IR 05000482/2012009

IR 05000482-12-009; 05/21/2012 - 08/06/2012; Wolf Creek Generating Station; Augmented Inspection Team Follow-up Inspection; Maintenance Effectiveness; Plant Modifications

ML12227A919
Person / Time
Site:	Wolf Creek
Issue date:	08/06/2012
From:	Kennedy K NRC/RGN-IV/DRP
To:	Matthew Sunseri Wolf Creek
References
EA-12-152 IR-12-009
Download: ML12227A919 (45)

Text

UNITE D S TATE S NUC LEAR REGULATOR Y C OMMI S SI ON ust 6, 2012

SUBJECT:

WOLF CREEK NUCLEAR OPERATING CORPORATION - NRC AUGMENTED INSPECTION TEAM FOLLOW-UP REPORT 05000482/2012009; PRELIMINARY YELLOW FINDING

Dear Mr. Sunseri:

On August 6, 2012, the U. S. Nuclear Regulatory Commission (NRC) completed a follow-up inspection of the unresolved items identified by the Augmented Inspection Team in Inspection Report 05000482/2012008. The Augmented Inspection Team reviewed the circumstances surrounding the loss of offsite power event and Notification of Unusual Event declaration on January 13, 2012. The enclosed report documents the inspection results, which were discussed with Rich Clemens, Vice President of Strategic Projects and other members of your staff on August 6, 2012.

The inspections examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The enclosed inspection report discusses a finding that has preliminarily been determined to be a Yellow finding with substantial safety significance that could result in additional NRC inspections and potentially other NRC action. As discussed in Section 4OA5.2 of the enclosed report, your root cause analysis concluded that the Startup Transformer failure on January 13, 2012, was caused by your staffs failure to provide adequate oversight of contractors while they performed work that could affect safety-related equipment in April 2011. As a result, your staff failed to identify that electrical maintenance contractors had not installed insulating sleeves on wires that affected the differential current protection circuit, contrary to work order instructions.

This allowed an electrical short that prevented transferring power to the Startup Transformer in the event of a plant trip. This is not a current safety concern because you conducted extensive troubleshooting and inspection activities, and completed repairs prior to restarting the plant on March 20, 2012, and updated station procedures to require oversight of contractors performing work on risk significant components. This finding was assessed based on the best available information, using the applicable Significance Determination Process (SDP). The basis for the NRCs preliminary significance determination is described in the enclosed report. The final resolution of this finding will be conveyed in separate correspondence. This finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

In accordance with NRC Inspection Manual Chapter (IMC) 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staffs final determination. Before we make a final decision on this matter, we are providing you with an opportunity to: (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit, in writing, either your acceptance of this preliminary significance determination or your position on the significance of this finding to the NRC. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation, and, to announce the conference, a public meeting notice and a press release will be issued. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either you fail to meet the appeal requirements stated in the Prerequisite and Limitation Sections of Attachment 2 of IMC 0609.

Please contact Neil OKeefe at 817-200-1141, and respond in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.

The final resolution of this matter will be conveyed in separate correspondence.

Since the NRC has not made a final determination in this matter, a Notice of Violation is not being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violations may change as a result of further NRC review.

Additionally, two self-revealing findings and one NRC- identified finding of very low safety significance (Green) were identified during this inspection. All of these findings were determined to involve violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCV) consistent with Section 2.3.2 of the Enforcement Policy. If you contest these non-cited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV, the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Wolf Creek Generating Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC Resident Inspector at the Wolf Creek Generating Station.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Kriss M. Kennedy Director Division of Reactor Projects Docket No.: 05000482 License No.: NPF-42 Enclosure: Inspection Report 05000482/2012-009 Attachment 1: Supplemental Information cc w/ encl: Electronic Distribution

SUMMARY OF FINDINGS

IR 05000482/2012009; 05/21/2012 - 08/06/2012; Wolf Creek Generating Station; Augmented

Inspection Team Follow-up Inspection; Maintenance Effectiveness; Plant Modifications.

An Augmented Inspection Team was dispatched to the site on January 30, 2012, to assess the facts and circumstances surrounding a loss of offsite power that occurred on January 13, 2012.

The Augmented Inspection Team was established in accordance with NRC Management Directive 8.3, NRC Incident Investigation Program, and implemented using Inspection Procedure 93800, Augmented Inspection Team. This report documents the follow-up inspection to close the unresolved items that were opened during the Augmented Inspection Team inspection documented in NRC Inspection Report 05000482/2012008. The follow-up team was comprised of resident and region-based inspectors. One preliminary Yellow finding of substantial significance and three Green non-cited violations of very low safety significance were identified. The significance of most findings is indicated by their color (Green, White,

Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process.

The cross-cutting aspect is determined using Inspection Manual Chapter 0310, Components Within the Cross-Cutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review.

The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Initiating Events

• AV. The team reviewed a self-revealing apparent violation of Technical Specification 5.4.1.a and Regulatory Guide 1.33 for the failure to follow procedures. Specifically, the electrical penetration seal and wiring assembly associated with the H1/CT4 and H2/CT5 current transformers installed in the startup transformer (XMR01) were replaced without insulating two of the splices, as required by Work Order 11-240360-006, Revision 3.

This affected safety-related equipment on January 13, 2012, when the startup transformer experienced a spurious trip and lockout during a plant trip because the two uninsulated wires touched and provided a false high phase differential signal to the protective relaying circuit. The protective lockout caused a prolonged loss of offsite power to Train B equipment. The licensees root cause analysis concluded that the Startup Transformer failure on January 13, 2012, was caused by the failure to provide adequate oversight of contractors. As a result, the licensee failed to identify that electrical maintenance contractors had failed to install insulating sleeves on two wires that affected the differential current protection circuit. This issue was entered into the corrective action program as Condition Report 47653. The licensees corrective actions included reworking the current transformer junction block to correct the missing insulation sleeves and updating station procedures to require oversight of contractors performing work on risk significant components.

This finding was more than minor because it affected the human performance attribute of the Initiating Events Cornerstone and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions.

This deficiency resulted in the failure of the fast bus transfer and the failure to maintain offsite power to safety-related loads during a reactor/turbine trip. The team performed the significance determination using NRC Inspection Manual Chapter 0609, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, dated January 10, 2008, because it affected the Initiating Events Cornerstone while the plant was at power. The Phase 1 screened to a Phase 3 because the finding contributed to both the likelihood of a reactor trip and the likelihood that mitigation equipment would not be available. A Senior Reactor Analyst performed a Phase 3 analysis using the Wolf Creek SPAR model, Revision 8.20. The performance deficiency was determined to impact all transient sequences, particularly those involving losses of essential service water and/or component cooling water that led to a reactor coolant pump seal loss of coolant accident. The loss of cooling water prevented successful room cooling for mitigation equipment as well as loss of containment recirculation phase cooling. The analyst used half (98.5 days) of the period since the last successful load transfer, since the actual time of failure could not be determined from the available information. Credit for recovery of limited non-vital loads on the startup transformer was given based on licensee troubleshooting results; however no recovery credit was available for room cooling, since the licensee had no preplanned alternate room cooling measures. The evaluation of external events showed a small contribution due to fires. The change in the core damage frequency (delta-CDF) was determined to be 2.59E-5. Therefore, this finding was preliminarily determined to have substantial safety significance (Yellow).

The change in large early release frequency (delta-LERF) was 1.62E-7. This value for delta-LERF would result in a finding of low to moderate safety significance (White).

However, this is a bounded by the preliminary yellow safety significance resulting from the delta - CDF calculation.

This finding had a human performance cross-cutting aspect associated with the work control component in that licensee personnel associated with the oversight of the work did not appropriately coordinate work activities, and address the impact of changes to the work scope consistent with nuclear safety H.3(b) (Section 4OA5.2).

Cornerstone: Mitigating Systems

Green.

The team reviewed a self-revealing non-cited violation of 10 CFR Part 50,

Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the failure to have an adequate preventative maintenance procedure, PM 28129, Refueling Inspection of the Trip Tappet. Specifically, the dimensional criterion for the turbine driven auxiliary feedwater pump head lever to tappet nut engagement was not verified to be in accordance with vendor recommended criteria. This resulted in an inadequate engagement that contributed to a false overspeed trip. The licensees corrective actions included replacement of the trip tappet nut, trip lever, and trip linkage spring, as well as, inspecting all contact points on the trip linkage for damage or wear and specifying a more precise method of measuring the head lever to tappet nut engagement. This issue was documented in the licensees corrective action program as Condition Report 47658.

This finding was more than minor because it affected the Mitigating Systems Cornerstone attributes of Human Performance and Procedure Quality and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. This deficiency resulted in the potential of the turbine driven auxiliary feedwater pump to trip during a seismic, or other jarring events. A Senior Reactor Analyst performed a Phase 3 analysis. The performance deficiency was determined to impact seismic events, since a seismic event could jar the mechanism enough to trip the turbine. Assuming all seismic events would trip the turbine, the analyst used SPAR-H to evaluate operator action to reset the trip mechanism. Considering the recovery, and conservatively assuming a zero baseline, the Delta-CDF of the finding was 7.9E-9/yr, or very low safety significance (Green). This finding did not have any cross-cutting aspects because the preventative maintenance procedure was changed in 1999 and no other procedure changes since then would have caused the licensee to review this change, therefore, it is not representative of current licensee performance (Section 4OA5.3).

Green.

The team reviewed a self-revealing non-cited violation of Technical Specification 5.4.1.d for the failure to have procedures appropriate for the implementation of fire protection compensatory measures. Specifically,

Procedure SYS FP-290, Temporary Fire Pump Operations, Revision 10, did not have appropriate guidance for the installation and operation of a temporary diesel driven fire water pump. This pump was a compensatory action for the nonfunctional normally installed diesel driven fire water pump. The licensees corrective actions included revising Procedure SYS FP-290 to provide adequate instructions to operate the temporary diesel driven fire water pump continuously to preclude another loss of fire water suppression capability; completing a temporary modification for the installation of the temporary diesel driven fire water pump; and replacing the permanently installed diesel driven fire water pump. This issue was entered into the licensees corrective action program as Condition Reports 43710 and 51821.

