IR 05000313/2007009

IR 05000313-07-009; 05000368-07-009, 10/31/2007 Through 02/20/2008, Arkansas Nuclear One, Units 1 & 2, Special Inspection Report

ML080590142
Person / Time
Site:	Arkansas Nuclear
Issue date:	02/27/2008
From:	Clark J A NRC/RGN-IV/DRP/RPB-E
To:	Mitchell T G Entergy Operations
References
IR-07-009
Download: ML080590142 (43)

Text

February 27, 2008

Mr. Timothy Vice President Operations Arkansas Nuclear One Entergy Operations, Inc.

1448 S.R. 333 Russellville, AR 72802-0967

SUBJECT: ARKANSAS NUCLEAR ONE - NRC SPECIAL INSPECTION REPORT 05000313/2007009 AND 05000368/2007009

Dear Mr. Mitchell:

On February 20, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Ark ansas Nuclear One, Units 1 and 2, facility. This inspection examined activities associated with a brief fire in an electrical panel resulting in the loss of a division of safety equipment on October 23, 2007. On this occasion a centrifugal charging pump was

undergoing 18-month surveillance testing when a fire o ccurred in the char ging pump breaker cubicle which resulted in the loss of a division of safety equipment. In response to the fire a declaration of an Alert was made. The NRC's initial evaluation satisfied the criteria in NRC Management Directive 8.3, "NRC Incident Investigation Program," for conducting a special inspection. The basis for initiating this special inspection is further discussed in the inspection charter, which is included in this report as Attachment 2. The determination that the inspection would be conducted was made by the NRC on October 31, 2007, and the inspection started on that date.

The enclosed inspection report documents the inspection findings, which were discussed on November 6, 2007, January 10, 2008 and again on February 20, 2008, with members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents three NRC identified and self-revealing findings of very low safety significance (Green). All three of the findings were determined to involve violations of NRC requirements. Because of their very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as noncited violations (NCVs)

consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas, 76011-4005; the

Entergy Operations, Inc. - 2 -

Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Arkansas Nuclear One, Units 1 and 2, facility.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be made available electronically fo r public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA G.Miller for/

Jeff Clark, P.E. Chief, Project Branch E Division of Reactor Projects

Dockets: 50-313; 50-368 License: DPR-51; NPF-6

Enclosure:

NRC Inspection Report 05000313/2007009; 05000368/2007009 w/Attachments

Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Significance Determination Evaluation

cc w/

Enclosure:

Senior Vice President

& Chief Operating Officer Entergy Operations, Inc.

P.O. Box 31995 Jackson, MS 39286-1995

Vice President, Operations Support Entergy Operations, Inc.

P.O. Box 31995 Jackson, MS 39286-1995

Director, Nuclear Safety Assurance Entergy Operations, Inc.

Arkansas Nuclear One 1448 S. R. 333 Russellville, AR 72802

Entergy Operations, Inc. - 3 -

Manager, Licensing Entergy Operations, Inc.

Arkansas Nuclear One 1448 S. R. 333 Russellville, AR 72802

Director, Nuclear Safety & Licensing Entergy Operations, Inc.

1340 Echelon Parkway Jackson, MS 39213-8298

Section Chief, Division of Health Radiation Control Section Arkansas Department of Health and Human Services 4815 West Markham Street, Slot 30 Little Rock, AR 72205-3867

Section Chief, Division of Health Emergency Management Section Arkansas Department of Health and Human Services 4815 West Markham Street, Slot 30 Little Rock, AR 72205-3867

County Judge of Pope County Pope County Courthouse 100 West Main Street Russellville, AR 72801

Site Vice President Entergy Operations, Inc.

Arkansas Nuclear One 1448 S. R. 333 Russellville, AR 72802

General Manager Plant Operations Entergy Operations, Inc.

Arkansas Nuclear One 1448 S. R. 333 Russellville, AR 72802

Entergy Operations, Inc. - 4 -

Electronic distribution by RIV: Regional Administrator (EEC) DRP Director (DDC) DRS Director (RJC1) DRS Deputy Director (ACC) Senior Resident Inspector (AAS1) Senior Project Engineer, DRP/E (GBM) Branch Chief, DRP/E (JAC) Senior Project Engineer, DRP/E (GDR) Team Leader, DRP/TSS (CJP) RITS Coordinator (MSH3) DRS STA (DAP) V. Dricks, PAO (VLD) D. Pelton, OEDO RIV Coordinator (DLP1) ROPreports Site Secretary (vlh)

SUNSI Review Completed: _WCW__ ADAMS: Yes No Initials: _ WCW

__ Publicly Available Non-Publicly Available Sensitive Non-Sensitive R:\_REACTORS\_ANO\2007\AN2007-09RP-WCW.doc ADAMS ML080590142 RIV:SPE:DRP/C RI:DRP/E SRA:DRS/E C:DRP/E WCWalker JEJosey MRunyan JAClark /RA/ /RA electronic/ /RA/ /RA/ 2/26/08 2/26/08 2/26/08 2/27/08 OFFICIAL RECORD COPY T= Telephone E= E-mail F = Fax Enclosure -1- U.S. NUCLEAR REGULATORY COMMISSION REGION IV

Docket: 50-313, 50-368 Licenses: DPR-51, NPF-6 Report No.: 05000313/20070009; 05000368/2007009 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nucl ear One, Units 1 and 2 Location: Junction of Hwy. 64W and Hwy. 333 South Russellville, Arkansas

Dates: October 31, 2007 through February 20, 2008 Inspectors: R. Bywater, Senior Reactor Analyst R. Egli, Reactor Technology Instructor J. Josey, Resident Inspector, Project Branch E, DRP M. Runyan, Senior Reactor Analyst W. Walker, Senior Project Engineer, Project Branch C, DRP

Approved By: Jeff Clark, P.E., Chief, Project Branch E Division of Reactor Projects

Enclosure -2-

SUMMARY OF FINDINGS

IR 05000313/2007009, 05000368/2007009; 10/31/07 - 02/20/08; Arkansas Nuclear One, Units 1 and 2; Special Inspection in response to a fault in a breaker cubicle which resulted in a brief fire in an electrical panel resulting in the loss of a division of safety equipment on October 23, 2007.

The report covered a 7-day period (October 31 through November 6, 2007) of onsite inspection, with in office review through February 20, 2008, by a special inspection team consisting of one senior project engineer, one resident inspector, and two senior reactor analysts. Three noncited violations were identified. The significance of most findings is indicated by its color (Green,

White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC's management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Summary of Event

The NRC conducted a special inspection to better understand the circumstances surrounding a fault in a breaker cubicle which resulted in a brief fire in an electrical panel resulting in the loss of a division of safety equipment on October 23, 2007. In accordance with NRC Management Directive 8.3, "NRC Incident Investigation Program," it was determined that this event involved repetitive failures of systems used to mitigate the effects of an actual event, involved potential adverse generic implications, and had sufficient risk significance to warrant a special inspection.

Cornerstone: Initiating Events

Green.

A self-revealing noncited violation was identified associated with the licensee's failure to comply with Unit 2 Technical Specifications, Section 6.4.1,

"Procedures," for the failure to ensure adequate procedures were available for maintenance that was conducted on the Unit 2 motor control centers.

Specifically, the maintenance procedure used by the licensee did not require visual inspections, nor cleaning, and lubrication of the bus to stab contact surface which facilitated degradation of the motor contro l center bus bars and also allowed this degradation to continue unrecognized. This issue was entered into the licensee's corrective action program as Condition Report ANO-2-2007-1512.

The finding was determined to be more than minor because it affected the protection against external factors attribute of both the Initiating Events and Mitigating Systems cornerstone. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 worksheets, the inspectors concluded that a Phase 2 evaluation was required.

The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power Significance Determination Process," of Manual Chapter 0609,

"Significance Determination Process," and the Phase 2 worksheets for Arkansas Nuclear One. The inspectors determined that the Phase 2 presolved table and worksheets did not contain appropriate target sets to estimate accurately the risk impact of the finding, therefore, a senior reactor analyst performed a Phase 3 analysis. The estimated change in core damage frequency was 8.463E-7/yr.

The estimated change in large early release frequency was 4.842E-8/yr.

Therefore, the significance of the finding was determined to be

Green.

(Section 2.1)

Green.

A self-revealing noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," was identified associated with the licensee's failure to implement adequate corrective actions to prevent recurrence of a significant condition adverse to quality. Specifically, during the Root Cause Evaluation performed for the fire in Motor Control Center 2B-22 in October 2000, the licensee failed to recognize and evaluate previously documented instances where other breakers exhibited degraded connections that were similar, and as such, were precursors to the failure of the breaker in Motor Control Center 2B-22.

Also, the licensee failed to recognize and evaluate these same degraded breaker connection conditions that were discovered during extent of condition inspections and subsequent motor control center maintenance inspections. The licensee's failure to identify and evaluate all instances of degraded breaker connections contributed to their failure to adequately identify the cause and implement corrective actions to prevent recurrence of this significant condition adverse to quality. This resulted in a fire in Motor Control Center 2B-52 on October 23, 2007. This issue was entered into the licensee's corrective action program as Condition Report ANO-2-2008-0060.

The finding was determined to be more than minor because it affected the protection against external factors attribute of both the Initiating Events and Mitigating Systems cornerstone. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 worksheets, the inspectors concluded that a Phase 2 evaluation was required.

The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power Significance Determination Process," of Manual Chapter 0609,

"Significance Determination Process," and the Phase 2 worksheets for Arkansas Nuclear One. The inspectors determined that the Phase 2 presolved table and worksheets did not contain appropriate target sets to estimate accurately the risk impact of the finding, therefore, a senior reactor analyst performed a Phase 3 analysis. The estimated change in core damage frequency was 8.463E-7/yr.

The estimated change in large early release frequency was 4.842E-8/yr.

Therefore, the significance of the finding was determined to be

Green.

The cause of this finding was determined to have a crosscutting aspect in the area of problem identification and resolution associated with the corrective action program (P.1[c]) in that the licensee failed to thoroughly evaluate the fire in Motor Control Center 2B-22 such that the resolution addressed the cause and extent of condition. This also includes conducting effectiveness reviews of corrective actions to ensure that the issue was resolved after more indications were discovered. (Section 2.2)

Green.

The inspectors identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to take adequate corrective actions in response to a motor control center fire that occurred on October 24, 2000. Specifically, the licensee had identified dust and dirt in the motor control center as a condition adverse to quality, assigned a corrective action for the condition, and subsequently closed the corrective action without correcting the condition. This issue was entered into the licensee's corrective action program as Condition Reports ANO 2-2007-1566,

ANO-2-2008-0050, and ANO-2-2008-0071.

