IR 05000382/2013008

IR 05000382-13-008; on 05/20/13 - 12/19/13; Waterford Steam Electric Station, Unit 3; Surveillance Testing

ML14030A616
Person / Time
Site:	Waterford
Issue date:	01/30/2014
From:	Kennedy K NRC/RGN-IV/DRP
To:	Chisum M Entergy Operations
References
EA-13-233 IR-13-008
Download: ML14030A616 (20)

Text

UNITE D S TATE S NUC LEAR RE GULATOR Y C OMMI S SI ON ary 30, 2014

SUBJECT:

WATERFORD STEAM ELECTRIC STATION, UNIT 3 - NRC INSPECTION REPORT 05000382/2013008; PRELIMINARY WHITE FINDING

Dear Mr. Chisum:

On December 19, 2013, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Waterford Steam Electric Station, Unit 3 facility. The enclosed inspection report documents the inspection results, which were discussed on December 19, 2013, with Mr. Carl Rich, Jr., Director, Regulatory and Performance Improvement, and other members of your staff.

The enclosed inspection report discusses a self-revealing finding that has preliminarily been determined to be a White finding with low to moderate safety significance that may require additional NRC inspections. This finding was assessed based on the best available information, using the applicable Significance Determination Process. The final resolution of this finding will be conveyed in separate correspondence.

The basis for the staffs significance determination is described in the enclosed report. As described in Section 1R22 of the enclosed report, the train B emergency diesel generator exhaust fan failed to function as designed because the fan separated from the fan motor. The self-revealing finding involved an inadequate test program that failed to demonstrate that the exhaust fan would perform satisfactorily in service. The corrective actions taken were to replace the exhaust fan hub assembly and evaluate the test program of the fan.

The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy, which appears on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The NRCs significance determination process is designed to encourage an open dialogue between your staff and the NRC; however, the dialogue should not impact the timeliness of our final determination. Before the NRC makes a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference, where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter. We encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a Regulatory Conference is held, it will be open for public observation. The NRC will issue a public meeting notice and press release to announce the conference. If you decide to submit only a written response, it should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final significance determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitations sections of Attachment 2 of NRC Inspection Manual Chapter 0609.

Please contact Greg Werner by phone at (817) 200-1156, and in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.

Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review.

Additionally, if you disagree with the cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Waterford Steam Electric Station, Unit 3 facility.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice and Procedure, a copy of this letter, its enclosure, and your response (if any) will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Kriss M. Kennedy, Director Division of Reactor Projects Docket: 50-382 License: NPF-38 Enclosures: NRC Inspection Report 05000382/2013008 w/Attachment: Supplemental Information

ML14030A616 SUNSI Rev Compl. Yes No ADAMS Yes No Reviewer Initials GW/dl Publicly Avail. Yes No Sensitive Yes No Sens. Type Initials GW/dl SRI:DRP/E RI:DRP/E SPE:DRP/C SPE:DRP/E SRA:DRS/ RSLO MDavis CSpeer RAzua MBloodgood GReplogle BMaier

/RA/E /RA/E /RA/E /RA/E /RA/E /RA/E 1/23/14 1/24/14 1/23/14 1/23/14 1/22/14 1/22/14 ACES C:ORA/ACES BC:DRP/E D:DRP RBrowder VCampbell GWerner KKennedy

/RA/ /RA/ /RA/ /RA/

1/27/14 1/27/14 1/28/14 1/29/14

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-382 License: NPF-38 Report: 05000382/2013008 Licensee: Entergy Operations, Inc.

Facility: Waterford Steam Electric Station, Unit 3 Location: 17265 River Road Killona, LA 70057 Dates: May 20 through December 19, 2013 Inspectors: M. Davis, Senior Resident Inspector R. Azua, Senior Project Engineer C. Speer, Resident Inspector Reactor Analyst: G. Replogle, Senior Reactor Analyst Branch Chief: G. Werner, Acting Chief, Project Branch E Division of Reactor Projects Approved By: K. Kennedy, Director Division of Rector Projects-1- Enclosure

SUMMARY

IR 05000382/2013008; 05/20/13 - 12/19/13; Waterford Steam Electric Station, Unit 3;

Surveillance Testing.

