ML081270639: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
Line 18: Line 18:


=Text=
=Text=
{{#Wiki_filter:May 6, 2008 EA 08-124 Stewart B. Minahan Vice President - Nuclear and CNO  
{{#Wiki_filter:UNITED STATES
Nebraska Public Power District PO Box 98 Brownville NE 68321  
                                NUC LE AR RE G UL AT O RY C O M M I S S I O N
SUBJECT: COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION REPORT 05000298/2008002 Dear Mr. Minahan: On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated inspection at your Cooper Nuclear Station. The enclosed report documents the inspection results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant Operations, and other members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. As described in Section 1R19 of this report, the NRC concluded that the failure to establish adequate procedural controls for the maintenance of electrical connections on diesel generators  
                                                    R E GI ON I V
led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety significance of this finding was assessed on the basis of the best available information, including influential assumptions, using the applicable Significance Determination Process and was preliminarily determined to be a White (low to moderate safety significance) finding. Attachment 2 of this report provides a detailed description of the preliminary risk assessment.
                                        612 EAST LAMAR BLVD , SU I TE 400
In accordance with NRC Inspection Manual Chapter 0609, "Significance Determination Process," we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of this letter.  
                                        AR LI N GTON , TEXAS 76011-4125
This finding does not represent an immediate safety concern because of the corrective actions  
                                              May 6, 2008
you have taken. These actions included applying thread locking compound to the amphenol connections on both diesel generators.  
EA 08-124
Also, this finding constitutes an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy. The current Enforcement Policy is included on the NRC's Web site at http://www.nrc.gov/reading-rm/adams.html. This significance determination process encourages an open dialog between the staff and the licensee, however the dialogue should not impact the timeliness of the staff's final determination.  UNITED STATESNUCLEAR REGULATORY COMMISSIONREGION IV612 EAST LAMAR BLVD, SUITE 400ARLINGTON, TEXAS 76011-4125
Stewart B. Minahan
Nebraska Public Power District - 2 - 
Vice President - Nuclear and CNO
  Before we make a final decision on this matter, we are providing you an opportunity (1) to present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the finding to the NRC in writing.  If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter and we encourage you to submit documentation at least one
Nebraska Public Power District
week prior to the conference in an effort to make the conference more efficient and effective.  If a Regulatory Conference is held, it will be open for public observation.  If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of the receipt of this letter.  If you decline to request a regulatory conference or submit a written response, your ability to appeal the final SDP determination can be affected, in that by not doing either you
PO Box 98
fail to meet the appeal requirements stated in the prerequisite and limitation sections of Attachment 2 of IMC 0609.
Brownville NE 68321
Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this letter to notify the NRC of your intentions.  If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberation on this matter.  
SUBJECT:         COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION
                REPORT 05000298/2008002
Dear Mr. Minahan:
On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated
inspection at your Cooper Nuclear Station. The enclosed report documents the inspection
results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant
Operations, and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and
compliance with the Commissions rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed
personnel.
As described in Section 1R19 of this report, the NRC concluded that the failure to establish
adequate procedural controls for the maintenance of electrical connections on diesel generators
led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety
significance of this finding was assessed on the basis of the best available information, including
influential assumptions, using the applicable Significance Determination Process and was
preliminarily determined to be a White (low to moderate safety significance) finding.
Attachment 2 of this report provides a detailed description of the preliminary risk assessment.
In accordance with NRC Inspection Manual Chapter 0609, Significance Determination
Process, we intend to complete our evaluation using the best available information and issue
our final determination of safety significance within 90 days of this letter.
This finding does not represent an immediate safety concern because of the corrective actions
you have taken. These actions included applying thread locking compound to the amphenol
connections on both diesel generators.
Also, this finding constitutes an apparent violation of NRC requirements and is being
considered for escalated enforcement action in accordance with the NRC Enforcement
Policy. The current Enforcement Policy is included on the NRCs Web site at
http://www.nrc.gov/reading-rm/adams.html. This significance determination process
encourages an open dialog between the staff and the licensee, however the dialogue should not
impact the timeliness of the staffs final determination.


Since the NRC has not made a final determination in this matter, no Notice of Violation is being issued for the inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review.  
Nebraska Public Power District                    -2-
Before we make a final decision on this matter, we are providing you an opportunity (1) to
present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive
at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the
finding to the NRC in writing. If you request a Regulatory Conference, it should be held within
30 days of the receipt of this letter and we encourage you to submit documentation at least one
week prior to the conference in an effort to make the conference more efficient and effective. If
a Regulatory Conference is held, it will be open for public observation. If you decide to submit
only a written response, such submittal should be sent to the NRC within 30 days of the receipt
of this letter. If you decline to request a regulatory conference or submit a written response,
your ability to appeal the final SDP determination can be affected, in that by not doing either you
fail to meet the appeal requirements stated in the prerequisite and limitation sections of
Attachment 2 of IMC 0609.
Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision and you will be advised
by separate correspondence of the results of our deliberation on this matter.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for the inspection finding at this time. In addition, please be advised that the number and
characterization of the apparent violation described in the enclosed inspection report may
change as a result of further NRC review.
The report also documents one finding which was evaluated under the risk SDP as having very
low safety significance (Green). The finding was determined to involve a violation of NRC
requirements. However, because of very low safety significance, and because the issue was
entered into your corrective action program, the NRC is treating the issue as a noncited violation
in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject
or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of
this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory
Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the
Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza
Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.
Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector
Office at the Cooper Nuclear Station.


The report also documents one
Nebraska Public Power District                 -3-
finding which was evaluated under the risk SDP as having very low safety significance (Green).  The finding was determined to involve a violation of NRC requirements.  However, because of very low safety significance, and because the issue was entered into your corrective action program, the NRC is treating the issue as a noncited violation
In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter
in accordance with Section VI. A. 1 of the NRC Enforcement Policy.  If you contest the subject or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN:  Document Control Desk, Washington, DC 20555-0001, with a copy to the Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza
and its enclosure will be made available electronically for public inspection in the NRC
Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector Office at the Cooper Nuclear Station. 
Public Document Room or from the Publicly Available Records (PARS) component of
Nebraska Public Power District - 3 -
NRCs document system (ADAMS), accessible from the NRC Web site at
  In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). Sincerely, /RA/ Dwight D. Chamberlain, Director Division of Reactor Projects Docket No: 50-298 License No: DPR-46 Enclosure: NRC Inspection Report 05000298/2008002 w/Attachments: Attachment 1: Supplemental Information Attachment 2: Preliminary Risk Assessment cc w/enclosure: Gene Mace Nuclear Asset Manager Nebraska Public Power District P.O. Box 98
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Brownville, NE  68321 John C. McClure, Vice President  and General Counsel Nebraska Public Power District P.O. Box 499 Columbus, NE 68602-0499 David Van Der Kamp Licensing Manager Nebraska Public Power District P.O. Box 98 Brownville, NE  68321 Michael J. Linder, Director Nebraska Department of    Environmental Quality P.O. Box 98922 Lincoln, NE 68509-8922 Chairman Nemaha County Board of Commissioners Nemaha County Courthouse 1824 N Street Auburn, NE  68305 Julia Schmitt, Manager Radiation Control Program Nebraska Health & Human Services Dept. of Regulation & Licensing Division of Public Health Assurance  
                                            Sincerely,
301 Centennial Mall, South P.O. Box 95007 Lincoln, NE  68509-5007 
                                            /RA/
Nebraska Public Power District - 4 - 
                                            Dwight D. Chamberlain, Director
   H. Floyd Gilzow Deputy Director for Policy Missouri Department of Natural Resources P. O. Box 176 Jefferson City, MO  65102-0176 Director, Missouri State Emergency    Management Agency P.O. Box 116 Jefferson City, MO  65102-0116 Chief, Radiation and Asbestos  Control Section Kansas Department of Health  and Environment Bureau of Air and Radiation 1000 SW Jackson, Suite 310
                                            Division of Reactor Projects
Topeka, KS  66612-1366 Melanie Rasmussen, State Liaison Officer/  Radiation Control Program Director Bureau of Radiological Health Iowa Department of Public Health Lucas State Office Building, 5th Floor 321 East 12th Street
Docket No:     50-298
Des Moines, IA  50319 John F. McCann, Director, Licensing Entergy Nuclear Northeast Entergy Nuclear Operations, Inc. 440 Hamilton Avenue White Plains, NY  10601-1813 Keith G. Henke, Planner Division of Community and Public Health Office of Emergency Coordination 930 Wildwood, P.O. Box 570 Jefferson City, MO  65102 Paul V.  Fleming, Director of Nuclear  Safety Assurance Nebraska Public Power District P.O. Box 98 Brownville, NE  68321 Ronald L. McCabe, Chief Technological Hazards Branch National Preparedness Division DHS/FEMA 9221 Ward Parkway Suite 300
License No:   DPR-46
Kansas City,  MO  64114-3372 
Enclosure:
Nebraska Public Power District - 5 - 
NRC Inspection Report 05000298/2008002
  Electronic distribution by RIV: Regional Administrator (Elmo.Collins@nrc.gov) DRP Director (Dwight.Chamberlain@nrc.gov) DRS Director (Roy.Caniano@nrc.gov) DRS Deputy Director (Troy.Pruett@nrc.gov) Senior Resident Inspector (Nick.Taylor@nrc.gov) Branch Chief, DRP/C (Rick.Deese@nrc.gov) Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov) Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov) RITS Coordinator (Marisa.Herrera@nrc.gov) 
w/Attachments:
Only inspection reports to the following: DRS STA (Dale.Powers@nrc.gov) J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov) P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov) ROPreports CNS Site Secretary (Sue.Farmer@nrc.gov) 
Attachment 1: Supplemental Information
   
Attachment 2: Preliminary Risk Assessment
   
  cc w/enclosure:
   
                                                                  John C. McClure, Vice President
    SUNSI Review Completed:    WCW      ADAMS:  Yes    No    Initials:    WCW 
   Gene Mace
  Publicly Available  Non-Publicly Available  Sensitive  Non-Sensitive
                                                                    and General Counsel
R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc                                ML081270639 RIV:SRI:DRP/C RI:DRP/C SPE:DRP/C DRS:SRA C:DRS/OB C:DRS/EB2 NHTaylor MLChambers WCWalker MFRunyan RELantz LJSmith E-Walker /RA/ E-maile
  Nuclear Asset Manager
d /RA/ /RA/ /RA/ /RA/ 4/24/08 4/23/08 4/24  /08 4/24/08 4/24/08 4/23/08 C:DRS/EB1 C:DRS/PSB C:DRP/C ACES:SES D:DRP  RLBywater MPShannon RWDeese GMVasquezDDChamberlain  /RA/ /RA/  /RA/ /RA/  4/22/08 4/22/08 4/    /08 4/24/08 5/02/08  OFFICIAL RECORD COPY              T=Telephone            E=Email                F=Fax
                                                                  Nebraska Public Power District
  - 1 - Enclosure
  Nebraska Public Power District
U. S. NUCLEAR REGULATORY COMMISSION REGION IV Docket No: 05000298 License No: PR-46 Report No: 5000298/2008002
                                                                  P.O. Box 499
Licensee: Nebraska Public Power District  Facility: Cooper Nuclear Station Location: PO Box 98, Brownville, NE 68321 Dates: January 1 through March 22, 2008 Inspectors:  N. Taylor, Senior Resident Inspector  M. Chambers, Resident Inspector  P. Elkmann, Emergency Preparedness Inspector  M. Runyan, Senior Reactor Analyst
  P.O. Box 98
Approved by: D. Chamberlain, Director  Division of Reactor Projects
                                                                  Columbus, NE 68602-0499
 
  Brownville, NE 68321
  - 2 - Enclosure SUMMARY OF FINDINGS
  David Van Der Kamp                                             Michael J. Linder, Director
  IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station.  Plant Modifications and Postmaintenance Testing.  This report covers a three-month period of inspection by resident inspectors and announced baseline inspections by regional inspectors.  The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process."  Findings for which the Significance Determination Process does not apply may be Green or be assigned a severity level after NRC management review.  The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006. A. NRC-Identified and Self-Revealing Findings
  Licensing Manager                                             Nebraska Department of
Cornerstone:  Mitigating Systems * Green.  The inspectors identified a Green noncited violation of Technical Specification 5.4.1.a regarding the licensee's failure to follow the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control."  Specifically, licensee personnel failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment during a required annual scaffold inspection on January 21, 2008.  This issue was entered Into the licensee's corrective action program as Condition Report CR-CNS-2008-01576.
  Nebraska Public Power District                                   Environmental Quality
  P.O. Box 98                                                     P.O. Box 98922
The finding is more than minor because if left uncorrected the failure to perform annual scaffold inspections could become a more significant safety concern.  Specifically, annual inspections failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment.  Using the Manual Chapter 0609, "Significance Determination Process," Phase 1
  Brownville, NE 68321                                            Lincoln, NE 68509-8922
Worksheet, the finding is determined to have a very low safety significance because it did not result in the loss of function of a Technical Specification required system for greater than its allowed outage time.  The cause of this finding is related to the human performance crosscutting component of work practices because maintenance personnel did not follow the requirements of
                                                                  Julia Schmitt, Manager
Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).
                                                                  Radiation Control Program
* TBD.  Two examples of a self-revealing apparent violation of Technical Specification 5.4.1.a were identified regarding the licensee's failure to establish procedural controls for maintenance of electrical connections on essential equipment.  In the first example, the licensee failed to include amphenol connections within the scope of existing periodic electrical connection inspections to identify loosening connections.  In the second example, the licensee failed to incorporate internal operating experience into work control procedures to ensure that diesel generator-mounted amphenol connections were solidly attached following maintenance.  These failures to establish adequate procedural controls led to the trip of Diesel Generator 2 during testing on January 15, 2008.  This
  Chairman
issue was entered into the licensee's corrective action program as Condition Report CR-CNS 2008-00304. 
                                                                  Nebraska Health & Human Services
  - 3 - Enclosure
  Nemaha County Board of Commissioners
  The finding affected the mitigating systems cornerstone and is more than minor because it is associated with the cornerstone attribute of equipment performance and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.  The Phase 1 worksheets in Inspection Manual
                                                                  Dept. of Regulation & Licensing
Chapter 0609, "Significance Determination Process," were used to conclude that a Phase 2 analysis was required because the finding represents an actual loss of safety function of a single train for greater than its Technical Specification allowed outage time (7 days).  A Phase 2 risk analysis was conducted using the guidance of Manual Chapter 0609, Appendix A, "Determining the Significance of
  Nemaha County Courthouse
Reactor Inspection Findings for At-Power Situations."  Entering the site-specific pre-solved table with an assumed exposure time of greater than 30 days yielded a result of red, or very high significance.  A Phase 3 analysis conducted by a risk analyst preliminarily determined the finding to be of white, or low to moderate significance.  The cause of the finding is related to the corrective action component of the crosscutting area of problem identification and resolution in that the licensee failed to take appropriate corrective actions for a 2007 NRC
                                                                  Division of Public Health Assurance
inspection finding which identified inadequate maintenance procedures for checking the tightness of diesel generator electrical connections (P.1(d)) (Section 71111.19).
  1824 N Street
B. Licensee-Identified Violations
                                                                  301 Centennial Mall, South
No violations of significance were identified. 
   Auburn, NE 68305
  - 4 - Enclosure REPORT DETAILS
                                                                  P.O. Box 95007
Summary of Plant Status
                                                                  Lincoln, NE 68509-5007
The plant began the inspection period at 100 percent power.  On February 19, 2008, the plant began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from 90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump motor Generator B.  The reactor was returned to full power later in the day, where it remained
for the rest of the inspection period.
1. REACTOR SAFETY Cornerstones:  Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency  Preparedness


1R04 Equipment Alignment (71111.04)
Nebraska Public Power District            -4-
.1 Quarterly Partial System Walkdowns
  H. Floyd Gilzow
  a. Inspection Scope
                                              Director, Missouri State Emergency
The inspectors selected these systems based on their risk significance relative to the reactor safety cornerstones at the time they were inspected.  The inspectors attempted to identify any discrepancies that could impact the function of the system, and, therefore,  
  Deputy Director for Policy
potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs), condition reports (CR), and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable
                                                Management Agency
of performing their intended functions.  The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable.  The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies.  The inspectors also verified that the licensee had properly
  Missouri Department of Natural Resources
identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the corrective action program (CAP) with the appropriate significance characterization.  Documents reviewed are listed in the attachment. The inspectors performed partial system walkdowns of the following risk-significant systems: * January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B during REC HX A limiting condition for operation (LCO)
                                              P.O. Box 116
* February 28, 2008, Service Water Train B during Diesel Generator (DG)  LCO
  P. O. Box 176
* March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO The inspectors completed three samples.  
                                              Jefferson City, MO 65102-0116
  - 5 - Enclosure b. Findings
  Jefferson City, MO 65102-0176
No findings of significance were identified. .2 Semi-Annual Complete System Walkdown
  Chief, Radiation and Asbestos                Melanie Rasmussen, State Liaison Officer/
a. Inspection Scope
   Control Section                              Radiation Control Program Director
On March 11, 2008 the inspectors performed a complete system alignment inspection of the DG 1 to verify the functional capability of the system. This system was selected
  Kansas Department of Health                  Bureau of Radiological Health
because it was considered both safety-significant and risk-significant in the licensee's probabilistic risk assessment.  The inspectors walked down the system to review mechanical and electrical equipment line ups, electrical power availability, system pressure and temperature indications, as appropriate, component labeling, component lubrication, component and equipment cooling, hangers and supports, operability of support systems, and to ensure that ancillary equipment or debris did not interfere with equipment operation. A review of a sample of past and outstanding WOs was performed to determine whether any deficiencies significantly affected the system function. In addition, the inspectors reviewed the CAP database to ensure that system equipment alignment problems were being identified and appropriately resolved.  
   and Environment                            Iowa Department of Public Health
* March 11, 2008, DG 1 during DG 2 LCO  Documents reviewed by the inspectors included:
  Bureau of Air and Radiation                  Lucas State Office Building, 5th Floor
* CNS System Operating Procedure 2.2.20, "Standby AC Power System (Diesel Generator)," Revision 70 These activities constituted one complete system walkdown sample as defined by Inspection Procedure 71111.04-05. b. Findings
  1000 SW Jackson, Suite 310                  321 East 12th Street
No findings of significance were identified. 1R05 Fire Protection (71111.05AQ) a. Inspection Scope
  Topeka, KS 66612-1366                        Des Moines, IA 50319
  The inspectors conducted fire protection walkdowns which were focused on availability, accessibility, and the condition of firefighting equipment. The inspectors reviewed areas to assess if the licensee had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant, effectively maintained fire detection and suppression capability, maintained passive fire protection features in good material condition, and had implemented
  John F. McCann, Director, Licensing          Keith G. Henke, Planner
adequate compensatory measures for out of service, degraded or inoperable fire protection equipment, systems, or features in accordance with the licensee's fire plan.  The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plant's Individual Plant Examination of External Events with later additional insights, their potential to impact equipment which could initiate or mitigate a 
  Entergy Nuclear Northeast                    Division of Community and Public Health
  - 6 - Enclosure plant transient, or their impact on the plant's ability to respond to a security event.  Using the documents listed in the attachment, the inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use; that fire detectors and sprinklers were unobstructed, that transient material loading was within the analyzed limits; and fire doors, dampers, and penetration seals appeared to be in satisfactory condition.  The inspectors also verified that minor issues identified
  Entergy Nuclear Operations, Inc.            Office of Emergency Coordination
during the inspection were entered into the licensee's corrective action program.
  440 Hamilton Avenue                          930 Wildwood, P.O. Box 570
* February 13, 2008, Fire Zone 2C during fuel movement 
  White Plains, NY 10601-1813                  Jefferson City, MO 65102
* March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO
                                              Ronald L. McCabe, Chief
* March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO
  Paul V. Fleming, Director of Nuclear        Technological Hazards Branch
* March 15, 2008, Fire Zone 19C Controlled Access Corridor
   Safety Assurance                            National Preparedness Division
  Documents reviewed by the inspectors included:
  Nebraska Public Power District              DHS/FEMA
* CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated February 28, 2003
  P.O. Box 98                                  9221 Ward Parkway
* CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated November 5, 2007 These activities constituted four quarterly fire protection inspection samples as defined by Inspection Procedure 71111.05-05. b. Findings
  Brownville, NE 68321                        Suite 300
No findings of significance were identified. 1R07 Annual Heat Sink Performance (71111.07) a. Inspection Scope
                                              Kansas City, MO 64114-3372
The inspectors reviewed the licensee's testing of A and B REC heat exchangers to verify that potential deficiencies did not mask the licensee's ability to detect degraded performance, to identify any common cause issues that had the potential to increase
risk, and to ensure that the licensee was adequately addressing problems that could result in initiating events that would cause an increase in risk.  The inspectors reviewed the licensee's observations as compared against acceptance criteria, the correlation of scheduled testing and the frequency of testing, and the impact of instrument inaccuracies on test results.  Inspectors also verified that test acceptance criteria considered differences between test conditions, design conditions, and testing conditions.
* January 25 and January 21, 2008, A and B REC HX performance tests Documents reviewed are listed in the attachment.   This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05. 
  - 7 - Enclosure b. Findings
No findings of significance were identified. 1R11 Licensed Operator Requalification Program (71111.11) Conformance With Simulator Requirements Specified in 10 CFR 55.46
  a. Inspection Scope
The inspectors observed testing and training of senior reactor operators and reactor operators to identify deficiencies and discrepancies in the training, to assess operator performance, and to assess the evaluator's critique.  The training scenario involved a tornado, station blackout and a loss of shutdown cooling.
* February 28, 2008, Crew E drill Documents reviewed by the inspectors included:
* Lesson SKL054-01-28, "Tornado, Station Blackout, Loss of Shutdown Cooling" The inspectors completed one sample.   b. Findings
No findings of significance were identified. 1R12 Maintenance Effectiveness (71111.12) a. Inspection Scope
The inspectors evaluated degraded performance issues involving the risk significant systems of events such as where ineffective equipment maintenance has resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensee's actions to address system performance or condition
problems in terms of the following:
* implementing appropriate work practices;
  * identifying and addressing common cause failures;
* scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
* characterizing system reliability issues for performance;
* charging unavailability for performance;
* trending key parameters for condition monitoring;
* ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and  
 
  - 8 - Enclosure
* verifying appropriate performance criteria for structures, systems, and components (SSCs) functions classified as (a)(2) or appropriate and adequate goals and corrective actions for systems classified as (a)(1). The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the system.  In addition, the inspectors verified maintenance effectiveness issues were entered into the corrective action program with the appropriate significance characterization.
* March 19, 2008, Reactor protection system (RPS) electronic protection assembly (EPA) breaker failures January 12, 2008
  * March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008
  Documents reviewed by the inspectors included:
* Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1
* Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC
  This inspection constitutes two quarterly maintenance effectiveness samples as defined in Inspection Procedure 71111.12-05. b. Findings
  No findings of significance were identified. 1R13  Maintenance Risk Assessments and Emergent Work Control (71111.13) a. Inspection Scope
  The inspectors reviewed the licensee's evaluation and management of plant risk for the maintenance and emergent work activities affecting risk-significant and safety-related equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:
* March 6, 2008, Inoperability of both DGs on September 11, 2007
* March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008
These activities were selected based on their potential risk significance relative to the
reactor safety cornerstones. As applicable for each activity, the inspectors verified that risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate and complete.  When emergent work was performed, the inspectors verified that the plant risk was promptly reassessed and managed.  The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical engineer, and verified plant conditions were consistent with the risk assessment.  The inspectors also reviewed TS requirements and
walked down portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met.  Documents reviewed are listed in the attachment. 
The inspectors completed two samples.   
  - 9 - Enclosure b. Findings
No findings of significance were identified. 1R15 Operability Evaluations (71111.15) a. Inspection Scope
The inspectors reviewed the following issues: The inspectors selected these potential operability issues based on the risk-significance of the associated components and systems.  The inspectors evaluated the technical adequacy of the evaluations to ensure that TS operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred.  The inspectors compared the operability and design criteria in the appropriate sections of the TS and UFSAR to the licensee's evaluations, to determine
whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations.  Additionally, the inspectors also reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.    
* January 14, 2008, DG 2 operability and common cause evaluation for loss of overspeed governor sightglass during run
* January 15, 2008, operability evaluation of control room Board C non-essential meters without isolation devices in DG 1 and DG 2 essential circuits, on January 14, 2008 * February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in DG 2 * March 19, 2008, RPS EPA circuit breakers operability evaluations on January 25, 2008 and February 6, 2008 This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05. b. Findings
  No findings of significance were identified. 1R18 Plant Modifications (71111.18) Temporary Modifications
a. Inspection Scope
The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs to ensure that temporary alterations and configuration changes to the plant conformed to 
  - 10 - Enclosure these guidance documents and the requirements of 10 CFR 50.59.  The inspectors: (1) verified that the modifications did not have an affect on system operability/availability; (2) verified that the installations were consistent with modification documents; (3) ensured that the post-installation test results were satisfactory and that the impacts of the temporary modifications on permanently installed SSCs were supported by the test; and (4) verified that appropriate safety evaluations were completed.  The inspectors
reviewed the following temporary modifications:
* March 19, 2008, Long term scaffolding program review
  Documents reviewed by the inspectors included:
* Maintenance Procedure 7.0.7, "Scaffolding Construction and Control," Revision 24 The inspectors completed one sample. b. Findings
  Introduction.  The inspectors identified a Green noncited violation of TS 5.4.1.a regarding the licensee's failure to follow the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control."  Specifically, licensee personnel failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment during a required annual scaffold inspection on January 21, 2008.  Description.  During pre-outage scaffold inspections on February 7, 2008, the licensee discovered that some existing scaffolds were not built in accordance with established procedures.  Specifically, the licensee discovered that scaffolds constructed in 1999 had been built in contact with safety-related service water piping, RHR piping, pipe hangers, electrical conduit and the torus shell.  This condition was documented in CR-CNS-2008-00822.  After determining that the scaffold did not affect the operability of
the impacted safety systems, the licensee took actions to remove the non-compliant scaffold on February 22, 2008, and closed the CR.
The inspectors noted that Maintenance Procedure 7.0.7, "Scaffolding Construction and Control," Revision 24, contains the following requirement in Paragraph 3.2:


During the month of January, all erected scaffolds shall have an Industrial Safety examination performed to ensure compliance with this procedure. This examination is required prior to placing a new tag and entering the scaffold into the new calendar year log.  
Nebraska Public Power District                -5-
The inspectors also noted that the required annual examination had been completed on January 21, 2008. The maintenance personnel who conducted the examination in WO 4552687 documented completion with no discrepancies.  
Electronic distribution by RIV:
Regional Administrator (Elmo.Collins@nrc.gov)
On March 6, 2008, the inspectors questioned licensee management regarding the performance of the annual scaffold examinations. Specifically, the inspectors asked why the non-compliant scaffold had not been identified during the required annual scaffold examinations. Following this meeting, the licensee conducted a scaffolding walkdown to 
DRP Director (Dwight.Chamberlain@nrc.gov)
  - 11 - Enclosure identify any remaining non-compliances. The following additional violations of Procedure 7.0.7 were discovered during this walkdown:
DRS Director (Roy.Caniano@nrc.gov)
* Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had a board in contact with high pressure coolant injection steam line drip leg piping. Contrary to Procedure 7.0.7, this scaffold had not been inspected due to a misperception that only "long term" scaffolds that had been in place greater than 90 days needed to be inspected. The
DRS Deputy Director (Troy.Pruett@nrc.gov)
licensee documented this condition in CR-CNS-2008-01551.  
Senior Resident Inspector (Nick.Taylor@nrc.gov)
* Scaffold 08-06 was discovered to be in contact with safety-related conduit and pipe hangers in the torus area. The licensee was unable to determine when this scaffold had been installed.  
Branch Chief, DRP/C (Rick.Deese@nrc.gov)
* Eight examples of non-compliant scaffolding handrails were discovered in contact with safety system components in the torus area which had been installed in 2002. This example, documented in
Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)
CR-CNS-2008-01563 on March 11, 2008 was not identified by the annual examination because it was not included in the scaffold log and was therefore not inspected.  
Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)
The inspectors determined that Procedure 7.0.7 had been violated during the
RITS Coordinator (Marisa.Herrera@nrc.gov)
January 21, 2008 annual scaffolding examination in that the examiner reviewed only those scaffolds identified in the scaffolding log as "Long Term Permanent" versus "all erected scaffolds" as required by the procedure. As a result, seven existing scaffolds were not inspected, despite the fact that some of them had been installed for more than one year at the time of the inspection. In addition, the examiner did not conduct a thorough inspection to "ensure compliance with this procedure."  Obvious non-compliances existed in some of the installed scaffolds that were not identified until
Only inspection reports to the following:
months later.
DRS STA (Dale.Powers@nrc.gov)
The inspectors also noted that since handrails built from scaffolding materials do not meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an elevated platform, no annual inspections have been performed on these structures.
J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)
P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)
ROPreports
CNS Site Secretary (Sue.Farmer@nrc.gov)
SUNSI Review Completed: WCW              ADAMS: ; Yes No        Initials: WCW
; Publicly Available        Non-Publicly Available Sensitive    ; Non-Sensitive
R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc                                  ML081270639
RIV:SRI:DRP/C RI:DRP/C              SPE:DRP/C DRS:SRA          C:DRS/OB        C:DRS/EB2
NHTaylor          MLChambers WCWalker          MFRunyan      RELantz          LJSmith
E-Walker          /RA/ E-mailed /RA/            /RA/          /RA/            /RA/
4/24/08            4/23/08          4/24 /08    4/24/08        4/24/08          4/23/08
C:DRS/EB1          C:DRS/PSB        C:DRP/C      ACES:SES D:DRP
RLBywater          MPShannon RWDeese            GMVasquez DDChamberlain
/RA/              /RA/                          /RA/          /RA/
4/22/08            4/22/08          4/ /08      4/24/08        5/02/08
OFFICIAL RECORD COPY                  T=Telephone      E=Email            F=Fax


