IR 05000313/2016011

Arkansas Nuclear One - NRC Inspection Report 05000368/2016011 and Preliminary White Finding

ML17019A288
Person / Time
Site:	Arkansas Nuclear
Issue date:	01/19/2017
From:	Pruett T W NRC/RGN-IV/DRP
To:	Richard Anderson Entergy Operations
NEIL O'KEEFE
References
EA-16-247 IR 2016011
Download: ML17019A288 (24)

Text

January 19, 2017

EA-16-247 Rich Anderson, Site Vice President Arkansas Nuclear One Entergy Operations, Inc. 1448 SR 333 Russellville, AR 72802-0967

SUBJECT: ARKANSAS NUCLEAR ONE - NRC INSPECTION REPORT 05000368/2016011 AND PRELIMINARY WHITE FINDING

Dear Mr. Anderson:

On December 21, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Arkansas Nuclear One facility, Unit 2, and the inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed inspection report. The enclosed inspection report discusses a finding that has preliminarily been determined to be a White finding with low to moderate safety significance that may require additional inspections, regulatory actions, and oversight. As described in Section 4OA3.1 of the enclosed report, this finding involved a failure to ensure that an emergency diesel generator bearing was provided with adequate lubrication. As a result, the bearing overheated and caused the emergency diesel generator to fail on September 16, 2016 during a required 24-hour loaded endurance test. The extent of damage from the failure led to the decision to shut the unit down to comply with technical specifications. This finding did not present an immediate safety concern because other normal and emergency sources of power remained available, and your plant walkdowns and our inspections confirmed that this condition did not exist on other safety-related equipment. This finding was assessed based on the best available information, using the NRC's significance determination process (SDP). The basis for the NRC's preliminary significance determination is described in the enclosed report. The NRC will inform you in writing when the final significance has been determined. The NRC staff determined that the total increase in core damage frequency for the performance deficiency was preliminarily estimated to be between 3.0E-6 per year and 9.6E-6 per year, or of low to moderate safety significance (White). The most dominant contributor was potential fires in nonvital electrical switchgear, which could result in a transient and loss of offsite power for Unit 2, combined with a postulated non-related failure of emergency diesel generator B. Your staff implemented compensatory measures while repairs were being made to the affected equipment, including delaying work that could impact the reliability of offsite and onsite power sources, increasing the number of fire watches near critical equipment, and delaying the start of the planned refueling outage in Unit 1. The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy, which can be found on the NRC's Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. In accordance with NRC Inspection Manual Chapter 0609, we intend to complete, using the best available information, and issue our final safety significance determination within 90 days from the date of this letter. The NRC's Significance Determination Process (SDP) is designed to encourage an open dialogue between your staff and the NRC; however, the dialogue should not affect the timeliness of our final determination. Before the NRC makes a final decision on this matter, we are providing you with an opportunity to (1) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 40 days of your receipt of this letter. We encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. The focus of the Regulatory Conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a Regulatory Conference is held, it will be open for public observation. The NRC will issue a public meeting notice to announce the conference. If you decide to submit only a written response, it should be sent to the NRC within 40 days of your receipt of this letter. Written responses should be clearly marked as a "Response to an Apparent Violation; EA-16-247 and should include for the apparent violation: (1) the reason for the apparent violation, or if contested, the basis for disputing the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609. Please contact Neil O'Keefe at 817-200-1574, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence. Because the NRC has not made a final determination in this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation may change based on further NRC review. In accordance with 10 CFR 2.390 of the NRC's "Agency Rules of Practice," a copy of this letter and its enclosure will be made available electronically for public inspection in the NRC Public Document Room and in the NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.

Sincerely,/RA/ Troy W. Pruett, Director Division of Reactor Projects Docket No. 50-368 License No. NPF-6

Enclosure:

Inspection Report 05000368/2016011 w/

Attachments:

1.Supplemental Information2.Detailed Risk Evaluation

SUMMARY

IR 05000368/2016011; 09/16/2016 - 12/21/2016; Arkansas Nuclear One, Unit 2; Inspection Report; Follow-up of Events and Notices of Enforcement Discretion. The inspection activities described in this report were performed between September 16 and December 21, 2016, by the resident inspectors at Arkansas Nuclear One and inspectors from the NRC's Region IV office. One finding that was preliminarily determined to have low to moderate safety significance (White) is documented in this report. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red), which is determined using Inspection Manual Chapter 0609, "Significance Determination Process." Their cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects within the Cross-Cutting Areas." Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process."