The inspection activities described in this report were performed between May 20, 2013, and December 19, 2013, by the resident inspectors at Waterford Steam Electric Station, Unit 3, a senior project engineer and a senior risk analyst from the NRCs Region IV office. One preliminary White apparent violation was identified. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance Determination Process. Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, Components Within the Cross-Cutting Areas. Violations of NRC requirements are disposition in accordance with the NRC s Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

• Apparent Violation. A self-revealing apparent violation of 10 CFR Part 50, Appendix B,

Criteria XI, Test Control, occurred because the licensee failed to establish an adequate test program to demonstrate that a safety-related component associated with the train B emergency diesel generator would perform satisfactorily in service. Specifically, the licensee failed to identify and perform adequate testing on the train B emergency diesel generator exhaust fan to demonstrate that the exhaust fan would perform satisfactorily in service. The test did not incorporate requirements and acceptance limits contained in applicable design documents such as the Final Safety Analysis Report, as updated. As a result, the licensee failed to ensure that for all operational tests that the safety-related exhaust fan would perform satisfactorily such that it would provide sufficient flow and remove heat during accident conditions. The licensee entered this condition into its corrective action program as Condition Report CR-WF3-2013-02530. The immediate corrective actions taken to restore compliance included the replacement of the train B emergency diesel generator exhaust fan assembly. The planned corrective actions included the review of the emergency diesel generator ventilation system monitoring plan.

The failure to identify and perform testing to demonstrate that a safety-related component would perform satisfactorily in service in accordance with requirements contained in applicable design documents was a performance deficiency. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The inspectors performed the initial significance determination for the diesel generator room ventilation fan failure. The inspectors used the NRC Inspection Manual 0609, Attachment 4,

Initial Characterization of Findings. The finding required a detailed risk evaluation because it involved a potential loss of one train of safety-related equipment for longer than the technical specification allowed outage time. The emergency diesel generator needed the ventilation exhaust fan to remain operable. The unit was not recoverable. The total exposure period was 25 days. The allowed outage time was 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The analyst determined the best estimated change to the core damage frequency was 4.4E-6/year. This finding was preliminarily characterized as low to moderate safety significance (White). The dominant core damage sequences included loss of offsite power events, leading to station blackout, coincident with the failure of the turbine driven auxiliary feedwater pump.

Equipment that helped to mitigate the risk included recovery of an emergency diesel generator or manually starting a temporary emergency diesel generator set.

The inspectors concluded that the finding reflected current licensee performance and involved a cross-cutting aspect in the resource component of the human performance area in that the licensee did not have complete, accurate and up-to-date operational surveillance test procedure H.2(c) (Section 1R22).

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R22 Surveillance Testing

a. Inspection Scope

The inspectors reviewed several surveillance tests for the safety-related emergency diesel generator. The inspectors observed and reviewed test results to verify that these tests adequately demonstrated that the structures, systems, and components were capable of performing its safety functions. The inspectors verified that these tests met technical specification requirements, that the licensee performed the tests in accordance with its procedures, and that the results of the test satisfied appropriate acceptance criteria. The inspectors verified that the licensee restored the operability of the affected structures, systems, and components following testing.

This activity constitutes completion of one surveillance test inspection sample as defined in Inspection Procedure 71111.22-05.

b. Findings

Introduction:

A self-revealing apparent violation of 10 CFR Part 50, Appendix B, Criteria XI, Test Control, occurred because the licensee failed to establish an adequate test program to demonstrate that a safety-related component associated with the train B emergency diesel generator would perform satisfactorily in service. Specifically, the licensee failed to identify and perform adequate testing on the train B emergency diesel generator exhaust fan to demonstrate that the exhaust fan would perform satisfactorily in service, which incorporated the requirements and acceptance limits contained in applicable design documents such as the Final Safety Analysis Report.

Description:

On May 20, 2013, the licensee performed a periodic surveillance test on the train B emergency diesel generator using operating procedure OP-903-068, EDG and Subgroup Relay Operability Verification, Revision 307. During the operational surveillance run, the licensee noticed that the train B emergency diesel generator room temperatures increased from 94°F to over 115°F. According to the plant monitoring computer point, the train B emergency diesel generator room temperature reached as high as 118°F. The licensee initiated a condition report and performed an immediate operability evaluation. The licensees operability evaluation determined that the most likely cause for the elevated room temperature was due to a change in the minimum setting of the variable pitch blade controller that may have occurred during previous maintenance activities. The variable pitch blade controller is actually a Hydramotor.