Analysis.  The performance deficiency associated with this finding involved the licensee's failure to comply with the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control."  The finding is more than minor because if left uncorrected the failure to perform annual scaffold inspections could become a more
              U. S. NUCLEAR REGULATORY COMMISSION
significant safety concern.  Specifically, annual inspections failed to inspect all existing scaffolds and failed to identify multiple scaffolding interactions with safety-related equipment.  Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheet, the finding is determined to have a very low safety significance because it did not result in the loss of function of a TS required system for greater than
                                REGION IV
its allowed outage time.  The cause of this finding is related to the human performance crosscutting component of work practices because maintenance personnel did not follow the requirements of Maintenance Procedure 7.0.7 (H.4(b)).
Docket No:  05000298
  Enforcement. TS 5.4.1.a requires that written procedures be established, implemented, and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978.  Regulatory Guide 1.33, Appendix A, section 9.a, 
License No: PR-46
  - 12 - Enclosure requires that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with written procedures. Contrary to this requirement, on January 21, 2008, maintenance personnel violated the requirements of Maintenance Procedure 7.0.7, "Scaffolding Construction and Control," in that they did not inspect all required scaffolds or identify obvious non-compliances with Procedure 7.0.7.  Because the finding is of very low safety significance and has been
Report No:   5000298/2008002
entered into the licensee's CAP as CR-CNS-2008-01576, this violation is being treated as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures."
Licensee:    Nebraska Public Power District
1R19 Postmaintenance Testing (71111.19)
Facility:    Cooper Nuclear Station
a. Inspection Scope
Location:   PO Box 98, Brownville, NE 68321
  These activities were selected based upon the SSCs ability to impact risk.  The inspectors evaluated these activities for the following (as applicable): the effect of testing on the plant had been adequately addressed; testing was adequate for the maintenance performed; acceptance criteria were clear and demonstrated operational readiness; test
Dates:       January 1 through March 22, 2008
instrumentation was appropriate; tests were performed as written in accordance with properly reviewed and approved procedures; equipment was returned to its operational status following testing (temporary modifications or jumpers required for test performance were properly removed after test completion), and test documentation was properly evaluated.  The inspectors evaluated the activities against TS, the UFSAR, 10
Inspectors: N. Taylor, Senior Resident Inspector
CFR Part 50 requirements, licensee procedures, and various NRC generic communications to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements.  In addition, the inspectors reviewed corrective action documents associated with postmaintenance tests to determine whether the licensee was identifying problems and entering them in the CAP and that
            M. Chambers, Resident Inspector
the problems were being corrected commensurate with their importance to safety.  Documents reviewed are listed in the attachment. The inspectors reviewed the following postmaintenance activities to verify that procedures and test activities were adequate to ensure system operability and functional capability:  
            P. Elkmann, Emergency Preparedness Inspector
* March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008
            M. Runyan, Senior Reactor Analyst
* March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008
Approved by: D. Chamberlain, Director
* March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and thermography
            Division of Reactor Projects
* March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008  
                                    -1-                 Enclosure
  * March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008
The inspectors completed five samples.   
  - 13 - Enclosure b. Findings
Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical Connections
  Introduction.  Two examples of a self-revealing apparent violation of TS 5.4.1.a were identified regarding the licensee's failure to establish procedural controls for
maintenance of electrical connections on essential equipment.  In the first example, the licensee failed to include amphenol connections within the scope of existing periodic electrical connection inspections to identify loosening connections. In the second example, the licensee failed to incorporate internal operating experience into work control procedures to ensure that DG-mounted amphenol connections were solidly
attached following maintenance. These failures to establish adequate procedural controls led to the trip of DG 2 during testing on January 15, 2008.
Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a postmaintenance test.  The test was being conducted to verify the ability of DG 2 to perform its safety function following repairs to the overspeed governor oil level sight glass.  The licensee determined that the cause of the trip of DG 2 was a loose
amphenol-type connection on the relay tachometer speed sensing circuit magnetic pickup.  The licensee determined that this failure was similar in nature to a condition identified during previous troubleshooting of DG 2.  On December 10, 1995, operations personnel initiated a CR to document that the amphenol connector on a DG mounted magnetic pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors and apply thread locking compound to the amphenol threads to keep the connection from vibrating loose.  The completion of these actions was documented in Minor
Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions were taken to codify the use of thread locking compounds or other measures to prevent the amphenol connections from coming unthreaded during engine operation.
During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm
was unexpectedly received, as described in CR 4-13285.  Minor Maintenance WO 003915 was initiated to determine the cause of the unexpected alarm.  During completion of this WO on December 29, 2000, maintenance personnel replaced the relay tachometer and the associated MPU, and the associated amphenol connection was disconnected and then reconnected. 


In the first example of this performance deficiency, the inspectors determined that the licensee's procedures for performing periodic DG electrical examinations were inadequate in that they did not include engine-mounted components. Maintenance Procedure 7.3.8.2, "Diesel Generator Electrical Examination and Maintenance," was created on September 30, 1988 to perform periodic (once per operating cycle) preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC  
                                        SUMMARY OF FINDINGS
identified an NCV regarding the licensee's failure to establish adequate instructions for emergency DG electrical maintenance (see NRC Special Inspection Report 05000298/2007007).  Two of the three examples described in the NCV dealt with inadequate work instructions for checking the tightness of electrical connections on DG system components. In response to this NCV, the licensee initiated Corrective Action #8 
IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications
  - 14 - Enclosure under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically check the DG systems for loose connections. In developing a revision to Maintenance Procedure 7.3.8.2, "Diesel Generator Electrical Examination and Maintenance," the licensee made the erroneous assumption that all engine-mounted components have other maintenance actions that satisfy the intent of the corrective action. As such, engine-mounted connections were not included in the scope of the inspections in
and Postmaintenance Testing.
Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007.  The revised procedure was subsequently completed for DG 2 on September 13, 2007.  The assumption was in error and resulted in a recently missed opportunity to discover the loosening amphenol connection on the DG 2 relay tachometer MPU.
This report covers a three-month period of inspection by resident inspectors and announced
In the second example of this performance deficiency, the licensee determined that the maintenance procedures used on December 29, 2000 did not contain adequate guidance to ensure that thread locking compounds or other measures would be utilized to ensure that the DG amphenol connections did not become unthreaded during engine operation. The work was not conducted using detailed procedures, and as such the licensee determined that the amphenol became loose as a result of either inadequate tightening during the maintenance, or equipment vibration between 2000 and 2008 (due
baseline inspections by regional inspectors. The significance of most findings is indicated by
to thread locking compound not being used), or a combination of both. The licensee has initiated corrective actions to add the appropriate guidance to Administrative Procedure 0.40.4, "Planning."
their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance
Analysis. The performance deficiency associated with this finding involved the licensee's failure to establish procedural controls for maintenance of electrical connections on essential equipment. In the first example, the licensee failed to include these amphenol connections within the scope of existing periodic electrical connection inspections to identify loosening connections. In the second example, the licensee failed to incorporate internal operating experience into work control procedures to ensure that  
Determination Process. Findings for which the Significance Determination Process does not
DG-mounted amphenol connections were solidly attached following maintenance. These failures to establish adequate procedural controls led to the trip of DG 2 during testing on January 15, 2008. The finding is more than minor because it is associated with the mitigating systems cornerstone attribute of equipment performance and affects the associated cornerstone objective to ensure the availability, reliability, and capability
apply may be Green or be assigned a severity level after NRC management review. The NRCs
of systems that respond to initiating events to prevent undesirable consequences.  The Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process," were used to conclude that a Phase 2 analysis was required because the finding represents an actual loss of safety function of a single train for greater than its TS allowed outage time (7 days).  A Phase 2 risk analysis was conducted using the
program for overseeing the safe operation of commercial nuclear power reactors is described in
guidance of Manual Chapter 0609, Appendix A, "Determining the Significance of Reactor Inspection Findings for At-Power Situations."  Entering the site-specific pre-solved table with an assumed exposure time of greater than 30 days yielded a result of red, or very high significance.  A Phase 3 analysis conducted by a risk analyst preliminarily determined the finding to be of white, or low to moderate significance. 
NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.
The cause of the finding is related to the corrective action component of the crosscutting
A.      NRC-Identified and Self-Revealing Findings
area of problem identification and resolution in that the licensee failed to take appropriate corrective actions for a 2007 NRC inspection finding which identified inadequate maintenance procedures for checking the tightness of DG electrical connections (P.1(d)).
        Cornerstone: Mitigating Systems
 
        *      Green. The inspectors identified a Green noncited violation of Technical
  - 15 - Enclosure Enforcement.  TS 5.4.1.a requires that written procedures be established, implemented, and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978.  Regulatory Guide 1.33, Appendix A, Section 9 (a), requires that maintenance affecting performance of safety-related equipment should be performed in accordance with written procedures.  Contrary to this, since December 29, 2000, the licensee used inadequate procedural guidance to reassemble amphenol
                Specification 5.4.1.a regarding the licensees failure to follow the requirements of
connections on DG 2.  Additionally, since September 30, 1988, the licensee's procedural guidance for performing periodic electrical inspections has been inadequate in that it did not check the tightness of engine-mounted amphenol connections.  These inadequate procedures resulted in the trip of DG 2 during testing on January 15, 2008.  This issue was entered into the licensee's CAP as CR-CNS-2008-00304. Pending determination of
                Maintenance Procedure 7.0.7, Scaffolding Construction and Control.
the finding's final safety significance, this finding is identified as Apparent Violation (AV) 05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical Connections." 
                Specifically, licensee personnel failed to inspect all existing scaffolds and failed
1R22 Surveillance Testing (71111.22) Routine Surveillance Testing
                to identify multiple scaffolding interactions with safety-related equipment during a
a. Inspection Scope
                required annual scaffold inspection on January 21, 2008. This issue was
The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that the three surveillance activities listed below demonstrated that the SSCs tested were capable of performing their intended safety functions.  The inspectors either witnessed or reviewed test data to verify that the following significant surveillance test attributes were adequate:  (1) preconditioning; (2) evaluation of testing impact on the plant; (3)
                entered Into the licensees corrective action program as Condition
acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls; (7) test data; (8) testing frequency and method demonstrated TS operability; (9) test equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code requirements; (12) engineering evaluations, root causes, and bases for returning tested SSCs not meeting the test acceptance criteria were correct; (13) reference setting data; 
                Report CR-CNS-2008-01576.
and (14) annunciators and alarms setpoints.  The inspectors also verified that the licensee identified and implemented any needed corrective actions associated with the surveillance testing.
                The finding is more than minor because if left uncorrected the failure to perform
The inspectors observed in-plant activities and reviewed procedures and associated
                annual scaffold inspections could become a more significant safety concern.
records to determine whether:  any preconditioning occurred; effects of the testing were adequately addressed by control room personnel or engineers prior to the commencement of the testing; acceptance criteria were clearly stated, demonstrated operational readiness, and were consistent with the system design basis; plant equipment calibration was correct, accurate, and properly documented; as left setpoints
                Specifically, annual inspections failed to inspect all existing scaffolds and failed to
were within required ranges; the calibration frequency was in accordance with TS, the UFSAR, procedures, and applicable commitments; measuring and test equipment calibration was current; test equipment was used within the required range and accuracy; applicable prerequisites described in the test procedures were satisfied; test frequencies met TS requirements to demonstrate operability and reliability; tests were performed in accordance with the test procedures and other applicable procedures; jumpers and lifted leads were controlled and restored where used; test data and results
                identify multiple scaffolding interactions with safety-related equipment. Using the
were accurate, complete, within limits, and valid; test equipment was removed after testing; where applicable, test results not meeting acceptance criteria were addressed with an adequate operability evaluation or the system or component was declared 
                Manual Chapter 0609, Significance Determination Process, Phase 1
  - 16 - Enclosure inoperable; where applicable for safety-related instrument control surveillance tests, reference setting data were accurately incorporated in the test procedure; where applicable, actual conditions encountering high resistance electrical contacts were such that the intended safety function could still be accomplished; prior procedure changes had not provided an opportunity to identify problems encountered during the performance of the surveillance or calibration test; equipment was returned to a position
                Worksheet, the finding is determined to have a very low safety significance
or status required to support the performance of the safety functions; and all problems identified during the testing were appropriately documented and dispositioned in the CAP.  The inspectors reviewed the test results for the following activities to determine whether risk-significant systems and equipment were capable of performing their intended safety function and to verify testing was conducted in accordance with applicable procedural and TS requirements:
                because it did not result in the loss of function of a Technical Specification
* January 23, 2008, Scram discharge volume vent valve inservice test (IST) performed January 14, 2008
                required system for greater than its allowed outage time. The cause of this
* February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31, 2008  * March 19, 2008, 6.REC.201 performed  January 31, 2008
                finding is related to the human performance crosscutting component of work
* March 21, 2008, DG 2 monthly operability test performed March 11, 2008
                practices because maintenance personnel did not follow the requirements of
This inspection constitutes four routine surveillance testing samples as defined in
                Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).
Inspection Procedure 71111.22. b. Findings
        *      TBD. Two examples of a self-revealing apparent violation of Technical
No findings of significance were identified. EP4 Emergency Action Level and Emergency Plan Changes (71114.04) CNS Emergency Plan Revision 53
                Specification 5.4.1.a were identified regarding the licensees failure to establish
a. Inspection Scope
                procedural controls for maintenance of electrical connections on essential
The inspector performed an in-office review of Revision 53 to the Cooper Nuclear Station Emergency Plan, received January 8, 2008.  This revision moved the licensee's Joint Information Center (emergency news  center) from Columbus, Nebraska, to Auburn, Nebraska, revised position duties in the Emergency Operations Facility and Joint Information Center, deleted the Technical Information Coordinator (EOF) position, revised position titles in the Joint Information Center, added a Letter of Agreement
                equipment. In the first example, the licensee failed to include amphenol
between the licensee and the Nebraska City Fire Department, and revised geographical-based protective action zones in Missouri, based on an approval letter from Federal Emergency Management Agency, Region VII, dated October 10, 2007.
                connections within the scope of existing periodic electrical connection inspections
This revision was compared to its previous revision, to the criteria of NUREG-0654,
                to identify loosening connections. In the second example, the licensee failed to
"Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants," Revision 1, and to the standards in 
                incorporate internal operating experience into work control procedures to ensure
  - 17 - Enclosure 10 CFR 50.47(b) to determine if the revision adequately implemented the requirements of 10 CFR 50.54(q).  This review was not documented in a Safety Evaluation Report and did not constitute approval of licensee changes; therefore, this revision is subject to future inspection. 
                that diesel generator-mounted amphenol connections were solidly attached
  The inspectors completed one sample during the inspection.
                following maintenance. These failures to establish adequate procedural controls
                led to the trip of Diesel Generator 2 during testing on January 15, 2008. This
                issue was entered into the licensees corrective action program as Condition
                Report CR-CNS 2008-00304.
                                                  -2-                                       Enclosure


b. Findings
          The finding affected the mitigating systems cornerstone and is more than minor
No findings of significance were identified. 4. OTHER ACTIVITIES 4OA1 Performance Indicator (PI) Verification (71151) .1 Data Submission Review
          because it is associated with the cornerstone attribute of equipment performance
a. Inspection Scope
          and affects the associated cornerstone objective to ensure the availability,
The inspectors performed a review of the data submitted by the licensee for the 4th Quarter 2007 PIs for any obvious inconsistencies prior to its public release in accordance with Inspection Manual Chapter 0608, "Performance Indicator Program." This review was performed as part of the inspectors' normal plant status activities and, as such, did not constitute a separate inspection sample. b. Findings
          reliability, and capability of systems that respond to initiating events to prevent
No findings of significance were identified. .2 Unplanned Scrams per 7000 Critical Hours
          undesirable consequences. The Phase 1 worksheets in Inspection Manual
a. Inspection Scope
          Chapter 0609, "Significance Determination Process," were used to conclude that
The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical hours PI for the period from the 1
          a Phase 2 analysis was required because the finding represents an actual loss of
st quarter 2007 through the 4
          safety function of a single train for greater than its Technical Specification
th quarter 2007.  To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02, "Regulatory Assessment Performance Indicator Guideline," were used.  The inspectors reviewed the licensee's operator narrative logs, issue reports, event reports and NRC
          allowed outage time (7 days). A Phase 2 risk analysis was conducted using the
inspection reports to validate the accuracy of the submittals. The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the PI data collected or transmitted for this indicator and none were identified.  This inspection constitutes one unplanned scrams per 7000 critical hours sample as defined by Inspection Procedure 71151. b. Findings
          guidance of Manual Chapter 0609, Appendix A, Determining the Significance of
No findings of significance were identified. 
          Reactor Inspection Findings for At-Power Situations. Entering the site-specific
  - 18 - Enclosure .3 Unplanned Transients per 7000 Critical Hours
          pre-solved table with an assumed exposure time of greater than 30 days yielded
a. Inspection Scope
          a result of red, or very high significance. A Phase 3 analysis conducted by a risk
The inspectors sampled licensee submittals for the unplanned transients per 7000 critical hours PI for the period from the 1
          analyst preliminarily determined the finding to be of white, or low to moderate
st quarter 2007 through the 4
          significance. The cause of the finding is related to the corrective action
th quarter 2007.  To determine the accuracy of the PI data reported during those periods, PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute
          component of the crosscutting area of problem identification and resolution in
Document 99-02, "Regulatory Assessment Performance Indicator Guideline," were used. The inspectors reviewed the licensee's operator narrative logs, issue reports, maintenance rule records, event reports and NRC integrated Inspection reports to validate the accuracy of the submittals.  The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the PI data
          that the licensee failed to take appropriate corrective actions for a 2007 NRC
collected or transmitted for this indicator and none were identified.
          inspection finding which identified inadequate maintenance procedures for
  This inspection constitutes one unplanned transients per 7000 critical hours sample as defined by Inspection Procedure 71151. b. Findings
          checking the tightness of diesel generator electrical connections (P.1(d))
No findings of significance were identified. 4OA2 Identification and Resolution of Problems (71152) Cornerstones:  Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical Protection .1 Routine Review of Items Entered Into the CAP
          (Section 71111.19).
a. Inspection Scope
B. Licensee-Identified Violations
The inspectors performed a daily screening of items entered into the licensee's CAP.  This assessment was accomplished by reviewing CRs and WOs and attending corrective action review and work control meetings.  The inspectors:  (1) verified that equipment, human performance, and program issues were being identified by the licensee at an appropriate threshold and that the issues were entered into the CAP; (2) verified that corrective actions were commensurate with the significance of the issue;
  No violations of significance were identified.
and (3) identified conditions that might warrant additional followup through other baseline inspection procedures.  
                                            -3-                                       Enclosure
      b. Findings
  No findings of significance were identified.  
.2 Selected Issue Followup Inspection
        a. Inspection Scope
  In addition to the routine review, the inspectors selected the issues listed below for a more in-depth review.  The inspectors considered the following during the review of the 
  - 19 - Enclosure licensee's actions:  (1) complete and accurate identification of the problem in a timely manner; (2) evaluation and disposition of operability/reportability issues; (3) consideration of extent of condition, generic implications, common cause, and previous occurrences; (4) classification and prioritization of the resolution of the problem; (5) identification of root and contributing causes of the problem; (6) identification of corrective actions; and (7) completion of corrective actions in a timely manner. 


* December 27, 2007, loss of both plant monitoring and information system computers Documents reviewed by the inspectors included:
                                          REPORT DETAILS
* Abnormal Procedure 2.4 COMP, "Computer Malfunction," Revision 4
Summary of Plant Status
* Computer System Operating Procedure 2.6.3, "Computer Systems Operation and Outage Recovery," Revision 23
The plant began the inspection period at 100 percent power. On February 19, 2008, the plant
The inspectors completed one sample. 
began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from
b. Findings
90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump
No findings of significance were identified. 4OA3  Followup of Events and Notices of Enforcement Discretion (71153) .1 (Closed) Licensee Event Report (LER) 05000298/2007-006-00:  Procedural Guidance Leads to Rendering Second Diesel Inoperable
motor Generator B. The reactor was returned to full power later in the day, where it remained
On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil day tank following extensive maintenance on DG 2. While filling the DG 2 day tank, control room operators received annunciators due to a rising level in the DG 1 fuel oil day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves.  Due to failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, "Diesel Generator Fuel Oil Transfer Pump IST Flow Test - Div 2," the licensee declared DG 1
for the rest of the inspection period.
inoperable.  With DG 2 already inoperable, the control room staff properly entered Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an operable status within 2 hours.  
1.       REACTOR SAFETY
In an effort to restore operability of DG 1, the licensee elected to attempt repair of the
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency
leaking solenoid isolation valve on the DG 1 fuel oil day tank.  This required placing DG 1 into maintenance lockout and entry into an overall red risk window for the station.  The repair attempt was unsuccessful, and the control room staff subsequently entered Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours and Mode 4 within 36 hours.  Operability of DG 1 was subsequently restored by closing a fuel oil
                  Preparedness
system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.  
1R04 Equipment Alignment (71111.04)
The licensee initiated this LER due to the loss of safety function (on-site emergency power) that occurred during the corrective maintenance attempt on DG 1. The inspectors reviewed all aspects of the event, including performance of control room staff,
  .1     Quarterly Partial System Walkdowns
planning of the associated WOs, evaluation and mitigation of station risk, configuration control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency 
    a.   Inspection Scope
  - 20 - Enclosure and emergent work, and relationship to previous work on DG 1.  A related violation of NRC requirements is discussed in detail in NRC Integrated Inspection Report 05000298/2007005.  This LER is closed.
        The inspectors selected these systems based on their risk significance relative to the
.2 (Closed) Licensee Event Report 05000298/2007-007-00:  Damaged Lead on Emergency Filter System Fan Motor Results in Loss of Safety Function
        reactor safety cornerstones at the time they were inspected. The inspectors attempted
During a preventative maintenance inspection on December 3, 2007, licensee technicians discovered severely overheated motor leads on the Control Room Emergency Filter System (CREFS) exhaust booster fan.  Based on the discovery of the damaged motor leads, operations staff declared the fan inoperable and determined that
        to identify any discrepancies that could impact the function of the system, and, therefore,
since CREFS is a single-train safety system, a loss of safety function had occurred.  Immediate action was taken and the degraded booster fan was replaced.  CREFS was returned to an operable status on December 4, 2007.  The degraded condition was determined to have been caused by the improper crimping of the motor lugs by the manufacturer prior to installation in the plant. No performance deficiencies were identified during the review of this LER.  This LER is closed. 4OA6  Management Meetings
        potentially increase risk. The inspectors reviewed applicable operating procedures,
Exit Meeting Summary
        system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical
On January 15, 2008, a regional inspector conducted a telephonic exit to present the results of the in-office inspection of licensee changes to the emergency plan to Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.  The inspector confirmed that proprietary information was not provided or examined  
        Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),
during the inspection.
        condition reports (CR), and the impact of ongoing work activities on redundant trains of
On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the results of the in-office inspection of changes to the licensee's emergency plan to Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The  
        equipment in order to identify conditions that could have rendered the systems incapable
inspector confirmed that proprietary, sensitive, or personal information examined during the inspection had been returned to the identified custodian.
        of performing their intended functions. The inspectors also walked down accessible
On April 14, 2008, the resident inspectors presented the inspection results to Mr. M. Colomb, General Manager of Plant Operations and other members of the  
        portions of the systems to verify system components and support equipment were
licensee staff. The licensee acknowledged the issues presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary.  No proprietary information was identified.
        aligned correctly and operable. The inspectors examined the material condition of the
 
        components and observed operating parameters of equipment to verify that there were
  A1-1 Attachment 1 SUPPLEMENTAL INFORMATION KEY POINTS OF CONTACT
        no obvious deficiencies. The inspectors also verified that the licensee had properly
Licensee  John Austin, Manager, Emergency Preparedness Manager
        identified and resolved equipment alignment problems that could cause initiating events
Mark Bergmeier, Operations Support Group Supervisor Vasant Bhardwaj, Engineering Support Manager Michael Boyce, Director of Projects Daniel Buman, System Engineering Manager Michael Colomb, General Manager of Plant Operations
        or impact the capability of mitigating systems or barriers and entered them into the
Jeff Ehlers, Engineer, Electric Systems/I&C Roman Estrada, Corrective Action and Assessments Manager Jim Flaherty, Senior Staff Licensing Engineer Paul Fleming, Director of Nuclear Safety Assurance Scott Freborg, Valves Engineering Programs Supervisor Gabe Gardner, Design Engineering Civil Engineering Supervisor Gary Kline, Director of Engineering
        corrective action program (CAP) with the appropriate significance characterization.
Dave Madsen, Licensing Engineer Mark F Metzger, Engineer, Electric Systems/I&C Ole Olson, Engineer, Engineering Support & Risk Management  Raymond Rexroad, Engineer, Electric Systems/I&C Todd Stevens, Manager-Design Engineering
        Documents reviewed are listed in the attachment.
Mark Unruh, Senior Staff Engineer David VanDerKamp, Licensing Manager Marshall VanWinkle, Design Engineering Mechanical Supervisor Dave Werner, Operations Training Support Supervisor
        The inspectors performed partial system walkdowns of the following risk-significant
        systems:
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
        *        January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B
Opened 05000298/2008002-02 AV Failure to Establish Adequate Procedures for Maintenance of Emergency Diesel Generator Electrical Connections
                  during REC HX A limiting condition for operation (LCO)
Closed 05000298/2007-006-00 LER Procedural Guidance Leads to Rendering Second Diesel Inoperable 05000298/2007-007-00 LER Damaged Lead on Emergency Filter System Fan Motor Results in Loss of Safety Function
        *        February 28, 2008, Service Water Train B during Diesel Generator (DG) LCO
Opened and Closed
        *        March 6, 2008, Residual Heat Removal (RHR) HX B during a RHR HX LCO
05000298/2008002-01 NCV Failure to Follow Scaffold Inspection Procedures
        The inspectors completed three samples.
                                                  -4-                                     Enclosure
LIST OF DOCUMENTS REVIEWED The following is a partial list of documents reviewed during the inspection.  Inclusion on this list does not imply that the NRC inspector reviewed the documents in their entirety, but rather that selected sections or portions of the documents were evaluated as part of the overall inspection 
  A1-2 Attachment 1 effort.  Inclusion of a document on this list does not imply NRC acceptance of the document or any part of it, unless this is stated in the body of the inspection report.
1R07:  Heat Sink Performance
Condition Report
 
CR-CNS-2008-00029 Procedures
  Performance Evaluation Procedure 13.15.1, "Reactor Equipment Cooling Heat Exchanger Performance Analysis," Revision 27


Engineering Procedure 3.34, "Heat Exchanger Program," Revision 9
  b.  Findings
  Work Orders
        No findings of significance were identified.
   4592135 4592134 1R13:  Maintenance Risk Assessments and Emergent Work Control
  .2    Semi-Annual Complete System Walkdown
Procedures
  a.   Inspection Scope
  EP5.1 WEATHER, "Operation During Weather Watches and Warnings," Revision 2 GOP 2.1.11, "Station Operator Tours," Revision 127
        On March 11, 2008 the inspectors performed a complete system alignment inspection of
Procedure 0.49, "Schedule Risk Assessment," Revision 20 Procedure 0-PROTECT-EQP, "Protected Equipment Program," Revision 5 
        the DG 1 to verify the functional capability of the system. This system was selected
Work Order
        because it was considered both safety-significant and risk-significant in the licensees
 
        probabilistic risk assessment. The inspectors walked down the system to review
WO 4618242
        mechanical and electrical equipment line ups, electrical power availability, system
1R19:  Post Maintenance Testing
        pressure and temperature indications, as appropriate, component labeling, component
Condition Reports
        lubrication, component and equipment cooling, hangers and supports, operability of
 
        support systems, and to ensure that ancillary equipment or debris did not interfere with
CR-CNS-2008-00720 CR-CNS-2008-00738
        equipment operation. A review of a sample of past and outstanding WOs was
Procedures
        performed to determine whether any deficiencies significantly affected the system
 
        function. In addition, the inspectors reviewed the CAP database to ensure that system
SP 6.1HV.601, "Air Flow Test of Fan Coil Unit FC-R-1F (Div 1)," Revision 5 6.EE.606, "250 V Battery Charger Performance Test," Revision 19 MP 7.5.33, "SW-MO-650MV Dynamic Test," Revision 5 MP 7.3.14, "Thermal Examination of Plant Components," Revision 7
        equipment alignment problems were being identified and appropriately resolved.
 