This performance deficiency was more than minor because it affected the Mitigating Systems Cornerstone attribute of protection against external factors and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inadequate procedure contributed to the delayed recovery of the fire water system for approximately hours. A Region IV Senior Reactor Analyst determined that NRC Inspection Manual 0609, Appendix F, Fire Protection Significance Determination Process, could not be used to evaluate this issue because the firewater system was credited in both the fire suppression and the internal events probabilistic risk assessment models. Therefore the analyst performed a bounding detailed risk evaluation for this performance deficiency.

The exposure period of 68 days was used for the time when the pump was placed in a cold-weather alignment. The senior reactor analyst determined that bounding change to the core damage frequency was 5.9E-7 per year. The dominant core damage sequences included loss of offsite power initiating events (including fire induced loss of offsite power events), the failure of component cooling water, and the failure to establish alternate lube oil cooling to the charging and high pressure safety injection pumps. This finding had a human performance cross-cutting aspect associated with the decision making component in that the licensee failed to make safety-significant decisions using a systematic process to ensure safety was maintained while reviewing changes to the plant and procedures necessary to implement required compensatory measures H.1(a)

(Section 4OA5.8).

Green.

The team identified a non-cited violation of License Condition 2.C.5.a for the failure of the licensee to identify and correct a condition adverse to fire protection.

Specifically, the licensee failed to identify an adverse trend in the diesel driven fire water pump oil samples and take appropriate corrective actions. The licensees corrective actions included installing a new diesel driven fire water pump, revising the oil sample procedure and evaluating further corrective actions. This issue was entered into the licensees corrective action program as Condition Report 43710.

This performance deficiency was more than minor because it affected the Mitigating Systems Cornerstone attribute of protection against external factors (fire) and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Corrective actions to address the adverse condition were not taken, which led to the catastrophic failure of the right-angle drive for the diesel driven fire water pump. The team performed the significance determination using NRC Inspection Manual Chapter 0609,

Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, dated January 10, 2008, because it affected the Mitigating Systems Cornerstone while the plant was at power, and concluded the finding needed additional screening under Appendix F, Fire Protection Significance Determination Process, dated February 28, 2005. The team determined that the condition represented a low degradation of the fire protection program element of fixed fire protection systems due to a loss of the diesel driven fire water pump, and using Figure F.1 the finding was determined to be of very low safety significance based on Task 1.3.1. In addition, this finding had a problem identification and resolution cross-cutting aspect associated with the corrective action program component in that the licensee failed to thoroughly evaluate problems such that resolutions address causes and extent of condition P.1(c)

(Section 4OA5.10).

Licensee-Identified Violations

None.

REPORT DETAILS

Summary of Plant Status

Prior to the event, Wolf Creek was operating at 100 percent rated thermal power with no plant evolutions in progress, no transmission switching events occurring, and no severe weather conditions. On January 13, 2012, at 2:02 p.m. CST, the site experienced a loss of offsite power.

The event resulted from two distinct faults. The first fault was on the C phase of the main generator output breaker. The second fault occurred on the B phase of the startup transformer.

Approximately 8 seconds after the event, the A and B emergency diesel generators automatically started and sequenced on the safety-related loads. At 2:15 p.m., the shift manager declared a Notification Of Unusual Event (NOUE) based on the loss of offsite power expected to last longer than 15 minutes. At 4:45 p.m., the 345 kVac east bus was reenergized, restoring offsite power to train A safety- related components. At 5:09 p.m., the NOUE was terminated. All safety systems functioned properly and the plant successfully completed a natural circulation cooldown to cold shutdown conditions on January 14, 2012. The licensee restored power to most of the plant systems on January 17, 2012, after verifying that the non-vital switchboards were safe to energize. There were no radiological releases due to this event.

Wolf Creek remained in a forced outage until March 20, 2012, when the reactor was restarted.

The plant returned to 100 percent power on March 30, 2012.

For a detailed description of the event, refer to NRC Inspection Report 05000482/2012008.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R12 Maintenance Effectiveness

a. Inspection Scope

The team evaluated degraded performance issues involving the following risk-significant systems:

• June 1, 2012, turbine driven auxiliary feedwater pump

• June 1, 2012, diesel driven fire water pump The team reviewed events where ineffective equipment maintenance has resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensees actions to address system performance or condition problems in terms of the following:

• Implementing appropriate work practices

• Identifying and addressing common cause failures

• Scoping of systems in accordance with 10 CFR 50.65(b)

• Characterizing system reliability issues for performance monitoring

• Trending key parameters for condition monitoring

• Ensuring proper classification in accordance with 10 CFR 50.65(a)(1) or -(a)(2)

• Verifying appropriate performance criteria for structures, systems, and components classified as having an adequate demonstration of performance through preventive maintenance, as described in 10 CFR 50.65(a)(2), or as requiring the establishment of appropriate and adequate goals and corrective actions for systems classified as not having adequate performance, as described in 10 CFR 50.65(a)(1)

The team assessed performance issues with respect to the reliability, availability, and condition monitoring of the system. In addition, the team verified that maintenance effectiveness issues were entered into the corrective action program with the appropriate significance characterization. Specific documents reviewed during this inspection are listed in the attachment.

These activities constitute completion of two quarterly maintenance effectiveness samples as defined in Inspection Procedure 71111.12-05.

b. Findings

See Section 4OA5.3 for a non-cited violation associated with the turbine driven auxiliary feedwater pump and Section 4OA5.10 for a non-cited violation associated with the diesel driven fire water pump.

1R15 Operability Evaluations and Functionality Assessments

a. Inspection Scope

The team reviewed the following issue:

• June 1, 2012, emergency diesel generator B field ground The team evaluated the technical adequacy of this evaluation to ensure that technical specification operability was properly justified and the subject system remained available such that no unrecognized increase in risk occurred. The team compared the operability and design criteria in the appropriate sections of the technical specifications and Updated Final Safety Analysis Report (UFSAR) to the licensee personnels evaluations to determine whether the components or systems were operable. Additionally, the team also reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations.

Specific documents reviewed during this inspection are listed in the attachment.

These activities constitute completion of one operability evaluation inspection sample as defined in Inspection Procedure 71111.15-04.

b. Findings

No findings were identified.

1R18 Plant Modifications

Temporary Modifications

a. Inspection Scope

The team reviewed key affected parameters associated with energy needs, materials, replacement components, timing, heat removal, control signals, equipment protection from hazards, operations, flow paths, pressure boundary, ventilation boundary, structural, process medium properties, licensing basis, and failure modes for the temporary modification listed below.

• June 1, 2012, temporary diesel driven fire water pump The team assessed whether: modification preparation, staging, and implementation impaired emergency/abnormal operating procedure actions, key safety functions, or operator response to loss of key safety functions; post-modification testing maintained the plant in a safe configuration during testing by verifying that unintended system interactions did not occur; systems, structures and components performance characteristics still met the design basis; the modification design assumptions were appropriate; the modification test acceptance criteria were met; and licensee personnel identified and implemented appropriate corrective actions associated with temporary plant modification. Specific documents reviewed during this inspection are listed in the attachment.

These activities constitute completion of one sample for a temporary plant modification as defined in Inspection Procedure 71111.18-05.

b. Findings

See Section 4OA5.8 for a non-cited violation associated with the temporary diesel driven fire water pump.

4OA3 Event Followup

(Closed) Licensee Event Report 05000482/2012001-00, -01, Failure of 345 kV Switchyard Breaker Due to Internal Fault Resulting in Reactor Trip and Coincident Loss of Offsite Power The details of this event are described in NRC Inspection Report 05000482/2012008.

The team reviewed the root cause investigations, apparent cause investigations, the technical specifications, UFSAR, design basis documents, post trip report, corrective action program documents and actions, and interviewed personnel to ensure that the licensee correctly reported the event and implemented corrective actions commensurate with the safety significance of each investigation. The team also ensured that the

following commitments made by the licensee had already been completed or have been scheduled to be completed in accordance with the submittal: Procedure AP 24B-001, Control of Site Contractor Services, was revised in concert with changes to the work controls process to ensure sufficient vendor performance oversight (completed May 17, 2012); work control process procedures were revised to ensure adequate controls are applied to critical and non-critical assets, regardless of their safety classification (completed May 17, 2012); the 345-50 and 345-60 generator output breakers will have internal boroscope inspections conducted following Hi-Pot testing (scheduled for Refueling Outage 19, fall 2012). These items were documented in Condition Report 47653. The enforcement aspects of this licensee event report are documented in Section 4OA5 of this report. This licensee event report is closed.

4OA5 Other Activities

Inspection Procedure 93800, Augmented Inspection Team Unresolved Items For detailed information on the background of each unresolved item, refer to NRC Inspection Report 05000482/2012008.

.1 (Closed) Unresolved Item 05000482/2012008-01, Review Main Generator Output

Breaker Fault Cause Based on the damage that was identified internal to the breaker where the fault occurred, it was unlikely that a root cause could be determined. Therefore, the follow-up team focused on the licensees determination of the most probable cause and the method that the licensee used to reach that conclusion. The licensee and Westar (the company that operates the switchyard) representatives worked with the breaker manufacturer, HVB AE Power Systems, to conduct a failure analysis at the HVB plant.

In addition, Westar contracted National Electric Energy Testing Research and Applications Center (NEETRAC) to provide an independent failure analysis. The failed breaker, 345-60, was a Type HHI 362, sulfur hexafluoride (SF6) pure puffer power circuit breaker. The breaker consisted of three poles, one pole per phase, each with an independent operating mechanism. The breaker was manufactured in June 2009 and was installed in October 2009, with the most recent testing performed in March 2011 with satisfactory results.

