IR 05000482/2016007

NRC Component Design Bases Inspection Report 05000482/2016007

ML16162A105
Person / Time
Site:	Wolf Creek
Issue date:	06/10/2016
From:	Thomas Farnholtz Region 4 Engineering Branch 1
To:	Heflin A Wolf Creek
References
IR 2016007
Download: ML16162A105 (49)

Text

June 10, 2016

Mr. Adam C. Heflin, President and

Chief Executive Officer Wolf Creek Nuclear Operating Corporation P.O. Box 411 Burlington, KS 66839

SUBJECT: WOLF CREEK GENERATING STATION

- NRC COMPONENT DESIGN BASES INSPECTION REPORT 05000482/2016007

Dear Mr. Heflin:

On April 28, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Wolf Creek Generating Station. On April 28, 2016, the NRC inspectors discussed the results of this inspection with Mr. J. McCoy, Vice President, Engineering, and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection

report.

NRC inspectors documented four findings of very low safety significance (Green) in this report. All of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Wolf Creek Generating Station.

If you disagree with a cross-cutting aspect in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Wolf Creek

Generating Station.

In accordance with Title 10 of the Code of Federal Regulations 2.390, "Public Inspections, Exemptions, Requests for Withholding," of the NRC's "Rules of Practice and Procedure," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public UNITED STATESNUCLEAR REGULATORY COMMISSION REGION IV 1600 E. LAMAR BLVD. ARLINGTON, TX 76011-4511 inspection in the NRC's Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Thomas R. Farnholtz, Branch Chief Engineering Branch 1 Division of Reactor Safety

Docket No. 50-482 License No. NPF-42

Enclosure:

Inspection Report 05000482/2016007 w/Attachment: Supplemental Information

REGION IV==

Docket: 05000482 License: NPF-42 Report No.: 05000482/2016007 Licensee: Wolf Creek Nuclear Operation Corporation Facility: Wolf Creek Generating Station Location: 1550 Oxen Lane NE Burlington, KS 66839 Dates: March 28 through April 28, 2016 Team Leader: C. Smith, Reactor Inspector Inspectors: A. Palmer, Senior Technology Instructor W. Sifre, Senior Reactor Inspector J. Watkins, Reactor Inspector Accompanying Personnel: G. Nicely, Contractor Beckman and Associates M. Yemini, Contractor, Beckman and Associates Approved By: Thomas R. Farnholtz, Chief, Engineering Branch 1

Division of Reactor Safety

- 2 -

SUMMARY

IR 05000482/2016007; 03/28/2016 - 04/28/2016; Wolf Creek Generating Station Baseline Inspection, NRC Inspection Procedure 71111.21, "Component Design Bases Inspection."

The inspection activities described in this report were performed between March 28, 2016, and April 28, 2016, by three inspectors from the NRC's Region IV office, one inspector from the NRC's Technical Training Center, and two contractors. Four findings of very low safety significance (Green) are documented in this report and all four of these findings involved violations of NRC requirements. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, "Significance Determination Process." Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects Within the Cross-Cutting Areas." Violations of NRC requirements are dis positioned in accordance with the NRCs Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process."

Cornerstone: Mitigating Systems

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, "The design control measures shall provide for verifying or checking the adequacy of design, such as by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program."

Specifically, prior to April 28, 2016, the licensee failed to verify the adequacy of the design of the Class 1E electrical equipment, because it failed to perform adequate analyses demonstrating 1) that the degraded voltage relay setpoints specified in technical specifications would ensure adequate voltage to safety-related equipment, 2) adequate voltage would be available to the safety-related loads during transient voltage conditions caused by load sequencing, and 3) that the degraded voltage relay-associated time delays provide timely separation from offsite power and transfer to the emergency diesel generator to ensure that the Class 1E safety-related loads can achieve their safety function without protective device tripping. In response to these issues, the licensee performed preliminary analyses to demonstrate that the Class 1E electrical equipment would function at degraded voltages and was operable. This finding was entered into the corrective action program as Condition Reports 47791, 104253, 104098, 104389, and 104390.

The team determined the licensee's failure to ensure the adequacy of the design of the Class 1E electrical equipment was a perfo rmance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the design control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee's electrical analyses failed to verify degraded voltage relay setpoints specified in technical specifications would ensure adequate voltage to safety-related equipment, that adequate voltage would be available to the safety-related loads during transient voltage conditions caused by load sequencing, and that degraded voltage relay time delays would provide timely separation from offsite power and transfer to the emergency diesel generator to ensure that the Class 1E safety-related loads can achieve their safety function without protective device tripping. In accordance with

Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a desi gn or qualification deficiency that did not to result in loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.1)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, "The design control measures shall provide for verifying or checking the adequacy of design, such as by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program."

Specifically, prior to April 28, 2016, the licensee failed to verify the adequacy of the design of the fuel oil transfer pump control circuitry to ensure that the thermal overloads associated with the fuel oil transfer pump would not activate, trip the pump, and render the emergency diesel generator inoperable in the case of excessive cycling. In response to this issue, the licensee conducted a preliminary evaluation of the fuel oil transfer pump and confirmed there is not any significant active leakage on the day tank which would lead to excessive cycling, and that starting currents are sufficiently below the thermal overload trip settings and are unlikely to trip the pump. Additionally, the licensee planned to initiate a program to determine fuel oil leakage from the day tank and require operators to initiate interim corrective actions until final corrective actions can be determined. This finding was entered into the licensee's corrective action program as Condition Report 104066.

The team determined the failure to evaluate the effects of cyclical fuel oil transfer pump operation was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the design control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the design of the fuel oil transfer pump control circuity does not prevent activation of the pump thermal overloads that would trip the pump and render the emergency diesel generator inoperable in the event of cyclical operation of the fuel oil transfer pump. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance. (Section 1R21.2.16.b)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, "The design control measures shall provide for verifying or checking the adequacy of design, such as by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program." Specifically, prior to April 28, 2016, the licensee failed to verify the design of the essential service water piping because the analyses assumed that the essential service water piping upstream of the containment air coolers was full of water after a loss of offsite power. However, the essential service water pump check valve was never tested to ensure water would not drain from the essential service water piping. In response to this issue, the licensee conducted a preliminary evaluation using data from the last surveillance test and inspection of the check valve, and concluded that the worst-case expected leakage through the check valve was not large enough to cause a water hammer event in the piping that exceeded operability criteria. This finding was entered into the licensee's corrective action program as Condition Reports 104222 and 104184.