      *        March 11, 2008, DG 1 during DG 2 LCO
  A1-3 Attachment 1 Work Orders
      Documents reviewed by the inspectors included:
  WO 4523441 WO 4532270 WO 4541631 WO 4532754
        *      CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel
WO 4581466
              Generator), Revision 70
1R22:  Surveillance Testing
        These activities constituted one complete system walkdown sample as defined by
Condition Report
        Inspection Procedure 71111.04-05.
 
  b.   Findings
CR-CNS-02007-06517
        No findings of significance were identified.
Procedures
1R05 Fire Protection (71111.05AQ)
  6.CAD.201, "North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing Test", Revision 12 T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0
    a. Inspection Scope
T.S. Sec 5.5.6, CNS IST Program 6.1DG.401, "Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1)," Revision 24 EP 3.9, "ASME OM Code Testing of Pumps and Valves,," Revision 23 CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2 DCD-01, p. B-12, Revision dated October 28, 2006
        The inspectors conducted fire protection walkdowns which were focused on availability,
SOP 2.2.12, "Diesel Fuel Oil transfer System," Revision 47 6.REC.201, "REC Motor Operated Valve Operability Test (IST)," Revision16 SR 6.2DG.101, "Diesel Generator 31 Day Operability Test (IST) (Div 2)," Revision 52
        accessibility, and the condition of firefighting equipment.
Work Order
        The inspectors reviewed areas to assess if the licensee had implemented a fire
  WO 4578012
        protection program that adequately controlled combustibles and ignition sources within
LIST OF ACRONYMS USED ASME  American Society of Mechanical Engineers AV  apparent violation CAP  corrective action program
        the plant, effectively maintained fire detection and suppression capability, maintained
CFR Code of Federal Regulations
        passive fire protection features in good material condition, and had implemented
CR  condition reports DG  diesel generator
        adequate compensatory measures for out of service, degraded or inoperable fire
HX  heat exchange(r) LCO  limiting condition for operation LER  licensee event report NCV  noncited violation PI  performance indicator PMT  postmaintenance testing REC  uranium hexafluoride
        protection equipment, systems, or features in accordance with the licensees fire plan.
RHR  residual heat removal TS  Technical Specification UFSAR Updated Final Safety Analysis Report WO  work order 
        The inspectors selected fire areas based on their overall contribution to internal fire risk
  A2-1 Attachment 2 Cooper Nuclear Station Failure of EDG 2 Speed Sensing Circuit SDP Phase 3 Analysis
        as documented in the plants Individual Plant Examination of External Events with later
Performance Deficiency:
        additional insights, their potential to impact equipment which could initiate or mitigate a
  Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008.  The event was caused by a failure of an amphenol connection on the EDG speed sensing circuit.  
                                                  -5-                                   Enclosure
 
      plant transient, or their impact on the plants ability to respond to a security event. Using
      the documents listed in the attachment, the inspectors verified that fire hoses and
      extinguishers were in their designated locations and available for immediate use; that
      fire detectors and sprinklers were unobstructed, that transient material loading was
      within the analyzed limits; and fire doors, dampers, and penetration seals appeared to
      be in satisfactory condition. The inspectors also verified that minor issues identified
      during the inspection were entered into the licensees corrective action program.
      *        February 13, 2008, Fire Zone 2C during fuel movement
      *        March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO
      *        March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO
      *        March 15, 2008, Fire Zone 19C Controlled Access Corridor
      Documents reviewed by the inspectors included:
      *      CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated
              February 28, 2003
      *      CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated
              November 5, 2007
      These activities constituted four quarterly fire protection inspection samples as defined
      by Inspection Procedure 71111.05-05.
  b. Findings
      No findings of significance were identified.
1R07 Annual Heat Sink Performance (71111.07)
  a. Inspection Scope
      The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify
      that potential deficiencies did not mask the licensees ability to detect degraded
      performance, to identify any common cause issues that had the potential to increase
      risk, and to ensure that the licensee was adequately addressing problems that could
      result in initiating events that would cause an increase in risk. The inspectors reviewed
      the licensees observations as compared against acceptance criteria, the correlation of
      scheduled testing and the frequency of testing, and the impact of instrument
      inaccuracies on test results. Inspectors also verified that test acceptance criteria
      considered differences between test conditions, design conditions, and testing
      conditions.
      *        January 25 and January 21, 2008, A and B REC HX performance tests
      Documents reviewed are listed in the attachment.
      This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.
                                              -6-                                        Enclosure
 
  b. Findings
    No findings of significance were identified.
1R11 Licensed Operator Requalification Program (71111.11)
    Conformance With Simulator Requirements Specified in 10 CFR 55.46
  a. Inspection Scope
    The inspectors observed testing and training of senior reactor operators and reactor
    operators to identify deficiencies and discrepancies in the training, to assess operator
    performance, and to assess the evaluator's critique. The training scenario involved a
    tornado, station blackout and a loss of shutdown cooling.
    *      February 28, 2008, Crew E drill
    Documents reviewed by the inspectors included:
    *      Lesson SKL054-01-28, Tornado, Station Blackout, Loss of Shutdown Cooling
    The inspectors completed one sample.
  b. Findings
    No findings of significance were identified.
1R12 Maintenance Effectiveness (71111.12)
  a. Inspection Scope
    The inspectors evaluated degraded performance issues involving the risk significant
    systems of events such as where ineffective equipment maintenance has resulted in
    valid or invalid automatic actuations of engineered safeguards systems and
    independently verified the licensee's actions to address system performance or condition
    problems in terms of the following:
    *      implementing appropriate work practices;
    *      identifying and addressing common cause failures;
    *      scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
    *      characterizing system reliability issues for performance;
    *      charging unavailability for performance;
    *      trending key parameters for condition monitoring;
    *      ensuring 10 CFR 50.65(a)(1) or (a)(2) classification or re-classification; and
                                              -7-                                      Enclosure
 
    *        verifying appropriate performance criteria for structures, systems, and
              components (SSCs) functions classified as (a)(2) or appropriate and adequate
              goals and corrective actions for systems classified as (a)(1).
    The inspectors assessed performance issues with respect to the reliability, availability,
    and condition monitoring of the system. In addition, the inspectors verified maintenance
    effectiveness issues were entered into the corrective action program with the appropriate
    significance characterization.
    *        March 19, 2008, Reactor protection system (RPS) electronic protection
              assembly (EPA) breaker failures January 12, 2008
    *        March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008
    Documents reviewed by the inspectors included:
    *        Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1
    *        Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC
    This inspection constitutes two quarterly maintenance effectiveness samples as defined
    in Inspection Procedure 71111.12-05.
  b. Findings
    No findings of significance were identified.
1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)
  a. Inspection Scope
    The inspectors reviewed the licensee's evaluation and management of plant risk for the
    maintenance and emergent work activities affecting risk-significant and safety-related
    equipment listed below to verify that the appropriate risk assessments were performed
    prior to removing equipment for work:
    *        March 6, 2008, Inoperability of both DGs on September 11, 2007
    *        March 3, 2008, Core spray A LCO with winter storm warning on February 5, 2008
    These activities were selected based on their potential risk significance relative to the
    reactor safety cornerstones. As applicable for each activity, the inspectors verified that
    risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate
    and complete. When emergent work was performed, the inspectors verified that the
    plant risk was promptly reassessed and managed. The inspectors reviewed the scope
    of maintenance work, discussed the results of the assessment with the licensee's
    probabilistic risk analyst or shift technical engineer, and verified plant conditions were
    consistent with the risk assessment. The inspectors also reviewed TS requirements and
    walked down portions of redundant safety systems, when applicable, to verify risk
    analysis assumptions were valid and applicable requirements were met. Documents
    reviewed are listed in the attachment.
    The inspectors completed two samples.
                                                -8-                                      Enclosure
 
  b. Findings
    No findings of significance were identified.
1R15 Operability Evaluations (71111.15)
  a. Inspection Scope
    The inspectors reviewed the following issues:
    The inspectors selected these potential operability issues based on the risk-significance
    of the associated components and systems. The inspectors evaluated the technical
    adequacy of the evaluations to ensure that TS operability was properly justified and the
    subject component or system remained available such that no unrecognized increase in
    risk occurred. The inspectors compared the operability and design criteria in the
    appropriate sections of the TS and UFSAR to the licensees evaluations, to determine
    whether the components or systems were operable. Where compensatory measures
    were required to maintain operability, the inspectors determined whether the measures
    in place would function as intended and were properly controlled. The inspectors
    determined, where appropriate, compliance with bounding limitations associated with the
    evaluations. Additionally, the inspectors also reviewed a sampling of corrective action
    documents to verify that the licensee was identifying and correcting any deficiencies
    associated with operability evaluations.
    *      January 14, 2008, DG 2 operability and common cause evaluation for loss of
            overspeed governor sightglass during run
    *      January 15, 2008, operability evaluation of control room Board C non-essential
            meters without isolation devices in DG 1 and DG 2 essential circuits, on January
            14, 2008
    *      February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in
            DG 2
    *      March 19, 2008, RPS EPA circuit breakers operability evaluations on
            January 25, 2008 and February 6, 2008
    This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.
  b. Findings
    No findings of significance were identified.
1R18 Plant Modifications (71111.18)
    Temporary Modifications
  a. Inspection Scope
    The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs
    to ensure that temporary alterations and configuration changes to the plant conformed to
                                            -9-                                    Enclosure
 
  these guidance documents and the requirements of 10 CFR 50.59. The inspectors:
  (1) verified that the modifications did not have an affect on system operability/availability;
  (2) verified that the installations were consistent with modification documents;
  (3) ensured that the post-installation test results were satisfactory and that the impacts of
  the temporary modifications on permanently installed SSCs were supported by the test;
  and (4) verified that appropriate safety evaluations were completed. The inspectors
  reviewed the following temporary modifications:
  *        March 19, 2008, Long term scaffolding program review
  Documents reviewed by the inspectors included:
  *        Maintenance Procedure 7.0.7, Scaffolding Construction and Control,
            Revision 24
  The inspectors completed one sample.
b. Findings
  Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a
  regarding the licensees failure to follow the requirements of Maintenance Procedure
  7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to
  inspect all existing scaffolds and failed to identify multiple scaffolding interactions with
  safety-related equipment during a required annual scaffold inspection on January 21,
  2008.
  Description. During pre-outage scaffold inspections on February 7, 2008, the licensee
  discovered that some existing scaffolds were not built in accordance with established
  procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had
  been built in contact with safety-related service water piping, RHR piping, pipe hangers,
  electrical conduit and the torus shell. This condition was documented in
  CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of
  the impacted safety systems, the licensee took actions to remove the non-compliant
  scaffold on February 22, 2008, and closed the CR.
  The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and
  Control, Revision 24, contains the following requirement in Paragraph 3.2:
      During the month of January, all erected scaffolds shall have an Industrial
      Safety examination performed to ensure compliance with this procedure. This
      examination is required prior to placing a new tag and entering the scaffold into
      the new calendar year log.
  The inspectors also noted that the required annual examination had been completed on
  January 21, 2008. The maintenance personnel who conducted the examination in
  WO 4552687 documented completion with no discrepancies.
  On March 6, 2008, the inspectors questioned licensee management regarding the
  performance of the annual scaffold examinations. Specifically, the inspectors asked why
  the non-compliant scaffold had not been identified during the required annual scaffold
  examinations. Following this meeting, the licensee conducted a scaffolding walkdown to
                                            - 10 -                                    Enclosure
 
identify any remaining non-compliances. The following additional violations of
Procedure 7.0.7 were discovered during this walkdown:
*        Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had
        a board in contact with high pressure coolant injection steam line drip
        leg piping. Contrary to Procedure 7.0.7, this scaffold had not been
        inspected due to a misperception that only long term scaffolds that
        had been in place greater than 90 days needed to be inspected. The
        licensee documented this condition in CR-CNS-2008-01551.
*        Scaffold 08-06 was discovered to be in contact with safety-related
        conduit and pipe hangers in the torus area. The licensee was unable to
        determine when this scaffold had been installed.
*        Eight examples of non-compliant scaffolding handrails were discovered
        in contact with safety system components in the torus area which had
        been installed in 2002. This example, documented in
        CR-CNS-2008-01563 on March 11, 2008 was not identified by the
        annual examination because it was not included in the scaffold log and
        was therefore not inspected.
The inspectors determined that Procedure 7.0.7 had been violated during the
January 21, 2008 annual scaffolding examination in that the examiner reviewed only
those scaffolds identified in the scaffolding log as Long Term Permanent versus all
erected scaffolds as required by the procedure. As a result, seven existing scaffolds
were not inspected, despite the fact that some of them had been installed for more than
one year at the time of the inspection. In addition, the examiner did not conduct a
thorough inspection to ensure compliance with this procedure. Obvious non-
compliances existed in some of the installed scaffolds that were not identified until
months later.
The inspectors also noted that since handrails built from scaffolding materials do not
meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an
elevated platform, no annual inspections have been performed on these structures.
Analysis. The performance deficiency associated with this finding involved the
licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,
Scaffolding Construction and Control. The finding is more than minor because if left
uncorrected the failure to perform annual scaffold inspections could become a more
significant safety concern. Specifically, annual inspections failed to inspect all existing
scaffolds and failed to identify multiple scaffolding interactions with safety-related
equipment. Using the Manual Chapter 0609, Significance Determination Process,
Phase 1 Worksheet, the finding is determined to have a very low safety significance
because it did not result in the loss of function of a TS required system for greater than
its allowed outage time. The cause of this finding is related to the human performance
crosscutting component of work practices because maintenance personnel did not follow
the requirements of Maintenance Procedure 7.0.7 (H.4(b)).
Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,
and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,
Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,
                                        - 11 -                                    Enclosure
 
    requires that maintenance that can affect the performance of safety-related equipment
    should be properly pre-planned and performed in accordance with written procedures.
    Contrary to this requirement, on January 21, 2008, maintenance personnel violated the
    requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in
    that they did not inspect all required scaffolds or identify obvious non-compliances with
    Procedure 7.0.7. Because the finding is of very low safety significance and has been
    entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated
    as an NCV consistent with Section VI.A of the Enforcement Policy: NCV
    05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.
1R19 Postmaintenance Testing (71111.19)
  a. Inspection Scope
    These activities were selected based upon the SSCs ability to impact risk. The
    inspectors evaluated these activities for the following (as applicable): the effect of testing
    on the plant had been adequately addressed; testing was adequate for the maintenance
    performed; acceptance criteria were clear and demonstrated operational readiness; test
    instrumentation was appropriate; tests were performed as written in accordance with
    properly reviewed and approved procedures; equipment was returned to its operational
    status following testing (temporary modifications or jumpers required for test
    performance were properly removed after test completion), and test documentation was
    properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10
    CFR Part 50 requirements, licensee procedures, and various NRC generic
    communications to ensure that the test results adequately ensured that the equipment
    met the licensing basis and design requirements. In addition, the inspectors reviewed
    corrective action documents associated with postmaintenance tests to determine
    whether the licensee was identifying problems and entering them in the CAP and that
    the problems were being corrected commensurate with their importance to safety.
    Documents reviewed are listed in the attachment.
    The inspectors reviewed the following postmaintenance activities to verify that
    procedures and test activities were adequate to ensure system operability and functional
    capability:
    *      March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008
    *      March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008
    *      March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and
            thermography
    *      March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008
    *      March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008
    The inspectors completed five samples.
                                            - 12 -                                    Enclosure
 
b. Findings
  Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical
  Connections
  Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were
  identified regarding the licensees failure to establish procedural controls for
  maintenance of electrical connections on essential equipment. In the first example, the
  licensee failed to include amphenol connections within the scope of existing periodic
  electrical connection inspections to identify loosening connections. In the second
  example, the licensee failed to incorporate internal operating experience into work
  control procedures to ensure that DG-mounted amphenol connections were solidly
  attached following maintenance. These failures to establish adequate procedural
  controls led to the trip of DG 2 during testing on January 15, 2008.
  Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a
  postmaintenance test. The test was being conducted to verify the ability of DG 2 to
  perform its safety function following repairs to the overspeed governor oil level sight
  glass. The licensee determined that the cause of the trip of DG 2 was a loose
  amphenol-type connection on the relay tachometer speed sensing circuit magnetic
  pickup.
  The licensee determined that this failure was similar in nature to a condition identified
  during previous troubleshooting of DG 2. On December 10, 1995, operations personnel
  initiated a CR to document that the amphenol connector on a DG mounted magnetic
  pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the
  licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors
  and apply thread locking compound to the amphenol threads to keep the connection
  from vibrating loose. The completion of these actions was documented in Minor
  Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions
  were taken to codify the use of thread locking compounds or other measures to prevent
  the amphenol connections from coming unthreaded during engine operation.
  During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm
  was unexpectedly received, as described in CR 4-13285. Minor Maintenance
  WO 003915 was initiated to determine the cause of the unexpected alarm. During
  completion of this WO on December 29, 2000, maintenance personnel replaced the
  relay tachometer and the associated MPU, and the associated amphenol connection
  was disconnected and then reconnected.
  In the first example of this performance deficiency, the inspectors determined that the
  licensees procedures for performing periodic DG electrical examinations were
  inadequate in that they did not include engine-mounted components. Maintenance
  Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was
  created on September 30, 1988 to perform periodic (once per operating cycle)
  preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC
  identified an NCV regarding the licensees failure to establish adequate instructions for
  emergency DG electrical maintenance (see NRC Special Inspection
  Report 05000298/2007007). Two of the three examples described in the NCV dealt with
  inadequate work instructions for checking the tightness of electrical connections on DG
  system components. In response to this NCV, the licensee initiated Corrective Action #8
                                            - 13 -                                  Enclosure
 
under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically
check the DG systems for loose connections. In developing a revision to Maintenance
Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the
licensee made the erroneous assumption that all engine-mounted components have
other maintenance actions that satisfy the intent of the corrective action. As such,
engine-mounted connections were not included in the scope of the inspections in
Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised
procedure was subsequently completed for DG 2 on September 13, 2007. The
assumption was in error and resulted in a recently missed opportunity to discover the
loosening amphenol connection on the DG 2 relay tachometer MPU.
In the second example of this performance deficiency, the licensee determined that the
maintenance procedures used on December 29, 2000 did not contain adequate
guidance to ensure that thread locking compounds or other measures would be utilized
to ensure that the DG amphenol connections did not become unthreaded during engine
operation. The work was not conducted using detailed procedures, and as such the
licensee determined that the amphenol became loose as a result of either inadequate
tightening during the maintenance, or equipment vibration between 2000 and 2008 (due
to thread locking compound not being used), or a combination of both. The licensee has
initiated corrective actions to add the appropriate guidance to Administrative
Procedure 0.40.4, Planning.
Analysis. The performance deficiency associated with this finding involved the
licensees failure to establish procedural controls for maintenance of electrical
connections on essential equipment. In the first example, the licensee failed to include
these amphenol connections within the scope of existing periodic electrical connection
inspections to identify loosening connections. In the second example, the licensee failed
to incorporate internal operating experience into work control procedures to ensure that
DG-mounted amphenol connections were solidly attached following maintenance.
These failures to establish adequate procedural controls led to the trip of DG 2 during
testing on January 15, 2008. The finding is more than minor because it is associated
with the mitigating systems cornerstone attribute of equipment performance and affects
the associated cornerstone objective to ensure the availability, reliability, and capability
of systems that respond to initiating events to prevent undesirable consequences. The
Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"
were used to conclude that a Phase 2 analysis was required because the finding
represents an actual loss of safety function of a single train for greater than its TS
allowed outage time (7 days). A Phase 2 risk analysis was conducted using the
guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor
Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table
with an assumed exposure time of greater than 30 days yielded a result of red, or very
high significance. A Phase 3 analysis conducted by a risk analyst preliminarily
determined the finding to be of white, or low to moderate significance.
The cause of the finding is related to the corrective action component of the crosscutting
area of problem identification and resolution in that the licensee failed to take
appropriate corrective actions for a 2007 NRC inspection finding which identified
inadequate maintenance procedures for checking the tightness of DG electrical
connections (P.1(d)).
                                        - 14 -                                    Enclosure
 
    Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,
    and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,
    Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),
    requires that maintenance affecting performance of safety-related equipment should be
    performed in accordance with written procedures. Contrary to this, since December 29,
    2000, the licensee used inadequate procedural guidance to reassemble amphenol
    connections on DG 2. Additionally, since September 30, 1988, the licensees procedural
    guidance for performing periodic electrical inspections has been inadequate in that it did
    not check the tightness of engine-mounted amphenol connections. These inadequate
    procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue
    was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of
    the findings final safety significance, this finding is identified as Apparent Violation (AV)
    05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of
    Emergency DG Electrical Connections."
1R22 Surveillance Testing (71111.22)
    Routine Surveillance Testing
  a. Inspection Scope
    The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that
    the three surveillance activities listed below demonstrated that the SSCs tested were
    capable of performing their intended safety functions. The inspectors either witnessed
    or reviewed test data to verify that the following significant surveillance test attributes
    were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)
    acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;
    (7) test data; (8) testing frequency and method demonstrated TS operability; (9) test
    equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code
    requirements; (12) engineering evaluations, root causes, and bases for returning tested
    SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;
    and (14) annunciators and alarms setpoints. The inspectors also verified that the
    licensee identified and implemented any needed corrective actions associated with the
    surveillance testing.
    The inspectors observed in-plant activities and reviewed procedures and associated
    records to determine whether: any preconditioning occurred; effects of the testing were
    adequately addressed by control room personnel or engineers prior to the
    commencement of the testing; acceptance criteria were clearly stated, demonstrated
    operational readiness, and were consistent with the system design basis; plant
    equipment calibration was correct, accurate, and properly documented; as left setpoints
    were within required ranges; the calibration frequency was in accordance with TS, the
    UFSAR, procedures, and applicable commitments; measuring and test equipment
    calibration was current; test equipment was used within the required range and
    accuracy; applicable prerequisites described in the test procedures were satisfied; test
    frequencies met TS requirements to demonstrate operability and reliability; tests were
    performed in accordance with the test procedures and other applicable procedures;
    jumpers and lifted leads were controlled and restored where used; test data and results
    were accurate, complete, within limits, and valid; test equipment was removed after
    testing; where applicable, test results not meeting acceptance criteria were addressed
    with an adequate operability evaluation or the system or component was declared
                                              - 15 -                                      Enclosure
 
    inoperable; where applicable for safety-related instrument control surveillance tests,
    reference setting data were accurately incorporated in the test procedure; where
    applicable, actual conditions encountering high resistance electrical contacts were such
    that the intended safety function could still be accomplished; prior procedure changes
    had not provided an opportunity to identify problems encountered during the
    performance of the surveillance or calibration test; equipment was returned to a position
    or status required to support the performance of the safety functions; and all problems
    identified during the testing were appropriately documented and dispositioned in the
    CAP.
    The inspectors reviewed the test results for the following activities to determine whether
    risk-significant systems and equipment were capable of performing their intended safety
    function and to verify testing was conducted in accordance with applicable procedural
    and TS requirements:
    *        January 23, 2008, Scram discharge volume vent valve inservice test (IST)
              performed January 14, 2008
    *        February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,
              2008
    *        March 19, 2008, 6.REC.201 performed January 31, 2008
    *        March 21, 2008, DG 2 monthly operability test performed March 11, 2008
    This inspection constitutes four routine surveillance testing samples as defined in
    Inspection Procedure 71111.22.
  b. Findings
    No findings of significance were identified.
EP4  Emergency Action Level and Emergency Plan Changes (71114.04)
    CNS Emergency Plan Revision 53
  a. Inspection Scope
    The inspector performed an in-office review of Revision 53 to the Cooper Nuclear
    Station Emergency Plan, received January 8, 2008. This revision moved the licensee's
    Joint Information Center (emergency news center) from Columbus, Nebraska, to
    Auburn, Nebraska, revised position duties in the Emergency Operations Facility and
    Joint Information Center, deleted the Technical Information Coordinator (EOF) position,
    revised position titles in the Joint Information Center, added a Letter of Agreement
    between the licensee and the Nebraska City Fire Department, and revised geographical-
    based protective action zones in Missouri, based on an approval letter from Federal
    Emergency Management Agency, Region VII, dated October 10, 2007.
    This revision was compared to its previous revision, to the criteria of NUREG-0654,
    Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and
    Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in
                                              - 16 -                                  Enclosure
 
      10 CFR 50.47(b) to determine if the revision adequately implemented the requirements
      of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and
      did not constitute approval of licensee changes; therefore, this revision is subject to
      future inspection.
      The inspectors completed one sample during the inspection.
  b. Findings
      No findings of significance were identified.
4.    OTHER ACTIVITIES
4OA1 Performance Indicator (PI) Verification (71151)
.1    Data Submission Review
  a. Inspection Scope
      The inspectors performed a review of the data submitted by the licensee for the 4th
      Quarter 2007 PIs for any obvious inconsistencies prior to its public release in
      accordance with Inspection Manual Chapter 0608, Performance Indicator Program.
      This review was performed as part of the inspectors normal plant status activities and,
      as such, did not constitute a separate inspection sample.
  b. Findings
      No findings of significance were identified.
.2    Unplanned Scrams per 7000 Critical Hours
  a. Inspection Scope
      The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical
      hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To
      determine the accuracy of the PI data reported during those periods, PI definitions and
      guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,
      Regulatory Assessment Performance Indicator Guideline, were used. The inspectors
      reviewed the licensees operator narrative logs, issue reports, event reports and NRC
      inspection reports to validate the accuracy of the submittals. The inspectors also
      reviewed the licensees issue report database to determine if any problems had been
      identified with the PI data collected or transmitted for this indicator and none were
      identified.
      This inspection constitutes one unplanned scrams per 7000 critical hours sample as
      defined by Inspection Procedure 71151.
  b. Findings
      No findings of significance were identified.
                                              - 17 -                                  Enclosure
 
