Text

NRC Inspection Report 05000482/2016008; January 1, 2016 Through June 29, 2016; Preliminary White Finding
	ML16235A132
Person / Time
Site:	Wolf Creek
Issue date:	08/19/2016
From:	Troy Pruett; NRC/RGN-IV/DRP
To:	Heflin A; Wolf Creek
	Taylor N
Shared Package
ML16237A013	List: IR 05000482/2016008; ML16235A132;
References
	EA-16-069 IR 2016008
	Download: ML16235A132 (53)
	v • d • e

UNITED STATES

NUCLEAR REGULATORY COMMISSION

REGION IV

1600 E. LAMAR BLVD.

ARLINGTON, TX 76011-4511

August 19, 2016

EA-16-069

Adam C. Heflin, President and

Chief Executive Officer

Wolf Creek Nuclear Operating Corporation

P.O. Box 411

Burlington, KS 66839

SUBJECT: WOLF CREEK GENERATING STATION - NRC INSPECTION

REPORT 05000482/2016008; PRELIMINARY WHITE FINDING

Dear Mr. Heflin:

On June 29, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at

your Wolf Creek Generating Station, and the NRC inspectors discussed the results of this

inspection with Mr. Jaime McCoy, Vice President of Engineering, and other members of your

staff. The inspectors documented the results of this inspection in the enclosed inspection

report.

This letter discusses a finding that has preliminarily been determined to be White - a finding

with low to moderate safety significance that may require additional NRC inspections. As

described in this letter (Section 4OA3 of this report), the finding is associated with an apparent

violation of Technical Specification 5.4.1.a for the licensees failure to adequately develop and

adjust preventive maintenance activities for emergency diesel generator excitation system

diodes. As a result, emergency diesel generator B would not have been able to operate for the

full mission time following a loss of offsite power event. This finding was assessed using the

best available information, using the applicable Significance Determination Process. The final

resolution of this finding will be conveyed in separate correspondence.

The NRC performed a detailed risk evaluation using Inspection Manual Chapter 0609, Appendix

A, The Significance Determination Process (SDP) for Findings At-Power, and determined an

incremental conditional core damage probability of 1.54E-06. The NRC determined that

mitigation credit for a new modification for the station blackout diesel generators was not

warranted because the equipment was not verified to be capable of performing its risk mitigation

function. The NRC noted that additional qualitative risk could be applied to the final result to

account for the actual number of control room cabinets, a common cause vulnerability with

emergency diesel generator A, and a period of shutdown plant conditions. If all of these factors

were applied the final significance would increase slightly and remain in the low to moderate risk

category (White).

A. Heflin -2-

The inspectors determined that this finding no longer presents an immediate safety concern

because emergency diesel generator B has been restored to operable and failed components,

including diodes associated with the static exciter, have been replaced and a preventive

maintenance strategy for the failed diodes has been developed. The finding is also an apparent

violation of NRC requirements and is being considered for escalated enforcement action in

accordance with the Enforcement Policy, which can be found on the NRCs Web site at

http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. In accordance with NRC

Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available

information and issue our final determination of safety significance within 90 days of the date of

this letter. The significance determination process encourages an open dialogue between the

NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staffs

final determination.

Before we make a final decision on this matter, we are providing you with an opportunity to

(1) attend a Regulatory Conference where you can present to the NRC your perspective on the

facts and assumptions the NRC used to arrive at the finding and assess its significance, or

(2) submit your position on the finding to the NRC in writing. If you request a Regulatory

Conference, it should be held within 40 days of the receipt of this letter and we encourage you

to submit supporting documentation at least one week prior to the conference in an effort to

make the conference more efficient and effective. The focus of the Regulatory Conference is to

discuss the significance of the finding and not necessarily the root cause(s) or corrective

action(s) associated with the finding. If a Regulatory Conference is held, it will be open for

public observation. If you decide to submit only a written response, such submittal should be

sent to the NRC within 40 days of your receipt of this letter. If you decline to request a

Regulatory Conference or to submit a written response, you relinquish your right to appeal the

final SDP determination, in that by not doing either, you fail to meet the appeal requirements

stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual

Chapter 0609.

Please contact Nicholas Taylor at 817-200-1141 and in writing within 10 days from the issue

date of this letter to notify the NRC of your intentions. If we have not heard from you within

10 days, we will continue with our significance determination and enforcement decision. The

final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination in this matter, no Notice of Violation is

being issued for these inspection findings at this time. In addition, please be advised that the

number and characterization of the apparent violation(s) described in the enclosed inspection

report may change as a result of further NRC review.

In addition, NRC inspectors documented one finding of very low safety significance (Green) in

this report. This finding involved a violation of NRC requirements. The NRC is treating this

violation as a non-cited violation (NCV) consistent with Section 2.3.2.a of the NRC Enforcement

Policy.

If you contest the violation or significance of this NCV, you should provide a response within

30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear

Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with

copies to the Regional Administrator, Region IV; the Director, Office of Enforcement,

A. Heflin -3-

U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident

inspector at the Wolf Creek Generating Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a

response within 30 days of the date of this inspection report, with the basis for your

disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the

Wolf Creek Generating Station.

In accordance with 10 CFR 2.390 of the NRC's "Agency Rules of Practice and Procedure," a

copy of this letter and its enclosure will be made available electronically for public inspection in

the NRC Public Document Room and in the NRCs Agencywide Documents Access and

Management System (ADAMS), accessible from the NRC Web site at

http://www.nrc.gov/reading-rm/adams.html.

Sincerely,

/RA/

Troy W. Pruett, Director

Division of Reactor Projects

Docket No. 50-482

License No. NPF-42

Enclosure:

Inspection Report 05000482/2016008

w/ Attachments:

1. Supplemental Information

2. Significance Determination

Letter to Adam C. Heflin from Troy W. Pruett, dated August 19, 2016

SUBJECT: WOLF CREEK GENERATING STATION - NRC INSPECTION

REPORT 05000482/2016008; PRELIMINARY WHITE FINDING

DISTRIBUTION:

Regional Administrator (Kriss.Kennedy@nrc.gov)

Deputy Regional Administrator (Scott.Morris@nrc.gov)

DRP Director (Troy.Pruett@nrc.gov)

DRP Deputy Director (Ryan.Lantz@nrc.gov)

DRS Director (Anton.Vegel@nrc.gov)

DRS Deputy Director (Jeff.Clark@nrc.gov)

Senior Resident Inspector (Douglas.Dodson@nrc.gov)

Resident Inspector (Fabian.Thomas@nrc.gov)

WC Administrative Assistant (Susan.Galemore@nrc.gov)

Branch Chief, DRP/B (Nick.Taylor@nrc.gov)

Senior Project Engineer, DRP/B (David.Proulx@nrc.gov)

Project Engineer, DRP/B (Steven.Janicki@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Project Manager (Fred.Lyon@nrc.gov)

Team Leader, DRS/IPAT (Thomas.Hipschman@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

ACES (R4Enforcement.Resource@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Technical Support Assistant (Loretta.Williams@nrc.gov)

Senior Congressional Affairs Officer (Jenny.Weil@nrc.gov)

RIV Congressional Affairs Officer (Angel.Moreno@nrc.gov)

RIV/ETA: OEDO (Jeremy.Bowen@nrc.gov)

RIV RSLO (Bill.Maier@nrc.gov)

ROPreports.Resource@nrc.gov

ROPassessment.Resource@nrc.gov

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000482

License: NPF-42

Report: 05000482/2016008

Licensee: Wolf Creek Nuclear Operating Corporation

Facility: Wolf Creek Generating Station

Location: 1550 Oxen Lane NE

Burlington, KS 66839

Dates: January 1 through June 29, 2016

Inspectors: D. Dodson, Senior Resident Inspector

F. Thomas, Resident Inspector

D. Loveless, Senior Reactor Analyst

G. Pick, Senior Reactor Inspector

Approved Troy W. Pruett, Director

By: Division of Reactor Projects

Enclosure

SUMMARY

IR 05000482/2016008; 01/01/2016 - 06/29/2016; Wolf Creek Generating Station; Follow-up of

Events and Notices of Enforcement Discretion

The inspection activities described in this report were performed between January 1 and

June 29, 2016, by the resident inspectors at Wolf Creek Generating Station and inspectors from

the NRCs Region IV office. The inspectors identified a preliminary White finding associated

with an apparent violation. Additionally, one finding of very low safety significance (Green) is

documented in this report. This finding involved a violation of NRC requirements. The

significance of inspection findings is indicated by their color (Green, White, Yellow, or Red),

which is determined using Inspection Manual Chapter 0609, Significance Determination

Process, issued April 29, 2015. Their cross-cutting aspects are determined using Inspection

Manual Chapter 0310, Aspects within the Cross-Cutting Areas, issued December 4, 2014.

Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement

Policy. The NRCs program for overseeing the safe operation of commercial nuclear power

reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

Preliminary White. The inspectors identified a preliminary White finding associated with

an apparent violation of Technical Specification 5.4.1.a, for the licensees failure to

adequately develop and adjust preventive maintenance activities in accordance with

Procedure AP 16B-003, Planning and Scheduling Preventive Maintenance, Revision 5.

Specifically, the licensee did not create a preventive maintenance replacement task or

schedule for emergency diesel generator excitation system diodes, which resulted in

emergency diesel generator B being declared inoperable and unavailable when it tripped

during a 24-hour surveillance test. The licensee entered this condition into its corrective

action program as Condition Report 88665. The licensee restored compliance by

establishing preventive maintenance tasks 49286, 49287, 49288, and 49289, which

refurbish the power rectifier assemblies and replace the diodes on a 12-year replacement

frequency.

This finding is more than minor because it is associated with the equipment performance

attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to

ensure the availability, reliability, and capability of systems that respond to initiating events

to prevent undesirable consequences. Specifically, with one emergency diesel generator

excitation system diode failed as a result of thermal degradation, emergency diesel

generator B was not operable or available to perform its safety function. The inspectors

evaluated the finding using Attachment 0609.04, "Initial Characterization of Findings,"

worksheet to Inspection Manual Chapter (IMC) 0609, Significance Determination Process,

issued June 19, 2012. The attachment instructs the inspectors to utilize IMC 0609,

Appendix A, Significance Determination Process (SDP) for Findings At-Power, issued

June 19, 2012. In accordance with NRC Inspection Manual Chapter 0609, Appendix A,

Exhibit 2, Mitigating Systems Screening Questions, the inspectors determined that the

finding required a detailed risk evaluation because it represented an actual loss of function

of the emergency diesel generator B for greater than its technical specification allowed

outage time. A senior reactor analyst performed a detailed risk evaluation in accordance

with Appendix A, Section 6.0, Detailed Risk Evaluation. The calculated change in core

damage frequency was dominated by a loss of offsite power initiator leading to station

blackout with failures of the turbine-driven and non-safety-related auxiliary feedwater

-2-

pumps. The analyst did not evaluate the large early release frequency because this

performance deficiency would not have challenged the containment. The NRC preliminarily

determined that the incremental conditional core damage probability for internal and external

initiators was 1.54E-06, in the low to moderate risk significance range (White). This finding

has a cross-cutting aspect in the area of problem identification and resolution, operating

experience, because the organization did not systematically and effectively evaluate

relevant internal and external operating experience in a timely manner. Specifically,

Condition Report 55103 documented industry operating experience regarding emergency

diesel generator excitation system diodes failing at an increased rate, and the operating

experience was not effectively implemented and institutionalized through changes to station

processes, procedures, equipment, and training programs, and at least one emergency

diesel generator excitation system diode failed due to aging [P.5]. (Section 4OA3)

Green. The inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix

B, Criterion XVI, Corrective Action, for the licensees failure to assure that conditions

adverse to quality, such as failures, malfunctions, and deficiencies are promptly identified

and corrected. Specifically, the licensee failed to promptly identify and correct a failed

rectifier bridge diode after smoke was observed coming from the three power potential

transformers in the emergency diesel generator exciter cabinet NE106 on June 11, 2014,

which contributed to the emergency diesel generator B being declared inoperable and

unavailable when it tripped during a 24-hour surveillance test on October 6, 2014. To

address the failure to take adequate corrective actions Wolf Creek entered this issue into its

corrective action program as Condition Report 105480 and plans to implement a

modification to install overcurrent detection for each emergency diesel generators power

potential transformer.

This finding is more than minor because it is associated with the equipment performance

attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to

ensure the availability, reliability, and capability of systems that respond to initiating events

to prevent undesirable consequences. Specifically, the failure to identify and correct the

failed emergency diesel generator excitation system diode contributed to the emergency

diesel generator B failure on October 6, 2014. The inspectors evaluated the finding using

Attachment 0609.04, "Initial Characterization of Findings," worksheet to Inspection Manual

Chapter (IMC) 0609, Significance Determination Process, issued June 19, 2012. The

attachment instructs the inspectors to utilize IMC 0609, Appendix A, Significance

Determination Process (SDP) for Findings At-Power, issued June 19, 2012. The inspectors

determined this finding is not a deficiency affecting the design or qualification of a mitigating

structure, system, or component that maintained its operability or functionality, the finding

does not represent a loss of system and/or function, the finding does not represent an actual

loss of function of at least a single train for greater than its Technical Specification allowed

outage time, and the finding does not represent an actual loss of function of one or more

non-Technical Specification trains of equipment designated as high safety-significant.

