Revision as of 23:18, 19 June 2019

Text

NRC Inspection Report 05000482/2016008; January 1, 2016 Through June 29, 2016; Preliminary White Finding
	ML16235A132
Person / Time
Site:	Wolf Creek
Issue date:	08/19/2016
From:	Troy Pruett; NRC/RGN-IV/DRP
To:	Heflin A; Wolf Creek
	Taylor N
Shared Package
ML16237A013	List: IR 05000482/2016008; ML16235A132;
References
	EA-16-069 IR 2016008
	Download: ML16235A132 (53)
	v • d • e

UNITED STATES

NUCLEAR REGULATORY COMMISSION

REGION IV 1600 E. LAMAR BLVD.

ARLINGTON, TX

76011-4511 August 19, 2016 EA-16-069 Adam C. Heflin, President and

Chief Executive Officer

Wolf Creek Nuclear Operating Corporation

P.O. Box 411

Burlington, KS 66839

SUBJECT: WOLF CREEK GENERATING STATION - NRC INSPECTION

REPORT 05000482/2016008; PRELIMINARY WHITE FINDING

Dear Mr. Heflin:

On June 29, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Wolf Creek Generating Station, and the NRC inspectors discussed the results of this inspection with Mr. Jaime McCoy, Vice President of Engineering, and other members of your staff. The inspectors documented the results of this inspection in the enclosed inspection report.

This letter discusses a finding that has preliminarily been determined to be White - a finding with low to moderate safety significance that may require additional NRC inspections

. As described in this letter (Section 4OA3 of this report), the finding is associated with an apparent

violation of Technical Specification 5.4.1.a for the licensee's failure to adequately develop and adjust preventive maintenance activities for

emergency diesel generator excitation system diodes. As a result, emergency diesel generator B would not have been able to operate for the full mission time following a loss of offsite power event. This finding was assessed using the best available information, using the applicable Significance Determination Process. The final resolution of this finding will be conveyed in separate correspondence.

The NRC performed a detailed risk evaluation using Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At

-Power," and determined an incremental conditional core damage probability

of 1.54E-06. The NRC determined that mitigation credit for a new modification for the station blackout diesel generators was not warranted because the equipment was not verified to be capable of performing its risk mitigation function. The NRC noted that additional qualitative risk could be applied to the final result to account for the actual number of control room cabinets, a common cause vulnerability with

emergency diesel generator

A, and a period of shutdown plant conditions. If all of these factors were applied the final significance would increase slightly and remain in the low to moderate risk

category (White).

A. Heflin - 2 - The inspectors determined that this finding no longer presents an immediate safety concern because emergency diesel generator B has been restored to operable and failed components, including diodes associated with the static exciter, have been replaced and a preventive maintenance strategy for the failed diodes has been developed. The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in

accordance with the Enforcement Policy, which can be found on the NRC's Web site at

http://www.nrc.gov/about

-nrc/regulatory/enforcement/enforce

-pol.html. In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available

information and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staff's final determination.

Before we make a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 40 days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a Regulatory Conference is held, it will be open for

public observation. If you decide to submit only a written response, such submittal should be

sent to the NRC within 40 days of your receipt of this letter. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.

Please contact Nicholas Taylor at 817

-200-1141 and in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within

10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for these inspection findings at this time. In addition, please be advised that the number and characterization of the apparent violation(s) described in the enclosed inspection report may change as a

result of further NRC review.

In addition, NRC inspectors documented one

finding of very low safety significance (Green) in this report. This finding involved a violation of NRC requirements. The NRC is treating this violation as a non

-cited violation (NCV) consistent with Section

2.3.2.a of the NRC Enforcement Policy. If you contest the violation or significance of this NCV, you should provide a response within

30 days of the date of this inspection report, with the basis for your denial, to the U.S.

Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555

-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement,

A. Heflin - 3 - U.S. Nuclear Regulatory Commission, Washington, DC 20555

-0001; and the NRC resident inspector at the Wolf Creek Generating Station.

If you disagree with

a cross-cutting aspect assignment in this report, you should provide a response within 30

days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the

Wolf Creek Generating Station.

In accordance with 10 CFR 2.390 of the NRC's "Agency Rules of Practice

and Procedure," a copy of this letter and its enclosure will be made available electronically for public inspection in

the NRC Public Document Room and in the NRC's Agencywide Documents Access and

Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading

-rm/adams.html

. Sincerely, /RA/ Troy W. Pruett , Director Division of Reactor Projects

Docket No.

50-482 License No.

NPF-42

Enclosure:

Inspection Report 05000482/2016008

w/ Attachments:

1. Supplemental Information

2. Significance Determination

Letter to Adam C. Heflin from Troy W. Pruett, dated August

19, 2016 SUBJECT: WOLF CREEK GENERATING STATION

- NRC INSPECTION REPORT 05000482/2016008; PRELIMINARY WHITE FINDING

DISTRIBUTION

Regional Administrator (Kriss.Kennedy@nrc.gov) Deputy Regional Administrator (Scott.Morris@nrc.gov) DRP Director (Troy.Pruett@nrc.gov)

DRP Deputy Director (Ryan.Lantz@nrc.gov)

DRS Director (Anton.Vegel@nrc.gov)

DRS Deputy Director (Jeff.Clark@nrc.gov)

Senior Resident Inspector (Douglas.Dodson@nrc.gov)

Resident Inspector (Fabian.Thomas@nrc.gov)

WC Administrative Assistant (Susan.Galemore@nrc.gov

) Branch Chief, DRP/B (Nick.Taylor@nrc.gov)

Senior Project Engineer, DRP/B (David.Proulx@nrc.gov)

Project Engineer, DRP/B (Steven.Janicki@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov

) Project Manager (Fred.Lyon@nrc.gov)

Team Leader, DRS/IPAT (Thomas.Hipschman@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

ACES (R4Enforcement.Resource@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Technical Support Assistant (Loretta.Williams@nrc.gov)

Senior Congressional Affairs Officer (Jenny.Weil@nrc.gov)

RIV Congressional Affairs Officer (Angel.Moreno@nrc.gov)

RIV/ETA: OEDO (Jeremy.Bowen@nrc.gov

) RIV RSLO (Bill.Maier@nrc.gov)

ROPreports.Resource@nrc.gov

ROPassessment.Resource@nrc.gov

Enclosure U.S. NUCLEAR REGULATORY COMMISSION

REGION IV Docket: 05000 482 License: NPF-42 Report: 05000 482/2016008 Licensee: Wolf Creek Nuclear Operating Corporation

Facility: Wolf Creek Generating Station

Location: 1550 Oxen Lane NE

Burlington, KS 66839

Dates: January 1 through June 29, 20 16 Inspectors:

D. Dodson, Senior Resident Inspector

F. Thomas, Resident Inspector

D. Loveless, Senior Reactor Analyst

G. Pick, Senior Reactor Inspector Approved By: Troy W. Pruett , Director Division of Reactor Projects

- 2 - SUMMARY IR 05000 482/20 16008; 01/01/2016

- 06/29/2016; Wolf Creek Generating Station

Follow-up of Events and Notices of Enforcement Discretion

The inspection activities described in this report were performed between January 1 and June 29, 2016, by the resident inspectors at Wolf Creek Generating Station

and inspectors from the NRC's Region IV office. The inspectors identified a preliminary White finding associated with an apparent violation. Additionally, one

finding of very low safety significance (Green) is documented in this report. This finding involved a violation of NRC requirements. The

significance of inspection findings is indicated by their color (Green, White, Yellow, or Red),

which is determined using Inspection Manual Chapter 0609, "Significance Determination Process," issued April 29, 2015

. Their cross

-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects

within the Cross-Cutting Areas," issued December 4, 2014

. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement

Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG

-1649, "Reactor Oversight Process."

Cornerstone: Mitigating Systems

Preliminary White. The inspectors identified a preliminary White finding associated with

an apparent violation of Technical Specification 5.4.1.a, for the licensee's failure to adequately develop and adjust preventive maintenance activities in accordance with Procedure AP 16B

-003, "Planning and Scheduling Preventive Maintenance," Revision 5. Specifically, the licensee did not create a preventive maintenance replacement task or schedule for emergency diesel generator excitation system diodes, which resulted in emergency diesel generator B being declared inoperable and unavailable when it tripped

during a 24

-hour surveillance test. The licensee entered this condition into its corrective action program as Condition Report 88665. The licensee restored compliance by establishing preventive maintenance tasks 49286, 49287, 49288, and 49289, which refurbish the power rectifier assemblies and replace

the diodes on a 12

-year replacement frequency.

This finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of

systems that respond to initiating events to prevent undesirable consequences. Specifically, with one emergency diesel generator excitation system diode failed as a result of thermal degradation, emergency diesel generator B was not operable or available to perform its safety function

. The inspectors evaluated the finding using Attachment 0609.04, "Initial Characterization of Findings,"

worksheet to Inspection Manual Chapter (IMC) 0609, "Significance Determination Process," issued June 19, 2012. The attachment instructs the inspectors to utilize IMC 0609,

Appendix A, "Significance Determination Process (SDP) for Findings At

-Power," issued June 19, 2012. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, "Mitigating Systems Screening Questions," the inspectors determined that the

finding required a detailed risk evaluation because it represented an actual loss of function of the emergency diesel generator B

for greater than its technical specification allowed outage time.

A senior reactor analyst performed a detailed risk evaluation in

accordance with Appendix A, Section 6.0, "Detailed Risk Evaluation." The calculated change in core damage frequency was dominated by a loss of offsite power initiator leading to station blackout with failures of the turbine

-driven and non

-safety-related auxiliary feedwater

- 3 - pumps. The analyst did not evaluate the large early release frequency because this performance deficiency would not have challenged the containment.

The NRC preliminarily determined that

the incremental conditional core damage probability

for internal and external initiators was 1.54E-06, in the low to moderate risk significance range (White).

This finding has a cross

-cutting aspect in the area of problem identification and resolution, operating experience, because the organization did not systematically and effectively evaluate relevant internal and external operating experience in a timely manner. Specifically, Condition Report 55103 documented industry operating experience regarding emergency diesel generator excitation system diodes failing at an increased rate, and the operating experience was not effectively implemented and institutionalized through changes to station processes, procedures, equipment, and training programs, and at least one emergency

diesel generator excitation system diode failed due to aging [P.5]. (Section 4OA3)

Green. The inspectors identified a Green n

on-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action

," for the licensee's failure to assure that conditions adverse to quality, such as failures, malfunctions, and deficiencies

are promptly identified and corrected. Specifically, the licensee failed to promptly identify and correct a failed rectifier bridge diode after smoke was observed coming from the three power potential transformers in the emergency diesel generator exciter cabinet NE106 on June 11, 2014, which contributed to the emergency diesel generator B being declared inoperable and unavailable when it tripped during a 24

-hour surveillance test on October 6, 2014. To address the failure to take adequate corrective actions Wolf Creek entered this issue into its corrective action program as Condition Report 105480 and plans to implement a modification to install overcurrent detection for each emergency diesel generator's power

potential transformer.

This finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of

systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to identify and correct the failed emergency diesel generator excitation system diode contributed to the emergency diesel generator B failure on October 6, 2014. The inspectors evaluated the finding using Attachment 0609.04, "Initial Characterization of Findings," worksheet to Inspection Manual Chapter (IMC) 0609, "Significance Determination Process," issued June 19, 2012. The attachment instructs the inspectors

to utilize

IMC 0609, Appendix A, "Significance Determination Process (SDP) for Findings At

-Power," issued June 19, 2012. The inspectors determined this finding is not a deficiency affecting the design or qualification of a mitigating structure, system, or component

that maintained its operability or functionality, the finding does not represent a loss of system and/or function, the finding does not represent an actual loss of function of at least a single train for greater than it

s Technical Specification allowed

outage time, and the finding does not represent an actual loss of function of one or more

non-Technical Specification trains of equipment designated as high safety

-significant. Therefore, the inspectors determined the finding was of very low safety significance (Green). The inspectors determined that in accordance with Inspection Manual Chapter 0310, "Aspects Within The Cross

-Cutting Areas," issued December 4, 2014, the finding has a cross-cutting aspect in the area of human performance, conservative bias, because when smoke was identified coming from the power potential transformers on multiple occasions, licensee personnel did not use decision making

-practices that emphasize prudent choices over those that are simply allowable, and a proposed action is determined to be safe in order to proceed, rather than unsafe in order to stop. As a result, the licensee missed

an

- 4 - opportunity to identify and correct the condition of the failed diode in the static exciter [H.14]. (Section 4OA3)

- 5 - REPORT DETAILS

4. OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security 4OA 3 Follow-up of Events and Notices of Enforcement Discretion (71153)

.1 (Closed) Unresolved Item 05000482/2014005

-02, Notice of Enforcement Discretion

14-4-02 for Emergency Diesel Generator B Exciter Cabinet Fire

a. Inspection Scope

On October 6, 2014, at 1:26 p.m., emergency diesel generator B was declared

inoperable when it tripped during a 24

-hour surveillance test and operators identified a fire in an associated exciter cabinet. An Alert was declared and operators entered Technical Specification 3.8.1, "AC Sources

- Operating," Required Action B.4.1, which required emergency

diesel generator B be restored to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The fire was quickly suppressed and the station exited the Alert. Following the completion of repairs, the licensee identified that post

-maintenance testing required to demonstrate system operability included completing

a 24-hour run. Since the post

-maintenance testing and subsequent system restoration was expected to exceed the time remaining in the 72

-hour action statement, the licensee requested that the NRC exercise discretion to not

enforce compliance with the actions required in Technical Specification 3.8.1, Required Action B.4.1, and approve an additional 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore the system. Notice of Enforcement Discretion 14

-4-02, documents this request and the NRC's approval. Following post-maintenance testing, emergency diesel generator B was restored to operable status at 5:17 p.m. on October 9, 2014

. Unresolved

Item 05000482/2014005

-02, "Notice of Enforcement Discretion

14-4-02 for Emergency Diesel Generator B Exciter Cabinet Fi

re ," was identified because a Notice of Enforcement Discretion was issued, and Inspection Manual Chapter 0410, "Notice of

Enforcement Discretion," requires that an unresolved item be opened to assess whether the causes of the events leading up to the request for the Notice

s of Enforcement Discretion involved violations of NRC requirements.