.3    Unplanned Transients per 7000 Critical Hours
  a. Inspection Scope
      The inspectors sampled licensee submittals for the unplanned transients per
      7000 critical hours PI for the period from the 1st quarter 2007 through the 4th
      quarter 2007. To determine the accuracy of the PI data reported during those periods,
      PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute
      Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.
      The inspectors reviewed the licensees operator narrative logs, issue reports,
      maintenance rule records, event reports and NRC integrated Inspection reports to
      validate the accuracy of the submittals. The inspectors also reviewed the licensees
      issue report database to determine if any problems had been identified with the PI data
      collected or transmitted for this indicator and none were identified.
      This inspection constitutes one unplanned transients per 7000 critical hours sample as
      defined by Inspection Procedure 71151.
  b. Findings
      No findings of significance were identified.
4OA2 Identification and Resolution of Problems (71152)
      Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency
      Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical
      Protection
.1    Routine Review of Items Entered Into the CAP
  a. Inspection Scope
      The inspectors performed a daily screening of items entered into the licensee's CAP.
      This assessment was accomplished by reviewing CRs and WOs and attending
      corrective action review and work control meetings. The inspectors: (1) verified that
      equipment, human performance, and program issues were being identified by the
      licensee at an appropriate threshold and that the issues were entered into the CAP;
      (2) verified that corrective actions were commensurate with the significance of the issue;
      and (3) identified conditions that might warrant additional followup through other baseline
      inspection procedures.
  b. Findings
      No findings of significance were identified.
.2    Selected Issue Followup Inspection
  a. Inspection Scope
      In addition to the routine review, the inspectors selected the issues listed below for a
      more in-depth review. The inspectors considered the following during the review of the
                                              - 18 -                                  Enclosure
 
      licensee's actions: (1) complete and accurate identification of the problem in a timely
      manner; (2) evaluation and disposition of operability/reportability issues;
      (3) consideration of extent of condition, generic implications, common cause, and
      previous occurrences; (4) classification and prioritization of the resolution of the problem;
      (5) identification of root and contributing causes of the problem; (6) identification of
      corrective actions; and (7) completion of corrective actions in a timely manner.
      *        December 27, 2007, loss of both plant monitoring and information system
              computers
      Documents reviewed by the inspectors included:
      *        Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4
      *        Computer System Operating Procedure 2.6.3, Computer Systems Operation
              and Outage Recovery, Revision 23
      The inspectors completed one sample.
  b. Findings
      No findings of significance were identified.
4OA3 Followup of Events and Notices of Enforcement Discretion (71153)
.1    (Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance
      Leads to Rendering Second Diesel Inoperable
      On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil
      day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,
      control room operators received annunciators due to a rising level in the DG 1 fuel oil
      day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to
      failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel
      Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1
      inoperable. With DG 2 already inoperable, the control room staff properly entered
      Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an
      operable status within 2 hours.
      In an effort to restore operability of DG 1, the licensee elected to attempt repair of the
      leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing
      DG 1 into maintenance lockout and entry into an overall red risk window for the station.
      The repair attempt was unsuccessful, and the control room staff subsequently entered
      Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours and Mode 4
      within 36 hours. Operability of DG 1 was subsequently restored by closing a fuel oil
      system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.
      The licensee initiated this LER due to the loss of safety function (on-site emergency
      power) that occurred during the corrective maintenance attempt on DG 1. The
      inspectors reviewed all aspects of the event, including performance of control room staff,
      planning of the associated WOs, evaluation and mitigation of station risk, configuration
      control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency
                                                - 19 -                                    Enclosure
 
    and emergent work, and relationship to previous work on DG 1. A related violation of
    NRC requirements is discussed in detail in NRC Integrated Inspection Report
    05000298/2007005. This LER is closed.
.2  (Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency
    Filter System Fan Motor Results in Loss of Safety Function
    During a preventative maintenance inspection on December 3, 2007, licensee
    technicians discovered severely overheated motor leads on the Control Room
    Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the
    damaged motor leads, operations staff declared the fan inoperable and determined that
    since CREFS is a single-train safety system, a loss of safety function had occurred.
    Immediate action was taken and the degraded booster fan was replaced. CREFS was
    returned to an operable status on December 4, 2007. The degraded condition was
    determined to have been caused by the improper crimping of the motor lugs by the
    manufacturer prior to installation in the plant. No performance deficiencies were
    identified during the review of this LER. This LER is closed.
4OA6 Management Meetings
    Exit Meeting Summary
    On January 15, 2008, a regional inspector conducted a telephonic exit to present the
    results of the in-office inspection of licensee changes to the emergency plan to
    Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.
    The inspector confirmed that proprietary information was not provided or examined
    during the inspection.
    On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the
    results of the in-office inspection of changes to the licensees emergency plan to
    Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The
    inspector confirmed that proprietary, sensitive, or personal information examined during
    the inspection had been returned to the identified custodian.
    On April 14, 2008, the resident inspectors presented the inspection results to
    Mr. M. Colomb, General Manager of Plant Operations and other members of the
    licensee staff. The licensee acknowledged the issues presented. The inspectors asked
    the licensee whether any materials examined during the inspection should be
    considered proprietary. No proprietary information was identified.
                                              - 20 -                                Enclosure
 
                                  SUPPLEMENTAL INFORMATION
                                    KEY POINTS OF CONTACT
Licensee
John Austin, Manager, Emergency Preparedness Manager
Mark Bergmeier, Operations Support Group Supervisor
Vasant Bhardwaj, Engineering Support Manager
Michael Boyce, Director of Projects
Daniel Buman, System Engineering Manager
Michael Colomb, General Manager of Plant Operations
Jeff Ehlers, Engineer, Electric Systems/I&C
Roman Estrada, Corrective Action and Assessments Manager
Jim Flaherty, Senior Staff Licensing Engineer
Paul Fleming, Director of Nuclear Safety Assurance
Scott Freborg, Valves Engineering Programs Supervisor
Gabe Gardner, Design Engineering Civil Engineering Supervisor
Gary Kline, Director of Engineering
Dave Madsen, Licensing Engineer
Mark F Metzger, Engineer, Electric Systems/I&C
Ole Olson, Engineer, Engineering Support & Risk Management
Raymond Rexroad, Engineer, Electric Systems/I&C
Todd Stevens, Manager-Design Engineering
Mark Unruh, Senior Staff Engineer
David VanDerKamp, Licensing Manager
Marshall VanWinkle, Design Engineering Mechanical Supervisor
Dave Werner, Operations Training Support Supervisor
                    LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
05000298/2008002-02          AV      Failure to Establish Adequate Procedures for Maintenance of
                                      Emergency Diesel Generator Electrical Connections
Closed
05000298/2007-006-00          LER    Procedural Guidance Leads to Rendering Second Diesel
                                      Inoperable
05000298/2007-007-00          LER    Damaged Lead on Emergency Filter System Fan Motor
                                      Results in Loss of Safety Function
Opened and Closed
05000298/2008002-01          NCV    Failure to Follow Scaffold Inspection Procedures
                                LIST OF DOCUMENTS REVIEWED
The following is a partial list of documents reviewed during the inspection. Inclusion on this list
does not imply that the NRC inspector reviewed the documents in their entirety, but rather that
selected sections or portions of the documents were evaluated as part of the overall inspection
                                                  A1-1                                Attachment 1
 
effort. Inclusion of a document on this list does not imply NRC acceptance of the document or
any part of it, unless this is stated in the body of the inspection report.
1R07: Heat Sink Performance
Condition Report
CR-CNS-2008-00029
Procedures
Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger
Performance Analysis, Revision 27
Engineering Procedure 3.34, Heat Exchanger Program, Revision 9
Work Orders
4592135
4592134
1R13: Maintenance Risk Assessments and Emergent Work Control
Procedures
EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2
GOP 2.1.11, Station Operator Tours, Revision 127
Procedure 0.49, Schedule Risk Assessment, Revision 20
Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5
Work Order
WO 4618242
1R19: Post Maintenance Testing
Condition Reports
CR-CNS-2008-00720
CR-CNS-2008-00738
Procedures
SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5
6.EE.606, 250 V Battery Charger Performance Test, Revision 19
MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5
MP 7.3.14, Thermal Examination of Plant Components, Revision 7
                                                  A1-2                            Attachment 1
 
Work Orders
WO 4523441
WO 4532270
WO 4541631
WO 4532754
WO 4581466
1R22: Surveillance Testing
Condition Report
CR-CNS-02007-06517
Procedures
6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing
Test, Revision 12
T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0
T.S. Sec 5.5.6, CNS IST Program
6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24
EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23
CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2
DCD-01, p. B-12, Revision dated October 28, 2006
SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47
6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16
SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52
Work Order
WO 4578012
                                  LIST OF ACRONYMS USED
ASME          American Society of Mechanical Engineers
AV            apparent violation
CAP            corrective action program
CFR            Code of Federal Regulations
CR            condition reports
DG            diesel generator
HX            heat exchange(r)
LCO            limiting condition for operation
LER            licensee event report
NCV            noncited violation
PI            performance indicator
PMT            postmaintenance testing
REC            uranium hexafluoride
RHR            residual heat removal
TS            Technical Specification
UFSAR          Updated Final Safety Analysis Report
WO            work order
                                                A1-3                            Attachment 1
 
                                      Cooper Nuclear Station
                              Failure of EDG 2 Speed Sensing Circuit
                                      SDP Phase 3 Analysis
Performance Deficiency:
Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was
caused by a failure of an amphenol connection on the EDG speed sensing circuit.
Assumptions:
Assumptions:
  1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only during times that the diesel generator was running; specifically in response to the vibration of the operating engine. There is no assumption of accelerated degradation associated with diesel starts or any degradation while the unit was in standby. It is further assumed that the failure was a deterministic outcome set to occur after a specific number of operating hours.   
1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only
The diesel was run at the following times:  
  during times that the diesel generator was running; specifically in response to the vibration
  of the operating engine. There is no assumption of accelerated degradation associated with
  diesel starts or any degradation while the unit was in standby. It is further assumed that the
  failure was a deterministic outcome set to occur after a specific number of operating hours.
  The diesel was run at the following times:
  09/13/07 - ran for 2 hrs 15 min
  10/15/07 - ran for 5 hrs 45 min
  11/13/07 - ran for 5 hrs 21 min
  12/10/07 - ran for 5 hrs 51 min
  01/14/08 - ran for 5 hrs 21 min (1700)
  01/15/08 - failure less than one minute after starting
  01/16/08- EDG 2 restored to a functional status (1700)
  Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP
  demand, or it was inoperable for maintenance, during the two-day period from January 14 to
  January 16, 2008.
  Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours following a
  LOOP demand at any time during the 35-day period from its last successful surveillance test
  on December 10, 2007 until the test failure that occurred on January 14, 2008.
  Prior to this date, EDG 2 would have run and failed at 11.2 hours during the 27-day period
  from November 13, 2007 to December 10, 2007.
  Prior to this date, EDG 2 would have run and failed at 16.5 hours during the 29-day period
  from October 15, 2007 to November 13, 2007.
  Prior to this date, EDG 2 would have failed to run at 22.3 hours during the 32-day period
  from September 13, 2007 to October 15, 2007.
  Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed
  sensing circuit failure for at least 24 hours, the mission time assumed in the SPAR model.
  Therefore, prior to this date no additional risk impact is assumed.
2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the
  outcome of any of the SPAR core damage sequences, the longest of which is 11 hours (as
  modified by an extension to the battery duration (assumption #3). Adjustments made to the
                                                A2-1                                Attachment 2
 
    performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG
    CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,
    unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,
    including a very small contribution from the action steps of repairing the amphenol
    connection and re-starting the EDG, which are relatively simple.
    The following table presents the diagnosis tabulation:
                            Diagnosis (0.01)   Multiplier  Action (0.001)    Multiplier
Available Time              Expansive          0.01        Nominal          1
Stress                      Extreme            5            High              2
Complexity                  High              5            Nominal          1
Experience/Training          Nominal            1            Nominal          1
Procedures                  Not Available      50          Nominal          1
Ergonomics                  Poor              10          Nominal          1
Product of Multipliers                          125                            2
Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558
Action HEP = 0.001(2) = 0.002
Total HEP = 0.56
    For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit
    failure applies to sequences of 4 hours or greater. The only sequence that is less than 4
    hours is a 30 minute sequence, for which no recovery of the amphenol connection is
    assumed.
    The SPAR model does not distinguish between cutsets that contain two or just one EDG
    failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely
    to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in
    this analysis, this feature of the SPAR model is not altered
3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge
    capability following a station blackout. Based on information received from the licensee, this
    credit was extended to 11 hours. Although the batteries could potentially function beyond
    11 hours under certain conditions other challenges related to the operation of RCIC and
    HPCI in station blackout conditions would be present. These challenges include the
    availability of adequate injection supply water and operational concerns of RCIC under high
    back pressure conditions as a result of the unavailability of suppression pool cooling during
    an extended station blackout event.
4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to
    operate for the period of time before it is assumed to fail from the connector failure during
    the various exposure periods. This introduces a slight inconsistency to the risk estimate, but
    because it would similarly affect both the base and current case, it does not significantly
    influence the result of this analysis.
5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed
    to be independent in nature. The reason for this determination is based on the following
                                                A2-2                                  Attachment 2
 
    reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine
    vibration while the EDG was running. Historically, EDG 2 has experienced vibration
    problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the
    amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very
    unlikely that this type of failure would occur on both EDGs at the same time. The fact that it
    took 7 years of operation for EDG 2 to reach the point of failure also points to the
    unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the
    exposure period of this finding.
    Even if both EDGs were determined to be vulnerable to a speed sensor amphenol
    connection failure, there was no mechanism that would tend to cause both EDGs to fail
    simultaneously. That is, the failure of one amphenol connection would not make failure of
    the other one more likely. Therefore, for this case, the failure of both EDGs from this issue
    would mathematically be modeled by the combined independent failures of both EDGs
    instead of by a classic common cause coupling mechanism. For this case, the estimated
    probability of an independent failure of EDG 1 from a failed amphenol connection during the
    exposure period would be a small number compared to its baseline SPAR fail-to-run
    probability and therefore this application would not appreciably affect the final result.
    Finally, if EDG 1 had experienced problems with this connection, thereby making it
    comparatively vulnerable to the same type of failure; it is likely that the licensee would have
    taken more aggressive actions to address this issue, seeing that it affected both trains of
    emergency power. Therefore, the conditions necessary to create the possibility of a
    common cause failure would also have triggered actions to prevent it.
The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A
cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.
The model was revised by INL to increase the battery life to 11 hours, as discussed above. In
addition, the timing of various sequences was lengthened based on data provided by the
licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),
with an HEP of 0.15. However, based on observations by the senior resident inspector, the
analyst concluded that credit for firewater injection should not be granted. This is because
barely enough time was available to perform the necessary actions and a valve that must be
opened to establish a flow path was non-functional with a stem-disk separation for the entire
period of exposure. There were other valves that could have been used in alternate lineups, but
it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure
the flow path.
Also, changes were made to the containment venting fault tree. In the original version, a loss of
Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the
vent function is possible by taking manual local actions to open the vent valves. The failure
probability of this action was estimated based on an observed evolution conducted in response
to questions concerning this analysis. This observation revealed that the actions needed to
perform this function were dangerous and complex and would be conducted in poor lighting and
high temperatures. Also, operators had little experience. The recovery efforts applied to both a
loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic
events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following
SPAR-H analysis.
                                                A2-3                                  Attachment 2
 
The diagnosis of the need to manually vent containment is obvious based on emergency
operating procedures that direct this action when containment pressure reaches 25 psig.
Operators would be continually monitoring this parameter, and it is very unlikely that the effort to
manually vent containment would not be undertaken at 25 psig and possibly prior to this point.
For the action steps, approximately 8 hours of time are available from the time that containment
pressurizes to 25 psig until containment would fail. The nominal time needed to perform the
manually venting task is estimated at 2 hours. In this case, the relevant SPAR-H category for
time is nominal. Extreme stress is chosen because the effort to manually open the vent valves
involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The
effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to
the valves and performing several manipulations. Operators have little experience with this
evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack
of lighting.
                            Diagnosis (0.01)  Multiplier    Action (0.001)    Multiplier
Available Time              Expansive          0.01          Nominal          1
Stress                      High              2              Extreme          5
Complexity                  Obvious            0.1            Moderate          2
Experience/Training          Nominal            1              Low              3
Procedures                  Nominal            1              Nominal          1
Ergonomics                  Nominal            1              Poor              10
Product of Multipliers                          0.002                            300
Diagnosis HEP = 0.01(.002) = 2.0E-5
Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23
Total HEP = 0.23
To model the failure of the speed sensing circuit and its specific recovery, a new and gate was
added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the
speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of
restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are
considered similar to the same for the various prior exposure periods. The common cause
probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets
containing the independent failure of EDG 2 contribute to the delta CDF of this finding.
Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG
recovery basic events were removed from cutsets that contained an EDG 2 speed sensor
failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure
to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset
of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery
for those sequences.
Internal Events Analysis:
A.      Risk Estimate for the 2-day period between January 14 and January 16, 2006:
        During this 48-hour period, it is assumed that EDG 2 was completely unavailable either
        because of maintenance or because it would have failed within one minute after a LOOP
                                                A2-4                                    Attachment 2
 
  demand. To represent the assumed failure and potential recovery of EDG 2, the new
  basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was
  set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of
  4.172E-4 to ensure that cutsets containing common cause to run events would cancel
  out in the base and current case.
  The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.
B. Risk Estimate for the 35-day period between December 10, 2006 and January 14,
  2007:
  During this exposure period, EDG 2 is assumed to have been capable of running for
  5.35 hours. The LOOP frequency used in the analysis was adjusted to reflect the
  situation that only LOOPs with durations greater than 5.35 hours would result in a risk
  increase attributable to the speed sensor failure.
  The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is
  0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours is
  3.99E-3/yr.
  Resetting event time t=0 to 5.35 hours following the LOOP event requires that the
  recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
  SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
  recovery at 7.35 hours, given that recovery has failed at 5.35 hours.
  An adjustment to account for the diminishment of decay heat must be considered. This
  is because the magnitude of decay heat at 5.35 hours following shutdown is less than in
  the early moments following a reactor trip, and the timing of core damage sequences is
  affected by this fact. In the modified SPAR model, recovery times for offsite power are
  set at the intervals of 30 minutes, 2 hours, 4 hours, and 10 hours. The analyst
  determined that the average decay heat level in the first 30 minutes is approximately two
  times the average level that exists between 5.35 and 6.35 hours following shutdown.
  Therefore, baseline 30-minute SPAR model sequences, that essentially account for
  boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences
  model safety relief valve failures to close, and are based more on inventory control than
  core heat production. Therefore, no adjustment was made for these sequences. The
  analyst determined that decay heat rates leveled out quickly following shutdown and
  could find no basis for adjusting the times associated with the 4 and 10-hour sequences.
  The following table presents the adjusted offsite power non-recovery factors for the
  event times that are relevant in the SPAR core damage cutsets:
                                            A2-5                                Attachment 2


09/13/07 - ran for 2 hrs 15 min 10/15/07 - ran for 5 hrs 45 min 11/13/07 - ran for 5 hrs 21 min 12/10/07 - ran for 5 hrs 51 min
        SPAR          SPAR base            SPAR base            SPAR base          Modified
01/14/08 - ran for 5 hrs 21 min (1700) 01/15/08 - failure less than one minute after starting 01/16/08- EDG 2 restored to a functional status (1700)               
      recovery        offsite power      offsite power        offsite power    SPAR non-
Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP
          time        non-recovery        non-recovery at      non-recovery at      recovery
demand, or it was inoperable for maintenance, during the two-day period from January 14 to January 16, 2008.  
                                            5.35 hours          5.35 hours +      (Column 4
Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours following a LOOP demand at any time during the 35-day period from its last successful surveillance test
                                                                SPAR recovery      divided by
on December 10, 2007 until the test failure that occurred on January 14, 2008.  
                                                              time in Column 1    Column 3)
Prior to this date, EDG 2 would have run and failed at 11.2 hours during the 27-day period from November 13, 2007 to December 10, 2007.
        30 min.           0.7314              0.1112                0.0905 1          0.814
        4 hours            0.1566              0.1112                0.0554            0.498
Prior to this date, EDG 2 would have run and failed at 16.5 hours during the 29-day period from October 15, 2007 to November 13, 2007.  
        5 hours           0.1205              0.1112                0.0487            0.438
Prior to this date, EDG 2 would have failed to run at 22.3 hours during the 32-day period from September 13, 2007 to October 15, 2007.  
        9 hours            0.05789            0.1112                0.0325            0.292
Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed
      11 hours            0.04500            0.1112                0.0278            0.250
sensing circuit failure for at least 24 hours, the mission time assumed in the SPAR model. Therefore, prior to this date no additional risk impact is assumed.  
      1. A SPAR recovery time of 1.0 hours is used, as discussed above, to account for the
2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the outcome of any of the SPAR core damage sequences, the longest of which is 11 hours (as
            lessening of decay heat
modified by an extension to the battery duration (assumption #3). Adjustments made to the 
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
  A2-2 Attachment 2 performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training, unavailable procedures, and missing ergonomics) returned a failure probability of 0.56, including a very small contribution from the action steps of repairing the amphenol connection and re-starting the EDG, which are relatively simple.  
      before EDG 2 fails from the speed sensor circuit failure at 5.35 hours, the result for the
The following table presents the diagnosis tabulation:
      base and the current case that contain an EDG 1 FTS event were multiplied by the
  Diagnosis (0.01) Multiplier Action (0.001) Multiplier Available Time Expansive 0.01 Nominal 1 Stress Extreme 5 High 2 Complexity High 5 Nominal 1 Experience/Training Nominal 1 Nominal 1 Procedures Not Available 50 Nominal 1 Ergonomics Poor
      success probability of recovering EDG 1 in 5.35 hours, which was 0.5934 (1- non-
10 Nominal 1 Product of Multipliers 125  2
      recovery probability). This value was then subtracted to obtain a final result for the base
Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558 Action HEP = 0.001(2) = 0.002
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
Total HEP = 0.56
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit failure applies to sequences of 4 hours or greater. The only sequence that is less than 4  hours is a 30 minute sequence, for which no recovery of the amphenol connection is assumed.  The SPAR model does not distinguish between cutsets that contain two or just one EDG  
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
failure as it relates to EDG non-recovery basic events.  Theoretically, it would be more likely to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in this analysis, this feature of the SPAR model is not altered
      events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours).
3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge capability following a station blackout. Based on information received from the licensee, this credit was extended to 11 hours.  Although the batteries could potentially function beyond 11 hours under certain conditions other challenges related to the operation of RCIC and HPCI in station blackout conditions would be present.  These challenges include the availability of adequate injection supply water and operational concerns of RCIC under high
      This then would suggest that the EDG recovery terms in the SPAR model would
back pressure conditions as a result of the unavailability of suppression pool cooling during an extended station blackout event.
      coincide with the event time t=0 at 5.35 hours following the onset of the LOOP and
4.  For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to operate for the period of time before it is assumed to fail from the connector failure during
      therefore do not require adjustment.
the various exposure periods.  This introduces a slight inconsistency to the risk estimate, but because it would similarly affect both the base and current case, it does not significantly influence the result of this analysis.
      The results of this portion of the analysis are presented in the following table:
5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed to be independent in nature.  The reason for this determination is based on the following 
                CDF/yr            CDF/35 days    EDG1 FTS            EDG1 FTS      Remaining
  A2-3 Attachment 2 reasoning.  The loosening of the amphenol connection on EDG 2 resulted from engine vibration while the EDG was running.  Historically, EDG 2 has experienced vibration problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very unlikely that this type of failure would occur on both EDGs at the same time.  The fact that it took 7 years of operation for EDG 2 to reach the point of failure also points to the
                                                  Recovered          Recovered/35 CDF (column
unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the exposure period of this finding. 
                                                  (EDG1 FTS          days          3- column 5)
Even if both EDGs were determined to be vulnerable to a speed sensor amphenol connection failure, there was no mechanism that would tend to cause both EDGs to fail
                                                  Cutset total
simultaneously. That is, the failure of one amphenol connection would not make failure of the other one more likely.  Therefore, for this case, the failure of both EDGs from this issue would mathematically be modeled by the combined independent failures of both EDGs instead of by a classic common cause coupling mechanism. For this case, the estimated probability of an independent failure of EDG 1 from a failed amphenol connection during the exposure period would be a small number compared to its baseline SPAR fail-to-run probability and therefore this application would not appreciably affect the final result.  
                                                  times 0.5934)
Base Case      6.989E-7          6.702E-8        3.686E-8            3.535E-9      6.348E-8
Current Case 1.394E-5            1.337E-6        4.706E-7            4.513E-8      1.292E-6
Delta                                                                                1.229E-6
CDF/35 days
                                                A2-6                                  Attachment 2


Finally, if EDG 1 had experienced problems with this connection, thereby making it comparatively vulnerable to the same type of failure; it is likely that the licensee would have taken more aggressive actions to address this issue, seeing that it affected both trains of emergency power. Therefore, the conditions necessary to create the possibility of a
C. Risk Estimate for the 27-day period between November 13, 2007 and December 10,
common cause failure would also have triggered actions to prevent it.  
  2007:
The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.  
  During this exposure period, EDG 2 is assumed to have been capable of running for
  11.2 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs
The model was revised by INL to increase the battery life to 11 hours, as discussed above. In addition, the timing of various sequences was lengthened based on data provided by the licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0), with an HEP of 0.15.  However, based on observations by the senior resident inspector, the analyst concluded that credit for firewater injection should not be granted. This is because
  with durations greater than 11.2 hours would result in a risk increase attributable to the
barely enough time was available to perform the necessary actions and a valve that must be opened to establish a flow path was non-functional with a stem-disk separation for the entire period of exposure. There were other valves that could have been used in alternate lineups, but it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure the flow path.  
  speed sensor failure.
  The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is
  0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours is
  1.58E-3/yr.
  Resetting event time t=0 to 11.2 hours following the LOOP event requires that the
  recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
  SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
  recovery at 13.2 hours, given that recovery has failed at 11.2 hours.
  The analyst considered an adjustment to account for the diminishment of decay heat as
  in the 5.35-hour case above. The analyst determined that the average decay heat level
  in the first 30 minutes is approximately three times the average level that exists between
  11 and 12 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
  essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.
  The 2-hour sequences model safety relief valve failures to close, and are based more on
  inventory control than core heat production. Therefore, no adjustment was made for
  these sequences. Sequences of 4 and 10 hours were increased by 30 minutes each
  The following table presents the adjusted offsite power non-recovery factors for the
  event times that are relevant in the SPAR core damage cutsets:
      SPAR          SPAR base          SPAR base          SPAR base          Modified
    recovery        offsite power        offsite power      offsite power    SPAR non-
      time         non-recovery      non-recovery at    non-recovery at      recovery
                                          11.2 hours        11.2 hours +      (Column 4
                                                          SPAR recovery        divided by
                                                        time in Column 1      Column 3)
    30 min.          0.7314              0.0441            0.0377 1          0.855
    4 hours          0.1566              0.0441            0.02922            0.662
    5 hours            0.1205              0.0441            0.02712            0.615
    9 hours          0.05789              0.0441            0.02122            0.481
  11 hours            0.04500              0.0441            0.01912            0.433
      1    A SPAR recovery time of 1.5 hours is used, as discussed above, to account for
          the lessening of decay heat
      2  The SPAR recovery time was increased by 30 minutes.
                                            A2-7                                Attachment 2