Therefore, the inspectors determined the finding was of very low safety significance (Green).

The inspectors determined that in accordance with Inspection Manual Chapter 0310,

Aspects Within The Cross-Cutting Areas, issued December 4, 2014, the finding has a

cross-cutting aspect in the area of human performance, conservative bias, because when

smoke was identified coming from the power potential transformers on multiple occasions,

licensee personnel did not use decision making-practices that emphasize prudent choices

over those that are simply allowable, and a proposed action is determined to be safe in

order to proceed, rather than unsafe in order to stop. As a result, the licensee missed an

-3-

opportunity to identify and correct the condition of the failed diode in the static exciter [H.14].

(Section 4OA3)

-4-

REPORT DETAILS

4. OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency

Preparedness, Public Radiation Safety, Occupational Radiation Safety, and

Security

4OA3 Follow-up of Events and Notices of Enforcement Discretion (71153)

.1 (Closed) Unresolved Item 05000482/2014005-02, Notice of Enforcement

Discretion 14-4-02 for Emergency Diesel Generator B Exciter Cabinet Fire

a. Inspection Scope

On October 6, 2014, at 1:26 p.m., emergency diesel generator B was declared

inoperable when it tripped during a 24-hour surveillance test and operators identified a

fire in an associated exciter cabinet. An Alert was declared and operators entered

Technical Specification 3.8.1, AC Sources - Operating, Required Action B.4.1, which

required emergency diesel generator B be restored to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The fire was quickly suppressed and the station exited the Alert. Following the

completion of repairs, the licensee identified that post-maintenance testing required to

demonstrate system operability included completing a 24-hour run. Since the post-

maintenance testing and subsequent system restoration was expected to exceed the

time remaining in the 72-hour action statement, the licensee requested that the NRC

exercise discretion to not enforce compliance with the actions required in Technical

Specification 3.8.1, Required Action B.4.1, and approve an additional 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore

the system. Notice of Enforcement Discretion 14-4-02, documents this request and the

NRCs approval. Following post-maintenance testing, emergency diesel generator B

was restored to operable status at 5:17 p.m. on October 9, 2014.

Unresolved Item 05000482/2014005-02, Notice of Enforcement Discretion 14-4-02 for

Emergency Diesel Generator B Exciter Cabinet Fire, was identified because a Notice of

Enforcement Discretion was issued, and Inspection Manual Chapter 0410, Notice of

Enforcement Discretion, requires that an unresolved item be opened to assess whether

the causes of the events leading up to the request for the Notices of Enforcement

Discretion involved violations of NRC requirements.

The inspectors performed an in-depth review of the licensees root cause evaluations

associated with Condition Report 88665, operating experience related to the event, other

related condition reports, and documentation listed in Attachment 1. In addition, the

inspectors performed on-site tours, interviewed site personnel, and reviewed corrective

actions associated with the condition. Unresolved Item 05000482/2014005-02 is closed

to the two enforcement actions discussed below.

b. Findings

1. Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency

Diesel Generator Excitation System Diodes

Introduction. The inspectors identified a preliminary White finding associated with an

apparent violation of Technical Specification 5.4.1.a, for the licensees failure to

-5-

adequately develop and adjust preventive maintenance activities in accordance with

Procedure AP 16B-003, Planning and Scheduling Preventive Maintenance, Revision 5.

Specifically, the licensee did not create a preventive maintenance replacement task for

emergency diesel generator excitation system diodes, which resulted in emergency

diesel generator B being declared inoperable and unavailable when it tripped during a

24-hour surveillance test.

Description. On October 6, 2014, at 1:26 p.m., emergency diesel generator B was

declared inoperable when it tripped during a 24-hour surveillance test and operators

identified a fire in an associated exciter cabinet. An Alert was declared and operators

entered Technical Specification 3.8.1, AC Sources - Operating, Required Action B.4.1,

which required emergency diesel generator B be restored to operable status within

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The fire was quickly suppressed and the station exited the Alert. Following

the completion of repairs, the licensee returned emergency diesel generator B to service

on October 9, 2014. The licensee initiated Condition Report 88665 to evaluate the

causes of the inoperability of emergency diesel generator B.

On June 11, 2014, approximately four months prior to the failure of emergency diesel

generator B, during performance of Procedure SYS KJ-124, Post Maintenance Run of

Emergency Diesel Generator B, Revision 60A, a burning smell was noted coming from

cabinet NE106 in emergency diesel generator room B. Condition Report 85125

documented the condition and stated, Small amounts of smoke could be seen coming

from the three transformers at the bottom right side of NE106. The licensee determined

that the B emergency diesel generator remained operable. The immediate operability

determination stated, The condition identified is likely age related degradation of the

noted heat shrink insulating material. Based on operating experience at Wolf Creek, as

certain insulating materials age, the plasticizer starts slowly [separating] and the material

then becomes brittle. Visual inspections were performed as well as thermography;

however, the licensee did not recognize any failed equipment.

On July 18, 2012, industry operating experience related to Loss of Emergency Diesel

Generator Excitation, was placed into the licensees corrective action program as

Condition Report 55103, but closed without action by the licensees staff who incorrectly

determined that it was not applicable to their design. The root cause analysis associated

with Condition Report 88665 describes industry operating experience that concluded the

average life span of emergency diesel generator excitation system diodes is

approximately 12 years. Revision 1 of the root cause analysis states, The [condition

report] evaluator did not find it to be applicable due to a different exciter design. As this

is true, the middle phase diodes in any rectifier bridge are still susceptible to the same

failure mode identified in this IER. If the evaluator identified the susceptibility and

proactively suggested replacement of the diodes, then it may have prevented this event

from happening. Revision 2 of the root cause analysis revised this section to state, If

the evaluator identified the possible susceptibility and proactively suggested

replacement of the diodes, then it may have reduced the probability of this event

occurring. On October 27, 2015, the licensee established preventive maintenance

tasks 49286, 49287, 49288, and 49289, which refurbish the power rectifier assemblies

and replace the diodes on a 12-year replacement frequency. The inspectors noted that

if the licensee had adequately established and implemented the appropriate preventive

maintenance task and replaced the diodes, which were original equipment that had been

in service for approximately 29 years, during one of the three refueling outages or one of

the five forced outages after Condition Report 55103 was documented in July 2012, the

-6-

diode failures that resulted in the system failure in October 2014 would have been

prevented.

The root cause analysis associated with Condition Report 88665 also discussed the

direct and root causes of the issue. With reference to the direct cause, Revision 1

stated,

The most probable direct causehas been identified as thermal

degradation of the Power Rectifier diodes. Due to the reduced

contribution of field current and voltage from the Power Current

Transformer circuitry from a single diode failure, the voltage regulator

would task the [power potential transformer] to supply the remainder of

the required current to the field. This increase current would increase the

internal temperatures of the [power potential transformer], leading to

degraded windings within the [power potential transformer]. This

condition could only be noticed by the smoking from the [power potential

transformer]. The second diode then eventually shorted, causing a short

in the generator field. This short would cause a loss of excitation to the

field and would trip the diesel.

Revision 1 of the licensees root cause analysis stated, The station did not

recognize the significance of aging or life cycle factors associated with the

[emergency diesel generators] excitation system resulting in an inadequate

preventive maintenance strategy of the excitation system. The analysis also

stated,

Had a thorough review of IER L3-12-41 been performed, then it is

possible that a [preventive maintenance activity] could have been

createdThe [Preventive Maintenance Optimization] group did review

the Electric Power Research Institute (EPRI) document 1011232

Emergency Diesel Generator Voltage Regulator Maintenance Issues

which states diodesappear to be failing because of age. However,

there is no evidence of any action taken to replace the diodes within the

[emergency diesel generator] exciter system.

Revision 2 of the root cause analysis revised the root cause. It stated,

The station did not have the ability to assess the degradation of the

[power potential transformer] within the [emergency diesel generators]

excitation system that led to the continual operation of a degraded

component, resulting in significant equipment failure. Additionally, there

were limited [preventive maintenance activities], obsolescence issues that

had not been addressed, limited knowledge of the exciter, and the design

of the system lacked overcurrent protection/detection of the [power

potential transformer].

The inspectors reviewed Revisions 0, 1, and 2 of the licensees root cause analysis for

Condition Report 88665. Considering the operating experience associated with the

degradation of power rectifier bridge diodes, and the licensees analyses, the inspectors

determined that the conclusions of Revision 1 of the licensees root cause analysis for

Condition Report 88665 remained valid.

-7-

The inspectors questioned the completed and planned corrective actions associated with

the Revision 2 root cause and determined that Revision 2 of the root cause did not

identify corrective actions to prevent recurrence for all aspects of the root cause.

Specifically, one action to implement a design change to protect the power potential

transformers was the only corrective action to prevent recurrence. No other corrective

actions to prevent recurrence were proposed to address the other elements of the root

cause, including the inability to assess the degradation of the power potential

transformer, the limited preventive maintenance activities, obsolescence issues that had

not been addressed, and limited knowledge of the exciter. The licensee documented

Condition Report 104833 to capture the inspectors concerns and to document that

actions were to revise the root cause evaluation cause.

The inspectors noted that Procedure AP 16B-003, Planning and Scheduling Preventive

Maintenance, Revision 5, provides direction for implementing the preventive

maintenance program. In Section 6.2, Establishing [preventive maintenance] Activities,

it states, Develop [preventive maintenance] activities by considering the

followingOperating Experience (OE) (Industry and Station). Section 6.2.2, states,

[Preventive maintenance] frequencies are established and adjusted in accordance

withthe following considerationsThe age of the installed equipment. The inspectors

determined that the July 2012 operating experience was not adequately evaluated, in

that the licensees power diodes were susceptible to the same heat and age related

failure mechanisms described in the operating experience. The licensee should have

utilized the operating experience and revised maintenance procedures to prevent this

issue from impacting emergency diesel generator B reliability and availability.

The licensee also obtained third party reviews, including reviews from DP Engineering

LTD. Co. (DPE) and Mandil, Panoff, and Rockwell (MPR). The DPE review, dated April

15, 2015, stated, DPE effectively concurs with the Root Cause [Revision 1] of the

event. The MPR review, documented in Enclosure 1 to LTR-0405-0018, Revision 1,

dated April 17, 2015, stated, MPR agrees with the [root cause evaluation], [Revision 1],

in that the most probable cause is the thermal degradation of Power Rectifier diodes,

combined with transients these diodes have experienced through service over several

decades.

Licensee personnel documented similar conclusions following testing on a mock-up of

the emergency diesel generators excitation system, If a single diode would fail in the

Power Rectifier then the [power potential transformer] would then become overloaded.

Considering the root cause evaluation, the failure of emergency diesel generator B to

operate more than 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months during its 24-hour surveillance run on October 6, 2014, the

failure of the first diode on or before June 11, 2014, and the likely thermal degradation

failure mechanism of the first diode that failed, the inspectors determined that

emergency diesel generator B would not have been able to perform its safety function.

During a review of the licensees mitigating strategies for the failure of emergency diesel

generator B, the inspectors reviewed the availability of the station blackout diesel

generators. The station blackout diesel generators were installed in the plant and then

credited in the licensees probabilistic risk assessment model on October 1, 2013. The

licensee acknowledged in 2013 that it could not energize a safety-related bus from the

station blackout diesel generators at power without rendering the safety-related bus

inoperable, and the licensee acknowledged that post modification testing to fully

-8-

demonstrate station blackout diesel generator capability could not be performed until the

spring 2014 mid-cycle outage. After the licensee took credit for the station blackout

diesel generators in its probabilistic risk assessment model in 2013, the NRC expressed

concerns to the licensee regarding its taking credit for the station blackout diesel

generators without verifying the mitigation function could be accomplished. On April 25,

2014, the licensee tested the station blackout diesel generators ability to connect to the

safety-related buses, but the equipment failed testing as a result of improperly installed

current transformer wiring in the safety-related buses alternate feeder cubicles. This

wiring error was corrected and the diesels were successfully tested on April 29, 2014.

NRC Inspection Report 05000482/2015002 documented a green non-cited violation,05000482/2015002-01, Class 1E 4kV Feeder Breakers from Station Blackout Diesel

Generators Current Transformer Wiring not Installed per Design Drawings, associated

with this issue. The inspectors noted Inspection Manual Chapter 0308, Attachment 3,

Significance Determination Process Technical Basis, issued June 16, 2016, discusses,

The Independence of Inspection Findings. However, the inspectors determined that

prior to April 29, 2014, Wolf Creek should not have reduced the baseline risk of the

facility by revising the plant-specific probabilistic risk assessment model. Any

performance deficiencies occurring during this seven-month time window should exclude

the station blackout diesel generators from the baseline risk of the facility because the

station blackout diesels were never installed prior to April 29, 2014, and, therefore,

should not have been credited in the baseline risk of the facility prior to this date.

The licensees corrective actions included replacing the power potential transformer and

selecting the alternate rectifier bank to restore the availability of emergency diesel

generator B. In addition to immediate actions taken, the licensee replaced all power

diodes within all four rectifier bridges (two rectifier bridges for each emergency diesel

generator). On October 27, 2015, the licensee implemented a corrective action to

generate new preventive maintenance activities to periodically replace the diodes within

the power rectifier and other excitation system components as recommended by the

operating experience.