The inspectors performed an in

-depth review of the licensee's root cause evaluation

s associated with Condition Report 88665, operating experience related to the event, other related condition reports, and documentation

listed in Attachment 1. In addition, the inspectors performed on

-site tours, interviewed site personnel, and reviewed corrective actions associated with the condition. Unresolved

Item 05000482/2014005

-02 is closed to the two enforcement actions

discussed below.

b. Findings 1. Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel Generator Excitation System Diodes

Introduction. The inspectors identified a

preliminary White finding associated with an apparent violation of Technical Specification 5.4.1.a, for the licensee's failure to

- 6 - adequately develop and adjust preventive maintenance activities in accordance with Procedure AP 16B

-003, "Planning and Scheduling Preventive Maintenance," Revision

5. Specifically, the licensee did not create a preventive maintenance replacement task for

emergency diesel generator excitation system diodes, which resulted in emergency diesel generator B being declared inoperable and unavailable when it tripped during a

24-hour surveillance test.

Description. On October 6, 2014, at 1:26 p.m., emergency diesel generator B was declared inoperable when it tripped during a 24

-hour surveillance test and operators identified a fire in an associated exciter cabinet. An Alert was declared and operators

entered Technical Specification 3.8.1, "AC Sources

- Operating," Required Action B.4.1, which required emergency diesel generator B be restored to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The fire was quickly suppressed and the station exited the Alert. Following the completion of repairs, the licensee returned emergency diesel generator B to service on October 9, 2014.

The licensee initiated Condition Report 88665 to evaluate the causes of the inoperability of emergency diesel generator B

. On June 11, 2014, approximately four months prior to the failure of emergency diesel generator B, during performance of Procedure SYS KJ-124, "Post Maintenance Run of Emergency Diesel Generator B," Revision 60A, a burning smell was noted coming from cabinet NE106 in emergency diesel generator room B. Condition Report 85125 documented the condition and stated, "Small amounts of smoke

could be seen coming from the three

transformers at the bottom right side of NE106."

The licensee determined that the B emergency diesel generator remained operable.

The immediate operability determination stated, "The condition identified is likely age related degradation of the noted heat shrink insulating material. Based on operating experience at Wolf Creek, as certain insulating materials age, the plasticizer starts slowly [separating] and the material then becomes brittle." Visual inspections were performed as well as thermography; however, the licensee did not recognize any failed equipment.

On July 18, 2012, industry operating experience related to "Loss of

Emergency Diesel Generator Excitation," was placed into

the licensee's corrective action program as Condition Report 55103, but closed without action by the licensee's staff who incorrectly determined that i

t was not applicable to their design. The root cause analysis associated with Condition Report

88665 describes industry operating experience that concluded the average life span of emergency diesel generator excitation system

diodes is approximately 12 years. Revision 1 of the root cause analysis states, "The [condition report] evaluator did not find it to be applicable due to a different exciter design. As this

is true, the middle phase diodes in any rectifier bridge are still susceptible to the same failure mode identified in this IER. If the evaluator identified the susceptibility and proactively suggested replacement of the diodes, then it may have prevented this event from happening." Revision 2 of the root cause analysis revised this section to state, "If

the evaluator identified the possible susceptibility and proactively suggested replacement of the diodes, then it may have reduced the probability of this event

occurring." On October 27, 2015, the licensee

established preventive maintenance tasks 49286, 49287, 49288, and 49289, which refurbish the power rectifier assemblies and replace the diodes

on a 12-year replacement frequency. The inspectors noted that

if the licensee had adequately established and implemented the appropriate preventive maintenance task and replaced the diodes, which were original equipment that had been

in service for approximately 29 years, during one of the three refueling outages or one of

the five forced outages after Condition Report 55103 was documented in July 2012, the

- 7 - diode failures that resulted in the system failure in October 2014 would have been prevented.

The root cause analysis associated with Condition Report 88665 also discussed

the direct and root causes of the issue. With reference to the

direct cause, Revision 1 stated , "The most probable direct cause-has been identified as thermal degradation of the Power Rectifier diodes. Due to the reduced

contribution of field current and voltage from the Power Current Transformer circuitry from a single diode failure, the voltage regulator would task the [power potential transformer] to supply the remainder of the required current to the field. This increase current would increase the internal temperatures of the [power potential transformer], leading to degraded windings within the [power potential transformer]. This condition could only be noticed by the smoking from the [power potential transformer]. The second diode then eventually shorted, causing a short in the generator field. This short would cause a loss of excitation to the field and would trip the diesel.

" Revision 1 of the licensee's root cause analysis stated, "The station did not recognize the significance of aging or life cycle factors associated with the [emergency diesel generator

's] excitation system resulting in an inadequate preven tive maintenance strategy of the excitation system." The analysis

also stated , "Had a thorough review of IER L3

-12-41 been performed, then it is

possible that a [preventive maintenance activity] could have been created-The [Preventive Maintenance Optimization] group did review the Electric Power Research Institute (EPRI) document 1011232 Emergency Diesel Generator Voltage Regulator Maintenance Issues which states 'diodes-appear to be failing because of age.' However, there is no evidence of any action taken to replace the diodes within the [emergency diesel generator] exciter system.

" Revision 2 of the root cause analysis revised the root cause. It stated , "The station did not have the ability to assess the degradation of the [power potential transformer] within the [emergency diesel generator

's] excitation system that led to the continual operation of a degraded component, resulting in significant equipment failure. Additionally, there were limited [preventive maintenance activities], obsolescence issues that had not been addressed, limited knowledge of the exciter, and the design of the system lacked overcurrent protection/detection of

the [power potential transformer

]." The inspectors reviewed Revisions 0, 1, and 2 of the licensee's root cause analysis for Condition Report 88665. Considering the operating experience associated with the degradation of power rectifier bridge diodes, and the licensee's analyses, the inspectors determined that the conclusions of Revision 1 of the licensee's root cause analysis for

Condition Report 88665 remained valid.

- 8 - The inspectors questioned the completed and planned corrective actions associated with the Revision 2

root cause and determined that Revision 2 of the root cause did not identify corrective actions to prevent recurrence for all aspects of the root cause. Specifically, one action to implement a design change to protect the power potential

transformers was the only corrective action to prevent recurrence. No other corrective actions to prevent recurrence were proposed to address

the other elements of the root cause, including the inability to assess the degradation of the power potential

transformer, the limited preventive maintenance activities, obsolescence issues that had not been addressed, and limited knowledge of the exciter

. The licensee documented Condition Report 104833 to capture the inspectors' concerns and to document that

actions were "to revise the root cause evaluation cause."

The inspectors noted that Procedure AP 16B

-003, "Planning and Scheduling Preventive Maintenance," Revision 5, provides direction for implementing the preventive

maintenance program. In Section 6.2, "Establishing [preventive maintenance] Activities," it states, "Develop [preventive maintenance] activities by considering the following-Operating Experience (OE) (Industry and Station)." Section 6.2.2

, states, "[Preventive maintenance] frequencies are established and adjusted in accordance with-the following considerations-The age of the installed equipment." The inspectors determined that the July 2012 operating experience was not adequately evaluated, in that the licensee's power diodes were susceptible to the same heat and age related failure mechanisms described in the operating experience. The licensee should have utilized the operating experience

and revised maintenance procedures

to prevent this issue from impacting emergency diesel generator B reliability and availability.

The licensee

also obtained third party reviews, including reviews from DP Engineering LTD. Co. (DPE) and

Mandil, Panoff, and Rockwell (MPR). The DPE review, dated April 15, 2015, stated, "DPE effectively concurs with the Root Cause [Revision 1] of the

event." The MPR review, documented in Enclosure 1 to LTR

-0405-0018, Revision 1, dated April 17, 2015, stated, "MPR agrees with the [root cause evaluation], [Revision 1], in that the most probable cause is the thermal degradation of Power Rectifier diodes, combined with transients these diodes have experienced through service over several decades."

Licensee personnel documented similar conclusions following testing on a mock

-up of the emergency diesel generator's excitation system, "If a single diode would fail in the Power Rectifier then the [power potential transformer] would then become overloaded."

Considering the root cause evaluation, the failure of emergency diesel generator B to operate more than 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months during its 24

-hour surveillance run on October 6, 2014, the failure of the first diode on or before June 11, 2014, and the likely thermal degradation failure mechanism of the first diode that failed, the inspectors determined that emergency diesel generator B would not have been able to perform its safety function.

During a review of the licensee's mitigating strategies for the failure of emergency diesel generator B, the inspectors reviewed the availability of the station blackout diesel generators. The station blackout diesel generators were installed in the plant and then credited in the licensee's probabilistic risk assessment model on October 1, 2013. The licensee acknowledged in 2013 that it could not energize a safety

-related bus from the station blackout diesel generators at power without rendering the safety

-related bus inoperable, and the licensee acknowledged that post modification testing to fully

- 9 - demonstrate station blackout diesel generator capability could not be performed until the spring 2014 mid

-cycle outage. After the licensee took credit for the station blackout diesel generators in its probabilistic risk assessment model in

2013, the NRC expressed concerns to the licensee regarding its taking credit for the station blackout diesel generators without verifying the mitigation function could be accomplished. On April 25, 2014, the licensee tested the station blackout diesel generators' ability to connect to the

safety-related buses, but the equipment failed testing as a result of improperly installed current transformer wiring in the safety

-related buses' alternate feeder cubicles. This wiring error was corrected and the die

sels were successfully tested on

April 29, 2014. NRC Inspection Report 05000482/2015002 documented

a green non

-cited violation, 05000482/2015002

-01, "Class 1E 4kV Feeder Breakers from Station Blackout Diesel Generators Current Transformer Wiring not Installed per Design Drawings," associated with this issue. The inspectors noted Inspection Manual Chapter

03 08 , Attachment 3, "Significance Determination Process Technical Basis," issued June 16, 2016, discusses, "The Independence of Inspection Findings." However, the inspectors determined that prior to April 29, 2014, Wolf Creek should not have reduced the baseline risk of the facility by revising the plant

-specific probabilistic risk assessment model. Any performance deficiencies occurring during this seven

-month time window should exclude the station blackout diesel generators from the baseline risk of the facility because the

station blackout diesels were never installed prior to April 29, 2014

, and , therefore, should not have been

credited in the baseline risk of the facility

prior to this date

. The licensee's corrective

actions included replacing the power potential transformer and selecting the alternate rectifier bank to restore the availability of emergency diesel generator B. In addition to immediate actions taken, the licensee replaced all power diodes within all four rectifier bridges (two rectifier bridges for each emergency diesel generator). On October 27, 2015, the licensee implemented a corrective action to

generate new preventive maintenance activities to periodically replace the diodes within the power rectifier and other excitation system components

as recommended by the operating experience

. Analysis. The inspectors determined that the failure to adequately develop and adjust emergency diesel generator excitation system diode preventive maintenance activities in accordance with

Procedure AP 16B

-003, "Planning and Scheduling Preventive Maintenance," was a performance deficiency. This finding is more than minor because it

is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of

systems that respond to initiating events to prevent undesirable consequences. Specifically, with one emergency diesel generator excitation system diode failed

as a result of thermal degradation, emergency diesel generator B was not operable or available to perform its safety function.

The inspectors evaluated the finding using the Attachment 0609.04, "Initial Characterization of Findings," worksheet to Inspection Manual Chapter (IMC) 0609,

"Significance Determination Process," issued June 19, 2012.

The attachment instructs the inspectors to utilize IMC 0609, Appendix A, "Significance Determination Process (SDP) for Findings At

-Power," issued June

19, 2012. In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, "Mitigating Systems Screening

Questions," the inspectors determined that the finding required a detailed risk evaluation because it represented an actual loss of function of the emergency diesel generator B for greater than its technical specification allowed outage time.