The finding was determined to be more than minor because it affected the protection against external factors attribute of the Initiating Events cornerstone, and it directly affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Using the Manual Chapter 0609,

Appendix F, "Fire Protection Significance Determination Process," Phase 1 worksheet, the finding was determined to have very low safety significance because the condition represented a low degradation of fire prevention and administrative controls feature. The finding had crosscutting aspects in the area of problem identification and resolution associated with the corrective action program P.1[d]) because the licensee failed to take appropriate corrective actions to address safety issues in a timely matter. (Section 2.3)

B. Licensee-Identified Violations

None.

REPORT DETAILS

1.0 SPECIAL

INSPECTION SCOPE

The NRC conducted a special inspection at Arkansas Nuclear One (ANO) to better understand the circumstances surrounding a fault in a breaker cubicle which resulted in a brief fire in an electrical panel resulting in the loss of a division of safety equipment on October 23, 2007. On this occasion centrifugal charging Pump A was undergoing 18-month surveillance testing following mechanical maintenance. During the testing, the pump was started locally at the charging pump breaker cubicle; following that, the pump was immediately started remotely from the control room. During the remote start, a fire occurred in the charging pump breaker cubicle which resulted in Motor Control Center (MCC) 2B-52 de-energizing due to load center Breaker 2B-532 tripping. The loss of MCC 2B-52 resulted in the loss of one division of Engineered Safety Features. The fire in conjunction with the loss of one division of Engineered Safety Features resulted in operators declaring an Alert. In accordance with NRC Management Directive 8.3, it was determined that this event had sufficient risk significance to warrant a special inspection.

The team used NRC Inspection Procedure 93812, "Special Inspection," to conduct the inspection. The special inspection team reviewed procedures, corrective action documents, operator logs, design documentation, maintenance records, and procurement records for the MCC. The team interviewed various station personnel regarding the event. The team reviewed the licensee's preliminary root cause analysis report, past failure records, extent of condition evaluation, immediate and long term corrective actions, and industry operating experience. A list of specific documents reviewed is provided in Attachment 1. The charter for the special inspection is included as Attachment 2.

1.1 Event Summary During full power operation on October 23, 2007, mechanical maintenance was

completed on Charging Pump A and the pump was undergoing 18 month surveillance testing. During the testing, the pump was started locally at the charging pump breaker cubicle; following that, the pump was immediately started remotely from the control room. During the remote start, a fire occurred in the charging pump breaker cubicle which resulted in MCC 2B-52 de-energizing due to load center Breaker 2B-532 tripping.

The following equipment was declared inoperable as a result of the load center being de-energized: Low Pressure Safety Injection Pump 2P-34A, High Pressure Safety Injection Pump 2P-89A, Emergency Diesel Generator 2K-4A, Control Room Emergency

Chiller 2VE-1A, and Containment Spray Pump 2P-35A. As a result, the fire brigade was called out. The fire in MCC 2B-52 was out and no fire extinguishers were discharged.

An Alert was declared at 11:05 p.m. CDT on Unit 2 due to a fire onsite affecting one train of Engineered Safety Feature systems. Operators realigned electrical equipment in accordance with plant procedures and the Alert was exited at 1:33 a.m. CDT.

-6- The time line below describes the major events following the start of the Charging Pump A on October 23, 2007.

October 23, 2007 10:50 p.m. Charging Pump A filled and vented.

10:55 p.m. At the breaker, locally started charging Pump A for 18-month surveillance test in accordance with Procedure OP-2305.016, "Remote Feature Periodic Testing."

10:56 p.m. Secured charging Pump A. Placed the local remote switch to remote.

10:58 p.m. Control room attempted to start charging Pump A. Fire occurred in Breaker 2B-52A5 cubicle.

MCC 2B-52 de-energized when Breaker 2B-532, MCC 2B-52 supply breaker tripped automatically on over voltage.

Entered Procedure OP-2203.034, fire and explosion abnormal operating procedure (AOP).

Entered the following Technical Specifications (TS) due to MCC 2B-52 fire: TS 3.5.2 for Low Pressure Safety Injection Pump 2P-34A, and High Pressure Safety Injection Pump 2P-89A being inoperable

TS 3.4.4 for pressurizer proportional heater Group 1 being inoperable

TS 3.8.1.1 for Emergency Diesel Generator 2K-4A being inoperable

TS 3.7.6.1 for control room emergency ventilation and Air Conditioning System 2VE-1A being inoperable

TS 3.6.2.1 for containment spray Pump 2P-35A being inoperable

TS 3.7.3.1 for Loop 1 service water header being inoperable

TS 3.6.3.1 for containment isolation valves being inoperable

TS 3.7.1.2 for emergency feedwater Pump 2P-7B being inoperable due to Loop 1 of service water being inoperable

-7- TS 3.6.2.3 for a containment cooler being inoperable due to Loop 1 of service water being inoperable 11:04 p.m. Fire in MCC 2B-52 is out.

No extinguishers were discharged. Reflash watch is set.

11:05 p.m. Declared an Alert on Unit 2 due to fire in MCC 2B-52. Emergency Action Level 7.6, Fire or explosion onsite affecting one train of any ESF system.

11:12 p.m. NRC notified of Unit 2 Alert declaration.

1:33 a.m. Terminated the Alert.

1.2 Operator and Plant Response to the Event The team assessed the response of the control room operators to the MCC fire and loss of a division of safety equipment. The team reviewed operator logs and plant computer data to evaluate operator performance in coping with the event and transient and verified that operator actions were in accordance with the response required by plant procedures and training. The team also conducted interviews with the control room operators who were on shift the night of the event.

The team concluded the operators acted appropriately to respond to the MCC fire and Alert declaration. The inspectors also concluded the operators acted promptly and appropriately in entering required TSs for safety equipment that was de-energized due to the breaker fire and the emergency declaration.

The inspectors also reviewed operator logs, alarm history, and available trend information to evaluate the plant response to the loss of the division of safety equipment.

The inspectors concluded the MCC breakers and electrical system functioned as described in the Final Safety Analysis Report. Following the fire in the charging pump breaker cubicle, MCC 2B-52 de-energized due to the load center Breaker 2B-532 tripping as designed. The inspectors also concluded the integrated plant response to the overall event occurred as described in the Final Safety Analysis Report.

1.3 Root Cause Evaluation The inspectors reviewed and assessed the licensee's root cause analysis for technical accuracy, thoroughness, and corrective actions proposed and taken. The inspectors reviewed the scope and processes used by licensee personnel to identify the root cause of the fault and fire in MCC 2B-52. The inspectors compared information gained through inspection to the event information and assumptions made in the root cause reports.

The inspectors interviewed licensee personnel, reviewed logs, and reviewed personal statements. The inspectors evaluated the licensee's extent of condition review and common cause evaluation.

-8- The licensee entered the MCC 2B-52 fault and fire issue in the corrective action program (CAP) as CR ANO-2-2007-1512 and performed an RCE in response to

determine the cause of the fault. Evaluation techniques utilized by the licensee included a failure modes analysis. Through this effort, the licensee determined that a high resistance connection at the bus/stab interface combined with the high starting current associated with large loads was the cause of this event. While the licensee concluded that the exact root cause could not be determined because of the damage sustained by the bus/stab contact surfaces during the event, the licensee was able to identify that the most probable root causes were inadequate preventative maintenance and inadequate original design.

To better understand the damage mechanism the stab caused to the bus bar when not lubricated, the licensee performed shop testing with subsequent laboratory analysis. The shop testing demonstrated that when not lubricated, the stabs caused noticeable damage to the tin coating on the bus bar. The laboratory analysis further confirmed that the stabbing of the un-lubricated bus bar removed the tin coating exposing the aluminum bus bar. The licensee concluded that the preventative maintenance procedure used did not require visual inspections, nor cleaning and lubrication of the bus to stab contact surface which facilitated degradation of the MCC bus bars and also allowed this degradation to continue unrecognized. Corrective actions were identified to revise both Units 1 and 2 MCC maintenance procedures to provide guidance for inspecting, cleaning and lubricating bus/stab connections; to develop and implement an equivalency/modification to replace existing plated aluminum bus bars with plated copper bus bars; and to clean, inspect, and lubricate the stab/bus connections on MCC cubicles with large loads by the end of Refueling Outage 2R20.

Aspects of organizational and programmatic weakness were also evaluated by the root cause team and reviewed by the inspectors. These included the two identified root causes: preventative maintenance less than adequate and original design inadequate, as well as timeliness of completing extent of condition inspections for Breaker 2B-53 event, thermography not performed on Unit 2 safety-related MCCs, and use of operating experience.

The extent of the condition for the cause of the fault and fire in MCC 2B-52 was assessed by the root cause team because of its potential to exist in all of the other MCCs. In response, the licensee developed a list of breaker cubicles with the same risk factors that resulted in the fire in MCC 2B-52 and performed boroscopic inspections to verify that the same condition did not exist in other MCCs. This is discussed in more detail in Section 1.4 of this report. The inspectors reviewed the licensee's actions and concluded that the licensee's extent of condition evaluation was adequate.

The final portion of the licensee's RCE consisted of a previous occurrence evaluation.

The licensee determined that there have been several previous events associated with Unit 2 that were similar in nature to the issue identified with MCC 2B-52. The licensee concluded that degraded stab connections are an industry concern. Their review also determined that there had been no missed opportunities or actions that should have been taken.

-9- The inspectors determined that the cause evaluation for the fault and fire in MCC 2B-52 was thorough and technically sound. However, the inspectors determined that in some areas the RCE was narrowly focused and lacked rigor when evaluating some of the issues. Specific examples were the licensee's previous occurrence evaluation and the organizational and programmatic weakness evaluation.

The inspectors considered the evaluation to be narrowly focused with respect to the previous occurrence evaluation since it did not fully evaluate all previous instances where breakers were discovered with similar degraded conditions. This resulted in the licensee failing to identify that there were missed opportunities and as such address this issue appropriately. This is discussed in more detail in Sections 1.6 and 2.2 of this report.

Also, the inspectors considered the licensee's conclusion in the area of organizational and programmatic weakness regarding preventative maintenance as being less than adequate was narrowly focused and lacking rigor. Specifically, the licensee determined that the preventative maintenance procedure used had been developed using a preventative maintenance engineering evaluation, which had been developed by engineering based largely on vendor manual requirements, as well as other inputs. The licensee identified that Evaluation PMEE-023 provided the requirements for the Unit 2 MCCs, and that these requirements had been taken from the "Periodic Inspection" and "Semi-annual Inspection" sections of the vendor manual which did not include the requirement to lubricate the bus/stab interface. However, during the root cause investigation, the team identified that the installation section of the vendor manual had a requirement to inspect the stabs to insure they were lubricated (petroleum jelly).

However, the licensee's root cause team determined that it could not be concluded that the intent of the manual was that this lubrication be repeated periodically. Furthermore, the licensee determined that while grease can serve to inhibit oxidation and limit plating damage, other inputs caution against the effects of hardened grease on connections.