Analysis. The inspectors determined that the failure to adequately develop and adjust

emergency diesel generator excitation system diode preventive maintenance activities in

accordance with Procedure AP 16B-003, Planning and Scheduling Preventive

Maintenance, was a performance deficiency. This finding is more than minor because it

is associated with the equipment performance attribute of the Mitigating Systems

cornerstone and affected the cornerstone objective to ensure the availability, reliability,

and capability of systems that respond to initiating events to prevent undesirable

consequences. Specifically, with one emergency diesel generator excitation system

diode failed as a result of thermal degradation, emergency diesel generator B was not

operable or available to perform its safety function.

The inspectors evaluated the finding using the Attachment 0609.04, "Initial

Characterization of Findings," worksheet to Inspection Manual Chapter (IMC) 0609,

Significance Determination Process, issued June 19, 2012. The attachment instructs

the inspectors to utilize IMC 0609, Appendix A, Significance Determination Process

(SDP) for Findings At-Power, issued June 19, 2012. In accordance with NRC

Inspection Manual Chapter 0609, Appendix A, Exhibit 2, Mitigating Systems Screening

Questions, the inspectors determined that the finding required a detailed risk evaluation

because it represented an actual loss of function of the emergency diesel generator B

for greater than its technical specification allowed outage time.

-9-

The detailed risk evaluation was performed in accordance with Appendix A, Section 6.0,

Detailed Risk Evaluation, and is included as Attachment 2, Significance Determination

for Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency

Diesel Generator Excitation System Diodes.

The detailed risk evaluation was developed using the assumption that the station

blackout diesel generators were available with their nominal failure rate. The result was

then adjusted to account for the 79-day period from February 5, 2014, until April 25,

2014, when the station blackout emergency diesel generator had not been verified to be

capable of performing its mitigation function. The total resulting incremental conditional

core damage probability increased to 1.54E-06. A Significance and Enforcement

Review Panel held on June 23, 2016, made a preliminary determination that the finding

was of low to moderate safety significance (White).

The inspectors determined that in accordance with Inspection Manual Chapter 0310,

Aspects Within The Cross-Cutting Areas, issued December 4, 2014, the finding has a

cross-cutting aspect in the area of problem identification and resolution, operating

experience, because the organization did not systematically and effectively evaluate

relevant internal and external operating experience in a timely manner. Specifically,

Condition Report 55103 documented industry operating experience regarding

emergency diesel generator excitation system diodes failing at an increased rate, and

the operating experience was not effectively implemented and institutionalized through

changes to station processes, procedures, equipment, and training programs, and at

least one emergency diesel generator excitation system diode failed due to aging. This

issue is indicative of current performance because the station did not take any formal

corrective actions to address the stations failure to adequately consider operating

experience [P.5].

Enforcement. Technical Specification 5.4.1.a, requires, in part, that procedures shall be

established, implemented, and maintained covering the applicable procedures

recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 9.b of

Appendix A to Regulatory Guide 1.33, Revision 2, requires that preventive maintenance

schedules be developed to specifyinspection or replacement of parts that have a

specific lifetime. The licensee established Procedure AP 16B-003, Planning and

Scheduling Preventive Maintenance, Revision 5, which provides direction for

implementing the preventive maintenance program to meet the Regulatory Guide 1.33

requirement. Section 6.2 of Procedure AP 16B-003 requires that preventive

maintenance activities be developed by considering operating experience and

preventive maintenance frequencies are established and adjusted in accordance with

the age of installed equipment. Contrary to the above, until October 27, 2015, the

licensee did not ensure that preventive maintenance activities were developed by

considering operating experience and preventive maintenance frequencies were not

established and adjusted in accordance with the age of installed equipment.

Specifically, the licensee did not ensure that adequate preventive maintenance activities

were developed for emergency diesel generator excitation system diodes by considering

operating experience documented in Condition Report 55103, and preventive

maintenance frequencies were not established or adjusted for emergency diesel

generator excitation system diodes that were original plant equipment. As a result, a

power diode that had been installed in the emergency diesel generator B excitation

system beyond its recommended service life failed and caused the emergency diesel

- 10 -

generator to be inoperable and led to the catastrophic failure of emergency diesel

generator B on October 6, 2014. The licensee entered this condition into its corrective

action program as Condition Report 88665. The licensee restored compliance by

establishing preventive maintenance tasks 49286, 49287, 49288, and 49289, which

refurbish the power rectifier assemblies and replace the diodes on a 12-year

replacement frequency. This violation is being treated as an apparent violation pending

a final significance determination: AV 05000482/2016008-01, Failure to Adequately

Establish and Adjust Preventive Maintenance for Emergency Diesel Generator

Excitation System Diodes

2. Failure to Promptly Identify and Correct a Significant Condition Adverse to Quality

Associated with the Emergency Diesel Generator B Excitation System Diodes

Introduction. The inspectors identified a Green non-cited violation of 10 CFR Part 50,

Appendix B, Criterion XVI, Corrective Action, for the licensees failure to assure that

conditions adverse to quality, such as failures, malfunctions, and deficiencies, are

promptly identified and corrected. Specifically, the licensee failed to promptly identify

and correct a failed rectifier bridge diode after smoke was observed coming from the

three power potential transformers in the emergency diesel generator exciter cabinet

NE106 on June 11, 2014. This failed diode resulted in the emergency diesel generator

B being declared inoperable and unavailable when it caught on fire and tripped during a

24-hour surveillance test on October 6, 2014.

Description. On June 11, 2014, during performance of Procedure SYS KJ-124, Post

Maintenance Run of Emergency Diesel Generator B, Revision 60A, operations

personnel detected a burning smell coming from cabinet NE106 in the B emergency

diesel generator room. Condition Report 85125 documented the condition and stated,

Small amounts of smoke could be seen coming from the 3 transformers at the bottom

right side of NE106. The immediate operability determination associated with Condition

Report 85125 stated, What affect does the deficiency have on the affected structure,

system, or components ability to perform its intended design/safety function? None.

This is a long term [degradation] issue that needs to be evaluated for the need for

correction and [those] corrections [implemented] as desired by the system engineer.

The immediate operability determination stated, The condition identified is likely age

related degradation of the noted heat shrink insulating material. Based on operating

experience at Wolf Creek, as certain insulating materials age, the plasticizer starts

slowly [separating] and the material then becomes brittle. Visual inspections were

performed as well as thermography; however, the licensee did not recognize the failed

diode.

Revision 2 of the root cause evaluation completed per Condition Report 88665

described a missed opportunity in having not performed an adequate investigation of the

cause of the smoke identified coming from the three power potential transformers in

cabinet NE106. Specifically:

An inadequate investigation of the [power potential transformer] vaporing

in June 2014 was also considered to be a missed opportunity. Personnel

involved with the determination of the [power potential transformer] issue

identified on June 11, 2014, did not thoroughly investigate the condition of

the [power potential transformer]. The heat shrink tubing was degraded

so actions were taken to replace the [power potential transformer].

- 11 -

However, the question to why the connections were degraded was never

asked. If a more thorough investigation was pursued then it is possible

that a failed diode could have been found failed, preventing the [power

potential transformer] from ever exhibiting a fire. If the individuals

involved with the June determination were well aware of the

subcomponents within the NE106 cabinet, it is possible that the fire

observed would not have taken place.

Neither the root cause evaluation associated with Condition Report 88665 nor Condition

Report 85125 identified corrective actions to adequately address the licensees failure to

promptly identify and correct the failed power rectifier bridge diode June 2014.

Specifically, no corrective actions directly addressed the incorrect decision to accept a

smoking power potential transformer.

The inspectors noted that the Plant Health Committee approved a modification to install

overcurrent detection for each emergency diesel generators power potential

transformer. This modification is expected to provide plant personnel indication that a

diode has failed, including a revised local alarm. Upon identification of the revised local

alarm, the licensee expects that troubleshooting would occur and include current checks

of each phase of the power potential transformer, which would be expected to identify an

overcurrent condition and subsequently a failed diode. Action would then been expected

to occur in a timely manner to correct the condition. However, the inspectors noted that

this planned design modification did not directly address station acceptance of smoking

equipment. Based on inspector concerns, the licensee entered this issue into its

corrective action program as Condition Report 105480 and plans to perform a basic

cause evaluation to identify additional actions.

Analysis. The inspectors determined that the failure to identify and correct the cause of

the smoke coming from the power potential transformer was a performance deficiency.

This finding is more than minor because it is associated with the equipment performance

attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to

ensure the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences. Specifically, the failure to identify and

correct the failed emergency diesel generator excitation system diode contributed to the

emergency diesel generator B failure on October 6, 2014.

The inspectors evaluated the finding using Attachment 0609.04, "Initial Characterization

of Findings," worksheet to Inspection Manual Chapter (IMC) 0609, Significance

Determination Process, issued June 19, 2012. The attachment instructs the inspectors

to utilize IMC 0609, Appendix A, Significance Determination Process (SDP) for Findings

At-Power, issued June 19, 2012. The inspectors determined this finding is not a

deficiency affecting the design or qualification of a mitigating structure, system, or

component that maintained its operability or functionality; the finding does not represent

a loss of system and/or function; the finding does not represent an actual loss of function

of at least a single train for greater than its Technical Specification-allowed outage time;

and the finding does not represent an actual loss of function of one or more

non-Technical Specification trains of equipment designated as high safety-significant.

Therefore, the inspectors determined the finding was of very low safety significance

(Green).

- 12 -

The inspectors determined that in accordance with Inspection Manual Chapter 0310,

Aspects Within The Cross-Cutting Areas, issued December 4, 2014, the finding has a

cross-cutting aspect in the area of human performance, conservative bias, because

when smoke was identified coming from the power potential transformers on multiple

occasions, licensee personnel did not use decision making-practices that emphasize

prudent choices over those that are simply allowable, and a proposed action is

determined to be safe in order to proceed, rather than unsafe in order to stop. As a

result, an opportunity to identify and correct the condition of the failed diode in the static

exciter was missed [H.14].

Enforcement. Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action,

states, in part, that measures shall be established to assure that conditions adverse to

quality such as failures, malfunctions, and deficiencies, are promptly identified and

corrected. Contrary to the above, from June 11, 2014, to October 9, 2014, measures

were not established to assure that conditions adverse to quality such as failures,

malfunctions, and deficiencies were promptly identified and corrected. Specifically, the

licensee did not establish adequate measures to assure that a condition adverse to

quality, a failed power rectified bridge diode, was promptly identified and corrected, and

the failure to identify and correct the failed emergency diesel generator excitation system

diode resulted in a missed opportunity to prevent the failure of emergency diesel

generator B failure on October 6, 2014. To address the failure to take adequate

corrective actions Wolf Creek entered this issue into its corrective action program, plans

to perform a basic cause evaluation, and plans to implement a modification to install

overcurrent detection for each emergency diesel generators power potential

transformer. This violation was of very low safety significance (Green), and the licensee

entered this issue into its corrective action program as Condition Report 105480. This

violation is being treated as a non-cited violation consistent with Section 2.3.2 of the

Enforcement Policy: NCV 05000482/2016008-02, Failure to Promptly Identify and

Correct a Condition Adverse to Quality Associated with the Emergency Diesel Generator

B Excitation System Diodes

.2 (Closed) Licensee Event Report 05000482/2016-001-00, Power Potential Transformer

Overloading Results in Emergency Diesel Generator Inoperability

a. Inspection Scope

On October 6, 2014, during a scheduled 24-hour surveillance test of emergency diesel

generator B, the emergency diesel generator unexpectedly tripped and a fire was

observed in electrical cabinet NE106 associated with the exciter circuitry. This event

resulted in an unplanned 72-hour limiting condition of operation and an Alert emergency

declaration. On January 28, 2016, a hardware failure analysis concluded that the power

potential transformer, which was the source of the fire, most likely failed from

overloading as a result of a diode failure in the power rectifier of the emergency diesel

generator excitation system. The licensee event report concluded that the failure of the

diode most likely occurred during load transients on June 9, 2014.

The inspectors performed an in-depth review of the licensees root cause evaluation

revisions (Revision 0, completed December 17, 2014; Revision 1, completed July 30,

2015; and Revision 2, completed February 22, 2016) associated with Condition

Report 88665, operating experience related to the event, other Condition Reports, and

other documentation. In addition, the inspectors performed on-site tours, interviewed

- 13 -

site personnel, worked with regional staff concerning the risk analysis, and reviewed

corrective actions associated with the condition. In reviewing the event, the inspectors

documented one apparent violation, AV 05000482/2016008-01, Failure to Adequately

Establish and Adjust Preventive Maintenance for Emergency Diesel Generator

Excitation System Diodes, and one non-cited violation, NCV 05000482/2016008-02,

Failure to Promptly Identify and Correct a Condition Adverse to Quality Associated with

the Emergency Diesel Generator B Excitation System Diodes, which are also

documented in Section 4OA3 of this report.

This licensee event report is closed.

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On June 29, 2016, the inspectors presented the inspection results to Jamie McCoy, Vice

President of Engineering, and other members of the licensee staff. The licensee acknowledged

the issues presented. The licensee confirmed that any proprietary information reviewed by the

inspectors had been returned or destroyed.