- 10 - The detailed risk evaluation was performed in accordance with Appendix A, Section 6.0, "Detailed Risk Evaluation

," and is included as Attachment 2, "Significance Determination

for Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency

Diesel Generator Excitation System Diodes."

The detailed risk evaluation was developed using the assumption that the station blackout diesel generators were available with

their nominal failure rate. The result was then adjusted to account for

the 79-day period from February

5, 2014, until April

25, 2014 , when the station blackout emergency diesel generator

had not been verified to be capable of performing its mitigation function.

The total resulting incremental conditional core damage probability

increased to

1.54E-06. A Significance and Enforcement Review Panel held on June 23, 2016, made a preliminary determination that the finding was of low to moderate safety significance (White).

The inspectors determined that in accordance with Inspection Manual Chapter 0310, "Aspects Within The Cross

-Cutting Areas," issued December 4, 2014, the finding has a cross-cutting aspect in the area of problem identification and resolution, operating experience, because the organization did not systematically and effectively evaluate relevant internal and external operating experience in a timely manner. Specifically, Condition Report 55103 documented industry operating experience regarding

emergency diesel generator excitation system diodes failing at an increased rate, and the operating experience was not effectively implemented and institutionalized through changes to station processes, procedures, equipment, and training programs, and at least one emergency diesel generator excitation system diode failed due to aging

. This issue is indicative of current performance because the station did not take any formal corrective actions to address the station's failure to adequately consider operating experience [P.5]. Enforcement. Technical Specification 5.4.1.a, requires, in part, that procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2. Section 9.b of Appendix A to Regulatory Guide 1.33, Revision 2, requires that "preventive maintenance schedules be developed to specify-inspection or replacement of parts that have a

specific lifetime." The licensee established Procedure AP 16B

-003, "Planning and Scheduling Preventive Maintenance," Revision 5, which provides direction for

implementing the preventive maintenance program to meet the Regulatory Guide 1.33 requirement. Section 6.2 of Procedure AP 16B

-003 requires that preventive maintenance activities be developed by considering operating experience and preventive maintenance frequencies are established and adjusted in accordance with the age of installed equipment. Contrary to the above, until October 27, 2015, the licensee did not ensure that preventive maintenance activities were developed by considering operating experience and preventive maintenance frequencies were not established and adjusted in accordance with the age of installed equipment. Specifically, the licensee did not ensure that adequate preventive maintenance activities

were developed for emergency diesel generator excitation system diodes by considering operating experience documented in Condition Report 55103, and preventive maintenance frequencies were not established or adjusted for emergency diesel generator excitation system diodes that were original plant equipment. As a result, a power diode that had been installed in the emergency diesel generator B excitation system beyond its recommended service life failed

and caused

the emergency diesel

- 11 - generator to be inoperable and led to the catastrophic failure of emergency diesel generator B on October 6, 2014.

The licensee entered this condition into its corrective action program as Condition Report 88665. The licensee restored compliance by establishing preventive maintenance tasks 49286, 49287, 49288, and 49289, which refurbish the power rectifier assemblies

and replace the diodes on a 12

-year replacement frequency.

This violation is being treated as an apparent violation pending

a final significance determination: AV 05000482/2016008

-01, "Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel Generator Excitation System Diodes

" 2. Failure to Promptly Identify and Correct a Significant Condition Adverse to Quality Associated with the Emergency Diesel Generator B Excitation System Diodes

Introduction. The inspectors identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action

," for the licensee's failure to assure that conditions adverse to quality, such as failures, malfunctions, and deficiencies, are promptly identified and corrected. Specifically, the licensee failed to promptly identify and correct a failed rectifier bridge diode after smoke was observed coming from the three power potential transformers in the emergency diesel generator exciter cabinet NE106 on June 11, 2014. This failed diode resulted in the emergency diesel generator B being declared inoperable and unavailable when it caught on fire and tripped during a

24-hour surveillance test on October 6, 2014.

Description. On June 11, 2014, during performance of Procedure

SYS KJ-124, "Post Maintenance Run of Emergency Diesel Generator B," Revision 60A, operations

personnel detected a burning smell coming from cabinet NE106 in the B emergency diesel generator room. Condition Report 85125 documented the condition and stated, "Small amounts of

smoke could be seen coming from the 3 transformers at the bottom right side of NE106." The immediate operability determination associated with Condition Report 85125 state

d, "What affect does the deficiency have on the affected structure, system, or comp

onent's ability to perform its intended design/safety function? None. This is a long term [degradation] issue that needs to be evaluated for the need for correction and [those] corrections [implemented] as desired by the system engineer." The immediate operability determination state

d, "The condition identified is likely age related degradation of the noted heat shrink insulating material. Based on operating experience at Wolf Creek, as certain insulating materials age, the plasticizer starts slowly [separating] and the material then becomes brittle." Visual inspections were performed as well as thermography; however, the licensee did not recognize the failed diode. Revision 2 of the root cause evaluation completed per Condition Report 88665 described a missed opportunity in having not performed an adequate investigation of the cause of the smoke identified coming from the three power potential transformers

in cabinet NE106. Specifically:

"An inadequate investigation of the [power potential transformer] vaporing in June 2014 was also considered to be a missed opportunity. Personnel involved with the determination of the [power potential transformer]

issue identified on June 11, 2014, did not thoroughly investigate the condition of the [power potential transformer]. The heat shrink tubing was degraded so actions were taken to replace the [power potential transformer].

- 12 - However, the question to why the connections were degraded was never asked. If a more thorough investigation was pursued then it is possible that a failed diode could have been found failed, preventing the [power potential transformer]

from ever exhibiting a fire. If the individuals involved with the June determination were well aware of the subcomponents within the NE106 cabinet, it is possible that the fire

observed would not have taken place.

" Neither the root cause evaluation associated with Condition Report 88665 nor Condition Report 85125 identified corrective actions to adequately address the licensee's failure to promptly identify and correct the failed power rectifier bridge diode

June 2014. Specifically, no corrective actions directly addressed the incorrect decision to accept

a smoking power potential transformer.

The inspectors noted that the Plant Health Committee approved a modification to install overcurrent detection for each emergency diesel generator's power potential transformer. This modification is expected to provide plant personnel indication that a diode has failed, including a revised local alarm. Upon identification of the revised local alarm, the licensee expects that troubleshooting would occur and include current checks of each phase of the power potential transformer, which would be expected to identify an overcurrent condition and subsequently a failed diode. Action would then be

en expected to occur in a timely manner to correct the condition. However, the inspectors noted that

this planned design modification did not directly address station acceptance of smoking equipment. Based on inspector concerns, the licensee entered this issue into its corrective action program as Condition Report 105480 and plans to perform a basic cause evaluation to identify additional actions

. Analysis. The inspectors determined that the failure to

identify and correct the cause of the smoke coming from the power potential transformer was a performance deficiency. This finding is more than minor because it is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of

systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to identify and correct the failed emergency diesel generator excitation system diode contributed to the emergency diesel generator B failure on October 6, 2014. The inspectors evaluated the finding using Attachment 0609.04, "Initial Characterization

of Findings," worksheet to Inspection Manual Chapter (IMC) 0609, "Significance Determination Process," issued June 19, 2012.

The attachment instructs the inspectors

to utilize IMC 0609, Appendix A, "Significance Determination Process (SDP) for Findings

At-Power," issued June 19, 2012. The inspectors determined this finding is not a deficiency affecting the design or qualification of a mitigating structure, system, or component that maintained its operability or functionality

the finding does not represent a loss of system and/or function

the finding does not represent an actual loss of function of at least a single train for

greater than its Technical Specification

-allowed outage time

and the finding does not represent an actual loss of function of one or more

non-Technical Specification trains of equipment designated as high safety

-significant. Therefore, the inspectors determined the finding was of very low safety significance

(Green).

- 13 - The inspectors determined that in accordance with Inspection Manual Chapter 0310, "Aspects Within The Cross

-Cutting Areas," issued December 4, 2014, the finding has a cross-cutting aspect in the area of human performance, conservative bias, because when smoke was identified coming from the power potential transformers on multiple occasions, licensee personnel did not use decision making

-practices that emphasize prudent choices over those that

are simply allowable, and a proposed action is determined to be safe in order to proceed, rather than unsafe in order to stop.

As a result, an opportunity to identify and correct the condition of the failed diode in the static exciter was missed

[H.14]. Enforcement. Title 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," states, in part, that measures shall be established to assure that conditions adverse to quality such as failures, malfunctions, and deficiencies, are promptly identified

and corrected.

Contrary to the above, from June 11, 2014, to October 9, 2014, measures were not established to assure that conditions adverse to quality such as failure

s , malfunctions, and deficiencies

were promptly identified and corrected. Specifically, the licensee did not establish adequate measures to assure that a condition adverse to quality, a failed power rectified bridge diode, was promptly identified and corrected, and the failure to identify and correct the failed emergency diesel generator excitation system diode resulted in a missed opportunity to prevent the failure of emergency diesel generator B failure on October 6, 2014. To address the failure to take adequate corrective actions Wolf Creek entered this issue into its corrective action program, plans to perform a basic cause evaluation, and plans to implement a modification to install overcurrent detection for each emergency diesel generator's power potential transformer.

This violation was of very low safety significance (Green), and the licensee entered this issue into its corrective action program as Condition Report 105480. This violation is being treated as a

non-cited violation

consistent with Section 2.3.2 of the Enforcement Policy

NCV 05000482/2016008

-0 2, "Failure to Promptly Identify and Correct a Condition Adverse to Quality Associated with the Emergency Diesel Generator B Excitation System Diodes

" .2 (Closed) Licensee Event Report 05000482/2016

-001-00, "Power Potential Transformer Overloading Results in Emergency Diesel Generator Inoperability"

a. Inspection Scope

On October 6, 2014, during a scheduled 24-hour surveillance test of emergency diesel generator B, the emergency diesel generator unexpectedly tripped and a fire was observed in electrical cabinet NE106 associated with the exciter circuitry. This event resulted in an unplanned 72

-hour limiting condition of operation and an Alert emergency declaration. On January 28, 2016, a hardware failure analysis concluded that the power potential transformer, which was the source of the fire, most likely failed

from overloading as a result of a diode failure

in the power rectifier of the emergency diesel generator excitation system. The licensee

event report

conclude d that the failure of the diode most likely occurred during load transients on June 9, 2014.

The inspectors performed an in

-depth review of the licensee's root cause evaluation revisions (Revision 0, completed December 17, 2014; Revision 1, completed July 30,

2015; and Revision 2

, completed February 22, 2016) associated with Condition Report 88665, operating experience related to the event, other Condition Reports, and other documentation. In addition, the inspectors performed on

-site tours, interviewed

- 14 - site personnel, worked with regional staff concerning the risk analysis, and reviewed corrective actions associated with the condition. In reviewing the event, the inspectors documented one apparent violation, AV 05000482/2016008

-01, "Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel Generator Excitation System Diodes

," and one non

-cited violation, NCV 05000482/2016008

-02, "Failure to Promptly Identify and Correct a Condition Adverse to Quality Associated with the Emergency Diesel Generator B Excitation System Diodes," which are also documented in Section 4OA3 of this report.

This licensee event report is closed.

b. Findings No findings were identified.