The C phase of breaker 345-60 experienced a catastrophic internal failure within the SF6 tank. The root cause evaluation concluded that, subsequent to the fault, the breaker opened as designed, but with the internal fault on the generator side of the breaker and upstream of the moving contact, the breaker opening did not disconnect the fault from the generator. Therefore, the generator continued to feed the fault until generator excitation was removed. The root cause evaluation also concluded that the protective relaying for breaker 345-60 and the other switchyard breakers performed as designed in order to disconnect the generator and switchyard from the fault. The root cause evaluation determined that the failure on C phase of breaker 345-60 started the sequence of events which ultimately led to the loss of offsite power. Breaker 345-60 was replaced on January 16, 2012, with an equivalent breaker.

HVB used a fault tree analysis comprised of sequential disassembly, visual examination, and electrical testing. During disassembly, the A and B poles showed no signs of damage or contamination, and appeared new. The electrical testing of the undamaged poles produced results very similar to those recorded in the factory prior to being shipped to Westar in 2009. In addition, the B pole was subjected to a reduced SF6 pressure at 550 kV to determine where the pole would fail during reduced pressure conditions. This test resulted in a flashover of the B pole in a completely different location than exhibited in the failed C pole. This indicated that the C pole failure was not related to SF6 quality or pressure. There were no electrical tests performed on the C pole as the damage was too extensive. Material samples were collected and analyzed showing components of epoxy resin, decomposed material from SF6, melted aluminum, and melted steel. All of the identified materials were to be expected, and there was no evidence of any foreign materials and was, therefore, inconclusive.

Westar and Wolf Creek employees, along with HVB and an independent investigator from NEETRAC, witnessed the disassembly of the C pole. The stationary contact assembly of C pole exhibited little or no damage, except for some surface discoloration.

Prior to disassembly of the moveable contact assembly, it was observed that the pressure relief valve for the tank had vented carbon residue, metallic fluorides, and SF6 gas from inside the breaker tank into the control cabinet. Evidence of corrosion of exposed metal components within the control cabinet, and etching of the glass cover on the pressure gauge for the SF6 tank inside the control cabinet confirmed that corrosive products produced within the SF6 environment were vented into the control cabinet. The moveable contact assembly of C pole was disassembled and showed extensive charring and significant reduction in the material cross-section of the insulator along the charred path which resulted in a deep channel in the insulator. This component showed evidence of extensive exposure to high temperatures, a fracture line was evident and the insulator had broken into two pieces. There was also evidence of some vaporization of aluminum from the main conductor that had resolidified on and around the insulator support assembly. There were indications that fault current had travelled off both the top and bottom edges of the main conductor across the support insulator.

The followup team reviewed the actions taken by the licensee to:

(1) preserve the evidence of the failed breaker,

(2) witness the disassembly and testing of the breaker at the factory, and

(3) contract an independent agent (NEETRAC) to assist in the investigation, and found all these actions to be appropriate and focused. The followup team reviewed the failure analysis techniques, methods, and electrical testing performed by HVB and concluded the root cause evaluation and methods used to be thorough, in-depth, and self-critical. In addition, the followup team reviewed the failure analysis report performed by NEETRAC and found it to be scientifically sound in method, thorough, and in-depth. By method of exclusion of other causes, detailed examination of the damaged components, and documentation of the material evidence, the failure analysis performed by HVB and NEETRAC using different methods, both concluded that the most probable cause of the breaker failure was metallic particle contamination on or near the moveable contact assembly that resulted in a fault current path by surface tracking, which ultimately led to the catastrophic failure of the breaker. While the source of the metallic particle contamination may never be known, this contamination was not introduced by the licensee and likely was within the SF6 chamber when the breaker was

installed in October 2009. The followup team concluded that since the failure mechanism of the breaker was not within the ability of the licensee to prevent or mitigate, there was no performance deficiency. This unresolved item is closed.

.2 (Closed) Unresolved Item 05000482/2012008-02, Review Startup Transformer Fault

Cause During the loss of offsite power on January 13, 2012, all of the fast bus transfer breakers changed state as designed. However, when breaker PA0110 closed, the startup transformer experienced a differential relay actuation (487/T1) on the B phase, which disconnected the startup transformer from the switchyard and the non-vital buses. Once actuated, the protective relaying for the startup transformer performed as designed. The licensee tested current transformer (CT) ratios, polarity, and saturation. CT megger tests of the high voltage section were also performed. No anomalies were found, and troubleshooting and evaluation did not reveal any damage or cause for the fault. The licensee contracted TransGrid Solutions to develop a computer model to further analyze the fault and test failure mode theories related to inrush current and harmonics.

The licensee placed the startup transformer back into service on February 3, 2012, with monitoring equipment installed, after concluding that it was safe to restore in order to support further testing. On February 13, 2012, the licensee experienced another trip of the same B phase differential relay (487/T1) of the startup transformer while attempting to start the A reactor coolant pump.

The licensee reevaluated the previous troubleshooting plan to determine additional testing. Subsequent troubleshooting identified a short between two taps of the high side CTs caused by missing insulation sleeves on wires in the transformer that likely caused the false actuation of the transformers protective relay both times. These wires were associated with providing electrical current indication to the differential relay 487/T1.

The licensee corrected this condition by restoring the insulation and testing the restored connections by starting all reactor coolant pumps successfully. The enforcement aspects of this finding are discussed below. This unresolved item is closed.

Introduction.

The team reviewed a self-revealing apparent violation of Technical Specification 5.4.1.a and Regulatory Guide 1.33 for the failure to follow procedures.

Specifically, the electrical penetration seal and wiring assembly associated with the H1/CT4 and H2/CT5 current transformers installed in the startup transformer (XMR01)were replaced without insulating two of the splices, as required by Work Order 11-240360-006, Revision 3. This affected safety-related equipment on January 13, 2012, when the startup transformer experienced a trip and lockout during a plant trip because the two uninsulated wires touched and provided a false high phase differential signal to the protective relaying circuit. The protective lockout caused a prolonged loss of offsite power to Train B equipment. The licensees root cause analysis concluded that the startup transformer failure on January 13, 2012, was caused by the failure to provide adequate oversight of contractors. This finding was preliminarily determined to have substantial safety significance (Yellow).

Description.

In April 2011, inspection of the startup transformer junction boxes identified a green liquescent substance (plasticizer) coming from wires within the CT junction

wiring boxes. The licensee decided to perform unscheduled work to replace all four startup transformer CT junction blocks, and contracted with ASEA, Brown, Boveri (ABB)to perform the initial replacement. ABB procedures were used to perform the work. The work required the transformer oil to be drained down. The wiring assembly is comprised of a seal assembly with wiring on both sides and required the use of butt splices with a separate insulating sleeve installed over each splice. The seal assembly prevents leakage of the transformer oil after it is refilled and pressurized. Subsequent to the repairs, two of the replaced seal assemblies experienced oil leakage due to a material deficiency. The licensee again contracted with ABB to return to the site to replace the two leaking seal assemblies.

It was during this rework activity that two insulating sleeves, that are necessary to prevent terminal-to-terminal contact, were not installed on the CT wiring external connections. Each startup transformer CT junction block contained 37 individual wires with each one requiring an insulating sleeve. The licensees root cause concluded that Wolf Creek Nuclear Operating Corporation (WCNOC) had failed to ensure that adequate oversight of the contractor was being performed to ensure that this risk-significant activity was being performed in accordance with work order instructions and procedural guidance. Additionally, the root cause determined that this unscheduled work was not appropriately addressed per the outage planning procedures to address the impact of this change to the overall work scope. The licensees corrective actions included reworking the CT junction block to correct the missing insulation sleeves and updating station procedures to require oversight of contractors performing work on risk significant components.

The two wires that did not have an insulating sleeve installed were wire W2 associated with H1/CT4 (A phase CT) and wire W10 associated with H2/CT5 (B phase CT).

H1/CT4 and H2/CT5 are high voltage side bushing current transformers. The wiring for both the internal and external connections of these CTs was part of the wiring replaced by ABB in April 2011. The results of the missing insulating sleeves and subsequent shorting of CT-4 and CT-5 produced a short circuit between A phase and B phase CTs.

This wiring error reduced the primary current value and caused a phase shift in the signal going to the 487/T1 differential relay that caused a false actuation of the relay.

The wires became shorted sometime after the restart from the forced outage on June 26, 2011. This is evident because the reactor tripped and a fast bus transfer from the unit auxiliary transformer to the startup transformer was successful on this date.

Work order 11-340360-006, Revision 3, was used to replace two CT penetration blocks on the startup transformer XMRO1 in April 2011. This work involved the disconnecting and reconnecting of approximately 148 wires (both ends of each 37-lead CT junction block). The work was performed by ABB personnel with oversight by Wolf Creek personnel.

The work order contained Westinghouse Instruction Leaflet I.L. 47-069-9C, Instructions for Junction Block, Cast Resin Type for Oil Apparatus, which details the procedure for installation of the Westinghouse cast resin junction block. Attachment 2 (new junction block assembly) is ABB Inc. TS00332, Transformer 37 Lead Terminal Kit, and provides a drawing representation of the installation of the ABB replacement for the obsolete

Westinghouse part. Both attachments require the installation of insulating sleeves over the spliced wires. The work order did not contain or require the use of a wire removal/installation form.

Step 1.1 of work order 11-34060-006, Work Instructions S/U - CT penetration block replacement, stated, in part Provide oversight of the ABB, Inc. personnel activities, for the replacement of the Startup transformer CT penetrations. Work activities shall be performed in accordance with design documents approved by DRE 13690, purchase order 754566 and these instructions. Contrary to this, ABB did not follow the instructions detailed in Attachments 1 and 2 of DRE CP 13690, Revision 1, which required the installation of insulating sleeves over the spliced wires and Wolf Creek did not provide the oversight to verify that these instructions were followed.

