this parameter, and it is very unlikely that the effort to  
time is nominal. Extreme stress is chosen because the effort to manually open the vent valves
manually vent containment would not be undertaken at 25 psig and possibly prior to this point.  
involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The
effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to
For the action steps, approximately 8 hours of time are available from the time that containment  
the valves and performing several manipulations. Operators have little experience with this
pressurizes to 25 psig until containment would fail. The nominal time needed to perform the  
evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack
manually venting task is estimated at 2 hours. In this case, the relevant SPAR-H category for  
of lighting.
time is nominal.   Extreme stress is chosen because the effort to manually open the vent valves  
                            Diagnosis (0.01)   Multiplier     Action (0.001)   Multiplier
involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The  
Available Time               Expansive         0.01           Nominal           1
effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to  
Stress                       High               2             Extreme           5
the valves and performing several manipulations. Operators have little experience with this  
Complexity                   Obvious           0.1           Moderate         2
evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack  
Experience/Training         Nominal           1             Low               3
of lighting.  
Procedures                   Nominal           1             Nominal           1
Ergonomics                   Nominal           1             Poor             10
Product of Multipliers                         0.002                           300
Diagnosis (0.01)  
Diagnosis HEP = 0.01(.002) = 2.0E-5
Multiplier  
Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23
Action (0.001)  
Total HEP = 0.23
Multiplier  
To model the failure of the speed sensing circuit and its specific recovery, a new and gate was
Available Time  
added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the
Expansive  
speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of
0.01  
restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are
Nominal  
considered similar to the same for the various prior exposure periods. The common cause
1  
probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets
Stress  
containing the independent failure of EDG 2 contribute to the delta CDF of this finding.
High  
Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG
2  
recovery basic events were removed from cutsets that contained an EDG 2 speed sensor
Extreme  
failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure
5  
to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset
Complexity  
of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery
Obvious  
for those sequences.
0.1  
Internal Events Analysis:
Moderate  
A.       Risk Estimate for the 2-day period between January 14 and January 16, 2006:
2  
        During this 48-hour period, it is assumed that EDG 2 was completely unavailable either
Experience/Training  
        because of maintenance or because it would have failed within one minute after a LOOP
Nominal  
                                                A2-4                                    Attachment 2
1  
Low  
3  
Procedures  
Nominal  
1  
Nominal  
1  
Ergonomics  
Nominal  
1  
Poor  
10  
Product of Multipliers  
0.002  
300  
Diagnosis HEP = 0.01(.002) = 2.0E-5  
Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23  
Total HEP = 0.23  
To model the failure of the speed sensing circuit and its specific recovery, a new and gate was  
added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the  
speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of  
restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are  
considered similar to the same for the various prior exposure periods. The common cause  
probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets  
containing the independent failure of EDG 2 contribute to the delta CDF of this finding.  
Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG  
recovery basic events were removed from cutsets that contained an EDG 2 speed sensor  
failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure  
to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset  
of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery  
for those sequences.
Internal Events Analysis:  
A.  
Risk Estimate for the 2-day period between January 14 and January 16, 2006:  
During this 48-hour period, it is assumed that EDG 2 was completely unavailable either  
because of maintenance or because it would have failed within one minute after a LOOP  


  demand. To represent the assumed failure and potential recovery of EDG 2, the new
  basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was
  set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of
A2-5
  4.172E-4 to ensure that cutsets containing common cause to run events would cancel
Attachment 2
  out in the base and current case.
demand. To represent the assumed failure and potential recovery of EDG 2, the new  
  The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.
basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was  
B. Risk Estimate for the 35-day period between December 10, 2006 and January 14,
set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of  
  2007:
4.172E-4 to ensure that cutsets containing common cause to run events would cancel  
  During this exposure period, EDG 2 is assumed to have been capable of running for
out in the base and current case.  
  5.35 hours. The LOOP frequency used in the analysis was adjusted to reflect the
  situation that only LOOPs with durations greater than 5.35 hours would result in a risk
The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.  
  increase attributable to the speed sensor failure.
  The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is
B.  
  0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours is
Risk Estimate for the 35-day period between December 10, 2006 and January 14,  
  3.99E-3/yr.
2007:  
  Resetting event time t=0 to 5.35 hours following the LOOP event requires that the
  recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
During this exposure period, EDG 2 is assumed to have been capable of running for  
  SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
5.35 hours. The LOOP frequency used in the analysis was adjusted to reflect the  
  recovery at 7.35 hours, given that recovery has failed at 5.35 hours.
situation that only LOOPs with durations greater than 5.35 hours would result in a risk  
  An adjustment to account for the diminishment of decay heat must be considered. This
increase attributable to the speed sensor failure.
  is because the magnitude of decay heat at 5.35 hours following shutdown is less than in
  the early moments following a reactor trip, and the timing of core damage sequences is
The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is  
  affected by this fact. In the modified SPAR model, recovery times for offsite power are
0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours is  
  set at the intervals of 30 minutes, 2 hours, 4 hours, and 10 hours. The analyst
3.99E-3/yr.  
  determined that the average decay heat level in the first 30 minutes is approximately two
  times the average level that exists between 5.35 and 6.35 hours following shutdown.
Resetting event time t=0 to 5.35 hours following the LOOP event requires that the  
  Therefore, baseline 30-minute SPAR model sequences, that essentially account for
recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in  
  boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences
SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
  model safety relief valve failures to close, and are based more on inventory control than
recovery at 7.35 hours, given that recovery has failed at 5.35 hours.  
  core heat production. Therefore, no adjustment was made for these sequences. The
  analyst determined that decay heat rates leveled out quickly following shutdown and
An adjustment to account for the diminishment of decay heat must be considered. This  
  could find no basis for adjusting the times associated with the 4 and 10-hour sequences.
is because the magnitude of decay heat at 5.35 hours following shutdown is less than in  
  The following table presents the adjusted offsite power non-recovery factors for the
the early moments following a reactor trip, and the timing of core damage sequences is  
  event times that are relevant in the SPAR core damage cutsets:
affected by this fact. In the modified SPAR model, recovery times for offsite power are  
                                            A2-5                                Attachment 2
set at the intervals of 30 minutes, 2 hours, 4 hours, and 10 hours. The analyst  
determined that the average decay heat level in the first 30 minutes is approximately two  
times the average level that exists between 5.35 and 6.35 hours following shutdown.
Therefore, baseline 30-minute SPAR model sequences, that essentially account for  
boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences  
model safety relief valve failures to close, and are based more on inventory control than  
core heat production. Therefore, no adjustment was made for these sequences. The  
analyst determined that decay heat rates leveled out quickly following shutdown and  
could find no basis for adjusting the times associated with the 4 and 10-hour sequences.  
The following table presents the adjusted offsite power non-recovery factors for the  
event times that are relevant in the SPAR core damage cutsets:  


        SPAR           SPAR base            SPAR base           SPAR base          Modified
      recovery        offsite power      offsite power        offsite power   SPAR non-
          time        non-recovery       non-recovery at     non-recovery at     recovery
A2-6
                                            5.35 hours          5.35 hours +     (Column 4
Attachment 2
                                                                SPAR recovery       divided by
                                                              time in Column 1     Column 3)
SPAR  
        30 min.           0.7314             0.1112               0.0905 1         0.814
recovery
        4 hours           0.1566             0.1112               0.0554           0.498
time
        5 hours           0.1205             0.1112               0.0487           0.438
SPAR base  
        9 hours           0.05789             0.1112               0.0325           0.292
offsite power  
      11 hours           0.04500             0.1112               0.0278           0.250
non-recovery  
      1. A SPAR recovery time of 1.0 hours is used, as discussed above, to account for the
SPAR base
            lessening of decay heat
offsite power
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
non-recovery at  
      before EDG 2 fails from the speed sensor circuit failure at 5.35 hours, the result for the
5.35 hours 
      base and the current case that contain an EDG 1 FTS event were multiplied by the
SPAR base
      success probability of recovering EDG 1 in 5.35 hours, which was 0.5934 (1- non-
offsite power
      recovery probability). This value was then subtracted to obtain a final result for the base
non-recovery at  
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
5.35 hours +  
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
SPAR recovery  
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
time in Column 1  
      events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours).
Modified
      This then would suggest that the EDG recovery terms in the SPAR model would
SPAR non-
      coincide with the event time t=0 at 5.35 hours following the onset of the LOOP and
recovery
      therefore do not require adjustment.
(Column 4
      The results of this portion of the analysis are presented in the following table:
divided by
                CDF/yr           CDF/35 days     EDG1 FTS           EDG1 FTS       Remaining
Column 3)  
                                                  Recovered          Recovered/35 CDF (column
30 min.  
                                                  (EDG1 FTS          days          3- column 5)
0.7314  
                                                  Cutset total
0.1112  
                                                  times 0.5934)
0.0905 1  
Base Case       6.989E-7         6.702E-8       3.686E-8           3.535E-9       6.348E-8
0.814  
Current Case 1.394E-5             1.337E-6       4.706E-7           4.513E-8       1.292E-6
4 hours  
Delta                                                                               1.229E-6
0.1566  
CDF/35 days
0.1112  
                                                A2-6                                   Attachment 2
0.0554  
0.498  
5 hours  
0.1205  
0.1112  
0.0487  
0.438  
9 hours  
0.05789  
0.1112  
0.0325  
0.292  
11 hours  
0.04500  
0.1112  
0.0278  
0.250  
1. A SPAR recovery time of 1.0 hours is used, as discussed above, to account for the  
lessening of decay heat  
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered  
before EDG 2 fails from the speed sensor circuit failure at 5.35 hours, the result for the  
base and the current case that contain an EDG 1 FTS event were multiplied by the  
success probability of recovering EDG 1 in 5.35 hours, which was 0.5934 (1- non-
recovery probability). This value was then subtracted to obtain a final result for the base  
and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to  
start event before EDG 2 fails from the speed sensor circuit failure will not end in core  
damage. Also, the methodology used effectively assumes that for EDG 1 fail to run  
events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours).
This then would suggest that the EDG recovery terms in the SPAR model would  
coincide with the event time t=0 at 5.35 hours following the onset of the LOOP and  
therefore do not require adjustment.  
The results of this portion of the analysis are presented in the following table:  
CDF/yr  
CDF/35 days  
EDG1 FTS
Recovered
(EDG1 FTS  
Cutset total
times 0.5934)
EDG1 FTS  
Recovered/35  
days
Remaining
CDF (column  
3- column 5)  
Base Case  
6.989E-7  
6.702E-8  
3.686E-8  
3.535E-9  
6.348E-8  
Current Case 1.394E-5  
1.337E-6  
4.706E-7  
4.513E-8  
1.292E-6  
Delta  
CDF/35 days  
1.229E-6  


C. Risk Estimate for the 27-day period between November 13, 2007 and December 10,
  2007:
  During this exposure period, EDG 2 is assumed to have been capable of running for
A2-7
  11.2 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs
Attachment 2
  with durations greater than 11.2 hours would result in a risk increase attributable to the
C.  
  speed sensor failure.
Risk Estimate for the 27-day period between November 13, 2007 and December 10,  
  The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is
2007:  
  0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours is
  1.58E-3/yr.
During this exposure period, EDG 2 is assumed to have been capable of running for  
  Resetting event time t=0 to 11.2 hours following the LOOP event requires that the
11.2 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs  
  recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
with durations greater than 11.2 hours would result in a risk increase attributable to the  
  SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
speed sensor failure.
  recovery at 13.2 hours, given that recovery has failed at 11.2 hours.
  The analyst considered an adjustment to account for the diminishment of decay heat as
The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is  
  in the 5.35-hour case above. The analyst determined that the average decay heat level
0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours is  
  in the first 30 minutes is approximately three times the average level that exists between
1.58E-3/yr.  
  11 and 12 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
  essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.
Resetting event time t=0 to 11.2 hours following the LOOP event requires that the  
  The 2-hour sequences model safety relief valve failures to close, and are based more on
recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in  
  inventory control than core heat production. Therefore, no adjustment was made for
SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
  these sequences. Sequences of 4 and 10 hours were increased by 30 minutes each
recovery at 13.2 hours, given that recovery has failed at 11.2 hours.  
  The following table presents the adjusted offsite power non-recovery factors for the
  event times that are relevant in the SPAR core damage cutsets:
The analyst considered an adjustment to account for the diminishment of decay heat as  
      SPAR           SPAR base          SPAR base         SPAR base          Modified
in the 5.35-hour case above. The analyst determined that the average decay heat level  
    recovery        offsite power        offsite power     offsite power    SPAR non-
in the first 30 minutes is approximately three times the average level that exists between  
      time        non-recovery       non-recovery at   non-recovery at       recovery
11 and 12 hours following shutdown. Therefore, baseline 30-minute SPAR models, that  
                                          11.2 hours        11.2 hours +       (Column 4
essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.
                                                          SPAR recovery       divided by
The 2-hour sequences model safety relief valve failures to close, and are based more on  
                                                        time in Column 1     Column 3)
inventory control than core heat production. Therefore, no adjustment was made for  
    30 min.           0.7314               0.0441             0.0377 1           0.855
these sequences. Sequences of 4 and 10 hours were increased by 30 minutes each  
    4 hours           0.1566               0.0441             0.02922           0.662
    5 hours           0.1205               0.0441             0.02712           0.615
The following table presents the adjusted offsite power non-recovery factors for the  
    9 hours           0.05789             0.0441             0.02122           0.481
event times that are relevant in the SPAR core damage cutsets:  
  11 hours           0.04500             0.0441             0.01912           0.433
      1   A SPAR recovery time of 1.5 hours is used, as discussed above, to account for
          the lessening of decay heat
SPAR  
      2   The SPAR recovery time was increased by 30 minutes.
recovery
                                            A2-7                                Attachment 2
time
SPAR base  
offsite power  
non-recovery  
SPAR base
offsite power
non-recovery at  
11.2 hours 
SPAR base
offsite power
non-recovery at  
11.2 hours +  
SPAR recovery  
time in Column 1  
Modified
SPAR non-
recovery
(Column 4
divided by
Column 3)  
30 min.  
0.7314  
0.0441  
0.0377 1  
0.855  
4 hours  
0.1566  
0.0441  
0.02922  
0.662  
5 hours  
0.1205  
0.0441  
0.02712  
0.615  
9 hours  
0.05789  
0.0441  
0.02122  
0.481  
11 hours  
0.04500  
0.0441  
0.01912  
0.433  
 
1 A SPAR recovery time of 1.5 hours is used, as discussed above, to account for  
the lessening of decay heat  
2 The SPAR recovery time was increased by 30 minutes.