The team determined that the failure to verify the adequacy of the design of the essential service water piping was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the design control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the failure to account for check valve leakage in the essential service water system led to a non-conservative assumption that the piping upstream of the containment air coolers would not drain after a loss of offsite power, which contributes to water hammer events that could challenge the integrity of the piping. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding was assigned a cross cutting aspect in the area of problem identification and resolution, specifically operating experience, because the water hammer issue was previously documented in several NRC inspection reports, the licensee made recent modifications to the system, and a 'companion' check valve in the normal service water system was installed and correctly categorized in the inservice testing basis document. The operating experience cross-cutting aspect requires that the licensee systematically and effectively collects, evaluates, and implements relevant internal and external operating experience in a timely manner [P.5]. (Section 1R21.2.17.b)

Green.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," which states, in part, "Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected." Specifically, prior to April 28, 2016, the licensee failed to correct deficiencies identified in 2012 for operator time critical actions associated with control room habitability; in 2013 after revising training materials for control room habitability time critical actions; in a 2014 condition report documenting the failure to validate scenarios in the time critical action program; and again in a 2015 self-assessment of the time critical action program. During the inspection, five out of six operators in a test crew failed to complete the control room habitability scenario within the required two minutes. In response to this finding, the licensee performed just-in-time training to remediate the crews and ensure time critical actions can be met. After re-training, each crew successfully performed the control room habitability time critical action within the two-minute requirement. This finding was entered into the licensee's corrective action program as Condition Reports 103910, 103915, and 103658.

• The team determined the failure to correct the deficiencies with the control room habitability time critical action was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the human performance attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, operators failed to meet the time critical action for the control room habitability scenario within the required two minutes. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of human performance associated with training because the licensee failed to provide training and ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9]. (Section 1R21.4.b)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity This inspection of component design bases verifies that plant components are maintained within their design basis. Additionally, this inspection provides monitoring of the capability of the selected components and operator actions to perform their design basis functions. As plants age, modifications may alter or disable important design features making the design bases difficult to determine or obsolete. The plant risk assessment model assumes the capability of safety systems and components to perform their intended safety function successfully. This inspectable area verifies aspects of the Initiating Events, Mitigating Systems, and Barrier Integrity cornerstones for which there are no indicators to measure performance.

1R21 Component Design Basis Inspection

.1 Overall Scope

To assess the ability of the Wolf Creek Generating Station equipment and operators to perform their required safety functions, the team inspected risk-significant components and the licensee's responses to industry operating experience. The team selected risk-significant components for review using information contained in the Wolf Creek Generating Station probabilistic risk assessments and the U. S. Nuclear Regulatory Commission's (NRC) standardized plant analysis risk model. In general, the selection process focused on components that had a risk achievement worth factor greater than 1.3 or a risk reduction worth factor greater than 1.005. The items selected included components in both safety-related and nonsafety-related systems including pumps, circuit breakers, heat exchangers, transformers, and valves. The team selected the risk-significant operating experience to be inspected based on its collective past

experience.

To verify that the selected components would function as required, the team reviewed design basis assumptions, calculations, and procedures. In some instances, the team performed calculations to independently verify the licensee's conclusions. The team also verified that the condition of the components was consistent with the design basis and that the tested capabilities met the required criteria.

The team reviewed maintenance work records, corrective action documents, and industry-operating experience records to verify that licensee personnel considered degraded conditions and their impact on the components. For selected components, the team observed operators during simulator scenarios, as well as during simulated actions in the plant.

The team performed a margin assessment and detailed review of the selected risk-significant components to verify that the design basis have been correctly implemented and maintained. This design margin assessment considered original design issues, margin reductions because of modifications, and margin reductions identified as a result of material condition issues. Equipment reliability issues were also considered in the selection of components for detailed review. These included items such as failed performance test results; significant corrective actions; repeated maintenance; 10 CFR 50.65(a)1 status; operable, but degraded, conditions; NRC resident inspector input of problem equipment; system health reports; industry operating experience; and licensee problem equipment lists. Consideration was also given to the uniqueness and complexity of the design, operating experience, and the available defense in-depth margins.

The inspection procedure requires a review of 15 to 25 total samples that include risk-significant and low design margin components, components that affect the large early release frequency, and operating experience issues. The sample selection for this inspection was 16 components, 1 component that affects large early release frequency, and 5 operating experience items. The selected inspection and associated operating experience items supported risk-significant functions including the following:

a. Electrical power to mitigation systems: The team selected several components in the electrical power distribution systems to verify operability to supply alternating current

(ac) and direct current

(dc) power to risk-significant and safety-related loads in support of safety system operation in response to initiating events such as loss of offsite power, station blackout, and a loss-of-coolant accident with offsite power available. As such the team selected:

• 4.16 kV switchgear NB002

• 480 V motor control center NG002A

• Emergency diesel generator NE002

• Transformers No. 2 XNB02 and No. 5 XNB05

• 125 Vdc bus NK04

• Pressurizer pressure operated relief valve solenoid BBPCV0456A

• Essential service water "A" (ESWA) pump room supply fan GDCGD01A

• Thermal barrier cooling flow transmitter BBFT0017

• Diesel fire pump pressure switch 1PSFP003 b. Components that affect large early release frequency: The team reviewed components required to perform functions that mitigate or prevent an unmonitored release of radiation. The team selected the following components:

• Reactor containment structure c. Mitigating systems needed to attain safe shutdown: The team reviewed components required to perform the safe shutdown of the plant. As such the team selected:

• Turbine-driven auxiliary feedwater pump PAL02

• Residual heat removal pump DPEJ01A

• Safety injection motor-operated valves HV8801A, HV8801B

• Control room and switchgear air conditioning systems

• Emergency diesel fuel oil transfer pump PJE01A

• Essential service water pump PEF01B (and associated piping modification)

.2.1 4.16 kV Class 1E Switchgear NB002:

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, current system health report, selected drawings, maintenance and test procedures, and condition reports associated with 4.16 kV class 1E switchgear NB002 to ensure design basis requirements and specifications were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits

• Protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions

• Degraded and loss of voltage relays and associated time delays were set in accordance with calculations, and that associated calibration procedures were consistent with calculation assumptions, associated time delays and set point accuracy calculations

• Selected portions of the licensee res ponse to NRC Generic Letter (GL) 2006-02, "Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power,"

dated February 1, 2006

• Coordination and interface with the transmission system operator for plant voltage requirements and notification set points were reviewed

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance

• Corrective action documents and system health reports to determine whether there were any adverse operating trends and to assess the station's ability to evaluate and correct problems

• Visual non-intrusive inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses.

b. Findings

Inadequate Degraded Voltage Analyses of Class 1E Systems

Introduction.