The Hydramotor uses an internal positive displacement pump to provide hydraulic pressure that operates a piston that in turn changes the pitch of the fan blade. The Hydramotor controller adjusts the blade pitch to a minimum position when the emergency diesel generator starts to allow air flow through the room. The licensee indicated that the controller probably did not move to its minimum position. The licensee generated a work request to perform more troubleshooting on the variable pitch settings for the fan.

On May 22, 2013, while troubleshooting, the licensee identified that the train B emergency diesel generator exhaust fan blades were not rotating while the fan motor was operating. At this time, the licensee noticed that the malfunction of the exhaust fan was due to a separation of the fan hub assembly from the hub sleeve, which effectively separated the fan from the fan motor. As a result, the licensee generated another Condition Report CR-WF3-2013-2530 to document this condition. On May 26, 2013, the licensee completed the replacement of the fan hub assembly, made final adjustments to the exhaust fan controller, performed an operational surveillance test, and declared the emergency diesel generator operable.

The licensee conducted an apparent cause evaluation and determined that the most likely cause of the failure was due to a failure mode that was inadvertently introduced when maintenance personnel reworked the fan hub to sleeve connection in 1999.

Specifically, on March 17, 1999, during a train B emergency diesel generator fan operational surveillance run, the fan motor tripped on overcurrent. The licensee investigated the condition and determined that the motor windings failed to operate. The licensee removed the fan hub assembly and installed a new motor to the fan. During the subsequent electrical bump test for the new motor, the technicians noted that the fan operated in the reverse direction because the licensee wired the leads for the motor in the opposite direction. The licensee determined that the reverse torque on the fan hub was sufficient to cause the fan hub spanner nut to back off its threads and allow the hub to drop down off the hub sleeve. This damaged the hub sleeve threads and spanner nuts. At that time, the licensee reworked the hub sleeve threads and developed Engineering Evaluation, ER-W3-1999-0301-00, Revision 0, to add four more set screws to reduce the likelihood of future events with the spanner nut backing off the sleeve.

These design field changes reduced the allowable stress of the fan hub to sleeve connection and increased the loading on the hub sleeve threads, respectively.

The inspectors reviewed this apparent cause evaluation and other condition reports, associated work orders, operational surveillance tests, and design documents related to this issue. The inspectors noted that on April 25, 2013, the licensee performed an operational surveillance test on the train B emergency diesel generator. Procedure OP-903-068, Section 7.4.7.11.1, provided instructions to verify that the EDG Exh Fan, HVR-0025B, has started. However, the inspectors noted that there was no guidance on how to perform this step. In discussions with the licensee, the licensee stated that operators used indicating lights from a control switch to show the exhaust fan status (RED, meaning run and GREEN, meaning stopped). However, the inspectors noticed that this indication only shows that the motor is running and does not provide indication that the fan is rotating or operating properly. Based on the review of this issue, the inspectors determined that this was an inadequate indication to determine the operability of the emergency diesel generator ventilation system exhaust fan. The inspectors concluded that the licensee did not have complete, accurate and up-to-date operational surveillance test procedures.

Additionally, the inspectors noted that the Final Safety Analysis Report stated, in part, that the control room operator was provided with safety-related indication on the operation of each exhaust fan. The inspectors concluded that the licensee did not provide this safety-related indication for the operation of the exhaust fan. Specifically, the inspectors noticed that the computer records on April 25 and May 20, 2013, showed that the train B emergency diesel generator exhaust fan LO FLOW computer point indicated abnormal flow for the duration of both operational runs. This low flow indicator is available for the exhaust fans on the plant monitoring computer in the control room.