- 14 -

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

T. Baban, Manager, System Engineering

W. Brown, Superintendent, Security Operations

A. Broyles, Manager, Information Services

D. Campbell, Superintendent, Maintenance

T. East, Superintendent, Emergency Planning

J. Edwards, Manager, Operations

D. Erbe, Manager, Security

R. Flannigan, Manager, Nuclear Engineering

J. Fritton, Oversight

C. Garcia, Supervisor Engineer

C. Hafenstine, Manager, Regulatory Affairs

A. Heflin, President and Chief Executive Officer

S. Henry, Manager, Integrated Plant Scheduling

R. Hobby, Licensing Engineer

J. Isch, Superintendent, Operations Work Controls

B. Ketchum, Supervisor Engineer

B. Lee, Licensed Supervising Instructor

M. Legresley, Engineer

D. Mand, Manager, Design Engineering

J. McCoy, Vice President, Engineering

N. Mingle, Engineer

W. Muilenburg, Supervisor, Licensing

L. Ratzlaff, Manager, Maintenance

C. Reasoner, Site Vice President

M. Skiles, Manager, Radiation Protection

T. Slenker, Supervisor, Operations Support

S. Smith, Plant Manager

A. Stull, Vice President and Chief Administrative Officer

J. Suter, Supervisor Engineer

M. Tate, Superintendent, Security Operations

NRC Personnel

T. Martinez-Navedo, Electrical Engineer, NRR

G. Matharu, Senior Electrical Engineer, NRR

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000482/2016008-01 AV Failure to Adequately Establish and Adjust Preventive

Maintenance for Emergency Diesel Generator Excitation System

Diodes (Section 4OA3)

A1-1 Attachment 1

Opened and Closed

05000482/2016008-02 NCV Failure to Promptly Identify and Correct a Condition Adverse to

Quality Associated with the Emergency Diesel Generator B

Excitation System Diodes (Section 4OA3)

Closed

05000482/2014005-02 URI Notice of Enforcement Discretion 14-4-02 for Emergency Diesel

Generator B Exciter Cabinet Fire (Section 4OA3)05000482/2016001-00 LER Power Potential Transformer Overloading Results in Emergency

Diesel Generator Inoperability (Section 4OA3)

LIST OF DOCUMENTS REVIEWED

Section 4OA3: Follow-up of Events and Notices of Enforcement Discretion

Procedures

Number Title Revision

AI 28A-100 Condition Report Resolution 9

ALR 00-021B NB02 BUS UV 18

AP 16B-003 Planning and Scheduling Preventive Maintenance 3

AP 16B-003 Planning and Scheduling Preventive Maintenance 4

AP 16B-003 Planning and Scheduling Preventive Maintenance 5

AP 16B-003 Planning and Scheduling Preventive Maintenance 6

AP 16E-002 Post Maintenance Testing Development 15

AP 20E-001 Industry Operating Experience Program 28

EMG C-0 Loss of All AC Power 34

EMG C-0 Loss of All AC Power 36

EMG E-0 Reactor Trip or Safety Injection 37A

OFN KJ-032 Local Emergency Diesel Startup 12

OFN NB-030 Loss of AC Emergency BUS NB01 (NB02) 33A

OFN RP-017 Control Room Evacuation 48

OFN RP-017A Hot Standby To Cold Shutdown From Outside The Control 11C

Room Due To Fire

SYS KJ-124 Post Maintenance Run of Emergency Diesel Generator B 60A

SYS KJ-124 Post Maintenance Run of Emergency Diesel Generator B 62D

A1-2

Procedures

Number Title Revision

SYS KU-122 Energizing NB02 From Station Blackout Diesel Generators 4

SYS KU-122 Energizing NB02 From Station Blackout Diesel Generators 5

Drawings

Number Title Revision/Date

6998D62 Colt Industries Type WNR Volt Reg. & Excitation System March 16,

1978

E-11001 Main Single Line Diagram 10

J-104-00390 Logic Block Diagram ESFAS W08

J-14001 Control Room Equipment Arrangement, Sheet 1 11

KD-7496 One Line Diagram 59

M-12AL01 Piping & Instrumentation Diagram Auxiliary Feedwater 28

System

Condition Reports

55103 83379 84939 85015 85125

88665 88734 88755 89146 95773

103395 104833

Work Orders

02-243437-000 02-243438-000 15-408390-000 15-408391-000 15-408392-000

15-408393-000

Miscellaneous

Number Title Revision/Date

12-41 INPO Event Report April 26, 2012

15-0209 Lab Analysis Report June 1, 2015

AIF 28-001-01 Event Review Team Summary October 6, 2014

AN 93-0213 Letter from M.D. Hall (MS2-01) to E. L. Asbury (WC-NP) July 20, 1993

AN-95-029 Control Room Fire Analysis 0

E-050A-00011 Lucent Technologies Lineage 2000 Round Cell Battery W03

EPRI Technical Emergency Diesel Generator Voltage Regulator December 2004

Report 1011232 Maintenance Issues

A1-3

Miscellaneous

Number Title Revision/Date

ES 94-0004 Letter from E.L. Asbury (WC-NP) to M. D. Hall (MS2-01) January 3, 1994

FR-015188 High Voltage Rectifiers 0

FR-015188 High Voltage Rectifiers 1

LER 2016-001- Power Potential Transformer Overloading Results in March 28, 2016

00 Emergency Diesel Generator Inoperability

M-018-00309 Emergency Diesel Generator System W136

NE 94-0011 Letter from D. R. Prichard (MS2-01) to TE-43510 January 11, 1994

NK-E-001 125 VDC Class 1E Battery System Sizing, Voltage Drop 4

and Short Circuit Studies

OTSC 15-0058 Alternator Inspection 13A

PSA-05-0011 PSA Evaluation Sheet 0

STN GP-009 Emergency Equipment Verification Completed

February 5, 2016

STN-GP-009 Emergency Equipment Verification Completed

March 14, 2106

STN-GP-009 Emergency Equipment Verification Completed

April 11, 2016

Various NE106 Thermography Report Since July 11,

2012

A1-4

Significance Determination

Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel

Generator Excitation System Diodes

Significance Determination Basis:

(a) Results: Screening Logic

Minor Question: In accordance with NRC Inspection Manual Chapter 0612,

Appendix B, Issue Screening, the finding was determined to be more than minor

because it was associated with the equipment performance attribute of the Mitigating

Systems cornerstone, and affected the associated cornerstone objective to ensure

availability, reliability, and capability of systems that respond to initiating events to

prevent undesirable consequences. Specifically, the performance deficiency

adversely affected the emergency diesel generator B capability to operate loaded for

the technical specification required time caused by thermal degradation of diodes in

the excitation circuitry. Thermal degradation of the diodes stressed the power

potential transformers since they had to generate a magnetic field that exceeded

their design ratings.

Initial Characterization: Using NRC Inspection Manual Chapter Attachment 0609.04,

Initial Characterization of Findings, the inspectors determined that the finding could

be evaluated using the significance determination process. In accordance with

Table 3, SDP Appendix Router, the inspectors determined that the subject finding

should be processed through Appendix A, The Significance Determination Process

(SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions,

effective date July 1, 2012.

Issue Screening: In accordance with NRC Inspection Manual Chapter 0609,

Appendix A, Exhibit 2, Mitigating Systems Screening Questions, the inspectors

determined that the finding required a detailed risk evaluation because it represented

an actual loss of function of the Emergency Diesel Generator B for greater than its

technical specification allowed outage time.

(b) Detailed Risk Evaluation:

(1) The Phase 3 Model Revision and Other Probabilistic Risk Assessment Tools

Used

The analyst utilized a limited use model of the SPAR model for Wolf Creek

Generating Station, Version 8.26, which included the licensees station blackout

emergency diesel generators, and hand calculation methods to quantify the risk

of the subject performance deficiency. The analyst modified the model to include

the actions needed for operators to start the station blackout emergency diesel

generators using the SPAR-H (human factors) model. The analyst also created

an event tree to model a postulated fire leading to control room abandonment.

A2-1 Attachment 2

(2) Assumptions

1. Emergency diesel generator B was unable to perform its function beginning

on February 5, 2014, after it was secured from a monthly surveillance run.

The analyst selected this date based on the inspection staffs assumption that

failure of a pair of diodes in the excitation circuit resulted from thermal

degradation. The failure of the diodes caused additional stresses on the

generator field circuits that resulted in the power potential transformers

catching fire and rendering the diesel generator inoperable. The analyst

determined this was a run-time degradation, as defined in the Risk

Assessment of Operational Events Handbook, Volume 1, Internal Events,

Revision 2.0, and is consistent with the SPAR assumption that emergency

diesel generator B must be capable of performing its risk-significant function

for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following an accident. This resulted in an applied exposure time

of 243 days plus the repair time of 3.16 days.

2. No recovery credit was given based on the nature of the failure. It took

approximately 76 hours8.796296e-4 days 0.0211 hours 1.256614e-4 weeks 2.8918e-5 months to repair the failed components and restore

emergency diesel generator B to service.

3. A postulated seismic event could result in a long-term demand for the

emergency diesel generators. A seismic event would likely result in a loss of

offsite power caused by failure of the offsite power supply insulators that were

not easily repairable. As a result, the increased risk from the failure of

emergency diesel generator B as a result of seismic initiators was included as

part of the external events analysis.

4. A postulated tornado could result in long-term demand for the emergency

diesel generators. High winds would likely result in a loss of offsite power

caused by failure of the offsite power supply towers and were not easily

repairable. As a result, the increased risk from the failure of emergency

diesel generator B based on high winds was included as part of the external

events analysis.

5. The performance deficiency was a contributor to fire-induced core damage.

Emergency diesel generator B is relied upon in the fire hazards analysis.

Control room abandonment sequences were significant for this failure

because emergency diesel generator B is the only power supply described in

response procedures. Therefore, the unavailability of emergency diesel

generator B had increased risk significance for control room abandonment

sequences and was included in the external event sequences.

6. A postulated control room fire that was not suppressed in 20 minutes would

result in control room abandonment. However, not all cabinet fires can

actually cause a loss of offsite power (LOOP), consequently, offsite power

would remain available in most instances and could be restored if needed.

By procedure, the licensee intentionally causes station blackout conditions

when abandoning the control room to ensure that they have control of their

protected equipment.

A2-2

7. Despite control room abandonment procedures relying solely on emergency

diesel generator B, additional power sources available would include station

blackout emergency diesel generators, offsite power, and emergency diesel

generator A, provided the power supply and/or the associated equipment

were not damaged by the postulated fire.

8. Despite being a 4-hour coping plant, vital batteries would last for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months prior

to depletion without load shedding. The licensee provided information related

to this assumption and it was used in control room abandonment human

reliability analysis calculations.

9. Upon loss of emergency diesel generator B, following a postulated control

room abandonment, the turbine-driven auxiliary feedwater pump would

continue to operate until battery depletion.

10. Following a postulated control room abandonment, offsite power would be

connected to train A bus NB01 if it was not affected by the control room fire

initiator. Therefore, instrumentation would be continuously available at the

remote shutdown panel for train A and train A equipment would be available

for mitigation efforts upon restoration to the bus.

11. Emergency diesel generator A can be started locally by plant operators as

defined in site procedures. Therefore, this generator would potentially be

available as a power source following a postulated control room

abandonment.

12. The increased stress on the diodes and power potential transformers

degraded only during times that the emergency diesel generator was running,

defined as a run-time failure. This implies that no degradation occurred while

the emergency diesel generator was secured and in a standby status. It is

further assumed that the failure was a deterministic outcome set to occur

after a specific number of operating hours. Therefore, emergency diesel

generator B would have failed to run at 2.98 hours0.00113 days 0.0272 hours 1.62037e-4 weeks 3.7289e-5 months following a LOOP demand

at any time during the 27-day, 16-hour period from its last successful

surveillance test on September 8, 2014, until the test failure that occurred on

October 6, 2014.

13. Similar to Assumption 12, emergency diesel generator B would have run and

failed at the run time provided in Table 1 for the associated exposure period

documented in that table for each of the additional seven periods from

February 5, 2014, to September 8, 2014.

14. Emergency diesel generator B exceeded 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of run time for the period

prior to February 5, 2014. Given the total run time assumption, any time prior

to this date, emergency diesel generator B would have run for greater than

the 24-hour mission time. Therefore, this date is chosen as the cutoff for this

analysis.

15. The licensee would be unable to recover emergency diesel generator B

within the 24-hour mission time.

A2-3

16. The Wolf Creek Generating Station SPAR model, Version 8.26 (as modified),

was an appropriate tool to use in this analysis, provided offsite power

nonrecovery probabilities are adjusted based on each assumed run time of

emergency diesel generator B. A cutset truncation of 1.0E-12 was used for

all runs. Average test and maintenance was assumed.

17. Although the station blackout emergency diesel generators were not available

from February 5, 2014, to April 25, 2014, the analyst assumed the SBO

diesels were available with nominal failure rates.

NOTE: From February 5, 2014 to April 25, 2014, a period of 79 days, the

newly installed station blackout emergency diesel generators were not

available. On June 23, 2016, the Significance and Enforcement Review

Panel determined that no mitigation credit should be applied for the 79 day

period where the SBO diesel would have not functioned. The NRC

determined that mitigation credit for a new modification for the station

blackout diesel generators was not warranted because the equipment was

not verified to be capable of performing its risk mitigation function. As a

result, the SERP determined that sensitivity analysis #4 should be included in

the preliminary risk significance determination. The use of sensitivity #4

increased the risk significance into the low to moderate risk category (White).