      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
      before EDG 2 fails from the speed sensor circuit failure at 11.2 hours, the result for the
      base and the current case that contain an EDG 1 FTS event were multiplied by the
A2-8
      success probability of recovering EDG 1 in 11.2 hours, which was 0.7907 (1- non-
Attachment 2
      recovery probability). This value was then subtracted to obtain a final result for the base
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered  
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
before EDG 2 fails from the speed sensor circuit failure at 11.2 hours, the result for the  
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
base and the current case that contain an EDG 1 FTS event were multiplied by the  
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
success probability of recovering EDG 1 in 11.2 hours, which was 0.7907 (1- non-
      events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours).
recovery probability). This value was then subtracted to obtain a final result for the base  
      This then would suggest that the EDG recovery terms in the SPAR model would
and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to  
      coincide with the event time t=0 at 11.2 hours following the onset of the LOOP and
start event before EDG 2 fails from the speed sensor circuit failure will not end in core  
      therefore do not require adjustment.
damage. Also, the methodology used effectively assumes that for EDG 1 fail to run  
      The results of this portion of the analysis are presented in the following table:
events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours).
                CDF/yr         CDF/27 days     EDG1 FTS         EDG1 FTS         Remaining
This then would suggest that the EDG recovery terms in the SPAR model would  
                                                  Recovered        Recovered/27 CDF (column
coincide with the event time t=0 at 11.2 hours following the onset of the LOOP and  
                                                  (EDG1 FTS        days              3- column 5)
therefore do not require adjustment.  
                                                  Cutset total
                                                  times 0.7907)
Base Case       4.332E-7       3.204E-8         3.168E-8         2.343E-9         2.970E-8
The results of this portion of the analysis are presented in the following table:  
Current Case 9.216E-6           6.817E-7         4.216E-7         3.119E-8         6.505E-7
Delta                                                                               6.208E-7
CDF/27 days
CDF/yr  
D.     Risk Estimate for the 29-day period between October 15, 2007 and November 13,
CDF/27 days  
      2007:
EDG1 FTS  
      During this exposure period, EDG 2 is assumed to have been capable of running for
Recovered
      16.5 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs
(EDG1 FTS
      with durations greater than 16.5 hours would result in a risk increase attributable to the
Cutset total
      speed sensor failure.
times 0.7907)
      The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is
EDG1 FTS  
      0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours is
Recovered/27  
      9.87E-4/yr.
days
      Resetting event time t=0 to 16.5 hours following the LOOP event requires that the
Remaining
      recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
CDF (column  
      SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
3- column 5)  
      recovery at 18.5 hours, given that recovery has failed at 16.5 hours.
Base Case  
      The analyst considered an adjustment to account for the diminishment of decay heat as
4.332E-7  
      in the 5.35-hour case above. The analyst determined that the average decay heat level
3.204E-8  
      in the first 30 minutes is approximately four times the average level that exists between
3.168E-8  
      16 and 17 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
2.343E-9  
      essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The
2.970E-8  
                                                A2-8                                  Attachment 2
Current Case 9.216E-6  
6.817E-7  
4.216E-7  
3.119E-8  
6.505E-7  
Delta  
CDF/27 days
6.208E-7  
D.  
Risk Estimate for the 29-day period between October 15, 2007 and November 13,  
2007:  
During this exposure period, EDG 2 is assumed to have been capable of running for  
16.5 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs  
with durations greater than 16.5 hours would result in a risk increase attributable to the  
speed sensor failure.
The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is  
0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours is  
9.87E-4/yr.  
Resetting event time t=0 to 16.5 hours following the LOOP event requires that the  
recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in  
SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
recovery at 18.5 hours, given that recovery has failed at 16.5 hours.  
The analyst considered an adjustment to account for the diminishment of decay heat as  
in the 5.35-hour case above. The analyst determined that the average decay heat level  
in the first 30 minutes is approximately four times the average level that exists between  
16 and 17 hours following shutdown. Therefore, baseline 30-minute SPAR models, that  
essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The  


      2-hour sequences model safety relief valve failures to close, and are based more on
      inventory control than core heat production. Therefore, no adjustment was made for
      these sequences. Sequences of 4 and 10 hours were increased by 60 minutes each
A2-9
      The following table presents the adjusted offsite power non-recovery factors for the
Attachment 2
      event times that are relevant in the SPAR core damage cutsets:
2-hour sequences model safety relief valve failures to close, and are based more on  
        SPAR         SPAR base            SPAR base            SPAR base         Modified
inventory control than core heat production. Therefore, no adjustment was made for  
      recovery        offsite power      offsite power         offsite power    SPAR non-
these sequences. Sequences of 4 and 10 hours were increased by 60 minutes each  
          time        non-recovery       non-recovery at     non-recovery at     recovery
                                            16.5 hours          16.5 hours +     (Column 4
The following table presents the adjusted offsite power non-recovery factors for the  
                                                              SPAR recovery       divided by
event times that are relevant in the SPAR core damage cutsets:  
                                                              time in Column 1     Column 3)
        30 min.           0.7314             0.0275               0.02411           0.876
        4 hours           0.1566             0.0275               0.02032           0.738
SPAR  
      5 hours           0.1205             0.0275               0.01922           0.698
recovery
        9 hours           0.05789             0.0275               0.01602           0.582
time
      11 hours           0.04500             0.0275               0.01482           0.538
SPAR base  
      1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the
offsite power  
      lessening of decay heat
non-recovery  
      2. The SPAR recovery time was increased by 60 minutes.
SPAR base
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
offsite power
      before EDG 2 fails from the speed sensor circuit failure at 16.5 hours, the result for the
non-recovery at  
      base and the current case that contain an EDG 1 FTS event were multiplied by the
16.5 hours 
      success probability of recovering EDG 1 in 16.5 hours, which was 0.8760 (1- non-
SPAR base
      recovery probability). This value was then subtracted to obtain a final result for the base
offsite power
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
non-recovery at  
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
16.5 hours +  
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
SPAR recovery  
      events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours).
time in Column 1  
      This then would suggest that the EDG recovery terms in the SPAR model would
Modified
      coincide with the event time t=0 at 16.5 hours following the onset of the LOOP and
SPAR non-
      therefore do not require adjustment.
recovery
      The results of this portion of the analysis are presented in the following table:
(Column 4
              CDF/yr           CDF/29 days     EDG1 FTS           EDG1 FTS       Remaining
divided by
                                                Recovered          Recovered/29 CDF (column
Column 3)  
                                                (EDG1 FTS          days          3- column 5)
30 min.  
                                                Cutset total
0.7314  
                                                times 0.8760)
0.0275  
Base Case     3.263E-7         2.593E-8       2.675E-8           2.125E-9       2.380E-8
0.02411  
                                              A2-9                                  Attachment 2
0.876  
4 hours  
0.1566  
0.0275  
0.02032  
0.738  
5 hours  
0.1205  
0.0275  
0.01922  
0.698  
9 hours  
0.05789  
0.0275  
0.01602  
0.582  
11 hours  
0.04500  
0.0275  
0.01482  
0.538  
1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the  
lessening of decay heat  
2. The SPAR recovery time was increased by 60 minutes.
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered  
before EDG 2 fails from the speed sensor circuit failure at 16.5 hours, the result for the  
base and the current case that contain an EDG 1 FTS event were multiplied by the  
success probability of recovering EDG 1 in 16.5 hours, which was 0.8760 (1- non-
recovery probability). This value was then subtracted to obtain a final result for the base  
and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to  
start event before EDG 2 fails from the speed sensor circuit failure will not end in core  
damage. Also, the methodology used effectively assumes that for EDG 1 fail to run  
events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours).
This then would suggest that the EDG recovery terms in the SPAR model would  
coincide with the event time t=0 at 16.5 hours following the onset of the LOOP and  
therefore do not require adjustment.  
The results of this portion of the analysis are presented in the following table:  
CDF/yr  
CDF/29 days  
EDG1 FTS  
Recovered
(EDG1 FTS
Cutset total
times 0.8760)
EDG1 FTS  
Recovered/29  
days
Remaining
CDF (column  
3- column 5)  
Base Case  
3.263E-7  
2.593E-8  
2.675E-8  
2.125E-9  
2.380E-8  


Current Case 7.071E-6             5.618E-7         3.601E-7         2.861E-8       5.332E-7
Delta                                                                               5.094E-7
CDF/29 days
A2-10
E.   Risk Estimate for the 32-day period between September 13, 2007 and October 15,
Attachment 2
      2007:
Current Case 7.071E-6  
      During this exposure period, EDG 2 is assumed to have been capable of running for 22.3
5.618E-7  
      hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with
3.601E-7  
      durations greater than 22.3 hours would result in a risk increase attributable to the speed
2.861E-8  
      sensor failure.
5.332E-7  
      The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is
      0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours is
Delta  
      6.98E-4/yr.
CDF/29 days
      Resetting event time t=0 to 22.3 hours following the LOOP event requires that the
      recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
      SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
      recovery at 24.3 hours, given that recovery has failed at 22.3 hours.
      The analyst considered an adjustment to account for the diminishment of decay heat as in
5.094E-7  
      the 5.35-hour case above. The analyst determined that the average decay heat level in the
      first 30 minutes is approximately four times the average level that exists between 22 and
      23 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
E.  
      essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-
Risk Estimate for the 32-day period between September 13, 2007 and October 15,  
      hour sequences model safety relief valve failures to close, and are based more on
2007:  
      inventory control than core heat production. Therefore, no adjustment was made for these
      sequences. Sequences of 4 and 10 hours were increased by 60 minutes each
During this exposure period, EDG 2 is assumed to have been capable of running for 22.3  
      The following table presents the adjusted offsite power non-recovery factors for the event
hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with  
      times that are relevant in the SPAR core damage cutsets:
durations greater than 22.3 hours would result in a risk increase attributable to the speed  
          SPAR         SPAR base            SPAR base        SPAR base           Modified
sensor failure.
        recovery        offsite power       offsite power      offsite power    SPAR non-
            time        non-recovery       non-recovery at   non-recovery at       recovery
The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is  
                                              22.3 hours        22.3 hours +     (Column 4
0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours is  
                                                              SPAR recovery       divided by
6.98E-4/yr.  
                                                              time in Column 1     Column 3)
          30 min.           0.7314               0.0194             0.0177 1           0.912
Resetting event time t=0 to 22.3 hours following the LOOP event requires that the  
          4 hours           0.1566               0.0194             0.01692           0.871
recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in  
        5 hours           0.1205               0.0194             0.01492           0.768
SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
          9 hours           0.05789             0.0194             0.01342           0.691
recovery at 24.3 hours, given that recovery has failed at 22.3 hours.  
        11 hours           0.04500             0.0194             0.01272           0.655
                                                A2-10                                Attachment 2
The analyst considered an adjustment to account for the diminishment of decay heat as in  
the 5.35-hour case above. The analyst determined that the average decay heat level in the  
first 30 minutes is approximately four times the average level that exists between 22 and  
23 hours following shutdown. Therefore, baseline 30-minute SPAR models, that  
essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-
hour sequences model safety relief valve failures to close, and are based more on  
inventory control than core heat production. Therefore, no adjustment was made for these  
sequences. Sequences of 4 and 10 hours were increased by 60 minutes each  
The following table presents the adjusted offsite power non-recovery factors for the event  
times that are relevant in the SPAR core damage cutsets:  
SPAR  
recovery
time
SPAR base  
offsite power  
non-recovery  
SPAR base
offsite power
non-recovery at  
22.3 hours 
SPAR base
offsite power
non-recovery at  
22.3 hours +  
SPAR recovery  
time in Column 1  
Modified
SPAR non-
recovery
(Column 4
divided by
Column 3)  
30 min.  
0.7314  
0.0194  
0.0177 1  
0.912  
4 hours  
0.1566  
0.0194  
0.01692  
0.871  
5 hours  
0.1205  
0.0194  
0.01492  
0.768  
9 hours  
0.05789  
0.0194  
0.01342  
0.691  
11 hours  
0.04500  
0.0194  
0.01272  
0.655  