Therefore, the lic ensee determined that there was no ove r-riding "good practice" argument for the use of grease without a supporting basis.

While the inspectors did not conclude that grease hardening was an issue, they noted that grease hardening is a well known industry issue and as such, there is a substantial amount of industry information concerning grease hardening and actions/programs to monitor for and prevent this issue. Also, the inspectors concluded that there was industry information available to the licensee that identified the need to lubricate aluminum bus bars to prevent damage and aluminum oxidation. As such, the inspectors concluded that the organizational and programmatic weakness evaluation regarding preventative maintenance was less than adequate.

1.4 Breakers Potentially Susceptible to Failure Mechanism Identified by Root Cause The licensee determined that since the identified causes of inadequate maintenance and design weaknesses existed on all ITE Series 5600 MCCs, the condition that caused the fault in MCC 2B-52 could occur in other MCCs. Furthermore, the licensee determined that certain factors, larger load sizes, and a higher number of starts when combined with the identified causes produced failures.

-10- During their review, the licensee determined that the ITE Series 5600 MCCs were installed primarily in 480 VAC applications on Unit 2, but similar MCCs had been added to both Units 1 and 2 as later design additions. As such, the similar MCCs were assumed to be susceptible to the same condition if the same casual factors existed.

Based on this, the licensee determined that there were over 900 active cubicles installed in ITE Series 5600 model MCCs in both units. As such, the licensee determined that it was not feasible to perform inspections of all of these cubicles in the short term so the licensee prioritized their inspection efforts by developing a list of cubicles with the same risk factors that resulted in the fault in MCC 2B-52. This prioritization produced a list of 167 potentially susceptible cubicles with a weighting factor from 0-7, where the higher the

rating indicated the higher the probability of stab damage occurs. Of these 167, the licensee immediately inspected the top 29 cubicles, which were weighted as a 4 or higher.

During their initial inspections of the 29 cubicles, the licensee identified 3 cubicles that appeared to exhibit indications of stab to bus bar degradation. The identified cubicles were Breaker 2B-62A5, charging Pump 2P-36B, Breaker 2B-64J3, turbine generator turning gear and Breaker 2B-42C6, stator water cooling Pump 2P-25B. Subsequently, the licensee determined that the indications observed on Breaker 2B-42C6 stator water cooling Pump 2P-25B was due to discolored grease on the bus bar.

The inspectors noted that the licensee initially focused on breaker cubicles with a weighting factor of 4 or higher. During their review, the inspectors determined that there were previous repetitive occurrences of degradation associated with breakers that the licensee had classified as having a weighting factor of 3. The inspectors informed the licensee of this and the licensee subsequently expanded the scope of their review to encompass breakers with a weighting factor of 3 or higher.

During expanded scope inspections, the licensee identified two additional breakers that exhibited indications of bus to stab degradation. The identified cubicles were Breaker 2B-26D1/D2, auxiliary building extension Chiller 2VCH-3B and Cubicle 2B-26G5, auxiliary building extension radiological waste ex haust Fan 2VEF-51B.

The licensee de-energized and removed from service all cubicles that were determined to have degradation.

1.5 Evaluation of Operability Determination for Degraded Breakers

The licensee identified a total of five breaker cubicles that appeared to exhibit signs of bus to stab degradation. Of these cubicles, four were de-energized and removed from service pending repair. The cubicle that was not de-energized, Breaker 2B-42C6, stator water cooling Pump 2P-25B was evaluated by the licensee as functional in CR ANO-2-2007-1525.

Stator water cooling Pump 2P-25B was classified as a high risk maintenance rule component, and as such, the licensee performed a functionality assessment of its condition. During their assessment, the licensee identified that the cubicle appeared to be showing signs of degradation and overheating at the stab to bus connection.

However, the licensee determined that this degradation did not prevent the pump from

-11- performing its function. The licensee identified that the cubicle had a work request written to remove the cubicle and inspect the stabs and bus bars for degradation, and that the degradation present did not prevent the pump from performing its function. The licensee also cited that Pump 2P-25B had been the running stator water cooling pump from May 2007 through October 2007. Based on this, the licensee determined that stator water cooling Pump 2P-25B remained functional.

The inspectors reviewed the licensee's CR and functionality determination associated with the stator water cooling pump. The inspectors determined that the licensee's functionality assessment was not adequate to support the continued use of the pump.

The fact that a work order had been written to inspect the cubicle stabs and bus bars at some point in the future and that the pump had run for the previous five months was not relevant to the condition that was being evaluated and was determined to not be adequate bases for functionality.

The inspectors informed the licensee of their concerns associated with stator water cooling Pump 2P-25B. Subsequently, the licensee initiated CR ANO-2-2007-1575 to re-evaluate the issue. During subsequent review, the licensee was able to determine that the indications observed associated with the stator water cooling pump were in fact a result of discolored grease on the bus bar.

1.6 Event Precursors The inspectors performed a review of the licensee's CAP database as well as the facilities maintenance database to determine if previously identified MCC pr oblems could have been viewed as precursors to the event on October 23, 2007. During this review, the inspectors considered previously documented issues where stab to bus bar degradation had been identified as well as any actual breaker fire events. The inspectors identified five previous events that appeared to be similar to that identified on Breaker 2B-52A5. Specifically,

• In April 1998, during performance of preventative maintenance on Breaker 2B-26C1, Auxiliary Building Extension Chiller 2VCH-3A, the Phase B stab was found to be welded to its associated bus bar.

• In September 1999, during performance of preventative maintenance on Breaker 2B-26C1, the middle phase stab was discovered to be welded to its associated bus bar.

• In October 2000, while performing postmodification testing of Main Chill Water Pump 2VP-1B, Unit 2 experienced a loss of MCC 2B-22 and a fire inside Breaker Cubicle 2B-22A5, the breaker for the main chiller water pump.

• In October 2001, Breakers 2B-21A6, Heating Boiler Hot Water Circulating Pump 2VP-4B, and Breaker 2B-26D1, Auxiliary Building Extension Chiller 2VCH-3B, were found wi th burnt bus bars.

-12-

• In November 2006, molten metal was identified on the Phase A bus bar of Breaker 2B-26H5, Regeneration System Air Blower 2C-29.

Based on this, the inspectors determined that there had been event precursors documented by the licensee in various facility databases. As such , the inspectors concluded that the licensee had failed to recognize and evaluate all breakers that had exhibited degraded conditions which were similar. This resulted in the licensee failing to recognize and analyze pertinent information about previous breaker issues which were precursors to the event in October 23, 2007.

1.7 MCC Maintenance and Testing The inspectors reviewed the licensee's program for maintenance and inspection of the MCCs, particularly as it related to the historical health of the breakers and ability to recognize and identify material deficiencies. During their review the inspectors noted that the licensee's generic preventative maintenance frequency for MCCs was every 6 years, and most of the nonsafety related MCCs were set to this periodicity. However, the safety-related MCCs periodicity was every 9 years. This was based on the licensee's determination that the safety-related MCCs were located in clean areas. The inspectors also noted that Procedure OP-2412.074, "Unit 2 Motor Control Centers," Revision 6, was the licensee's procedure used for performance of their preventative maintenance task on the MCCs. This procedure only required cleaning in the MCC housing where accessible and appropriate, and generally only directed the cleaning of the interior of the breaker cubicle without removing it from the MCC housing.

The inspectors determined that the licensee's program was not in accordance with industry standards for MCC maintenance. Specifically, the industry standard is to clean and inspect inside of the MCC housing during maintenance to maintain the area clear of dust and dirt. The inspectors determined that, since the interior of the MCCs were not readily accessible from the rear; the licensee was not performing interior cleaning of the MCC housings. Based on this, the inspectors determined that the licensee's program was not adequate to recognize and identify material deficiencies of breakers. A finding associated with this issue is described in Section 2.3 of this report.

1.8 Industry Operating Experience (OE) and Potential Generic Issues The inspectors performed searches of OE databases and other sources to identify reports of similar problems, both inside and outside the nuclear industry. The inspectors conducted interviews of licensee personnel, reviews of pertinent OE materials discovered independently as well as with the assistance of the NRC's OE section, and an evaluation of actions taken by the licensee in response to relevant OE.

-13- The inspectors determined that the licensee had appropriately reviewed and incorporated OE associated with the circumstances of other MCC/breaker issues, and that a failure to incorporate applicable OE into station practices was not a contributing cause to the fault in MCC 2B-52. The inspectors reviewed several items of OE, inspection reports, and licensee event reports. It appeared to the inspectors that the licensee had accounted for all available OE at the time that could have reasonably been obtained and reviewed.

2.0 SPECIAL INSPECTION FINDINGS

2.1 Inadequate Maintenance Procedure for MCC Breakers A self-revealing noncited violation was identified associated with the licensee's failure to comply with Unit 2 Technical Specifications, Section 6.4.1, "Procedures," for the failure to ensure adequate procedures were available for maintenance that was conducted on the Unit 2 motor control centers. Specifically, the maintenance procedure used by the licensee did not require visual inspections, nor cleaning, and lubrication of the bus to stab contact surface which fa cilitated degradation of the motor cont rol center bus bars and also allowed this degradation to continue unrecognized.

On October 23, 2007, Unit 2 operations were in the process of performing an 18 month surveillance testing on Charging Pump 2P-36A in accordance with Procedure OP-2305.016, "Remote Features Periodic Testing," Revision 21. This surveillance tests the local/remote start feature of the charging pump to ensure that it operates correctly from the selected station. The charging pump was started and secured by an operator at MCC 2B-52 using the local control station. Control was then transferred to the remote station and control room operators attempted to start the Charging Pump A to complete testing. As the pump was being started, a fault occurred in MCC 2B-52 Breaker 2B-52A5. The local operator at MCC 2B-52 reported a flash, followed by smoke, and fire. Concurrently, Feeder Breaker 2B-532 tripped, de-energizing MCC 2B-52, which resulted in the loss of one train of Engineered Safety Features. The Unit 2 control room also received a fire alarm for the affected area and entered AOP OP-2203.034, "Fire or Explosion." In response to this condition, Unit 2 operators declared an Alert based on a fire or explosion with loss of one train of Engineered Safety Features.

The licensee performed an RCE of this event as documented in CR ANO-2-2007-1512.

During this evaluation, the licensee identified that high resistance connection at the stab/bus interface combined with high starting current associated with large loads was the cause of this event. The licensee concluded that the exact root cause could not be determined because of the damage that was sustained during the event but the licensee identified as a probable root cause that preventative maintenance was less than adequate. Specifically, preventative maintenance Procedure OP-2412.074, "Unit 2 AC Motor Control Centers," Revision 6, does not require visual inspections and cleaning/lubrication of the bus/stab contact surface, which is contrary to standard industry practice and cubicle installation instructions contained in the vendor technical manual. Also, this practice allowed degradation of the stab to bus connection to continue unrecognized.