(3) Significance Determination Process Assessment:

The analyst estimated the risk increase resulting from the emergency diesel

generator B generator field excitation circuit component failures. The analyst

determined that the licensee had operated emergency diesel generator B at the

times and with the durations indicated in Table 1, Emergency Diesel

Generator B Run and Exposure Time Periods. These were reported as the

period of time that the emergency diesel generator B generator field excitation

circuit components would have been subject to thermal induced aging. Note that

the operational runs were conducted after the performance deficiency occurred.

Table 1 - Emergency Diesel Generator B Run and Exposure Time Periods

Event Date Time Run Time Exposure

Repaired October 9, 2014 17:17 0 3 days 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Failed during October 6, 2014 02.98 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 27 days, 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months

24-hr test

Surveillance September 8, 2014 01.57 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , 33 minutes 33 days, 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months

Surveillance August 6, 2014 02.11 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , 40 minutes 27 days, 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months

Surveillance July 9, 2014 02.58 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , 15 minutes 27 days, 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months

Surveillance June 11, 2014 06.45 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months , 42 minutes 39 days, 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months

Surveillance May 3, 2014 01.42 17 hours1.967593e-4 days 0.00472 hours 2.810847e-5 weeks 6.4685e-6 months , 7 minutes 35 days, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

Surveillance March 28, 2014 04.73 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months , 51 minutes 19 days, 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months

Surveillance March 9, 2014 01.16 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months 32 days, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Surveillance February 5, 2014 01.62 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , 37 minutes 24 days, 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months

A2-4

Internal Events Analysis:

A. Risk Estimate for the 27-day, 16-hour period between September 8, 2014,

and October 6, 2014:

During this exposure period, emergency diesel generator B would have been capable of

running for 2.98 hours0.00113 days 0.0272 hours 1.62037e-4 weeks 3.7289e-5 months (used 3.0 hours0 days 0 hours 0 weeks 0 months in the analysis). The analyst adjusted the LOOP

frequency used in the analysis to reflect the situation that only LOOPs with durations

greater than 3.0 hours0 days 0 hours 0 weeks 0 months would result in a risk increase attributable to the diesel generator

component failures. Using the SPAR model the analyst determined the base LOOP

frequency was 3.59E-2/year.

Similarly, each of the four LOOP categories have the following frequencies:

Grid-Related LOOP GR 1.22 x 10-2

Plant-Centered LOOP PC 1.93 x 10-3

Switchyard-Centered LOOP SC 1.04 x 10-2

Weather-Related LOOP WR 3.91 x 10-3

The nonrecovery values for 3.0 hours0 days 0 hours 0 weeks 0 months in each LOOP category were developed using the

plant-specific SPAR. Additionally, the analyst determined that the best mathematical

representation for the nonrecovery of one of one emergency diesel generator was the

square root of the nonrecovery for one of two. The resulting values were as follows:

Grid-Related LOOP P(NR3.0)GR 2.50 x 10-1

Plant-Centered LOOP P(NR3.0)PC 1.12 x 10-1

Switchyard-Centered LOOP P(NR3.0)SC 1.45 x 10-1

Weather-Related LOOP P(NR3.0)WR 4.80 x 10-1

Emergency Diesel Generators (1of2) P(NR3.0)1of2 7.45 x 10-1

Emergency Diesel Generators (1of1) P(NR3.0)1of1 8.63 x 10-1

To account for having one of two emergency diesel generators to recover during the

first 3.0 hours0 days 0 hours 0 weeks 0 months (emergency diesel generator B is assumed to be running during the

first 3.0 hours0 days 0 hours 0 weeks 0 months of the event), the emergency diesel generator nonrecovery factor was

adjusted to the square root of the base nonrecovery factor for both emergency diesel

generators at 3.0 hours0 days 0 hours 0 weeks 0 months . This adjusts the nonrecovery from both emergency diesel

generators to a single emergency diesel generator. Therefore, the adjusted (current

case) LOOP frequency (LOOP), representing the frequency of LOOPs that are not

recovered in 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months by either restoring offsite power or recovering a failure of

Emergency Diesel Generator A is:

LOOP = CAT * P(NR3.0) * P(NR3.0)1of1

For each of the four LOOP categories.

For the base case, the adjusted LOOP frequency includes the potential that either of the

emergency diesel generators are recovered. Therefore the base case LOOP (Base)

frequency is:

LOOP = CAT * P(NR3.0) * P(NR3.0)1of2

A2-5

For each of the four LOOP categories. The results of these calculations are

documented in Table 2.

Table 2 - Adjusted Loss of Offsite Power Frequencies

LOOP Category LOOP LOOP Single Diesel Two Diesel Adjusted LOOP

Frequency

Frequency Nonrecovery Nonrecovery Nonrecovery Base Case

Grid-Related 1.22E-02 2.50E-01 8.63E-01 7.45E-01 2.27E-03 2.63E-03

Plant-Centered 1.93E-03 1.12E-01 8.63E-01 7.45E-01 1.61E-04 1.86E-04

Switchyard- 1.04E-02 1.45E-01 8.63E-01 7.45E-01 1.13E-03 1.30E-03

Centered

Weather-Related 3.91E-03 4.80E-01 8.63E-01 7.45E-01 1.40E-03 1.62E-03

The analyst used the SPAR model to determine the conditional core damage probability of a

station blackout that occurred for each of the four LOOP categories. The analyst modified the

SPAR to establish the conditions for a station blackout after emergency diesel generator B

operated for 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . The analyst set initiating event basic event failure probability to 1.0 for

each LOOP category. Resetting station blackout time t=0 to 3.0 hours0 days 0 hours 0 weeks 0 months following the LOOP

event requires that the recovery factors for offsite power and the emergency diesel generators

be adjusted. For example, for the 1-hour sequences in SPAR, the basic event for nonrecovery

of offsite power should be adjusted to the nonrecovery at 4.0 hours0 days 0 hours 0 weeks 0 months , given that recovery has

failed at 3.0 hours0 days 0 hours 0 weeks 0 months . The analyst used the adjusted nonrecovery factors for the four LOOP

categories as listed in the last column in Table 2, Offsite Power Nonrecovery Probabilities and

used the adjusted nonrecovery factors for the onsite electric power supplies as listed in the last

column in Table 3, Offsite Power Nonrecovery Probabilities. After adjusting SPAR for the

LOOPs and the adjusted nonrecovery probabilities, the analyst used common cause failure of

both emergency diesel generators to model the conditions for a station blackout. The analyst

included the resulting SPAR model station blackout conditional core damage probabilities for

each LOOP category in Table 4, Emergency Diesel Generator A Nonrecovery Probabilities

(Base).

Table 3 presents the adjusted offsite power nonrecovery factors for the event times that are

relevant in the SPAR core damage cut sets.

A2-6

Table 3 - Offsite Power Nonrecovery Probabilities

SPAR LOOP SPAR base SPAR base SPAR base SPAR

recovery category offsite power offsite power offsite power recovery

time nonrecovery nonrecovery nonrecovery (Column 5

at 3.0 hours0 days 0 hours 0 weeks 0 months at 3.0 hours0 days 0 hours 0 weeks 0 months + divided by

SPAR Column 4)

recovery time

in Column 1

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months GR 0.6587 0.2496 0.1685 0.6751

PC 0.3309 0.1117 0.0775 0.6941

SC 0.4014 0.1453 0.1024 0.7047

WR 0.6868 0.4800 0.4244 0.8842

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months GR 0.3915 0.2496 0.1189 0.4764

PC 0.1763 0.1117 0.0570 0.5105

SC 0.2240 0.1453 0.0761 0.5234

WR 0.5589 0.4800 0.3822 0.7963

3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months GR 0.2496 0.2496 0.0869 0.3480

PC 0.1117 0.1117 0.0437 0.3908

SC 0.1453 0.1453 0.0587 0.4037

WR 0.4800 0.4800 0.3487 0.7265

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months GR 0.1685 0.2496 0.0652 0.2612

PC 0.0775 0.1117 0.0344 0.3083

SC 0.1024 0.1453 0.0465 0.3203

WR 0.4244 0.4800 0.3213 0.6694

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months GR 0.0869 0.2496 0.0392 0.1569

PC 0.0437 0.1117 0.0229 0.2047

SC 0.0587 0.1453 0.0312 0.2145

WR 0.3487 0.4800 0.2786 0.5804

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months GR 0.0501 0.2496 0.0251 0.1004

PC 0.0278 0.1117 0.0162 0.1448

SC 0.0377 0.1453 0.0221 0.1524

WR 0.2982 0.4800 0.2466 0.5138

Table 4 represents the emergency diesel generator A nonrecoveries used to adjust the

SPAR model assuming emergency diesel generator B operated for 3.0 hours0 days 0 hours 0 weeks 0 months then failed.

Again, these values are conditional probabilities used to adjust timing in the SPAR. For

example, for the 1-hour sequences in SPAR, the basic event for nonrecovery of

emergency diesel generator A should be adjusted to the nonrecovery at 4.0 hours0 days 0 hours 0 weeks 0 months , given

that recovery has failed at 3.0 hours0 days 0 hours 0 weeks 0 months .

A2-7

Table 4 Emergency Diesel Generator A Nonrecovery Probabilities (Base)

SPAR SPAR base SPAR base DG SPAR base DG Modified SPAR

recovery nonrecovery for nonrecovery at nonrecovery at recovery

time 1 of 2 DGs 3.0 hours0 days 0 hours 0 weeks 0 months for 1 3.0 hours0 days 0 hours 0 weeks 0 months + (Column 4

of 2 DGs SPAR recovery divided by

time in Column 1 Column 3)

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 0.8712 0.7451 0.6984 0.9373

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 0.8006 0.7451 0.6579 0.8830

3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 0.7451 0.7451 0.6220 0.8348

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 0.6984 0.7451 0.5897 0.7914

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 0.6220 0.7451 0.5336 0.7161

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 0.5604 0.7451 0.4860 0.6523

Table 5 includes the following values developed and/or quantified using the plant-specific SPAR

model:

Independent failure probabilities of each diesel generator (P(NE01 Failure) and

P(NE02 Failure));

The base LOOP initiation frequency (LOOP Initiation);

Total probability of common cause failure of both diesel generators

(CCF 2of2 DGs);

Common cause failure of an emergency diesel generator given that a single

emergency diesel generator is unavailable (CCF 1of1 DGs); and

The adjusted station blackout conditional core damage probabilities for each

LOOP category (SBO CCDP-xx (3.0)) after emergency diesel generator B

operated for 3.0 hours0 days 0 hours 0 weeks 0 months .

Table 5 - Factors Used in 27.647-day

Exposure Period with 3-hour Run Time

LOOP Initiation 3.59E-02 /year

P(NE01 Failure) 7.40E-02

P(NE02 Failure) 7.40E-02

CCF 2of2 DGs 2.25E-04

CCF 1of1 DGs 7.94E-03

SBO CCDP-GR (3.0) 1.24E-03

SBO CCDP-PC (3.0) 1.32E-03

SBO CCDP-SC (3.0) 1.34E-03

SBO CCDP-WR (3.0) 8.94E-03

The analyst performed hand calculations to determine the core damage frequency that

would result from a station blackout given that emergency diesel generator B operated

A2-8

for 3.0 hours0 days 0 hours 0 weeks 0 months then failed using the data in Table 5. Therefore, the current case adjusted

station blackout core damage frequency (CDFSBO-Case) representing the frequency of

station blackouts leading to core damage, given that the associated LOOP was not

recovered in 3.0 hours0 days 0 hours 0 weeks 0 months by either restoring offsite power or recovering a failure of

emergency diesel generator A is:

CDFSBO-Case = LOOP * (P(NE01 Failure) + CCF 1of1 DGs) * SBO CCDPCat

For each of the four LOOP categories.

For the base case, the adjusted core damage frequency from a station blackout

(CDFSBO-base) includes the potential that either of the emergency diesel generators are

recoverable. Therefore the base case station blackout core damage frequency is:

CDFSBO-base = Base * [(P(NE01 Failure) * P(NE02 Failure)) + CCF 2of2 DGs] * SBO

CCDPCat

For each of the four LOOP categories.

The sum of the CDFSBO-Base categories (shown in the calculation above) represents the

total adjusted SPAR base case result. This result was 9.71 x 10-8/year. Similarly, the

total current case result (sum of the CDFSBO-Case categories) was 1.62 x 10-6/year.

Therefore, the estimated incremental conditional core damage probability for the 27-day,

16-hour period during which emergency diesel generator B was assumed to be in a

condition that guaranteed its failure at 3.0 hours0 days 0 hours 0 weeks 0 months is:

(1.62 x 10-6/year - 9.71 x 10-8/year) * (27.65 days/365 days/year) = 1.15 x 10-7

B. Summary of Risk Estimate for Seven Additional Run Time Periods:

During each exposure period indicated in Table 1, emergency diesel generator B would

have been capable of running for its associated run time listed in the table. For

simplicity, all run times were rounded to the nearest half hour. The analyst then adjusted

the LOOP frequency and nonrecovery probabilities to reflect the situation that only

LOOPs with durations greater than the run time would result in a risk increase

attributable to the emergency diesel generator component failures. These calculations

were developed in the same manner as the first exposure period documented in

Section A. The resulting incremental conditional core damage probability for each

exposure period was then documented in Table 6.