          1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the
          lessening of decay heat
          2. The SPAR recovery time was increased by 60 minutes.
A2-11
    To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
Attachment 2
    before EDG 2 fails from the speed sensor circuit failure at 22.3 hours, the result for the base
1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the  
    and the current case that contain an EDG 1 FTS event were multiplied by the success
lessening of decay heat  
    probability of recovering EDG 1 in 22.3 hours, which was 0.9267 (1- non-recovery
2. The SPAR recovery time was increased by 60 minutes.
    probability). This value was then subtracted to obtain a final result for the base and current
    case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered  
    before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,
before EDG 2 fails from the speed sensor circuit failure at 22.3 hours, the result for the base  
    the methodology used effectively assumes that for EDG 1 fail to run events, the failure
and the current case that contain an EDG 1 FTS event were multiplied by the success  
    occurs more or less at the same time that EDG 2 fails (22.3 hours). This then would
probability of recovering EDG 1 in 22.3 hours, which was 0.9267 (1- non-recovery  
    suggest that the EDG recovery terms in the SPAR model would coincide with the event time
probability). This value was then subtracted to obtain a final result for the base and current  
    t=0 at 22.3 hours following the onset of the LOOP and therefore do not require adjustment.
case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event  
        The results of this portion of the analysis are presented in the following table:
before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,  
                  CDF/yr           CDF/32 days     EDG1 FTS         EDG1 FTS         Remaining
the methodology used effectively assumes that for EDG 1 fail to run events, the failure  
                                                  Recovered        Recovered/32 CDF (column
occurs more or less at the same time that EDG 2 fails (22.3 hours). This then would  
                                                  (EDG1 FTS        days              3- column 5)
suggest that the EDG recovery terms in the SPAR model would coincide with the event time  
                                                  Cutset total
t=0 at 22.3 hours following the onset of the LOOP and therefore do not require adjustment.  
                                                  times 0.9267)
Base Case         2.745E-7         2.407E-8       2.402E-8         2.106E-9         2.196E-8
The results of this portion of the analysis are presented in the following table:  
Current Case 6.033E-6             5.289E-7       3.262E-7           2.860E-8         5.003E-7
Delta                                                                                 4.783E-7
CDF/32 days
CDF/yr  
The following table presents the aggregate internal events result:
CDF/32 days  
        TIME PERIOD                     DAYS OF EXPOSURE                       DELTA CDF
EDG1 FTS  
      01/14/08 - 01/16/08                         2                             1.528E-7
Recovered
      12/10/07 - 01/14/08                         35                             1.229E-6
(EDG1 FTS
      11/13/07 - 12/10/07                         27                             6.208E-7
Cutset total
      10/15/07 - 11/13/07                         29                             5.094E-7
times 0.9267)
      09/13/07 - 10/15/07                         32                             4.783E-7
EDG1 FTS  
                Total Internal Events Delta-CDF                                 2.990E-6
Recovered/32  
External Events Analysis:
days
The risk increase from fire initiating events was reviewed and determined to have a small impact
Remaining
on the risk of the finding. Two fire scenarios were identified where equipment damage could
CDF (column  
cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a
3- column 5)  
control room fire that affected either Vertical Board F or Board C. The second was a fire in the
Base Case  
Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote
2.745E-7  
because of the confined specificity of their locations and the fact that a combination of hot shorts
2.407E-8  
of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced
2.402E-8  
in this manner would be likely to succeed for the station blackout sequences that comprise the
2.106E-9  
majority of the risk, because a minimum of 11 hours of battery power would be available, power
2.196E-8  
                                                A2-11                                  Attachment 2
Current Case 6.033E-6  
5.289E-7  
3.262E-7  
2.860E-8  
5.003E-7  
Delta  
CDF/32 days
4.783E-7  
The following table presents the aggregate internal events result:  
TIME PERIOD  
DAYS OF EXPOSURE  
DELTA CDF  
01/14/08 - 01/16/08  
2  
1.528E-7  
12/10/07 - 01/14/08  
35  
1.229E-6  
11/13/07 - 12/10/07  
27  
6.208E-7  
10/15/07 - 11/13/07  
29  
5.094E-7  
09/13/07 - 10/15/07  
32  
4.783E-7  
Total Internal Events Delta-CDF  
2.990E-6  
External Events Analysis:  
The risk increase from fire initiating events was reviewed and determined to have a small impact  
on the risk of the finding. Two fire scenarios were identified where equipment damage could  
cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a  
control room fire that affected either Vertical Board F or Board C. The second was a fire in the  
Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote  
because of the confined specificity of their locations and the fact that a combination of hot shorts  
of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced  
in this manner would be likely to succeed for the station blackout sequences that comprise the  
majority of the risk, because a minimum of 11 hours of battery power would be available, power  


would presumably be available in the switchyard, and the breaker manipulations needed to
complete this task would be possible and within the capability of an augmented plant staff that
would respond to the event.
A2-12
Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2
Attachment 2
power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no
would presumably be available in the switchyard, and the breaker manipulations needed to  
change in risk from the finding.
complete this task would be possible and within the capability of an augmented plant staff that  
The other type of fires that would result in a LOOP are those that require an evacuation of the
would respond to the event.  
control room. In this case, plant procedures require offsite power to be isolated from the vital
buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With
Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2  
the assumption that the Division 2 EDG will fail 5.35 hours into the event, a station blackout
power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no  
would occur at this time. The sequences that could lead to core damage would include a failure
change in risk from the finding.  
of the Division 1 EDG, such that ultimate success in averting core damage would rely on
recovery of either EDG or of offsite power. A review of the onsite electrical distribution system
The other type of fires that would result in a LOOP are those that require an evacuation of the  
did not reveal any particular difficulties in restoring switchyard power to the vital buses in this
control room. In this case, plant procedures require offsite power to be isolated from the vital  
scenario, especially given that many hours are available to accomplish this task. The licensee
buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With  
confirmed that for all postulated fire scenarios that would require evacuation of the control room,
the assumption that the Division 2 EDG will fail 5.35 hours into the event, a station blackout  
a undamaged and available power pathway exists from the switchyard through the emergency
would occur at this time. The sequences that could lead to core damage would include a failure  
transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish
of the Division 1 EDG, such that ultimate success in averting core damage would rely on  
this task would take only a few minutes.
recovery of either EDG or of offsite power. A review of the onsite electrical distribution system  
In general, the fire risk importance for this finding is small compared to that associated with
did not reveal any particular difficulties in restoring switchyard power to the vital buses in this  
internal events because onsite fires do not remove the availability of offsite power in the
scenario, especially given that many hours are available to accomplish this task. The licensee  
switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is
confirmed that for all postulated fire scenarios that would require evacuation of the control room,  
presumed to occur as a consequence of such events as severe weather or significant electrical
a undamaged and available power pathway exists from the switchyard through the emergency  
grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially
transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish  
non-functional (no run time remaining) is small because of a very low initiating event probability.
this task would take only a few minutes.  
The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact
on overall plant risk. When adjusted for the exposure period of this finding, the cumulative
In general, the fire risk importance for this finding is small compared to that associated with  
baseline core damage frequency for the zones that had the potential for a control room
internal events because onsite fires do not remove the availability of offsite power in the  
evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was
switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is  
approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used
presumed to occur as a consequence of such events as severe weather or significant electrical  
several bounding assumptions. The analyst qualitatively assumed that the increase in risk from
grid failures.   Also, the fire risk corresponding the two-day period when EDG 2 was essentially  
having EDG 2 in a status where it is assumed to fail at 5.35 hours would likely be somewhat
non-functional (no run time remaining) is small because of a very low initiating event probability.  
less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated
by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours is
The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact  
well less than 10 percent. Based on these considerations, the analyst concluded that the risk
on overall plant risk. When adjusted for the exposure period of this finding, the cumulative  
related to fires would not be sufficiently large to change the risk characterization of this finding.
baseline core damage frequency for the zones that had the potential for a control room  
The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.
evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was  
As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope
approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used  
of the seismic risk particular to this finding. The generic median earthquake acceleration
several bounding assumptions. The analyst qualitatively assumed that the increase in risk from  
assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at
having EDG 2 in a status where it is assumed to fail at 5.35 hours would likely be somewhat  
Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency
less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated  
assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered
by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours is  
by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is
well less than 10 percent. Based on these considerations, the analyst concluded that the risk  
capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an
related to fires would not be sufficiently large to change the risk characterization of this finding.  
earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would
remove offsite power but not damage other equipment important to safe shutdown. In the
The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.
                                                  A2-12                                Attachment 2
As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope  
of the seismic risk particular to this finding. The generic median earthquake acceleration  
assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at  
Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency  
assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered  
by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is  
capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an  
earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would  
remove offsite power but not damage other equipment important to safe shutdown. In the  


internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours
duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours
duration would likely have recovery characteristics closely matching that from an earthquake.
A2-13
The ratio between these two frequencies is 44. Based on this, the analyst qualitatively
Attachment 2
concluded that the risk associated with seismic events would be small compared to the internal
internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours  
result.
duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours  
Flooding could be a concern because of the proximity to the Missouri River. However, floods
duration would likely have recovery characteristics closely matching that from an earthquake.  
that would remove offsite power would also likely flood the EDG compartments and therefore
The ratio between these two frequencies is 44. Based on this, the analyst qualitatively  
not result in a significant change to the risk associated with the finding. The switchyard
concluded that the risk associated with seismic events would be small compared to the internal  
elevation is below that of the power block by several feet, but it is not likely that a slight
result.  
inundation of the switchyard would cause a loss of offsite power. The low frequency of floods
within the thin slice of water elevations that would remove offsite power for at least 5.35 hours
Flooding could be a concern because of the proximity to the Missouri River. However, floods  
but not debilitate the diesel generators indicates that external flooding would not add
that would remove offsite power would also likely flood the EDG compartments and therefore  
appreciably to the risk of this finding.
not result in a significant change to the risk associated with the finding. The switchyard  
Based on the above, the analyst determined that external events did not add significantly to the
elevation is below that of the power block by several feet, but it is not likely that a slight  
risk of the finding.
inundation of the switchyard would cause a loss of offsite power. The low frequency of floods  
Large Early Release Frequency:
within the thin slice of water elevations that would remove offsite power for at least 5.35 hours  
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for
but not debilitate the diesel generators indicates that external flooding would not add  
the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences
appreciably to the risk of this finding.  
to determine an estimate of the change in large early release frequency caused by the finding.
The LERF consequences of this performance deficiency were similar to those documented in a
Based on the above, the analyst determined that external events did not add significantly to the  
previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service
risk of the finding.  
water pumps. The final determination letter was issued on March 31, 2005 and is located in
ADAMS, Accession No. ML050910127. The following excerpt from this document addressed
Large Early Release Frequency:  
the LERF issue:
        The NRC reevaluated the portions of the preliminary significance determination related
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for  
        to the change in LERF. In the regulatory conference, the licensee argued that the
the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences  
        dominant sequences were not contributors to the LERF. Therefore, there was no
to determine an estimate of the change in large early release frequency caused by the finding.
        change in LERF resulting from the subject performance deficiency. Their argument was
        based on the longer than usual core damage sequences, providing for additional time to
The LERF consequences of this performance deficiency were similar to those documented in a  
        core damage, and the relatively short time estimated to evacuate the close in population
previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service  
        surrounding Cooper Nuclear Station.
water pumps. The final determination letter was issued on March 31, 2005 and is located in  
        LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment
ADAMS, Accession No. ML050910127. The following excerpt from this document addressed  
        Integrity Significance Determination Process as: the frequency of those accidents
the LERF issue:  
        leading to significant, unmitigated release from containment in a time frame prior to the
        effective evacuation of the close-in population such that there is a potential for early
The NRC reevaluated the portions of the preliminary significance determination related  
        health effect. The NRC noted that the dominant core damage sequences documented
to the change in LERF. In the regulatory conference, the licensee argued that the  
        in the preliminary significance determination were long sequences that took greater than
dominant sequences were not contributors to the LERF. Therefore, there was no  
        12 hours to proceed to reactor pressure vessel breach. The shortest calculated interval
change in LERF resulting from the subject performance deficiency. Their argument was  
        from the time reactor conditions would have met the requirements for entry into a
based on the longer than usual core damage sequences, providing for additional time to  
        general emergency (requiring the evacuation) until the time of postulated containment
core damage, and the relatively short time estimated to evacuate the close in population  
        rupture was 3.5 hours. The licensee stated that the average evacuation time for Cooper,
surrounding Cooper Nuclear Station.  
        from the declaration of a General Emergency was 62 minutes.
                                                A2-13                                    Attachment 2
LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment  
Integrity Significance Determination Process as: the frequency of those accidents  
leading to significant, unmitigated release from containment in a time frame prior to the  
effective evacuation of the close-in population such that there is a potential for early  
health effect. The NRC noted that the dominant core damage sequences documented  
in the preliminary significance determination were long sequences that took greater than  
12 hours to proceed to reactor pressure vessel breach. The shortest calculated interval  
from the time reactor conditions would have met the requirements for entry into a  
general emergency (requiring the evacuation) until the time of postulated containment  
rupture was 3.5 hours. The licensee stated that the average evacuation time for Cooper,  
from the declaration of a General Emergency was 62 minutes.  