-14- The licensee determined that maintenance technicians did not use lubricant on stabs or bus bars when inserting the ITE Series 5600 breaker cubicles, nor was lubrication required/recommended by maintenance Procedure OP-2412.074, "Unit 2 AC Motor Control Centers." However, ITE Series 5600 Technical Document TD I005 0150, "General Instructions Motor Control Center Series 5600," Revision 1, recommends that the stab fingers be lubricated with petroleum jelly prior to insertion.

The licensee was able to determine that during the mid 1980s, common maintenance Procedure OP-1403.085, "MCC Maintenance," had contained a step to apply NO-OX-ID grease to the breaker stabs. Subsequently, Procedure OP-1412.054, "Unit 1 AC Motor Control Centers," superseded Procedure OP-1403.085, "Motor Control Center Maintenance," in 1989, and this procedure did not require maintenance technicians to lubricate the breaker stabs. Procedure OP-2412.074, "Unit 2 AC Motor Control Centers,"

was issued in 1993 and also did not require lubrication of the breaker stabs.

The inspectors reviewed the licensee's RCE of this event. During their review, the inspectors noted that the use of lubrication during the installation of MCC breakers was an established industry practice. The inspectors also noted that Unit 2 uses aluminum bus bars coated with tin, and as such, there is industry operating experience that identifies that any damage to the coating will lead to the formation of aluminum oxide which is known to cause a localized high resistance point. The inspectors noted that the industry operating experience that identified the importance of using the proper lubrication to prevent damaging the bus bars and inhibit oxide formation was available to the licensee.

The inspectors also noted that the licensee performed testing of an undamaged portion of bus bar. This testing consisted of 30 stabs with an un-lubricated bar and 30 stabs with a lubricated bar. The licensee determined that there was noticeable wear of the tin coating on the un-lubricated bar, whereas the lubricated bar showed little wear. The licensee also performed a metallurgical examination of this bus bar and stab as documented in "Metallurgical Examination of "Bus Bar" and "Stab" From Electrical Equipment 2B26H5 ANO-2." In this analysis it was noted that the bus bar and stab both showed signs of coating damage from the un-lubricated damage.

The safety significance and enforcement aspects of this finding are described in Sections 3.1 and 4.1, respectively.

2.2 Failure to Identify, Correct, and Prevent Recurrence of a Significant Condition Adverse to Quality A self-revealing noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," was identified associated with the licensee's failure to implement adequate corrective actions to prevent recurrence of a significant condition adverse to quality. Specifically, during the Root Cause Evaluation performed for the fire in Motor Control Center 2B-22 in October 2000, the licensee failed to recognize and evaluate previously documented instances where other breakers exhibited degraded connections that were similar, and as such, were precursors to the failure of the breaker in Motor Control Center 2B-22. Also, the licensee failed to recognize and evaluate these same

-15- degraded breaker connection conditions that were discovered during extent of condition inspections and subsequent motor control center maintenance inspections. The licensee's failure to identify and evaluate all instances of degraded breaker connections contributed to their failure to adequately identify the cause and implement corrective actions to prevent recurrence of this significant condition adverse to quality

On October 23, 2007, while Unit 2 Operations was in the process of performing testing on charging Pump 2P-36A in accordance with Procedure OP-2305.016, "Remote Features Periodic Testing," Revision 21, a fault occurred in MCC 2B-52 Breaker 2B-52A5. This fault resulted in a fire in the MCC and also resulted in Feeder Breaker 2B-532 tripping, de-energizing MCC 2B-52 and resulting in the loss of one train of Engineered Safety Features. The licensee entered this issue into their CAP as CR ANO-2-2007-1512, and performed an RCE of this event, as documented in this CR.

During the inspectors' review of this event, they determined that a previous fire in MCC 2B-22 was caused by similar circumstances. Specifically, on October 24, 2000, while an operator was attempting to start Main Chill Water Pump 2VP-1B for postmodification testing, lights in the room went out and the pump did not start. The operator went to MCC 2B-22 and noted smoke coming from the MCC, all of the

indicating lights on the MCC off, and fire in the Main Chill Water Pump 2VP-1B Breaker 2B-22A5, which was extinguished by the operator with a CO2 fire extinguisher. The licensee entered this issue into their CAP as CR ANO-2-2000-0766.

Subsequently, on October 25, 2000, while performing extent of condition inspections in response to the fire in MCC 2B-22, the Phase B stab on Breaker 2B-11A6, Heating Boiler Water Circulating Pump 2VP-4A, was found to be damaged by heat and arcing where contact between the stab and bus bar was made. The licensee entered this issue into their CAP as CR ANO-2-2000-0767, which was subsequently closed to CR ANO-2-2000-0766 for resolution.

The licensee performed an RCE of these events, as documented in CR ANO-2-2000-0766. During this process, the licensee identified that the center stab of Breaker 2B-22A5 appeared to have suffered previous damage. The licensee concluded that based on the MCC design, the fault condition should not have resulted in bus bar degradation unless there was already a high resistance stab connection. Based on this, the licensee determined that on October 24, 2000, the high inrush starting current caused the center stab of Breaker 2B-22A5 to emit an arc and a small amount of molten metal which resulted in a fire and subsequent Phase 3 fault which caused Feeder Breaker 2B-213 to trip which de-energized MCC 2B-22. The licensee determined the root cause of this event to be a degraded subcomponent. Specifically, the stabs on the breaker did not exert enough tension on the bus bar to support the high starting current without damage to the bus bars and stabs. The licensee also determined that the root cause for the condition discovered on Breaker 2B-11A6 to be the same.

-16- The inspectors reviewed the licensee's RCE for this event. During this review, the inspectors noted that the licensee had identified that there had been events both at ANO and other sites where arcing was involved but did not consider them to be applicable because none of these events had led to a fire. The inspectors questioned this position based on the licensee's determination that there had been previous damage on the bus bars of Breaker 2B-22A5 that had not resulted in a fire as well as the degradation observed on Breaker 2B-11A6 that had not resulted in a fire. The inspectors conducted a review of previously documented issues where stab to bus bar degradation was identified and noted two previous events where degradation appeared to be similar to that identified on Breakers 2B-22A5 and 2B-11A6. Specifically:

• In April 1998, during performance of preventative maintenance on Breaker 2B-26C1, Auxiliary Building Extension Chiller 2VCH-3A, the Phase B stab was found to be welded to its associated bus bar. The licensee initiated Job Order (JO) 00754703 to replace the affected bus bar and breaker stab.

• In September 1999, during performance of preventative maintenance on Breaker 2B-26C1, the middle phase stab was discovered to be welded to its associated bus bar. The licensee initiated Job Order 796818 to replace the affected bus bar and breaker stab.

The inspectors determined that the licensee's decision to not evaluate previous events based solely on the fact that these events had not resulted in a fire was not appropriate and was narrowly focused. Specifically, the inspectors determined that this criterion was not representative of all of the conditions identified and being evaluated by the licensee in the RCE. As such, the inspectors determined that the licensee had not adequately investigated and evaluated these previous instances where breakers where discovered with similar degraded conditions. This resulted in the licensee overlooking pertinent information that was available for the identification of the failure mechanism as well as the actual root cause of the failure.

The inspectors also noted that the licensee had used a failure modes analysis (FMA) to determine the root cause. Through the FMA the licensee had determined that the potential failure causes Number 3, "High resistance connection," and Number 19, "Contacts spread from repeated installation and lost tension or were faulty and never had enough tension," with all the evidence substantiated the root cause of faulty stabs. The inspectors questioned the licensee's conclusion based on the FMA data. Specifically, the refuting evidence for the stab tension as a potential failure condition identified that there was not a history of repeated installations of this breaker, along with no substantiated supporting evidence. The inspectors also noted that, in the previous breakers with degraded conditions, loose spring clips had not been identified nor had loose spring clips been found with degradation in any of the extent of condition inspections. Furthermore, the inspectors noted there had been a subsequent similar degraded condition identified on a Unit 2 breaker during performance of maintenance

that had not been evaluated for applicability. Also in each of these conditions, the inspectors noted that spring clip tension was not identified as an issue. Specifically, in October 2001, Breakers 2B-21A6, Heating Boiler Hot Water Circulating Pump 2VP-4B, and 2B-26D1, Auxiliary Building Extension Chiller 2VCH-3B, were found with burnt bus

-17- bars. The licensee entered these issues into the CAP as CRs ANO-2-2001-1091 and ANO-2-2001-1108 and generated maintenance Action Items 55722 and 55715 to replace the affected bus bars. Subsequently, these CRs were closed to trend with no further investigation or review performed.

The inspectors also noted that in November 2006, molten metal was identified on the Phase A bus bar of Breaker 2B-26H5, Regeneration System Air Blower 2C-29. The licensee entered this into their CAP as CR ANO-2-2006-2568 and performed an apparent cause evaluation of this issue. In this evaluation, the licensee had determined that the cause of the degradation was poor cubicle insertion. The inspectors questioned this determination because the licensee had verified that the cubicle was fully inserted and was not able to determine when the cubicle was last removed or reinstalled. The inspectors determined that this was another example of the licensee's failure to recognize and evaluate the same degraded breaker connection conditions that had previously been identified.

The inspectors concluded that the licensee failed to accurately identify the root cause of the fire in MCC 2B-52A5 as well as the degradation in Breaker 2B-11A6 using all available pertinent data. The inspectors determined that the root cause for these issues was the same as that identified in CR ANO-2-2007-1512; preventative maintenance was less than adequate. Specifically, preventative maintenance procedures did not require visual inspections and cleaning/lubrication of the bus/stab contact surface.

The safety significance and enforcement aspects of this finding are described in Sections 3.2 and 4.2, respectively.

2.3 Inadequate Implementation of Corrective Actions Fail to Correct a Condition Adverse to Quality The inspectors identified a noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to take adequate corrective actions in response to a motor control center fire that occurred on October 24, 2000.

Specifically, the licensee had identified dust and dirt in the motor control center as a condition adverse to quality, assigned a corrective action for the condition, and subsequently closed the corrective action without correcting the condition.

On October 23, 2007, while Unit 2 operations was in the process of performing testing on Charging Pump 2P-36A in accordance with Procedure OP-2305.016, "Remote Features Periodic Testing," Revision 21, a fault occurred in MCC 2B-52 Breaker 2B-52A5. This fault resulted in a fire in the MCC and also resulted in Feeder Breaker 2B-532 tripping de-energizing MCC 2B-52 resulting in the loss of one division of Engineered Safety Features.

As part of the inspectors' review of this issue, walkdowns of the affected equipment and area were conducted. During these walkdowns following the event, the inspectors noted a large amount of dust and dirt internal to MCC 2B-52. The inspectors inquired about the dust and dirt that was present in the MCC and were informed by the licensee that this was not uncommon because they did not remove the breaker cubicles from the MCC

-18- during clean and inspect maintenance but merely wiped down the inside of the breaker cubicles.