The team identified several examples of a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of the design of the Class 1E electrical equipment. Specifically, the licensee failed to perform adequate analyses demonstrating that:

a. Degraded voltage relay setpoints specified in technical specifications would ensure adequate voltage to safety-related equipment b. Adequate voltage would be available to the safety-related loads during transient voltage conditions caused by load sequencing

c. Degraded voltage relay time delays provide timely separation from offsite power and transfer to the emergency diesel generator to ensure that the Class 1E safety-related loads can achieve their safety function without protective device tripping

Description.

In 2011, the NRC issued Regulatory Issue Summary (RIS) 2011-12, "Adequacy of Station Electric Distribution System Voltages," to clarify voltage studies necessary for determining the proper settings for degraded voltage relays. Regulatory Issue Summary 2011-12 provided the NRC staff's position for the licensee's transmission network/offsite power system design to meet the requirements of General Design Criterion 17 to 10 CFR Part 50, Appendix A.

The team identified the following five examples of the performance deficiencies in electrical calculations that contributed to the failure of the licensee to verify and assure adequate voltages to safety-related equipment during a degraded voltage condition and/or design basis event with offsite power available in accordance with the guidelines in RIS 2011-12:

Example 1: Electrical calculation XX-E-009 failed to ensure that all safety-related loads, motors, and motor-operated valves have adequate starting and/or operating voltage when the 4160 V safety buses are operated at the Technical Specification 3.3.5.3 minimum degraded voltage dropout setpoint. The calculation did not address starting voltage capability for motors that may be started after load sequencing is completed when voltages on the bus may be slightly above the degraded voltage dropout setting. The use of higher 4160 V voltages associated with minimum grid voltage and degraded voltage relay reset point is non-conservative and would predict load terminal voltages higher than previously analyzed. After identification the licensee entered the issue into the corrective action program as Condition Report 47791.

Example 2: Electrical calculation XX-E-012 failed to ensure that safety-related control circuits have adequate voltage to pick up and operate when the 4160 V safety buses are operated at the Technical Specification 3.3.5.3 minimum degraded voltage dropout setpoint. The use of 4160 V associated with minimum grid voltage and degraded voltage relay reset point is non-conservative and would predict higher control circuit voltages than would actually exist; therefore, the control circuit contactors may not have adequate voltage to energize. After identification the licensee entered the issue into the corrective action program as Condition Report 104253.

Example 3: Electrical calculation XX-E-006 failed to perform analysis to ensure that sequenced low voltage safety-related motors and motor-operated valves have adequate starting voltage during minimum voltage dips during design basis accident load sequencing of large upstream 4160 V safety-related motors when on offsite power. The use of steady-state voltages instead of transient voltages is non-conservative and would predict higher voltages than would actually exist; therefore, the motors may not have adequate voltage to energize until after the upstream 4160 V starting motors have accelerated. The licensee also failed to evaluate the potential time delay or stall torque heating impact for affected motor-operated valves on the updated final safety analysis report accident analyses. After identification, the licensee entered the issue into the corrective action program as Condition Report 104098.

Example 4: Electrical calculation XX-E-012 failed to perform analysis to ensure that the motor control center (MCC) control circuits have adequate pickup and operating voltage for sequenced safety-related motors and motor-operated valves during minimum voltage dips during design basis accident load sequencing of large upstream 4 kV safety-related motors load sequencing when on offsite power. The use of steady-state voltages instead of transient voltages is non-conservative and would predict higher control circuit voltages than would actually exist; therefore, the control circuit contactors may not have adequate voltage to energize until after the upstream 4160 V starting motors have accelerated. The licensee also failed to evaluate the potential time delay impact for affected motor-operated valves on the updated final safety analysis report accident analyses. After identification the licensee entered the issue into the corrective action program as Condition Report 104098.

Example 5: Electrical calculation XX-E-009 failed to perform analysis to ensure that protective devices for safety-related loads during a degraded voltage condition for both the accident and non-accident time delays associated with Technical Specification 3.3.5.3 will not prevent the safety-related loads from performing their safety function upon transfer to the emergency diesel generator. For a sustained degraded voltage between the degraded voltage dropout setting and the loss of voltage setting, motors may be damaged or stall and trip out on overcurrent conditions, potentially resulting in unavailability of required safety loads during an event and may require manual operator actions to reset those protective devices. After identification the licensee entered the issue into the corrective action program as Condition Reports 47791 and 104390.

Analysis.

The team determined the licensee's failure to ensure the adequacy of the design of the Class 1E electrical equipment was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the design control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee's electrical analyses failed to verify degraded voltage relay setpoints specified in technical specifications would ensure adequate voltage to safety-related equipment, that adequate voltage would be available to the safety-related loads during transient voltage conditions caused by load sequencing, and that degraded voltage relay time delays would provide timely separation from offsite power and transfer to the emergency diesel generator to ensure that the Class 1E safety-related loads can achieve their safety function without protective device tripping. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power,"

dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not to result in loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, "design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational

methods, or by the performance of a suitable testing program." Contrary to the above, the licensee failed to provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, prior to April 28, 2016, the licensee failed to verify the adequacy of the design of the Class 1E electrical equipment, because it failed to perform adequate analyses demonstrating 1) that the degraded voltage relay setpoints specified in technical specifications would ensure adequate voltage to safety-related equipment, 2) adequate voltage would be available to the safety-related loads duri ng transient voltage conditions caused by load sequencing, and 3) that the degraded voltage relay-associated time delays provide timely separation from offsite power and transfer to the emergency diesel generator to ensure that the Class 1E safety-related loads can achieve their safety function without protective device tripping. In response to these issues, the licensee performed preliminary analyses to demonstrate that the Class 1E electrical equipment would function at degraded voltages and was operable. This finding was entered into the corrective action program as Condition Reports 47791, 104253, 104098, 104389, and 104390. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000482/2016007-01, "Inadequate Degraded Voltage Analyses of Class 1E Systems."