4OA 6 Meetings, Including Exit

Exit Meeting Summary

On June 29, 2016, the inspectors presented the inspection results to Jamie McCoy, Vice President of Engineering, and other members of the licensee staff. The licensee acknowledged

the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

A1-1 Attachment 1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel T. Baban, Manager, System Engineering

W. Brown, Superintendent, Security Operations

A. Broyles, Manager, Information Services

D. Campbell, Superintendent, Maintenance

T. East, Superintendent, Emergency Planning

J. Edwards, Manager, Operations

D. Erbe, Manager, Security

R. Flannigan, Manager, Nuclear Engineering

J. Fritton, Oversight

C. Garcia, Supervisor Engineer

C. Hafenstine, Manager, Regulatory Affairs

A. Heflin, President and Chief Executive Officer

S. Henry, Manager, Integrated Plant Scheduling

R. Hobby, Licensing Engineer

J. Isch, Superintendent, Operations Work Controls

B. Ketchum, Supervisor Engineer

B. Lee, Licensed Supervising

Instructor

M. Legresley, Engineer

D. Mand, Manager, Design Engineering

J. McCoy, Vice President, Engineering

N. Mingle, Engineer

W. Muilenburg, Supervisor, Licensing

L. Ratzlaff, Manager, Maintenance

C. Reasoner, Site Vice President

M. Skiles, Manager, Radiation Protection

T. Slenker, Supervisor, Operations Support

S. Smith, Plant Manager

A. Stull, Vice President and Chief Administrative Officer

J. Suter, Supervisor Engineer

M. Tate, Superintendent, Security

Operations

NRC Personnel

T. Martinez-Navedo, Electrical Engineer, NRR

G. Matharu, Senior Electrical Engineer, NRR

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened 05000482/2016008

-01 AV Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel Generator Excitation System Diodes (Section 4OA3)

A1-2 Opened and Closed

05000482/2016008

-02 NCV Failure to Promptly Identify and Correct a Condition Adverse to Quality Associated with the Emergency Diesel Generator B Excitation System Diodes (Section 4OA3)

Closed 05000482/2014005

-02 URI Notice of Enforcement Discretion

14-4-02 for Emergency Diesel Generator B Exciter Cabinet Fire

(Section 4OA3)

05000482/2016001

-00 LER Power Potential Transformer Overloading Results in Emergency Diesel Generator Inoperability (Section 4OA3)

LIST OF DOCUMENTS REVIEWED

Section 4OA3: Follow

-up of Events and Notices of Enforcement Discretion

Procedures

Number Title Revision AI 28A-100 Condition Report Resolution

9 ALR 00-021B NB02 BUS UV

18 AP 16B-003 Planning and Scheduling Preventive Maintenance

3 AP 16B-003 Planning and Scheduling Preventive Maintenance

4 AP 16B-003 Planning and Scheduling Preventive Maintenance

5 AP 16B-003 Planning and Scheduling Preventive Maintenance

6 AP 16E-002 Post Maintenance Testing Development

15 AP 20E-001 Industry Operating Experience Program

28 EMG C-0 Loss of All AC Power

34 EMG C-0 Loss of All AC Power

36 EMG E-0 Reactor Trip or Safety Injection

37A OFN KJ-032 Local Emergency Diesel Startup

12 OFN NB-030 Loss of AC Emergency BUS NB01 (NB02)

33A OFN RP-017 Control Room Evacuation

48 OFN RP-017A Hot Standby To Cold Shutdown From Outside The Control Room Due To Fire

11C SYS KJ-124 Post Maintenance Run of Emergency Diesel Generator B

60A SYS KJ-124 Post Maintenance Run of Emergency Diesel Generator B

62D

A1-3 Procedures

Number Title Revision SYS KU-122 Energizing NB02 From Station Blackout Diesel Generators

4 SYS KU-122 Energizing NB02 From Station Blackout Diesel Generators

5 Drawings Number Title Revision/Date 6998D62 Colt Industries Type "WNR" Volt Reg. & Excitation System

March 16, 1978 E-11001 Main Single Line Diagram

10 J-104-00390 Logic Block Diagram ESFAS

W08 J-14001 Control Room Equipment Arrangement, Sheet 1 11 KD-7496 One Line Diagram

59 M-12AL01 Piping & Instrumentation Diagram Auxiliary Feedwater System 28 Condition Reports

55103 83379 84939 85015 85125 88665 88734 88755 89146 95773 103395 104833 Work Orders

02-243437-000 02-243438-000 15-408390-000 15-408391-000 15-408392-000 15-408393-000 Miscellaneous

Number Title Revision/Date

12-41 INPO Event Report

April 26, 2012

15-0209 Lab Analysis Report

June 1, 2015

AIF 28-001-01 Event Review Team Summary

October 6, 2014

AN 93-0213 Letter from M.D. Hall (MS2

-01) to E. L. Asbury (WC

-NP) July 20, 1993

AN-95-029 Control Room Fire Analysis

0 E-050A-00011 Lucent Technologies Lineage 2000 Round Cell Battery

W03 EPRI Technical Report 1011232

Emergency Diesel Generator Voltage Regulator Maintenance Issues

December 2004

A1-4 Miscellaneous

Number Title Revision/Date

ES 94-0004 Letter from

E.L. Asbury (WC

-NP) to M. D. Hall (MS2

-01) January 3, 1994

FR-015188 High Voltage Rectifiers

0 FR-015188 High Voltage Rectifiers

1 LER 2016-001-00 Power Potential Transformer Overloading Results in Emergency Diesel Generator Inoperability

March 28, 201

6 M-018-00309 Emergency Diesel Generator System

W136 NE 94-0011 Letter from D. R. Prichard (MS2

-01) to TE-43510 January 11, 1994

NK-E-001 125 VDC Class 1E Battery System Sizing, Voltage Drop and Short Circuit Studies

4 OTSC 15-0058 Alternator Inspection

13A PSA-05-0011 PSA Evaluation Sheet

0 STN GP-009 Emergency Equipment Verification

Completed February 5, 2016

STN-GP-009 Emergency Equipment Verification

Completed March 14, 2106 STN-GP-009 Emergency Equipment Verification

Completed April 11, 2016 Various NE106 Thermography Report

Since July 11, 2012

A2-1 Attachment 2

Significance Determination

Failure to Adequately Establish and Adjust Preventive Maintenance for Emergency Diesel Generator Excitation System Diodes

Significance Determination Basis

(a) Results: Screening Logic

Minor Question: In accordance with NRC Inspection Manual Chapter 0612, Appendix B, "Issue Screening," the finding was determined to be more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency adversely affected the emergency diesel generator

B capability to operate loaded for the technical specification required time caused by thermal degradation of diodes in the excitation circuitry. Thermal degradation of the diodes stressed the power potential transformers since they had to generate a magnetic field that exceeded their design ratings.

Initial Characterization: Using NRC Inspection Manual Chapter Attachment 0609.04 , "Initial Characterization of Findings," the inspectors determined that the finding could

be evaluated using the significance determination process. In accordance with Table 3, "SDP Appendix Router," the inspectors determined that the subject finding should be processed through Appendix A, "The Significance Determination Process (SDP) for Findings At

-Power," Exhibit 2, "Mitigating Systems Screening Questions," effective date

July 1, 2012. Issue Screening: In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Exhibit 2, "Mitigating Systems Screening Questions," the inspectors determined that the finding required a detailed risk evaluation because it represented an actual loss of function of the Emergency Diesel

Generator B for greater than its technical specification allowed outage time.

(b) Detailed Risk Evaluation:

(1) The Phase 3 Model Revision

and Other Probabilistic Risk Assessment Tools Used The analyst utilized a limited use model of the SPAR model

for Wolf Creek Generating Station, Version 8.26, which included the licensee's station blackout emergency diesel generators

, and hand calculation methods to quantify the risk of the subject performance deficiency. The analyst modified the model to include the actions needed for operators to start the station blackout emergency diesel generators using the SPAR

-H (human factors) model. The analyst also created an event tree to model a postulated fire leading to control room abandonment.

A2-2 (2) Assumptions

1. Emergency diesel generator B was unable to perform its function beginning on February

5, 2014, after it was secured from a monthly surveillance run. The analyst selected this date based on the inspection staff's assumption that failure of a pair of diodes in the excitation circuit resulted from thermal

degradation. The failure of the diodes caused additional stresses on the generator field circuits that resulted in the power potential

transformers catching fire and rendering the diesel generator inoperable. The analyst

determined this was a run

-time degradation, as defined in the Risk Assessment of Operational Events Handbook, Volume 1, "Internal Events," Revision 2.0

, and is consistent with the SPAR assumption that

emergency diesel generator

B must be capable of performing its risk

-significant function for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following an accident. This resulted in an applied exposure time of 243 days plus the repair time of 3.16

days. 2. No recovery credit was given based on the nature of the failure. It took approximately 76

hours to repair the failed components and restore

emergency diesel generator B to service.

3. A postulated seismic event could result in a long

-term demand for the

emergency diesel generators. A seismic event would likely result in a loss of offsite power caused by failure of the offsite power supply insulators that were not easily repairable. As a result, the increased risk from the failure of

emergency diesel g enerator B as a result of seismic initiators was included as part of the external events analysis.

4. A postulated tornado could result in long

-term demand for the emergency diesel generators. High winds would likely result in a loss of offsite power

caused by failure of the offsite power supply towers and were not easily repairable. As a result, the increased risk from the failure of emergency

diesel generator B based on high winds was included as part of the external events analysis.

5. The performance deficiency was a contributor to fire

-induced core damage. Emergency

diesel generator B is relied upon in the fire hazards analysis. Control room abandonment sequences were significant for this failure because emergency diesel generator B is the only power supply described in response procedures. Therefore, the unavailability of

emergency diesel generator B had increased risk significance for control room abandonment sequences and was included in the external event sequences.

6. A postulated control room fire that was not suppressed in 20 minutes would result in control room abandonment. However, not all cabinet fires can actually cause a loss of offsite power (LOOP), consequently, offsite power would remain available in most instances and could be restored if needed. By procedure, the licensee intentionally causes station blackout conditions

when abandoning the control room to ensure that they have control of their protected equipment.

A2-3 7. Despite control room abandonment procedures relying solely on

emergency diesel generator B, additional power sources available would include station blackout emergency diesel generators, offsite power, and emergency diesel generator A, provided the power supply and/or the associated equipment

were not damaged by the postulated fire.

8. Despite being a 4

-hour coping plant, vital batteries would last for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months prior to depletion without load shedding. The licensee provided information related

to this assumption and it was used in control room abandonment human reliability analysis calculations.

9. Upon loss of emergency diesel generator B, following a postulated control room abandonment, the turbine

-driven auxiliary feedwater pump would continue to operate until battery depletion.

10. Following a postulated control room abandonment, offsite power would be connected to

train A bus NB01 if it was not affected by the control room fire initiator. Therefore, instrumentation would be continuously available at the remote shutdown panel for train A and train A equipment would be available for mitigation efforts upon restoration to the bus.

11. Emergency diesel generator A can be started locally by plant operators as defined in site procedures. Therefore, this generator would potentially be

available as a power source following a postulated control room abandonment.

12. The increased stress on the diodes and power potential

transformers degraded only during times that the emergency diesel generator was running, defined as a run

-time failure. This implies that no degradation occurred while the emergency diesel generator was secured and in a standby status. It is further assumed that the failure was a deterministic outcome set to occur after a specific number of operating hours. Therefore, emergency diesel generator B would have failed to run at 2.98

hours following a LOOP demand at any time during the 27

-day, 16-hour period from its last successful surveillance test on September

8, 2014, until the test failure that occurred on October 6, 2014.

13. Similar to Assumption 12, emergency diesel generator B would have run and failed at the run time provided in Table 1 for the associated exposure period documented in that table for each of the additional seven periods from February 5, 2014

, to September

8, 2014. 14. Emergency diesel generator B exceeded 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of run time for the period prior to February

5, 2014. Given the total run time assumption, any time prior to this date, emergency diesel generator

B would have run for greater than the 24-hour mission

time. Therefore, this date is chosen as the cutoff for this analysis. 15. The licensee would be unable to recover emergency diesel generator

B within the 24

-hour mission time.

A2-4 16. The Wolf Creek Generating Station SPAR model, Version 8.26 (as modified), was an appropriate tool to use in this analysis, provided offsite power nonrecovery probabilities are adjusted based on each assumed run time of

emergency diesel generator B. A cutset truncation of 1.0E

-12 was used for all runs. Average test and maintenance was assumed.

17. Although the station blackout emergency diesel generators were not available from February 5, 2014, to April 25, 2014, the analyst assumed the SBO diesels were available with nom

inal failure rates.

NOTE: From February 5, 2014 to April 25, 2014, a period of 79 days, the

newly installed station blackout emergency diesel generators were not available. On June 23, 2016, the Significance and Enforcement Review Panel determined that no mitigation credit should be applied for the 79 day period where the SBO diesel would have not functioned. The NRC determined that mitigation credit for a new modification for the station blackout diesel generators was not warranted because the equipment was not verified to be capable of performing its risk mitigation function

. As a result, the SERP determined that sensitivity analysis #4 should be included in

the preliminary risk significance determination. The use of sensitivity #4 increased the risk significance into the low to moderate risk category (White).

(3) Significance Determination Process Assessment:

The analyst estimated the risk increase resulting from the emergency diesel generator B generator field excitation circuit component failures. The analyst determined that the licensee had operated

emergency diesel generator B

at the times and with the durations indicated in Table 1, "Emergency Diesel Generator B Run and Exposure Time Periods." These were reported as the period of time that the emergency diesel generator

B generator field excitation circuit components would have been subject to thermal induced aging. Note that the operational runs were conducted after the performance deficiency occurred.