The inspectors questioned the licensee's response based on the review of a previous similar event where dust and dirt had been identified as a contributing cause to a fire in another MCC. Specifically, on October 24, 2000, wh ile starting main chiller chilled water Pump 2VP-1B for postmaintenance testing, a fire occurred in MCC 2B-22 Breaker 2B-22A5. This resulted in Feeder Breaker 2B-213 tripping which de-energized MCC 2B-22. The licensee performed a Root Cause Analysis of this event as documented in CR CR-ANO-2-2000-0766. In their Root Cause Analysis the licensee identified as a contributing cause that preventative maintenance activities for MCCs were less than adequate because the procedure allowed for steps requiring cleaning of the internal of the MCCs to not be performed and that accumulated dust and dirt created an environment where an ignition source could create a fire. Based on this, the licensee had initiated Corrective Action 9 to CR ANO-2-2000-0766 to correct this condition.

The inspectors noted that the licensee subsequently determined that dust and dirt was not a contributing cause to the fire in MCC 2B-22. However, the inspectors determined that this issue was a condition adverse to quality, and as such, determined the licensee had not adequately addressed the issue. Specifically during their review, the inspectors determined that the licensee had closed this corrective action to the stations preventative maintenance optimization program for resolution. Subsequently, the preventative maintenance optimization program closed the action without resolution of this issue. The licensee entered this into their CAP as CRs ANO-2-2007-1566, ANO-2-2008-0050, and ANO-2-2008-0071.

The safety significance and enforcement aspects of this finding are described in Sections 3.3 and 4.3, respectively.

3.0 ASSESSMENT

3.1 Inadequate Maintenance Procedure for MCC Breakers The inspectors determined that the licensee's failure to ensure that adequate procedures were available for maintenance conducted on MCC 2B-52 was a performance deficiency. The finding was determined to be more than minor because it affected the protection against external factors attribute of both the Initiating Events and Mitigating Systems cornerstone. Using the Manual Chapter 0609, "Significance Determination Process," Phase 1 Worksheets, the inspectors concluded that a Phase 2 evaluation was required.

The finding was determined to be more than minor because it affected the protection against external factors attribute of both the Initiating Events and Mitigating Systems cornerstone. Using the Manual Chapter 0609, "Significance Determination Process,"

Phase 1 worksheets, the inspectors concluded that a Phase 2 evaluation was required.

The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power Significance Determination Process," of Manual Chapter 0609, "Significance

-19- Determination Process," and the Phase 2 worksheets for Arkansas Nuclear One. The inspectors determined that the Phase 2 presolved table and worksheets did not contain appropriate target sets to estimate accurately the risk impact of the finding, therefore, a senior reactor analyst performed a Phase 3 analysis. The estimated change in core damage frequency was 8.463E-7/yr. The estimated change in large early release frequency was 4.842E-8/yr. Therefore, the significance of the finding was determined to be Green.

3.2 Failure to Identify, Correct, and Prevent Recurrence of a Significant Condition Adverse to Quality The finding was determined to be more than minor because it affected the protection against external factors attribute of both the Initiating Events and Mitigating Systems cornerstone. Using the Manual Chapter 0609, "Significance Determination Process,"

Phase 1 worksheets, the inspectors concluded that a Phase 2 evaluation was required.

The inspectors performed a Phase 2 analysis using Appendix A, "Technical Basis For At Power Significance Determination Process," of Manual Chapter 0609, "Significance Determination Process," and the Phase 2 worksheets for Arkansas Nuclear One. The inspectors determined that the Phase 2 presolved table and worksheets did not contain appropriate target sets to estimate accurately the risk impact of the finding, therefore, a senior reactor analyst performed a Phase 3 analysis. The estimated change in core damage frequency was 8.463E-7/yr. The estimated change in large early release frequency was 4.842E-8/yr. Therefore, the significance of the finding was determined to be Green. The cause of this finding was determined to have a crosscutting aspect in the area of problem identification and resolution associated with the corrective action program (P.1[c]) in that the licensee failed to thoroughly evaluate the fire in Motor Control Center 2B-22 such that the resolution addressed the cause and extent of condition. This also includes conducting effectiveness reviews of corrective actions to ensure that the issue was resolved after more indications were discovered.

3.3 Inadequate Implementation of Corrective Actions Fail to Correct a Condition Adverse to Quality The inspectors determined that the licensee's failure to perform adequate corrective actions for a condition adverse to quality associated with inadequate preventative maintenance activities of MCCs was a performance deficiency. The finding was determined to be more than minor because it affected the protection against external factors attribute of the Initiating Events cornerstone, and it directly affected the

cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Using the Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," Phase 1 Worksheet, the finding was determined to have very low safety significance because the condition represented a low degradation of fire prevention and administrative controls feature. The finding had crosscutting aspects in the area of problem identification and resolution associated with the CAP (P.1 [d]) because the licensee failed to take appropriate corrective actions to address safety issues in a timely manner.

-20- 4.0 ENFORCEMENT

4.1 Inadequate Maintenance Procedure for MCC Breakers Unit 2 Technical Specifications, Section 6.4.1.a, "Procedures," requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Regulatory Guide 1.33, Appendix A, Section 9.a., requires, in part, that maintenance that can affect the performance of safety-related equipment should be performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to the above, on October 4, 2003, when maintenance was performed on MCC 2B-52 using Procedure OP-2412.074, "Unit 2 AC Motor Control Centers," the licensee failed to ensure adequate procedures were available for the maintenance conducted. Because this finding is of very low safety significance and has been entered into the CAP as CR ANO-2-2007-1512, this violation is being treated as an NCV consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000368/2007009-01, "Inadequate Maintenance Procedure for Motor Control Center Breakers."

4.2 Failure to Identify, Correct, and Prevent Recurrence of a Significant Condition Adverse to Quality 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," requires, in part, that "Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformance's are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition." Contrary to the above, the licensee failed to properly evaluate and identify the cause of the breaker fire in MCC 2B-22 in October 2000. Subsequently, the corrective actions that were implemented for the identified cause were not sufficient to correct the condition and prevent repetition which resulted in a fire in MCC 2B-52 on October 23, 2007. Because this finding is of very low safety significance and has been entered into the CAP as CR ANO-2-2008-0060, this violation is being treated as an NCV consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000368/2007009-02, "Failure to Identify, Correct, and Prevent Recurrence of a Significant Condition Adverse to Quality."

4.3 Inadequate Implementation of Corrective Actions Fail to Correct a Condition Adverse to Quality 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that measures be established to assure that conditions adverse to quality are promptly identified and corrected. Contrary to this, between June 2001 and October 2007, the licensee's measures failed to assure that a condition adverse to quality was promptly corrected. Specifically, the licensee had identified dust and dirt internal to the station MCCs as a condition adverse to quality, assigned a corrective action to address this condition, and subsequently closed this corrective action without resolution of the issue.

Because this finding is of very low safety significance and has been entered into the CAP

-21- as CR ANO-2-2008-0071, this violation is being treated as an NCV consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000368/2007009-03, "Inadequate Implementation of Corrective Actions Fail to Correct a Condition Adverse to Quality."

4OA6 Meetings, Including Exit

On November 6, 2007, and January 10, 2008, the results of this inspection were presented to T. Mitchell, Vice President Nuclear Generation, and other members of his staff who acknowledged the findings. Additionally, on February 20, 2008, the final results of this inspection were presented to B. Berryman, Plant General Manager, and other members of his staff who acknowledged the findings. The inspector confirmed that no proprietary material was examined during the inspection.

ATTACHMENT 1:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

B. Berryman, General Manager, Plant Operations

C. Bregar, Nuclear Safety Assurance Director

J. Browning, Manager, Maintenance

L. Cawyer, Reactor Operator

S. Cotton, Manager, Training & Development

B. Efrid, Reactor Operator

J. Eichenberger, Director, Nuclear Safety

D. James, Licensing Manager

J. Miller, System

Engineering Manager

T. Mitchell, Vice President, Operations

C. Reasoner, Engineering Director

R. Scheide, Licensing Specialist

J. Smith, Quality Assurance Manager

W. Strickland, Senior Reactor Operator

F. Van Buskirk, Licensing Specialist

R. Walters, Operations Manager

M. Woodby, Design Engineering Manager

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000368/2007009-01

NCV Inadequate Maintenance Procedure for Motor Control Center Breakers

05000368/2007009-02

NCV Failure to Identify, Correct and Prevent Recurrence of A Significant Condition Adverse to Quality

05000368/2007009-03

NCV Inadequate Implementation of Corrective Actions Fail to Correct a Condition Adverse to Quality

LIST OF DOCUMENTS REVIEWED

Procedures

NUMBER TITLE REVISION

OP-1403.085 Motor Control Center Maintenance 0

OP-2412.074 Unit 2 Motor Control Centers 6

OP-2305.016 Remote Feature Periodic Testing 21

-2-OP-2203.034 Fire or Explosion 9 E-2014

Single Line Diagram 480 Volt Motor Control

Centers 2B52

CRsANO-1-2007-2276

ANO-2-2000-0766

ANO-2-2000-0767

ANO-2-2000-0842

ANO-2-2000-0111

ANO-2-2001-0220

ANO-2-2001-1091

ANO-2-2001-1108

ANO-2-2006-2568

ANO-2-2006-2444

ANO-2-2007-1528

ANO-2-2007-1525

ANO-2-2007-1575

ANO-2-2007-1527

ANO-2-2007-1627

ANO-2-2007-1566

ANO-2-2007-1773

ANO-2-2007-1512

ANO-2-2007-1785

ANO-2-2007-1773

ANO-2-2008-0071

ANO-2-2008-0050

ANO-2-2008-0060

MAIs

17157

35952

35965

43098 45548 55715

55722

45041

Job Orders

00754703

00796818

00796818

00833474

00840251

00879233

00891716

Work Orders

250118

273956

50467237

50503547

50570785

Miscellaneous

Information

Specification 6600-E-2400, Class 1E Motor Control Centers

ANSI/ASTM B 236-73, Aluminum Bar for Electrical Purposes (Bus Conductor)

TD I005.0150, General Instructions Motor Control Center Series 5600, Revision 1

Preventative Maintenance Engineering Evaluation 023

Attachment 2

November 1, 2007

MEMORANDUM TO: Wayne Walker, Senior Project Engineer, Branch C

Jeffrey Josey, Resident Inspector, Arkansas Nuclear One

FROM:

Arthur T. Howell III, Director, Division of Reactor Projects

SUBJECT:

SPECIAL INSPECTION CHARTER TO EVALUATE THE ARKANSAS NUCLEAR ONE BREAKER FIRE AND ALERT DECLARATION

A Special Inspection Team is being chartered in response to the Arkansas Nuclear One Unit 2

breaker fire and Alert declaration on October 23, 2007.