Analysis.

Failure to provide adequate supervision/oversight of electrical contractors during maintenance on the startup transformer, which resulted in the failure to install insulating sleeves in wires in the startup transformer, was a performance deficiency.

Specifically, the licensee failed to satisfy the requirements of Procedure AP 24B-001 to ensure that field activities were monitored and that periodic verification of contractor personnel was occurring to ensure work in accordance with applicable work orders. This finding was more than minor because it affected the Initiating Events Cornerstone attribute of Human Performance and affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions.

This deficiency resulted in the failure of the fast bus transfer and the failure to maintain offsite power to safety-related loads following a reactor/turbine trip.

The team performed the significance determination using NRC Inspection Manual Chapter 0609, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, dated January 10, 2008, because it affected the Initiating Events Cornerstone while the plant was at power. The Phase 1 screened to a Phase 3 because the finding contributed to both the likelihood of a reactor trip and the likelihood that mitigation equipment would not be available; it was also potentially risk significant due to seismic external initiating event core damage sequences.

Phase 3 Analysis The Senior Reactor Analyst used the Wolf Creek SPAR model, Revision 8.20. The following assumptions were used in this evaluation:

1. The wires are assumed to have degraded linearly following a plant trip that occurred

on June 26, 2011, during which the startup transformer performed as designed. The transformer failed on January 13, 2012, during a loss of offsite power event. The T/2 exposure period since the subsequent startup is 98.5 days. During the exposure period, it is assumed that the startup transformer would have failed following any plant trip. This is because the current draw from the four running reactor coolant pumps at the moment of the fast transfer to the startup transformer would have been sufficient to cause a differential current lockout.

2. After the event, the startup transformer retained some residual capability to handle

loads. This was confirmed both by testing and by calculations. In review of the major core damage sequences, the most important loads to be recovered would be the normal charging pump and two normal service water pumps. The licensees analysis indicated that these loads could have been started on the startup transformer without causing a differential current trip.

However, the cause of the problem would not have been immediately known to the operators, nor would they have known the loading limit. It is possible that they would have continued to add loads until another trip occurred. It is also possible that most or all of the recovery effort would have been directed to restore essential service water or component cooling water (most of the core damage sequences include the failure of these systems) in lieu of trying to recover the startup transformer.

Given these facts and considerations, the analyst used the SPAR-H method to estimate the probability of failing to recover the startup transformer. Diagnosis is defined as making the decision to attempt to reload the transformer and to manage the loads under the load limit despite not knowing the nature of the problem or what the limit was. Action is defined as the actual physical actions needed to implement the decision path and to successfully energize the pumps selected for restart.

Diagnosis Action (0.01) (0.001)

Available Extra Time >5 times Time (0.1)

(0.1)

Complexity High

(5) Nominal (1.0)

Stress High (2.0) High (2.0)

Procedures Incomplete Nominal (20)

(1.0)0.17 2E-4 Total 0.17 The estimated probability that the startup transformer would not be recovered and supply the loads needed to avoid core damage is 0.17.

3. The licensee installed high temperature reactor coolant pump seals. This was not

properly reflected in the Wolf Creek SPAR model. Accordingly, a change set was implemented to eliminate O-ring extrusion failures.

4. The licensee has the ability to cross-tie power from the east switchyard bus to the

Class 1E bus NB002 (Train B vital power). This becomes important if the Train B EDG fails to function. A recovery to reflect this capability was added to the SPAR model. The probability of operators failing to perform this action was estimated using SPAR-H.

Diagnosis Action (0.01) (0.001)

Available Extra Time >5 times Time (0.1)

(0.1)

Complexity Obvious Moderately Diagnosis Complex (0. 1) (2.0)

Stress High (2.0) High (2.0)

Procedures Nominal Nominal (1.0)

(1.0)2.0E-4 4E-4 Total 6E-4

5. The licensees PRA does not credit alternate room cooling. The SPAR model credits

this recovery for the high pressure injection (HPI), residual heat removal (RHR), and normal charging pump rooms. After discussion with the licensee, it was determined that credit for this recovery is not merited and was therefore removed for this analysis.

6. The SPAR model provided a recovery of the component cooling water heat

exchangers in the case that essential service water was lost by providing fire water as an alternate cooling source. Discussions with the licensee confirmed that fire water cannot provide this capability. This recovery was removed from the SPAR model for this analysis.

Analysis:

The Wolf Creek SPAR model, Revision 8.20, modified as described above, was used at a truncation of 1.0E-11 and assuming average test and maintenance.

The analyst determined that this finding potentially affected sequences involving loss of essential service water with a reactor coolant pump seal loss of coolant accident and loss of component cooling water with a seal reactor coolant pump loss of coolant accident.

For both the base and condition cases, basic events RCS-MDP-LK-01 and RCS-MDP-LK-02 (RCP Seal Stage 1/2 Integrity (O-Ring Extrusion)) were set to a failure probability of 0.0, reflecting the installation of high temperature reactor coolant pump seals. Also, CVC-HXE-XM-ROOM, HPI-XHE-XM-RCOOL, and RHR-HXE-XM-ALTCOOL were all set to a failure probability of 1.0 to reflect the lack of alternate cooling for these rooms.

In the condition case, basic event ACP-TFM-FC-XMR01 (Failure of 345-13.8kV StartUp Transformer) was set to a failure probability of 0.17 reflecting the non-recovery probability. All of the initiating events were quantified. The results were as follows:

CDF 98.5-day exposure Nominal Case 7.92E-6/yr.

2.14E-6 Condition Case 1.01E-4/yr.

2.73E-5 Incremental Conditional Core 2.52E-5 Damage Probability (ICCDP)

The two major sequences are transients with a loss of essential service water and a reactor coolant pump seal loss of coolant accident, and a loss of component cooling water with a seal loss of coolant accident. Transients accounted for 72.5% of the change in risk and loss of component cooling water accounted for 4.5% of the change in risk. Reactor coolant pump seal loss of coolant accidents were involved in 76.1% of the core damage sequences.

The risk of the condition was aggravated by the loss of non-safety buses PA001 and PA002, which are fed only from the startup transformer. The risk-significant equipment powered by these buses include the normal charging pump and the normal service water system. The loss of essential service water or component cooling water combined with the loss of the normal charging pump and normal service water ultimately results in a loss of reactor coolant pump seal cooling and a potential seal loss of coolant accident External Events:

Seismic Seismic events that cause a plant shutdown will also most likely result in a loss of offsite power. It is generally assumed in this case that offsite power cannot be restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. For this situation, the startup transformer is not credited for mitigation.

Therefore the degraded condition of the startup transformer would not be significant to seismic events.

Fire The contribution of fires to the significance of the finding is principally from transients that they cause. Based on a review of the Wolf Creek Individual Plant Examination for External Events Report, the transient frequency caused by fires is 2.5E-2/yr. Because very little of the risk of this finding involves a loss of power to the vital buses, fires that specifically target one train of vital power would have a very small effect on the result.

Using the SPAR model and substituting 2.5E-2/yr for the transient frequency, while including the startup transformer failure, yields a delta-CDF of 2.65E-6/yr. For an exposure period of 98.5 days, the ICCDP is 7.15E-7.

Other The analyst determined that other external initiators would not have a significant effect on the result of this analysis. High winds are included in the weather-related loss of offsite power frequency. Flooding, both external and internal, has a low frequency and would be insignificant compared to the high frequency of transients.

Combined Risk:

Internal Risk 2.52E-5 External Risk 7.15E-7 Total Risk 2.59E-5 (delta-CDF)

The calculated combined total risk corresponds to a preliminary conclusion that the finding has substantial safety significance (Yellow).

Large Early Release:

According to IMC 0609, Appendix H, for a large, dry containment, only steam generator tube ruptures and inter-system loss of coolant accidents contribute more than negligibly to the potential for a large, early release of radiation.

This analysis resulted in no change above truncation for inter-system loss of coolant accidents. For steam generator tube ruptures, the delta-CDF was 6.01E-7/yr. For a 98.5 day exposure, the ICCDP for steam generator tube ruptures is 1.62E-7. The large early release frequency (LERF) factor for steam generator tube ruptures is 1.0; therefore, the delta-LERF is also 1.62E-7. This was a White significance, but this was less significant than the Yellow significance of the delta-CDF.

In addition, this finding had a human performance cross-cutting aspect associated with the work control component in that licensee personnel associated with the oversight of the work did not appropriately coordinate work activities and address the impact of changes to the work scope consistent with nuclear safety H.3(b).

Enforcement.

Technical Specification 5.4.1(a), Procedures, requires that written procedures be established, implemented, and maintained covering the applicable procedures in Regulatory Guide 1.33, Revision 2, Appendix A. Regulatory Guide 1.33, Quality Assurance Program, Appendix A, Section 9.a requires that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with written procedures, documented instructions, or drawings appropriate o the circumstances. Work Order 11-240360-006, Revision 3, required installation of insulation sleeves over each wire splice during the external wiring connection procedure.

Contrary to the above, between April 16 and 27, 2011, maintenance that affected safety-related equipment was not implemented in accordance with written procedures.

Specifically, the electrical penetration seal and wiring assembly associated with the H1/CT4 and H2/CT5 current transformers installed in the startup transformer (XMR01)were replaced without insulating two of the splices, as required by Work Order 11-240360-006, Revision 3. This affected safety-related equipment on January 13, 2012, when the startup transformer experienced a trip and lockout during a plant trip because the two uninsulated wires touched and provided a false high phase differential signal to the protective relaying circuit. The protective lockout caused a prolonged loss of offsite power to Train B equipment.