Also, changes were made to the containment venting fault tree.  In the original version, a loss of Division 2 AC was sufficient to fail the containment vent function.  However, a recovery of the vent function is possible by taking manual local actions to open the vent valves.  The failure probability of this action was estimated based on an observed evolution conducted in response to questions concerning this analysis.  This observation revealed that the actions needed to perform this function were dangerous and complex and would be conducted in poor lighting and
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
high temperatures.  Also, operators had little experience. The recovery efforts applied to both a loss of Division 2 AC and to a loss of instrument air.  A non-recovery probability of 0.23 for basic events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following SPAR-H analysis.
      before EDG 2 fails from the speed sensor circuit failure at 11.2 hours, the result for the
 
      base and the current case that contain an EDG 1 FTS event were multiplied by the
  A2-4 Attachment 2 The diagnosis of the need to manually vent containment is obvious based on emergency operating procedures that direct this action when containment pressure reaches 25 psig.  Operators would be continually monitoring this parameter, and it is very unlikely that the effort to manually vent containment would not be undertaken at 25 psig and possibly prior to this point.
      success probability of recovering EDG 1 in 11.2 hours, which was 0.7907 (1- non-
For the action steps, approximately 8 hours of time are available from the time that containment
      recovery probability). This value was then subtracted to obtain a final result for the base
pressurizes to 25 psig until containment would fail.  The nominal time needed to perform the manually venting task is estimated at 2 hours. In this case, the relevant SPAR-H category for time is nominal.  Extreme stress is chosen because the effort to manually open the vent valves involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death.  The effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
the valves and performing several manipulations.  Operators have little experience with this evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack of lighting.
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
  Diagnosis (0.01) Multiplier Action (0.001) Multiplier Available Time Expansive 0.01 Nominal 1 Stress High 2 Extreme 5 Complexity Obvious 0.1 Moderate 2 Experience/Training Nominal 1 Low 3 Procedures Nominal 1 Nominal 1 Ergonomics Nominal 1 Poor 10 Product of Multipliers 0.002  300
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
Diagnosis HEP = 0.01(.002) = 2.0E-5 Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23
      events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours).
Total HEP = 0.23
      This then would suggest that the EDG recovery terms in the SPAR model would
      coincide with the event time t=0 at 11.2 hours following the onset of the LOOP and
To model the failure of the speed sensing circuit and its specific recovery, a new "and" gate was added to the "EDG 1B Faults" fault tree, with an input from two basic events (one modeling the speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are considered similar to the same for the various prior exposure periods. The common cause
      therefore do not require adjustment.
probability for fail-to-run events was restored to its nominal value.  Therefore, only cutsets containing the independent failure of EDG 2 contribute to the delta CDF of this finding.
      The results of this portion of the analysis are presented in the following table:
Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG recovery basic events were removed from cutsets that contained an EDG 2 speed sensor
                CDF/yr         CDF/27 days     EDG1 FTS         EDG1 FTS         Remaining
failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure to restore basic event.  Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery for those sequences. 
                                                  Recovered        Recovered/27 CDF (column
Internal Events Analysis
                                                  (EDG1 FTS        days              3- column 5)
:  A. Risk Estimate for the 2-day period between January 14 and January 16, 2006
                                                  Cutset total
:  During this 48-hour period, it is assumed that EDG 2 was completely unavailable either
                                                  times 0.7907)
because of maintenance or because it would have failed within one minute after a LOOP 
Base Case       4.332E-7       3.204E-8         3.168E-8         2.343E-9         2.970E-8
  A2-5 Attachment 2 demand. To represent the assumed failure and potential recovery of EDG 2, the new basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was set to 0.56.
Current Case 9.216E-6            6.817E-7        4.216E-7         3.119E-8         6.505E-7
  The basis event EPS-DGN-CF-RUN was reset to its base case value of 4.172E-4 to ensure that cutsets containing common cause to run events would cancel out in the base and current case.
Delta                                                                                6.208E-7
CDF/27 days
The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.
D.    Risk Estimate for the 29-day period between October 15, 2007 and November 13,
B. Risk Estimate for the 35-day period between December 10, 2006 and January 14, 2007:  During this exposure period, EDG 2 is assumed to have been capable of running for 5.35 hours. The LOOP frequency used in the analysis was adjusted to reflect the situation that only LOOPs with durations greater than 5.35 hours would result in a risk increase attributable to the speed sensor failure. 
      2007:
The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is 0.1112.  Therefore, the frequency of LOOPs that are not recovered in 5.35 hours is
      During this exposure period, EDG 2 is assumed to have been capable of running for
3.99E-3/yr.
      16.5 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs
Resetting event time t=0 to 5.35 hours following the LOOP event requires that the recovery factors for offsite power be adjusted.  For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
      with durations greater than 16.5 hours would result in a risk increase attributable to the
recovery at 7.35 hours, given that recovery has failed at 5.35 hours. 
      speed sensor failure.
An adjustment to account for the diminishment of decay heat must be considered.  This is because the magnitude of decay heat at 5.35 hours following shutdown is less than in the early moments following a reactor trip, and the timing of core damage sequences is
      The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is
affected by this fact.  In the modified SPAR model, recovery times for offsite power are set at the intervals of 30 minutes, 2 hours, 4 hours, and 10 hours.  The analyst determined that the average decay heat level in the first 30 minutes is approximately two times the average level that exists between 5.35 and 6.35 hours following shutdown.  Therefore, baseline 30-minute SPAR model sequences, that essentially account for
      0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours is
boiloff to fuel uncovery, should be adjusted to 1-hour sequences.  The 2-hour sequences model safety relief valve failures to close, and are based more on inventory control than core heat production. Therefore, no adjustment was made for these sequences.  The analyst determined that decay heat rates leveled out quickly following shutdown and could find no basis for adjusting the times associated with the 4 and 10-hour sequences.
      9.87E-4/yr.
The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:
      Resetting event time t=0 to 16.5 hours following the LOOP event requires that the
 
      recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
  A2-6 Attachment 2
      SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
SPAR recovery time SPAR base offsite power non-recovery
      recovery at 18.5 hours, given that recovery has failed at 16.5 hours.
SPAR base offsite power non-recovery at 5.35 hours  SPAR base offsite power non-recovery at 5.35 hours + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.1112 0.0905
      The analyst considered an adjustment to account for the diminishment of decay heat as
1 0.814 4 hours 0.1566 0.1112 0.0554 0.498 5  hours 0.1205 0.1112 0.0487 0.438 9 hours 0.05789 0.1112 0.0325 0.292 11 hours 0.04500 0.1112 0.0278 0.250
      in the 5.35-hour case above. The analyst determined that the average decay heat level
1. A SPAR recovery time of 1.0 hours is used, as discussed above, to account for the lessening of decay heat
      in the first 30 minutes is approximately four times the average level that exists between
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 5.35 hours, the result for the base and the current case that contain an EDG 1 FTS event were multiplied by the  
      16 and 17 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
success probability of recovering EDG 1 in 5.35 hours, which was 0.5934 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also, the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours). This then would suggest that the EDG recovery terms in the SPAR model would  
      essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The
coincide with the event time t=0 at 5.35 hours following the onset of the LOOP and therefore do not require adjustment.  
                                                A2-8                                  Attachment 2
  The results of this portion of the analysis are presented in the following table:  
  CDF/yr CDF/35 days EDG1 FTS Recovered (EDG1 FTS Cutset total
times 0.5934) EDG1 FTS Recovered/35 days Remaining CDF (column 3- column 5) Base Case 6.989E-7 6.702E-8 3.686E-8 3.535E-9 6.348E-8 Current Case 1.394E-5 1.337E-6 4.706E-7 4.513E-8 1.292E-6  
Delta CDF/35 days     1.229E-6      
  A2-7 Attachment 2 C. Risk Estimate for the 27-day period between November 13, 2007 and December 10, 2007: During this exposure period, EDG 2 is assumed to have been capable of running for 11.2 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with durations greater than 11.2 hours would result in a risk increase attributable to the  
speed sensor failure.
The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is 0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours is 1.58E-3/yr.  


Resetting event time t=0 to 11.2 hours following the LOOP event requires that the recovery factors for offsite power be adjusted.  For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-recovery at 13.2 hours, given that recovery has failed at 11.2 hours. 
      2-hour sequences model safety relief valve failures to close, and are based more on
The analyst considered an adjustment to account for the diminishment of decay heat as
      inventory control than core heat production. Therefore, no adjustment was made for
in the 5.35-hour case above. The analyst determined that the average decay heat level in the first 30 minutes is approximately three times the average level that exists between 11 and 12 hours following shutdown.  Therefore, baseline 30-minute SPAR models, that essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.  The 2-hour sequences model safety relief valve failures to close, and are based more on  
      these sequences. Sequences of 4 and 10 hours were increased by 60 minutes each
inventory control than core heat production. Therefore, no adjustment was made for these sequences. Sequences of 4 and 10 hours were increased by 30 minutes each  
      The following table presents the adjusted offsite power non-recovery factors for the
The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:  
      event times that are relevant in the SPAR core damage cutsets:
        SPAR          SPAR base            SPAR base            SPAR base          Modified
      recovery        offsite power      offsite power        offsite power    SPAR non-
          time        non-recovery        non-recovery at      non-recovery at      recovery
                                            16.5 hours          16.5 hours +      (Column 4
                                                              SPAR recovery      divided by
                                                              time in Column 1    Column 3)
        30 min.          0.7314              0.0275                0.02411          0.876
        4 hours          0.1566              0.0275                0.02032          0.738
      5 hours            0.1205              0.0275                0.01922          0.698
        9 hours          0.05789            0.0275                0.01602          0.582
      11 hours            0.04500            0.0275                0.01482          0.538
      1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the
      lessening of decay heat
      2. The SPAR recovery time was increased by 60 minutes.
      To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
      before EDG 2 fails from the speed sensor circuit failure at 16.5 hours, the result for the
      base and the current case that contain an EDG 1 FTS event were multiplied by the
      success probability of recovering EDG 1 in 16.5 hours, which was 0.8760 (1- non-
      recovery probability). This value was then subtracted to obtain a final result for the base
      and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to
      start event before EDG 2 fails from the speed sensor circuit failure will not end in core
      damage. Also, the methodology used effectively assumes that for EDG 1 fail to run
      events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours).
      This then would suggest that the EDG recovery terms in the SPAR model would
      coincide with the event time t=0 at 16.5 hours following the onset of the LOOP and
      therefore do not require adjustment.
      The results of this portion of the analysis are presented in the following table:
              CDF/yr            CDF/29 days    EDG1 FTS            EDG1 FTS      Remaining
                                                Recovered          Recovered/29 CDF (column
                                                (EDG1 FTS          days          3- column 5)
                                                Cutset total
                                                times 0.8760)
Base Case      3.263E-7          2.593E-8        2.675E-8            2.125E-9      2.380E-8
                                              A2-9                                  Attachment 2


  SPAR recovery time SPAR base offsite power non-recovery
Current Case 7.071E-6              5.618E-7        3.601E-7         2.861E-8       5.332E-7
SPAR base offsite power non-recovery at 11.2 hours  SPAR base offsite power non-recovery at 11.2 hours + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.0441 0.0377
Delta                                                                                5.094E-7
1 0.855 4 hours 0.1566 0.0441 0.0292
CDF/29 days
2 0.662 5  hours 0.1205 0.0441 0.0271
E.   Risk Estimate for the 32-day period between September 13, 2007 and October 15,
2 0.615 9 hours 0.05789 0.0441 0.0212
      2007:
2 0.481 11 hours 0.04500 0.0441 0.0191
      During this exposure period, EDG 2 is assumed to have been capable of running for 22.3
2 0.433  1  A SPAR recovery time of 1.5 hours is used, as discussed above, to account for the lessening of decay heat 2 The SPAR recovery time was increased by 30 minutes.
      hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with
 
      durations greater than 22.3 hours would result in a risk increase attributable to the speed
  A2-8 Attachment 2 To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 11.2 hours, the result for the base and the current case that contain an EDG 1 FTS event were multiplied by the success probability of recovering EDG 1 in 11.2 hours, which was 0.7907 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case.  This adjustment recognizes/assumes that recovery of an EDG 1 fail to
      sensor failure.
start event before EDG 2 fails from the speed sensor circuit failure will not end in core damage.  Also, the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (11.2  hours).  This then would suggest that the EDG recovery terms in the SPAR model would coincide with the event time t=0 at 11.2 hours following the onset of the LOOP and
      The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is
therefore do not require adjustment.
      0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours is
  The results of this portion of the analysis are presented in the following table:
      6.98E-4/yr.
  CDF/yr CDF/27 days EDG1 FTS Recovered
      Resetting event time t=0 to 22.3 hours following the LOOP event requires that the
(EDG1 FTS Cutset total times 0.7907) EDG1 FTS Recovered/27
      recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in
days Remaining CDF (column
      SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-
3- column 5) Base Case 4.332E-7 3.204E-8 3.168E-8 2.343E-9 2.970E-8 Current Case 9.216E-6 6.817E-7 4.216E-7 3.119E-8 6.505E-7  
      recovery at 24.3 hours, given that recovery has failed at 22.3 hours.
Delta CDF/27 days     6.208E-7  D. Risk Estimate for the 29-day period between October 15, 2007 and November 13, 2007:   During this exposure period, EDG 2 is assumed to have been capable of running for 16.5 hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs  
      The analyst considered an adjustment to account for the diminishment of decay heat as in
with durations greater than 16.5 hours would result in a risk increase attributable to the speed sensor failure.
      the 5.35-hour case above. The analyst determined that the average decay heat level in the
The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is 0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours is  
      first 30 minutes is approximately four times the average level that exists between 22 and
9.87E-4/yr.  
      23 hours following shutdown. Therefore, baseline 30-minute SPAR models, that
Resetting event time t=0 to 16.5 hours following the LOOP event requires that the recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-recovery at 18.5 hours, given that recovery has failed at 16.5 hours.  
      essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-
The analyst considered an adjustment to account for the diminishment of decay heat as in the 5.35-hour case above. The analyst determined that the average decay heat level in the first 30 minutes is approximately four times the average level that exists between 16 and 17 hours following shutdown. Therefore, baseline 30-minute SPAR models, that essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The
      hour sequences model safety relief valve failures to close, and are based more on
  A2-9 Attachment 2 2-hour sequences model safety relief valve failures to close, and are based more on inventory control than core heat production. Therefore, no adjustment was made for these sequences. Sequences of 4 and 10 hours were increased by 60 minutes each  
      inventory control than core heat production. Therefore, no adjustment was made for these
The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:  
      sequences. Sequences of 4 and 10 hours were increased by 60 minutes each
      The following table presents the adjusted offsite power non-recovery factors for the event
      times that are relevant in the SPAR core damage cutsets:
          SPAR          SPAR base            SPAR base        SPAR base          Modified
        recovery        offsite power        offsite power      offsite power    SPAR non-
            time        non-recovery        non-recovery at    non-recovery at      recovery
                                              22.3 hours        22.3 hours +      (Column 4
                                                              SPAR recovery        divided by
                                                              time in Column 1    Column 3)
          30 min.          0.7314              0.0194            0.0177 1          0.912
          4 hours          0.1566              0.0194            0.01692            0.871
        5 hours            0.1205              0.0194            0.01492            0.768
          9 hours          0.05789              0.0194            0.01342            0.691
        11 hours          0.04500              0.0194            0.01272            0.655
                                                A2-10                                Attachment 2


  SPAR recovery time SPAR base offsite power non-recovery
          1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the
SPAR base offsite power non-recovery at 16.5 hours  SPAR base offsite power non-recovery at 16.5 hours + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.0275 0.0241
          lessening of decay heat
1 0.876 4 hours 0.1566 0.0275 0.0203
          2. The SPAR recovery time was increased by 60 minutes.
2 0.738 5  hours 0.1205 0.0275 0.0192
    To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered
2 0.698 9 hours 0.05789 0.0275 0.0160
    before EDG 2 fails from the speed sensor circuit failure at 22.3 hours, the result for the base
2 0.582 11 hours 0.04500 0.0275 0.0148
    and the current case that contain an EDG 1 FTS event were multiplied by the success
2 0.538  1. A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the lessening of decay heat 2. The SPAR recovery time was increased by 60 minutes.
    probability of recovering EDG 1 in 22.3 hours, which was 0.9267 (1- non-recovery
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 16.5 hours, the result for the  
    probability). This value was then subtracted to obtain a final result for the base and current
base and the current case that contain an EDG 1 FTS event were multiplied by the success probability of recovering EDG 1 in 16.5 hours, which was 0.8760 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event before EDG 2 fails from the speed sensor circuit failure will not end in core  
    case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event
damage. Also, the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (16.5  hours). This then would suggest that the EDG recovery terms in the SPAR model would coincide with the event time t=0 at 16.5 hours following the onset of the LOOP and therefore do not require adjustment.  
    before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,
    the methodology used effectively assumes that for EDG 1 fail to run events, the failure
    occurs more or less at the same time that EDG 2 fails (22.3 hours). This then would
    suggest that the EDG recovery terms in the SPAR model would coincide with the event time
    t=0 at 22.3 hours following the onset of the LOOP and therefore do not require adjustment.
        The results of this portion of the analysis are presented in the following table:
                  CDF/yr          CDF/32 days    EDG1 FTS          EDG1 FTS          Remaining
                                                  Recovered        Recovered/32 CDF (column
                                                  (EDG1 FTS        days              3- column 5)
                                                  Cutset total
                                                  times 0.9267)
Base Case        2.745E-7        2.407E-8        2.402E-8          2.106E-9          2.196E-8
Current Case 6.033E-6              5.289E-7        3.262E-7          2.860E-8        5.003E-7
Delta                                                                                  4.783E-7
CDF/32 days
The following table presents the aggregate internal events result:
        TIME PERIOD                    DAYS OF EXPOSURE                        DELTA CDF
      01/14/08 - 01/16/08                          2                            1.528E-7
      12/10/07 - 01/14/08                        35                            1.229E-6
      11/13/07 - 12/10/07                        27                            6.208E-7
      10/15/07 - 11/13/07                        29                            5.094E-7
      09/13/07 - 10/15/07                        32                            4.783E-7
                Total Internal Events Delta-CDF                                  2.990E-6
External Events Analysis:
The risk increase from fire initiating events was reviewed and determined to have a small impact
on the risk of the finding. Two fire scenarios were identified where equipment damage could
cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a
control room fire that affected either Vertical Board F or Board C. The second was a fire in the
Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote
because of the confined specificity of their locations and the fact that a combination of hot shorts
of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced
in this manner would be likely to succeed for the station blackout sequences that comprise the
majority of the risk, because a minimum of 11 hours of battery power would be available, power
                                                A2-11                                  Attachment 2


  The results of this portion of the analysis are presented in the following table:
would presumably be available in the switchyard, and the breaker manipulations needed to
  CDF/yr CDF/29 days EDG1 FTS Recovered (EDG1 FTS Cutset total times 0.8760) EDG1 FTS Recovered/29 days Remaining CDF (column 3- column 5) Base Case 3.263E-7 2.593E-8 2.675E-8 2.125E-9 2.380E-8 
complete this task would be possible and within the capability of an augmented plant staff that
  A2-10 Attachment 2 Current Case 7.071E-6 5.618E-7 3.601E-7 2.861E-8 5.332E-7
would respond to the event.
Delta CDF/29 days    5.094E-7  E. Risk Estimate for the 32-day period between September 13, 2007 and October 15, 2007:  During this exposure period, EDG 2 is assumed to have been capable of running for 22.3
Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2
hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with durations greater than 22.3 hours would result in a risk increase attributable to the speed sensor failure. 
power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no
The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is 0.01944.  Therefore, the frequency of LOOPs that are not recovered in 22.3 hours is 6.98E-4/yr.
change in risk from the finding.
Resetting event time t=0 to 22.3 hours following the LOOP event requires that the
The other type of fires that would result in a LOOP are those that require an evacuation of the
recovery factors for offsite power be adjusted.  For instance, in 2-hour sequences in SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-recovery at 24.3 hours, given that recovery has failed at 22.3 hours. 
control room. In this case, plant procedures require offsite power to be isolated from the vital
The analyst considered an adjustment to account for the diminishment of decay heat as in
buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With
the 5.35-hour case above. The analyst determined that the average decay heat level in the first 30 minutes is approximately four times the average level that exists between 22 and 23 hours following shutdown.  Therefore, baseline 30-minute SPAR models, that essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences.  The 2-hour sequences model safety relief valve failures to close, and are based more on
the assumption that the Division 2 EDG will fail 5.35 hours into the event, a station blackout
inventory control than core heat production. Therefore, no adjustment was made for these sequences.  Sequences of 4 and 10 hours were increased by 60 minutes each
would occur at this time. The sequences that could lead to core damage would include a failure
The following table presents the adjusted offsite power non-recovery factors for the event times that are relevant in the SPAR core damage cutsets:
of the Division 1 EDG, such that ultimate success in averting core damage would rely on
SPAR recovery time SPAR base offsite power non-recovery
recovery of either EDG or of offsite power. A review of the onsite electrical distribution system
SPAR base offsite power non-recovery at 22.3 hours  SPAR base offsite power non-recovery at 22.3 hours + SPAR recovery time in Column 1 Modified SPAR non-recovery (Column 4 divided by Column 3) 30 min. 0.7314 0.0194 0.0177
did not reveal any particular difficulties in restoring switchyard power to the vital buses in this
1 0.912 4 hours 0.1566 0.0194 0.0169
scenario, especially given that many hours are available to accomplish this task. The licensee
2 0.871 5  hours 0.1205 0.0194 0.0149
confirmed that for all postulated fire scenarios that would require evacuation of the control room,
2 0.768 9 hours 0.05789 0.0194 0.0134
a undamaged and available power pathway exists from the switchyard through the emergency
2 0.691 11 hours 0.04500 0.0194 0.0127
transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish
2 0.655 
this task would take only a few minutes.
  A2-11 Attachment 2 1.  A SPAR recovery time of 2.0 hours is used, as discussed above, to account for the lessening of decay heat 2.  The SPAR recovery time was increased by 60 minutes. 
In general, the fire risk importance for this finding is small compared to that associated with
To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered before EDG 2 fails from the speed sensor circuit failure at 22.3 hours, the result for the base
internal events because onsite fires do not remove the availability of offsite power in the
and the current case that contain an EDG 1 FTS event were multiplied by the success probability of recovering EDG 1 in 22.3 hours, which was 0.9267 (1- non-recovery probability). This value was then subtracted to obtain a final result for the base and current case.  This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event before EDG 2 fails from the speed sensor circuit failure will not end in core damage.  Also,
switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is
the methodology used effectively assumes that for EDG 1 fail to run events, the failure occurs more or less at the same time that EDG 2 fails (22.3  hours).  This then would suggest that the EDG recovery terms in the SPAR model would coincide with the event time t=0 at 22.3 hours following the onset of the LOOP and therefore do not require adjustment.
presumed to occur as a consequence of such events as severe weather or significant electrical
The results of this portion of the analysis are presented in the following table:
grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially
  CDF/yr CDF/32 days EDG1 FTS Recovered (EDG1 FTS Cutset total times 0.9267) EDG1 FTS Recovered/32 days Remaining CDF (column 3- column 5) Base Case 2.745E-7 2.407E-8 2.402E-8 2.106E-9 2.196E-8 Current Case 6.033E-6 5.289E-7 3.262E-7 2.860E-8 5.003E-7
non-functional (no run time remaining) is small because of a very low initiating event probability.
Delta CDF/32 days    4.783E-7  The following table presents the aggregate internal events result:
The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact
TIME PERIOD DAYS OF EXPOSURE DELTA CDF 01/14/08 - 01/16/08 2 1.528E-7 12/10/07 - 01/14/08 35 1.229E-6 11/13/07 - 12/10/07 27 6.208E-7 10/15/07 - 11/13/07 29 5.094E-7 09/13/07 - 10/15/07 32 4.783E-7 Total Internal Events Delta-CDF 2.990E-6
on overall plant risk. When adjusted for the exposure period of this finding, the cumulative
External Events Analysis
baseline core damage frequency for the zones that had the potential for a control room
: 
evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was
The risk increase from fire initiating events was reviewed and determined to have a small impact on the risk of the finding.  Two fire scenarios were identified where equipment damage could cause a loss of Division 2 vital power, thereby requiring the function of EDG 2.  One was a control room fire that affected either Vertical Board F or Board C.  The second was a fire in the
approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used
Division 2 critical switchgear.  For the control room fires, the scenario probabilities are remote because of the confined specificity of their locations and the fact that a combination of hot shorts of a specific polarity are needed to cause a LOOP.  In addition, recovery from a LOOP induced in this manner would be likely to succeed for the station blackout sequences that comprise the majority of the risk, because a minimum of 11 hours of battery power would be available, power 
several bounding assumptions. The analyst qualitatively assumed that the increase in risk from
  A2-12 Attachment 2 would presumably be available in the switchyard, and the breaker manipulations needed to complete this task would be possible and within the capability of an augmented plant staff that would respond to the event.  
having EDG 2 in a status where it is assumed to fail at 5.35 hours would likely be somewhat
Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2 power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no  
less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated
change in risk from the finding.  
by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours is
The other type of fires that would result in a LOOP are those that require an evacuation of the control room. In this case, plant procedures require offsite power to be isolated from the vital buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With  
well less than 10 percent. Based on these considerations, the analyst concluded that the risk
the assumption that the Division 2 EDG will fail 5.35 hours into the event, a station blackout would occur at this time. The sequences that could lead to core damage would include a failure of the Division 1 EDG, such that ultimate success in averting core damage would rely on recovery of either EDG or of offsite power. A review of the onsite electrical distribution system did not reveal any particular difficulties in restoring switchyard power to the vital buses in this scenario, especially given that many hours are available to accomplish this task. The licensee confirmed that for all postulated fire scenarios that would require evacuation of the control room,  
related to fires would not be sufficiently large to change the risk characterization of this finding.
a undamaged and available power pathway exists from the switchyard through the emergency transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish this task would take only a few minutes.  
The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.
In general, the fire risk importance for this finding is small compared to that associated with  
As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope
internal events because onsite fires do not remove the availability of offsite power in the switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is presumed to occur as a consequence of such events as severe weather or significant electrical grid failures.   Also, the fire risk corresponding the two-day period when EDG 2 was essentially non-functional (no run time remaining) is small because of a very low initiating event probability.  
of the seismic risk particular to this finding. The generic median earthquake acceleration
assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at
Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency
assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered
by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is
capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an
earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would
remove offsite power but not damage other equipment important to safe shutdown. In the
                                                  A2-12                                Attachment 2


The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact on overall plant risk.  When adjusted for the exposure period of this finding, the cumulative baseline core damage frequency for the zones that had the potential for a control room evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was
internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours
approximately 3.6E-7/yr.  The methods used to screen these areas were not rigorous and used several bounding assumptions.  The analyst qualitatively assumed that the increase in risk from having EDG 2 in a status where it is assumed to fail at 5.35 hours would likely be somewhat less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours is
duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours
well less than 10 percent.  Based on these considerations, the analyst concluded that the risk related to fires would not be sufficiently large to change the risk characterization of this finding.
duration would likely have recovery characteristics closely matching that from an earthquake.
The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.  As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope of the seismic risk particular to this finding.  The generic median earthquake acceleration assumed to cause a loss of offsite power is 0.3g.  The estimated frequency of earthquakes at
The ratio between these two frequencies is 44. Based on this, the analyst qualitatively
Cooper of this magnitude or greater is 9.828E-5/yr.  The generic median earthquake frequency assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered by the EDGs would likely fail at approximately 2.0g.  The seismic information for Cooper is capped at a magnitude of 1.0g with a frequency of 8.187E-6.  This would suggest that an earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would
concluded that the risk associated with seismic events would be small compared to the internal
remove offsite power but not damage other equipment important to safe shutdown.  In the 
result.
  A2-13 Attachment 2 internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours duration would likely have recovery characteristics closely matching that from an earthquake. The ratio between these two frequencies is 44. Based on this, the analyst qualitatively concluded that the risk associated with seismic events would be small compared to the internal result.  
Flooding could be a concern because of the proximity to the Missouri River. However, floods
Flooding could be a concern because of the proximity to the Missouri River. However, floods that would remove offsite power would also likely flood the EDG compartments and therefore not result in a significant change to the risk associated with the finding. The switchyard elevation is below that of the power block by several feet, but it is not likely that a slight inundation of the switchyard would cause a loss of offsite power. The low frequency of floods within the thin slice of water elevations that would remove offsite power for at least 5.35 hours but not debilitate the diesel generators indicates that external flooding would not add appreciably to the risk of this finding.  
that would remove offsite power would also likely flood the EDG compartments and therefore
Based on the above, the analyst determined that external events did not add significantly to the risk of the finding.  
not result in a significant change to the risk associated with the finding. The switchyard
elevation is below that of the power block by several feet, but it is not likely that a slight
inundation of the switchyard would cause a loss of offsite power. The low frequency of floods
within the thin slice of water elevations that would remove offsite power for at least 5.35 hours
but not debilitate the diesel generators indicates that external flooding would not add
appreciably to the risk of this finding.
Based on the above, the analyst determined that external events did not add significantly to the
risk of the finding.
Large Early Release Frequency:
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for
the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences
to determine an estimate of the change in large early release frequency caused by the finding.
The LERF consequences of this performance deficiency were similar to those documented in a
previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service
water pumps. The final determination letter was issued on March 31, 2005 and is located in
ADAMS, Accession No. ML050910127. The following excerpt from this document addressed
the LERF issue:
        The NRC reevaluated the portions of the preliminary significance determination related
        to the change in LERF. In the regulatory conference, the licensee argued that the
        dominant sequences were not contributors to the LERF. Therefore, there was no
        change in LERF resulting from the subject performance deficiency. Their argument was
        based on the longer than usual core damage sequences, providing for additional time to
        core damage, and the relatively short time estimated to evacuate the close in population
        surrounding Cooper Nuclear Station.
        LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment
        Integrity Significance Determination Process as: the frequency of those accidents
        leading to significant, unmitigated release from containment in a time frame prior to the
        effective evacuation of the close-in population such that there is a potential for early
        health effect. The NRC noted that the dominant core damage sequences documented
        in the preliminary significance determination were long sequences that took greater than
        12 hours to proceed to reactor pressure vessel breach. The shortest calculated interval
        from the time reactor conditions would have met the requirements for entry into a
        general emergency (requiring the evacuation) until the time of postulated containment
        rupture was 3.5 hours. The licensee stated that the average evacuation time for Cooper,
        from the declaration of a General Emergency was 62 minutes.
                                                A2-13                                    Attachment 2