However, this indication is not routinely monitored during emergency diesel operational tests. The low flow indicator is a non-safety-related pressure switch that measures a differential pressure across the exhaust fan. The set point for the switch is 1 inch water gage (inwg) that reads LO in response to the fan blade not rotating at the same speed as the fan motor and reads NT LO when operating properly. Local indication for this pressure switch is available near the exhaust fan actuator outside the train B emergency diesel generator room on a different elevation. A review of the surveillance procedures identified that each contained acceptance criteria that must be satisfied to constitute satisfactory performance of the surveillance. However, the procedures did not include the exhaust fan differential pressure local indication nor refer to the plant monitoring computer point as an acceptance criterion to demonstrate the operability of the emergency diesel generator ventilation exhaust fan assembly. The inspectors determined that the licensee performed the same operational surveillance on the train B emergency diesel generator using Procedure OP-903-068 on May 20, 2103. The train B emergency diesel generator surveillance results were found to be acceptable and the exhaust fan was considered to be operable. However, a review of the low flow indicator computer point showed the same LO FLOW condition as indicated during the operational surveillance run on April 25, 2103. As a result, the inspectors concluded that the train B emergency diesel generator exhaust fan failed sometime after the start of train B emergency diesel generator operational run on April 25, 2013.

Analysis:

The licensee failed to establish an adequate test program to demonstrate that the train B emergency diesel generator exhaust fan would perform satisfactorily in service. Specifically, the licensee failed to identify and perform adequate testing on the safety-related train B emergency diesel generator ventilation system exhaust fan to assure that during all operational tests required to demonstrate that the exhaust fan would perform satisfactorily in service incorporated the requirements and acceptance limits contained in applicable design documents such as the Final Safety Analysis Report. The inspectors determined that it was reasonable for the licensee to be able to foresee and prevent the performance deficiency since the licensee conducted an emergency diesel generator surveillance operability test at least every 30 days. The performance deficiency was more than minor because it was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors performed the initial significance determination for the diesel generator room ventilation fan failure. The inspectors used the NRC Inspection Manual 0609, 4, Initial Characterization of Findings, which directed the inspectors to Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power. In accordance with Exhibit 2, Mitigating Systems Screening Questions, of Appendix A, the finding required a detailed risk evaluation because it involved a potential loss of one train of safety-related equipment for longer than the technical specification allowed outage time. The emergency diesel generator needed the ventilation exhaust fan to remain operable.

Additionally, the inspectors concluded that the finding reflected current licensee performance and involved a cross-cutting aspect in the resource component of the human performance area in that the licensee did not have complete, accurate and up-to-date operational surveillance test procedure H.2(c).

Detailed Risk Analysis The total exposure period was 32.5 days, but the risk analyst reduced the exposure period to 25 days for assumed quantification. The analyst determined the exposure period as follows:

• The safety-related emergency diesel generator room fan last successfully operated on April 22, 2013. On April 25, 2013, the fan was operated and a low flow ventilation computer point tripped (indicating low flow in the ventilation ducts). The licensee did not notice or address the low flow indication.

Note: A non-safety-related reactor auxiliary building ventilation system was also cooling the diesel room on April 25, 2013, and helped to mask the failed fan. The outside air temperature was 60ºF and the diesel room temperature did not exceed 120ºF during the surveillance. During a loss of offsite power, the non-safety ventilation system would not be available for diesel room cooling. Without at least one ventilation system available, the room would overheat and the diesel would fail. The room walls were primarily concrete and would not efficiently remove heat, regardless of the outside weather conditions. The t/2 exposure period between April 22 and April 25, 2013, was 1.5 days.

• On May 20, 2013, during emergency diesel generator surveillance testing, the room overheated during the surveillance. Room temperature reached 118ºF in less than an hour. The time between April 25 and May 22, 2013, was 27 days.

Since the fan was in a known failed condition on April 25, 2013, the full 27 days was utilized in the exposure period. The licensee did not initially identify the fan as inoperable, but thought that the fan pitch mechanism was malfunctioning.

• The analyst considered the time between May 22 and May 26, 2013, repair time.

The licensee found the fan motor spinning while the fan itself was not functioning on May 24, 2013. The licensee repaired the fan and returned it to service on May 26, 2013. The repair time included an additional 4 days.

The analyst modified the 32.5 day exposure period to account for the following events.

• The train B emergency diesel generator was inoperable and unavailable for planned maintenance for two days between April 23 and April 25, 2013. The maintenance was for reasons unrelated to this performance deficiency. The analyst reduced the exposure period by two days.

• The plant was shut down early on April 27 and restarted late on May 1, 2013.

The outage lasted for five days. The analyst reduced the overall exposure period by five days. The analyst did not perform a shutdown risk assessment for this period. A temporary diesel was installed to support the train B safety loads and the train A emergency diesel generator remained in service. The risk during this shutdown period would remain very low when compared to power operations.