Licensee personnel entered this issue into their corrective action program as Condition Report 47653. This finding is being treated as an apparent violation pending a final determination of the significance: AV 05000482/2012009-01, Failure to follow procedures on contractor control during maintenance on the Startup Transformer.

.3 (Closed) Unresolved Item 05000482/2012008-03, Review Turbine Driven Auxiliary

Feedwater Pump Mechanical Overspeed Trip Device Out of Specification The team determined that the out of specification head lever to tappet nut engagement of the turbine driven auxiliary feedwater pump mechanical overspeed trip mechanism warranted additional NRC review and followup considering that this maintenance deficiency led directly to the spurious overspeed trip following the loss of offsite power event and additionally might have affected the seismic fragility of the turbine. The enforcement aspects of this event are discussed below. This unresolved item is closed.

Introduction.

The team reviewed a Green self-revealing non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for an inadequate preventative maintenance procedure, PM 28129, Refueling Inspection of the Trip Tappet. Specifically, the dimensional criterion for the head lever to tappet nut engagement was not verified to be in accordance with vendor recommended criteria.

Description.

During recovery from the January 13, 2012, loss of offsite power event, control room operators elected to feed the steam generators with the turbine driven

auxiliary feedwater pump. Approximately 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the onset of the event, the operator secured the turbine driven pump by closing the trip and throttle valve. At the instant the operator pushed the button on the control board to close the trip and throttle valve, operators received a mechanical overspeed trip alarm in the control room. This was an unexpected response. Using indications on the control board, the operator was able to verify that an actual overspeed event had not occurred. A plant operator responded to the turbine and verified that the mechanical overspeed linkage had tripped.

The plant operator was able to reset the turbine.

The licensee determined that the cause of the mechanical overspeed trip was inadequate engagement between the head lever and tappet nut on the turbine control mechanism. This overlap engagement length is checked by preventative maintenance Procedure PM 28129 every refueling outage, and was required to be set between 0.030 and 0.060 inch. During the most recent refueling outage, the measurement was documented as being 0.060 inch. Discussions with the maintenance personnel that performed the measurement determined that the 0.060 measurement was an indirect measurement and was done using essentially a visual check. The performer visually estimated the engagement by holding shims in his hand next to the head lever and tappet nut to get what appeared to be the same thickness as the engagement. He then measured the shims in his hand with a micrometer to determine the engagement. The verifier also performed the measurement in the same manner. After the loss of offsite power event, the engagement was precisely measured and determined to be only 0.018 inch. It is likely that the vibration induced by closing the trip and throttle valve caused the tappet nut to disengage with the head lever, thereby allowing the lever to pivot and trip the turbine.

A similar event occurred on November 17, 2009, when the mechanical overspeed trip actuated at the instant the trip and throttle valve was closed. The licensee only visually checked the engagement of the head lever to tappet nut, noting that it appeared to be within specification; but did not use shims held in hand to estimate. Visual checks of the engagement length are not precise for determining such small dimensions.

Consequently, it is likely that the head lever to tappet nut engagement dimension was below specification for an extended period of time. The licensee also speculated that the mating surfaces of the head lever and tappet nut wore over time causing the contact between them to be more tenuous. In response to this event, the licensees corrective actions included replacement of the trip tappet nut, trip lever, and trip linkage spring, as well as inspecting all contact points on the trip linkage for damage or wear. Additionally, the licensee developed a more precise method of measuring the head lever to tappet nut engagement.

In 1999, the preventative maintenance procedure step that directs the head lever to tappet nut engagement measurement had been changed. The change stated that the actual dimension could not be checked and that a visual inspection can be performed to verify that the engagement is between 0.030 and 0.060 inch. In addition, it added a statement that the dimensional check was not acceptance criteria. This change was not consistent with the vendor manual, which required the dimensional check. The November 2009 event provided the licensee with an opportunity to identify that there was not adequate engagement, and that the method for checking the engagement was

not sufficient. As a result of simply resetting the mechanical overspeed trip, the licensee failed to evaluate the cause of the trip and identify the deficiency completely, accurately, and commensurate with the safety significance of the turbine driven auxiliary feedwater pump. The team determined that overall, past maintenance-related activities did impact the response and recovery to the loss of offsite power. However, it did not prevent the operating crew from performing a safe and controlled shutdown and cooldown and placing the reactor coolant system into a stable cold shutdown condition, Mode 5, within the required technical specification allowed outage time.

Analysis.

The failure to maintain a preventative maintenance procedure that ensured proper engagement of the head lever and the tappet nut, such that the pump would not spuriously trip, was a performance deficiency. This finding was more than minor because it affected the Mitigating Systems Cornerstone attributes of Human Performance and Procedure Quality, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. This deficiency resulted in the potential of the turbine driven auxiliary feedwater pump to trip during a seismic, or other jarring events.

The team performed the significance determination using NRC Inspection Manual Chapter 0609, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, dated January 10, 2008, because it affected the Mitigating Systems Cornerstone while the plant was at power. The Phase 1 screened to a Phase 3 because the finding was potentially risk significant due to seismic external initiating event core damage sequences.

A Region IV Senior Reactor Analyst performed a Phase 3 analysis based on the following assumptions:

• All seismic events large enough to cause a loss of offsite power are assumed to cause a trip of the turbine driven auxiliary feedwater pump. Seismic events that do not remove offsite power could also cause a trip of the overspeed linkage, but this would be less likely and also less of a risk contribution because power to the motor driven pumps would be available from offsite power and would not depend on the emergency diesel generators.

• The exposure period of the finding was 1 year (condition existed for greater than 1 year).

• From the Risk Assessment Standardization Project Handbook, Volume 2, the frequency of a seismic event that causes a loss of offsite power at Wolf Creek is 1.87E-5/yr.

• From the Wolf Creek SPAR model, Revision 8.17, the overall failure probably of the emergency power system is 6.4E-3.

• From the Wolf Creek SPAR model, Revision 8.17, the failure probability of auxiliary feedwater is 1.3E-2 per train. Conservatively, this was assumed as the failure of both trains considering that much of the risk is from common cause events

• Seismic events large enough to affect the emergency diesel generators and motor driven auxiliary feedwater pumps are considered to be baseline because these events would also affect the turbine driven auxiliary feedwater pump, such that the performance deficiency would not have an effect.

• The ability to reset the turbine driven auxiliary feedwater pump following a seismic event within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was considered to be highly likely because it is a simple operation and access should be unimpeded. Using SPAR-H, and assuming an obvious diagnosis, high stress for both diagnosis and action, and all other PDFs nominal, the failure probability is 0.022.

• A loss of auxiliary feedwater for greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was conservatively considered to be a core damage event, even though feed and bleed would be available in the case of the success of emergency power system.

• Offsite power recovery was considered to fail following a seismic event.

Using these assumptions, the senior reactor analyst concluded: the overall failure rate of the motor driven auxiliary feedwater pumps following a seismic event could be approximated as the addition of the emergency power system failure and the auxiliary feedwater failure, or 6.4E-3 + 1.3E-2 = 1.94E-2; and the frequency of a seismic event that causes a loss of offsite power and also involves a non-seismic loss of both motor driven auxiliary feedwater pumps is 1.87E-5 (1.94E-2) = 3.6E-7/yr. Considering the recovery, and conservatively assuming a zero baseline, the Delta-CDF of the finding is 3.6E-7 (2.2E-2) = 7.9E-9/yr, or very low safety significance (Green).

This finding did not have any cross-cutting aspects because the preventative maintenance procedure was changed in 1999 and no other procedure changes since then would have caused the licensee to review this change, therefore, it is not representative of current licensee performance.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Preventative maintenance Procedure PM 28129, step 1, stated, in part, to document the amount of engagement between the head lever and the tappet nut between 0.030 and 0.060 inch. Contrary to the above, between November 2009 and January 2012, the verification of adequate engagement between the head lever and the tappet nut of the turbine driven auxiliary feedwater pump, an activity affecting quality, was not prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances. Specifically, the actual engagement had been visually estimated rather than being required to be directly measured. Since this violation was of very low safety significance and was documented in the licensees corrective action program as Condition Report 47658, it is being treated as a non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000482/2012009-02, Inadequate Preventative Maintenance Procedure on Turbine Driven Auxiliary Feedwater Pump.

.4 (Closed) Unresolved Item 05000482/201208-04, Review Operation of the Turbine

Driven Auxiliary Feedwater Pump at Low Flow, Steam Pressures, and Speed The team assessed whether the licensee operated the turbine driven auxiliary feedwater pump in accordance with system operating procedure and vendor recommendations, since it had been run at low steam supply pressure, low speed, and low flows. The licensee reviewed the vendor recommendations for turbine operation to determine if changes were needed to procedures or training; these actions were documented in Condition Report 48575.

The team reviewed the condition report, the vendor manual, station procedures, and relevant operating experience and determined that the licensee had not operated the turbine driven auxiliary feedwater pump contrary to the applicable station procedures or vendor manual recommendations. At the time, operators had entered emergency operating procedures for loss of offsite power and were conducting a natural circulation cooldown. Emergency operating procedures supersede the normal system operating procedures, including the associated notes and precautions, until directed to restore the system to normal alignment once the casualty has been stabilized. Also, the vendor technical manual listed the operating parameters to be monitored as the bearing oil pressures and temperatures. Wolf Creek had a control room annunciator that alarms on high bearing oil temperature and low bearing oil pressure. The annunciator response procedure for both of these alarms has shutdown criteria to prevent damage to the pump. Finally, the lower limit of 77 psig steam supply pressure in the vendor technical manual was a design specification rather than an operating limitation, since it is the lowest pressure at which the turbine is rated to achieve the minimum required pump output. The vendor manual did not require the turbine to be shut down below this value, but instructs the owner to perform more frequent checks of the bearing oil system and bearing oil temperatures.