        The NRC determined that, based on a 62-minute average evacuation time, effective
        evacuation of the close-in population could be achieved within 3.5 hours. Therefore, the
        dominant core damage sequences affected by the subject performance deficiency were
A2-14
        not LERF contributors. As such, the NRCs best estimate determination of the change in
Attachment 2
        LERF resulting from the performance deficiency was zero.
The NRC determined that, based on a 62-minute average evacuation time, effective  
In the current analysis, the total contribution of the 30-minute sequences for the 35-day period
evacuation of the close-in population could be achieved within 3.5 hours. Therefore, the  
(when 5.35 hours of EDG run time remained) to the current case CDF is only 0.54% of the total.
dominant core damage sequences affected by the subject performance deficiency were  
That is, almost all of the risk associated with this performance deficiency involves sequences of
not LERF contributors. As such, the NRCs best estimate determination of the change in  
duration 5.35 hours or longer following the loss of all ac power.
LERF resulting from the performance deficiency was zero.  
The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of
these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the
In the current analysis, the total contribution of the 30-minute sequences for the 35-day period  
two-hour sequences comprise only 0.3 percent of the total.
(when 5.35 hours of EDG run time remained) to the current case CDF is only 0.54% of the total.
Consequently, the analyst determined that the risk associated with large early release was very
That is, almost all of the risk associated with this performance deficiency involves sequences of  
small.
duration 5.35 hours or longer following the loss of all ac power.  
References:
SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004
The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of  
GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)
these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the  
Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1
two-hour sequences comprise only 0.3 percent of the total.  
NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of
Loss of Offsite Power Events: 1986-2004"
Consequently, the analyst determined that the risk associated with large early release was very  
Peer Review:
small.  
See-Meng Wong, NRR
References:  
SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004  
GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)  
Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1  
NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of  
Loss of Offsite Power Events: 1986-2004"  
Peer Review:  
See-Meng Wong, NRR  
George McDonald, NRR
George McDonald, NRR
                                                A2-14                                Attachment 2
}}
}}

Latest revision as of 16:53, 14 January 2025

IR 05000298-08-002; on 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications and Postmaintenance Testing
ML081270639
Person / Time
Site: Cooper Entergy icon.png
Issue date: 05/06/2008
From: Chamberlain D
NRC/RGN-IV/DRP
To: Minahan S
Nebraska Public Power District (NPPD)
References
EA-08-124 IR-08-002
Download: ML081270639 (42)
v • d • e


See also: IR 05000298/2008002

Text

May 6, 2008

EA 08-124

Stewart B. Minahan

Vice President - Nuclear and CNO

Nebraska Public Power District

PO Box 98

Brownville NE 68321

SUBJECT:

COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION

REPORT 05000298/2008002

Dear Mr. Minahan:

On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated

inspection at your Cooper Nuclear Station. The enclosed report documents the inspection

results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant

Operations, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and

compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed

personnel.

As described in Section 1R19 of this report, the NRC concluded that the failure to establish

adequate procedural controls for the maintenance of electrical connections on diesel generators

led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety

significance of this finding was assessed on the basis of the best available information, including

influential assumptions, using the applicable Significance Determination Process and was

preliminarily determined to be a White (low to moderate safety significance) finding.

Attachment 2 of this report provides a detailed description of the preliminary risk assessment.

In accordance with NRC Inspection Manual Chapter 0609, Significance Determination

Process, we intend to complete our evaluation using the best available information and issue

our final determination of safety significance within 90 days of this letter.

This finding does not represent an immediate safety concern because of the corrective actions

you have taken. These actions included applying thread locking compound to the amphenol

connections on both diesel generators.

Also, this finding constitutes an apparent violation of NRC requirements and is being

considered for escalated enforcement action in accordance with the NRC Enforcement

Policy. The current Enforcement Policy is included on the NRCs Web site at

http://www.nrc.gov/reading-rm/adams.html. This significance determination process

encourages an open dialog between the staff and the licensee, however the dialogue should not

impact the timeliness of the staffs final determination.

UNITED STATES

NUCLEAR REGULATORY COMMISSION

R E GI ON I V

612 EAST LAMAR BLVD, SUITE 400

ARLINGTON, TEXAS 76011-4125

Nebraska Public Power District

- 2 -

Before we make a final decision on this matter, we are providing you an opportunity (1) to

present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive

at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the

finding to the NRC in writing. If you request a Regulatory Conference, it should be held within

30 days of the receipt of this letter and we encourage you to submit documentation at least one

week prior to the conference in an effort to make the conference more efficient and effective. If

a Regulatory Conference is held, it will be open for public observation. If you decide to submit

only a written response, such submittal should be sent to the NRC within 30 days of the receipt

of this letter. If you decline to request a regulatory conference or submit a written response,

your ability to appeal the final SDP determination can be affected, in that by not doing either you

fail to meet the appeal requirements stated in the prerequisite and limitation sections of

Attachment 2 of IMC 0609.

Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this

letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will

continue with our significance determination and enforcement decision and you will be advised

by separate correspondence of the results of our deliberation on this matter.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being

issued for the inspection finding at this time. In addition, please be advised that the number and

characterization of the apparent violation described in the enclosed inspection report may

change as a result of further NRC review.

The report also documents one finding which was evaluated under the risk SDP as having very

low safety significance (Green). The finding was determined to involve a violation of NRC

requirements. However, because of very low safety significance, and because the issue was

entered into your corrective action program, the NRC is treating the issue as a noncited violation

in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject

or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of

this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory

Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the

Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza

Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector

Office at the Cooper Nuclear Station.

Nebraska Public Power District

- 3 -

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter

and its enclosure will be made available electronically for public inspection in the NRC

Public Document Room or from the Publicly Available Records (PARS) component of

NRCs document system (ADAMS), accessible from the NRC Web site at

http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Dwight D. Chamberlain, Director

Division of Reactor Projects

Docket No:

50-298

License No:

DPR-46

Enclosure:

NRC Inspection Report 05000298/2008002

w/Attachments:

Attachment 1: Supplemental Information

Attachment 2: Preliminary Risk Assessment

cc w/enclosure:

Gene Mace

Nuclear Asset Manager

Nebraska Public Power District

P.O. Box 98

Brownville, NE 68321

John C. McClure, Vice President

and General Counsel

Nebraska Public Power District

P.O. Box 499

Columbus, NE 68602-0499

David Van Der Kamp

Licensing Manager

Nebraska Public Power District

P.O. Box 98

Brownville, NE 68321

Michael J. Linder, Director

Nebraska Department of

Environmental Quality

P.O. Box 98922

Lincoln, NE 68509-8922

Chairman

Nemaha County Board of Commissioners

Nemaha County Courthouse

1824 N Street

Auburn, NE 68305

Julia Schmitt, Manager

Radiation Control Program

Nebraska Health & Human Services

Dept. of Regulation & Licensing

Division of Public Health Assurance

301 Centennial Mall, South

P.O. Box 95007

Lincoln, NE 68509-5007

Nebraska Public Power District

- 4 -

H. Floyd Gilzow

Deputy Director for Policy

Missouri Department of Natural Resources

P. O. Box 176

Jefferson City, MO 65102-0176

Director, Missouri State Emergency

Management Agency

P.O. Box 116

Jefferson City, MO 65102-0116

Chief, Radiation and Asbestos

Control Section

Kansas Department of Health

and Environment

Bureau of Air and Radiation

1000 SW Jackson, Suite 310

Topeka, KS 66612-1366

Melanie Rasmussen, State Liaison Officer/

Radiation Control Program Director

Bureau of Radiological Health

Iowa Department of Public Health

Lucas State Office Building, 5th Floor

321 East 12th Street

Des Moines, IA 50319

John F. McCann, Director, Licensing

Entergy Nuclear Northeast

Entergy Nuclear Operations, Inc.

440 Hamilton Avenue

White Plains, NY 10601-1813

Keith G. Henke, Planner

Division of Community and Public Health

Office of Emergency Coordination

930 Wildwood, P.O. Box 570

Jefferson City, MO 65102

Paul V. Fleming, Director of Nuclear

Safety Assurance

Nebraska Public Power District

P.O. Box 98

Brownville, NE 68321

Ronald L. McCabe, Chief

Technological Hazards Branch

National Preparedness Division

DHS/FEMA

9221 Ward Parkway

Suite 300

Kansas City, MO 64114-3372

Nebraska Public Power District

- 5 -

Electronic distribution by RIV:

Regional Administrator (Elmo.Collins@nrc.gov)

DRP Director (Dwight.Chamberlain@nrc.gov)

DRS Director (Roy.Caniano@nrc.gov)

DRS Deputy Director (Troy.Pruett@nrc.gov)

Senior Resident Inspector (Nick.Taylor@nrc.gov)

Branch Chief, DRP/C (Rick.Deese@nrc.gov)

Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)

Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

Only inspection reports to the following:

DRS STA (Dale.Powers@nrc.gov)

J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)

P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)

ROPreports

CNS Site Secretary (Sue.Farmer@nrc.gov)

SUNSI Review Completed: WCW ADAMS:  ; Yes No Initials: WCW

Publicly Available

Non-Publicly Available Sensitive

Non-Sensitive

R:\\_REACTORS\\_CNS\\2008\\CN2008-002RP-NHT.doc ML081270639

RIV:SRI:DRP/C RI:DRP/C

SPE:DRP/C

DRS:SRA

C:DRS/OB

C:DRS/EB2

NHTaylor

MLChambers WCWalker

MFRunyan

RELantz

LJSmith

E-Walker

/RA/ E-mailed /RA/

/RA/

/RA/

/RA/

4/24/08

4/23/08

4/24 /08

4/24/08

4/24/08

4/23/08

C:DRS/EB1

C:DRS/PSB

C:DRP/C

ACES:SES

D:DRP

RLBywater

MPShannon

RWDeese

GMVasquez

DDChamberlain

/RA/

/RA/

/RA/

/RA/

4/22/08

4/22/08

4/ /08

4/24/08

5/02/08

OFFICIAL RECORD COPY T=Telephone E=Email F=Fax

- 1 -

Enclosure

U. S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket No:

05000298

License No:

PR-46

Report No:

5000298/2008002

Licensee:

Nebraska Public Power District

Facility:

Cooper Nuclear Station

Location:

PO Box 98, Brownville, NE 68321

Dates:

January 1 through March 22, 2008

Inspectors:

N. Taylor, Senior Resident Inspector

M. Chambers, Resident Inspector

P. Elkmann, Emergency Preparedness Inspector

M. Runyan, Senior Reactor Analyst

Approved by:

D. Chamberlain, Director

Division of Reactor Projects

- 2 -

Enclosure

SUMMARY OF FINDINGS

IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications

and Postmaintenance Testing.

This report covers a three-month period of inspection by resident inspectors and announced

baseline inspections by regional inspectors. The significance of most findings is indicated by

their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance

Determination Process. Findings for which the Significance Determination Process does not

apply may be Green or be assigned a severity level after NRC management review. The NRCs

program for overseeing the safe operation of commercial nuclear power reactors is described in

NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

A.

NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green. The inspectors identified a Green noncited violation of Technical

Specification 5.4.1.a regarding the licensees failure to follow the requirements of

Maintenance Procedure 7.0.7, Scaffolding Construction and Control.

Specifically, licensee personnel failed to inspect all existing scaffolds and failed

to identify multiple scaffolding interactions with safety-related equipment during a

required annual scaffold inspection on January 21, 2008. This issue was

entered Into the licensees corrective action program as Condition

Report CR-CNS-2008-01576.

The finding is more than minor because if left uncorrected the failure to perform

annual scaffold inspections could become a more significant safety concern.

Specifically, annual inspections failed to inspect all existing scaffolds and failed to

identify multiple scaffolding interactions with safety-related equipment. Using the

Manual Chapter 0609, Significance Determination Process, Phase 1

Worksheet, the finding is determined to have a very low safety significance

because it did not result in the loss of function of a Technical Specification

required system for greater than its allowed outage time. The cause of this

finding is related to the human performance crosscutting component of work

practices because maintenance personnel did not follow the requirements of

Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).

TBD. Two examples of a self-revealing apparent violation of Technical

Specification 5.4.1.a were identified regarding the licensees failure to establish

procedural controls for maintenance of electrical connections on essential

equipment. In the first example, the licensee failed to include amphenol

connections within the scope of existing periodic electrical connection inspections

to identify loosening connections. In the second example, the licensee failed to

incorporate internal operating experience into work control procedures to ensure

that diesel generator-mounted amphenol connections were solidly attached

following maintenance. These failures to establish adequate procedural controls

led to the trip of Diesel Generator 2 during testing on January 15, 2008. This

issue was entered into the licensees corrective action program as Condition

Report CR-CNS 2008-00304.

- 3 -

Enclosure

The finding affected the mitigating systems cornerstone and is more than minor

because it is associated with the cornerstone attribute of equipment performance

and affects the associated cornerstone objective to ensure the availability,

reliability, and capability of systems that respond to initiating events to prevent

undesirable consequences. The Phase 1 worksheets in Inspection Manual

Chapter 0609, "Significance Determination Process," were used to conclude that

a Phase 2 analysis was required because the finding represents an actual loss of

safety function of a single train for greater than its Technical Specification

allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, Determining the Significance of

Reactor Inspection Findings for At-Power Situations. Entering the site-specific

pre-solved table with an assumed exposure time of greater than 30 days yielded

a result of red, or very high significance. A Phase 3 analysis conducted by a risk

analyst preliminarily determined the finding to be of white, or low to moderate

significance. The cause of the finding is related to the corrective action

component of the crosscutting area of problem identification and resolution in

that the licensee failed to take appropriate corrective actions for a 2007 NRC

inspection finding which identified inadequate maintenance procedures for

checking the tightness of diesel generator electrical connections (P.1(d))

(Section 71111.19).

B.

Licensee-Identified Violations

No violations of significance were identified.

- 4 -

Enclosure

REPORT DETAILS

Summary of Plant Status

The plant began the inspection period at 100 percent power. On February 19, 2008, the plant

began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from

90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump

motor Generator B. The reactor was returned to full power later in the day, where it remained

for the rest of the inspection period.