C. Risk during the Repair Period from October 6, to October 9, 2014:

As a result of the performance deficiency, during the time on October 6, 2014, at

1:26 p.m. when emergency diesel generator B tripped until October 9, 2014, at 5:17 p.m.

when the diesel was started after repairs, the machine was out of service and was

unavailable for response. The analyst determined the model baseline is

4.00 x 10-6/year. The analyst established the current case by setting the emergency

diesel generator B fail-to-run basic event to the house event TRUE. The resulting

conditional core damage frequency was 8.75 x 10-6/year.

A2-9

Therefore, the estimated incremental conditional core damage probability of the

3.16-day period during which emergency diesel generator B was unavailable for

response if it had been demanded was:

(8.75 x 10-6/year - 4.00 x 10-6/year) * (3.16 days/365 days/year) = 4.11 x 10-8

D. Internal Events Result:

Table 6 - Internal Events Incremental Conditional Core Damage Probability

Exposure Period ICCDP

27 days, 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Period (09/08 - 10/06/2014) 1.15 x 10-7

33 days, 14 hour1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months Period (08/06 - 09/08/2014) 1.10 x 10-7

27 days, 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Period (07/09 - 08/06/2014) 7.14 x 10-8

27 days, 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Period (06/11 - 07/09/2014) 5.66 x 10-8

39 days, 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Period (05/03 - 06/11/2014) 5.20 x 10-8

35 days, 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Period (03/28 - 05/03/2014) 4.15 x 10-8

19 days, 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months Period (03/09 - 03/28/2014) 1.76 x 10-8

32 days, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Period (02/05 - 03/09/2014) 2.78 x 10-8

3-day, 4-hour Repair Period (07/13/15) 4.11 x 10-8

Total Internal Events ICCDP 5.34 x 10-7

E. Placing Station Blackout Emergency Diesel Generators in Service:

The analysts noted that the station blackout emergency diesel generators were not

modeled in the limited use plant-specific SPAR model for internal events evaluations.

Therefore, the analyst performed a SPAR-H human reliability analysis methodology to

quantify the probability of operator failure to place the station blackout emergency diesel

generators in service following a postulated loss of all alternating current power event.

Given input from the licensee and inspectors, the analyst calculated a reasonable value

for the probability that operators would fail to start the station blackout emergency diesel

generators. The analyst considered this an infrequently performed evolution and

determined that the operators had appropriate procedures and had been trained.

For this analysis, the analyst assumed that sufficient time and expertise was available to

perform these activities within one hour. One hour response time was to account for the

most limiting core damage sequences in the SPAR. In these sequences the turbine-

driven auxiliary feedwater pump fails to function. The results of this analysis are

presented in Table 7, Operator Fails to Place Station Blackout Diesels in Service in

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

A2-10

Table 7 - Operator Fails to Place Station Blackout Diesels in Service in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Performance Shaping Diagnosis Action

Factor

PSF Level Multiplier PSF Level Multiplier

Time: Nominal 1.0 Nominal 1.0

Stress: High 2.0 High 2.0

Complexity: Nominal 1.0 Nominal 1.0

Experience: Nominal 1.0 Nominal 1.0

Procedures: Diagnostic 0.5 Nominal 1.0

Ergonomics: Nominal 1.0 Nominal 1.0

Fitness for Duty: Nominal 1.0 Nominal 1.0

Work Processes: Nominal 1.0 Nominal 1.0

Nominal 1.00E-02 1.00E-03

Adjusted 1.00E-02 2.00E-03

Odds Ratio: 1.00E-02 Odds Ratio: 2.00E-03

Failure to Recovery Probability: 1.20E-02

The nominal time for performing the actions was estimated to be approximately

20 minutes once the failure had been identified. The analyst assumed a 20-minute time

frame from failure to diagnosis of the need to use the station blackout emergency diesel

generators. Therefore, nominal credit for time available was applied for both diagnosis

and action. High stress was assumed because the unit would be in a station blackout

condition. Diagnostic procedures directly applying to the condition were available and

followed the response not obtained format.

The analyst used this information and included this failure to recovery probability in the

limited use SPAR model to account for the likelihood that operators would fail to start the

station blackout emergency diesel generators. This modified SPAR model was then

used in all evaluations.

External Events Analysis

In accordance with Manual Chapter 0609, Appendix A, The Significance Determination

Process (SDP) For Findings At-Power, issued June 19, 2012, Section 6.0, Detailed Risk

Evaluation, when the internal events detailed risk evaluation results are greater than or

equal to 1.0E-7, the finding should be evaluated for external event risk contribution.

Therefore, the analyst assessed the impact of external initiators because the internal events

detailed risk evaluation resulted in a core damage frequency of 5.34 x 10-7. The

methodology used to assess the impact of external events was to evaluate each initiator for

the potential to:

Increase the likelihood of a loss of offsite power

A2-11

Impact the reliability or availability of mitigating systems used during a loss of offsite

power

The analyst referenced the Wolf Creek Generating Station Individual Plant Examination of

External Events (IPEEE), dated November 15, 1995. The analyst reviewed the IPEEE and

concluded that the 1975 standard review plan criteria were met for floods, transportation

accidents and nearby facility accidents, so those events were not considered further. The

weather-related LOOP initiator was already included in the SPAR model. The remaining

external accident initiators included seismic, fire, and high wind.

A. Seismic

Seismic Calculation: The analyst assumed that a seismic event would not result in

failure of emergency diesel generator B because the median capacity of a generic

emergency diesel generator is 1.45g peak ground acceleration, which is significantly

higher than the dominate ranges in the Wolf Creek seismic hazard curve. However, the

analyst noted that the dominant risk would result when a seismic event was large

enough to destroy the switchyard insulators causing a nonrecoverable LOOP. As a

bounding assumption, for all seismically induced LOOPs, the analyst assumed

Emergency Diesel Generator B would fail at time zero (0).

As such, the analyst evaluated the subject performance deficiency by determining each

of the following parameters for any seismic event producing a given range of median

acceleration a [SE(a)]:

1. The frequency of the seismic event SE(a) ( SE(a));

2. The probability that a LOOP occurs during the event (P LOOP-SE(a));

3. The baseline core damage probability (CCDP SE(a)); and

4. The case conditional core damage probability (CCDP B-SE(a)).

The CDF for the acceleration range in question (CDF SE(a)) can then be quantified as

follows:

CDF SE(a) = SE(a) * P LOOP-S. E(a) * (CCDP B-SE(a) - CCDP SE(a))

Given that each range a was selected by the analyst specifically to be independent of

all other ranges, the total increase in risk, CDF, can be quantified by summing the

CDFSE(a) for each range evaluated as follows:

8

CDF = CDFSE(a)

a=.05

over the range of SE(a).

Conditional Core Damage Probability: The analyst calculated the likelihood of a

seismically-induced LOOP using the seismic hazard defined in the Risk Assessment of

Operational Events Handbook, Volume 2, External Events. The analyst quantified a

nonrecoverable LOOP using the plant-specific SPAR model as the baseline conditional

core damage probability (3.31 x 10-5). The analyst then quantified the risk increase

caused by the failure of emergency diesel generator B. The case conditional core

A2-12

damage probability was 3.17 x 10-4. This resulted in a change in the conditional core

damage probability of 2.84 x 10-4.

Seismic Binning: NRC research data indicated that seismic events of 0.05g peak

ground acceleration or less have little to no impact on internal plant equipment.

Therefore, the analyst assumed that seismic events less than 0.05g do not directly affect

the plant. The analyst assumed that seismic events greater than 8.0g lead directly to

core damage. The analyst therefore examined seismic events in the range of 0.05g to

8.0g.

The analyst divided that range of seismic events into segments (called bins hereafter);

specifically, seismic events from 0.05g to 0.08g to 0.15g to 0.25g to 0.30g to 0.40g to

0.50g to 0.65g to 0.80g to 1.00g to 8.00g were each binned.

In order to determine the frequency of a seismic event for a specific range of ground

motion (g in peak ground acceleration), the analyst used the seismic hazard for Wolf

Creek and obtained values for the frequency of the seismic event that generates a level

of peak ground acceleration that exceeds the lower value in each of the bins. The

analyst then calculated the difference in these frequency of exceedance values to

obtain the frequency of seismic events for the binned seismic event ranges.

For example, the frequency of exceedance for a 0.25g seismic event at Wolf Creek is

estimated at 1.53 x 10-5/year and a 0.30g seismic event at 9.86 x 10-6/year. The

frequency of seismic events with median acceleration in the range of 0.25g to 0.30g

[SE(0.35-0.30)] equals the difference, 5.40 x 10-6/year.

Probability of a Loss of Offsite Power: The analyst assumed that a seismic event

severe enough to break the ceramic insulators on the transmission lines will cause an

unrecoverable LOOP.

The analyst obtained data on switchyard components from the Risk Assessment of

Operating Events Handbook; Volume 2, External Events, Revision 4, and other

referenced documents. The references describe the mean failure probability for various

equipment using the following equation:

Pfail(a) = [ ln(a/am) / (r2 + u2)1/2]

Where is the standard normal cumulative distribution function and

a= median acceleration level of the seismic event;

am= median of the component fragility (capacity);

r= logarithmic standard deviation representing random uncertainty;

u= logarithmic standard deviation representing systematic or modeling

uncertainty.

In order to calculate the LOOP probability given a seismic event the analyst used the

following generic seismic fragility:

am = 0.30g

r = 0.30

u = 0.45

A2-13

fire areas in the power block because they could cause a nonrecoverable LOOP;

however, they were determined to not be a significant risk contributor.

Analysis of Risk Associated with Fire Areas that Could Cause a LOOP:

The analyst quantified base case and current case values using the SPAR for a

nonrecoverable LOOP as listed in Table 10. To establish the base case, the analyst set

the failure probability for each category of LOOP to a failure probability of 1.0 and set

each operator basic event for recovering each category of LOOP for any time period to

the house event TRUE indicating that power recovery was not possible. The current

case reflected the nonrecoverable LOOP and the failure of emergency diesel

generator B at time zero. The failure of emergency diesel generator B was developed

by setting the Failure-To-Run and Test and Maintenance basic events equal to the

house event TRUE and setting the Failure-To-Start basic event equal to the house event

FALSE.

Table 10 - Nonrecoverable LOOP

CCDP

Baseline 3.31E-05

Case (EDG Fails) 3.17E-04

Delta 2.84E-04

The analyst performed hand calculations to determine the change in core damage

frequency that would result from a fire in plant areas coincident with a nonrecoverable

LOOP using the data in Table 10. The analyst obtained the fire initiation frequencies

(FIFCC-1D & FIFCC-1F) for the affected fire areas from the licensees IPEEE. The analyst

chose a severity factor of 0.1, from Inspection Manual Chapter 0609, Appendix F, Fire

Protection Significance Determination Process, Task 2.4.1, Nominal Fire Frequency

Estimation. This severity factor accounts for the likelihood that the initiated fire would

grow to a level that would result in a LOOP. The analyst first determined the base case

core damage frequency for the individual fire areas by performing the following

calculations:

CDFBase CC-1D = FIFCC-1D/year * SF * CCDPBase

= 7.24 x 10-4/year * 0.1 * 3.31 x 10-5

= 2.40 x 10-9/year

CDFBase CC-1F = FIFCC-1F/year * SF * CCDPBase

= 3.42 x 10-3/year * 0.1 * 3.31 x 10-5

= 1.13 x 10-8/year

Similarly, the analyst determined the current case core damage frequency for the

individual fire areas:

CDFCase CC-1D = FIFCC-1D/year * SF * CCDPCase

A2-15

= 7.24 x 10-4/year * 0.1 * 3.17 x 10-4

= 2.30 x 10-8/year

CDFCase CC-1F = FIFCC-1F/year * SF * CCDPCase

= 3.42 x 10-3/year * 0.1 * 3.17 x 10-4

= 1.08 x 10-7/year

After combining the core damage frequencies for the individual fire areas for the base

case and for the current case, the analyst calculated the delta conditional core damage

frequency and multiplied by the exposure period (EXP) to obtain the incremental

conditional core damage probability.

CDFBase FAs = CDFBase CC-1D + CDFBase CC-1F

= 2.40 x 10-9/year + 1.13 x 10-8/year

= 1.37 x 10-8/year

CDFCase FAs = CDFCase CC-1D + CDFCase CC-1F

= 2.30 x 10-8/year + 1.08 x 10-7/year

= 1.31 x 10-7/year

CCDP = (CDFCase FAs - CDFBase FAs) * EXP

= (1.31 x 10-7/year - 1.37 x 10-8/year) * 242.95 days * 1year/365 days

= 7.83 x 10-8

Control Room Abandonment Caused by a Fire:

A fire in the control room could result in abandonment for numerous reasons. The

licensed operators would relocate to their alternate shutdown panel. The only controls

protected and isolated from a control room fire are associated with train B.

The analyst evaluated the contribution to external risk for control room abandonment

because the licensee relied upon emergency diesel generator B to respond when a

control room fire required abandonment. The fire hazards analysis and plant procedures

specified that emergency diesel generator B was the only power source available at the

remote shutdown panel.