After the event, the licensee removed and inspected the pump thrust bearing and found no signs of damage. The licensee, however, conservatively replaced the bearing. The team also examined the bearing and observed no signs of damage or wear.

Consequently, the team concluded that no performance deficiency existed as the licensee operated the pump in accordance with procedures and vendor recommendations. This unresolved item is closed.

.5 (Closed) Unresolved Item 05000482/2012008-05, Assess Impact of Emergency Diesel

Generator Ground on Mission Time Emergency diesel generator B started as required in response to the loss of offsite power event. The generator operated normally for 22-1/2 hours until the generator field ground 164 relay alarm was received on the negative field cable. No change in generator amps, voltage or frequency was observed after the alarm was received. The generator continued to operate for an additional 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> until it was secured. Prior to securing the generator, voltage measurements were taken on the relay input terminals which confirmed that a field ground existed. By process of elimination, the licensee isolated the ground to one of four cables between the collector rings on the rotor and the poles, and when the bad cable was cutout the ground cleared. These cables were

original cables installed with the generator. The licensee initiated Condition Report 47670 to document the ground, perform an apparent cause, and perform corrective actions, which included replacing all four cables on both emergency diesel generators A and B.

The team reviewed the licensees efforts to determine the cause of the field ground on emergency diesel generator B, and to determine whether the ground would have impacted the ability of the generator to perform reliably through its design mission time.

The emergency diesel generator required mission time was 7 days of continuous operation. The team reviewed the apparent cause evaluation, condition reports, work orders, equipment testing, calibration, and troubleshooting procedures used to locate and repair the ground. In addition, the team reviewed the licensees application of operating experience that was related to generator field grounds, including consultation with the vendor. The direct cause of the generator field ground was the loss of dielectric insulation on a single field cable (negative cable) from abrasions where the cable penetrated into the rotor. The abrasions were deep enough that they penetrated the insulation and exposed the conductor allowing the conductor to contact the rotor frame.

There were abrasions on the cable of opposite polarity, but they were not deep enough to penetrate the insulation. The emergency diesel generators operate on an ungrounded system. This means that the first ground causes ground alarms to be received, but does not result in an actual ground condition that draws large amounts of current until a protective device trips. A second ground would need to occur while the original ground was present to create the large current draw. It was, therefore, unlikely that a second ground would be experienced on the opposite polarity within the 7-day mission time of the emergency diesel generators.

The licensee reviewed previous operating experience reports associated with their generators and revised the preventive maintenance Procedure MPE-NE-004, Alternator Inspection, to include instructions to visually inspect the field lead cables and terminations, with supporting actions to revise associated training materials. The team concluded that the emergency diesel generator field ground fault would not have prevented it from meeting its mission time, and that there were no performance deficiencies. This unresolved item is closed.

.6 (Closed) Unresolved Item 05000482/2012008-08, Review Source Range Detector

Deviation The team reviewed three occasions when source range nuclear instrument NI-31 (SEN0031) showed diverging indication from NI-32 (SEN0032). In all three cases, the cavity cooling ventilation fan that cooled NI-31 was not available. The team questioned if the priority and the actions taken to investigate and address the problem during the time from the initial occurrence in 2009 until the current loss of offsite power event in January 2012 were commensurate with the safety significance. The team assessed the impact of the deviation between the two source range nuclear instrument channels on operator decision-making, and the ability to verify that adequate shutdown margin existed. The team also assessed the timeliness of the licensees actions.

The team concluded that the licensee had four instruments (NI-31, NI-32 and two Gamma Metrics detectors) to verify proper shutdown conditions. The team verified that the licensee performed a shutdown margin calculation supporting plant cooldown to 150°F prior to commencing the natural circulation cooldown on January 13, 2012. The shutdown margin calculation does not rely on the source range nuclear instruments.

Prior to plant startup following the loss of offsite power event, the licensee performed:

(1) cavity cooling ventilation flow and temperature measurements,

(2) detector well ventilation leak checks on both source range detectors,

(3) visual inspections of the detector well inlet scoops,

(4) heating of the detector junction box to assess whether cable heating was the cause, and

(5) installed temperature monitors in the detector well.

The licensee also revised procedures to monitor for loss of cavity cooling, sources of heating, and prompt identification of nuclear instrument abnormal indications.

The team determined that the licensee did not take effective actions in 2009 and 2011 to determine the cause of the temperature increase that affected NI-31 count rate during loss of cavity cooling. Following NRC questioning of the operability evaluation on NI-31 in 2009, the licensee initiated Condition Report 20208 and concluded that the most probable cause of the behavior was increased heating of the detector and associated cabling, resulting in increased count rate indication. However, the condition report was categorized as a basic low level and did not require any investigation into causes of increased heating.

Following the 2011 event, the licensee initiated Condition Report 35122 and performed an apparent cause evaluation. This evaluation determined that corrective actions taken following the 2009 event were not effective in reducing the potential for recurrence, in part, because the condition report was not appropriately categorized. Because the condition report specified the use of compensatory measures and operator aids, the licensee concluded that the condition report should have been categorized at a higher significance level The failure to properly categorize a condition report that will lead to appropriate corrective actions according to licensee Procedure AP 28A-100, Condition Reports, Revision 14, was a performance deficiency. However, because there was no safety consequence, and the corrective actions taken during the prolonged time from the initial occurrence in 2009 until the current loss of offsite power event in January 2012 were commensurate with the safety significance of NI-31, this issue was determined to be a minor violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings. This issue was entered into the corrective action program under Condition Reports 35122 and 47652. This unresolved item is closed.

.7 (Closed) Unresolved Item 05000482/2012008-09, Review Failure to Maintain Fire

Water Pressure As a result of a combination of events during the loss of offsite power, the temporary diesel driven fire water pump was not placed into service for approximately 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> after power was lost to the electric fire pump. While control room operators recognized the loss of fire header pressure immediately through control room alarms, it was not a high

priority for restoration. The control room priority was addressing the loss of offsite power and performing the plant cooldown.

The plant fire protection supervisor informed the control room that the station did not have fire suppression water at approximately 3:00 p.m. In accordance with the fire protection impairment program Procedure AP 10-103, Fire Impairment Control, Revision 23A, Attachment C, Section 1.3.1.E.1, with two fire pumps inoperable, a backup pump must be provided within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The team determined that the temporary diesel driven fire pump was restored within this time.

Procedure AP 10-103, Attachment D, Section 1.3.1.A.1, also required establishing continuous fire watches in affected areas with backup fire suppression capability in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> when one or more spray and/or sprinkler systems are inoperable. Initially, there were not sufficient fire watch personnel onsite. At 5:30 p.m., fire protection and engineering staff (who were not fire watch qualified) performed the fire watch duties and were relieved by 8:00 p.m. by qualified fire watch personnel.

The need for large numbers of fire watch personnel was created by the inability to start the temporary diesel driven fire pump. The enforcement aspects of this unresolved item are documented in Section 4OA5.8 of this report. This unresolved item is closed.

.8 (Closed) Unresolved Item 05000482/2012008-10, Review Inadequate Procedures and

Training for Operation of the Temporary Diesel Fire Pump This unresolved item documented that Procedure SYS FP-290, Temporary Fire Pump Operations, did not provide adequate instructions on how to prime and start the temporary diesel driven fire water pump. Valves that were required to be in a certain state were not detailed enough or labeled such that operators could place the equipment in the proper alignment to successfully prime and start the pump. In addition, the drawing that depicts the installation of the temporary pump, and that is supposed to show the installation and is used for the operation of the temporary diesel driven fire water pump was missing key components that were required to be manipulated in order to put the pump in service. Operators were provided limited on-the-job training with no lesson plan to follow and with minimal practice. The enforcement aspects of this unresolved item are discussed below. This unresolved item is closed.

Introduction.

The team reviewed a Green self-revealing non-cited violation of Technical Specification 5.4.1.d for the failure to provide an appropriate procedure for the implementation of fire protection compensatory measures. Specifically, Procedure SYS FP-290, Temporary Fire Pump Operations, Revision 10, did not have adequate guidance for the installation and operation of a temporary diesel driven fire water pump. This pump was a compensatory action for the nonfunctional normally installed diesel driven fire water pump.

Description.

The licensee modified a test fire water header in 2005 to allow for the installation of a temporary diesel driven fire water pump to the fire protection system.

The licensee changed Procedure SYS FP-290 to allow this modification to be used as a compensatory action for an inoperable fire water pump. As a result, Procedure SYS FP-290 could be used to install a temporary fire water pump, in lieu of

installation under a temporary modification. The team concluded that Procedure SYS FP-290 did not receive the same level of review that would be required for a temporary modification, and not all applicable design control measures were identified, verified, and correctly translated into the procedure, and drawings, to ensure that the pump was installed appropriately and would complete its intended function under all required conditions.

On September 13, 2011, the permanently installed diesel driven fire water pump failed catastrophically, and compensatory measures per Procedure AP 10-103, Fire Impairment Control, Revision 23A, required the installation of a backup fire water pump.

On September 21, 2011, the temporary diesel driven fire water pump was installed and verified it to be operable by postmaintenance testing. Operations personnel subsequently prepared the temporary fire water pump for winter alignment by opening several valves to keep water from freezing in the pumps suction path.

Procedure SYS FP-290 did not have sufficient guidance for placing, operating, or restoring the pump in this configuration, and it did not have all appropriate valves labeled and numbered for operations personnel to place them in the correct positions.

On January 13, 2012, the site suffered a loss of offsite power and lost the ability to maintain fire header pressure with the electric driven fire water pump. Two hours and 42 minutes after the loss of offsite power, operations personnel attempted to start the temporary fire water pump but were unsuccessful. When the temporary pump was drained for freeze protection, the system operating procedure was not changed to provide instructions for priming the pump with the suction line empty, nor was training provided to operators on how to start the pump in this condition. Operators did not initially close all the vent/drain valves because they were not numbered, labeled, or shown on the drawing, so the priming pump was unable to evacuate all the air; the priming pump motor eventually failed because it was run too long. Fire protection and operations personnel decided to use the fire truck pump to prime the temporary fire water pump through an eductor, but there was no procedural guidance for this action.