1.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency

Preparedness

1R04 Equipment Alignment (71111.04)

.1

Quarterly Partial System Walkdowns

a.

Inspection Scope

The inspectors selected these systems based on their risk significance relative to the

reactor safety cornerstones at the time they were inspected. The inspectors attempted

to identify any discrepancies that could impact the function of the system, and, therefore,

potentially increase risk. The inspectors reviewed applicable operating procedures,

system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical

Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),

condition reports (CR), and the impact of ongoing work activities on redundant trains of

equipment in order to identify conditions that could have rendered the systems incapable

of performing their intended functions. The inspectors also walked down accessible

portions of the systems to verify system components and support equipment were

aligned correctly and operable. The inspectors examined the material condition of the

components and observed operating parameters of equipment to verify that there were

no obvious deficiencies. The inspectors also verified that the licensee had properly

identified and resolved equipment alignment problems that could cause initiating events

or impact the capability of mitigating systems or barriers and entered them into the

corrective action program (CAP) with the appropriate significance characterization.

Documents reviewed are listed in the attachment.

The inspectors performed partial system walkdowns of the following risk-significant

systems:

January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B

during REC HX A limiting condition for operation (LCO)

February 28, 2008, Service Water Train B during Diesel Generator (DG) LCO

March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO

The inspectors completed three samples.

- 5 -

Enclosure

b.

Findings

No findings of significance were identified.

.2

Semi-Annual Complete System Walkdown

a.

Inspection Scope

On March 11, 2008 the inspectors performed a complete system alignment inspection of

the DG 1 to verify the functional capability of the system. This system was selected

because it was considered both safety-significant and risk-significant in the licensees

probabilistic risk assessment. The inspectors walked down the system to review

mechanical and electrical equipment line ups, electrical power availability, system

pressure and temperature indications, as appropriate, component labeling, component

lubrication, component and equipment cooling, hangers and supports, operability of

support systems, and to ensure that ancillary equipment or debris did not interfere with

equipment operation. A review of a sample of past and outstanding WOs was

performed to determine whether any deficiencies significantly affected the system

function. In addition, the inspectors reviewed the CAP database to ensure that system

equipment alignment problems were being identified and appropriately resolved.

March 11, 2008, DG 1 during DG 2 LCO

Documents reviewed by the inspectors included:

CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel

Generator), Revision 70

These activities constituted one complete system walkdown sample as defined by

Inspection Procedure 71111.04-05.

b.

Findings

No findings of significance were identified.

1R05 Fire Protection (71111.05AQ)

a. Inspection Scope

The inspectors conducted fire protection walkdowns which were focused on availability,

accessibility, and the condition of firefighting equipment.

The inspectors reviewed areas to assess if the licensee had implemented a fire

protection program that adequately controlled combustibles and ignition sources within

the plant, effectively maintained fire detection and suppression capability, maintained

passive fire protection features in good material condition, and had implemented

adequate compensatory measures for out of service, degraded or inoperable fire

protection equipment, systems, or features in accordance with the licensees fire plan.

The inspectors selected fire areas based on their overall contribution to internal fire risk

as documented in the plants Individual Plant Examination of External Events with later

additional insights, their potential to impact equipment which could initiate or mitigate a

- 6 -

Enclosure

plant transient, or their impact on the plants ability to respond to a security event. Using

the documents listed in the attachment, the inspectors verified that fire hoses and

extinguishers were in their designated locations and available for immediate use; that

fire detectors and sprinklers were unobstructed, that transient material loading was

within the analyzed limits; and fire doors, dampers, and penetration seals appeared to

be in satisfactory condition. The inspectors also verified that minor issues identified

during the inspection were entered into the licensees corrective action program.

February 13, 2008, Fire Zone 2C during fuel movement

March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO

March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO

March 15, 2008, Fire Zone 19C Controlled Access Corridor

Documents reviewed by the inspectors included:

CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated

February 28, 2003

CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated

November 5, 2007

These activities constituted four quarterly fire protection inspection samples as defined

by Inspection Procedure 71111.05-05.

b. Findings

No findings of significance were identified.

1R07 Annual Heat Sink Performance (71111.07)

a.

Inspection Scope

The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify

that potential deficiencies did not mask the licensees ability to detect degraded

performance, to identify any common cause issues that had the potential to increase

risk, and to ensure that the licensee was adequately addressing problems that could

result in initiating events that would cause an increase in risk. The inspectors reviewed

the licensees observations as compared against acceptance criteria, the correlation of

scheduled testing and the frequency of testing, and the impact of instrument

inaccuracies on test results. Inspectors also verified that test acceptance criteria

considered differences between test conditions, design conditions, and testing

conditions.

January 25 and January 21, 2008, A and B REC HX performance tests

Documents reviewed are listed in the attachment.

This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.

- 7 -

Enclosure

b.

Findings

No findings of significance were identified.

1R11 Licensed Operator Requalification Program (71111.11)

Conformance With Simulator Requirements Specified in 10 CFR 55.46

a.

Inspection Scope

The inspectors observed testing and training of senior reactor operators and reactor

operators to identify deficiencies and discrepancies in the training, to assess operator

performance, and to assess the evaluator's critique. The training scenario involved a

tornado, station blackout and a loss of shutdown cooling.

February 28, 2008, Crew E drill

Documents reviewed by the inspectors included:

Lesson SKL054-01-28, Tornado, Station Blackout, Loss of Shutdown Cooling

The inspectors completed one sample.

b.

Findings

No findings of significance were identified.

1R12 Maintenance Effectiveness (71111.12)

a.

Inspection Scope

The inspectors evaluated degraded performance issues involving the risk significant

systems of events such as where ineffective equipment maintenance has resulted in

valid or invalid automatic actuations of engineered safeguards systems and

independently verified the licensee's actions to address system performance or condition

problems in terms of the following:

implementing appropriate work practices;

identifying and addressing common cause failures;

scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;

characterizing system reliability issues for performance;

charging unavailability for performance;

trending key parameters for condition monitoring;

ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and

- 8 -

Enclosure

verifying appropriate performance criteria for structures, systems, and

components (SSCs) functions classified as (a)(2) or appropriate and adequate

goals and corrective actions for systems classified as (a)(1).

The inspectors assessed performance issues with respect to the reliability, availability,

and condition monitoring of the system. In addition, the inspectors verified maintenance

effectiveness issues were entered into the corrective action program with the appropriate

significance characterization.

March 19, 2008, Reactor protection system (RPS) electronic protection

assembly (EPA) breaker failures January 12, 2008

March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008

Documents reviewed by the inspectors included:

Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1

Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC

This inspection constitutes two quarterly maintenance effectiveness samples as defined

in Inspection Procedure 71111.12-05.

b.

Findings

No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)

a.

Inspection Scope

The inspectors reviewed the licensee's evaluation and management of plant risk for the

maintenance and emergent work activities affecting risk-significant and safety-related

equipment listed below to verify that the appropriate risk assessments were performed

prior to removing equipment for work:

March 6, 2008, Inoperability of both DGs on September 11, 2007

March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008

These activities were selected based on their potential risk significance relative to the

reactor safety cornerstones. As applicable for each activity, the inspectors verified that

risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate

and complete. When emergent work was performed, the inspectors verified that the

plant risk was promptly reassessed and managed. The inspectors reviewed the scope

of maintenance work, discussed the results of the assessment with the licensee's

probabilistic risk analyst or shift technical engineer, and verified plant conditions were

consistent with the risk assessment. The inspectors also reviewed TS requirements and

walked down portions of redundant safety systems, when applicable, to verify risk

analysis assumptions were valid and applicable requirements were met. Documents

reviewed are listed in the attachment.

The inspectors completed two samples.

- 9 -

Enclosure

b.

Findings

No findings of significance were identified.

1R15 Operability Evaluations (71111.15)

a.

Inspection Scope

The inspectors reviewed the following issues:

The inspectors selected these potential operability issues based on the risk-significance

of the associated components and systems. The inspectors evaluated the technical

adequacy of the evaluations to ensure that TS operability was properly justified and the

subject component or system remained available such that no unrecognized increase in

risk occurred. The inspectors compared the operability and design criteria in the

appropriate sections of the TS and UFSAR to the licensees evaluations, to determine

whether the components or systems were operable. Where compensatory measures

were required to maintain operability, the inspectors determined whether the measures

in place would function as intended and were properly controlled. The inspectors

determined, where appropriate, compliance with bounding limitations associated with the

evaluations. Additionally, the inspectors also reviewed a sampling of corrective action

documents to verify that the licensee was identifying and correcting any deficiencies

associated with operability evaluations.

January 14, 2008, DG 2 operability and common cause evaluation for loss of

overspeed governor sightglass during run

January 15, 2008, operability evaluation of control room Board C non-essential

meters without isolation devices in DG 1 and DG 2 essential circuits, on January

14, 2008

February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in

DG 2

March 19, 2008, RPS EPA circuit breakers operability evaluations on

January 25, 2008 and February 6, 2008

This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.

b.

Findings

No findings of significance were identified.

1R18 Plant Modifications (71111.18)

Temporary Modifications

a.

Inspection Scope

The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs

to ensure that temporary alterations and configuration changes to the plant conformed to

- 10 -

Enclosure

these guidance documents and the requirements of 10 CFR 50.59. The inspectors:

(1) verified that the modifications did not have an affect on system operability/availability;

(2) verified that the installations were consistent with modification documents;

(3) ensured that the post-installation test results were satisfactory and that the impacts of

the temporary modifications on permanently installed SSCs were supported by the test;

and (4) verified that appropriate safety evaluations were completed. The inspectors

reviewed the following temporary modifications:

March 19, 2008, Long term scaffolding program review

Documents reviewed by the inspectors included:

Maintenance Procedure 7.0.7, Scaffolding Construction and Control,

Revision 24

The inspectors completed one sample.

b.

Findings

Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a

regarding the licensees failure to follow the requirements of Maintenance Procedure

7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to

inspect all existing scaffolds and failed to identify multiple scaffolding interactions with

safety-related equipment during a required annual scaffold inspection on January 21,

2008.

Description. During pre-outage scaffold inspections on February 7, 2008, the licensee

discovered that some existing scaffolds were not built in accordance with established

procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had

been built in contact with safety-related service water piping, RHR piping, pipe hangers,

electrical conduit and the torus shell. This condition was documented in

CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of

the impacted safety systems, the licensee took actions to remove the non-compliant

scaffold on February 22, 2008, and closed the CR.

The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and

Control, Revision 24, contains the following requirement in Paragraph 3.2:

During the month of January, all erected scaffolds shall have an Industrial

Safety examination performed to ensure compliance with this procedure. This

examination is required prior to placing a new tag and entering the scaffold into

the new calendar year log.

The inspectors also noted that the required annual examination had been completed on

January 21, 2008. The maintenance personnel who conducted the examination in

WO 4552687 documented completion with no discrepancies.

On March 6, 2008, the inspectors questioned licensee management regarding the

performance of the annual scaffold examinations. Specifically, the inspectors asked why

the non-compliant scaffold had not been identified during the required annual scaffold

examinations. Following this meeting, the licensee conducted a scaffolding walkdown to

- 11 -

Enclosure

identify any remaining non-compliances. The following additional violations of

Procedure 7.0.7 were discovered during this walkdown:

Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had

a board in contact with high pressure coolant injection steam line drip

leg piping. Contrary to Procedure 7.0.7, this scaffold had not been

inspected due to a misperception that only long term scaffolds that

had been in place greater than 90 days needed to be inspected. The

licensee documented this condition in CR-CNS-2008-01551.

Scaffold 08-06 was discovered to be in contact with safety-related

conduit and pipe hangers in the torus area. The licensee was unable to

determine when this scaffold had been installed.

Eight examples of non-compliant scaffolding handrails were discovered

in contact with safety system components in the torus area which had

been installed in 2002. This example, documented in

CR-CNS-2008-01563 on March 11, 2008 was not identified by the

annual examination because it was not included in the scaffold log and

was therefore not inspected.

The inspectors determined that Procedure 7.0.7 had been violated during the

January 21, 2008 annual scaffolding examination in that the examiner reviewed only

those scaffolds identified in the scaffolding log as Long Term Permanent versus all

erected scaffolds as required by the procedure. As a result, seven existing scaffolds

were not inspected, despite the fact that some of them had been installed for more than

one year at the time of the inspection. In addition, the examiner did not conduct a

thorough inspection to ensure compliance with this procedure. Obvious non-

compliances existed in some of the installed scaffolds that were not identified until

months later.

The inspectors also noted that since handrails built from scaffolding materials do not

meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an

elevated platform, no annual inspections have been performed on these structures.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,

Scaffolding Construction and Control. The finding is more than minor because if left

uncorrected the failure to perform annual scaffold inspections could become a more

significant safety concern. Specifically, annual inspections failed to inspect all existing

scaffolds and failed to identify multiple scaffolding interactions with safety-related

equipment. Using the Manual Chapter 0609, Significance Determination Process,

Phase 1 Worksheet, the finding is determined to have a very low safety significance

because it did not result in the loss of function of a TS required system for greater than

its allowed outage time. The cause of this finding is related to the human performance

crosscutting component of work practices because maintenance personnel did not follow

the requirements of Maintenance Procedure 7.0.7 (H.4(b)).

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,

and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,

Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,

- 12 -

Enclosure

requires that maintenance that can affect the performance of safety-related equipment

should be properly pre-planned and performed in accordance with written procedures.

Contrary to this requirement, on January 21, 2008, maintenance personnel violated the

requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in

that they did not inspect all required scaffolds or identify obvious non-compliances with

Procedure 7.0.7. Because the finding is of very low safety significance and has been

entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated

as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.