Table 1 - Emergency Diesel Generator

B Run and Exposure Time Periods

Event Date Time Run Time Exposure Repaired October 9, 2014

17:17 0 3 days 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Failed during

24-hr test October 6, 2014

02.98 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 27 days, 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months

Surveillance

September 8, 2014

01.57 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , 33 minutes

33 days, 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months

Surveillance

August 6, 2014

02.11 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , 40 minutes 27 days, 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months

Surveillance

July 9, 2014

02.58 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months , 15 minutes

27 days, 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months

Surveillance

June 11, 2014

06.45 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months , 42 minutes

39 days, 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months

Surveillance

May 3, 2014

01.42 17 hours1.967593e-4 days 0.00472 hours 2.810847e-5 weeks 6.4685e-6 months , 7 minutes

35 days, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

Surveillance

March 28, 2014

04.73 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months , 51 minutes

19 days, 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months

Surveillance

March 9, 2014

01.16 23 hours2.662037e-4 days 0.00639 hours 3.80291e-5 weeks 8.7515e-6 months 32 days, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Surveillance

February 5, 2014

01.62 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , 37 minutes

24 days, 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months

A2-5 Internal Events Analysis

A. Risk Estimate for the 27

-day, 16-hour period between September

8, 2014 , and October 6, 2014: During this exposure period, emergency diesel generator

B would have been capable of running for 2.98

hours (used 3.0

hours in the analysis). The analyst adjusted the LOOP frequency used in the analysis to reflect the situation that only LOOPs with durations greater than 3.0

hours would result in a risk increase attributable to the diesel generator component failures. Using the SPAR model the analyst determined the base LOOP frequency was 3.59E

-2/year. Similarly, each of the four LOOP categories have the following frequencies:

Grid-Related LOOP

GR 1.22 x 10-2 Plant-Centered LOOP

PC 1.93 x 10-3 Switchyard

-Centered LOOP

SC 1.04 x 10-2 Weather-Related LOOP

WR 3.91 x 10-3

The nonrecovery

values for 3.0

hours in each LOOP category were developed using the plant-specific SPAR. Additionally, the analyst determined that the best mathematical representation for the nonrecovery of one of one emergency diesel generator was the square root of the nonrecovery for one of two. The resulting values were as follows:

Grid-Related LOOP

P(NR3.0)GR 2.50 x 10-1 Plant-Centered LOOP

P(NR3.0)PC 1.12 x 10-1 Switchyard

-Centered LOOP

P(NR3.0)SC 1.45 x 10-1 Weather-Related LOOP

P(NR3.0)WR 4.80 x 10-1 Emergency Diesel Generators (1of2)

P(NR3.0)1of2 7.45 x 10-1 Emergency Diesel Generators (1of1)

P(NR3.0)1of1 8.63 x 10-1 To account for having one of two emergency diesel generators to recover during the first 3.0 hours0 days 0 hours 0 weeks 0 months (emergency diesel generator B is assumed to be running during the first 3.0 hours0 days 0 hours 0 weeks 0 months of the event), the emergency diesel generator nonrecovery factor was adjusted to the square root of the base nonrecovery factor for both emergency diesel

generators at 3.0

hours. This adjusts the nonrecovery from both emergency diesel generators to a single emergency diesel generator. Therefore, the adjusted (current

LOOP), representing the frequency of LOOPs that are not recovered in 3

hours by either restoring offsite power or recovering a failure of Emergency Diesel Generator

A is: LOOP CAT * P(NR3.0) * P(NR3.0)1of1 For each of the four LOOP categories.

For the base case, the adjusted LOOP frequency includes the potential that either of the

emergency diesel generators are

Base) frequency is:

LOOP CAT * P(NR3.0) * P(NR3.0)1of2

A2-6 For each of the four LOOP categories.

The results of these calculations are documented in Table 2.

Table 2 - Adjusted Loss of Offsite Power Frequencies

LOOP Category

LOOP LOOP Single Diesel

Two Diesel

Adjusted LOOP Frequency Frequency Nonrecovery

Nonrecovery

Base Case Grid-Related 1.22E-02 2.50E-01 8.63E-01 7.45E-01 2.27E-03 2.63E-03 Plant-Centered 1.93E-03 1.12E-01 8.63E-01 7.45E-01 1.61E-04 1.86E-04 Switchyard

-Centered 1.04E-02 1.45E-01 8.63E-01 7.45E-01 1.13E-03 1.30E-03 Weather-Related 3.91E-03 4.80E-01 8.63E-01 7.45E-01 1.40E-03 1.62E-03 The analyst used the SPAR model to determine the conditional core damage probability of a station blackout that occurred for each of the four LOOP categories. The analyst modified the SPAR to establish the conditions for a station blackout after emergency diesel generator

B operated for 3

hours. The analyst set initiating event basic event failure probability to 1.0 for each LOOP category. Resetting station blackout time t=0 to 3.0

hours following the LOOP event requires that the recovery factors for offsite power and the emergency diesel generators be adjusted. For example, for the 1

-hour sequences in SPAR, the basic event for nonrecovery of offsite power should be adjusted to the nonrecovery at 4.0 hours0 days 0 hours 0 weeks 0 months , given that recovery has failed at 3.0

hours. The analyst used the adjusted nonrecovery factors for the four LOOP categories as listed in the last column in Table

2, "Offsite Power Nonrecovery Probabilities" and used the adjusted nonrecovery factors for the onsite electric power supplies as listed in the last column in Table

3, "Offsite Power Nonrecovery Probabilities." After adjusting SPAR for the LOOPs and the adjusted nonrecovery probabilities, the analyst used common cause failure of

both emergency diesel generators to model the conditions for a station blackout. The analyst included the resulting SPAR model station blackout conditional core damage probabilities for each LOOP category in Table

4, "Emergency Diesel Generator

A Nonrecovery Probabilities (Base)." Table 3 presents the adjusted offsite

power nonrecovery factors for the event times that are relevant in the SPAR core damage cut sets.

A2-7 Table 3 - Offsite Power Nonrecovery Probabilities

SPAR recovery time LOOP category SPAR base offsite power nonrecovery

SPAR base offsite power nonrecovery at 3.0 hours0 days 0 hours 0 weeks 0 months

SPAR base offsite power nonrecovery at 3.0 hours0 days 0 hours 0 weeks 0 months + SPAR recovery time in Column 1

SPAR recovery (Column 5 divided by Column 4)

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months GR 0.6587 0.2496 0.1685 0.6751 PC 0.3309 0.1117 0.0775 0.6941 SC 0.4014 0.1453 0.1024 0.7047 WR 0.6868 0.4800 0.4244 0.8842 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months GR 0.3915 0.2496 0.1189 0.4764 PC 0.1763 0.1117 0.0570 0.5105 SC 0.2240 0.1453 0.0761 0.5234 WR 0.5589 0.4800 0.3822 0.7963 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months GR 0.2496 0.2496 0.0869 0.3480 PC 0.1117 0.1117 0.0437 0.3908 SC 0.1453 0.1453 0.0587 0.4037 WR 0.4800 0.4800 0.3487 0.7265 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months GR 0.1685 0.2496 0.0652 0.2612 PC 0.0775 0.1117 0.0344 0.3083 SC 0.1024 0.1453 0.0465 0.3203 WR 0.4244 0.4800 0.3213 0.6694 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months GR 0.0869 0.2496 0.0392 0.1569 PC 0.0437 0.1117 0.0229 0.2047 SC 0.0587 0.1453 0.0312 0.2145 WR 0.3487 0.4800 0.2786 0.5804 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months GR 0.0501 0.2496 0.0251 0.1004 PC 0.0278 0.1117 0.0162 0.1448 SC 0.0377 0.1453 0.0221 0.1524 WR 0.2982 0.4800 0.2466 0.5138 Table 4 represents the emergency diesel generator A nonrecoveries used to adjust the SPAR model assuming emergency diesel generator

B operated for 3.0

hours then failed. Again, these values are conditional probabilities used to adjust timing in the SPAR. For example, for the 1

-hour sequences in SPAR, the basic event for nonrecovery of emergency diesel generator

A should be adjusted to the nonrecovery at 4.0 hours0 days 0 hours 0 weeks 0 months , given that recovery has failed at 3.0

hours.

A2-8 Table 4 Emergency Diesel Generator

A Nonrecovery Probabilities (Base

) SPAR recovery time SPAR base nonrecovery for 1 of 2 DGs

SPAR base DG nonrecovery at 3.0 hours0 days 0 hours 0 weeks 0 months for 1 of 2 DGs SPAR base DG nonrecovery at 3.0 hours0 days 0 hours 0 weeks 0 months + SPAR recovery time in Column 1

Modified SPAR recovery (Column 4 divided by Column 3) 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 0.8712 0.7451 0.6984 0.9373 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 0.8006 0.7451 0.6579 0.8830 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 0.7451 0.7451 0.6220 0.8348 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 0.6984 0.7451 0.5897 0.7914 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 0.6220 0.7451 0.5336 0.7161 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 0.5604 0.7451 0.4860 0.6523 Table 5 includes the following values developed and/or quantified using the plant

-specific SPAR model: Independent failure probabilities of each diesel generator (P(NE01 Failure) and P(NE02 Failure)

); The base LOOP initiation frequency (LOOP Initiation);

Total probability of common cause failure of both diesel generators (CCF 2of2 DGs); Common cause failure of an emergency diesel generator given that a single emergency diesel generator is unavailable (CCF 1of1 DGs); and

The adjusted station blackout conditional core damage probabilities for

each LOOP category (SBO CCDP

-xx (3.0)) after emergency diesel generator

B operated for 3.0

hours. Table 5 - Factors Used in 27.647

-day Exposure Period with 3

-hour Run Time

LOOP Initiation

3.59E-02 /year P(NE01 Failure)

7.40E-02 P(NE02 Failure)

7.40E-02 CCF 2of2 DGs

2.25E-04 CCF 1of1 DGs

7.94E-03 SBO CCDP-GR (3.0) 1.24E-03 SBO CCDP-PC (3.0) 1.32E-03 SBO CCDP-SC (3.0) 1.34E-03 SBO CCDP-WR (3.0) 8.94E-03 The analyst performed hand calculations to determine the core damage frequency that would result from a station blackout given that emergency diesel generator

B operated

A2-9 for 3.0 hours0 days 0 hours 0 weeks 0 months then failed using the data in Table

5. Therefore, the current case adjusted station blackout core damage frequency (CDF

SBO-Case) representing the frequency of station blackouts leading to core damage, given that the associated LOOP was not recovered in 3.0

hours by either restoring offsite power or recovering a failure of emergency diesel generator

A is: CDF SBO-Case = LOOP * (P(NE01 Failure) + CCF 1of1 DGs) * SBO CCDPCat For each of the four LOOP categories.

For the base case, the adjusted core damage frequency from a station blackout

(CDF SBO-base) includes the potential that either of the emergency diesel generators are recoverable. Therefore the base case station blackout core damage frequency is:

CDF SBO-base Base * [(P(NE01 Failure) * P(NE02 Failure)) + CCF 2of2 DGs] * SBO

CCDPCat For each of the four LOOP categories. The sum of the CDF

SBO-Base categories (shown in the calculation above) represents the total adjusted SPAR base case result. This result was 9.71 x 10

-8/year. Similarly, the total current case result (sum of the CDF

SBO-Case categories) was 1.62 x 10

-6/year. Therefore, the estimated incremental conditional core damage probability for the 27

-day, 16-hour period during which emergency diesel generator

B was assumed to be in a condition that guaranteed its failure at 3.0

hours is:

(1.62 x 10

-6/year - 9.71 x 10-8/year) * (27.65 days/365 days/year) = 1.15 x 10

-7 B. Summary of Risk Estimate for Seven Additional Run Time Periods

During each exposure period indicated in Table 1, emergency diesel generator

B would have been capable of running for its associated run time listed in the table. For simplicity, all run times were rounded to the nearest half hour. The analyst then adjusted the LOOP frequency and nonrecovery probabilities to reflect the situation that only LOOPs with durations greater than the run time would result in a risk increase attributable to the emergency diesel generator component failures. These calculations were developed in the same manner as the first exposure period documented in Section A. The resulting incremental conditional core damage probability for each exposure period was then documented in Table

6. C. Risk during the Repair Period from October

6, to October

9, 2014: As a result of the performance deficiency, during the time on October

6, 2014, at 1:26 p.m. when emergency diesel generator B tripped until October

9, 2014 , at 5:17 p.m. when the diesel was started after repairs, the machine was out of service and was unavailable for response. The analyst determined the model baseline is 4.00 x 10-6/year. The analyst established the current case by setting the emergency diesel generator B fail-to-run basic event to the house event TRUE. The resulting conditional core damage frequency was 8.75 x 10

-6/year.

A2-10 Therefore, the estimated incremental conditional core damage probability of

the 3.16-day period during which

emergency diesel generator

B was unavailable for response if it had been demanded was:

(8.75 x 10

-6/year - 4.00 x 10-6/year) * (3.16 days/365 days/year) = 4.11 x 10

-8 D. Internal Events Result:

Table 6 - Internal Events Incremental Conditional Core Damage Probability

Exposure Period

ICCDP 27 days, 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Period (09/08

- 10/06/2014)

1.15 x 10-7 33 days, 14 hour1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months Period (08/06

- 09/08/2014)

1.10 x 10-7 27 days, 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Period (07/09

- 08/06/2014)

7.14 x 10-8 27 days, 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Period (06/11

- 07/09/2014)

5.66 x 10-8 39 days, 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Period (05/03

- 06/11/2014)

5.20 x 10-8 35 days, 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Period (03/28

- 05/03/2014)

4.15 x 10-8 19 days, 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months Period (03/09

- 03/28/2014)

1.76 x 10-8 32 days, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Period (02/05

- 03/09/2014)

2.78 x 10-8 3-day, 4-hour Repair Period (07/13/15)

4.11 x 10-8 Total Internal Events ICCDP

5.34 x 10-7 E. Placing Station Blackout Emergency Diesel Generators in Service: The analysts noted that the station blackout emergency diesel generators were not modeled in the limited use plant

-specific SPAR model for internal events evaluations. Therefore, the analyst performed a SPAR

-H human reliability analysis methodology to quantify the probability of operator failure to place the station blackout emergency diesel generators in service following a postulated loss of all alternating

current power event.