• Temporary diesel generators were installed and were available to support train B safety loads from April 22 to early May 15, 2013. In addition, the temporary diesels were installed in the same location from late May 24 through May 26, 2013. The analyst segmented this detailed risk evaluation to account for the lower risk periods when the temporary diesels were installed.

Note: The analyst noted a short span of time where the temporary diesels were on site but were not installed. The analyst provided no mitigation credit for this period. The licensee had determined that maintenance personnel and operators could not install the temporary diesels to a functional status within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> probabilistic risk assessment mission time. Moving the diesels into place and installing the needed support equipment is not a trivial matter and requires numerous subtasks.

From the information above, the analyst identified two relevant exposure periods for this performance deficiency:

• 10 days where the emergency diesel generator was inoperable and the temporary diesels were not available.

• 15 days where the emergency diesel generator was inoperable and the temporary diesel generators were available to support safety-related loads.

The analyst noted that the licensee had temporary diesel generators installed and ready for operation in accordance with Technical Specifications 3.8.1, 3.8.2, and 3.8.3. Two 1500 kW emergency diesel generators were installed in parallel to support the train B emergency loads. Procedures limited the temporary diesel generator power load to 1750 kW (approximately 875 kW per emergency diesel generator). The safety-related emergency diesel generator provides over 4400 kW of power. While the temporary diesels provide less power, the loss of offsite power loads are less than for the loss of coolant accidents. In addition, the licensee only needs the temporary diesels to maintain hot standby conditions.

Internal Events

Analysis:

The analysts performed simplified calculations to determine the change to the core damage frequency (delta-CDF) for the fan failure. The analyst used the Waterford-3 Standardized Plant Analysis Risk (SPAR) model, Revision 8.16, with a truncation limit of 1E-11. The analyst solved only the loss of offsite power sequences.

The following definitions are important to this analysis.

Nominal case - this is the baseline risk for the developed sequences. This case does not include equipment failures associated with the performance deficiency.

Current case - this is the case that includes the equipment failures associated with the performance deficiency.

For the nominal and base cases, the analyst set basic event EHV-XHE-XM-ALTCL to 1.0. The NRC had a prior finding where inspectors determined that alternate room cooling would not work because the licensee did not have a safety-related power source for the fans, did not have procedures to direct the action, and did not train operators on the action (see NRC Inspection Report 05000382/2011007).

10 Days, Temporary Diesels Not Available:

Modeling Changes: For the nominal case, the conditional core damage probability was calculated as 6.1E-6.

For the current case, the analyst set the basic event for the train B emergency diesel generator room fan failure-to-run to a probability of 1.0 (EPS-FAN-FR-3BSB). This was consistent with a condition where potential common cause was ruled out. The train A fan was not affected by this performance deficiency. The analyst solved only the LOOP sequences. The conditional core damage probability for the current case (which included the performance deficiency) was 1.5E-4. This reflected the normal recovery values for the train A diesel generator and offsite power. The SPAR model does not permit recovery from the diesel generator train B fan failure.

The delta-CDF for the 10 day exposure period was:

Delta-CDF = 10/365 * (1.5E-4 - 6.1E-6) = 3.9E-6/year 15 Days, Temporary Diesels Available: During this period, the temporary diesels were available and in place to support train B loads. The temporary diesel setup included two diesels that would run in parallel. Train B failures included:

1. Failure of either of the two diesels or 2. Failure of operators to properly start and load the diesels.

Operator Failure Probability: The analyst calculated the operator human error probability (to start and load the temporary diesels) using NUREG/CR 6883, The SPAR-H Human Reliability Analysis Method," dated August, 2005. The resulting Performance Shaping Factors (PSFs) are provided in the table below.

Manually Start Temporary Diesel Generators Performance Shaping Diagnosis Action Factor PSF Level Multiplier PSF Level Multiplier Time Nominal 1.0 Nominal 1.0 Stress Nominal 1.0 Nominal 1.0 Complexity Nominal 1.0 Nominal 1.0 Experience Nominal 1.0 Nominal 1.0 Procedures Nominal 1.0 Nominal 1.0 Ergonomics Nominal 1.0 Nominal 1.0 Fitness for Duty Nominal 1.0 Nominal 1.0 Work Processes Nominal 1.0 Nominal 1.0 Nominal Base 1E-2 1E-3 PSFs 1.0 1.0 Total 1E-2 1E-3 Failure Probability 1.1E-2 Justifications for Performance Shaping Factors: The analyst assumed nominal values for all performance shaping factors.