1R19 Postmaintenance Testing (71111.19)

a.

Inspection Scope

These activities were selected based upon the SSCs ability to impact risk. The

inspectors evaluated these activities for the following (as applicable): the effect of testing

on the plant had been adequately addressed; testing was adequate for the maintenance

performed; acceptance criteria were clear and demonstrated operational readiness; test

instrumentation was appropriate; tests were performed as written in accordance with

properly reviewed and approved procedures; equipment was returned to its operational

status following testing (temporary modifications or jumpers required for test

performance were properly removed after test completion), and test documentation was

properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10

CFR Part 50 requirements, licensee procedures, and various NRC generic

communications to ensure that the test results adequately ensured that the equipment

met the licensing basis and design requirements. In addition, the inspectors reviewed

corrective action documents associated with postmaintenance tests to determine

whether the licensee was identifying problems and entering them in the CAP and that

the problems were being corrected commensurate with their importance to safety.

Documents reviewed are listed in the attachment.

The inspectors reviewed the following postmaintenance activities to verify that

procedures and test activities were adequate to ensure system operability and functional

capability:

March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008

March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008

March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and

thermography

March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008

March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008

The inspectors completed five samples.

- 13 -

Enclosure

b.

Findings

Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical

Connections

Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were

identified regarding the licensees failure to establish procedural controls for

maintenance of electrical connections on essential equipment. In the first example, the

licensee failed to include amphenol connections within the scope of existing periodic

electrical connection inspections to identify loosening connections. In the second

example, the licensee failed to incorporate internal operating experience into work

control procedures to ensure that DG-mounted amphenol connections were solidly

attached following maintenance. These failures to establish adequate procedural

controls led to the trip of DG 2 during testing on January 15, 2008.

Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a

postmaintenance test. The test was being conducted to verify the ability of DG 2 to

perform its safety function following repairs to the overspeed governor oil level sight

glass. The licensee determined that the cause of the trip of DG 2 was a loose

amphenol-type connection on the relay tachometer speed sensing circuit magnetic

pickup.

The licensee determined that this failure was similar in nature to a condition identified

during previous troubleshooting of DG 2. On December 10, 1995, operations personnel

initiated a CR to document that the amphenol connector on a DG mounted magnetic

pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the

licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors

and apply thread locking compound to the amphenol threads to keep the connection

from vibrating loose. The completion of these actions was documented in Minor

Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions

were taken to codify the use of thread locking compounds or other measures to prevent

the amphenol connections from coming unthreaded during engine operation.

During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm

was unexpectedly received, as described in CR 4-13285. Minor Maintenance

WO 003915 was initiated to determine the cause of the unexpected alarm. During

completion of this WO on December 29, 2000, maintenance personnel replaced the

relay tachometer and the associated MPU, and the associated amphenol connection

was disconnected and then reconnected.

In the first example of this performance deficiency, the inspectors determined that the

licensees procedures for performing periodic DG electrical examinations were

inadequate in that they did not include engine-mounted components. Maintenance

Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was

created on September 30, 1988 to perform periodic (once per operating cycle)

preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC

identified an NCV regarding the licensees failure to establish adequate instructions for

emergency DG electrical maintenance (see NRC Special Inspection

Report 05000298/2007007). Two of the three examples described in the NCV dealt with

inadequate work instructions for checking the tightness of electrical connections on DG

system components. In response to this NCV, the licensee initiated Corrective Action #8

- 14 -

Enclosure

under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically

check the DG systems for loose connections. In developing a revision to Maintenance

Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the

licensee made the erroneous assumption that all engine-mounted components have

other maintenance actions that satisfy the intent of the corrective action. As such,

engine-mounted connections were not included in the scope of the inspections in

Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised

procedure was subsequently completed for DG 2 on September 13, 2007. The

assumption was in error and resulted in a recently missed opportunity to discover the

loosening amphenol connection on the DG 2 relay tachometer MPU.

In the second example of this performance deficiency, the licensee determined that the

maintenance procedures used on December 29, 2000 did not contain adequate

guidance to ensure that thread locking compounds or other measures would be utilized

to ensure that the DG amphenol connections did not become unthreaded during engine

operation. The work was not conducted using detailed procedures, and as such the

licensee determined that the amphenol became loose as a result of either inadequate

tightening during the maintenance, or equipment vibration between 2000 and 2008 (due

to thread locking compound not being used), or a combination of both. The licensee has

initiated corrective actions to add the appropriate guidance to Administrative

Procedure 0.40.4, Planning.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to establish procedural controls for maintenance of electrical

connections on essential equipment. In the first example, the licensee failed to include

these amphenol connections within the scope of existing periodic electrical connection

inspections to identify loosening connections. In the second example, the licensee failed

to incorporate internal operating experience into work control procedures to ensure that

DG-mounted amphenol connections were solidly attached following maintenance.

These failures to establish adequate procedural controls led to the trip of DG 2 during

testing on January 15, 2008. The finding is more than minor because it is associated

with the mitigating systems cornerstone attribute of equipment performance and affects

the associated cornerstone objective to ensure the availability, reliability, and capability

of systems that respond to initiating events to prevent undesirable consequences. The

Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"

were used to conclude that a Phase 2 analysis was required because the finding

represents an actual loss of safety function of a single train for greater than its TS

allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor

Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table

with an assumed exposure time of greater than 30 days yielded a result of red, or very

high significance. A Phase 3 analysis conducted by a risk analyst preliminarily

determined the finding to be of white, or low to moderate significance.

The cause of the finding is related to the corrective action component of the crosscutting

area of problem identification and resolution in that the licensee failed to take

appropriate corrective actions for a 2007 NRC inspection finding which identified

inadequate maintenance procedures for checking the tightness of DG electrical

connections (P.1(d)).

- 15 -

Enclosure

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,

and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,

Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),

requires that maintenance affecting performance of safety-related equipment should be

performed in accordance with written procedures. Contrary to this, since December 29,

2000, the licensee used inadequate procedural guidance to reassemble amphenol

connections on DG 2. Additionally, since September 30, 1988, the licensees procedural

guidance for performing periodic electrical inspections has been inadequate in that it did

not check the tightness of engine-mounted amphenol connections. These inadequate

procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue

was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of

the findings final safety significance, this finding is identified as Apparent Violation (AV)05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of

Emergency DG Electrical Connections."

1R22 Surveillance Testing (71111.22)

Routine Surveillance Testing

a.

Inspection Scope

The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that

the three surveillance activities listed below demonstrated that the SSCs tested were

capable of performing their intended safety functions. The inspectors either witnessed

or reviewed test data to verify that the following significant surveillance test attributes

were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)

acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;

(7) test data; (8) testing frequency and method demonstrated TS operability; (9) test

equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code

requirements; (12) engineering evaluations, root causes, and bases for returning tested

SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;

and (14) annunciators and alarms setpoints. The inspectors also verified that the

licensee identified and implemented any needed corrective actions associated with the

surveillance testing.

The inspectors observed in-plant activities and reviewed procedures and associated

records to determine whether: any preconditioning occurred; effects of the testing were

adequately addressed by control room personnel or engineers prior to the

commencement of the testing; acceptance criteria were clearly stated, demonstrated

operational readiness, and were consistent with the system design basis; plant

equipment calibration was correct, accurate, and properly documented; as left setpoints

were within required ranges; the calibration frequency was in accordance with TS, the

UFSAR, procedures, and applicable commitments; measuring and test equipment

calibration was current; test equipment was used within the required range and

accuracy; applicable prerequisites described in the test procedures were satisfied; test

frequencies met TS requirements to demonstrate operability and reliability; tests were

performed in accordance with the test procedures and other applicable procedures;

jumpers and lifted leads were controlled and restored where used; test data and results

were accurate, complete, within limits, and valid; test equipment was removed after

testing; where applicable, test results not meeting acceptance criteria were addressed

with an adequate operability evaluation or the system or component was declared

- 16 -

Enclosure

inoperable; where applicable for safety-related instrument control surveillance tests,

reference setting data were accurately incorporated in the test procedure; where

applicable, actual conditions encountering high resistance electrical contacts were such

that the intended safety function could still be accomplished; prior procedure changes

had not provided an opportunity to identify problems encountered during the

performance of the surveillance or calibration test; equipment was returned to a position

or status required to support the performance of the safety functions; and all problems

identified during the testing were appropriately documented and dispositioned in the

CAP.

The inspectors reviewed the test results for the following activities to determine whether

risk-significant systems and equipment were capable of performing their intended safety

function and to verify testing was conducted in accordance with applicable procedural

and TS requirements:

January 23, 2008, Scram discharge volume vent valve inservice test (IST)

performed January 14, 2008

February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,

2008

March 19, 2008, 6.REC.201 performed January 31, 2008

March 21, 2008, DG 2 monthly operability test performed March 11, 2008

This inspection constitutes four routine surveillance testing samples as defined in

Inspection Procedure 71111.22.

b.

Findings

No findings of significance were identified.

EP4

Emergency Action Level and Emergency Plan Changes (71114.04)

CNS Emergency Plan Revision 53

a.

Inspection Scope

The inspector performed an in-office review of Revision 53 to the Cooper Nuclear

Station Emergency Plan, received January 8, 2008. This revision moved the licensee's

Joint Information Center (emergency news center) from Columbus, Nebraska, to

Auburn, Nebraska, revised position duties in the Emergency Operations Facility and

Joint Information Center, deleted the Technical Information Coordinator (EOF) position,

revised position titles in the Joint Information Center, added a Letter of Agreement

between the licensee and the Nebraska City Fire Department, and revised geographical-

based protective action zones in Missouri, based on an approval letter from Federal

Emergency Management Agency, Region VII, dated October 10, 2007.

This revision was compared to its previous revision, to the criteria of NUREG-0654,

Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and

Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in

- 17 -

Enclosure

10 CFR 50.47(b) to determine if the revision adequately implemented the requirements

of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and

did not constitute approval of licensee changes; therefore, this revision is subject to

future inspection.

The inspectors completed one sample during the inspection.

b.

Findings

No findings of significance were identified.

4.

OTHER ACTIVITIES

4OA1 Performance Indicator (PI) Verification (71151)

.1

Data Submission Review

a.

Inspection Scope

The inspectors performed a review of the data submitted by the licensee for the 4th

Quarter 2007 PIs for any obvious inconsistencies prior to its public release in

accordance with Inspection Manual Chapter 0608, Performance Indicator Program.

This review was performed as part of the inspectors normal plant status activities and,

as such, did not constitute a separate inspection sample.

b.

Findings

No findings of significance were identified.

.2

Unplanned Scrams per 7000 Critical Hours

a.

Inspection Scope

The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical

hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To

determine the accuracy of the PI data reported during those periods, PI definitions and

guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,

Regulatory Assessment Performance Indicator Guideline, were used. The inspectors

reviewed the licensees operator narrative logs, issue reports, event reports and NRC

inspection reports to validate the accuracy of the submittals. The inspectors also

reviewed the licensees issue report database to determine if any problems had been

identified with the PI data collected or transmitted for this indicator and none were

identified.

This inspection constitutes one unplanned scrams per 7000 critical hours sample as

defined by Inspection Procedure 71151.

b.

Findings

No findings of significance were identified.

- 18 -

Enclosure

.3

Unplanned Transients per 7000 Critical Hours

a.

Inspection Scope

The inspectors sampled licensee submittals for the unplanned transients per

7000 critical hours PI for the period from the 1st quarter 2007 through the 4th

quarter 2007. To determine the accuracy of the PI data reported during those periods,

PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute

Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.

The inspectors reviewed the licensees operator narrative logs, issue reports,

maintenance rule records, event reports and NRC integrated Inspection reports to

validate the accuracy of the submittals. The inspectors also reviewed the licensees

issue report database to determine if any problems had been identified with the PI data

collected or transmitted for this indicator and none were identified.

This inspection constitutes one unplanned transients per 7000 critical hours sample as

defined by Inspection Procedure 71151.

b.

Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems (71152)

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency

Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical

Protection

.1

Routine Review of Items Entered Into the CAP

a.

Inspection Scope

The inspectors performed a daily screening of items entered into the licensee's CAP.

This assessment was accomplished by reviewing CRs and WOs and attending

corrective action review and work control meetings. The inspectors: (1) verified that

equipment, human performance, and program issues were being identified by the

licensee at an appropriate threshold and that the issues were entered into the CAP;

(2) verified that corrective actions were commensurate with the significance of the issue;

and (3) identified conditions that might warrant additional followup through other baseline

inspection procedures.

b. Findings

No findings of significance were identified.

.2

Selected Issue Followup Inspection

a. Inspection Scope

In addition to the routine review, the inspectors selected the issues listed below for a

more in-depth review. The inspectors considered the following during the review of the

- 19 -

Enclosure

licensee's actions: (1) complete and accurate identification of the problem in a timely

manner; (2) evaluation and disposition of operability/reportability issues;

(3) consideration of extent of condition, generic implications, common cause, and

previous occurrences; (4) classification and prioritization of the resolution of the problem;

(5) identification of root and contributing causes of the problem; (6) identification of

corrective actions; and (7) completion of corrective actions in a timely manner.

December 27, 2007, loss of both plant monitoring and information system

computers

Documents reviewed by the inspectors included:

Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4

Computer System Operating Procedure 2.6.3, Computer Systems Operation

and Outage Recovery, Revision 23

The inspectors completed one sample.

b.

Findings

No findings of significance were identified.