        The NRC determined that, based on a 62-minute average evacuation time, effective
Large Early Release Frequency
        evacuation of the close-in population could be achieved within 3.5 hours. Therefore, the
: 
        dominant core damage sequences affected by the subject performance deficiency were
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences
        not LERF contributors. As such, the NRCs best estimate determination of the change in
to determine an estimate of the change in large early release frequency caused by the finding. 
        LERF resulting from the performance deficiency was zero.
The LERF consequences of this performance deficiency were similar to those documented in a previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service water pumps.  The final determination letter was issued on March 31, 2005 and is located in
In the current analysis, the total contribution of the 30-minute sequences for the 35-day period
ADAMS, Accession No. ML050910127. The following excerpt from this document addressed the LERF issue:
(when 5.35 hours of EDG run time remained) to the current case CDF is only 0.54% of the total.
The NRC reevaluated the portions of the preliminary significance determination related to the change in LERF.  In the regulatory conference, the licensee argued that the
That is, almost all of the risk associated with this performance deficiency involves sequences of
dominant sequences were not contributors to the LERF.  Therefore, there was no change in LERF resulting from the subject performance deficiency.  Their argument was based on the longer than usual core damage sequences, providing for additional time to core damage, and the relatively short time estimated to evacuate the close in population surrounding Cooper Nuclear Station.
duration 5.35 hours or longer following the loss of all ac power.
LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process" as: "the frequency of those accidents leading to significant, unmitigated release from containment in a time frame prior to the effective evacuation of the close-in population such that there is a potential for early health effect."  The NRC noted that the dominant core damage sequences documented in the preliminary significance determination were long sequences that took greater than
The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of
12 hours to proceed to reactor pressure vessel breach.  The shortest calculated interval from the time reactor conditions would have met the requirements for entry into a general emergency (requiring the evacuation) until the time of postulated containment rupture was 3.5 hours.  The licensee stated that the average evacuation time for Cooper, from the declaration of a General Emergency was 62 minutes.
these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the
 
two-hour sequences comprise only 0.3 percent of the total.
  A2-14 Attachment 2 The NRC determined that, based on a 62-minute average evacuation time, effective evacuation of the close-in population could be achieved within 3.5 hours. Therefore, the dominant core damage sequences affected by the subject performance deficiency were not LERF contributors. As such, the NRC's best estimate determination of the change in LERF resulting from the performance deficiency was zero.  
Consequently, the analyst determined that the risk associated with large early release was very
small.
In the current analysis, the total contribution of the 30-minute sequences for the 35-day period (when 5.35 hours of EDG run time remained) to the current case CDF is only 0.54% of the total. That is, almost all of the risk associated with this performance deficiency involves sequences of duration 5.35 hours or longer following the loss of all ac power.  
References:
SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004
The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the two-hour sequences comprise only 0.3 percent of the total.  
GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)
Consequently, the analyst determined that the risk associated with large early release was very small. References
Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1
:  SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004 GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary) Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1  
NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of
NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-2004"
Loss of Offsite Power Events: 1986-2004"
Peer Review
Peer Review:
:          See-Meng Wong, NRR George McDonald, NRR
See-Meng Wong, NRR
George McDonald, NRR
                                                A2-14                                Attachment 2
}}
}}

Revision as of 17:05, 14 November 2019

IR 05000298-08-002; on 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications and Postmaintenance Testing
ML081270639
Person / Time
Site: Cooper Entergy icon.png
Issue date: 05/06/2008
From: Chamberlain D
NRC/RGN-IV/DRP
To: Minahan S
Nebraska Public Power District (NPPD)
References
EA-08-124 IR-08-002
Download: ML081270639 (42)
v • d • e


See also: IR 05000298/2008002

Text

UNITED STATES

NUC LE AR RE G UL AT O RY C O M M I S S I O N

R E GI ON I V

612 EAST LAMAR BLVD , SU I TE 400

AR LI N GTON , TEXAS 76011-4125

May 6, 2008

EA 08-124

Stewart B. Minahan

Vice President - Nuclear and CNO

Nebraska Public Power District

PO Box 98

Brownville NE 68321

SUBJECT: COOPER NUCLEAR STATION - NRC INTEGRATED INPSECTION

REPORT 05000298/2008002

Dear Mr. Minahan:

On March 22, 2008 the U.S. Nuclear Regulatory Commission (NRC) completed an integrated

inspection at your Cooper Nuclear Station. The enclosed report documents the inspection

results, which were discussed on April 14, 2008 with Mr. M. Colomb, General Manager of Plant

Operations, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and

compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed

personnel.

As described in Section 1R19 of this report, the NRC concluded that the failure to establish

adequate procedural controls for the maintenance of electrical connections on diesel generators

led to the failure of Diesel Generator 2 during testing on January 15, 2008. The safety

significance of this finding was assessed on the basis of the best available information, including

influential assumptions, using the applicable Significance Determination Process and was

preliminarily determined to be a White (low to moderate safety significance) finding.

Attachment 2 of this report provides a detailed description of the preliminary risk assessment.

In accordance with NRC Inspection Manual Chapter 0609, Significance Determination

Process, we intend to complete our evaluation using the best available information and issue

our final determination of safety significance within 90 days of this letter.

This finding does not represent an immediate safety concern because of the corrective actions

you have taken. These actions included applying thread locking compound to the amphenol

connections on both diesel generators.

Also, this finding constitutes an apparent violation of NRC requirements and is being

considered for escalated enforcement action in accordance with the NRC Enforcement

Policy. The current Enforcement Policy is included on the NRCs Web site at

http://www.nrc.gov/reading-rm/adams.html. This significance determination process

encourages an open dialog between the staff and the licensee, however the dialogue should not

impact the timeliness of the staffs final determination.

Nebraska Public Power District -2-

Before we make a final decision on this matter, we are providing you an opportunity (1) to

present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive

at the finding and its significance, at a Regulatory Conference, or (2) submit your position on the

finding to the NRC in writing. If you request a Regulatory Conference, it should be held within

30 days of the receipt of this letter and we encourage you to submit documentation at least one

week prior to the conference in an effort to make the conference more efficient and effective. If

a Regulatory Conference is held, it will be open for public observation. If you decide to submit

only a written response, such submittal should be sent to the NRC within 30 days of the receipt

of this letter. If you decline to request a regulatory conference or submit a written response,

your ability to appeal the final SDP determination can be affected, in that by not doing either you

fail to meet the appeal requirements stated in the prerequisite and limitation sections of

Attachment 2 of IMC 0609.

Please contact Mr. Rick Deese at (817) 276-6573 within 10 business days of the date of this

letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will

continue with our significance determination and enforcement decision and you will be advised

by separate correspondence of the results of our deliberation on this matter.

Since the NRC has not made a final determination in this matter, no Notice of Violation is being

issued for the inspection finding at this time. In addition, please be advised that the number and

characterization of the apparent violation described in the enclosed inspection report may

change as a result of further NRC review.

The report also documents one finding which was evaluated under the risk SDP as having very

low safety significance (Green). The finding was determined to involve a violation of NRC

requirements. However, because of very low safety significance, and because the issue was

entered into your corrective action program, the NRC is treating the issue as a noncited violation

in accordance with Section VI. A. 1 of the NRC Enforcement Policy. If you contest the subject

or severity of a Non-Cited Violation, you should provide a response within 30 days of the date of

this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory

Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the

Regional Administrator, U.S. Nuclear Regulatory Commission - Region IV, 611 Ryan Plaza

Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001; and the Resident Inspector

Office at the Cooper Nuclear Station.

Nebraska Public Power District -3-

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter

and its enclosure will be made available electronically for public inspection in the NRC

Public Document Room or from the Publicly Available Records (PARS) component of

NRCs document system (ADAMS), accessible from the NRC Web site at

http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Dwight D. Chamberlain, Director

Division of Reactor Projects

Docket No: 50-298

License No: DPR-46

Enclosure:

NRC Inspection Report 05000298/2008002

w/Attachments:

Attachment 1: Supplemental Information

Attachment 2: Preliminary Risk Assessment

cc w/enclosure:

John C. McClure, Vice President

Gene Mace

and General Counsel

Nuclear Asset Manager

Nebraska Public Power District

Nebraska Public Power District

P.O. Box 499

P.O. Box 98

Columbus, NE 68602-0499

Brownville, NE 68321

David Van Der Kamp Michael J. Linder, Director

Licensing Manager Nebraska Department of

Nebraska Public Power District Environmental Quality

P.O. Box 98 P.O. Box 98922

Brownville, NE 68321 Lincoln, NE 68509-8922

Julia Schmitt, Manager

Radiation Control Program

Chairman

Nebraska Health & Human Services

Nemaha County Board of Commissioners

Dept. of Regulation & Licensing

Nemaha County Courthouse

Division of Public Health Assurance

1824 N Street

301 Centennial Mall, South

Auburn, NE 68305

P.O. Box 95007

Lincoln, NE 68509-5007

Nebraska Public Power District -4-

H. Floyd Gilzow

Director, Missouri State Emergency

Deputy Director for Policy

Management Agency

Missouri Department of Natural Resources

P.O. Box 116

P. O. Box 176

Jefferson City, MO 65102-0116

Jefferson City, MO 65102-0176

Chief, Radiation and Asbestos Melanie Rasmussen, State Liaison Officer/

Control Section Radiation Control Program Director

Kansas Department of Health Bureau of Radiological Health

and Environment Iowa Department of Public Health

Bureau of Air and Radiation Lucas State Office Building, 5th Floor

1000 SW Jackson, Suite 310 321 East 12th Street

Topeka, KS 66612-1366 Des Moines, IA 50319

John F. McCann, Director, Licensing Keith G. Henke, Planner

Entergy Nuclear Northeast Division of Community and Public Health

Entergy Nuclear Operations, Inc. Office of Emergency Coordination

440 Hamilton Avenue 930 Wildwood, P.O. Box 570

White Plains, NY 10601-1813 Jefferson City, MO 65102

Ronald L. McCabe, Chief

Paul V. Fleming, Director of Nuclear Technological Hazards Branch

Safety Assurance National Preparedness Division

Nebraska Public Power District DHS/FEMA

P.O. Box 98 9221 Ward Parkway

Brownville, NE 68321 Suite 300

Kansas City, MO 64114-3372

Nebraska Public Power District -5-

Electronic distribution by RIV:

Regional Administrator (Elmo.Collins@nrc.gov)

DRP Director (Dwight.Chamberlain@nrc.gov)

DRS Director (Roy.Caniano@nrc.gov)

DRS Deputy Director (Troy.Pruett@nrc.gov)

Senior Resident Inspector (Nick.Taylor@nrc.gov)

Branch Chief, DRP/C (Rick.Deese@nrc.gov)

Senior Project Engineer, DRP/C (Wayne.Walker@nrc.gov)

Team Leader, DRP/TSS (Chuck.Paulk@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

Only inspection reports to the following:

DRS STA (Dale.Powers@nrc.gov)

J. Adams, OEDO RIV Coordinator (John.Adams@nrc.gov)

P. Lougheed, OEDO RIV Coordinator (Patricia.Lougheed@nrc.gov)

ROPreports

CNS Site Secretary (Sue.Farmer@nrc.gov)

SUNSI Review Completed: WCW ADAMS: ; Yes No Initials: WCW

Publicly Available Non-Publicly Available Sensitive  ; Non-Sensitive

R:\_REACTORS\_CNS\2008\CN2008-002RP-NHT.doc ML081270639

RIV:SRI:DRP/C RI:DRP/C SPE:DRP/C DRS:SRA C:DRS/OB C:DRS/EB2

NHTaylor MLChambers WCWalker MFRunyan RELantz LJSmith

E-Walker /RA/ E-mailed /RA/ /RA/ /RA/ /RA/

4/24/08 4/23/08 4/24 /08 4/24/08 4/24/08 4/23/08

C:DRS/EB1 C:DRS/PSB C:DRP/C ACES:SES D:DRP

RLBywater MPShannon RWDeese GMVasquez DDChamberlain

/RA/ /RA/ /RA/ /RA/

4/22/08 4/22/08 4/ /08 4/24/08 5/02/08

OFFICIAL RECORD COPY T=Telephone E=Email F=Fax

U. S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket No: 05000298

License No: PR-46

Report No: 5000298/2008002

Licensee: Nebraska Public Power District

Facility: Cooper Nuclear Station

Location: PO Box 98, Brownville, NE 68321

Dates: January 1 through March 22, 2008

Inspectors: N. Taylor, Senior Resident Inspector

M. Chambers, Resident Inspector

P. Elkmann, Emergency Preparedness Inspector

M. Runyan, Senior Reactor Analyst

Approved by: D. Chamberlain, Director

Division of Reactor Projects

-1- Enclosure

SUMMARY OF FINDINGS

IR 05000298/2008002; 01/01/2008 - 03/22/2008; Cooper Nuclear Station. Plant Modifications

and Postmaintenance Testing.

This report covers a three-month period of inspection by resident inspectors and announced

baseline inspections by regional inspectors. The significance of most findings is indicated by

their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance

Determination Process. Findings for which the Significance Determination Process does not

apply may be Green or be assigned a severity level after NRC management review. The NRCs

program for overseeing the safe operation of commercial nuclear power reactors is described in

NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

  • Green. The inspectors identified a Green noncited violation of Technical

Specification 5.4.1.a regarding the licensees failure to follow the requirements of

Maintenance Procedure 7.0.7, Scaffolding Construction and Control.

Specifically, licensee personnel failed to inspect all existing scaffolds and failed

to identify multiple scaffolding interactions with safety-related equipment during a

required annual scaffold inspection on January 21, 2008. This issue was

entered Into the licensees corrective action program as Condition

Report CR-CNS-2008-01576.

The finding is more than minor because if left uncorrected the failure to perform

annual scaffold inspections could become a more significant safety concern.

Specifically, annual inspections failed to inspect all existing scaffolds and failed to

identify multiple scaffolding interactions with safety-related equipment. Using the

Manual Chapter 0609, Significance Determination Process, Phase 1

Worksheet, the finding is determined to have a very low safety significance

because it did not result in the loss of function of a Technical Specification

required system for greater than its allowed outage time. The cause of this

finding is related to the human performance crosscutting component of work

practices because maintenance personnel did not follow the requirements of

Maintenance Procedure 7.0.7 (H.4(b)) (Section 71111.18).

  • TBD. Two examples of a self-revealing apparent violation of Technical

Specification 5.4.1.a were identified regarding the licensees failure to establish

procedural controls for maintenance of electrical connections on essential

equipment. In the first example, the licensee failed to include amphenol

connections within the scope of existing periodic electrical connection inspections

to identify loosening connections. In the second example, the licensee failed to

incorporate internal operating experience into work control procedures to ensure

that diesel generator-mounted amphenol connections were solidly attached

following maintenance. These failures to establish adequate procedural controls

led to the trip of Diesel Generator 2 during testing on January 15, 2008. This

issue was entered into the licensees corrective action program as Condition

Report CR-CNS 2008-00304.

-2- Enclosure

The finding affected the mitigating systems cornerstone and is more than minor

because it is associated with the cornerstone attribute of equipment performance

and affects the associated cornerstone objective to ensure the availability,

reliability, and capability of systems that respond to initiating events to prevent

undesirable consequences. The Phase 1 worksheets in Inspection Manual

Chapter 0609, "Significance Determination Process," were used to conclude that

a Phase 2 analysis was required because the finding represents an actual loss of

safety function of a single train for greater than its Technical Specification

allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, Determining the Significance of

Reactor Inspection Findings for At-Power Situations. Entering the site-specific

pre-solved table with an assumed exposure time of greater than 30 days yielded

a result of red, or very high significance. A Phase 3 analysis conducted by a risk

analyst preliminarily determined the finding to be of white, or low to moderate

significance. The cause of the finding is related to the corrective action

component of the crosscutting area of problem identification and resolution in

that the licensee failed to take appropriate corrective actions for a 2007 NRC

inspection finding which identified inadequate maintenance procedures for

checking the tightness of diesel generator electrical connections (P.1(d))

(Section 71111.19).

B. Licensee-Identified Violations

No violations of significance were identified.

-3- Enclosure

REPORT DETAILS

Summary of Plant Status

The plant began the inspection period at 100 percent power. On February 19, 2008, the plant

began coastdown to Refueling Outage 24. On March 20, 2008, reactor power dropped from

90 percent to approximately 58 percent due to an unplanned trip of reactor recirculation pump

motor Generator B. The reactor was returned to full power later in the day, where it remained

for the rest of the inspection period.

1. REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency

Preparedness

1R04 Equipment Alignment (71111.04)

.1 Quarterly Partial System Walkdowns

a. Inspection Scope

The inspectors selected these systems based on their risk significance relative to the

reactor safety cornerstones at the time they were inspected. The inspectors attempted

to identify any discrepancies that could impact the function of the system, and, therefore,

potentially increase risk. The inspectors reviewed applicable operating procedures,

system diagrams, Updated Final Safety Analysis Report (UFSAR), Technical

Specification (TS) requirements, Administrative TSs, outstanding work orders (WOs),

condition reports (CR), and the impact of ongoing work activities on redundant trains of

equipment in order to identify conditions that could have rendered the systems incapable

of performing their intended functions. The inspectors also walked down accessible

portions of the systems to verify system components and support equipment were

aligned correctly and operable. The inspectors examined the material condition of the

components and observed operating parameters of equipment to verify that there were

no obvious deficiencies. The inspectors also verified that the licensee had properly

identified and resolved equipment alignment problems that could cause initiating events

or impact the capability of mitigating systems or barriers and entered them into the

corrective action program (CAP) with the appropriate significance characterization.

Documents reviewed are listed in the attachment.

The inspectors performed partial system walkdowns of the following risk-significant

systems:

  • January 30, 2008, Reactor Equipment Cooling (REC) Heat Exchanger (HX) B

during REC HX A limiting condition for operation (LCO)

The inspectors completed three samples.

-4- Enclosure

b. Findings

No findings of significance were identified.

.2 Semi-Annual Complete System Walkdown

a. Inspection Scope

On March 11, 2008 the inspectors performed a complete system alignment inspection of

the DG 1 to verify the functional capability of the system. This system was selected

because it was considered both safety-significant and risk-significant in the licensees

probabilistic risk assessment. The inspectors walked down the system to review

mechanical and electrical equipment line ups, electrical power availability, system

pressure and temperature indications, as appropriate, component labeling, component

lubrication, component and equipment cooling, hangers and supports, operability of

support systems, and to ensure that ancillary equipment or debris did not interfere with

equipment operation. A review of a sample of past and outstanding WOs was

performed to determine whether any deficiencies significantly affected the system

function. In addition, the inspectors reviewed the CAP database to ensure that system

equipment alignment problems were being identified and appropriately resolved.

  • March 11, 2008, DG 1 during DG 2 LCO

Documents reviewed by the inspectors included:

  • CNS System Operating Procedure 2.2.20, Standby AC Power System (Diesel

Generator), Revision 70

These activities constituted one complete system walkdown sample as defined by

Inspection Procedure 71111.04-05.

b. Findings

No findings of significance were identified.

1R05 Fire Protection (71111.05AQ)

a. Inspection Scope

The inspectors conducted fire protection walkdowns which were focused on availability,

accessibility, and the condition of firefighting equipment.

The inspectors reviewed areas to assess if the licensee had implemented a fire

protection program that adequately controlled combustibles and ignition sources within

the plant, effectively maintained fire detection and suppression capability, maintained

passive fire protection features in good material condition, and had implemented

adequate compensatory measures for out of service, degraded or inoperable fire

protection equipment, systems, or features in accordance with the licensees fire plan.

The inspectors selected fire areas based on their overall contribution to internal fire risk

as documented in the plants Individual Plant Examination of External Events with later

additional insights, their potential to impact equipment which could initiate or mitigate a

-5- Enclosure

plant transient, or their impact on the plants ability to respond to a security event. Using

the documents listed in the attachment, the inspectors verified that fire hoses and

extinguishers were in their designated locations and available for immediate use; that

fire detectors and sprinklers were unobstructed, that transient material loading was

within the analyzed limits; and fire doors, dampers, and penetration seals appeared to

be in satisfactory condition. The inspectors also verified that minor issues identified

during the inspection were entered into the licensees corrective action program.

  • February 13, 2008, Fire Zone 2C during fuel movement
  • March 11, 2008, Fire Zone 14A DG 1 during DG 2 LCO
  • March 11, 2008, Fire Zone 14C DG 1 Daytank during DG 2 LCO
  • March 15, 2008, Fire Zone 19C Controlled Access Corridor

Documents reviewed by the inspectors included:

  • CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14A, dated

February 28, 2003

  • CNS Fire Hazards Analysis Matrix for Fire Area IX, Fire Zone 14C, dated

November 5, 2007

These activities constituted four quarterly fire protection inspection samples as defined

by Inspection Procedure 71111.05-05.

b. Findings

No findings of significance were identified.

1R07 Annual Heat Sink Performance (71111.07)

a. Inspection Scope

The inspectors reviewed the licensees testing of A and B REC heat exchangers to verify

that potential deficiencies did not mask the licensees ability to detect degraded

performance, to identify any common cause issues that had the potential to increase

risk, and to ensure that the licensee was adequately addressing problems that could

result in initiating events that would cause an increase in risk. The inspectors reviewed

the licensees observations as compared against acceptance criteria, the correlation of

scheduled testing and the frequency of testing, and the impact of instrument

inaccuracies on test results. Inspectors also verified that test acceptance criteria

considered differences between test conditions, design conditions, and testing

conditions.

  • January 25 and January 21, 2008, A and B REC HX performance tests

Documents reviewed are listed in the attachment.

This inspection constitutes one sample as defined in Inspection Procedure 71111.07-05.

-6- Enclosure

b. Findings

No findings of significance were identified.

1R11 Licensed Operator Requalification Program (71111.11)

Conformance With Simulator Requirements Specified in 10 CFR 55.46

a. Inspection Scope

The inspectors observed testing and training of senior reactor operators and reactor

operators to identify deficiencies and discrepancies in the training, to assess operator

performance, and to assess the evaluator's critique. The training scenario involved a

tornado, station blackout and a loss of shutdown cooling.

  • February 28, 2008, Crew E drill

Documents reviewed by the inspectors included:

The inspectors completed one sample.

b. Findings

No findings of significance were identified.

1R12 Maintenance Effectiveness (71111.12)

a. Inspection Scope

The inspectors evaluated degraded performance issues involving the risk significant

systems of events such as where ineffective equipment maintenance has resulted in

valid or invalid automatic actuations of engineered safeguards systems and

independently verified the licensee's actions to address system performance or condition

problems in terms of the following:

  • implementing appropriate work practices;
  • identifying and addressing common cause failures;
  • scoping of systems in accordance with 10 CFR 50.65(b) of the maintenance rule;
  • characterizing system reliability issues for performance;
  • charging unavailability for performance;
  • trending key parameters for condition monitoring;

-7- Enclosure

  • verifying appropriate performance criteria for structures, systems, and

components (SSCs) functions classified as (a)(2) or appropriate and adequate

goals and corrective actions for systems classified as (a)(1).

The inspectors assessed performance issues with respect to the reliability, availability,

and condition monitoring of the system. In addition, the inspectors verified maintenance

effectiveness issues were entered into the corrective action program with the appropriate

significance characterization.

assembly (EPA) breaker failures January 12, 2008

  • March 19, 2008, DG 2 Postmaintenance testing (PMT) failure January 15, 2008

Documents reviewed by the inspectors included:

  • Functional Failure Evaluation for functions RPS-F01, RPS-F02, RPS-SD1
  • Functional failure Evaluations for functions DG-PF01B, ROP-MSPI-EAC

This inspection constitutes two quarterly maintenance effectiveness samples as defined

in Inspection Procedure 71111.12-05.

b. Findings

No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)

a. Inspection Scope

The inspectors reviewed the licensee's evaluation and management of plant risk for the

maintenance and emergent work activities affecting risk-significant and safety-related

equipment listed below to verify that the appropriate risk assessments were performed

prior to removing equipment for work:

  • March 6, 2008, Inoperability of both DGs on September 11, 2007

These activities were selected based on their potential risk significance relative to the

reactor safety cornerstones. As applicable for each activity, the inspectors verified that

risk assessments were performed as required by 10 CFR 50.65(a)(4) and were accurate

and complete. When emergent work was performed, the inspectors verified that the

plant risk was promptly reassessed and managed. The inspectors reviewed the scope

of maintenance work, discussed the results of the assessment with the licensee's

probabilistic risk analyst or shift technical engineer, and verified plant conditions were

consistent with the risk assessment. The inspectors also reviewed TS requirements and

walked down portions of redundant safety systems, when applicable, to verify risk

analysis assumptions were valid and applicable requirements were met. Documents

reviewed are listed in the attachment.

The inspectors completed two samples.

-8- Enclosure

b. Findings

No findings of significance were identified.

1R15 Operability Evaluations (71111.15)

a. Inspection Scope

The inspectors reviewed the following issues:

The inspectors selected these potential operability issues based on the risk-significance

of the associated components and systems. The inspectors evaluated the technical

adequacy of the evaluations to ensure that TS operability was properly justified and the

subject component or system remained available such that no unrecognized increase in

risk occurred. The inspectors compared the operability and design criteria in the

appropriate sections of the TS and UFSAR to the licensees evaluations, to determine

whether the components or systems were operable. Where compensatory measures

were required to maintain operability, the inspectors determined whether the measures

in place would function as intended and were properly controlled. The inspectors

determined, where appropriate, compliance with bounding limitations associated with the

evaluations. Additionally, the inspectors also reviewed a sampling of corrective action

documents to verify that the licensee was identifying and correcting any deficiencies

associated with operability evaluations.

  • January 14, 2008, DG 2 operability and common cause evaluation for loss of

overspeed governor sightglass during run

  • January 15, 2008, operability evaluation of control room Board C non-essential

meters without isolation devices in DG 1 and DG 2 essential circuits, on January

14, 2008

  • February 14, 2008, common cause evaluation for DG 1 after a lube oil leak in

DG 2

  • March 19, 2008, RPS EPA circuit breakers operability evaluations on

January 25, 2008 and February 6, 2008

This inspection constitutes four samples as defined in Inspection Procedure 71111.15-05.

b. Findings

No findings of significance were identified.