The analyst calculated the frequency of a control room abandonment (Fabandon) by

combining the total control room fire ignition frequency (FIFCR) and the nonsuppression

probability (NSprob) for fires that would lead to abandonment as follows:

Fabandon = FIFCR * NSprob

= 9.73 x 10-3 * 3.40 x 10-3

A2-16

= 3.31 x 10-5/year

The analyst developed an event tree (refer to Figure 1 - Control Room Abandonment

with Emergency Diesel Generator B Failed) to evaluate the risk contribution of a control

room fire that results in abandonment. Operators would relocate to their alternate

shutdown panel, which contains protected and isolated train B controls and some train A

controls. Given the subject performance deficiency, after having established safe and

stable conditions, emergency diesel generator NE02 would fail. Operators would be

successful in protecting the core if power to the train B safety bus (NB02) is restored or if

power to the train A safety bus (NB01) is restored combined with successful operation of

several train A components. The analyst developed several fault trees for this condition

by modifying the existing fault trees in the limited use Wolf Creek SPAR model.

The analyst developed a top event, Train B Powered by SBO Diesels, that related to

operators restoring power to the train B bus using the station blackout emergency diesel

generators. The fault tree accounts for the failure of the diesel generators and

associated equipment as well as the failure of operators to successfully perform the

recovery. The analyst used the SPAR-H methodology to determine the probability of

operator error in connecting the station blackout emergency diesel generators to

Bus NB02. The value used is reflected in Table 11, Operator Fails to Place Station

Blackout Diesels in Service in 8 Hours Following Control Room Abandonment.

According to Assumption 9, the turbine-driven auxiliary feedwater pump would continue

to operate from the time emergency diesel generator B failed until battery depletion. As

stated in Assumption 8, the vital batteries would last for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months without operator

intervention. Therefore, available time to complete this recovery was assumed to be

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for diagnosis and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for taking action.

A2-17

Table 11 - Operator Fails to Place Station Blackout Diesels in Service in 8 Hours Following

Control Room Abandonment

Performance Shaping Diagnosis Action

Factor

PSF Level Multiplier PSF Level Multiplier

Time: Extra 0.1 >5x 0.1

Stress: High 2.0 High 2.0

Complexity: Nominal 1.0 Nominal 1.0

Experience: Nominal 1.0 Nominal 1.0

Procedures: Incomplete 20.0 Nominal 1.0

Ergonomics: Nominal 1.0 Nominal 1.0

Fitness for Duty: Nominal 1.0 Nominal 1.0

Work Processes: Nominal 1.0 Nominal 1.0

Nominal 1.00E-02 1.00E-03

Adjusted 4.00E-01 2.00E-04

Odds Ratio: 3.88E-02 Odds Ratio: 2.00E-04

Failure to Recovery

Probability: 3.90E-02

Using a table top walkthrough of plant procedures and discussions with licensee

personnel, the analyst estimated the nominal time for diagnosing the need to use the

station blackout emergency diesel generators was 20 minutes. Additionally, the analyst

estimated that the nominal time to start and load the diesels following completion of

diagnosis was 20 minutes. Therefore, extra credit for time available was applied for

diagnosis because the time available was between one to two times greater than the

nominal time required and was also greater than 30 minutes. Likewise, the time

available for taking action was determined to be greater than 5 times the nominal time.

High stress was assumed because the unit would be in a station blackout condition with

operators controlling the plant from outside the control room. The analyst assigned

incomplete for diagnostic procedures because the control room abandonment procedure

did not identify using any power source other than emergency diesel generator B.

Procedures for action were assigned nominal, because once operators recognized the

need to align the station blackout emergency diesel generators, specific procedures

were available.

The next top event, Train B Powered from Offsite, identifies the likelihood that offsite

power remains available and that operators restore offsite power to the train B bus. The

associated fault tree reflects the likelihood that a control room fire causes a loss of offsite

power affecting train B. This was done by assuming a postulated fire leading to control

room abandonment could have initiated in any of the 103 control room cabinets

documented in the Individual Plant Evaluation for External Events. There were three

cabinets in the control room that could have resulted in a loss of offsite power.

Therefore, the bounding probability of a control room fire causing a loss of offsite power

A2-18

was 2.91 x 10-2, assuming that all fires in the three cabinets led to an unrecoverable loss

of offsite power. In addition to the loss of offsite power, the event tree models the

conditions that operators would experience in the field if the station blackout emergency

diesel generators were not available. This consideration evaluates the operator failure

probability given the lack of procedures for restoring power outside of the control room.

The analyst used the SPAR-H methodology to determine this probability. The value

used is reflected in Table 12, Operator Fails to Restore Offsite Power to NB02 following

Control Room Abandonment.

As described for the previous top event, based on Assumptions 8 and 9, the analyst

assumed operators had 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for diagnosis and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for taking action.

Table 12 - Operator Fails to Restore Offsite Power to NB02 following Control Room

Abandonment

Performance Shaping Diagnosis Action

Factor

PSF Level Multiplier PSF Level Multiplier

Time: Extra 0.1 >5X 0.1

Stress: High 2.0 High 2.0

Complexity: Nominal 1.0 Nominal 1.0

Experience: Nominal 1.0 Nominal 1.0

Procedures: Incomplete 20.0 Unavailable 50.0

Ergonomics: Nominal 1.0 Nominal 1.0

Fitness for Duty: Nominal 1.0 Nominal 1.0

Work Processes: Nominal 1.0 Nominal 1.0

Nominal 1.00E-02 1.00E-03

Adjusted 4.00E-01 1.00E-02

Odds Ratio: 3.88E-02 Odds Ratio: 9.91E-03

Failure to Recovery

Probability: 4.87E-02

Using a table top walkthrough of plant procedures and discussions with licensee

personnel, the analyst estimated the nominal time for diagnosing the need to restore

offsite power to Bus NB02 would be 60 minutes. This nominal time included the

40 minutes for failure to utilize the station blackout emergency diesel generators plus

20 minutes for the diagnostic evaluation. Additionally, the analyst estimated that the

nominal time to manipulate breakers to supply offsite power to the bus was 30 minutes.

Extra credit for time available was applied for diagnosis because the time available was

between one to two times greater than the nominal time required and was also greater

than 30 minutes. Likewise, the time available for taking action was determined to be

greater than 5 times the nominal time. High stress was assumed because the unit would

be in a station blackout condition with operators controlling the plant from outside the

control room. The analyst assigned the Incomplete performance shaping factor for

diagnostic procedures because the control room abandonment procedure did not identify

A2-19

using any power source other than emergency diesel generator B. Procedures for

action were determined to be incomplete, because once operators recognized the need

to align offsite power to bus NB02, operators had no specific procedures, related to

control room abandonment, for aligning offsite power sources to bus NB02 locally

(i.e., personnel in the Technical Support Center would have to generate the instructions

or operators recognize the need to modify other off-normal procedures).

The analyst noted that there was a direct dependency between the failure of operators to

connect the station blackout emergency diesel generators to bus NB02 and the failure of

operators to restore offsite power to the same bus. Therefore, the analyst used the

SPAR-H Method to quantify this dependency. The analyst found that the diagnosis and

actions would be performed by the same crew, they would not be close in time because

of the sequencing of the actions, they would be performed in the same location, but

there would be the additional cues of no voltage on the bus and operator reports of

failure of the system. This was considered moderate dependency and the dependent

failure probability (Pdep) was calculated as follows:

Pdep = (1 + 6 * Pind) ÷ 7

= (1 + 6 * 4.87 x 10-2) ÷ 7

= 1.85 x 10-1

The next top event, Train A Powered from Offsite, models offsite power or diesel

generator NE01 supplying power to bus NB01 and powering train A equipment. The

analyst noted that if offsite power is available to train A, plant procedures leave power

aligned to bus NB01. Therefore, provided the control room fire did not affect offsite

power to train A, bus NB01 will remain energized and available for use to the operators.

If offsite power is not available, the associated fault tree models equipment failures

associated with diesel generator NE01 and the operators action to diagnose the need

and actions to restore power to bus NB01 using the diesel generator. The analyst used

the SPAR-H methodology to determine the latter probability. The value used is reflected

in Table 13, Operator Fails to Place Emergency Diesel Generator A in Service in

8 Hours following Control Room Abandonment.

As described for the previous top event, based on Assumptions 8 and 9, the analyst

assumed operators had 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for diagnosis and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for taking action.

A2-20

Table 13 - Operator Fails to Place Emergency Diesel Generator A in Service in 8 Hours

following Control Room Abandonment

Performance Diagnosis Action

Shaping Factor PSF Level Multiplier PSF Level Multiplier

Time: Nominal 1.00 Nominal 1.0

Stress: High 2.0 High 2.0

Complexity: Nominal 1.0 Nominal 1.0

Experience: Nominal 1.0 Nominal 1.0

Procedures: Incomplete 20.0 Nominal 1.0

Ergonomics: Nominal 1.0 Nominal 1.0

Fitness for Duty: Nominal 1.0 Nominal 1.0

Work Processes: Nominal 1.0 Nominal 1.0

Nominal 1.00E-02 1.00E-03

Adjusted 4.00E-01 2.00E-03

Odds Ratio: 2.88E-01 Odds Ratio: 2.00E-03

Failure to

Recovery

Probability: 2.90E-01

Using a table top walkthrough of plant procedures and discussions with licensee

personnel, the analyst estimated the nominal time for diagnosing the need to restore

power to bus NB01 using emergency diesel generator A would be 135 minutes. This

nominal time included the delay that resulted from failure to provide power using the

station blackout emergency diesel generators (40 minutes), failure to provide power to

bus NB02 (50 minutes), time evaluating the status of offsite power to bus NB01

(15 minutes), and deciding to use emergency diesel generator A (30 minutes).

Additionally, the analyst estimated that the nominal time to locally start and connect

emergency diesel generator A would be 60 minutes. High stress was assumed because

the unit would be in a station blackout condition with operators controlling the plant from

outside the control room. The analyst assigned the Incomplete performance-shaping

factor to procedures for diagnosis because the control room abandonment procedure did

not identify using emergency diesel generator A. Procedures for action were determined

to be of nominal condition, because once operators recognized the need to use

emergency diesel generator A, specific procedures were available to locally start the

diesel generator.

The analyst noted that there was a direct dependency between the failure of operators to

restore power to bus NB02 and the failure of operators to restore power to bus NB01

using diesel generator NE01. Therefore, the analyst used the SPAR-H Method to

quantify this dependency. The analyst found that the diagnosis and actions would be

performed by the same crew, they would not be close in time because of the sequencing

of the actions, they would be performed in different locations, and there would be no

additional cues that bus NB01 required power. This was considered moderate

dependency and the dependent failure probability (Pdep) was calculated as follows:

Pdep = (1 + 6 * Pind) ÷ 7

A2-21

= (1 + 6 * 2.90 x 10-1) ÷ 7

= 3.91 x 10-1

Upon entry into the event tree, operators had already been successful using train B

equipment to place the reactor in a safe and stable condition. However, there are no

procedures for continuing to cool and stabilize the reactor using train A equipment, nor

has the equipment needed been challenged. Therefore, the next four top events model

the operators ability to continue stable shutdown conditions with train A equipment and

the availability of the principle systems necessary.

The next top event, Operators Fail to Shutdown Plant, models the probability of

operators failing to properly diagnose the need and take actions to continue plant

shutdown using train A equipment following control room abandonment. The analyst

used the SPAR-H methodology to determine this probability. The value used is reflected

in Table 14, Operator Fails to Cool Reactor from train A following Control Room

Abandonment.

As described for the previous top event, based on Assumptions 8 and 9, the analyst

assumed that there were 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months available for response from the time that emergency

diesel generator B failed. With the estimated nominal time to provide power to

bus NB01 of approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the analyst assumed that operators had 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months for

diagnosis and 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months for taking action. The analyst also assumed that operators had

recognized that offsite power was available to NB01 or decided to provide power to

train A equipment using emergency diesel generator A.

Table 14 - Operator Fails to Cool Reactor from Train A following Control Room

Abandonment

Performance Diagnosis Action

Shaping Factor PSF Level Multiplier PSF Level Multiplier

Time: Extra 0.10 Nominal 1.0

Stress: High 2.0 High 2.0

Complexity: Nominal 1.0 Moderate 2.0

Experience: Nominal 1.0 Nominal 1.0

Procedures: Not available 50.0 Not available 50.0

Ergonomics: Nominal 1.0 Nominal 1.0

Fitness for Duty: Nominal 1.0 Nominal 1.0

Work Processes: Nominal 1.0 Nominal 1.0

Nominal 1.00E-02 1.00E-03

Adjusted 1.00E-01 2.00E-01

Odds Ratio: 9.17E-02 Odds Ratio: 1.67E-01

Failure to Recovery

Probability: 2.59E-01

A2-22

Using a table top walkthrough of plant procedures and discussions with licensee

personnel, the analyst estimated the nominal time for diagnosing the appropriate

methods to use train A equipment to stabilize the plant following power recovery to

bus NB01 would be 20 minutes. Additionally, the analyst estimated that the nominal

time to perform these actions and place train A equipment in service would be

60 minutes. Therefore, extra credit for time available was applied for diagnosis because

the time available was between one to two times greater than the nominal time required

and was also greater than 30 minutes. However, only nominal time was applied to the

action step because the nominal time to perform these actions was less than 5 times the

time available. High stress was assumed because the unit would be in a station

blackout condition with operators controlling the plant from outside the control room.

The analyst applied the Nominal performance shaping factor for complexity in

diagnosis because the equipment needed were similar to those previously used in

controlling the plant using train B. However, the analyst assigned a moderate

complexity for actions because of the need to identify components and equipment

required to start after confirming availability on the remote shutdown panel and involved

field operations of charging pump A. The analyst determined that procedures were not

available to diagnose or to take action to use train A equipment because the procedure

for control room abandonment relies on operating train B equipment.