.2.2 480 V Safety-Related Motor Control Center NG002A

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with motor control center NG002A to ensure design basis requirements and specifications were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Calculations for electrical distribution, system load flow/voltage drop, short-circuit, and electrical protection to verify that bus capacity and voltages remained within minimum acceptable limits

• Protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions

• Calculations for the motor control center control circuit voltage drop and motor-operated valves terminal voltage and associated mechanical design torque and thrust for selected motor-operated valves

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance

• Corrective action documents and system health reports to determine whether there were any adverse operating trends and to assess the station's ability to evaluate and correct problems

• Visual non-intrusive inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses

b. Findings

No findings were identified.

.2.3 Emergency Diesel Generator NE002

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with emergency diesel generator NE002 to ensure design basis requirements and specifications were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Emergency diesel generator support component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Loading calculations to determine whether the capacity of the emergency diesel generator is adequate to supply worst-case accident loads

• Voltage and frequency calculations and operating procedures to determine whether steady-state limits are adequate to assure the adequacy of power to load equipment

• Protective device settings and circuit breaker ratings to ensure adequate selective protection coordination of connected equipment during worst-case short circuit conditions

• Emergency diesel generator feeder breaker dc control calculations to ensure that the spring charging motor and breaker closing and trip coils have adequate voltage to operate at the end of battery discharge

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance

• Last loss of offsite power/loss of coolant surveillance test to ensure that the voltage and frequency dips and recovery were within the RG 1.9 acceptable limits

• Corrective action documents and system health reports to determine whether there were any adverse operating trends and to assess the station's ability to evaluate and correct problems

• Visual non-intrusive inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses

b. Findings

No findings were identified.

.2.4 ESF No. 2 Transformer XNB02 and No. 5 Transformer XNB05

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the No. 2 transformer XNB02 and No. 5 transformer XNB05 to ensure design basis requirements and specifications were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

• Transformer maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance

• No. 5 transformer the periodic testing and maintenance for the automatic load tap changers including supporting calculations to ensure adequate voltage to the control circuits and tap changer motor when required to operate

• Loading calculations to determine whether the capacity of the transformer is adequate to supply worst-case loading

• Voltage calculations and operating procedures to determine whether transformer taps and administrative controls for switchyard voltage were adequate to assure the availability of offsite power during accident conditions

• Corrective action documents and system health reports to determine whether there were any adverse operating trends and to assess the station's ability to evaluate and correct problems

• Visual non-intrusive inspection to assess material condition, the presence of hazards, and consistency of installed equipment with design documentation and analyses

b. Findings

No findings were identified.

.2.5 Safety-Related 125Vdc Bus NK04

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis

documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with safety-related 125 Vdc bus NK04. The team also performed walkdowns and conducted interviews with

system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Calculations for electrical distribution, sy stem load flow/voltage drop to verify that bus capacity and voltages remained within minimum acceptable limits

• Sizing calculations to verify input assumptions, design loading, and environmental parameters are appropriate and that the distribution boards, batteries, and battery chargers are sized to perform the design basis function

• Procedures for preventive maintenance, inspection, thermography, and testing to compare maintenance practices against industry and vendor guidance

• Modifications made to the distribution boards

• Material condition of the dc distribution boards, batteries, battery chargers, to insure that design criteria and maintenance requirements are met

b. Findings

No findings were identified.

.2.6 Pressurizer Power Operated Relief Valve (PORV) Solenoid BBPCV0456A

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the power operated relief valve solenoid BBPCV0456A. The team also reviewed photographs of the installed conditions of the equipment and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Design specifications, installation drawings, modifications, and upgrades made to the system

• Vendor manuals for installation and maintenance

• Procedures for preventive maintenance, procedures for operation, inspection, and testing to compare maintenance practices against industry and vendor guidance

b. Findings

No findings were identified.

.2.7 Essential Service Water "A" (ESWA) Pump Room Supply Fan GDCGD01A

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with the essential service water train A GDCGD01A pump room supply fan. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Maintenance and testing activities performed on the fan and associated dampers in accordance with industry standards

• Mechanical and material condition of fan, dampers, and associated control and power equipment

• Vendor manuals for installation and maintenance

• Procedures for preventive maintenance, procedures for calibrations, inspection, and testing to compare maintenance practices against industry and vendor guidance

b. Findings

No findings were identified.

.2.8 Thermal Barrier Cooling Flow Transmitter BBFT0017

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis

documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with thermal barrier cooling flow transmitter BBFT017. The team also reviewed photographic information pertaining to the installed equipment and c onducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Maintenance and testing activities performed on the flow transmitter in accordance with industry standards

• Mechanical condition of the flow transmitter

• Replacement history

• Design specifications

• Installation drawings

• Vendor manuals for installation, maintenance, and testing of the flow transmitter

• Seismic and environmental qualifications and calculations for the installation of the flow transmitter, conduit, conduit supports, equipment seal assembly, and electrical conductor splicing methods to insure installation requirements met the design criteria for the environment of the equipment

b. Findings

No findings were identified.

.2.9 Diesel Fire Pump Pressure Switch 1PSFP003

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis

documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with pressure switch 1PSFP003 associated with the diesel-driven fire pump. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Maintenance and testing activities performed on the diesel-driven fire pump control panel and the associated pressure switch in accordance with industry standards

• Material condition of the diesel driven fire pump control panel, which is the enclosure for the pressure switch, to ensure the panel design criteria and maintenance requirements are met

• Design specifications

• Installation drawings

• Vendor manuals for installation, maintenance, and testing of the pressure switch and associated diesel driven fire pump control panel

b. Findings

No findings were identified.

.2.10 Reactor containment structure

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with the reactor containment building to ensure design basis requirements specification were met. The team also conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Reactor containment surveillance and testing procedures and results

• Reactor containment inspection results and corrective action documents

• Reactor containment worst-case pressure and temperature analysis for a main steam line break

b. Findings

No findings were identified.