1R18 Plant Modifications (71111.18)

Temporary Modifications

a. Inspection Scope

The inspectors reviewed the UFSAR, plant drawings, procedure requirements, and TSs

to ensure that temporary alterations and configuration changes to the plant conformed to

-9- Enclosure

these guidance documents and the requirements of 10 CFR 50.59. The inspectors:

(1) verified that the modifications did not have an affect on system operability/availability;

(2) verified that the installations were consistent with modification documents;

(3) ensured that the post-installation test results were satisfactory and that the impacts of

the temporary modifications on permanently installed SSCs were supported by the test;

and (4) verified that appropriate safety evaluations were completed. The inspectors

reviewed the following temporary modifications:

Documents reviewed by the inspectors included:

  • Maintenance Procedure 7.0.7, Scaffolding Construction and Control,

Revision 24

The inspectors completed one sample.

b. Findings

Introduction. The inspectors identified a Green noncited violation of TS 5.4.1.a

regarding the licensees failure to follow the requirements of Maintenance Procedure

7.0.7, Scaffolding Construction and Control. Specifically, licensee personnel failed to

inspect all existing scaffolds and failed to identify multiple scaffolding interactions with

safety-related equipment during a required annual scaffold inspection on January 21,

2008.

Description. During pre-outage scaffold inspections on February 7, 2008, the licensee

discovered that some existing scaffolds were not built in accordance with established

procedures. Specifically, the licensee discovered that scaffolds constructed in 1999 had

been built in contact with safety-related service water piping, RHR piping, pipe hangers,

electrical conduit and the torus shell. This condition was documented in

CR-CNS-2008-00822. After determining that the scaffold did not affect the operability of

the impacted safety systems, the licensee took actions to remove the non-compliant

scaffold on February 22, 2008, and closed the CR.

The inspectors noted that Maintenance Procedure 7.0.7, Scaffolding Construction and

Control, Revision 24, contains the following requirement in Paragraph 3.2:

During the month of January, all erected scaffolds shall have an Industrial

Safety examination performed to ensure compliance with this procedure. This

examination is required prior to placing a new tag and entering the scaffold into

the new calendar year log.

The inspectors also noted that the required annual examination had been completed on

January 21, 2008. The maintenance personnel who conducted the examination in

WO 4552687 documented completion with no discrepancies.

On March 6, 2008, the inspectors questioned licensee management regarding the

performance of the annual scaffold examinations. Specifically, the inspectors asked why

the non-compliant scaffold had not been identified during the required annual scaffold

examinations. Following this meeting, the licensee conducted a scaffolding walkdown to

- 10 - Enclosure

identify any remaining non-compliances. The following additional violations of

Procedure 7.0.7 were discovered during this walkdown:

  • Scaffold 08-04 erected under WO 4566810 on December 10, 2007 had

a board in contact with high pressure coolant injection steam line drip

leg piping. Contrary to Procedure 7.0.7, this scaffold had not been

inspected due to a misperception that only long term scaffolds that

had been in place greater than 90 days needed to be inspected. The

licensee documented this condition in CR-CNS-2008-01551.

  • Scaffold 08-06 was discovered to be in contact with safety-related

conduit and pipe hangers in the torus area. The licensee was unable to

determine when this scaffold had been installed.

  • Eight examples of non-compliant scaffolding handrails were discovered

in contact with safety system components in the torus area which had

been installed in 2002. This example, documented in

CR-CNS-2008-01563 on March 11, 2008 was not identified by the

annual examination because it was not included in the scaffold log and

was therefore not inspected.

The inspectors determined that Procedure 7.0.7 had been violated during the

January 21, 2008 annual scaffolding examination in that the examiner reviewed only

those scaffolds identified in the scaffolding log as Long Term Permanent versus all

erected scaffolds as required by the procedure. As a result, seven existing scaffolds

were not inspected, despite the fact that some of them had been installed for more than

one year at the time of the inspection. In addition, the examiner did not conduct a

thorough inspection to ensure compliance with this procedure. Obvious non-

compliances existed in some of the installed scaffolds that were not identified until

months later.

The inspectors also noted that since handrails built from scaffolding materials do not

meet the definition of a scaffold in Procedure 7.0.7 in that they do not contain an

elevated platform, no annual inspections have been performed on these structures.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to comply with the requirements of Maintenance Procedure 7.0.7,

Scaffolding Construction and Control. The finding is more than minor because if left

uncorrected the failure to perform annual scaffold inspections could become a more

significant safety concern. Specifically, annual inspections failed to inspect all existing

scaffolds and failed to identify multiple scaffolding interactions with safety-related

equipment. Using the Manual Chapter 0609, Significance Determination Process,

Phase 1 Worksheet, the finding is determined to have a very low safety significance

because it did not result in the loss of function of a TS required system for greater than

its allowed outage time. The cause of this finding is related to the human performance

crosscutting component of work practices because maintenance personnel did not follow

the requirements of Maintenance Procedure 7.0.7 (H.4(b)).

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,

and maintained covering the activities specified in Regulatory Guide 1.33, Revision 2,

Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, section 9.a,

- 11 - Enclosure

requires that maintenance that can affect the performance of safety-related equipment

should be properly pre-planned and performed in accordance with written procedures.

Contrary to this requirement, on January 21, 2008, maintenance personnel violated the

requirements of Maintenance Procedure 7.0.7, Scaffolding Construction and Control, in

that they did not inspect all required scaffolds or identify obvious non-compliances with

Procedure 7.0.7. Because the finding is of very low safety significance and has been

entered into the licensees CAP as CR-CNS-2008-01576, this violation is being treated

as an NCV consistent with Section VI.A of the Enforcement Policy: NCV 05000298/2008002-01, "Failure to Follow Scaffold Inspection Procedures.

1R19 Postmaintenance Testing (71111.19)

a. Inspection Scope

These activities were selected based upon the SSCs ability to impact risk. The

inspectors evaluated these activities for the following (as applicable): the effect of testing

on the plant had been adequately addressed; testing was adequate for the maintenance

performed; acceptance criteria were clear and demonstrated operational readiness; test

instrumentation was appropriate; tests were performed as written in accordance with

properly reviewed and approved procedures; equipment was returned to its operational

status following testing (temporary modifications or jumpers required for test

performance were properly removed after test completion), and test documentation was

properly evaluated. The inspectors evaluated the activities against TS, the UFSAR, 10

CFR Part 50 requirements, licensee procedures, and various NRC generic

communications to ensure that the test results adequately ensured that the equipment

met the licensing basis and design requirements. In addition, the inspectors reviewed

corrective action documents associated with postmaintenance tests to determine

whether the licensee was identifying problems and entering them in the CAP and that

the problems were being corrected commensurate with their importance to safety.

Documents reviewed are listed in the attachment.

The inspectors reviewed the following postmaintenance activities to verify that

procedures and test activities were adequate to ensure system operability and functional

capability:

  • March 14, 2008, Dynamic testing of SW-MO-650MV on January 30, 2008
  • March 19, 2008, Test failure of northeast quad fan coil unit on February 5, 2008
  • March 14, 2008, 6.EE.606 on January 30, 2008, 250 VDC charger test and

thermography

  • March 14, 2008, PMT for DG 1 relay replacement on March 3, 2008
  • March 21, 2008, PMT for DG 2 relay replacement on March 11, 2008

The inspectors completed five samples.

- 12 - Enclosure

b. Findings

Failure to Establish Adequate Procedures for Maintenance of Emergency DG Electrical

Connections

Introduction. Two examples of a self-revealing apparent violation of TS 5.4.1.a were

identified regarding the licensees failure to establish procedural controls for

maintenance of electrical connections on essential equipment. In the first example, the

licensee failed to include amphenol connections within the scope of existing periodic

electrical connection inspections to identify loosening connections. In the second

example, the licensee failed to incorporate internal operating experience into work

control procedures to ensure that DG-mounted amphenol connections were solidly

attached following maintenance. These failures to establish adequate procedural

controls led to the trip of DG 2 during testing on January 15, 2008.

Description. On January 15, 2008, DG 2 tripped shortly after being started as part of a

postmaintenance test. The test was being conducted to verify the ability of DG 2 to

perform its safety function following repairs to the overspeed governor oil level sight

glass. The licensee determined that the cause of the trip of DG 2 was a loose

amphenol-type connection on the relay tachometer speed sensing circuit magnetic

pickup.

The licensee determined that this failure was similar in nature to a condition identified

during previous troubleshooting of DG 2. On December 10, 1995, operations personnel

initiated a CR to document that the amphenol connector on a DG mounted magnetic

pickup (MPU) was vibrating loose during testing of the DG. In response to this CR, the

licensee initiated a minor maintenance WO to loosen both MPU amphenol connectors

and apply thread locking compound to the amphenol threads to keep the connection

from vibrating loose. The completion of these actions was documented in Minor

Maintenance WO 95-03959. Beyond the actions taken in the WO, no corrective actions

were taken to codify the use of thread locking compounds or other measures to prevent

the amphenol connections from coming unthreaded during engine operation.

During a normal shutdown of DG 2 on December 27, 2000, an engine overspeed alarm

was unexpectedly received, as described in CR 4-13285. Minor Maintenance

WO 003915 was initiated to determine the cause of the unexpected alarm. During

completion of this WO on December 29, 2000, maintenance personnel replaced the

relay tachometer and the associated MPU, and the associated amphenol connection

was disconnected and then reconnected.

In the first example of this performance deficiency, the inspectors determined that the

licensees procedures for performing periodic DG electrical examinations were

inadequate in that they did not include engine-mounted components. Maintenance

Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, was

created on September 30, 1988 to perform periodic (once per operating cycle)

preventative maintenance on the DG electrical systems. On May 22, 2007, the NRC

identified an NCV regarding the licensees failure to establish adequate instructions for

emergency DG electrical maintenance (see NRC Special Inspection

Report 05000298/2007007). Two of the three examples described in the NCV dealt with

inadequate work instructions for checking the tightness of electrical connections on DG

system components. In response to this NCV, the licensee initiated Corrective Action #8

- 13 - Enclosure

under CR-CNS-2007-00480 to establish preventative maintenance tasks to periodically

check the DG systems for loose connections. In developing a revision to Maintenance

Procedure 7.3.8.2, Diesel Generator Electrical Examination and Maintenance, the

licensee made the erroneous assumption that all engine-mounted components have

other maintenance actions that satisfy the intent of the corrective action. As such,

engine-mounted connections were not included in the scope of the inspections in

Revision 20 to Maintenance Procedure 7.3.8.2 on August 13, 2007. The revised

procedure was subsequently completed for DG 2 on September 13, 2007. The

assumption was in error and resulted in a recently missed opportunity to discover the

loosening amphenol connection on the DG 2 relay tachometer MPU.

In the second example of this performance deficiency, the licensee determined that the

maintenance procedures used on December 29, 2000 did not contain adequate

guidance to ensure that thread locking compounds or other measures would be utilized

to ensure that the DG amphenol connections did not become unthreaded during engine

operation. The work was not conducted using detailed procedures, and as such the

licensee determined that the amphenol became loose as a result of either inadequate

tightening during the maintenance, or equipment vibration between 2000 and 2008 (due

to thread locking compound not being used), or a combination of both. The licensee has

initiated corrective actions to add the appropriate guidance to Administrative

Procedure 0.40.4, Planning.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to establish procedural controls for maintenance of electrical

connections on essential equipment. In the first example, the licensee failed to include

these amphenol connections within the scope of existing periodic electrical connection

inspections to identify loosening connections. In the second example, the licensee failed

to incorporate internal operating experience into work control procedures to ensure that

DG-mounted amphenol connections were solidly attached following maintenance.

These failures to establish adequate procedural controls led to the trip of DG 2 during

testing on January 15, 2008. The finding is more than minor because it is associated

with the mitigating systems cornerstone attribute of equipment performance and affects

the associated cornerstone objective to ensure the availability, reliability, and capability

of systems that respond to initiating events to prevent undesirable consequences. The

Phase 1 worksheets in Manual Chapter 0609, "Significance Determination Process,"

were used to conclude that a Phase 2 analysis was required because the finding

represents an actual loss of safety function of a single train for greater than its TS

allowed outage time (7 days). A Phase 2 risk analysis was conducted using the

guidance of Manual Chapter 0609, Appendix A, Determining the Significance of Reactor

Inspection Findings for At-Power Situations. Entering the site-specific pre-solved table

with an assumed exposure time of greater than 30 days yielded a result of red, or very

high significance. A Phase 3 analysis conducted by a risk analyst preliminarily

determined the finding to be of white, or low to moderate significance.

The cause of the finding is related to the corrective action component of the crosscutting

area of problem identification and resolution in that the licensee failed to take

appropriate corrective actions for a 2007 NRC inspection finding which identified

inadequate maintenance procedures for checking the tightness of DG electrical

connections (P.1(d)).

- 14 - Enclosure

Enforcement. TS 5.4.1.a requires that written procedures be established, implemented,

and maintained, covering the activities specified in Regulatory Guide 1.33, Revision 2,

Appendix A, dated February 1978. Regulatory Guide 1.33, Appendix A, Section 9 (a),

requires that maintenance affecting performance of safety-related equipment should be

performed in accordance with written procedures. Contrary to this, since December 29,

2000, the licensee used inadequate procedural guidance to reassemble amphenol

connections on DG 2. Additionally, since September 30, 1988, the licensees procedural

guidance for performing periodic electrical inspections has been inadequate in that it did

not check the tightness of engine-mounted amphenol connections. These inadequate

procedures resulted in the trip of DG 2 during testing on January 15, 2008. This issue

was entered into the licensees CAP as CR-CNS-2008-00304. Pending determination of

the findings final safety significance, this finding is identified as Apparent Violation (AV)05000298/2008002-002, "Failure to Establish Adequate Procedures for Maintenance of

Emergency DG Electrical Connections."

1R22 Surveillance Testing (71111.22)

Routine Surveillance Testing

a. Inspection Scope

The inspectors reviewed the UFSAR, procedure requirements, and TSs to ensure that

the three surveillance activities listed below demonstrated that the SSCs tested were

capable of performing their intended safety functions. The inspectors either witnessed

or reviewed test data to verify that the following significant surveillance test attributes

were adequate: (1) preconditioning; (2) evaluation of testing impact on the plant; (3)

acceptance criteria; (4) test equipment; (5) procedures; (6) jumper/lifted lead controls;

(7) test data; (8) testing frequency and method demonstrated TS operability; (9) test

equipment removal; (10) restoration of plant systems; (11) fulfillment of ASME Code

requirements; (12) engineering evaluations, root causes, and bases for returning tested

SSCs not meeting the test acceptance criteria were correct; (13) reference setting data;

and (14) annunciators and alarms setpoints. The inspectors also verified that the

licensee identified and implemented any needed corrective actions associated with the

surveillance testing.

The inspectors observed in-plant activities and reviewed procedures and associated

records to determine whether: any preconditioning occurred; effects of the testing were

adequately addressed by control room personnel or engineers prior to the

commencement of the testing; acceptance criteria were clearly stated, demonstrated

operational readiness, and were consistent with the system design basis; plant

equipment calibration was correct, accurate, and properly documented; as left setpoints

were within required ranges; the calibration frequency was in accordance with TS, the

UFSAR, procedures, and applicable commitments; measuring and test equipment

calibration was current; test equipment was used within the required range and

accuracy; applicable prerequisites described in the test procedures were satisfied; test

frequencies met TS requirements to demonstrate operability and reliability; tests were

performed in accordance with the test procedures and other applicable procedures;

jumpers and lifted leads were controlled and restored where used; test data and results

were accurate, complete, within limits, and valid; test equipment was removed after

testing; where applicable, test results not meeting acceptance criteria were addressed

with an adequate operability evaluation or the system or component was declared

- 15 - Enclosure

inoperable; where applicable for safety-related instrument control surveillance tests,

reference setting data were accurately incorporated in the test procedure; where

applicable, actual conditions encountering high resistance electrical contacts were such

that the intended safety function could still be accomplished; prior procedure changes

had not provided an opportunity to identify problems encountered during the

performance of the surveillance or calibration test; equipment was returned to a position

or status required to support the performance of the safety functions; and all problems

identified during the testing were appropriately documented and dispositioned in the

CAP.

The inspectors reviewed the test results for the following activities to determine whether

risk-significant systems and equipment were capable of performing their intended safety

function and to verify testing was conducted in accordance with applicable procedural

and TS requirements:

performed January 14, 2008

  • February 29, 2008, DG 1 fuel oil transfer pump flow test performed January 31,

2008

  • March 19, 2008, 6.REC.201 performed January 31, 2008
  • March 21, 2008, DG 2 monthly operability test performed March 11, 2008

This inspection constitutes four routine surveillance testing samples as defined in

Inspection Procedure 71111.22.

b. Findings

No findings of significance were identified.

EP4 Emergency Action Level and Emergency Plan Changes (71114.04)

CNS Emergency Plan Revision 53

a. Inspection Scope

The inspector performed an in-office review of Revision 53 to the Cooper Nuclear

Station Emergency Plan, received January 8, 2008. This revision moved the licensee's

Joint Information Center (emergency news center) from Columbus, Nebraska, to

Auburn, Nebraska, revised position duties in the Emergency Operations Facility and

Joint Information Center, deleted the Technical Information Coordinator (EOF) position,

revised position titles in the Joint Information Center, added a Letter of Agreement

between the licensee and the Nebraska City Fire Department, and revised geographical-

based protective action zones in Missouri, based on an approval letter from Federal

Emergency Management Agency, Region VII, dated October 10, 2007.

This revision was compared to its previous revision, to the criteria of NUREG-0654,

Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and

Preparedness in Support of Nuclear Power Plants, Revision 1, and to the standards in

- 16 - Enclosure

10 CFR 50.47(b) to determine if the revision adequately implemented the requirements

of 10 CFR 50.54(q). This review was not documented in a Safety Evaluation Report and

did not constitute approval of licensee changes; therefore, this revision is subject to

future inspection.

The inspectors completed one sample during the inspection.

b. Findings

No findings of significance were identified.

4. OTHER ACTIVITIES

4OA1 Performance Indicator (PI) Verification (71151)

.1 Data Submission Review

a. Inspection Scope

The inspectors performed a review of the data submitted by the licensee for the 4th

Quarter 2007 PIs for any obvious inconsistencies prior to its public release in

accordance with Inspection Manual Chapter 0608, Performance Indicator Program.

This review was performed as part of the inspectors normal plant status activities and,

as such, did not constitute a separate inspection sample.

b. Findings

No findings of significance were identified.

.2 Unplanned Scrams per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the unplanned scrams per 7000 critical

hours PI for the period from the 1st quarter 2007 through the 4th quarter 2007. To

determine the accuracy of the PI data reported during those periods, PI definitions and

guidance contained in Revision 5 of the Nuclear Energy Institute Document 99-02,

Regulatory Assessment Performance Indicator Guideline, were used. The inspectors

reviewed the licensees operator narrative logs, issue reports, event reports and NRC

inspection reports to validate the accuracy of the submittals. The inspectors also

reviewed the licensees issue report database to determine if any problems had been

identified with the PI data collected or transmitted for this indicator and none were

identified.

This inspection constitutes one unplanned scrams per 7000 critical hours sample as

defined by Inspection Procedure 71151.

b. Findings

No findings of significance were identified.

- 17 - Enclosure

.3 Unplanned Transients per 7000 Critical Hours

a. Inspection Scope

The inspectors sampled licensee submittals for the unplanned transients per

7000 critical hours PI for the period from the 1st quarter 2007 through the 4th

quarter 2007. To determine the accuracy of the PI data reported during those periods,

PI definitions and guidance contained in Revision 5 of the Nuclear Energy Institute

Document 99-02, Regulatory Assessment Performance Indicator Guideline, were used.

The inspectors reviewed the licensees operator narrative logs, issue reports,

maintenance rule records, event reports and NRC integrated Inspection reports to

validate the accuracy of the submittals. The inspectors also reviewed the licensees

issue report database to determine if any problems had been identified with the PI data

collected or transmitted for this indicator and none were identified.

This inspection constitutes one unplanned transients per 7000 critical hours sample as

defined by Inspection Procedure 71151.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems (71152)

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency

Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical

Protection

.1 Routine Review of Items Entered Into the CAP

a. Inspection Scope

The inspectors performed a daily screening of items entered into the licensee's CAP.

This assessment was accomplished by reviewing CRs and WOs and attending

corrective action review and work control meetings. The inspectors: (1) verified that

equipment, human performance, and program issues were being identified by the

licensee at an appropriate threshold and that the issues were entered into the CAP;

(2) verified that corrective actions were commensurate with the significance of the issue;

and (3) identified conditions that might warrant additional followup through other baseline

inspection procedures.

b. Findings

No findings of significance were identified.

.2 Selected Issue Followup Inspection

a. Inspection Scope

In addition to the routine review, the inspectors selected the issues listed below for a

more in-depth review. The inspectors considered the following during the review of the

- 18 - Enclosure

licensee's actions: (1) complete and accurate identification of the problem in a timely

manner; (2) evaluation and disposition of operability/reportability issues;

(3) consideration of extent of condition, generic implications, common cause, and

previous occurrences; (4) classification and prioritization of the resolution of the problem;

(5) identification of root and contributing causes of the problem; (6) identification of

corrective actions; and (7) completion of corrective actions in a timely manner.

  • December 27, 2007, loss of both plant monitoring and information system

computers

Documents reviewed by the inspectors included:

  • Abnormal Procedure 2.4 COMP, Computer Malfunction, Revision 4
  • Computer System Operating Procedure 2.6.3, Computer Systems Operation

and Outage Recovery, Revision 23

The inspectors completed one sample.

b. Findings

No findings of significance were identified.

4OA3 Followup of Events and Notices of Enforcement Discretion (71153)

.1 (Closed) Licensee Event Report (LER) 05000298/2007-006-00: Procedural Guidance

Leads to Rendering Second Diesel Inoperable

On September 11, 2007, the licensee commenced an operation to fill the DG 2 fuel oil

day tank following extensive maintenance on DG 2. While filling the DG 2 day tank,

control room operators received annunciators due to a rising level in the DG 1 fuel oil

day tank, indicating leakage through the DG 1 fuel oil day tank isolation valves. Due to

failure to meet the acceptance criteria in Surveillance Procedure 6.2DG.401, Diesel

Generator Fuel Oil Transfer Pump IST Flow Test - Div 2, the licensee declared DG 1

inoperable. With DG 2 already inoperable, the control room staff properly entered

Condition E of Technical Specification 3.8.1, requiring restoration of either DG to an

operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

In an effort to restore operability of DG 1, the licensee elected to attempt repair of the

leaking solenoid isolation valve on the DG 1 fuel oil day tank. This required placing

DG 1 into maintenance lockout and entry into an overall red risk window for the station.

The repair attempt was unsuccessful, and the control room staff subsequently entered

Condition F of TS 3.8.1, requiring the plant to be in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4

within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Operability of DG 1 was subsequently restored by closing a fuel oil

system crossconnect valve, and Condition F was exited prior to transitioning to Mode 3.

The licensee initiated this LER due to the loss of safety function (on-site emergency

power) that occurred during the corrective maintenance attempt on DG 1. The

inspectors reviewed all aspects of the event, including performance of control room staff,

planning of the associated WOs, evaluation and mitigation of station risk, configuration

control of the DG fuel oil system, treatment in the CAP, fleet standards for emergency

- 19 - Enclosure

and emergent work, and relationship to previous work on DG 1. A related violation of

NRC requirements is discussed in detail in NRC Integrated Inspection Report 05000298/2007005. This LER is closed.

.2 (Closed) Licensee Event Report 05000298/2007-007-00: Damaged Lead on Emergency

Filter System Fan Motor Results in Loss of Safety Function

During a preventative maintenance inspection on December 3, 2007, licensee

technicians discovered severely overheated motor leads on the Control Room

Emergency Filter System (CREFS) exhaust booster fan. Based on the discovery of the

damaged motor leads, operations staff declared the fan inoperable and determined that

since CREFS is a single-train safety system, a loss of safety function had occurred.

Immediate action was taken and the degraded booster fan was replaced. CREFS was

returned to an operable status on December 4, 2007. The degraded condition was

determined to have been caused by the improper crimping of the motor lugs by the

manufacturer prior to installation in the plant. No performance deficiencies were

identified during the review of this LER. This LER is closed.

4OA6 Management Meetings

Exit Meeting Summary

On January 15, 2008, a regional inspector conducted a telephonic exit to present the

results of the in-office inspection of licensee changes to the emergency plan to

Mr. S. Rezhab, Acting Manager, Emergency Planning, who acknowledged the findings.

The inspector confirmed that proprietary information was not provided or examined

during the inspection.

On April 2, 2008, the inspectors conducted a telephonic exit meeting to present the

results of the in-office inspection of changes to the licensees emergency plan to

Mr. J. Austin, Manager, Emergency Planning, who acknowledged the findings. The

inspector confirmed that proprietary, sensitive, or personal information examined during

the inspection had been returned to the identified custodian.

On April 14, 2008, the resident inspectors presented the inspection results to

Mr. M. Colomb, General Manager of Plant Operations and other members of the

licensee staff. The licensee acknowledged the issues presented. The inspectors asked

the licensee whether any materials examined during the inspection should be

considered proprietary. No proprietary information was identified.

- 20 - Enclosure

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

John Austin, Manager, Emergency Preparedness Manager

Mark Bergmeier, Operations Support Group Supervisor

Vasant Bhardwaj, Engineering Support Manager

Michael Boyce, Director of Projects

Daniel Buman, System Engineering Manager

Michael Colomb, General Manager of Plant Operations

Jeff Ehlers, Engineer, Electric Systems/I&C

Roman Estrada, Corrective Action and Assessments Manager

Jim Flaherty, Senior Staff Licensing Engineer

Paul Fleming, Director of Nuclear Safety Assurance

Scott Freborg, Valves Engineering Programs Supervisor

Gabe Gardner, Design Engineering Civil Engineering Supervisor

Gary Kline, Director of Engineering

Dave Madsen, Licensing Engineer

Mark F Metzger, Engineer, Electric Systems/I&C

Ole Olson, Engineer, Engineering Support & Risk Management

Raymond Rexroad, Engineer, Electric Systems/I&C

Todd Stevens, Manager-Design Engineering

Mark Unruh, Senior Staff Engineer

David VanDerKamp, Licensing Manager

Marshall VanWinkle, Design Engineering Mechanical Supervisor

Dave Werner, Operations Training Support Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000298/2008002-02 AV Failure to Establish Adequate Procedures for Maintenance of

Emergency Diesel Generator Electrical Connections

Closed

05000298/2007-006-00 LER Procedural Guidance Leads to Rendering Second Diesel

Inoperable

05000298/2007-007-00 LER Damaged Lead on Emergency Filter System Fan Motor

Results in Loss of Safety Function

Opened and Closed

05000298/2008002-01 NCV Failure to Follow Scaffold Inspection Procedures

LIST OF DOCUMENTS REVIEWED

The following is a partial list of documents reviewed during the inspection. Inclusion on this list

does not imply that the NRC inspector reviewed the documents in their entirety, but rather that

selected sections or portions of the documents were evaluated as part of the overall inspection

A1-1 Attachment 1

effort. Inclusion of a document on this list does not imply NRC acceptance of the document or

any part of it, unless this is stated in the body of the inspection report.