4OA3 Followup of Events and Notices of Enforcement Discretion (71153)

.1

(Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance

Leads to Rendering Second Diesel Inoperable

On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil

day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,

control room operators received annunciators due to a rising level in the DG 1 fuel oil

day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to

failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel

Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1

inoperable. With DG 2 already inoperable, the control room staff properly entered

Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an

operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

In an effort to restore operability of DG 1, the licensee elected to attempt repair of the

leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing

DG 1 into maintenance lockout and entry into an overall red risk window for the station.

The repair attempt was unsuccessful, and the control room staff subsequently entered

Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4

within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Operability of DG 1 was subsequently restored by closing a fuel oil

system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.

The licensee initiated this LER due to the loss of safety function (on-site emergency

power) that occurred during the corrective maintenance attempt on DG 1. The

inspectors reviewed all aspects of the event, including performance of control room staff,

planning of the associated WOs, evaluation and mitigation of station risk, configuration

control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency

- 20 -

Enclosure

and emergent work, and relationship to previous work on DG 1. A related violation of

NRC requirements is discussed in detail in NRC Integrated Inspection Report 05000298/2007005. This LER is closed.

.2

(Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency

Filter System Fan Motor Results in Loss of Safety Function

During a preventative maintenance inspection on December 3, 2007, licensee

technicians discovered severely overheated motor leads on the Control Room

Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the

damaged motor leads, operations staff declared the fan inoperable and determined that

since CREFS is a single-train safety system, a loss of safety function had occurred.

Immediate action was taken and the degraded booster fan was replaced. CREFS was

returned to an operable status on December 4, 2007. The degraded condition was

determined to have been caused by the improper crimping of the motor lugs by the

manufacturer prior to installation in the plant. No performance deficiencies were

identified during the review of this LER. This LER is closed.

4OA6 Management Meetings

Exit Meeting Summary

On January 15, 2008, a regional inspector conducted a telephonic exit to present the

results of the in-office inspection of licensee changes to the emergency plan to

Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.

The inspector confirmed that proprietary information was not provided or examined

during the inspection.

On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the

results of the in-office inspection of changes to the licensees emergency plan to

Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The

inspector confirmed that proprietary, sensitive, or personal information examined during

the inspection had been returned to the identified custodian.

On April 14, 2008, the resident inspectors presented the inspection results to

Mr. M. Colomb, General Manager of Plant Operations and other members of the

licensee staff. The licensee acknowledged the issues presented. The inspectors asked

the licensee whether any materials examined during the inspection should be

considered proprietary. No proprietary information was identified.

A1-1

Attachment 1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

John Austin, Manager, Emergency Preparedness Manager

Mark Bergmeier, Operations Support Group Supervisor

Vasant Bhardwaj, Engineering Support Manager

Michael Boyce, Director of Projects

Daniel Buman, System Engineering Manager

Michael Colomb, General Manager of Plant Operations

Jeff Ehlers, Engineer, Electric Systems/I&C

Roman Estrada, Corrective Action and Assessments Manager

Jim Flaherty, Senior Staff Licensing Engineer

Paul Fleming, Director of Nuclear Safety Assurance

Scott Freborg, Valves Engineering Programs Supervisor

Gabe Gardner, Design Engineering Civil Engineering Supervisor

Gary Kline, Director of Engineering

Dave Madsen, Licensing Engineer

Mark F Metzger, Engineer, Electric Systems/I&C

Ole Olson, Engineer, Engineering Support & Risk Management

Raymond Rexroad, Engineer, Electric Systems/I&C

Todd Stevens, Manager-Design Engineering

Mark Unruh, Senior Staff Engineer

David VanDerKamp, Licensing Manager

Marshall VanWinkle, Design Engineering Mechanical Supervisor

Dave Werner, Operations Training Support Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened 05000298/2008002-02

AV

Failure to Establish Adequate Procedures for Maintenance of

Emergency Diesel Generator Electrical Connections

Closed

05000298/2007-006-00

LER

Procedural Guidance Leads to Rendering Second Diesel

Inoperable

05000298/2007-007-00

LER

Damaged Lead on Emergency Filter System Fan Motor

Results in Loss of Safety Function

Opened and Closed 05000298/2008002-01

NCV

Failure to Follow Scaffold Inspection Procedures

LIST OF DOCUMENTS REVIEWED

The following is a partial list of documents reviewed during the inspection. Inclusion on this list

does not imply that the NRC inspector reviewed the documents in their entirety, but rather that

selected sections or portions of the documents were evaluated as part of the overall inspection

A1-2

Attachment 1

effort. Inclusion of a document on this list does not imply NRC acceptance of the document or

any part of it, unless this is stated in the body of the inspection report.

1R07: Heat Sink Performance

Condition Report

CR-CNS-2008-00029

Procedures

Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger

Performance Analysis, Revision 27

Engineering Procedure 3.34, Heat Exchanger Program, Revision 9

Work Orders

4592135

4592134

1R13: Maintenance Risk Assessments and Emergent Work Control

Procedures

EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2

GOP 2.1.11, Station Operator Tours, Revision 127

Procedure 0.49, Schedule Risk Assessment, Revision 20

Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5

Work Order

WO 4618242

1R19: Post Maintenance Testing

Condition Reports

CR-CNS-2008-00720

CR-CNS-2008-00738

Procedures

SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5

6.EE.606, 250 V Battery Charger Performance Test, Revision 19

MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5

MP 7.3.14, Thermal Examination of Plant Components, Revision 7

A1-3

Attachment 1

Work Orders

WO 4523441

WO 4532270

WO 4541631

WO 4532754

WO 4581466

1R22: Surveillance Testing

Condition Report

CR-CNS-02007-06517

Procedures

6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing

Test, Revision 12

T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0

T.S. Sec 5.5.6, CNS IST Program

6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24

EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23

CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2

DCD-01, p. B-12, Revision dated October 28, 2006

SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47

6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16

SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52

Work Order

WO 4578012

LIST OF ACRONYMS USED

ASME

American Society of Mechanical Engineers

AV

apparent violation

CAP

corrective action program

CFR

Code of Federal Regulations

CR

condition reports

DG

diesel generator

HX

heat exchange(r)

LCO

limiting condition for operation

LER

licensee event report

NCV

noncited violation

PI

performance indicator

PMT

postmaintenance testing

REC

uranium hexafluoride

RHR

residual heat removal

TS

Technical Specification

UFSAR

Updated Final Safety Analysis Report

WO

work order

A2-1

Attachment 2

Cooper Nuclear Station

Failure of EDG 2 Speed Sensing Circuit

SDP Phase 3 Analysis

Performance Deficiency:

Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was

caused by a failure of an amphenol connection on the EDG speed sensing circuit.

Assumptions:

1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only

during times that the diesel generator was running; specifically in response to the vibration

of the operating engine. There is no assumption of accelerated degradation associated with

diesel starts or any degradation while the unit was in standby. It is further assumed that the

failure was a deterministic outcome set to occur after a specific number of operating hours.

The diesel was run at the following times:

09/13/07 - ran for 2 hrs 15 min

10/15/07 - ran for 5 hrs 45 min

11/13/07 - ran for 5 hrs 21 min

12/10/07 - ran for 5 hrs 51 min

01/14/08 - ran for 5 hrs 21 min (1700)

01/15/08 - failure less than one minute after starting

01/16/08- EDG 2 restored to a functional status (1700)

Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP

demand, or it was inoperable for maintenance, during the two-day period from January 14 to

January 16, 2008.

Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following a

LOOP demand at any time during the 35-day period from its last successful surveillance test

on December 10, 2007 until the test failure that occurred on January 14, 2008.

Prior to this date, EDG 2 would have run and failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the 27-day period

from November 13, 2007 to December 10, 2007.

Prior to this date, EDG 2 would have run and failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during the 29-day period

from October 15, 2007 to November 13, 2007.

Prior to this date, EDG 2 would have failed to run at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during the 32-day period

from September 13, 2007 to October 15, 2007.

Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed

sensing circuit failure for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the mission time assumed in the SPAR model.

Therefore, prior to this date no additional risk impact is assumed.

2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the

outcome of any of the SPAR core damage sequences, the longest of which is 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> (as

modified by an extension to the battery duration (assumption #3). Adjustments made to the

A2-2

Attachment 2

performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG

CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,

unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,

including a very small contribution from the action steps of repairing the amphenol

connection and re-starting the EDG, which are relatively simple.

The following table presents the diagnosis tabulation:

Diagnosis (0.01)

Multiplier

Action (0.001)

Multiplier

Available Time

Expansive

0.01

Nominal

1

Stress

Extreme

5

High

2

Complexity

High

5

Nominal

1

Experience/Training

Nominal

1

Nominal

1

Procedures

Not Available

50

Nominal

1

Ergonomics

Poor

10

Nominal

1

Product of Multipliers

125

2

Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558

Action HEP = 0.001(2) = 0.002

Total HEP = 0.56

For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit

failure applies to sequences of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or greater. The only sequence that is less than 4

hours is a 30 minute sequence, for which no recovery of the amphenol connection is

assumed.

The SPAR model does not distinguish between cutsets that contain two or just one EDG

failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely

to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in

this analysis, this feature of the SPAR model is not altered

3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge

capability following a station blackout. Based on information received from the licensee, this

credit was extended to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Although the batteries could potentially function beyond

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> under certain conditions other challenges related to the operation of RCIC and

HPCI in station blackout conditions would be present. These challenges include the

availability of adequate injection supply water and operational concerns of RCIC under high

back pressure conditions as a result of the unavailability of suppression pool cooling during

an extended station blackout event.

4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to

operate for the period of time before it is assumed to fail from the connector failure during

the various exposure periods. This introduces a slight inconsistency to the risk estimate, but

because it would similarly affect both the base and current case, it does not significantly

influence the result of this analysis.

5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed

to be independent in nature. The reason for this determination is based on the following

A2-3

Attachment 2

reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine

vibration while the EDG was running. Historically, EDG 2 has experienced vibration

problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the

amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very

unlikely that this type of failure would occur on both EDGs at the same time. The fact that it

took 7 years of operation for EDG 2 to reach the point of failure also points to the

unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the

exposure period of this finding.

Even if both EDGs were determined to be vulnerable to a speed sensor amphenol

connection failure, there was no mechanism that would tend to cause both EDGs to fail

simultaneously. That is, the failure of one amphenol connection would not make failure of

the other one more likely. Therefore, for this case, the failure of both EDGs from this issue

would mathematically be modeled by the combined independent failures of both EDGs

instead of by a classic common cause coupling mechanism. For this case, the estimated

probability of an independent failure of EDG 1 from a failed amphenol connection during the

exposure period would be a small number compared to its baseline SPAR fail-to-run

probability and therefore this application would not appreciably affect the final result.

Finally, if EDG 1 had experienced problems with this connection, thereby making it

comparatively vulnerable to the same type of failure; it is likely that the licensee would have

taken more aggressive actions to address this issue, seeing that it affected both trains of

emergency power. Therefore, the conditions necessary to create the possibility of a

common cause failure would also have triggered actions to prevent it.

The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A

cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.

The model was revised by INL to increase the battery life to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />, as discussed above. In

addition, the timing of various sequences was lengthened based on data provided by the

licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),

with an HEP of 0.15. However, based on observations by the senior resident inspector, the

analyst concluded that credit for firewater injection should not be granted. This is because

barely enough time was available to perform the necessary actions and a valve that must be

opened to establish a flow path was non-functional with a stem-disk separation for the entire

period of exposure. There were other valves that could have been used in alternate lineups, but

it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure

the flow path.

Also, changes were made to the containment venting fault tree. In the original version, a loss of

Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the

vent function is possible by taking manual local actions to open the vent valves. The failure

probability of this action was estimated based on an observed evolution conducted in response

to questions concerning this analysis. This observation revealed that the actions needed to

perform this function were dangerous and complex and would be conducted in poor lighting and

high temperatures. Also, operators had little experience. The recovery efforts applied to both a

loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic

events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following

SPAR-H analysis.

A2-4

Attachment 2

The diagnosis of the need to manually vent containment is obvious based on emergency

operating procedures that direct this action when containment pressure reaches 25 psig.

Operators would be continually monitoring this parameter, and it is very unlikely that the effort to

manually vent containment would not be undertaken at 25 psig and possibly prior to this point.

For the action steps, approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of time are available from the time that containment

pressurizes to 25 psig until containment would fail. The nominal time needed to perform the

manually venting task is estimated at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In this case, the relevant SPAR-H category for

time is nominal. Extreme stress is chosen because the effort to manually open the vent valves

involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The

effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to

the valves and performing several manipulations. Operators have little experience with this

evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack

of lighting.

Diagnosis (0.01)

Multiplier

Action (0.001)

Multiplier

Available Time

Expansive

0.01

Nominal

1

Stress

High

2

Extreme

5

Complexity

Obvious

0.1

Moderate

2

Experience/Training

Nominal

1

Low

3

Procedures

Nominal

1

Nominal

1

Ergonomics

Nominal

1

Poor

10

Product of Multipliers

0.002

300

Diagnosis HEP = 0.01(.002) = 2.0E-5

Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23

Total HEP = 0.23

To model the failure of the speed sensing circuit and its specific recovery, a new and gate was

added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the

speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of

restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are

considered similar to the same for the various prior exposure periods. The common cause

probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets

containing the independent failure of EDG 2 contribute to the delta CDF of this finding.

Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG

recovery basic events were removed from cutsets that contained an EDG 2 speed sensor

failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure

to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset

of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery

for those sequences.

Internal Events Analysis:

A.