You are hereby designated as the Special Inspection Team members.

Mr. Wayne Walker is designated as the team leader.

The assigned SRA to support the team is David Loveless.

A. Basis

On October 23, 2007, Arkansas Nuclear One (ANO) Unit 2 declared an Alert following a fire in a safety related 480V motor control center (MCC).

Specifically, the breaker for the Charging Pump A failed while the pump wa

s undergoing 18-month surveillance testing following mechanical maintenance.

During the testing, the pump was started locally at the charging pump breaker cubicle, then immediately started remotely from the control room.

During the remote start, a fire occurred in the charging pump breaker cubicle which resulted in MCC 2B52 de-energizing due to the tripping of load center breaker 2B-

2.

The licensee declared one Division of safety equipment inoperable as a result of the loss of power to the MCC.

From their initial investigations, the licensee believes the cause of the breaker failure was a long-term degradation of the connection between the breaker and the bus bars, which resulted in localized heating and eventual failure of the connection.

ANO Unit 2 experienced a similar failure in a breaker to bus bar connection in October 2006, which also resulted in a MCC fire and Alert declaration.

During extent of condition inspections conducted on October 25, 2007, the licensee identified three additional breakers that exhibited signs of bus bar heating indicative of high resistance connections of the type implicated in the October 23 failure.

The three additional breakers supplied power to the turbine turning gear, a stator water cooling pump, and a coolant charging pump.

This Special Inspection Team is chartered to review the circumstances related to historical and present electrical breaker problems at ANO Unit 2 and to assess the effectiveness of the licensee's actions for resolving these problems.

The team will also assess the effectiveness of the immediate actions taken by the licensee in response to the breaker fire event on October 23, 2007.

UNITED STATESNUCLEAR REGULATORY COMMISSIONREGION IV611 RYAN PLAZA DRIVE, SUITE 400ARLINGTON, TEXAS 76011-4005

Attachment 2 B. Scope

The team is expected to address the following:

1. Develop a chronology (time-line) that includes significant event elements.

2. Evaluate the operator response to the event.

Ensure that operators responded in accordance with plant procedures and Technical Specifications, took appropriate mitigating actions, and made appropriate emergency declarations.

3. Assess the licensee's root cause determination for the breaker failure, the extent of condition review, the common cause evaluation and corrective measures.

Evaluate whether the timeliness of the corrective measures are consistent with the safety significance of the problems.

4. Develop a complete scope of all breakers and associated supplied loads potentially susceptible to the failure mechanism identified by the licensee's root cause determination.

5. Review the licensee's operability deter minations that evaluated any degraded breaker connections.

Determine if the licensee appropriately entered the operability determination process and if key assumptions are valid and verifiable.

6. Identify previous motor control center issues that may have been precursors to the October 23 event, including events in October, 2006 and October, 2000.

Evaluate the licensee's corrective measures and extent of condition reviews for those problems.

7. Evaluate the licensee's electrical breaker and motor control center maintenance and testing programs.

Verify that the programs are adequate and that the licensee is following the program provisions.

8. Evaluate pertinent industry operating experience that represents potential precursors to the October 23 event, including the effectiveness of licensee actions taken in response to the operating experience.

9. Determine if there are any potential generic issues related to the breaker failure at ANO Unit 2.

Promptly communicate any potential generic issues to Region IV

management.

10. Collect data as necessary to support a risk analysis.

Work closely with the Senior Reactor Analyst during this inspection.

C. Guidance Inspection Procedure 93812, "Special Inspection," provides additional guidance to be used by the Special Inspection Team.

Your duties will be as described in Inspection Procedure 93812.

The inspection should emphasize fact-finding in its review of the

circumstances surrounding the event.

It is not the responsibility of the team to examine Attachment 2 the regulatory process.

Safety concerns identified that are not directly related to the event should be reported to the Region IV office for appropriate action.

The Team will report to the site, conduct an entrance, and begin inspection no later than October 31, 2007.

While on site, you will provide daily status briefings to Region IV management, who will coordinate with the Office of Nuclear Reac tor Regulation, to ensure that all other parties are kept informed.

If information is discovered that shows a more significant risk was associated with this issue, immediately contact Region IV

management for discussion of appropriate actions.

A report documenting the results of the inspection should be issued within 30 days of the completion of the inspection.

This Charter may be modified should the team develop significant new information that warrants review.

Should you have any questions concerning this Charter, contact me at

(817) 860-8147.

cc:

J. Clark, C:DRP/E

G. Replogle, DRP/E

G. Miller, DRP/E

C. Young,

SRI-ANO

D. Loveless, SRA/DRS

J. Josey,

RI-ANO

R. Caniano, DRS

D. Chamberlain, DRS

A. Vegel, DRP

P. Gwynn, DRA

1Significance Determination Evaluation Arkansas Nuclear One - Unit 2

Circuit Breaker Failure Phase 3 Analysis

Performance Deficiency

Inadequate circuit breaker maintenance led to the loss of motor control center (MCC) 2B-52

during a surveillance test of the 2P-36A charging pump.

The failure was caused by high circuit breaker contact resistance. The alternate train MCC (2B-62) was also vulnerable to failure from the same deficiency.

The major risk significant systems affected by loss of MCCs 2B-52 and

2B-62 are emergency boration, high pressure safety injection, high pressure recirculation, containment spray, and shutdown cooling.

For each of these systems, power is lost to motor-

operated valves that must be re-positioned for these systems to function.

Assumptions

1. The consequence observed during the event on October 23, 2007 is the only expected outcome of the failure mode.

That is, loss of the 2B-52 MCC is assumed guaranteed given the failure of the circuit breaker. Further, recovery of the MCC following its failure is not credited for any initiating event sequence.

Fires resulting from the event are expected to be brief in nature and easy to extinguish, therefore, they are not modeled beyond the considerat ion that plant personnel will be used for the fire brigade, potentially delaying the execution of manual recovery actions.

2. The circuit breaker for the 2P-36A charging pump was installed approximately 4 years prior to its failure.

It is assumed that degradation of the contacts began immediately after breaker installation and that it continued to degrade in a linear fashion until its ultimate failure.

Until the degradation reached a threshold limit, failure caused by high contact resistance was not a credible event, but after the threshold limit was achieved, breaker failure became possible and the probability of failure increased linearly with time.

In the absence of definitive knowledge of the physical processes, it is assumed that the threshold degradation was reached at the t/2 point, or two years after installation and two years prior to failure.

3. It is assumed that the failure of the 2P-36A charging pump breaker was a stochastic event and that it was not pre-conditioned by the pump start that occurred approximately 3

minutes before the failure occurred.

The thermal effects of the previous start would not have been significant after the pump had been secured for three minutes.

Also, it is noted that the assumed failure mode of the pump includes many situations where the pump is running continuously, then secured and quickly restarted. In these cases, the thermal effects would likely approximate or exceed those that existed during the October 27, 2007 failure.

4. Failure of the circuit breaker for the 2P-36A charging pump would occur only during a pump start, and would not occur during continuous operation or while the pump was in standby. Therefore, the risk of losing the 2B-52 MCC during any accident sequence would exceed the baseline value only during an event where the 2P-36A charging pump

2is started.

If the pump is in standby or is running, and no change of its operation occurs, it is assumed that the breaker and associated MCC are nominally reliable.

5. The rate of degradation of the circuit breaker contacts is assumed to be a function of time, pump run time, and pump starts.

The thermal effects of the starting current or continuous operation might accelerate the degradation process, but since pump starts and run time are more or less evenly distributed over a long period of time, it is assumed that the degradation over the 4-year time of installation was strictly a function of time.

6. During the final two years of operation, when it is assumed that the failure probability of the circuit breaker for the 2P-36A charging pump was above the baseline or nominal value (Assumption #2), a total of 84 starts of the pump occurred.

Given that one failure occurred, this would suggest, as a first-order approx imation, that the failure probability of the circuit breaker was 1/84 or 1.19E-2 per demand during this period of time.

However, as stated in (2) above, it is more likely corre ct to assume that the probability of failure was increasing linearly above the baseline value for the entire two-year period.

Further, the value of the failure probability at the end of the two-year period c an be estimated as that value that would give an expectation of one failure over this interval of time.

Thereafter, the average failure probability per demand during the final year of exposure would mathematically be 3/4 of the terminal failure probability.

Using this method, the estimated probability that the breaker would fail on its final demand (the time that it actually failed) was 2.38E-2 and the average breaker failure probability per demand during the final year of exposure was 1.79E-2.

7. Examination of the 2P-36B charging pump breaker indicated that it exhibited the same degree of degradation, though it had no failure history.

It had been installed for 5 years, or one year longer than the breaker for 2P-36A.

The licensee tagged out this pump to prevent its inadvertent start and potential adverse impact on MCC 2B-62.

It is assumed for this assessment that the failure probability of this pump was 1/2 of the failure probability of the 2P-36A pump for the final year of operation.

Therefor

e, the 2P-36B pump is assumed to have a failure probability of 8.95E-3 per demand.

With regard to both trains being affected, this is not a common cause failure mechanism, but rather a situation where the independent failure probabilities of both trains were elevated.

That is, there is no basis for concluding that there was a coupling mechanism making the failure of both trains at the same time a more likely event than their concurrent independent failures.

8. Pump breaker failures and the loss of the associated MCC are postulated to occur only when the pump is started from a de-energized state.

For various scenarios, operation of the pumps varies according to initial conditions and the nature of the event.

The assumed initial condition is that one of the two pumps (2P-36A or 2P-36B) is running and the other is in standby. The following presents the assumptions made for this assessment:

Small LOCA, Medium LOCA, Large LOCA, SRV LOCA, and ISL LOCA:

In these events, a safety injection actuation signal (SIAS) will be in itiated and both pumps will be stopped and then both restarted.

Therefore, both pumps and their associated MCCs are vulnerable to a demand failure.

3LOOP:

In the events where the EDGs operate as designed, i.e., start within 17 seconds, the previously running charging pump will be re-energiz ed, but a previously standby pump will likely not be started because pressurizer level will remain in the normal operating band.

However, if the re-energization of the

running pump results in a loss of the associated MCC, operators w ill start the alternate charging pump, thereby placing its MCC in jeopardy.

Therefore, for this analysis, it is assumed that both MCCs have elevated unreliability. In the event of a station blackout, it is likely that both pumps would be restarted upon resumption of power to control pressurizer level.

SGTR:

If the flow rate exceeds 44 gpm, a SIAS will be init iated and both pumps will be started. It is assumed in this analysis that all SGTR events will follow this sequence.

Transients:

Many transients will not caus

e a change in pump operation, which would not result in a change in the risk profile.