The licensee was eventually able to prime and start the pump by this method approximately 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> after the loss of offsite power event started.

The licensee revised Procedure SYS FP-290 to provide adequate instructions to operate the temporary diesel driven fire water pump; continuously operated the pump to preclude another loss of fire water suppression capability; completed a temporary modification for the temporary diesel driven fire water pump; and was in the process replacing the permanently installed diesel driven fire water pump.

Additionally, the licensee identified that they failed to follow Procedure AP10-103, Fire Impairment Control, Revision 23A, Attachment D, because with one or more sprinkler/spray systems inoperable in areas containing redundant systems or components, they failed to establish a continuous fire watch within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The fire protection supervisor informed the control room of the deficiency, but based on priorities for the loss of offsite power event the continuous fire watches were not established within the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> requirement. The licensee took immediate corrective actions to establish compensatory fire watches with nonqualified individuals until qualified individuals could be placed on watch. The licensee documented this issue in Condition

Report 47965 and was evaluating further corrective actions, including procedure revisions.

Analysis.

The failure to provide adequate procedures for the implementation of fire protection compensatory measures was a performance deficiency. This performance deficiency was more than minor because it affected the Mitigating Systems Cornerstone attribute of protection against external factors and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The inadequate procedure contributed to the loss of all fire water for approximately 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />. The team performed the significance determination using NRC Inspection Manual Chapter 0609, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, dated January 10, 2008, because it affected the Mitigating Systems Cornerstone while the plant was at power, and concluded the finding needed additional screening under Appendix F, Fire Protection Significance Determination Process, dated February 28, 2005. The team determined that the condition represented a high degradation of the fire protection program element of fixed fire protection systems due to a loss of all water-based suppression. Using Figure F.1, the finding was determined to require a Phase 2 analysis. The finding affected multiple fire areas and, as such, the Phase 2 analysis was not conducive for determining the significance of the finding.

A Region IV senior reactor analyst was determined that NRC Inspection Manual 0609, Appendix F, Fire Protection Significance Determination Process, was not appropriate to evaluate this issue because the firewater system was credited in both the fire suppression and the internal events probabilistic risk assessment models. Therefore the analyst performed a bounding detailed risk evaluation for this performance deficiency.

The analyst used the Wolf Creek Standardized Plant Analysis Risk (SPAR) model, Revision 8.20. The analyst assumed a truncation level of 1.0E-11:

Since operators took approximately 9.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> on January 13, 2012, to start the fire pump, the analyst assumed that the fire pump was not functional and was not recoverable. Fires lasting longer than 9.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> could progress to an unpredictable state. In addition, had the fire pump been required for high pressure injection pump or charging pump lubrication oil cooling, the analyst conservatively assumed that the safety-related pumps would have failed prior to placing the fire pump into service.

Internal Events: The fire protection system is credited for accident mitigation in the Wolf Creek SPAR model. This credit extended to backup lube oil cooling for charging and high pressure safety injection pumps. This backup feature is risk important when component cooling water fails.

The analyst corrected the following SPAR model errors:

• The firewater system backup to essential service water was removed. The licensee does not credit firewater for this function and the firewater system did not have sufficient capacity.

• The credit for alternate room cooling was removed. The licensee did not utilize the fire protection pumps for this purpose.

• The licensee had procedures in place to cross-tie safety related buses NB01 and NB02 if necessary. The analyst updated the model to reflect this capability.

To evaluate the internal events, the analyst adjusted the SPAR model basic event for the diesel driven firewater pump to a failure probability of 1.0. The exposure period spanned from November 7, 2011, (when the pump was winterized) up to and including January 13, 2012, - a total of 68 days. The change to the core damage frequency (Delta-CDF) associated with this exposure period was:

Delta-CDFinternal = 3.4E-7/year External Events:

Fires: For certain fires, fire-suppression equipment may not function. This included fires that could also induce a loss of offsite power. Since the motor-driven pump relied on offsite power, and the diesel driven pump was non-functional, fires that progressed to trip offsite power would also cause the firewater system (including the fire sprinklers) to fail.

The analyst utilized the Wolf Creek Individual Plant Examination of External Events, (IPEEE) dated June 27, 1995, to identify areas where firewater was credited for fire suppression. The licensee only credited firewater suppression in three fire areas, C-5 and C-6 (switchgear areas), and T-2A (portions of the turbine building). However, fires in areas C-5 and C-6 would not cause a concurrent loss offsite power. Therefore, they were much less significant because the electric driven fire pump would be available to respond to the vast majority of C-5 and C-6 fires. Conversely, a fire in the remaining fire area, T-2A, could cause a consequential loss of offsite power. If a T-2A fire induced a loss of offsite power, the entire firewater system would fail.

For fire area T-2A, the IPEEE specified a baseline fire related CDF of 3.0E-7/year.

Within this core damage frequency, the licensee credited a non-suppression probability of 0.02. This value corresponded to the failure and unavailability rate for wet pipe suppression systems. Removing the credit for the wet pipe suppression system resulted in a non-adjusted CDF of 1.5E-5/year.

The analyst noted that the turbine building had four levels (separated by concrete floors)and was a very large space. The fire ignition frequency for fire area T-2A was 4.75E-2/year. However, the IPEEE was overly conservative in that it assumed that a fire in one corner of the turbine building could spread to an opposite corner. In reality, most turbine building fires were not expected to cause a loss of offsite power and firewater suppression would function unencumbered for most fires.

The analyst reviewed turbine building floor plans and noted that the offsite power cables came into one corner of the building. Cables entered into the 2000 foot floor level and penetrated the ceiling/floor to the PA001 and PA002 buses on the floor above (2033 foot

elevation). The PA001 and PA001 buses were located near the same corner. The licensee specified that outgoing power cables to buses SL-31 and SL-41 (power to the motor-driven fire pump) were routed near the PA001 and PA002 incoming cables.

Based on the above, the analyst determined that only a relatively small portion of the turbine building was of concern for this significance determination. The area was bounded by approximately 1/8 of the floor space on two (of four) turbine building elevations. A precise determination of the affected space would yield a much smaller target area. Therefore, this assumption was conservative.

In the turbine building locations of concern, the analyst noted that the fire ignition sources included electrical cabinets. Less than 40 electrical cabinets were in the target area. Calculation AN-94-041, IPEEE Fire Ignition Frequencies Revision 0, dated March 1997, provided a detailed breakdown of fire ignition sources. The electrical cabinet fire ignition frequency was 1.2E-2/year for the entire turbine building. This included 112 electrical cabinets. The applicable ignition frequency for the target area was therefore:

Ignition Frequency = 40/112

• 1.2E-2/year = 4.3E-3/year Considering the exposure period, the original core damage frequency, and removing credit for suppression in the target area, the delta-CDF for fires was approximately:

Delta-CDF = [4.3E-3/year / 4.75E-2/year]

• 1.5E-5/year * [68 days/365 days] =

2.5E-7/year Seismic: The analyst qualitatively determined that the performance deficiency was not a significant contributor to seismic events. During a seismic event, the turbine building firewater piping may not survive. While a consequential fire is not assumed, firewater was credited as a backup cooling water source for safety-related pump lube oil coolers.

The seismic induced firewater piping failure may make this function unavailable, even if the performance deficiency did not exist. For seismic events, the analyst determined that sufficient data was not available to support a meaningful quantitative analysis. But, qualitatively, the analyst determined that the contribution was minimal. Since the seismic induced loss of offsite power frequency was only 1.8E-5/year (compared to 3.59E-2/year for other losses of offsite power), the change to the CDF for seismic initiators was very small.

Total Delta-CDF: Based on the prior sections, the total change to the CDF for this performance deficiency was:

Delta-CDFtotal = 3.4E-7/year + 2.5E-7/year = 5.9E-7/year The dominant core damage sequences included loss of offsite power initiating events (including fire induced loss of offsite power events), the failure of component cooling water, and the failure to establish alternate lube oil cooling to the charging and high

pressure safety injection pumps. The availability of the motor-driven pump, the limited frequency of risk significant fire induced loss of offsite power events, and the availability of front line lube oil cooling systems, such as component cooling water, helped to mitigate the findings significance.

Large Early Release Frequency: To evaluate the change to the large early release frequency (LERF), the analyst used Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process. Wolf Creek has a large dry containment. The finding screened as having very low safety significance for LERF because it did not affect the intersystem loss of coolant accident or steam generator tube rupture categories.

Because the delta-CDF was less than 1E-6 and the finding was not a significant contributor to the large early release frequency, the finding was of very low safety significance (Green). In addition, this finding had a human performance cross-cutting aspect associated with the decision making component in that the licensee failed to make safety-significant decisions using a systematic process to ensure that safety was maintained while reviewing changes to the plant and procedures necessary to implement required compensatory measures use a systematic process to review a design change to implement adequate compensatory actions H.1(a).

Enforcement.

Technical Specification 5.4.1.d requires that written procedures be established, implemented, and maintained for implementing the fire protection program.

Procedure AP 10-103, Fire Impairment Control, Revision 23A, requires, in part, that for one fire pump unavailable, the licensee shall provide a backup pump within 14 days.

Procedure SYS FP-290, Temporary Fire Pump Operations, Revision 10, provided guidance for the installation and operation of the backup pump. Contrary to the above, since September 21, 2011, a written procedure for implementing a fire protection program element was not established, implemented and maintained. Specifically, Procedure SYS FP-290 failed to provide adequate instructions for the installation and operation of the temporary diesel driven fire water pump. Since this violation was of very low safety significance and was documented in the licensees corrective action program as Condition Reports 43710 and 51821, it is being treated as a non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000482/2012009-03, Inadequate Procedure for Temporary Fire Pump.