.2.11 Turbine-driven auxiliary feedwater pump PAL02

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with turbine-driven auxiliary feedwater pump PAL02 to ensure design basis requirements specification were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Pump flow, head, and net positive suction head analyses

• Pump minimum flow and pump runout evaluations

• Preventive maintenance activities were verified to maintain the system according to manufacturer recommendations

• Surveillance test procedures and test results for the last three years and associated trend data

• Calculations associated with the transfer of suction from the condensate storage tank to the essential service water system

• Calculations and testing associated with the digital controls modification

b. Findings

No findings were identified.

.2.12 Turbine-driven auxiliary feedwater pump check valve ALV0054

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with turbine-driven

auxiliary feedwater pump check valve ALV 0054. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of the fuel transfer system to perform its safety-related design basis function. Specifically, the team reviewed:

• Check valve maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry benchmarks

• Vendor requirements established for the proper operation of the check valve to ascertain that the valve will operate as designed and to assure that the testability feature of the valve is properly executed

• Impact of reverse flow rate through the valve to verify that the established limits will not jeopardize pump operation

b. Findings

No findings were identified.

.2.13 Safety Injection Motor-Operated Valves HV8801A/HV8801B

c. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with safety injection motor-operated valves HV8801A, and HV8801B to ensure design basis requirements specification were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function.

Specifically, the team reviewed:

• Valve diagnostic tests and validations for the past five years

• Valve and actuator replacement and maintenance records

• Valve modifications in response to generic communications on pressure locking.

• Motor calculations that establish the motor voltage drop, protection and coordination, motor biological hazard potential requirements, and short circuit for the motor power supply and feeder cables

• Calculations for the degraded voltage at the motor-operated valve terminals to ensure the proper voltage was utilized in the team's review of motor-operated valve torque calculations

• Calculations that establish motor-operated valve control circuit voltage drop, short circuit, and protection/coordination including thermal overload sizing and application

d. Findings

No findings were identified.

.2.14 Residual Heat Removal Pump DPEJ01A

a. Inspection Scope

The team reviewed the updated safety analysis report, design basis documents, the current system health report, selected drawings, maintenance and test procedures, and condition reports associated with residual heat removal pump DPEJ01A to ensure design basis requirements specification were met. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of this component to perform its desired design basis function. Specifically, the team reviewed:

• Pump flow, head, and net positive suction head analyses

• Pump minimum flow and pump runout evaluations

• Preventive maintenance activities were verified to maintain the system according to manufacturer recommendations

• Surveillance test procedures and test results for the last three years and associated trend data

b. Findings

No findings were identified.

2.15 Control room and switchgear air conditioning systems

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis

documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with control room and switchgear room heating, ventilation, and air conditioning systems. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of the fuel transfer system to perform its safety-related design basis function. Specifically, the team reviewed:

• The heat removal capability of each of the air conditioners to ascertain that it is capable of removing the entire heat load at the most demanding conditions

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry

• Vendor requirements established for the proper operation of the heating, ventilation, and air conditioning units to ascertain that they will operate as designed and that the limits established for them are not exceeded

• Impact of a loss of a component and operator actions required to bring it back to service

b. Findings

No findings were identified.

2.16 Emergency diesel fuel oil transfer pump PJE01A

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, the current system health report, selected drawings and calculations, maintenance and test procedures, and condition reports associated with emergency diesel generator fuel oil transfer pump PJE01A. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of the fuel transfer system to perform its safety-related design basis function. Specifically, the team reviewed:

• Component maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry

• Vendor requirements and limits established for the operation of the fuel oil transfer pumps to ensure that the pumps will operate as designed and to assure that specific limits of operation are not exceeded

• Thermal overloads protection for the fuel oil transfer pumps to assure that they remain available when needed

• Operator rounds and operator actions associated with the fuel oil transfer pumps and the fuel level in the day tank to verify that pump condition is monitored

• Day tank elevation, venting capability, and fl ame arrestors, as well as day tank level instruments and setpoints, to assure that the day tank remains available at all times containing sufficient amount of fuel oil and to assure that the pumps will not cycle excessively

b. Findings

Failure to Protect the Fuel oil Transfer Pump from Excessive Cycling.

Introduction.

The NRC identified a Green non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's failure to verify the adequacy of the design of the emergency diesel generator's fuel oil transfer pump. Specifically, the licensee failed to ensure the diesel fuel oil pump control circuitry would not activate the thermal overloads that would stop the pump and render the emergency diesel generator inoperable.

Description.

The emergency diesel generator fuel oil transfer pump provides the motive force to transfer fuel oil from a large underground storage tank to a smaller day tank mounted above ground in the diesel generator building near the diesel engine. The fuel oil transfer pump control circuits receive start and stop signals from level switches in a standpipe located on top of the day tank. The volume of diesel fuel oil between the pump start and pump stop setpoints is small (approximately 1 gallon) compared to the flow rate of the fuel oil transfer pump (35 gallons per minute). If a low-level setpoint is reached on the day tank, the fuel oil transfer pump will start pumping fuel oil and operate for one or two seconds before it stops and shuts off when the level reaches the high-level setpoint of fuel oil. The configuration of the fuel oil transfer system allows for cyclical operation of the fuel oil transfer pump if fuel drains from the day tank. The NRC inspection team performed a review of day tank level. The data showed that the day tank was gradually leaking and, as expected, the pump cycled to keep the tank above the low-level setpoint. The licensee did not establish a limit on the number of fuel oil transfer pump starts per hour, nor were they able to get the information from the pump or motor manufacturer. Excessive cycling would eventually cause the thermal overloads associated with the fuel oil transfer pump to activate. There is no analysis to demonstrate that the thermal overloads will not trip the motor, which would stop pump operation and render the emergency diesel generator inoperable.

In 1994, the fuel oil transfer pump control circuitry was modified to bypass the day tank level setpoints and allow for continuous fuel oil transfer pump operation while the diesel engine was running. This modification was done to increase the reliability of the pump. However, in the standby configuration when the diesel engine is not running, the fuel oil transfer pump control circuitry still relies on the level setpoints to automatically start and start the pump which does not prevent excessive cycling.

Analysis.