However, if the transient involves

a high pressure condition, an SRV could open and fail to close, resulting in a safety injection actuation signal, and a subsequent restart of both charging pumps.

The data used to establish the SRV LOCA frequency included LERs that described events that began with standard transient events (such as a trip of the main turbine with failure of bypass valves).

Therefore, the analyst determined, in consultation with INL, that quantifying the transient sequences for this finding would result in double counting the significance of the prior industry events. (Also see Assumption #13). However, as can be observed in the sensitivity analysis performed below, deleting the transient sequences from the quantification did not make a large difference in the final result.

Other Initiators: it is possible that charging pump operations would occur during any event, but it is not particularly likely for the remainder of events that running pumps would be secured and then restarted or that standby pumps would be started.

Therefore, these sequences were not quantified in this analysis.

9. Repair of

MCC 52B took 1.61 days. During this time, it was assumed that this MCC was failed and that the failure probability of

MCC 62B was 8.

95E-3 (same as determined above).

The risk associated with the repair time was quantified with the same set of initiators and added to that accumulated during the year prior to the breaker failure.

10. Recovery of de-energized motor-operated valves associated with the loss of MCCs 2B-52 and 2B-62 is credited in this analysis.

Although there is no specific procedure or training that would facilitate the manual re-positioning of these valves, detection of the loss of a safety-related bus and identification of the affected loads is considered to be within the "skill of the craft" of licensed operators.

The event would possibly include the need to activate the fire brigade to fight a fire in the affected switchgear rooms.

Individuals who are members of the fire brigade would be the same personnel needed to perform the actions locally to stroke the affected motor-

operated valves.

The two most risk significant valves to this analysis are 2-CV-5649-1 and 2-CV-5650-2,

4the outboard containment sump isolation valves.

When MCCs 2B-52 and 2B-62 are lost, both of these motor-operated valves fail in the closed position and cause a complete functional loss of the recirculation phase of a LOCA recovery.

As can be seen below, the top cutset is an SRV LOCA and loss of both of these MCCs. This scenario is sufficient to result in core damage.

Valves 2-CV-5649-1 and 2-CV-5650-2 are accessible in the auxiliary building, but only 2-

CV-5650-2 has a pathway provided for easy access.

These are large valves that would take some time to open manually.

The RWT outlet valves, 2-

CV-5630 and 2-CV-5631 must isolate to prevent ingestion of nitrogen cover gas into the pump casing.

2-CV-5630 is powered from MCC 2B-52, and 2-CV-5631 is powered from

MCC 2B-61.

For the dominant core damage sequence, it would be assumed that 2-CV-

5630 would fail to close and 2-CV-5631 would close as designed when a recirculation actuation signal is received when sensed off a level transmitter in the RWT.

However both trains of ECCS pumps would be vulnerable to damage, one from nitrogen ingestion, the other from overheating because of the lack of a suction flow path if the sump isolation valves are not opened it time.

Recovery from the above scenario would involve the ability of operat ors to detect that MCCs 2B-52 and 2B-62 were de-energized, that the loss of these MCCs would result in

a failure to transfer ECCS suction automatically from the RWT to the containment sumps, and to develop a plan to send operators into the plant to manually establish a recirculation lineup in time before core uncovery or before ECCS pump damage would occur.

Concurrent with these efforts would be the possibility that fires would exist in both affected MCCs and that a fire brigade would be required to respond accordingly.

This would limit the number of operators available to take the necessary manual actions to establish a recirculation flow path for the ECCS.

The amount of time available to perform the manual repositioning of the effected motor-

operated valves is dependent on the magnitude of the LOCA.

For this analysis, it is assumed that in the event of a medium-break or large-break LOCA, there would be insufficient time to complete the actions.

For small-break and SRV LOCAs and steam generator tube ruptures, operators would have approximately one hour to diagnose the situation and perform the necessary valve lineups.

For these cases, the drawdown of the

RWT is mostly caused by containment spray.

The loss of the subject MCCs would disable several containment spray injection valves, but it is assumed that operators would quickly establish containment spray after containment pressure begins to rise.

The failure of containment spray to actuate automatically would provide an important diagnostic cue to operators that other valves, including the sump isolations, would also be affected.

Using the

SPAR-H Human Reliability Analysis Method, NUREG/

CR-6883, and assuming for diagnosis nominal time, high stress, a moderate complexity, and incomplete procedures, and for acti on nominal time and high stress, a failure probability of 0.45 was calculated.

Therefore, for SLOCA, SRV LOCA, and SGTR sequences, it is assumed

there is a 55 percent probability that operators will successfully reposition valves to establish recirculation from the containment sump.

5Other functions affected by the loss of MCCs 2B-52 and 2B-62 involve less of a time-related demand and therefore would be expected to have higher recovery rates.

However, in this analysis, a 0.45 non-recovery was assumed for these actions as well, and only credited for SLOCA, SRV LOCA, and SGTR.

11. The performance deficiency affected other circuit breakers than those associated with charging pumps 2P-36A and 2P-36B.

The risk significance or level of degradation of these circuit breakers was determined to be such that the effect on the risk analysis would be minimal. Therefore, this analysis only addressed the consequences associated with the two degraded charging pump breakers.

2. It is assumed that the emergency diesel generators can be affected by either the loss of MCC 2B-52 or MCC 2B-62.

The air compressors will be lost in this situation, but plant experience shows t hat one-start capability for an EDG would not be lost for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

However, ventilation in the EDG A room would be lost with the loss of MCC 2B-52

and EDG B with the loss of MCC 2B-62.

The EDGs themselves are cooled by service water and would be adequately cooled.

However, with no ventilation, circuitry in the room could be challenged by high room temperatures.

It is assumed in this case that plant operators would open vent paths in the room and that the EDG could survive for a period of time, but operation beyond 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is in question.

The base case consists of 1-

hour and 8-hour sequences. It assumed that the EDGs can run for at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> but would fail before 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> given a lack of room ventilation. Therefore, to bound the result of this analysis, the analyst placed the MCC fault as a separate feeder into the fault tree

"OR-GATE" for each EDG.

For cut sets that contained the loss of both MCCs, the EDG

common cause failure to run was removed to prevent the quantification of non-minimal cutsets.

One-hour cutsets that were generated by loss of both MCCs were eliminated and 8-hour cutsets were modified to remove the EDG recovery event, based on an assumption that overheated EDGs could not be recovered given a lack of options to cool the rooms.

13. The base SPAR model provides an event frequency of 3E-3/yr. for an SRV LOCA.

This value is based on two LERs from the 1990's.

One of the LERs involved a leak of only 25

gpm versus an actual situation that could be classified as a small-break LOCA.

With the concurrence of INL, the analyst decided to delete this LER from the event database.

This change resulted in a frequency of 1.7E-3 for the SRV LOCA event.

The base case of the SPAR model was updated appropriately.

Analysis:

Internal Events

The

ANO-2 SPAR model, Revision 3.31, dated June 29, 2006 was used in this analysis.

For the one-year exposure of the condition assessment, average test and maintenance was assumed.

A cutset truncation limit of 1.0E-12 was used.

6SLOCA, MLOCA, LLOCA,

SRV-LOCA, SGTR, LOOP

For these events, it is assumed that both of t he charging pump breakers will be operated, and that both of the associated MCCs are vulnerable to an increased failure probability.

As stated in (6) and (7) above, the probability of breaker failure and loss of the related MCC is estimated as 1.79E-2 and 8.95E-3 for 2P-36A and 2P-36B, respectively.

Consequently, the following changes to basic events were made in the SPAR model:

ACP-BAC-LP-MCCB52, Failure of MCC B52 Bus, was increased from 4.8E-6 to 1.79E-2

ACP-BAC-LP-MCCB62, Failure of MCC B62 Bus, was increased from 4.8E-6 to 8.95E-3

For SLOCA, SRV LOCA, and SGTR, the risk numbers were post-processed to reflect a non-recovery probability of 0.45 (Assumption 10). The results are presented as follows:

Initiating Event Base CDF Case CDF Delta-CDF SLOCA 6.725E-8 9.759E-8 9.086E-8 MLOCA 6.591E-9 2.646E-8 1.987E-8 LLOCA 1.982E-9 5.953E-9 3.971E-9 SRV LOCA 2.846E-7 5.696E-7 2.850E-7 ISL LOCA 5.310E-7 5.310E-7 0

SGTR 1.626E-7 2.110E-8 4.842E-8 LOOP 3.665E-7 6.080E-7 2.417E-7 Total Internal Events

6.898E-7

1. No risk increase is attributed to inter-system LOCAs because the event tree in the SPAR model only credits operator action to diagnose and isolate the LOCA. It is not expected that the loss of MCCs 2B-52 and 2B-62 would cause a loss of the operators' capability to isolate an inter-system LOCA.

The major core damage cutsets that generated a change in risk from the baseline resulted from a loss of sump recirculation caused by a loss of power to the sump suction valves to both headers (Valves 2CV-5649-1, 2CV-5650-1) as a consequence of the loss of MCCs 2B-

and 2B-62.

The top 20 cutsets are presented below:

Cut No. % Tot al % Cut Set Prob./Fre quen cy Basic Event Description Event Prob.

12.99 12.99 2.72 3E-

007

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

ACP-BAC-LP-MCCB62

ACP-BAC-LP-MCCB62 8.950E-003

7Cut No. % Tot al % Cut Set Prob./Fre quen cy Basic Event Description Event Prob.

17.04 4.0 5 8.50 0E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

HPR-SMP-PG-SUMP CONTAINMENT RECIRCULATION SUMP

FAILURES 5.000E-005

20.45 3.4 1 7.16 0E-

008

IE-SGTR SG TUBE

RUPTURE 4.000E-003

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

EFW-XHE-XM-CSTLT OPERATOR FAILS TO ALIGN LONG TERM BACKUP

WATER SOURCE 1.000E-003

23.51 3.0 6 6.40 8E-

008

IE-SLOCA SMALL LOCA INITIATING EVENT 4.000E-004

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

ACP-BAC-LP-MCCB62

ACP-BAC-LP-MCCB62 8.950E-003

25.83 2.3 2 4.86 3E-

008

IE-LOOP LOSS OF OFFSITE

POWER 3.590E-002

EPS-DGN-CF-RUN CCF OF DIESEL GENERATORS TO RUN 1.631E-004 /EPS-DUALUNIT-

LOOP DUAL UNIT LOOP 4.180E-001

EPS-XHE-XL-

NR08H OPERATOR FAILS TO RECOVER EMERGENCY

DIESEL IN 8 HOURS 2.958E-001

OEP-XHE-XL-NR08H OPERATOR FAILS TO RECOVER OFFSITE POWER

IN 8 HOURS 6.718E-002

27.95 2.1 2 4.43 7E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

HPR-MOV-CF-564950 CCF OF SUMP ISOLATION MOVs 2CV-5649/5650 2.610E-005

29.66 1.7 1 3.58 0E-

008

IE-SGTR SG TUBE

RUPTURE 4.000E-003

ACP-BAC-LP-MCCB62

ACP-BAC-LP-MCCB62 8.950E-003

8Cut No. % Tot al % Cut Set Prob./Fre quen cy Basic Event Description Event Prob.