For the remaining three top events, the analyst evaluated the availability of certain

train A equipment to operate following the control room abandonment. Each of the

following three systems were modeled:

Auxiliary Feedwater

Atmospheric Dump Valves

Reactor Coolant System Charging

In each respective fault tree, the analyst used portions of SPAR fault trees to model the

failure of associated equipment. Additionally, the analyst evaluated the probability that

the system survived damage from the control room fire because train A components are

not protected from damage in a control room fire. This probability was calculated by

determining the number of control room cabinets that could result in a failure of the

respective system divided by the total control room population. The licensee provided

that there were two cabinets affecting train A auxiliary feedwater, three cabinets affecting

atmospheric dump valves and an additional three cabinets affecting the train A charging

system. The resulting bounding probabilities of fire-induced system failure were as

follows:

Auxiliary Feedwater 1.94 x 10-2

Atmospheric Dump Valves 2.91 x 10-2

Charging 2.91 x 10-2

Control Room Abandonment Results: The analyst quantified the event tree to assess

the risk from postulated fires resulting in control room abandonment. A cutset truncation

of 1.0 x 10-15 was used for all runs. The incremental conditional core damage probability

was determined to be 8.3 x 10-8 over the 243-day exposure period.

A2-23

C. High Winds

The risk increase from external events related to wind that could result in a

nonrecoverable LOOP had more than minimal risk. A category EF2 or greater tornado

could result in loss of the offsite power lines that would not be quickly repairable. The

analyst obtained the frequency of a category EF2 tornado occurring onsite using the

data developed by the Office of Nuclear Reactor Research utilizing the methodology

from NUREG/CR-4461, Tornado Climatology of The Contiguous United States,

Revision 2.

The analyst obtained base case and current case values from SPAR for a

nonrecoverable LOOP as listed in Table 10. To establish the base case, the analyst set

the failure probability for each category of LOOP to a failure probability of 1.0 and set

each operator basic event for recovering each category of LOOP for any time period to

the house event TRUE indicating that power recovery was not possible. The current

case reflected the nonrecoverable LOOP and the failure of emergency diesel

generator B at time zero. The failure of emergency diesel generator B was developed

by setting the Failure-To-Run and Test & Maintenance basic events equal to the house

event TRUE and setting the Failure-To-Start basic event equal to the house event

FALSE.

The analyst performed hand calculations to determine the change in core damage

frequency from a nonrecoverable LOOP resulting from high winds using the data in

Table 9. The analyst used the frequency for high winds represented by an EF2 tornado

(TIFEF2) from data developed by the Office of Nuclear Reactor Research. The analyst

first calculated the base case:

CCDPBase-EF2 = TIFEF2/year * CCDPBase * EXP

= (2.98 x 10-4/year * 3.31 x 10-5) * (242.95 days * 1year/365 days)

= 6.57 x 10-9

For the current case, the analyst calculated:

CCDPCase-EF2 = TIFEF2/year * CCDPCase * EXP

= 2.98 x 10-4/year * 3.17 x 10-4) * (242.95 days * 1year/365 days)

= 6.29 x 10-8

The analyst determined the final change in risk for a nonrecoverable LOOP coincident

with a failure of emergency diesel generator B for a category EF2 tornado that would

result in LOOP as:

ICCDP = CCDPCase-EF2 - CCDPBase-EF2

= 6.29 x 10-8 - 6.57 x 10-9

= 5.63 x 10-8

A2-24

D. External Events Results

The analyst summed the incremental conditional core damage probabilities for the

affected external events, as listed in Table 15, to obtain the overall change in risk that

would result from a nonrecoverable LOOP and failure of emergency diesel generator B.

The analyst summed the external event incremental conditional core damage

probabilities to quantify the total change in risk from external initiators as 2.22 E-07.

Table 15 - External Events Incremental Core Damage Probability

External Initiator ICCDP

Seismic 3.77 x 10-9

Individual Fire Areas 7.83 x 10-8

Control Room Abandonment 8.32 x 10-8

High Winds 5.63 x 10-8

Total External Events ICCDP 2.22 x 10-7

Results:

The analyst combined the change in core damage frequency from the internal events

(5.34 E-07) and external events (2.22 E-07). The result was 7.55 E-07. The dominant

core damage component resulted from a fire causing abandonment of the control room.

This external event had increased risk since the performance deficiency resulted in the

post-fire safe shutdown equipment used to mitigate a fire being unavailable until the

licensee recovered power using their station blackout emergency diesel generators.

From February 5, 2014, to April 25, 2014, a period of 79 days, the newly installed station

blackout emergency diesel generators were not available because the current

transformer was miswired. On June 23, 2016, the Significance and Enforcement Review

Panel determined that no mitigation credit should be applied for the 79 day period

where the SBO diesel would not have functioned. The NRC determined that mitigation

credit for a new modification for the station blackout diesel generators was not warranted

because the equipment was not verified to be capable of performing its risk mitigation

function.

As a result, the SERP determined that sensitivity analysis #4 should be included in the

preliminary risk significance determination. The use of sensitivity #4 increased the risk

significance into the low to moderate risk category (White).

Large Early Release Frequency:

In accordance with Inspection Manual Chapter 0609, Appendix H, Containment Integrity

Significance Determination Process, issued May 6, 2004, the analyst determined that

this was a Type A finding, because the finding affected the plant core damage

frequency. In accordance with the guidance in Appendix H, this finding would not

involve a significant increase in risk of a large, early release of radiation because

Wolf Creek has a large, dry containment and the dominant sequences contributing to the

change in the core damage frequency did not involve either a steam generator tube

A2-25

rupture or an inter-system loss of coolant accident. Therefore, the analyst determined

that the significance of this finding was considered to be core damage frequency-

dominant, and the impact to large, early release frequency was negligible.

Sensitivity Analyses:

The analyst performed a variety of uncertainty and sensitivity analyses on the internal

events model and on the external events calculation.

Sensitivity Analysis 1 - Increase in Failure to Recover Probability for Operator Actions

When Abandoning the Control Room

The analyst performed a sensitivity for the probability of success of remote shutdown

using equipment other than the Train B protected equipment because the associated

basic event appeared in over 86 percent of the control room abandonment event tree cut

sets. The analyst increased the failure probability by 25 percent from 2.59E-01 to 3.24E-

01 and applied this value to the Fault Tree OEP-ALT-SD, Operators Fail to Shutdown

Plant. Quantifying the control room abandonment event tree resulted in an incremental

conditional core damage probability from the control room abandonment of 8.65E-08.

The overall change in core damage frequency equaled 7.59E-07 for internal and

external initiators and remained in the very low risk significance range (Green).

Sensitivity Analysis 2 - Decreased Run Time Exposure Time

The analyst reduced the run time exposure from a range of dates that ensured

emergency diesel generator B would meet its 24-hour mission time to the failure date

postulated by the licensee in their second root cause of June 11, 2014. This resulted in

reducing the exposure time from 243 to 117 days. When using the 117 days the analyst

determined that the change in the external events were reduced, but the total

incremental conditional core damage frequency for internal and external initiators

equaled 5.49E-07 and continued to remain in the very low risk significance range

(Green).

Sensitivity Analysis 3 - Account for Mid-cycle Outage

The analyst developed a bounding shutdown risk assessment that focused on the

18-day period during the mid-cycle outage that train A was out of service. The analyst

then reduced the at-power evaluation by decreasing the exposure period by the 57 days

the reactor was in Modes 4 or 5. The resulting total incremental conditional core

damage probability for internal and external initiators (9.30E-07) was higher than the

calculated at-power risk.

Sensitivity Analysis 4 - Account for Unavailable Station Blackout Emergency Diesel

Generators

The analyst developed a bounding risk assessment that focused on the 79-day period

from February 5, 2014, until April 25, 2014, that the station blackout emergency diesel

generators would not have started. To adjust the internal events contribution the analyst

recalculated the station blackout conditional core damage probability during the 17-hour,

22-hour, and 23-hour exposure windows using a limited use SPAR model that did not

include modeling of the station blackout emergency diesel generators. Using this SPAR

model, the analyst then calculated the effect of failed station blackout emergency diesel

A2-26

generators for the following external initiators: high winds, fire area, and seismic. For the

control room abandonment analysis, the analyst determined that offsite power would be

available for recovery following most postulated control room fires. The analyst,

therefore, calculated the probability that operators would be able to restore power and

stabilize the reactor following failure of emergency diesel generator B when the station

blackout emergency diesel generators were unavailable. The total resulting incremental

conditional core damage probability for internal and external initiators was (1.54E-06),

low to moderate risk significance range (White).

Sensitivity Analysis 5 - Account for Change in Number of Control Room Cabinets

During inspection of critical assumptions for this analysis, NRC inspection staff

determined that there were discrepancies associated with the number of cabinets the

inspection staff determined were in the control room and number designated in the

Individual Plant Evaluation of External Events. The licensee had recorded 103 cabinets.

However, the inspectors determined that a number of these cabinets had been removed

via modification. Additionally, the inspectors observed openings between cabinets that

they determined invalidated the licensees position that these were individual cabinets.

As a result of the inspectors accounting, they determined that the actual number of

electrical cabinets in the control room was 60. They also determined that only two of

these cabinets could result in a fire-induced loss of offsite power.

The analyst calculated the impact of this discrepancy in quantifying the change in risk

associated with control room abandonment if there were only 60 cabinets in the control

room. The analyst adjusted the frequency of a fire-induced loss of offsite power and the

probabilities for fire-induced failures of the train A equipment. The overall incremental

conditional core damage probability for internal and external initiators increased slightly

to 7.58E-07 and remained in the very low risk significance range (Green).

Sensitivity Analysis 6 - Account for Unavailability of Station Blackout Diesels and 60

Control Room Cabinets

As an additional sensitivity, the analyst evaluated the overall result when Sensitivities 4

and 5 were combined. The analyst calculated the probability that operators would be

able to restore power and stabilize the reactor following failure of emergency diesel

generator B when the station blackout emergency diesel generators were unavailable,

assuming that the actual number of electrical cabinets in the control room was 60. The

total resulting incremental conditional core damage probability for internal and external

initiators (1.64E-06) was higher than the calculated at-power risk and increased into the

low to moderate risk significance range (White).

Sensitivity Analysis 7 - Adjust Emergency Diesel Generator A Failure Probability

In evaluating the risk of the emergency diesel generator B failure, the analyst assumed

that there was a potential for common cause failure of emergency diesel generator A.

Additionally, in the run-time failure model used for this evaluation, the failure probability

of emergency diesel generator A would not increase above the common cause failure

increase because there was no actual failure of the machine. However, as a sensitivity,

the analyst increased the failure-to-run probability of emergency diesel generator A by

25 percent. This predominantly affected the internal events sequences. The overall

incremental conditional core damage probability for internal and external initiators

A2-27

increased by approximately 15 percent to 8.86E-07 and remained in the very low risk

significance range (Green).

Licensees Perspectives/Analyses:

The licensee's final estimate of the increase in core damage frequency for the failure of

the emergency diesel generator B excitation circuits was 4.12E-07.

The licensees root cause and risk analysis assume the event that resulted in the diesel

generator failure occurred on June 11, 2014, because the first diode failed on this date,

which resulted in additional stress and ultimate failure of emergency diesel generator B

in approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The NRC inspection staff disagreed with the licensees root cause and believed that

thermal degradation of the diodes resulted in the failure. The licensee could have

prevented the failure by performing preventive replacement of the diodes. The analyst

determined that emergency diesel generator B exceeded 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of run time for the

period prior to February 5, 2014. Given the total run time assumption, emergency diesel

generator B would have run for greater than the 24-hour mission time before that date.

The licensee used their internal events probabilistic risk assessment model to estimate

the effect of the performance deficiency on the risk from control room abandonment.

The resulting change in core damage frequency was negligible. However, the analyst

believes that this provided a significant underestimation of the risk because all recovery

following loss of emergency diesel generator B would be driven by operator action.

The licensee stated that their position was that control room operators would do

whatever was necessary to maintain the control room habitable, even if the actions they

took were not previously in plant procedures. Additionally, they believed that multiple

methods of reactor stabilization were available to the operators following a postulated

control room abandonment. The following represents the dominant differences between

the licensees evaluation and that of the NRC analysts:

1. Licensee disagreed with the performance deficiency.

2. Licensee quantified the change in risk from the failure of emergency diesel generator

B based on the total time (t) from June 11 through October 9, 2014.

3. Licensee assumed emergency diesel generator B would fail after 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

4. Licensees internal events value was 4.12E-07.

5. Analyst noted that the licensees internal events probabilistic risk assessment

provided a factor of 2.5 lower than the SPAR.

6. Licensee does not have an external events model but provided an external events

value of 2.14E-10.

7. The licensee used their internal events probabilistic risk assessment model to

estimate the effect of the performance deficiency on the risk from control room

abandonment. The resulting change in core damage frequency was negligible.

A2-28

8. The analyst believes that the licensees assessment of control room abandonment

provided a significant underestimation of the risk because all recovery following loss

of emergency diesel generator B would be driven by operator action.

9. Licensee did not include the impact of high winds.

10. Licensee considered the station blackout diesels to be available for the entire

exposure period.

A2-29

Figure 1 - Control Room Abandonment with Emergency Diesel Generator B Failed

A2-30

ML16235A132

Text

Navigation menu

Search