The team determined the failure to evaluate the effects of cyclical fuel oil transfer pump operation was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the design control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the design of the fuel oil transfer pump control circuity does not prevent activation of the pump thermal overloads that would trip the pump and render the emergency diesel generator inoperable in the event of cyclical operation of the fuel oil transfer pump. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding did not have a cross-cutting aspect because the most significant contributor did not reflect current licensee performance.

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, "The design control measures shall provide for verifying or checking the adequacy of design, such as by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program." Contrary to the above, prior to April 28, 2016, the licensee failed to provide measures for verifying the adequacy of the design, such as by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, the licensee failed to verify the adequacy of the design of the fuel oil transfer pump control circuitry to ensure that the thermal overloads associated with the fuel oil transfer pump would not activate, trip the pump, and render the emergency diesel generator inoperable in the case of excessive cycling. In response to this issue, the licensee conducted a preliminary evaluation of the fuel oil transfer pump and confirmed there is not any significant active leakage on the day tank which would lead to excessive cycling, and that starting currents are sufficiently below the thermal overload trip settings and are unlikely to trip the pump. Additionally, the licensee planned to initiate a program to determine fuel oil leakage from the day tank and require operators to initiate interim corrective actions until final corrective actions can be determined.

This finding was entered into the licensee's corrective action program as Condition Report 104066. This violation is being treated as an non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensee's corrective action program as Condition Report 104066. (NCV 05000482/2016007-02, "Failure to Verify the Adequacy of Design of the Control Circuitry of the Fuel Oil Transfer Pumps.")

.2.17 Essential service water pump PEF01B and associated piping modifications

a. Inspection Scope

The team reviewed the updated safety analysis report, system description, design basis documents, selected drawings and calculations, procedures, and condition reports associated with the essential service water pumps and the recent modification installed to minimize the magnitude of a water hammer associated with loss of offsite power -

with and without a loss-of-coolant accident. The team also performed walkdowns and conducted interviews with system engineering personnel to ensure the capability of the pump to perform its safety function and the capability of the modified discharge piping

with the vacuum breakers and newly installed service water check valve to minimize the magnitude of a water hammer following a loss of offsite power. Specifically, the team

reviewed:

• Pump maintenance history and corrective action program reports to verify the monitoring of potential degradation

• Corrective action documents issued in the past 5 years to verify that repeat failures, and potential chronic issues, will not prevent the essential service water pump and associated components from performing their safety function

• Procedures for preventive maintenance, inspection, and testing to compare maintenance practices against industry and vendor guidance

• Testing methodology, the values assigned to acceptance criteria, and whether the values supported design parameters and assumptions

• Correspondence detailing the Wolf Creek response and commitments regarding Generic Letter 96-06 to verify that all actions were adequately implemented

• Water hammer analysis performed for the essential service water discharge piping (downstream of the containment fan coolers), taking credit for the modified piping, newly installed vacuum breakers and newly installed check valve to verify the adequacy of the analysis, and to ascertain that assumptions are adequate and that the correct design inputs were used

• Design of the vacuum breakers and the method used to test them to verify that the vacuum breakers will operate as designed and as assumed in piping analyses

• Performance record of the vacuum breakers, special actions taken to monitor excessive chattering, and accelerated maintenance due to chattering to ascertain that they will perform as designed when they are required to open

• Corrective actions associated with previous NRC violations on the subject of discharge piping water hammer analysis to verify that the licensee did not leave any issues outstanding

b. Findings

Inadequate analysis of essential service water piping

Introduction.

The NRC identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the licensee's inadequate analysis associated with the essential service water pi ping. Specifically, the essential service water piping analyses incorrectly assumed the piping sections upstream of the containment air coolers were full of water.

Description.

In 2015, the licensee modified the essential service water piping system to mitigate rapid pressure spikes known as water hammer events. During normal operations, normal service water supplies components in the essential service water system. During a loss of offsite power, normal service water pumps stop. Approximately thirty seconds later, after the emergency diesel generators start and power the emergency buses, the essential serv ice water pumps start to provide cooling water to the essential service water loads. During these 30 seconds when no pumps are running, the essential service water system partially drains. The starting of the essential service water pumps rapidly fill the system, which leads to the rapid collapse of the voided (drained) piping sections with the inrush of water and causes water hammer. Such water hammer events have previously caused leaks in sections of essential service water piping. The NRC previously identified violations for the water hammer issues in Inspection Reports 05000482/2012007, 05000482/2010006, and 05000482/2009007. On November 26, 2014, NRC Region IV staff sent a letter to Wolf Creek summarizing the previous inspection findings and the licensee's planned actions to address the water hammer issues in the essential service water system. A copy of this letter is available in ADAMS (Accession No. ML14330A485).

The 2015 modification added vertical pipe sections downstream of the containment air coolers with vacuum breaker vent valves at the high points. This modification mitigated some of the water hammer effects of the piping downstream of the containment air coolers by admitting air into the system to cushion the collapse that occurs as water encounters voided piping sections. However, the modification and associated analyses incorrectly assumed that the piping upstream of the containment air coolers was hydraulically locked (full of water).

The NRC reviewed the inservice testing basis document for the essential service water pump discharge check valves, com ponent tag numbers EFV0001 (train A) and EFV0004 (train B), and found the valves are listed as "no safety function to close." The check valves are required to close upon loss of offsite power to prevent the drainage of large sections of essential service water piping to avoid water hammer. Although the valves were listed as having no safety function to close, the inservice testing basis document specified that the leakage past the check valve would be acceptable provided that the associated essential service water pump shaft did not rotate backwards. However, the licensee was unable to quantify how much leakage it would take to rotate the pump shaft backwards. Previous operational experience from NRC inspection findings, as documented in Inspection Report 05000321/2012008 (ML12285A443), showed that the leakage required to rotate the pump backwards for a similar type service water pump was more than 3,000 gallons per minute. Further, because of the configuration of the piping system, the licensee did not have any guidance on how to discriminate leakage past the check valves and water leakage from the piping section upstream of the check valves. Since construction, the essential service water check valves were never tested in the closed position and, therefore, did not prevent drainage of essential service water piping.