Given input from the licensee and inspectors, the analyst calculated a reasonable value for the probability that operators

would fail to start the station blackout emergency diesel generators. The analyst considered this an infrequently performed evolution and determined that the operators had appropriate procedures and had been trained.

For this analysis, the analyst assumed that sufficient time and expertise was available to

perform these activities within one

hour. One hour response time was to account for the most limiting core damage sequences in the SPAR. In these sequences the turbine

-driven auxiliary feedwater pump fails to function. The results of this analysis are presented in Table

7 , "Operator Fails to Place Station Blackout Diesels in Service in

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ."

A2-11 Table 7 - Operator Fails to Place Station Blackout Diesels in Service in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

Performance Shaping Factor Diagnosis Action PSF Level Multiplier

PSF Level Multiplier

Time: Nominal 1.0 Nominal 1.0 Stress: High 2.0 High 2.0 Complexity:

Nominal 1.0 Nominal 1.0 Experience:

Nominal 1.0 Nominal 1.0 Procedures:

Diagnostic

0.5 Nominal 1.0 Ergonomics:

Nominal 1.0 Nominal 1.0 Fitness for Duty:

Nominal 1.0 Nominal 1.0 Work Processes:

Nominal 1.0 Nominal 1.0 Nominal 1.00E-02 1.00E-03 Adjusted 1.00E-02 2.00E-03 Odds Ratio:

1.00E-02 Odds Ratio:

2.00E-03 Failure to Recovery Probability:

1.20E-02 The nominal time for performing the actions was estimated to be approximately

20 minutes once the failure had been identified. The analyst assumed a 20

-minute time frame from failure to diagnosis of the need to use the station blackout emergency diesel

generators. Therefore, nominal credit for time available was applied for both diagnosis and action. High stress was assumed because the unit would be in a station blackout condition. Diagnostic procedures directly applying to the condition were available and followed the "response not obtained" format.

The analyst used this information and included this failure to recovery probability in the limited use

SPAR model to account for the likelihood that operators would fail to start the station blackout emergency diesel generators. This modified SPAR model was then used in all evaluations.

External Events Analysis

In accordance with Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) For Findings At

-Power," issued June 19, 2012, Section 6.0, "Detailed Risk Evaluation," when the internal events detailed risk evaluation results are greater than or equal to 1.0E

-7, the finding should be evaluated for external event risk contribution. Therefore, the analyst assessed the impact of external initiators because the internal events

detailed risk evaluation resulted in a core damage frequency of 5.34 x 10

-7. The methodology used to assess the impact of external events was to evaluate each initiator for

the potential to:

Increase the likelihood of a loss of offsite power

A2-12 Impact the reliability or availability of mitigating systems used during a loss of offsite power The analyst referenced the "Wolf Creek Generating Station Individual Plant Examination of External Events (IPEEE)," dated November 15, 1995. The analyst reviewed the IPEEE and concluded that the 1975 standard review plan criteria were met for floods, transportation accidents and nearby facility accidents, so those events were not considered further. The weather-related LOOP initiator was already included in the SPAR model. The remaining external accident initiators included seismic, fire

, and high wind.

A. Seismic

Seismic Calculation: The analyst assumed that a seismic event would not result in failure of emergency diesel generator

B because the median capacity of a generic emergency diesel generator is 1.45g peak ground acceleration

, which is significantly higher than the

dominate ranges in the Wolf Creek seismic hazard curve. However, the analyst noted that the dominant risk would result when a seismic event was large enough to destroy the switchyard insulators causing a nonrecoverable LOOP. As a bounding assumption, for all seismically induced LOOPs, the analyst assumed Emergency Diesel Generator

B would fail at time zero

(0). As such, the analyst evaluated the subject performance deficiency by determining each of the following parameters for any seismic event producing

a given range of median acceleration "a" [SE(a)]:

1. SE(a)); 2. The probability that a LOOP occurs during the event (P LOOP-SE(a)); 3. The baseline core damage probability (CCDP SE(a)); and 4. The case conditional core damage probability (CCDP

B-SE(a)). SE(a)) can then be quantified as follows: SE(a) SE(a) * P LOOP-S. E(a) * (CCDP B-SE(a) - CCDP SE(a)) Given that each range "a" was selected by the analyst specifically to be independent of SE(a) for each range evaluated as follows:

8 SE(a) a=.05 over the range of SE(a).

Conditional Core Damage Probability: The analyst calculated the likelihood of a seismically

-induced LOOP using the seismic hazard defined in the Risk Assessment of Operational Events Handbook, Volume

2, "External Events."

The analyst quantified a nonrecoverable LOOP using the plant

-specific SPAR model as the baseline conditional core damage probability (3.31 x 10

-5). The analyst then quantified the risk increase caused by the failure of

emergency diesel generator B. The case conditional core

A2-13 damage probability was 3.17 x 10

-4. This resulted in a change in the conditional core damage probability of 2.84 x 10

-4. Seismic Binning: NRC research data indicated that seismic events of 0.05g peak ground acceleration or less have little to no impact on internal plant equipment. Therefore, the analyst assumed that seismic events less than 0.05g do not directly affect

the plant. The analyst assumed that seismic events greater than 8.0g lead directly to core damage. The analyst therefore examined seismic events in the range of 0.05g to 8.0g. The analyst divided that range of seismic events into segments (called "bins" hereafter); specifically, seismic events from 0.05g to 0.08g to 0.15g to 0.25g to 0.30g to 0.40g to 0.50g to 0.65g to 0.80g to 1.00g to 8.00g were each binned.

In order to determine the frequency of a seismic event for a specific range of ground

motion (g in peak ground

acceleration), the analyst used the seismic hazard for Wolf Creek and obtained values for the frequency of the seismic event that generates a level of peak ground acceleration that exceeds the lower value in each of the bins. The analyst then calculated the difference in these "frequency of exceedance" values to obtain the frequency of seismic events for the binned seismic event ranges.

For example, the frequency of exceedance for a 0.25g seismic event at Wolf Creek is estimated at 1.53 x 10

-5/year and a 0.30g seismic event at 9.86

x 10-6/year. The frequency of seismic events with median acceleration in the range of 0.25g to 0.30g

[SE(0.35-0.30)] equals the difference, 5.40 x 10

-6/year. Probability of a Loss of Offsite Power: The analyst assumed that

a seismic event severe enough to break the ceramic insulators on the transmission lines will cause an unrecoverable LOOP.

The analyst obtained data on switchyard components from the Risk Assessment of Operating Events Handbook; Volume 2, "External Events," Revision 4, and other referenced documents. The references describe the mean failure probability for various equipment using the following equation:

Pfail(a) mr 2 u 2)1/2] on and a = median acceleration level of the seismic event;

a m= median of the component fragility (capacity);

r= logarithmic standard deviation representing random uncertainty;

u= logarithmic standard deviation representing systematic or modeling uncertainty. In order to calculate the LOOP probability given a seismic event the analyst used the following generic seismic fragility:

a m = 0.30g r = 0.30 u = 0.45

A2-15 fire areas in the power block because they could cause a nonrecoverable LOOP; however, they were determined to not be a significant risk contributor.

Analysis of Risk Associated with Fire Areas that Could Cause a LOOP: The analyst quantified base case and current case values using the SPAR for a

nonrecoverable LOOP as listed in Table

10. To establish the base case, the analyst set the failure probability for each category of LOOP to a failure probability of 1.0 and set each operator basic event for recovering each category of LOOP for any time period to the house event TRUE indicating that power recovery was not possible. The current case reflected the nonrecoverable LOOP and the failure of emergency diesel generator B at time zero. The failure of emergency diesel generator

B was developed by setting the Failure

-To-Run and Test and

Maintenance basic events equal to the house event TRUE and setting the Failure

-To-Start basic event equal to the house event FALSE. Table 10 - Nonrecoverable LOOP

CCDP Baseline 3.31E-05 Case (EDG Fails)

3.17E-04 Delta 2.84E-04 The analyst performed hand calculations to determine the change in core damage frequency that would result from a fire in plant areas coincident with a nonrecoverable LOOP using the data in Table

10. The analyst obtained the fire initiation frequencies (F IF CC-1D & FIF CC-1F) for the affected fire areas from the licensee's IPEEE. The analyst chose a severity factor of 0.1, from Inspection Manual Chapter 0609, Appendix F, "Fire

Protection Significance Determination Process," Task 2.4.1, "Nominal Fire Frequency Estimation." This severity factor accounts for the likelihood that the initiated fire would grow to a level that would result in a LOOP. The analyst first determined the base case core damage frequency for the individual fire areas by performing the following calculations:

CDFBase CC-1D = FIF CC-1D/year * SF * CCDPBase = 7.24 x 10

-4/year * 0.1 * 3.31 x 10

-5 = 2.40 x 10

-9/year CDFBase CC-1F = FIF CC-1F/year * SF * CCDPBase = 3.42 x 10

-3/year * 0.1 * 3.31 x 10

-5 = 1.13 x 10

-8/year Similarly, the analyst determined the current case core damage frequency for the individual fire areas:

CDFCase CC-1D = FIF CC-1D/year * SF * CCDPCase

A2-16 = 7.24 x 10

-4/year * 0.1 * 3.17 x 10

-4 = 2.30 x 10

-8/year CDFCase CC-1F = FIF CC-1F/year * SF * C

CDPCase = 3.42 x 10

-3/year * 0.1 * 3.17 x 10

-4 = 1.08 x 10

-7/year After combining the core damage frequencies for the individual fire areas for the base case and for the current case, the analyst calculated the delta conditional core damage frequency and

multiplied by the exposure period (EXP) to obtain the incremental conditional core damage probability.

CDFBase FAs = CDFBase CC-1D + CDFBase CC-1F = 2.40 x 10

-9/year + 1.13 x 10

-8/year = 1.37 x 10

-8/year CDFCase FAs = CDFCase CC-1D + CDF Case CC-1F = 2.30 x 10

-8/year + 1.08 x 10

-7/year = 1.31 x 10

-7/year CCDP = (CDFCase FAs - CDFBase FAs) * EXP = (1.31 x 10

-7/year - 1.37 x 10-8/year) * 242.95 days * 1year/365 days

= 7.83 x 10

-8 Control Room Abandonment Caused by a Fire: A fire in the control room could result in abandonment for numerous reasons. The licensed operators would relocate to their alternate shutdown panel. The only controls protected and isolated from a control room fire are associated with train B. The analyst evaluated the contribution to external risk for control room abandonment because the licensee relied upon emergency diesel generator

B to respond when a control room fire required abandonment. The fire hazards analysis and plant procedures specified that emergency diesel generator

B was the only power source available at the remote shutdown panel.

The analyst calculated the frequency of a control room abandonment (Fabandon) by combining the total control room fire ignition frequency (FIF

CR) and the nonsuppression probability (NSprob) for fires that would lead to abandonment as follows:

Fabandon = FIF CR * NSprob = 9.73 x 10

-3 * 3.40 x 10

-3

A2-17 = 3.31 x 10

-5/year The analyst developed an event tree (refer to Figure 1

- "Control Room Abandonment with Emergency Diesel Generator B Failed") to evaluate the risk contribution of a control room fire that results in abandonment. Operators would relocate to their alternate shutdown panel, which contains protected and isolated train B controls and some

train A controls. Given the subject performance deficiency, after having established safe and

stable conditions, emergency diesel generator NE02 would fail. Operators would be successful in protecting the core if power to the train B safety bus (NB02) is restored or if power to the train A safety bus (NB01) is restored combined with successful operation of several train A components. The analyst developed several fault trees for this condition by modifying the existing fault trees in the limited use Wolf Creek SPAR model.

The analyst developed a top event, "Train B Powered by SBO Diesels," that related to operators restoring power to the train B bus using the station blackout emergency diesel generators. The fault tree accounts for the failure of the diesel generators and associated equipment as well as the failure of operators to successfully perform the

recovery. The analyst used the SPAR

-H methodology to determine the probability of operator error in connecting the station blackout emergency diesel generators to Bus NB02. The value used is reflected in Table

11 , "Operator Fails to Place Station Blackout Diesels in Service in 8

Hours Following Control Room Abandonment

." According to Assumption 9, the turbine

-driven auxiliary feedwater pump would conti

nue to operate from the time emergency diesel generator B failed until battery depletion. As stated in Assumption 8, the vital batteries would last for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months without operator

intervention. Therefore, available time to complete this recovery was assumed

to be 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for diagnosis and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for taking action.