1R07: Heat Sink Performance

Condition Report

CR-CNS-2008-00029

Procedures

Performance Evaluation Procedure 13.15.1, Reactor Equipment Cooling Heat Exchanger

Performance Analysis, Revision 27

Engineering Procedure 3.34, Heat Exchanger Program, Revision 9

Work Orders

4592135

4592134

1R13: Maintenance Risk Assessments and Emergent Work Control

Procedures

EP5.1 WEATHER, Operation During Weather Watches and Warnings, Revision 2

GOP 2.1.11, Station Operator Tours, Revision 127

Procedure 0.49, Schedule Risk Assessment, Revision 20

Procedure 0-PROTECT-EQP, Protected Equipment Program, Revision 5

Work Order

WO 4618242

1R19: Post Maintenance Testing

Condition Reports

CR-CNS-2008-00720

CR-CNS-2008-00738

Procedures

SP 6.1HV.601, Air Flow Test of Fan Coil Unit FC-R-1F (Div 1), Revision 5

6.EE.606, 250 V Battery Charger Performance Test, Revision 19

MP 7.5.33, SW-MO-650MV Dynamic Test, Revision 5

MP 7.3.14, Thermal Examination of Plant Components, Revision 7

A1-2 Attachment 1

Work Orders

WO 4523441

WO 4532270

WO 4541631

WO 4532754

WO 4581466

1R22: Surveillance Testing

Condition Report

CR-CNS-02007-06517

Procedures

6.CAD.201, North and South SV Vent and Drain Valve Cycling, Open Verification, and Timing

Test, Revision 12

T.S. SR 3.1.8 Scram Discharge Volume Vent and Drain Valves, Revision 0

T.S. Sec 5.5.6, CNS IST Program

6.1DG.401, Diesel Generator Fuel Oil Transfer Pump IST Flow Test (DIV 1), Revision 24

EP 3.9, ASME OM Code Testing of Pumps and Valves,, Revision 23

CNS Inservice Testing Program Basis Document, Revision 6, 6.1, 6.2

DCD-01, p. B-12, Revision dated October 28, 2006

SOP 2.2.12, Diesel Fuel Oil transfer System, Revision 47

6.REC.201, REC Motor Operated Valve Operability Test (IST), Revision16

SR 6.2DG.101, Diesel Generator 31 Day Operability Test (IST) (Div 2), Revision 52

Work Order

WO 4578012

LIST OF ACRONYMS USED

ASME American Society of Mechanical Engineers

AV apparent violation

CAP corrective action program

CFR Code of Federal Regulations

CR condition reports

DG diesel generator

HX heat exchange(r)

LCO limiting condition for operation

LER licensee event report

NCV noncited violation

PI performance indicator

PMT postmaintenance testing

REC uranium hexafluoride

RHR residual heat removal

TS Technical Specification

UFSAR Updated Final Safety Analysis Report

WO work order

A1-3 Attachment 1

Cooper Nuclear Station

Failure of EDG 2 Speed Sensing Circuit

SDP Phase 3 Analysis

Performance Deficiency:

Inadequate maintenance resulted in EDG 2 failing to run on January 15, 2008. The event was

caused by a failure of an amphenol connection on the EDG speed sensing circuit.

Assumptions:

1. It is assumed that the amphenol-type connector of the speed sensing circuit degraded only

during times that the diesel generator was running; specifically in response to the vibration

of the operating engine. There is no assumption of accelerated degradation associated with

diesel starts or any degradation while the unit was in standby. It is further assumed that the

failure was a deterministic outcome set to occur after a specific number of operating hours.

The diesel was run at the following times:

09/13/07 - ran for 2 hrs 15 min

10/15/07 - ran for 5 hrs 45 min

11/13/07 - ran for 5 hrs 21 min

12/10/07 - ran for 5 hrs 51 min

01/14/08 - ran for 5 hrs 21 min (1700)

01/15/08 - failure less than one minute after starting

01/16/08- EDG 2 restored to a functional status (1700)

Therefore, it is assumed that EDG2 would have failed to run within one minute of a LOOP

demand, or it was inoperable for maintenance, during the two-day period from January 14 to

January 16, 2008.

Prior to this date, it is assumed that EDG 2 would have failed to run at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following a

LOOP demand at any time during the 35-day period from its last successful surveillance test

on December 10, 2007 until the test failure that occurred on January 14, 2008.

Prior to this date, EDG 2 would have run and failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the 27-day period

from November 13, 2007 to December 10, 2007.

Prior to this date, EDG 2 would have run and failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during the 29-day period

from October 15, 2007 to November 13, 2007.

Prior to this date, EDG 2 would have failed to run at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during the 32-day period

from September 13, 2007 to October 15, 2007.

Before October 15, 2007, it is assumed that EDG 2 would not have failed from the speed

sensing circuit failure for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the mission time assumed in the SPAR model.

Therefore, prior to this date no additional risk impact is assumed.

2. The problem with the speed sensing circuit would be difficult to diagnose in time to affect the

outcome of any of the SPAR core damage sequences, the longest of which is 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> (as

modified by an extension to the battery duration (assumption #3). Adjustments made to the

A2-1 Attachment 2

performance shaping factors in the SPAR-H Human Reliability Analysis Method, NUREG

CR-6883, Sept. 2004 (expansive time, extreme stress, highly complex, nominal training,

unavailable procedures, and missing ergonomics) returned a failure probability of 0.56,

including a very small contribution from the action steps of repairing the amphenol

connection and re-starting the EDG, which are relatively simple.

The following table presents the diagnosis tabulation:

Diagnosis (0.01) Multiplier Action (0.001) Multiplier

Available Time Expansive 0.01 Nominal 1

Stress Extreme 5 High 2

Complexity High 5 Nominal 1

Experience/Training Nominal 1 Nominal 1

Procedures Not Available 50 Nominal 1

Ergonomics Poor 10 Nominal 1

Product of Multipliers 125 2

Diagnosis HEP = 0.01(125)/ [0.01(125-1)] + 1 = 0.558

Action HEP = 0.001(2) = 0.002

Total HEP = 0.56

For this analysis, it is assumed that the recovery of EDG 2 from the speed sensor circuit

failure applies to sequences of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or greater. The only sequence that is less than 4

hours is a 30 minute sequence, for which no recovery of the amphenol connection is

assumed.

The SPAR model does not distinguish between cutsets that contain two or just one EDG

failure as it relates to EDG non-recovery basic events. Theoretically, it would be more likely

to succeed in restoring one of two EDGs versus recovering one (of one) EDG. However, in

this analysis, this feature of the SPAR model is not altered

3. The standard CNS SPAR model credited the Class 1E batteries with an 8-hour discharge

capability following a station blackout. Based on information received from the licensee, this

credit was extended to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Although the batteries could potentially function beyond

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> under certain conditions other challenges related to the operation of RCIC and

HPCI in station blackout conditions would be present. These challenges include the

availability of adequate injection supply water and operational concerns of RCIC under high

back pressure conditions as a result of the unavailability of suppression pool cooling during

an extended station blackout event.

4. For the purpose of this analysis, it is assumed that EDG 2 would not be unavailable or fail to

operate for the period of time before it is assumed to fail from the connector failure during

the various exposure periods. This introduces a slight inconsistency to the risk estimate, but

because it would similarly affect both the base and current case, it does not significantly

influence the result of this analysis.

5. Common cause vulnerabilities for EDG 1 did not exist, that is, the failure mode is assumed

to be independent in nature. The reason for this determination is based on the following

A2-2 Attachment 2

reasoning. The loosening of the amphenol connection on EDG 2 resulted from engine

vibration while the EDG was running. Historically, EDG 2 has experienced vibration

problems while EDG 1 has not. Therefore, it is likely that vibration induced loosening of the

amphenol connection would proceed at a faster pace for EDG 2 than EDG 1, making It very

unlikely that this type of failure would occur on both EDGs at the same time. The fact that it

took 7 years of operation for EDG 2 to reach the point of failure also points to the

unlikelihood that the same failure would have occurred on EDG 1 within the timeframe of the

exposure period of this finding.

Even if both EDGs were determined to be vulnerable to a speed sensor amphenol

connection failure, there was no mechanism that would tend to cause both EDGs to fail

simultaneously. That is, the failure of one amphenol connection would not make failure of

the other one more likely. Therefore, for this case, the failure of both EDGs from this issue

would mathematically be modeled by the combined independent failures of both EDGs

instead of by a classic common cause coupling mechanism. For this case, the estimated

probability of an independent failure of EDG 1 from a failed amphenol connection during the

exposure period would be a small number compared to its baseline SPAR fail-to-run

probability and therefore this application would not appreciably affect the final result.

Finally, if EDG 1 had experienced problems with this connection, thereby making it

comparatively vulnerable to the same type of failure; it is likely that the licensee would have

taken more aggressive actions to address this issue, seeing that it affected both trains of

emergency power. Therefore, the conditions necessary to create the possibility of a

common cause failure would also have triggered actions to prevent it.

The Cooper SPAR model, Revision 3.40, dated February 28, 2008, was used in the analysis. A

cutset truncation of 1.0E-13 was used. Average test and maintenance was assumed.

The model was revised by INL to increase the battery life to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />, as discussed above. In

addition, the timing of various sequences was lengthened based on data provided by the

licensee. INL also adjusted the credit applied for firewater injection (base model HEP = 1.0),

with an HEP of 0.15. However, based on observations by the senior resident inspector, the

analyst concluded that credit for firewater injection should not be granted. This is because

barely enough time was available to perform the necessary actions and a valve that must be

opened to establish a flow path was non-functional with a stem-disk separation for the entire

period of exposure. There were other valves that could have been used in alternate lineups, but

it was clear that the disabled valve would have been chosen first, leaving no time to reconfigure

the flow path.

Also, changes were made to the containment venting fault tree. In the original version, a loss of

Division 2 AC was sufficient to fail the containment vent function. However, a recovery of the

vent function is possible by taking manual local actions to open the vent valves. The failure

probability of this action was estimated based on an observed evolution conducted in response

to questions concerning this analysis. This observation revealed that the actions needed to

perform this function were dangerous and complex and would be conducted in poor lighting and

high temperatures. Also, operators had little experience. The recovery efforts applied to both a

loss of Division 2 AC and to a loss of instrument air. A non-recovery probability of 0.23 for basic

events CVS-XHE-XL-LOAC and CVS-XHE-XL- LOIAS was determined based on the following

SPAR-H analysis.

A2-3 Attachment 2

The diagnosis of the need to manually vent containment is obvious based on emergency

operating procedures that direct this action when containment pressure reaches 25 psig.

Operators would be continually monitoring this parameter, and it is very unlikely that the effort to

manually vent containment would not be undertaken at 25 psig and possibly prior to this point.

For the action steps, approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of time are available from the time that containment

pressurizes to 25 psig until containment would fail. The nominal time needed to perform the

manually venting task is estimated at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In this case, the relevant SPAR-H category for

time is nominal. Extreme stress is chosen because the effort to manually open the vent valves

involves a high risk of falling 40 feet through a maze of pipes, possibly resulting in death. The

effort is complex because of the need to carry a lot of equipment, including nitrogen bottles, to

the valves and performing several manipulations. Operators have little experience with this

evolution and the ergonomics are limited by high temperatures, restricted clearances, and a lack

of lighting.

Diagnosis (0.01) Multiplier Action (0.001) Multiplier

Available Time Expansive 0.01 Nominal 1

Stress High 2 Extreme 5

Complexity Obvious 0.1 Moderate 2

Experience/Training Nominal 1 Low 3

Procedures Nominal 1 Nominal 1

Ergonomics Nominal 1 Poor 10

Product of Multipliers 0.002 300

Diagnosis HEP = 0.01(.002) = 2.0E-5

Action HEP = 0.001(300)/ [0.001(300-1)] +1 = 0.23

Total HEP = 0.23

To model the failure of the speed sensing circuit and its specific recovery, a new and gate was

added to the EDG 1B Faults fault tree, with an input from two basic events (one modeling the

speed sensor failure set at 1.0 and another modeling the recovery set at 0.56). The chance of

restoring the EDG for LOOPs occurring during the two-day diagnosis and repair period are

considered similar to the same for the various prior exposure periods. The common cause

probability for fail-to-run events was restored to its nominal value. Therefore, only cutsets

containing the independent failure of EDG 2 contribute to the delta CDF of this finding.

Because the recovery of EDG 2 for speed sensor faults was built into the fault tree, all EDG

recovery basic events were removed from cutsets that contained an EDG 2 speed sensor

failure, but did not also contain either an EDG 1 fail-to-start or EDG 1 fail-to-run or EDG 1 failure

to restore basic event. Additionally, a correction factor (1/0.56 = 1.78) was applied to the subset

of the above that contained 30-minute recovery events to effectively remove all EDG 2 recovery

for those sequences.

Internal Events Analysis:

A. Risk Estimate for the 2-day period between January 14 and January 16, 2006:

During this 48-hour period, it is assumed that EDG 2 was completely unavailable either

because of maintenance or because it would have failed within one minute after a LOOP

A2-4 Attachment 2

demand. To represent the assumed failure and potential recovery of EDG 2, the new

basic event EPS-SPEED-SENSOR was set to 1.0 and EPS-SPEED-SENSOR-RCV was

set to 0.56. The basis event EPS-DGN-CF-RUN was reset to its base case value of

4.172E-4 to ensure that cutsets containing common cause to run events would cancel

out in the base and current case.

The result was a delta-CDF of 2.789E-5/yr. or 1.528E-7 for two days.

B. Risk Estimate for the 35-day period between December 10, 2006 and January 14,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />. The LOOP frequency used in the analysis was adjusted to reflect the

situation that only LOOPs with durations greater than 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would result in a risk

increase attributable to the speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 5.35-hour non-recovery of offsite power is

0.1112. Therefore, the frequency of LOOPs that are not recovered in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

3.99E-3/yr.

Resetting event time t=0 to 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 7.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, given that recovery has failed at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />.

An adjustment to account for the diminishment of decay heat must be considered. This

is because the magnitude of decay heat at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown is less than in

the early moments following a reactor trip, and the timing of core damage sequences is

affected by this fact. In the modified SPAR model, recovery times for offsite power are

set at the intervals of 30 minutes, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The analyst

determined that the average decay heat level in the first 30 minutes is approximately two

times the average level that exists between 5.35 and 6.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following shutdown.

Therefore, baseline 30-minute SPAR model sequences, that essentially account for

boiloff to fuel uncovery, should be adjusted to 1-hour sequences. The 2-hour sequences

model safety relief valve failures to close, and are based more on inventory control than

core heat production. Therefore, no adjustment was made for these sequences. The

analyst determined that decay heat rates leveled out quickly following shutdown and

could find no basis for adjusting the times associated with the 4 and 10-hour sequences.

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

A2-5 Attachment 2

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.1112 0.0905 1 0.814

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.1112 0.0554 0.498

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.1112 0.0487 0.438

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.1112 0.0325 0.292

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.1112 0.0278 0.250

1. A SPAR recovery time of 1.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />, which was 0.5934 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/35 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/35 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.5934)

Base Case 6.989E-7 6.702E-8 3.686E-8 3.535E-9 6.348E-8

Current Case 1.394E-5 1.337E-6 4.706E-7 4.513E-8 1.292E-6

Delta 1.229E-6

CDF/35 days

A2-6 Attachment 2

C. Risk Estimate for the 27-day period between November 13, 2007 and December 10,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 11.2-hour non-recovery of offsite power is

0.0441. Therefore, the frequency of LOOPs that are not recovered in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is

1.58E-3/yr.

Resetting event time t=0 to 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 13.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, given that recovery has failed at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level

in the first 30 minutes is approximately three times the average level that exists between

11 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 1.5-hour sequences.

The 2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for

these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 30 minutes each

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.0441 0.0377 1 0.855

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0441 0.02922 0.662

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.0441 0.02712 0.615

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0441 0.02122 0.481

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0441 0.01912 0.433

1 A SPAR recovery time of 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is used, as discussed above, to account for

the lessening of decay heat

2 The SPAR recovery time was increased by 30 minutes.

A2-7 Attachment 2

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which was 0.7907 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/27 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/27 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.7907)

Base Case 4.332E-7 3.204E-8 3.168E-8 2.343E-9 2.970E-8

Current Case 9.216E-6 6.817E-7 4.216E-7 3.119E-8 6.505E-7

Delta 6.208E-7

CDF/27 days

D. Risk Estimate for the 29-day period between October 15, 2007 and November 13,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The LOOP frequency was adjusted to reflect the situation that only LOOPs

with durations greater than 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> would result in a risk increase attributable to the

speed sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 16.5-hour non-recovery of offsite power is

0.0275. Therefore, the frequency of LOOPs that are not recovered in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is

9.87E-4/yr.

Resetting event time t=0 to 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 18.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, given that recovery has failed at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as

in the 5.35-hour case above. The analyst determined that the average decay heat level

in the first 30 minutes is approximately four times the average level that exists between

16 and 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The

A2-8 Attachment 2

2-hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for

these sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the

event times that are relevant in the SPAR core damage cutsets:

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.0275 0.02411 0.876

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0275 0.02032 0.738

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.0275 0.01922 0.698

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0275 0.01602 0.582

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0275 0.01482 0.538

1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, the result for the

base and the current case that contain an EDG 1 FTS event were multiplied by the

success probability of recovering EDG 1 in 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, which was 0.8760 (1- non-

recovery probability). This value was then subtracted to obtain a final result for the base

and current case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to

start event before EDG 2 fails from the speed sensor circuit failure will not end in core

damage. Also, the methodology used effectively assumes that for EDG 1 fail to run

events, the failure occurs more or less at the same time that EDG 2 fails (16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />).

This then would suggest that the EDG recovery terms in the SPAR model would

coincide with the event time t=0 at 16.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the onset of the LOOP and

therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/29 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/29 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.8760)

Base Case 3.263E-7 2.593E-8 2.675E-8 2.125E-9 2.380E-8

A2-9 Attachment 2

Current Case 7.071E-6 5.618E-7 3.601E-7 2.861E-8 5.332E-7

Delta 5.094E-7

CDF/29 days

E. Risk Estimate for the 32-day period between September 13, 2007 and October 15,

2007:

During this exposure period, EDG 2 is assumed to have been capable of running for 22.3

hours. The LOOP frequency was adjusted to reflect the situation that only LOOPs with

durations greater than 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> would result in a risk increase attributable to the speed

sensor failure.

The base LOOP frequency is 3.59E-2/yr. The 22.3-hour non-recovery of offsite power is

0.01944. Therefore, the frequency of LOOPs that are not recovered in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> is

6.98E-4/yr.

Resetting event time t=0 to 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the LOOP event requires that the

recovery factors for offsite power be adjusted. For instance, in 2-hour sequences in

SPAR, the basic event for non-recovery of offsite power should be adjusted to the non-

recovery at 24.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, given that recovery has failed at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.

The analyst considered an adjustment to account for the diminishment of decay heat as in

the 5.35-hour case above. The analyst determined that the average decay heat level in the

first 30 minutes is approximately four times the average level that exists between 22 and

23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br /> following shutdown. Therefore, baseline 30-minute SPAR models, that

essentially account for boiloff to fuel uncovery were adjusted to 2-hour sequences. The 2-

hour sequences model safety relief valve failures to close, and are based more on

inventory control than core heat production. Therefore, no adjustment was made for these

sequences. Sequences of 4 and 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were increased by 60 minutes each

The following table presents the adjusted offsite power non-recovery factors for the event

times that are relevant in the SPAR core damage cutsets:

SPAR SPAR base SPAR base SPAR base Modified

recovery offsite power offsite power offsite power SPAR non-

time non-recovery non-recovery at non-recovery at recovery

22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> + (Column 4

SPAR recovery divided by

time in Column 1 Column 3)

30 min. 0.7314 0.0194 0.0177 1 0.912

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 0.1566 0.0194 0.01692 0.871

5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1205 0.0194 0.01492 0.768

9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 0.05789 0.0194 0.01342 0.691

11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 0.04500 0.0194 0.01272 0.655

A2-10 Attachment 2

1. A SPAR recovery time of 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> is used, as discussed above, to account for the

lessening of decay heat

2. The SPAR recovery time was increased by 60 minutes.

To compensate for sequences where EDG 1 fails to start (FTS) and then is recovered

before EDG 2 fails from the speed sensor circuit failure at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, the result for the base

and the current case that contain an EDG 1 FTS event were multiplied by the success

probability of recovering EDG 1 in 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, which was 0.9267 (1- non-recovery

probability). This value was then subtracted to obtain a final result for the base and current

case. This adjustment recognizes/assumes that recovery of an EDG 1 fail to start event

before EDG 2 fails from the speed sensor circuit failure will not end in core damage. Also,

the methodology used effectively assumes that for EDG 1 fail to run events, the failure

occurs more or less at the same time that EDG 2 fails (22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />). This then would

suggest that the EDG recovery terms in the SPAR model would coincide with the event time

t=0 at 22.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the onset of the LOOP and therefore do not require adjustment.

The results of this portion of the analysis are presented in the following table:

CDF/yr CDF/32 days EDG1 FTS EDG1 FTS Remaining

Recovered Recovered/32 CDF (column

(EDG1 FTS days 3- column 5)

Cutset total

times 0.9267)

Base Case 2.745E-7 2.407E-8 2.402E-8 2.106E-9 2.196E-8

Current Case 6.033E-6 5.289E-7 3.262E-7 2.860E-8 5.003E-7

Delta 4.783E-7

CDF/32 days

The following table presents the aggregate internal events result:

TIME PERIOD DAYS OF EXPOSURE DELTA CDF

01/14/08 - 01/16/08 2 1.528E-7

12/10/07 - 01/14/08 35 1.229E-6

11/13/07 - 12/10/07 27 6.208E-7

10/15/07 - 11/13/07 29 5.094E-7

09/13/07 - 10/15/07 32 4.783E-7

Total Internal Events Delta-CDF 2.990E-6

External Events Analysis:

The risk increase from fire initiating events was reviewed and determined to have a small impact

on the risk of the finding. Two fire scenarios were identified where equipment damage could

cause a loss of Division 2 vital power, thereby requiring the function of EDG 2. One was a

control room fire that affected either Vertical Board F or Board C. The second was a fire in the

Division 2 critical switchgear. For the control room fires, the scenario probabilities are remote

because of the confined specificity of their locations and the fact that a combination of hot shorts

of a specific polarity are needed to cause a LOOP. In addition, recovery from a LOOP induced

in this manner would be likely to succeed for the station blackout sequences that comprise the

majority of the risk, because a minimum of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> of battery power would be available, power

A2-11 Attachment 2

would presumably be available in the switchyard, and the breaker manipulations needed to

complete this task would be possible and within the capability of an augmented plant staff that

would respond to the event.

Fires in the Division 2 switchgear would eliminate the importance of EDG 2 because Division 2

power would be unavailable whether or not EDG 2 succeeds. Therefore, there would be no

change in risk from the finding.

The other type of fires that would result in a LOOP are those that require an evacuation of the

control room. In this case, plant procedures require offsite power to be isolated from the vital

buses and the preferred source of power, the Division 2 EDG, is used to power the plant. With

the assumption that the Division 2 EDG will fail 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> into the event, a station blackout

would occur at this time. The sequences that could lead to core damage would include a failure

of the Division 1 EDG, such that ultimate success in averting core damage would rely on

recovery of either EDG or of offsite power. A review of the onsite electrical distribution system

did not reveal any particular difficulties in restoring switchyard power to the vital buses in this

scenario, especially given that many hours are available to accomplish this task. The licensee

confirmed that for all postulated fire scenarios that would require evacuation of the control room,

a undamaged and available power pathway exists from the switchyard through the emergency

transformer to the Division 2 vital bus, and that the breaker manipulation needed to accomplish

this task would take only a few minutes.

In general, the fire risk importance for this finding is small compared to that associated with

internal events because onsite fires do not remove the availability of offsite power in the

switchyard, whereas, in the internal events scenarios, long-term unavailability of offsite power is

presumed to occur as a consequence of such events as severe weather or significant electrical

grid failures. Also, the fire risk corresponding the two-day period when EDG 2 was essentially

non-functional (no run time remaining) is small because of a very low initiating event probability.

The Cooper IPEEE Internal Fire Analysis screened the fire zones that had a significant impact

on overall plant risk. When adjusted for the exposure period of this finding, the cumulative

baseline core damage frequency for the zones that had the potential for a control room

evacuation (and a procedure-induced LOOP) or an induced plant centered LOOP was

approximately 3.6E-7/yr. The methods used to screen these areas were not rigorous and used

several bounding assumptions. The analyst qualitatively assumed that the increase in risk from

having EDG 2 in a status where it is assumed to fail at 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> would likely be somewhat

less than one order of magnitude above the baseline, or 3.6E-6/yr. This is easily demonstrated

by an assumption that failure to re-connect offsite power within a period of at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> is

well less than 10 percent. Based on these considerations, the analyst concluded that the risk

related to fires would not be sufficiently large to change the risk characterization of this finding.

The seismicity at Cooper is low and would likely have a small impact on risk for an EDG issue.

As a sensitivity, data from the RASP External Events Handbook was used to estimate the scope

of the seismic risk particular to this finding. The generic median earthquake acceleration

assumed to cause a loss of offsite power is 0.3g. The estimated frequency of earthquakes at

Cooper of this magnitude or greater is 9.828E-5/yr. The generic median earthquake frequency

assumed to cause a loss of the diesel generators is 3.1g, though essential equipment powered

by the EDGs would likely fail at approximately 2.0g. The seismic information for Cooper is

capped at a magnitude of 1.0g with a frequency of 8.187E-6. This would suggest that an

earthquake could be expected to occur with an approximate frequency of 9.0E-5/yr that would

remove offsite power but not damage other equipment important to safe shutdown. In the

A2-12 Attachment 2

internal events discussion above, it was estimated that LOOPS that exceeded 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

duration would occur with a frequency of 3.99E-3/yr. Most LOOPS that exceed 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

duration would likely have recovery characteristics closely matching that from an earthquake.

The ratio between these two frequencies is 44. Based on this, the analyst qualitatively

concluded that the risk associated with seismic events would be small compared to the internal

result.

Flooding could be a concern because of the proximity to the Missouri River. However, floods

that would remove offsite power would also likely flood the EDG compartments and therefore

not result in a significant change to the risk associated with the finding. The switchyard

elevation is below that of the power block by several feet, but it is not likely that a slight

inundation of the switchyard would cause a loss of offsite power. The low frequency of floods

within the thin slice of water elevations that would remove offsite power for at least 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />

but not debilitate the diesel generators indicates that external flooding would not add

appreciably to the risk of this finding.

Based on the above, the analyst determined that external events did not add significantly to the

risk of the finding.

Large Early Release Frequency:

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6, "Screening for

the Potential Risk Contribution Due to LERF," the analyst reviewed the core damage sequences

to determine an estimate of the change in large early release frequency caused by the finding.

The LERF consequences of this performance deficiency were similar to those documented in a

previous SDP Phase 3 evaluation regarding a misalignment of gland seal water to the service

water pumps. The final determination letter was issued on March 31, 2005 and is located in

ADAMS, Accession No. ML050910127. The following excerpt from this document addressed

the LERF issue:

The NRC reevaluated the portions of the preliminary significance determination related

to the change in LERF. In the regulatory conference, the licensee argued that the

dominant sequences were not contributors to the LERF. Therefore, there was no

change in LERF resulting from the subject performance deficiency. Their argument was

based on the longer than usual core damage sequences, providing for additional time to

core damage, and the relatively short time estimated to evacuate the close in population

surrounding Cooper Nuclear Station.

LERF is defined in NRC Inspection Manual Chapter 0609, Appendix H, Containment

Integrity Significance Determination Process as: the frequency of those accidents

leading to significant, unmitigated release from containment in a time frame prior to the

effective evacuation of the close-in population such that there is a potential for early

health effect. The NRC noted that the dominant core damage sequences documented

in the preliminary significance determination were long sequences that took greater than

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to proceed to reactor pressure vessel breach. The shortest calculated interval

from the time reactor conditions would have met the requirements for entry into a

general emergency (requiring the evacuation) until the time of postulated containment

rupture was 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The licensee stated that the average evacuation time for Cooper,

from the declaration of a General Emergency was 62 minutes.

A2-13 Attachment 2

The NRC determined that, based on a 62-minute average evacuation time, effective

evacuation of the close-in population could be achieved within 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Therefore, the

dominant core damage sequences affected by the subject performance deficiency were

not LERF contributors. As such, the NRCs best estimate determination of the change in

LERF resulting from the performance deficiency was zero.

In the current analysis, the total contribution of the 30-minute sequences for the 35-day period

(when 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> of EDG run time remained) to the current case CDF is only 0.54% of the total.

That is, almost all of the risk associated with this performance deficiency involves sequences of

duration 5.35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> or longer following the loss of all ac power.

The two-day period where EDG 2 was essentially unavailable had a delta-CDF of 1.528E-7. Of

these, the 30-minute sequences comprise only 2 percent of the total current case CDF and the

two-hour sequences comprise only 0.3 percent of the total.

Consequently, the analyst determined that the risk associated with large early release was very

small.

References:

SPAR-H Human Reliability Analysis Method, NUREG CR-6883, Sept. 2004

GE-NE-E1200141-04R2, Table 5-1, Shutdown Power at Cooper Nuclear Station (proprietary)

Green Screen Source Data, External Events PRA model, Nine Mile Point, Unit 1

NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of

Loss of Offsite Power Events: 1986-2004"

Peer Review:

See-Meng Wong, NRR

George McDonald, NRR

A2-14 Attachment 2

Retrieved from "https://kanterella.com/w/index.php?title=ML081270639&oldid=2157483"