There was substantial uncertainty with the time needed to accomplish the action.

Operators would be directed to take the action through the Severe Accident Guidelines, versus the Emergency Operating Procedures. Implementation of the severe accident guidelines is normally controlled by personnel in the technical support center, versus control room operators. The licensee is required to staff the technical support center within an hour after event initiation. This could result in a delay in implementing the temporary diesel strategy. Personnel in the technical support center may not be readily familiar with the status of the temporary diesels, especially during the times when they were installed but were not being credited to support an extended allowed outage time. For the case of a loss of offsite power, leading to a station blackout, timely operator action towards starting and loading the temporary diesels could be important to avoid core damage.

The analyst noted that, if the temporary diesels are not started prior to drying out both steam generators, the event could become much more difficult to control. While the temporary diesels could power an essential feedwater pump, if natural circulation through the reactor coolant system is lost, the steam generators may not be effective decay heat removal devices. Charging pump injection may be needed (which can also be powered by the temporary diesels).

The analyst assumed that, even if the severe accident guidelines were not yet entered, operators would take the action to promptly start and load the temporary diesels if needed. The emergency diesel generators would auto-start and load. Conversely, operators would need to manually start and load the temporary diesel generators.

Operators believed that they could successfully start, parallel and load the temporary diesels in 30 minutes. The licensee determined that core damage would take at least 60 minutes assuming a station blackout with the concurrent failure of the turbine driven auxiliary feedwater pump. Operators therefore would have sufficient time, but not extra time. The task did not appear overly complex and operators had adequate procedures to guide their actions. Operators receive just-in-time training prior to staging the temporary diesels, but not all operators receive hands-on training with the units.

The analyst completed a sensitivity analysis making different assumptions for the performance shaping factors. The sensitivity analysis is included later in this detailed risk evaluation.

Modeling Changes: The analyst utilized the train B emergency diesel generator basic events as surrogates for the temporary diesel generators. For the failure to start basic events, the nominal emergency diesel failure-to-start probability was 2.9E-3. For the temporary diesels, the analyst doubled this failure rate (because there are two diesels)and applied the SPAR-H human error rate. The combined failure to start probability was 1.7E-2. The analyst used a change set and changed the basic event for failure to start (EPS-DGN-FS-DG3B) to 1.7E-2.

The nominal SPAR model emergency diesel generator failure to run probability was 3.0E-2. The analyst doubled this value (6.0E-2) and substituted it into it into basic event EPS-DGN-FR-DG3B.

The analyst changed basic event EPS-DGN-TM-DG3B to 0.0. While the temporary diesels are in service, the licensee would not take them out for maintenance.

The analyst used a change set to defeat the train B residual heat removal system heat exchanger by failing the low pressure injection pump (LPI-MDP-FS-B = 1.0). The resultant cutsets were below the truncation limit of E-11. Therefore, this change had no impact on the results.

The list of equipment that the licensee is expected to power was included in Procedure OP-TEM-008, Emergency Diesel Generator A(B) Backup Temporary Diesel Generator(s), Revision 5. The analyst reviewed the equipment and noted that all of the risk important equipment was included in the list. The analyst made no further adjustments to the SPAR model basic events.

The analyst solved only the LOOP sequences. The nominal case core damage probability was 6.1E-6. The current case conditional core damage probability was 8.0E-5. This reflected nominal recovery values for the diesel generators and offsite power. The delta-CDF for the 15 day exposure period was:

Delta-CDF = 15/365 * (1.0E-5 - 6.1E-6) = 1.5E-7/year Total Internal Events Delta-CDF:

Delta-CDF = 3.9E-6/year + 1.5E-7/year =4.0E-6/year External Events: To identify the external event loss of offsite power initiators, the analyst reviewed the Waterford 3 Individual Plant Examination of External Events (IPEEE),dated July 28, 1995. The IPEEE specified that the 1975 standard review plan criteria were met for high winds, floods, transportation accidents and nearby facility accidents, so those events were not considered further. The weather-related loss of offsite power initiator was already included in the SPAR model. The remaining accident initiators included seismic and fire.