A2-18 Table 11 - Operator Fails to Place Station Blackout Diesels in Service in 8

Hours Following Control Room Abandonment

Performance Shaping

Factor Diagnosis Action PSF Level Multiplier

PSF Level Multiplier

Time: Extra 0.1 >5x 0.1 Stress: High 2.0 High 2.0 Complexity:

Nominal 1.0 Nominal 1.0 Experience:

Nominal 1.0 Nominal 1.0 Procedures:

Incomplete

20.0 Nominal 1.0 Ergonomics:

Nominal 1.0 Nominal 1.0 Fitness for Duty:

Nominal 1.0 Nominal 1.0 Work Processes:

Nominal 1.0 Nominal 1.0 Nominal 1.00E-02 1.00E-03 Adjusted 4.00E-01 2.00E-04 Odds Ratio:

3.88E-02 Odds Ratio:

2.00E-04 Failure to Recovery Probability:

3.90E-02 Using a table top walkthrough of plant procedures and discussions with licensee personnel, the analyst estimated the nominal time for diagnosing the need to use the station blackout emergency diesel generators was 20 minutes. Additionally, the analyst estimated that the nominal time to start and load the diesels following completion of diagnosis was 20 minutes. Therefore, extra credit for time available was applied for diagnosis because the time available was between one to two times greater than the nominal time required and was also greater than 30 minutes. Likewise, the time available for taking action was determined to be greater than 5 times the nominal time. High stress was assumed because the unit would be in a station blackout condition with

operators controlling the plant from outside the control room. The analyst assigned incomplete for diagnostic procedures because the control room abandonment procedure

did not identify using any power source other than emergency diesel generator B. Procedures for action were assigned nominal

, because once operators recognized the need to align the station blackout emergency diesel generators, specific procedures

were available.

The next top event, "Train B Powered from Offsite," identifies the likelihood that offsite power remains available and that operators restore offsite power to the train B bus. The associated fault tree reflects the likelihood that a control room fire causes a loss of offsite

power affecting train B. This was done by assuming a postulated fire leading to control room abandonment could have initiated in any of the 103 control room cabinets documented in the Individual Plant Evaluation for External Events. There were three cabinets in the control room that could have resulted in a loss

of offsite power. Therefore, the bounding probability of a control room fire causing a loss of offsite power

A2-19 was 2.91 x 10

-2, assuming that all fires in the three cabinets led to an unrecoverable loss of offsite power. In addition to the loss of offsite

power, the event tree models the conditions that operators would experience in the field if the station blackout emergency diesel generators were not available. This consideration evaluates the operator failure probability given the lack of procedures for restoring power outside of the control room. The analyst used the SPAR

-H methodology to determine this probability. The value used is reflected in Table

12 , "Operator Fails to Restore Offsite Power to NB02 following Control Room Abandonment." As described for the previous top event, based on Assumptions 8 and

9, the analyst assumed operators had 4

hours for diagnosis and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for taking action.

Table 12 - Operator Fails to Restore Offsite Power to NB02 following Control Room Abandonment

Performance Shaping

Factor Diagnosis Action PSF Level Multiplier

PSF Level Multiplier

Time: Extra 0.1 >5X 0.1 Stress: High 2.0 High 2.0 Complexity:

Nominal 1.0 Nominal 1.0 Experience:

Nominal 1.0 Nominal 1.0 Procedures:

Incomplete

20.0 Unavailable

50.0 Ergonomics:

Nominal 1.0 Nominal 1.0 Fitness for Duty:

Nominal 1.0 Nominal 1.0 Work Processes:

Nominal 1.0 Nominal 1.0 Nominal 1.00E-02 1.00E-03 Adjusted 4.00E-01 1.00E-02 Odds Ratio:

3.88E-02 Odds Ratio: 9.91E-03 Failure to Recovery Probability:

4.87E-02 Using a table top walkthrough of plant procedures and discussions with licensee personnel, the analyst estimated the nominal time for diagnosing the need to restore offsite power to Bus

NB02 would be 60

minutes. This nominal time included the

40 minutes for failure to utilize the station blackout emergency diesel generators plus

20 minutes for the diagnostic evaluation. Additionally, the analyst estimated that the

nominal time to manipulate breakers to supply offsite power to the bus was 30 minutes. Extra credit for time available was applied for diagnosis because the time available was

between one to two times greater than the nominal time required and was also greater than 30 minutes. Likewise, the time available for taking action was determined to be greater than 5 times the nominal time. High stress was assumed because the unit would be in a station blackout condition with operators controlling the plant from outside the control room. The analyst assigned the "Incomplete" performance shaping factor for diagnostic procedures because the control room abandonment procedure did not identify

A2-20 using any power source other than emergency diesel generator B. Procedures for action were determined to be incomplete

, because once operators recognized the need to align offsite power to bus NB02, operators had no specific procedures, related to control room abandonment, for aligning offsite power sources to bus NB02 locally (i.e., personnel in the Technical Support Center would have to generate the instructions or operators recognize the need to modify other off

-normal procedures).

The analyst noted that there was a direct dependency between the failure of operators to connect the station blackout emergency diesel generators to

bus NB02 and the failure of operators to restore offsite power to the same bus. Therefore, the analyst used the

SPAR-H Method to quantify this dependency. The analyst found that the diagnosis and

actions would be performed by the same crew, they would not be close in time because of the sequencing of the actions, they would be performed in the same location, but there would be the additional cues of no voltage on the bus and operator reports of failure of the system. This was considered moderate dependency and the dependent failure probability (P

dep) was calculated as follows:

P dep = (1 + 6 * Pind) ÷ 7 = (1 + 6 * 4.87 x 10

-2) ÷ 7 = 1.85 x 10

-1 The next top event, "Train A Powered

from Offsite," models offsite power or diesel generator NE01 supplying power to

bus NB01 and powering

train A equipment. The analyst noted that if offsite power is available to

train A, plant procedures leave power aligned to

bus NB01. Therefore, provided the control room fire did not affect offsite power to train A, bus NB01 will remain energized and available for use to the operators. If offsite power is not available, the associated fault tree models equipment failures

associated with diesel generato

r NE01 and the operators action to diagnose the need and actions to restore power to bus NB01 using the diesel generator. The analyst used the SPAR-H methodology to determine the latter probability. The value used is reflected in Table 13 , "Operator Fails to Place Emergency Diesel Generator A

in Service in

8 Hours following Control Room

Abandonment

." As described for the previous top event, based on Assumptions 8 and

9, the analyst assumed operators had 4

hours for diagnosis and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for taking action.

A2-21 Table 13 - Operator Fails to Place Emergency Diesel Generator

A in Service in 8 Hours following Control Room

Abandonment

Performance Shaping Factor

Diagnosis Action PSF Level Multiplier

PSF Level Multiplier

Time: Nominal 1.00 Nominal 1.0 Stress: High 2.0 High 2.0 Complexity:

Nominal 1.0 Nominal 1.0 Experience:

Nominal 1.0 Nominal 1.0 Procedures:

Incomplete

20.0 Nominal 1.0 Ergonomics:

Nominal 1.0 Nominal 1.0 Fitness for Duty:

Nominal 1.0 Nominal 1.0 Work Processes:

Nominal 1.0 Nominal 1.0 Nominal 1.00E-02 1.00E-03 Adjusted 4.00E-01 2.00E-03 Odds Ratio:

2.88E-01 Odds Ratio:

2.00E-03 Failure to Recovery Probability:

2.90E-01 Using a table top walkthrough of plant procedures and discussions with licensee personnel, the analyst estimated the nominal time for diagnosing the need to restore power to bus NB01 using

emergency diesel generator A would be 135

minutes. This nominal time included the delay that resulted from failure to provide power using the station blackout emergency diesel generators (40 minutes), failure to provide power to

bus NB02 (50 minutes), time evaluating the status of offsite power to bus NB01 (15 minutes), and deciding to use

emergency diesel generator A (30

minutes). Additionally, the analyst estimated that the nominal time to locally start and connect

emergency diesel generator A would be 60

minutes. High stress was assumed because the unit would be in a

station blackout condition with operators controlling the plant from outside the control room. The analyst assigned the "Incomplete" performance

-shaping factor to procedures for diagnosis because the control room abandonment procedure did not identify using emergency diesel generator A. Procedures for action were determined to be of nominal condition

, because once operators recognized the need to use

emergency diesel generator A, specific procedures were available to locally start the diesel generator.

The analyst noted that there was a direct dependency between the failure of operators to restore power to

bus NB02 and the failure of operators to restore power to

bus NB01 using diesel generator NE01. Therefore, the analyst used the SPAR

-H Method to quantify this dependency. The analyst found that the diagnosis and actions would be performed by the same crew, they would not be close in time because of the sequencing of the actions, they would be performed in different locations, and there would be no

additional cues that

bus NB01 required power. This was considered moderate dependency and the dependent failure probability (P

dep) was calculated as follows:

P dep = (1 + 6 * Pind) ÷ 7

A2-22 = (1 + 6 * 2.90 x 10

-1) ÷ 7 = 3.91 x 10

-1 Upon entry into the event tree, operators had already been successful using train B equipment to place the reactor in a safe and stable condition. However, there are no procedures for continuing to cool and stabilize the reactor using

train A equipment, nor has the equipment needed been challenged. Therefore, the next four top events model the operators' ability to continue stable shutdown conditions with train A equipment and the availability of the principle systems necessary.

The next top event, "Operators Fail to Shutdown Plant," models the probability of operators failing to properly diagnose the need and take actions to continue plant shutdown using train A equipment following control room abandonment. The analyst used the SPAR

-H methodology to determine this probability. The value used is reflected in Table 14 , "Operator Fails to Cool Reactor from train A following Control R oom Abandonment

." As described for the previous top event, based on Assumptions 8 and

9, the analyst assumed that there were 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months available for response from the time that emergency diesel generator B failed. With the estimated nominal time to provide power to

b us NB01 of approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the analyst assumed that operators had 3

hours for diagnosis and 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months for taking action. The analyst also assumed that operators had recognized that offsite power was available to NB01 or decided to provide power to

train A equipment using emergency diesel generator A. Table 14 - Operator Fails to Cool Reactor from Train A following Control Room Abandonment

Performance Shaping Factor

Diagnosis Action PSF Level Multiplier

PSF Level Multiplier

Time: Extra 0.10 Nominal 1.0 Stress: High 2.0 High 2.0 Complexity:

Nominal 1.0 Moderate 2.0 Experience:

Nominal 1.0 Nominal 1.0 Procedures:

Not available

50.0 Not available

50.0 Ergonomics:

Nominal 1.0 Nominal 1.0 Fitness for Duty:

Nominal 1.0 Nominal 1.0 Work Processes:

Nominal 1.0 Nominal 1.0 Nominal 1.00E-02 1.00E-03 Adjusted 1.00E-01 2.00E-01 Odds Ratio:

9.17E-02 Odds Ratio:

1.67E-01 Failure to Recovery Probability:

2.59E-01

A2-23 Using a table top walkthrough of plant procedures and discussions with licensee personnel, the analyst estimated the nominal time for diagnosing the appropriate methods to use train A equipment to stabilize the plant following power recovery to

b us NB01 would be 20 minutes. Additionally, the analyst estimated that the nominal time to perform these actions and place

train A equipment in service would be

60 minutes. Therefore, extra credit for time available was applied for diagnosis because the time available was between one to two times greater than the nominal time required

and was also greater than 30 minutes. However, only nominal time was applied to the action step because the nominal time to perform these actions was less than 5 times the time available. High stress was assumed because the unit would be in a station blackout condition with operators controlling the plant from outside the control room.

The analyst applied the "Nominal" performance shaping factor for complexity in diagnosis because the equipment needed were similar to those previously used in controlling the plant using train B. However, the analyst assigned a moderate complexity for actions because of the need to identify components and equipment

required to start after confirming availability on the remote shutdown panel and involved field operations of charging pump A. The analyst determined that procedures were not available to diagnose or to take action to use

train A equipment because the procedure for control room abandonment relies on operating

train B equipment.

For the remaining three top events, the analyst evaluated the availability of certain

train A equipment to operate following the control room abandonment. Each of the following three systems were modeled:

Auxiliary Feedwater Atmospheric Dump Valves

Reactor Coolant System Charging

In each respective fault tree, the analyst used portions of SPAR fault trees to model the failure of associated equipment. Additionally, the analyst evaluated the probability that the system survived damage from the control room fire because

train A components are not protected from damage in a control room fire. This probability was calculated by

determining the number of control room cabinets that could result in a failure of the respective system divided by the total control room population. The licensee provided that there were two cabinets affecting

train A auxiliary feedwater, three cabinets affecting atmospheric dump valves and an additional three cabinets affecting the

train A charging system. The resulting bounding probabilities of fire

-induced system failure were as follows: Auxiliary Feedwater

1.94 x 10-2 Atmospheric Dump Valves

2.91 x 10-2 Charging 2.91 x 10-2 Control Room Abandonment Results: The analyst quantified the event tree to assess the risk from postulated fires resulting in control room abandonment. A cutset truncation of 1.0 x 10

-15 was used for all runs. The incremental conditional core damage probability was determined to be 8.3 x 10-8 over the 243

-day exposure period.