EFW-XHE-XM-CSTLT OPERATOR FAILS TO ALIGN LONG TERM BACKUP

WATER SOURCE 1.000E-003

31.11 1.4 5 3.04 3E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

HPR-MOV-CC-CV5650 HPR TRAIN A OUTBD SUMP ISOL MOV 2CV-5650-2 FAILS

TO OPEN 1.000E-003

32.56 1.4 5 3.04 3E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

HPR-MOV-OO-CV5631 RWST ISOLATION MOV

CV-5631 FAILS TO CLOSE 1.000E-003

33.67 1.1 1 2.33 4E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

HPR-STR-CF-SMPSTR CCF OF SUMP STRAINERS 1.373E-005

34.76 1.0 9 2.28 2E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

HPI-MDP-FS-

2P89B HPI MDP 2P89B FAILS TO START 1.500E-003

HPI-MDPCSTBY-

TRNA HPI

MDP-C IN STANDBY AND ALIGNED TO TRAIN A 5.000E-001

35.85 1.0 9 2.28 2E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

HPI-MDP-FS-

2P89B HPI MDP 2P89B FAILS TO START 1.500E-003

HPI-MDPASTBY-

TRNA HPI

MDP-A IN STANDBY AND ALIGNED TO TRAIN A 5.000E-001

9Cut No. % Tot al % Cut Set Prob./Fre quen cy Basic Event Description Event Prob.

36.80 0.9 5 2.00 0E-

008

IE-SGTR SG TUBE

RUPTURE 4.000E-003

HPI-XHE-XM-RWST OPERATOR FAILS TO REFILL THE RWST 1.000E-003

MSS-VCF-HW-ISOLB RUPTURED STEAM GENERATOR B ISOLATION

FAILURES 1.000E-002

SGTR-SGB SGTR OCCURRED IN

SG-B 5.000E-001

37.75 0.9 5 2.00 0E-

008

IE-SGTR SG TUBE

RUPTURE 4.000E-003

HPI-XHE-XM-RWST OPERATOR FAILS TO REFILL THE RWST 1.000E-003

MSS-VCF-HW-ISOLA RUPTURED STEAM GENERATOR A ISOLATION

FAILURES 1.000E-002

SGTR-SGA SGTR OCCURRED IN

SG-A 5.000E-001

38.70 0.9 5 2.00 0E-

008

IE-SGTR SG TUBE

RUPTURE 4.000E-003

EFW-XHE-XM-CSTLT OPERATOR FAILS TO ALIGN LONG TERM BACKUP

WATER SOURCE 1.000E-003

MSS-VCF-HW-ISOLB RUPTURED STEAM GENERATOR B ISOLATION

FAILURES 1.000E-002

SGTR-SGB SGTR OCCURRED IN

SG-B 5.000E-001

39.65 0.9 5 2.00 0E-

008

IE-SGTR SG TUBE

RUPTURE 4.000E-003

EFW-XHE-XM-CSTLT OPERATOR FAILS TO ALIGN LONG TERM BACKUP

WATER SOURCE 1.000E-003

MSS-VCF-HW-ISOLA RUPTURED STEAM GENERATOR A ISOLATION

FAILURES 1.000E-002

SGTR-SGA SGTR OCCURRED IN

SG-A 5.000E-001

40.60 0.9 5 2.00 0E-

008

IE-SLOCA SMALL LOCA INITIATING EVENT 4.000E-004

HPR-SMP-PG-SUMP CONTAINMENT RECIRCULATION SUMP

FAILURES 5.000E-005

10Cut No. % Tot al % Cut Set Prob./Fre quen cy Basic Event Description Event Prob.

41.47 0.8 7 1.83 1E-

008

IE-SRVLOCA INADVERTENT RELIEF VALVE OPEN - LOCA 1.700E-003

HPI-MDP-CF-STRT COMMON CAUSE FAILURE OF HPI MDPs TO START 1.077E-005

42.23 0.7 6 1.60 2E-

008

IE-SLOCA SMALL LOCA INITIATING EVENT 4.000E-004

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

ACP-BAC-LP-MCCB62

ACP-BAC-LP-MCCB62 8.950E-003

LOCA-CLC LOCA OCCURRED IN COLD

LEG C 2.500E-001

42.99 0.7 6 1.60 2E-

008

IE-SLOCA SMALL LOCA INITIATING EVENT 4.000E-004

ACP-BAC-LP-MCCB52

ACP-BAC-LP-MCCB52 1.790E-002

ACP-BAC-LP-MCCB62

ACP-BAC-LP-MCCB62 8.950E-003

LOCA-CLA LOCA OCCURRED IN COLD

LEG A 2.500E-001

Repair Time

The repair of

MCC 52B took 1.61 days.

To account for this exposure period the following basic event changes were made:

ACP-BAC-LP-MCCB52, Failure of MCC B52 Bus, was increased from 4.8E-6 to 1.0

ACP-BAC-LP-MCCB62, Failure of MCC B62 Bus, was increased from 4.8E-6 to 8.95E-3

[note: Charging pump 2P-36B was not tagged out until after the repair to MCC B52 was completed; therefore, the vulnerability of losing MCC B62 existed for the entire 1.61 day repair time]

This change set was quantified for SLOCA, MLOCA, LLOCA, SGTR, SRV LOCA, and LOOP.

Base CDF

Case CDF Delta CDF/yr. Delta CDF/1.61 d. 1.107E-6 3.659E-5 3.548E-5 1.565E-7

Total Internal Delta CDF:

6.898E-7/yr. + 1.565E-7/yr. = 8.463E-7/yr.

11External Events Insights gained from the internal events analysis indicated that the majority of the risk associated with this performance deficiency is related to loss of coolant accidents coincident with the attempted starting of both charging pumps.

The top cutsets include the loss of both MCCs with

a subsequent loss of sump recirculation capability.

If one c harging pump is idle and remains idle during an event or if a pump is running and continues to run, the risk impact is considerably lower, because its associated MCC is then modeled as being nominally reliable (6.4E-6 failure probability over a

24-hour period).

Also, two flow paths for HPI remain available even if both MCC B52 and B62 are lost; therefor

e, the impact on injection capability is minimal, except in those cases where the break occurs in a location that causes the loss of the remaining flow paths.

The absence of a major risk impact for non-LOCA events is further demonstrated by the sensitivity result presented above. Therefore because it is unlikely that any external event would cause a loss of coolant accident, the risk significance of external events is not expected to be significant.

As discussed above with respect to the transient initiator, any reactor trip can result in complications that could cause an SRV to open and then stick open.

An example would be a turbine trip with a failure of the turbine bypass valves to open.

External events such as seismic and fires can cause reactor trips, though the frequency of these events are much lower than transients caused by internal events.

Also, a ccording to the SPAR model, the probability that a reactor trip will result in an SRV demand followed by a failure of the SRV to close is 2.7E-5.

Based on these facts, the analyst concluded that SRV LOCAs resulting from external events would not add appreciably to the significance of this finding.

Seismic

Seismic events would not be expected to cause a loss of coolant accident, but would add risk primarily by causing a loss of offsite power.

The originally running charging pump would be re-

started, and might cause a failure of the associated MCC, after which the starting of the alternate charging pump could also remove its MCC.

The median capacity earthquake to cause a loss of offsite power is 0.3g and for ANO, the frequency of earthquakes with accelerations of 0.3g or greater is 4.86E-5/yr. (RASP Manual, Volume 2, page 4-40).

A station blackout situation would require the loss of both MCCs, with failure probabilities of 1.79E-2 and

8.95E-3 upon t he starting of the corresponding charging pumps on the diesel generators, which would in turn be lost within hours from the loss of ventilation.

Multiplying these together, the frequency of a station blackout caused specifically by the performance deficiency from a seismic event is 7.8E-9/yr.

Based on this risk insight, the analyst determined that seismic events are not a significant contributor to the risk significance of this performance deficiency.

High Winds

The risk associated with tornadoes and other storms that can remove offsite power would be analogous to seismic events.

In both cases, the ability to restore offsite power would be limited and the diesel generators would presumably fail from a loss of ventilation.

However, unlike seismic, weather events are included in the database that determine the SPAR model loss of offsite power frequency; therefore, a separate consideration for external events is not required in this case.

2Internal Fires

Two fire scenario types were identified that could have more than a negligible impact on risk associated with the performance deficiency.

One is any fire that can cause a loss of offsite power.

The other is a fire in the switchgear of either MCC 2B-52 or 2B-62.

Each is addressed below:

1. Fires Causing a Loss of Offsite Power As discussed above, a loss of offsite power event does not significantly affect the risk significance of the finding unless it has duration of at least eight hours, the battery lifetime. This is because the diesel generators are expected to be functional for several hours following the loss of MCCs B-52 and B-62 and resultant loss of room ventilation.

Fires that remove offsite power would rarely be unrecoverable within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> because power would presumably be available in the switchyard throughout the event, and the fire would at most disable only one train of the ac power distribution system.

Therefore, the risk significance attributable to fire-induced loss of offsite power is not expected to be noteworthy.

2. Fires in MCC 2B-52 or 2B-62

A fire in MCC 2B-52 could result in operators starting the alternate charging pump, which could then remove MCC 2B-62 from service, or vice versa.

However, this event would presumably not result in a loss of coolant and the two remaining available injection paths would be sufficient to remove decay heat.

As revealed in the internal events review, events that do not cause the need for sump recirculation are not significant to the risk difference caused by the loss of the subject MCCs.

Therefore, this fire scenario is not important to this finding.

Internal/External Flooding

Flooding is not likely to cause a loss of coolant accident, or to require operators to change the charging pump configuration. Therefore, no significant risk impact on risk is expected.

Large Early Release Frequency (LERF)

In accordance with

IMC 0609, Appendix H, for a large, dry containment, LERF is important only for sequences involving a steam generator tube rupture or an inter-system

LOCA.

The results of this evaluation included a risk impact from SGTR events with a frequency of 4.842E-8/yr.

A first-assumption LERF factor of 1.0 is used for SGTR

events. Therefore, the LERF estimate for this finding is also 4.842E-8/yr.

Licensee Sensitivity Analysis Using an assumption equiva lent to the one made in this analysis for the reliability of MCCs 2B-52 and 2B-62, a preliminary licensee PRA result for this finding was 4.661E-7,

13accounting for both the one-year exposure and the repair time.

The difference between this result and the NRC result was almost entirely due to a difference in the assumed event frequency for the SRV LOCA.

Peer Review Jeff Circle, NRR

George McDonald, RII