Fires: The fire events of interest included those that could initiate a loss of offsite power. The licensee had completed substantial work towards a Waterford Unit 3 fire probabilistic risk assessment. The licensee provided a listing of fire scenarios that could result in a loss of offsite power. The vast majority of scenarios involved fires in the turbine building. The analyst multiplied each fire frequency by the licensees non-suppression probability. The sum of these products was the fire induced loss of offsite power initiation frequency = 3.3E-3/year.

The fire induced delta-CDF was the internal events delta-CDF multiplied by the ratio of the fire induced loss of offsite power initiating event frequency divided by initiating events loss of offsite power frequency.

Delta-CDF = 4.0E-6/year

• 3.3E-3/3.59E-2 = 3.7E-7/year Seismic: The analyst performed a simplified bounding analysis to address seismic contributors. The analyst referenced the NRCs Risk Assessment of Operational Events Handbook, Revision 1.03, to determine the seismic loss of offsite power initiating event frequency, which was 2.45E-5/year. Seismic initiated loss of offsite power events are not considered recoverable.

The analyst determined the conditional core damage probability for a seismically initiated non-recoverable loss of offsite power coincident with the failure of the train B emergency diesel generator room fan. The CCDP was 7.2E-4. The bounding delta-CDF for a maximum 34 day exposure period was:

Delta-CDF = 2.5E-5*7.2E-4*34/365 = 1.7E-9/year This seismic evaluation provides no credit for the temporary diesel generators. The temporary diesel generators are not seismically qualified and are assumed damaged by a seismic event.

Total Delta-CDF = 4.4E-6/year The dominant core damage sequences included loss of offsite power events, leading to station blackout, coincident with the failure of the turbine driven auxiliary feedwater pump. Equipment that helped mitigated the risk included recovery of an emergency diesel generator or manually starting a temporary diesel generator set.

Large Early Release Frequency: To address the contribution to conditional large early release frequency, the analyst used NRC Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004. Since the fan failure did not contribute directly to a steam generator tube rupture or an intersystem loss of coolant accident, the condition was not risk significant to the large early release frequency.

Sensitivity Studies: The analyst completed sensitivity studies to provide perspective on the variation of certain parameters where the analyst noted there was high uncertainty. The sensitivity studies included:

• Temporary diesel generators overall credit. The temporary diesel generators were a compensatory mitigating system, intended to reduce the plant risk exposure when a safety-related diesel generator was out-of-service for planned maintenance. An alternative method to use could be the average availability (over a year period) when crediting this type of plant equipment. In this case, however, the analyst had directly credited the temporary diesel generators when they were fully installed and available. Using the alternate method (averaging)the availability of the diesels may have been much less.

To evaluate this potential inconsistency, the analyst performed a bounding sensitivity study, assuming that the diesels were not credited whatsoever. If the diesels were totally ignored, the delta-CDF would increase to 1E-5 (White/Yellow threshold). Since the temporary diesels would provide some mitigating credit, regardless of the method used to evaluate the credit, the analyst qualitatively determined that the finding would remain White.

• Temporary diesel generators, change the time based performance shaping factor from nominal to barely adequate time:

Credit, but barely adequate time: delta-CDF = 4.8E-6 (White)

• Manual operation of the turbine driven auxiliary feedwater pump without DC control power. The licensee credited this action, but the NRC did not.

For this sensitivity case, the analyst assumed that the manual action would remain functional for the full 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time. The delta-CDF was still approximately 2E-6 (White).

Licensee Risk Assessment: The licensee provided a risk assessment and calculated a delta-CDF of 2.2E-6/year. The major assumptions involving equipment availability were very similar to the NRC detailed risk evaluation (4.4E-6/year). The analyst noted the following differences.

1. The licensee used an E-9 truncation limit with their model. This would tend to

truncate out more cutsets and decrease the risk, when compared to the E-11 truncation limit that was used in the NRC evaluation.

2. The licensee assumed a total exposure period of 33 days, with an exposure

period of 9.35 days for the period when the temporary diesel generators were not available. The NRC quantified 25 days of exposure. For 10 of these days the temporary diesels were not available.

3. The NRC used generic values for most basic events. This was for consistency

when implementing the significance determination process. For example, the overall SPAR model internal events loss of offsite power frequency was 3.59E-2.

The licensee used 2.58E-2.