A2-24 C. High Winds

The risk increase from external events related to wind that could result in a nonrecoverable LOOP had more than minimal risk. A

category EF2 or greater tornado could result in loss of the offsite power lines that would not be quickly repairable. The

analyst obtained the frequency of a category EF2 tornado occurring onsite using the data developed by the Office of Nuclear Reactor Research utilizing the methodology from NUREG/CR

-4461, "Tornado Climatology of The Contiguous United States," Revision 2. The analyst obtained base case and current case values from SPAR for a

nonrecoverable LOOP as listed in Table

10. To establish the base case, the analyst set the failure probability for each category of LOOP to a failure probability of 1.0 and set each operator basic event for recovering each category of LOOP for any time period to the house event TRUE indicating that power recovery was

not possible. The current case reflected the nonrecoverable LOOP and the failure of emergency diesel generator B at time zero. The failure of emergency diesel generator

B was developed by setting the Failure

-To-Run and Test & Maintenance basic events equal to the house event TRUE and setting the Failure

-To-Start basic event equal to the house event FALSE. The analyst performed hand calculations to determine the change in core damage frequency from a nonrecoverable LOOP resulting from high winds using the

data in Table 9. The analyst used the frequency for high winds represented by an EF2 tornado (TIFEF2) from data developed by the Office of Nuclear Reactor Research. The analyst first calculated the base case:

CCDPBase-EF2 = TIFEF2/year * CCDPBase * EXP = (2.98 x 10

-4/year * 3.31 x 10

-5) * (242.95 days * 1year/365 days)

= 6.57 x 10

-9 For the current case, the analyst calculated:

CCDPCase-EF2 = TIFEF2/year * CCDPCase * EXP = 2.98 x 10

-4/year * 3.17 x 10

-4) * (242.95 days * 1year/365 days)

= 6.29 x 10-8 The analyst determined the final change in risk for a nonrecoverable LOOP coincident with a failure of emergency diesel generator

B for a category EF2 tornado that would result in LOOP as:

ICCDP = CCDPCase-EF2 - CCDPBase-EF2 = 6.29 x 10

-8 - 6.57 x 10-9 = 5.63 x 10

-8

A2-25 D. External Events Results

The analyst summed the incremental conditional core damage probabilities for the affected external events, as listed in Table

15, to obtain the overall change in risk that would result from a nonrecoverable LOOP and failure of emergency diesel generator

B. The analyst summed the external event incremental conditional core damage probabilities to quantify the total change in risk from external initiators as 2.22

E-07. Table 15 - External Events Incremental Core Damage Probability

External Initiator

ICCDP Seismic 3.77 x 10-9 Individual Fire Areas

7.83 x 10-8 Control Room Abandonment

8.32 x 10-8 High Winds

5.63 x 10-8 Total External Events ICCDP

2.22 x 10-7 Results: The analyst combined the change in core damage frequency from the internal events

(5.34 E-07) and external events (2.22

E-07). The result was 7.55

E-07. The dominant core damage component resulted from a fire causing abandonment of the control room.

This external event had increased risk since the performance deficiency resulted in the post-fire safe shutdown equipment used to mitigate a fire being unavailable until the licensee recovered power using their station blackout emergency diesel generators. From February

5, 2014, to April

25, 2014, a period of 79 days, the newly installed station blackout emergency diesel generators were not available

because the current transformer was miswired.

On June 23, 2016, the Significance and Enforcement Review Panel determined that no mitigation credit should be applied for the 79 day period where the SBO diesel would not have functioned. The NRC determined that mitigation credit for a new modification for the station blackout diesel generators was not warranted because the equipment

was not verified to be capable of performing its risk mitigation function.

As a result, the SERP determined that sensitivity analysis #4 should be included in the preliminary risk significance determination. The use of sensitivity #4 increased the risk significance into the low to moderate risk category (White). Large Early Release Frequency

In accordance with Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process

," issued May 6, 2004, the analyst determined that this was a Type A finding, because the finding affected the plant core damage frequency. In accordance with the guidance in Appendix H, this finding would not involve a significant increase in risk of a large, early release of radiation because Wolf Creek has a large, dry containment and the dominant sequences contributing

to the change in the core damage frequency did not involve either a steam generator tube

A2-26 rupture or an inter

-system loss of coolant accident. Therefore, the analyst determined that the significance of this finding was considered to be core damage frequen

cy-dominant, and the impact to large, early release frequency was negligible.

Sensitivity Analyses: The analyst performed a variety of uncertainty and sensitivity analyses on the internal events model and on the external events calculation.

Sensitivity

Analysis 1 - Increase in Failure to Recover Probability for Operator Actions When Abandoning the Control Room

The analyst performed a sensitivity for the probability of success of remote shutdown using equipment other than the Train

B protected equipment because the associated basic event appeared in over 86

percent of the control room abandonment event tree cut sets. The analyst increased the failure probability by 25

percent from 2.59E

-01 to 3.24E

-01 and applied this value to the Fault Tree OEP

-ALT-SD, "Operators Fail to Shutdown Plant." Quantifying the control room abandonment event tree resulted in an incremental

conditional core damage probability from the control room abandonment of 8.65E

-08. The overall change in core damage frequency equaled 7.59

E-07 for internal and external initiators and remained in the very low risk significance range (Green).

Sensitivity Analysis

2 - Decreased Run Time Exposure Time

The analyst reduced the run time exposure from a range of dates that ensured emergency diesel generator

B would meet its 24

-hour mission time to the failure date postulated by the licensee in their second root cause of June 11, 2014. This resulted in

reducing the exposure time from 243 to 117 days. When using the 117 days the analyst determined that the change in the external events were reduced

, but the total incremental conditional core damage frequency for internal and external initiators equaled 5.49E

-07 and continued to remain in the very low risk significance range (Green).

Sensitivity Analysis 3 - Account for Mid

-cycle Outage

The analyst developed a bounding shutdown risk assessment that focused on the

18-day period during the mid

-cycle outage that train A was out of service. The analyst then reduced the at

-power evaluation by decreasing the exposure period by the 57 days the reactor was in Modes

4 or 5. The resulting total incremental conditional core damage probability for internal and external initiators (9.30E

-07) was higher than the calculated at-power risk.

Sensitivity Analysis 4 - Account for Unavailable Station Blackout Emergency Diesel Generators

The analyst developed a bounding risk assessment that focused on the 79

-day period from February

5, 2014, until April

25, 2014 , that the station blackout emergency diesel generators would not have started. To adjust the internal events contribution the analyst recalculated the station blackout conditional core damage probability

during the 17-hour, 22-hour, and 23-hour exposure windows using a limited use SPAR model that did no

t include modeling of the station blackout emergency diesel generators. Using this SPAR model, the analyst then calculated the effect of failed station blackout emergency diesel

A2-27 generators for the following external initiators: high winds, fire area

, and seismic. For the control room abandonment analysis, the analyst determined that offsite power would be available for recovery following most postulated control room fires. The analyst, therefore, calculated the probability that operators would be able to

restore power and stabilize the reactor following failure of

emergency diesel generator B when the station blackout emergency diesel generators were unavailable. The total resulting incremental

conditional core damage probability

for internal and external initiators was (1.54E-06), low to moderate risk significance range (White).

Sensitivity Analysis 5

- Account for Change in Number of Control Room Cabinets

During inspection of critical assumptions for this analysis, NRC inspection staff determined that there were discrepancies associated with the number of cabinets the inspection staff determined were in the control room and number designated in the

Individual Plant Evaluation of External Events. The licensee had recorded 103 cabinets. However, the inspectors determined that a number of these cabinets had been removed via modification. Additionally, the inspectors observed openings between cabinets that they determined invalidated the licensee's position that these were individual cabinets. As a result

of the inspectors accounting, they determined that the actual number of electrical cabinets in the control room was 60. They also determined that only two of these cabinets could result in a fire

-induced loss of offsite power.

The analyst calculated the impact of this discrepancy in quantifying the change in risk associated with control room abandonment if there were only 60 cabinets in the control room. The analyst adjusted the frequency of a fire

-induced loss of offsite power

and the probabilities for fire

-induced failures of the train A equipment. The overall incremental conditional core damage probability for internal and external initiators increased slightly

to 7.58E-07 and remained in the very low risk significance range

(Green). Sensitivity Analysis 6

- Account for Unavailability of Station Blackout Diesels and 60 Control Room Cabinets As an additional sensitivity, the analyst evaluated the overall result when Sensitivities 4

and 5 were combined. The analyst calculated the probability that operators would be able to restore power and stabilize the reactor following failure of emergency diesel generator B when the station blackout emergency diesel generators were unavailable, assuming that the actual number of electrical cabinets in the control room was 60. The total resulting incremental conditional core damage probability for internal and external initiators

(1.64E-06) was higher than the calculated at

-power risk and increased into the low to moderate risk significance range (White).

Sensitivity Analysis 7

- Adjust Emergency Diesel Generator A Failure Probability

In evaluating the risk of the emergency diesel generator B failure, the analyst assumed that there was a potential for common cause failure of emergency diesel generator A. Additionally, in the run

-time failure model used for this evaluation, the failure probability of emergency diesel generator A would not increase above the common cause failure increase because there was no actual failure of the machine. However, as a sensitivity, the analyst increased the failure

-to-run probability of emergency diesel generator A by 25 percent. This predominantly affected the internal events sequences. The overall incremental conditional core damage probability for internal and external initiators

A2-28 increased by approximately 15 percent to 8.86E

-07 and remained in the very low risk significance range (Green).

Licensee's Perspectives/Analyses

The licensee's final estimate of the increase in core damage frequency for the failure of the emergency diesel generator

B excitation circuits was 4.12E

-07. The licensee's root cause and risk analysis assume the event that resulted in the diesel generator failure occurred on June

11, 2014, because the first diode failed on this date, which resulted in additional stress and ultimate failure of emergency diesel generator

B in approximately 12

hours. The NRC inspection staff disagreed with the licensee's root cause and believed that thermal degradation of the diodes resulted in the failure. The licensee could have prevented the failure by performing preventive replacement of the diodes. The analyst determined that emergency diesel generator

B exceeded 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of run time for the period prior to February

5, 2014. Given the total run time assumption, emergency diesel generator B would have run for greater than the 24

-hour mission time before that date.

The licensee used their internal events probabilistic risk assessment model to estimate the effect of the performance deficiency on the risk from control room abandonment. The resulting change in core damage frequency was negligible. However, the analyst believes that this provided a significant underestimation of the risk because all recovery following loss of emergency diesel generator

B would be driven by operator action.

The licensee stated that their position was that control room operators would do whatever was necessary to maintain the control room habitable, even if the actions they took were not previously in plant procedures.

Additionally, they believed that multiple methods of reactor stabilization were available to the operators following a postulated control room abandonment. The following represents the dominant differences between the licensee's evaluation and that of the NRC analysts:

1. Licensee disagreed with the performance deficiency.

2. Licensee quantified the change in risk from the failure of emergency diesel generator B based on the total time (t) from June

11 through October

9, 2014.

3. Licensee assumed emergency diesel generator

B would fail after 1

hour.

4. Licensee's internal events value was 4.12E

-07. 5. Analyst noted that the licensee's internal events probabilistic risk assessment provided a factor of 2.5 lower than the SPAR.

6. Licensee does not have an external events model but provided an external events value of 2.14E

-10.

7. The licensee used their internal events probabilistic risk assessment model to estimate the effect of the performance deficiency on the risk from control room abandonment. The resulting change in core damage frequency was negligible.

A2-29 8. The analyst believes that the licensee's assessment of control room abandonment provided a significant underestimation of the risk because all recovery following loss of emergency diesel generator

B would be driven by operator action.

9. Licensee did not include the impact of high winds

. 10. Licensee considered the station blackout diesels to be available for the entire exposure period.

A2-30 Figure 1 - Control Room Abandonment with Emergency Diesel Generator B Failed

@@ Line 3: / Line 3: @@
 | issue date = 08/19/2016
 | title = NRC Inspection Report 05000482/2016008; January 1, 2016 Through June 29, 2016; Preliminary White Finding
-| author name = Pruett T W
+| author name = Pruett T
 | author affiliation = NRC/RGN-IV/DRP
-| addressee name = Heflin A C
+| addressee name = Heflin A
 | addressee affiliation = Wolf Creek Nuclear Operating Corp
 | docket = 05000482
 | license number = NPF-042
-| contact person = Taylor N H
+| contact person = Taylor N
 | case reference number = EA-16-069
 | document report number = IR 2016008
@@ Line 16: / Line 16: @@
 | page count = 53
 }}
-See also: [[followed by::IR 05000482/2016008]]
+See also: [[see also::IR 05000482/2016008]]
 =Text=

ML16235A132: Difference between revisions

Revision as of 23:18, 19 June 2019

Text

Navigation menu

ML16235A132: Difference between revisions

Revision as of 23:18, 19 June 2019

Text

Navigation menu

Search