.9 (Closed) Unresolved Item 05000482/2012008-11, Assess Impact of Failure of

Temporary Pump to Match the Functionality of Diesel Fire Pump The temporary diesel driven fire water pump was not a like-for-like functional replacement for the original diesel driven fire water pump. The temporary pump would not auto-start on a loss of offsite power, as the original diesel driven fire water pump was designed to do. The team determined that the licensees use of Procedure SYS FP-290, Temporary Fire Pump Operations, Revision 10, to install the temporary fire water pump did not review all applicable design control measures. Consequently, the licensee never considered if an automatic start capability was prudent or required. The team reviewed the approved fire protection plan as described in UFSAR, Section 9.5, and the compensatory measures required by Procedure AP 10-103, Fire Impairment Control,

Revision 23A, and determined no specific guidance required the temporary pump to maintain the same design capabilities, including the automatic start capability.

Therefore, the team did not identify any performance deficiency. This unresolved item is closed.

.10 (Closed) Unresolved Item 05000482/2012008-12, Assess Cause of Normal Diesel Fire

Pump Failure The diesel driven fire water pump is required to operate at a high level of reliability for fire protection. It is also used in some beyond design basis mitigation strategies. The licensee has speculated that the pump seized and caused excessive torque to be placed on the gearbox, which resulted in the gearbox catastrophically failing. The licensee was having the manufacturer of the pump, Fairbanks Morse, perform a failure analysis of the pump. Even though the failure occurred 8 months prior to this inspection, the failure analysis had still not been completed. The team reviewed the licensees action to restore the diesel driven fire pump to functional status, including reviewing the failure analysis report. The team determined that the licensee failed to follow station procedures that could have prevented the catastrophic failure of the pump. The enforcement aspects are discussed below. This unresolved item is closed.

Additionally, the team determined that the licensee also failed to properly trend a degraded condition on the diesel driven fire water pump as discussed below.

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.5.a for the failure of the licensee to identify and correct a condition adverse to fire protection. Specifically, the licensee failed to identify an adverse trend in the diesel driven fire water pump oil samples and take appropriate corrective actions.

Description.

On September 13, 2011, the diesel driven fire water pump (1FP001B) right angle drive experienced a catastrophic failure during the monthly functional test. The failed unit, installed in the plant for 27 years, had 1060 operating hours. Oil samples of the right-angle drive, and the fire pump, are taken every six months. In January 2011, the laboratory results indicated bearing/bushing and shaft/gear wear and a heavy concentration of water. The water content was measured in excess of 30 percent. The laboratory recommended an inspection for the source of wear and a check for the source of water.

The action level for water concentration in the oil, as defined in Procedure I-ENG-004, Lubrication Oil Analysis, Revision 3, was 0.2 percent. At the action limit, the licensee is required to take immediate corrective actions that include changing the oil, and increasing the sampling frequency. The licensee attributed the high water content to a leak in the oil cooler and requested that it be replaced; however, the licensee did not document corrective actions nor did they increase the frequency of oil samples or inspect the components. Subsequent oil samples taken at the normal 6 month periodicity, but after the oil cooler replacement and an oil change, still contained water concentrations in excess of action levels. Starting in July 2011, oil samples also began to indicate high levels of iron, which is indicative of degradation of the gear or bearings.

The team concluded that the licensee failed to identify, document, and evaluate an adverse trend in the diesel driven fire water pump oil samples, as required by Procedure AP 28A-100, Condition Reporting, Revision 14, which led to the catastrophic failure of the pump. Specifically, the licensee failed to properly evaluate and assess the adverse condition of high water and iron concentration in the lubricating oil, and take appropriate corrective actions. The licensee documented this issue in the corrective action program as Condition Report 43710. The licensees corrective actions included installing a new diesel driven fire water pump (in progress), revising the oil sample procedure to increase the sensitivity to the presence of water, and evaluating further corrective actions. At the time of this inspection, the licensee was using a temporary pump until the normal pump replacement could be completed.

Analysis.

The failure to identify and correct a condition adverse to fire protection was a performance deficiency. This performance deficiency was more than minor because it affected the Mitigating Systems Cornerstone attribute of protection against external factors (fire) and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Corrective actions to address the adverse condition were not taken, which led to the catastrophic failure of the right-angle drive for the diesel driven fire water pump. The team performed the significance determination using NRC Inspection Manual Chapter 0609, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, dated January 10, 2008, because it affected the Mitigating Systems Cornerstone while the plant was at power, and concluded the finding needed additional screening under Appendix F, Fire Protection Significance Determination Process, dated February 28, 2005. The team determined that the condition represented a low degradation of the fire protection program element of fixed fire protection systems due to a loss of the diesel driven fire water pump, and using Figure F.1 the finding was determined to be of very low safety significance (Green),based on Task 1.3.1. In addition, this finding had a problem identification and resolution cross-cutting aspect associated with the corrective action program component in that the licensee failed to thoroughly evaluate problems such that resolutions address causes and extent of condition P.1(c).

Enforcement.

License Condition 2.C.5.a requires, in part, that the licensee implement and maintain in effect the provisions of the fire protection program as described in the UFSAR. The UFSAR, Revision 24, Appendix 9.5 A-1, Section C.8, Corrective Action, states, in part, that procedures are established to ensure that deficiencies that affect fire protection are promptly identified, reported, evaluated, and corrected.

Procedure AP 28A-100, Condition Reporting, Revision 14, implements that requirement. Section 6.1 requires that a condition report be initiated for an adverse condition. Contrary to the above, between January and September 2011, the licensee failed to promptly identify, report, evaluate, and correct a deficiency that affected fire protection. Specifically, the licensee failed to identify an adverse trend in water and iron content in diesel driven fire water pump oil samples and document this in the corrective action program. Since this violation was of very low safety significance and was documented in the licensees corrective action program as Condition Report 43710, it is being treated as a non-cited violation consistent with Section 2.3.2 of the NRC

Enforcement Policy: NCV 05000482/2012009-04, Failure to Identify and Correct a Condition Adverse to Fire Protection.

4OA6 Meetings

Exit Meeting Summary

On August 6, 2012, the team presented the inspection results to Rich Clemens, Vice President of Strategic Projects, and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

T. Baban, Manager System Engineering

R. Baldwin, Master Mechanic

M. Blow, Shift Manager

R. Bodenhamer, Supervisor Operations Support

L. Brosch, Senior Operations Technician

J. Broschak, Director Plant Engineering

R. Clemens, Vice President Strategic Projects

S. Coffman, Supervisor Maintenance

B. Dunlop, Senior Nuclear Station Operator

B. Evenson, Licensed Supervising Instructor

D. Garbe, Engineer V

C. Garcia, Supervisor Engineer

S. Hedges, Site Vice President

S. Henry, Manager Operations

R. Hobby, Licensing Engineer III

S. Hossain, Engineer III

G. Kinn, Supervisor Engineer - Nuclear

L. Lane, Off-Shift Shift Manager

R. Lane, Certrec

M. LeGresley, Engineer II

J. Lowery, Engineer III

C. Medenciy, Supervisor Radiation Protection

D. Mosebey, Supervisor Engineer

W. Muilenburg, Licensing Engineer V

M. Rabalais, Engineer V

D. Riebe, Engineer V

L. Rockers, Licensing Engineer IV

G. Sen, Manager Regulatory Affairs

R. Smith, Plant Manager

M. Sunseri, President and Chief Executive Officer

J. Suter, Supervisor Engineer

J. Yunk, Manager Performance Improvement and Organizational Effectiveness

R. Zyduck, Manager Design Engineering

-1- Attachment

LIST OF ITEMS

OPENED

05000482/2012009-01 AV Failure to follow procedures on contractor control during maintenance on the Startup Transformer (Section 4OA5.2)

LIST OF ITEMS OPENED AND CLOSED

05000482/2012009-02 NCV Inadequate Preventative Maintenance Procedure on Turbine Driven Auxiliary Feedwater Pump (Section 4OA5.3)

05000482/2012009-03 NCV Inadequate Procedure for Temporary Fire Pump (Section 4OA5.8)

05000482/2012009-04 NCV Failure to Identify and Correct a Condition Adverse to Fire Protection (Section 4OA5.10)

LIST OF ITEMS CLOSED

05000482/2012-001-00, -01 LER Failure of 345 kV Switchyard Breaker Due to Internal Fault Resulting in Reactor Trip and Coincident Loss-of-Offsite Power (Section 4OA3)

05000482/2012008-01 URI Review Main Generator Output Breaker Fault Cause (Section 4OA5.1)

05000482/2012008-02 URI Review Startup Transformer Fault Cause (Section 4OA5.2)

05000482/2012008-03 URI Review Turbine-Driven Auxiliary Feedwater Pump Mechanical Overspeed Trip Device Out of Specification (Section 4OA5.3)

05000482/2012008-04 URI Review Operation of the Turbine-Driven Auxiliary Feedwater Pump at Low Flow, Steam Pressures, and Speed (Section 4OA5.4)

05000482/2012008-05 URI Assess Impact of Emergency Diesel Generator Ground on Mission Time (Section 4OA5.5)

05000482/2012008-08 URI Review Source Range Detector Deviation (Section 4OA5.6)

05000482/2012008-09 URI Review Failure to Maintain Fire Water Pressure

-2- Attachment

(Section 4OA5.7)

05000482/2012008-10 URI Review Inadequate Procedures and Training for Operation of the Temporary Diesel Fire Pump (Section 4OA5.8)

05000482/2012008-11 URI Assess Impact of Failure of Temporary Pump to Match the Functionality of Diesel Fire Pump (Section 4OA5.9)

05000482/2012008-12 URI Assess Cause of Normal Diesel Fire Pump Failure (Section 4OA5.10)