4. The NRC used the SPAR-H method for determining the failure probability for the

manual actions associated with manually operating the temporary diesels. The licensee used a different method. The NRC also doubled the nominal diesel generator failure-to-run and failure-to-start probabilities for the temporary diesels (two diesels must operate to power one bus). The licensee used a different method. A summary of the quantitative differences is provided below:

Basic event Licensee Value NRC Value Failure to run 4.8E-2 6E-2 Failure to start 3E-2 5.8E-3 Fail of Manual acts.

3.3E-3 1.1E-2 Note: The doubling of the normal safety-related failure rates may still be non-conservative. The temporary diesels are rental units and are not of the same pedigree as the safety-related diesel generators. Further, the emergency diesel units are rated at 4400 kW, whereas the two temporary diesels are rated at 1500 kW each.

5. The licensee credited manual operation of the turbine driven auxiliary feedwater

pump when the DC control system fails (on loss of battery power). The licensee credited manual operations for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The NRC did not credit this action; however, as part of the sensitivity studies, the NRC did determine that the risk would remain essentially the same.

6. When evaluating the contribution of external events, the licensee used a

simplified approach and simply doubled the internal events results. This was because the external events contribution to core damage was about the same as for internal events. The NRC quantified separate external event results directly.

Enforcement:

Title 10 of the Code of Federal Regulations Part 50, Appendix B, Criterion XI, Test Control, requires, in part, that a test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents.

Procedure OP-903-068, Emergency Diesel Generator (EDG) and Subgroup Relay Operability Verification, is the surveillance test used to verify emergency diesel generator and support equipment operability, including the exhaust fan.

Section 7.4.7.11.1 has a step to verify that the exhaust fan is operating.

Contrary to the above, prior to May 26, 2013, the licensee did not establish test program requirements within procedures to assure that testing demonstrated that a safety-related component (emergency diesel generator exhaust fan) would perform satisfactorily in service. Specifically, Procedure OP-903-068, Section 7.4.7.11.1 did not contain requirements or acceptable limits to assure that the emergency diesel generator exhaust fan was operational and provided adequate ventilation flow to maintain room cooling necessary for the diesel generator to remain operable.

As a result, the licensee failed to identify that the train B emergency diesel generator exhaust fan could not perform its function because it disengaged from the fan motor.

Consequently, the train B emergency diesel generator was determined to be inoperable for a period of 25 days, exceeding the Technical Specification 3.8.1 allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The licensee entered this condition report into their corrective action program for resolution as Condition Report CR-WF3-2013-2530. The immediate corrective actions taken to restore compliance included the replacement of the train B emergency diesel generator exhaust fan assembly. The planned corrective actions included the review of the ventilation system monitoring plan. Because this finding has been preliminarily determined to be of low to moderate safety significance (White), it will be treated as an apparent violation and tracked as AV 05000382/2013008-01, Failure to Establish an Adequate Test Program to Demonstrate that the Train B Emergency Diesel Generator Exhaust Fan Would Perform Satisfactorily In Service.

4OA6 Meetings

Exit Meeting Summary

On December 19, 2013, the inspectors presented the preliminary results of the inspection to Mr. Carl Rich, Jr., Director, Regulatory and Performance Improvement, and other members of the licensees staff who acknowledged the findings. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Chisum, Site Vice President, Operations

K. Cook, General Manager, Plant Operations

B. Pellegrin, Manager, Production

K. Crissman, Manager, Maintenance

R. Gilmore, Manager, Systems and Components

W. Hardin, Senior Licensing Specialist, Licensing

B. Lanka, Director, Engineering

B. Lindsey, Senior Manager, Operations

W. McKinney, Manager, Performance Improvement

J. Jarrell, Manager, Regulatory Assurance

G. Pierce, Manager, Training

R. Porter, Manager, Design & Program Engineering

M. Groome, Senior Lead Engineer, System Engineering

C. Rich, Jr., Director, Regulatory and Performance Improvement

P. Stanton, Supervisor, Design Engineering

J. Williams, Senior Licensing Specialist

J. Wilbur, Senior Lead Engineer, System Engineering

LIST OF ITEMS

Opened

05000382/2013008-01 AV Failure to Establish an Adequate Test Program to Demonstrate that the Train B Emergency Diesel Generator Exhaust Fan Would Perform Satisfactorily In Service