In addition, the 2015 modification added check valves EFV0470 (train A) and EFV0471 (train B) in the normal service water piping system at the piping tee that cross-connects to the essential service water piping. The NRC reviewed the inservice testing basis document for valves EFV0470 and EFV0471 and noted the valves have leakage acceptance criteria in the closed position of less than 2.5 gallons per minute. The addition of valves EFV0470 and EFV0471 prevented leakage of water through the normal service water piping and pumps; however, water was still free to drain from the essential service water piping and pumps through the essential service water check valves EFV0001 and EFV0004.

Because the leakage past check valves EFV0001 and EFV0004 was greater than zero (and theoretically up to 3,000 gallons per minute to rotate the pump backwards), the analyses for the essential service water system incorrectly assumed the essential service water piping was full of water. As a result of this invalid assumption, the water hammer analyses were non-conservative because the voided sections of piping would cause larger water hammer pressure spikes compared to piping full of water.

Analysis.

The team determined that the failure to verify the adequacy of the design of the essential service water piping was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the design control attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to account for check valve leakage in the essential service water system led to a non-conservative assumption that the piping upstream of the containment air coolers would not drain after a loss of offsite power, which contributes to water hammer events that could challenge the integrity of the piping. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding was assigned a cross cutting aspect in the area of problem identification and resolution, specifically operating experience, because the water hammer issue was

previously documented in several NRC inspection reports, the licensee made recent modifications to the system, and a 'companion' check valve in the normal service water system was installed and correctly categorized in the inservice testing basis document. The operating experience cross-cutting aspect requires that the licensee systematically and effectively collects, evaluates, and implements relevant internal and external operating experience in a timely manner [P.5].

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," which states, in part, "The design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program." Contrary to the above, prior to April 28, 2016, the licensee failed to verify or check the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Specifically, the licensee failed to verify the design of the essential service water piping because the analyses assumed that the essential service water piping upstream of the containment air coolers was full of water after a loss of offsite power. However, the essential service water pump check valve was never tested to ensure water would not drain from the essential service water piping. In response to this issue, the licensee conducted a preliminary evaluation using data from the last surveillance test and inspection of the check valve, and concluded that the worst-case expected leakage through the check valve was not large enough to cause a water hammer event in the piping that exceeded operability criteria. This finding was entered into the licensee's corrective action program as Condition Reports 104222 and 104184. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000482/2016007-03, "Inadequate Analysis of Essential Service Water Piping."

.3.1 NRC Information Notice 2012-06, "Ineffective Use of Vendor Technical Recommendations"

a. Inspection Scope

The team inspected the licensee's review of NRC Information Notice 2012-06, "Ineffective Use of Vendor Technical Recommendations." The information notice described that the NRC's review of recent oper ating experience involving ineffective use of vendor technical recommendations indicates that many of these events potentially allow latent failures to exist undetected and become an underlying cause of risk-significant initiating events. Many, if not most, of these events are preventable. Ineffective use of vendor technical recommendations can cause or contribute to operational transients, scrams, and component failures. The team reviewed the licensee's evaluation of the potential impact of the identified issues to determine if the issues in the information notice were directly applicable to Wolf Creek Generating Station and that appropriate corrective actions were taken if applicable.

b. Findings

No findings were identified.

.3.2 NRC Information Notice 2012-16, "Pre-Conditioning of Pressure Switches before Surveillance Testing"

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2012-16, "Pre-conditioning of Pressure Switches Before Surveillance Testing," to verify the licensee performed an applicability review and took appropriate corrective actions, if appropriate, to address the concerns. The team verified that the licensee's review adequately addressed the issues in the information notice.

b. Findings

No findings were identified.

.3.3 NRC Information Notice 2010-25, "Inadequate Electrical Connections"

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2010-25, "Inadequate Electrical Connections," to verify the licensee performed an applicability review and took appropriate corrective actions, if appropriate, to address the concerns. The team verified that the licensee's review adequately addressed the issues in the information

notice.

b. Findings

No findings were identified.

.3.4 NRC Information Notice 2015-05, "Inoperability of Auxiliary and Emergency Feedwater Auto-Start Circuits on Loss of Main Feedwater Pumps"

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2015-05, "Inoperability of Auxiliary and Emergency Feedwater Auto-Start Circuits on Loss of Main Feedwater," to verify that a program was in place to address issues identified by the NRC staff concerning the operation of main feedwater systems in such a manner that would disable the automatic initiation of auxiliary or emergency feedwater on loss of all main feedwater pumps. The team verified that the licensee's review adequately addressed the issues in the information notice.

b. Findings

No findings were identified.

.3.5 NRC Information Notice 2014-07, "Degradation of Leak-Chase Channel Systems for Floor Welds of Metal Containment Shell and Concrete Containment Metallic Liner"

a. Inspection Scope

The team reviewed the licensee's evaluation of Information Notice 2014-07, "Degradation of Leak-Chase Channel Systems for Floor Welds if Metal Containment Shell and Concrete Containment Metallic Liner," to verify that a program was in place to address issues identified by the NRC staff concerning degradation of floor weld leak-chase channel systems of steel containment shell and concrete containment metallic liner that could affect leak-tightness and aging management of containment structures. The team verified that the licensee's review adequately addressed the issues in the information notice.

b. Findings

No findings were identified.

.4 Results of Reviews for Operator Actions

a. Inspection Scope

The team selected risk-significant components and operator actions for review using information contained in the licensee's probabilistic risk assessment. This included components and operator actions that had a risk achievement worth factor greater than two or Birnbaum value greater than 1E-6.

For the review of operator actions, the team observed operators during simulator scenarios associated with the selected components as well as observing simulated actions in the plant.

The selected operator actions were:

• Scenario 1 was designed to cause a failure of the pressurizer level control circuitry. The scenario was initiated by failing one controlling channel low and the other channel failed as-is. The crew manually controlled charging and letdown flow and stabilized the plant using applicable procedures. After the failed channel was de-selected from the controlling circuitry and the charging and letdown flows were balanced, the scenario and timed action was completed.

• Scenario 2, Part 1: The second scenario was a manual reactor trip following an anticipated transient without scram (ATWS). The event was initiated by a spurious turbine trip which should have resulted in a reactor trip at full power. The crew recognized a reactor trip was needed, did not occur, and initiated a manual reactor trip within the required time period.

• Scenario 2, Part 2: The second part of the second scenario was a failure of the manual reactor trip using the reactor trip switches. The crew manually removed power to the control rod drive motor generators from the control room in accordance with applicable procedures. After the rods fell into the core, the timed actions and scenario was completed.