Risk Estimate for the 2-day period between January 14 and January 16, 2006:

During this 48-hour period, it is assumed that EDG 2 was completely unavailable either

because of maintenance or because it would have failed within one minute after a LOOP

A2-5

Attachment 2

demand. To represent the assumed failure and potential recovery of EDG 2, the new

basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was

set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of

4.172E-4 to ensure that cutsets containing common cause to run events would cancel

out in the base and current case.

The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.

B.

Risk Estimate for the 35-day period between December 10, 2006 and January 14,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />. The LOOP frequency used in the analysis was adjusted to reflect the

situation that only LOOPs with durations greater than 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would result in a risk

increase attributable to the speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is

0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

3.99E-3/yr.

Resetting event time t=0 to 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 7.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, given that recovery has failed at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />.

An adjustment to account for the diminishment of decay heat must be considered. This

is because the magnitude of decay heat at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown is less than in

the early moments following a reactor trip, and the timing of core damage sequences is

affected by this fact. In the modified SPAR model, recovery times for offsite power are

set at the intervals of 30 minutes, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The analyst

determined that the average decay heat level in the first 30 minutes is approximately two

times the average level that exists between 5.35 and 6.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown.

Therefore, baseline 30-minute SPAR model sequences, that essentially account for

boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences

model safety relief valve failures to close, and are based more on inventory control than

core heat production. Therefore, no adjustment was made for these sequences. The

analyst determined that decay heat rates leveled out quickly following shutdown and

could find no basis for adjusting the times associated with the 4 and 10-hour sequences.

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

A2-6

Attachment 2

SPAR

recovery

time

SPAR base

offsite power

non-recovery

SPAR base

offsite power

non-recovery at

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

SPAR base

offsite power

non-recovery at

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> +

SPAR recovery

time in Column 1

Modified

SPAR non-

recovery

(Column 4

divided by

Column 3)

30 min.

0.7314

0.1112

0.0905 1

0.814

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

0.1566

0.1112

0.0554

0.498

5 hours

0.1205

0.1112

0.0487

0.438

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />

0.05789

0.1112

0.0325

0.292

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />

0.04500

0.1112

0.0278

0.250

1. A SPAR recovery time of 1.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, which was 0.5934 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr

CDF/35 days

EDG1 FTS

Recovered

(EDG1 FTS

Cutset total

times 0.5934)

EDG1 FTS

Recovered/35

days

Remaining

CDF (column

3- column 5)

Base Case

6.989E-7

6.702E-8

3.686E-8

3.535E-9

6.348E-8

Current Case 1.394E-5

1.337E-6

4.706E-7

4.513E-8

1.292E-6

Delta

CDF/35 days

1.229E-6

A2-7

Attachment 2

C.

Risk Estimate for the 27-day period between November 13, 2007 and December 10,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is

0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is

1.58E-3/yr.

Resetting event time t=0 to 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 13.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, given that recovery has failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level

in the first 30 minutes is approximately three times the average level that exists between

11 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.

The 2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for

these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 30 minutes each

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

SPAR

recovery

time

SPAR base

offsite power

non-recovery

SPAR base

offsite power

non-recovery at

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />

SPAR base

offsite power

non-recovery at

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> +

SPAR recovery

time in Column 1

Modified

SPAR non-

recovery

(Column 4

divided by

Column 3)

30 min.

0.7314

0.0441

0.0377 1

0.855

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

0.1566

0.0441

0.02922

0.662

5 hours

0.1205

0.0441

0.02712

0.615

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />

0.05789

0.0441

0.02122

0.481

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />

0.04500

0.0441

0.01912

0.433

1 A SPAR recovery time of 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is used, as discussed above, to account for

the lessening of decay heat

2 The SPAR recovery time was increased by 30 minutes.

A2-8

Attachment 2

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which was 0.7907 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr

CDF/27 days

EDG1 FTS

Recovered

(EDG1 FTS

Cutset total

times 0.7907)

EDG1 FTS

Recovered/27

days

Remaining

CDF (column

3- column 5)

Base Case

4.332E-7

3.204E-8

3.168E-8

2.343E-9

2.970E-8

Current Case 9.216E-6

6.817E-7

4.216E-7

3.119E-8

6.505E-7

Delta

CDF/27 days

6.208E-7

D.

Risk Estimate for the 29-day period between October 15, 2007 and November 13,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is

0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is

9.87E-4/yr.

Resetting event time t=0 to 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 18.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, given that recovery has failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level

in the first 30 minutes is approximately four times the average level that exists between

16 and 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The

A2-9

Attachment 2

2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for

these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

SPAR

recovery

time

SPAR base

offsite power

non-recovery

SPAR base

offsite power

non-recovery at

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />

SPAR base

offsite power

non-recovery at

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> +

SPAR recovery

time in Column 1

Modified

SPAR non-

recovery

(Column 4

divided by

Column 3)

30 min.

0.7314

0.0275

0.02411

0.876

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

0.1566

0.0275

0.02032

0.738

5 hours

0.1205

0.0275

0.01922

0.698

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />

0.05789

0.0275

0.01602

0.582

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />

0.04500

0.0275

0.01482

0.538

1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, which was 0.8760 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr

CDF/29 days

EDG1 FTS

Recovered

(EDG1 FTS

Cutset total

times 0.8760)

EDG1 FTS

Recovered/29

days

Remaining

CDF (column

3- column 5)

Base Case

3.263E-7

2.593E-8

2.675E-8

2.125E-9

2.380E-8

A2-10

Attachment 2

Current Case 7.071E-6

5.618E-7

3.601E-7

2.861E-8

5.332E-7

Delta

CDF/29 days

5.094E-7

E.

Risk Estimate for the 32-day period between September 13, 2007 and October 15,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for 22.3

hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with

durations greater than 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> would result in a risk increase attributable to the speed

sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is

0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> is

6.98E-4/yr.

Resetting event time t=0 to 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 24.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, given that recovery has failed at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as in

the 5.35-hour case above. The analyst determined that the average decay heat level in the

first 30 minutes is approximately four times the average level that exists between 22 and

23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-

hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for these

sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the event

times that are relevant in the SPAR core damage cutsets:

SPAR

recovery

time

SPAR base

offsite power

non-recovery

SPAR base

offsite power

non-recovery at

22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />

SPAR base

offsite power

non-recovery at

22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> +

SPAR recovery

time in Column 1

Modified

SPAR non-

recovery

(Column 4

divided by

Column 3)

30 min.

0.7314

0.0194

0.0177 1

0.912

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

0.1566

0.0194

0.01692

0.871

5 hours

0.1205

0.0194

0.01492

0.768

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />

0.05789

0.0194

0.01342

0.691

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />

0.04500

0.0194

0.01272

0.655

A2-11

Attachment 2

1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, the result for the base

and the current case that contain an EDG 1 FTS event were multiplied by the success

probability of recovering EDG 1 in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, which was 0.9267 (1- non-recovery

probability). This value was then subtracted to obtain a final result for the base and current

case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event

before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,

the methodology used effectively assumes that for EDG 1 fail to run events, the failure

occurs more or less at the same time that EDG 2 fails (22.3 hours). This then would

suggest that the EDG recovery terms in the SPAR model would coincide with the event time

t=0 at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the onset of the LOOP and therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr

CDF/32 days

EDG1 FTS

Recovered

(EDG1 FTS

Cutset total

times 0.9267)

EDG1 FTS

Recovered/32

days

Remaining

CDF (column

3- column 5)

Base Case

2.745E-7

2.407E-8

2.402E-8

2.106E-9

2.196E-8

Current Case 6.033E-6

5.289E-7

3.262E-7

2.860E-8

5.003E-7

Delta

CDF/32 days

4.783E-7

The following table presents the aggregate internal events result:

TIME PERIOD

DAYS OF EXPOSURE

DELTA CDF

01/14/08 - 01/16/08

2

1.528E-7

12/10/07 - 01/14/08

35

1.229E-6

11/13/07 - 12/10/07

27

6.208E-7

10/15/07 - 11/13/07

29

5.094E-7

09/13/07 - 10/15/07

32

4.783E-7

Total Internal Events Delta-CDF

2.990E-6

External Events Analysis:

The risk increase from fire initiating events was reviewed and determined to have a small impact

on the risk of the finding. Two fire scenarios were identified where equipment damage could

cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a

control room fire that affected either Vertical Board F or Board C. The second was a fire in the

Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote

because of the confined specificity of their locations and the fact that a combination of hot shorts

of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced

in this manner would be likely to succeed for the station blackout sequences that comprise the

majority of the risk, because a minimum of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> of battery power would be available, power

A2-12

Attachment 2

would presumably be available in the switchyard, and the breaker manipulations needed to

complete this task would be possible and within the capability of an augmented plant staff that

would respond to the event.

Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2

power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no

change in risk from the finding.

The other type of fires that would result in a LOOP are those that require an evacuation of the

control room. In this case, plant procedures require offsite power to be isolated from the vital

buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With

the assumption that the Division 2 EDG will fail 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> into the event, a station blackout

would occur at this time. The sequences that could lead to core damage would include a failure

of the Division 1 EDG, such that ultimate success in averting core damage would rely on

recovery of either EDG or of offsite power. A review of the onsite electrical distribution system

did not reveal any particular difficulties in restoring switchyard power to the vital buses in this

scenario, especially given that many hours are available to accomplish this task. The licensee

confirmed that for all postulated fire scenarios that would require evacuation of the control room,

a undamaged and available power pathway exists from the switchyard through the emergency

transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish

this task would take only a few minutes.

In general, the fire risk importance for this finding is small compared to that associated with

internal events because onsite fires do not remove the availability of offsite power in the

switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is

presumed to occur as a consequence of such events as severe weather or significant electrical

grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially

non-functional (no run time remaining) is small because of a very low initiating event probability.

The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact

on overall plant risk. When adjusted for the exposure period of this finding, the cumulative

baseline core damage frequency for the zones that had the potential for a control room

evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was

approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used

several bounding assumptions. The analyst qualitatively assumed that the increase in risk from

having EDG 2 in a status where it is assumed to fail at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would likely be somewhat

less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated

by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

well less than 10 percent. Based on these considerations, the analyst concluded that the risk

related to fires would not be sufficiently large to change the risk characterization of this finding.

The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.

As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope

of the seismic risk particular to this finding. The generic median earthquake acceleration

assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at

Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency

assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered

by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is

capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an

earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would

remove offsite power but not damage other equipment important to safe shutdown. In the

A2-13

Attachment 2

internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

duration would likely have recovery characteristics closely matching that from an earthquake.

The ratio between these two frequencies is 44. Based on this, the analyst qualitatively

concluded that the risk associated with seismic events would be small compared to the internal

result.

Flooding could be a concern because of the proximity to the Missouri River. However, floods

that would remove offsite power would also likely flood the EDG compartments and therefore

not result in a significant change to the risk associated with the finding. The switchyard

elevation is below that of the power block by several feet, but it is not likely that a slight

inundation of the switchyard would cause a loss of offsite power. The low frequency of floods

within the thin slice of water elevations that would remove offsite power for at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

but not debilitate the diesel generators indicates that external flooding would not add

appreciably to the risk of this finding.

Based on the above, the analyst determined that external events did not add significantly to the

risk of the finding.

Large Early Release Frequency:

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for

the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences

to determine an estimate of the change in large early release frequency caused by the finding.

The LERF consequences of this performance deficiency were similar to those documented in a

previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service

water pumps. The final determination letter was issued on March 31, 2005 and is located in

ADAMS, Accession No. ML050910127. The following excerpt from this document addressed

the LERF issue:

The NRC reevaluated the portions of the preliminary significance determination related

to the change in LERF. In the regulatory conference, the licensee argued that the

dominant sequences were not contributors to the LERF. Therefore, there was no

change in LERF resulting from the subject performance deficiency. Their argument was

based on the longer than usual core damage sequences, providing for additional time to

core damage, and the relatively short time estimated to evacuate the close in population

surrounding Cooper Nuclear Station.

LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment

Integrity Significance Determination Process as: the frequency of those accidents

leading to significant, unmitigated release from containment in a time frame prior to the

effective evacuation of the close-in population such that there is a potential for early

health effect. The NRC noted that the dominant core damage sequences documented

in the preliminary significance determination were long sequences that took greater than

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to proceed to reactor pressure vessel breach. The shortest calculated interval

from the time reactor conditions would have met the requirements for entry into a

general emergency (requiring the evacuation) until the time of postulated containment

rupture was 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The licensee stated that the average evacuation time for Cooper,

from the declaration of a General Emergency was 62 minutes.

A2-14

Attachment 2

The NRC determined that, based on a 62-minute average evacuation time, effective

evacuation of the close-in population could be achieved within 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Therefore, the

dominant core damage sequences affected by the subject performance deficiency were

not LERF contributors. As such, the NRCs best estimate determination of the change in

LERF resulting from the performance deficiency was zero.

In the current analysis, the total contribution of the 30-minute sequences for the 35-day period

(when 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> of EDG run time remained) to the current case CDF is only 0.54% of the total.

That is, almost all of the risk associated with this performance deficiency involves sequences of

duration 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> or longer following the loss of all ac power.

The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of

these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the

two-hour sequences comprise only 0.3 percent of the total.

Consequently, the analyst determined that the risk associated with large early release was very

small.

References:

SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004

GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)

Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1

NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of

Loss of Offsite Power Events: 1986-2004"

Peer Review:

See-Meng Wong, NRR

George McDonald, NRR

Retrieved from "https://kanterella.com/w/index.php?title=ML081270639&oldid=5331388"