• Scenario 3, Part 1: The first event is a trip of the operating component cooling water (CCW) pump and failure of the other CCW pump in that train to start, which resulted in a loss of CCW flow. The crew identified the loss of CCW flow, started a CCW pump in the other train, and transferred the inservice CCW loss of offsite power to the operating CCW loss of offsite power.

• Scenario 3, Part 2: Then the second part of the scenario was an inadvertent safety injection. The scenario ended within the required time frame when the operations crew terminated the inadvertent safety injection by closing the boron injection tank inlet and outlet valves.

• In-plant job performance measure:

This job performance measure was designed for the control room operators to don self-contained breathing apparatus (SCBAs) for a toxic environment in the control room affecting habitability in accordance with Procedure OFN RP-013 within two minutes. This time critical action is described in the Updated Safety Analysis Report, Section 6.4.

b. Findings

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," for the licensee's failure to correct deficiencies with time critical operator actions. Specifically, the inspectors determined that the licensee failed to correct deficiencies with the control room habitability operator actions identified in 2012 and identified that five out of six operators failed to meet the time requirements for a simulated control room habitability scenario as part of the inspection.

Description.

The updated safety analysis report documents a requirement for operators to don portable respirators, known as self-contained breathing apparatus (SCBA), within two minutes of a toxic gas release that would affect the control room habitability. During the component design basis inspection, the NRC team observed a simulation of the toxic gas control room habitability scenario. The NRC team identified that five of six operators on one crew and one operator on a second crew failed to complete the required actions within the two minutes as required. The SCBA scenario was difficult because the time critical action program failed to adequately train and test the operators. Specifically, the licensee is currently transitioning from one brand SCBA to another brand SCBA. However, the new brand SCBA is not one-size-fits-all like the old brand, so depending on the operation crew composition, several new-style SCBAs are required in various sizes. Additionally, if operators require eye glasses, special corrective lenses had to be inserted into the SCBA mask. Finally, during previous SCBA time critical action drills, the SCBAs were either pre-staged in the simulator or the drill was conducted in a classroom setting that afforded ample space for maneuvering. The normal storage location of the portable SCBAs was not conducive to maneuvering.

The NRC team found that in 2012, the licensee identified a condition adverse to quality and generated a condition report because the SCBA time critical operator action drills performed in the simulator did not replicate the actual control room conditions.

Specifically, the portable SCBAs were pre-staged and easily accessible, rather than the actual conditions in the control room where the SCBAs are stored in a narrow passageway. The corrective action for the simulator fidelity issue was to revise the training given to operators and the condition report was closed. However, in 2013, the SCBA time critical operator action was performed in a classroom setting, rather than the simulator. In 2014, the licensee generated another condition report because the time critical actions were not being properly validated. In response to the 2014 condition report, the procedure for validating time critical operator actions was revised and the action was closed. In October 2015, the station performed a component design bases self-assessment (SA-2015-0107) and concluded t hat "simulator scenario time critical actions are tracked for performance, although unofficially."

Analysis.

The team determined the failure to correct the deficiencies with the control room habitability time critical action was a performance deficiency. The performance deficiency was more-than-minor, and therefore a finding, because it related to the human performance attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee did not take timely corrective actions to resolve time critical action program deficiencies associated with the control room habitability scenario, which resulted in a test crew's failure to meet the two minute time requirement. In accordance with Inspection Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At Power,"

dated July 19, 2012, the finding screened as having very low safety significance (Green) because it was a design or qualification deficiency that did not represent a loss of operability or functionality; did not represent an actual loss of safety function of the system or train; did not result in the loss of one or more trains of non-technical specification equipment; and did not screen as potentially risk-significant due to seismic, flooding, or severe weather. This finding had a cross-cutting aspect in the area of human performance associated with training because the licensee failed to provide training and ensure knowledge transfer to maintain a knowledgeable, technically competent workforce and instill nuclear safety values [H.9].

Enforcement.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," which states, in part, "Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected." Contrary to the above, the licensee failed to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances were promptly identified and corrected. Specifically, prior to April 28, 2016, the licensee failed to correct deficiencies identified in 2012 for operator time critical actions associated with control room habitability; in 2013 after revising training materials for control room habitability time critical actions; in a 2014 condition report documenting the failure to validate scenarios in the time critical action program; and again in a 2015 self-assessment of the time critical action program. During the inspection, five out of six operators in a test crew failed to complete the control room habitability scenario within the required two minutes. In response to this finding, the licensee performed just-in-time training to remediate the crews and ensure time critical actions can be met. After re-training, each crew successfully performed the control room habitability time critical action within the two-minute requirement. This finding was entered into the licensee's corrective action program as Condition Reports 103910, 103915, and 103658. Because this finding was of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000482/2016007-04, "Failure to Promptly Correct Deficiencies With Operator Time Critical Actions."

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

4OA2 Problem Identification and Resolution

The team reviewed action requests associated with the selected components, operator actions, and operating experience notifications. Any related findings are documented in prior sections of

the report.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On April 28, 2016, the inspectors presented the inspection results to Mr. J. McCoy, Vice President, Engineering, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Dandreo, Supervisor, Design

J. Ernest, Mechanical Design

N. Good, Licensing

K. Hinterweger, Mechanical Design

R. Hobby, Licensing

A. Jamar, Electrical Design

V. Kanal, Electrical Design

B. Ketchum, Risk Assessment

J. Knust, Licensing

D. Mand, Manager, Design

J. McCoy, Vice President, Engineering

B. Meyer, Operations

B. Muilenburg, Supervisor, Licensing

B. Schafer, Civil Design

R. Sims, Operations

C. Williams, Electrical Design

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000482/2016007-01 NCV

Inadequate Degraded Voltage Analyses of Class 1E Systems (Section 1R21.2.1.b)

05000482/2016007-02 NCV Failure to Verify the Adequacy of Design of the Control Circuitry of the Fuel Oil Transfer Pumps (Section 1R21.2.16.b)

05000482/2016007-03 NCV Inadequate Analysis of Essential Service Water Piping (Section 1R21.2.17.b)

05000482/2016007-04 NCV Failure to Promptly Correct Deficiencies With Operator Time Critical Actions (Section 1R21.4.b)