Cornerstone: Mitigating Systems

Apparent Violation. The inspectors reviewed a self-revealing finding that was preliminarily determined to have low to moderate safety significance (White) for the failure to perform maintenance activities in a manner that ensured adequate lubrication to Unit 2 emergency diesel generator A. This finding involved a violation of Technical Specification 6.4.1.a, because the licensee failed to provide adequate work instructions for maintenance on the inboard generator bearing oil sight glass to ensure that the scribe mark indicated the minimum acceptable oil level to ensure adequate lubrication to the bearing. As a result, the licensee reinstalled the sight glass with the oil level scribe mark below the bottom of the bearing rollers. Subsequently, on June 22, 2016, the oil was drained and replaced with oil level close to the sight glass scribe mark, and the bearing failed on September 16, 2016, during a 24-hour surveillance. The licensee entered this issue into the corrective action program as Condition Report CR-ANO-2-2016-03307. The licensee resolved the safety concern by repairing the bearing, successfully testing the diesel, and verifying the condition did not exist in any other safety-related equipment. The failure to ensure adequate lubrication to the inboard generator bearing so that the Unit 2 emergency diesel generator A would be capable of performing its safety functions for the intended mission time is a performance deficiency. This performance deficiency is more than minor, and therefore is a finding, because it is associated with the procedure quality attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to properly pre-plan and perform work that could affect this safety-related system in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances such that the minimum bearing oil level was correctly marked and maintained. This performance deficiency subsequently affected the availability and reliability of the emergency diesel generator, a mitigating system. The inspectors evaluated the finding with NRC Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions." The inspectors determined that the finding required a detailed risk evaluation because an actual loss of function of a single train of mitigating equipment occurred for greater than its technical specification allowed outage time.

3 As determined by a Significance and Enforcement Review Panel (SERP), the total increase in core damage frequency for the performance deficiency was preliminarily estimated to be between 3.0E-6 per year and 9.6E-6 per year, or of low to moderate safety significance.

The inspectors determined this finding has a cross-cutting aspect in the human performance area of Work Management, because the primary cause of the performance deficiency involved the failure to plan, control, and execute work activities such that nuclear safety is the overriding priority [H.5]. (Section 4OA3)

4

REPORT DETAILS

OTHER ACTIVITIES

Cornerstone:

Mitigating Systems

4OA3 Follow-up of Events and Notices of Enforcement Discretion

.1 Unit 2 Emergency Diesel Generator A Bearing Failure

a. Inspection Scope

On September 16, 2016, the inboard generator bearing for the Unit 2 emergency diesel generator A overheated and failed. The inspectors reviewed the operators' response to the failure, including securing the diesel, consideration of fire response, event classification, technical specification compliance, and risk management actions. During the repair process, the inspectors reviewed the licensee's efforts to assess the cause and extent of damage, replace parts, modify the generator shaft, and perform post-maintenance testing. The inspectors reviewed the licensee's corrective actions for the failure, including setting the correct scribe mark for the bearing oil. The inspectors independently assessed the extent of condition by conducting plant walkdowns, and reviewed the licensee's extent of condition inspection and evaluation.

The inspectors reviewed the licensee's corrective actions after a licensee engineer discovered, during reassembly, that the oil level scribe mark on the repaired bearing was again below the vendor recommended level, but above the minimum level for lubricating the bearing (CR-ANO-2-2016-3722). The inspectors reviewed the sleeving modification of the generator shaft and corrective actions for damage that occurred when the new shaft sleeve contacted the repaired bearing housing cover while manually rotating the engine (CR-ANO-2-2016-3435).

b. Findings

Introduction.

The inspectors reviewed a self-revealing finding of preliminary low to moderate safety significance (White) and an associated apparent violation of Unit 2 Technical Specification 6.4.1.a for the failure to provide adequate lubrication to the inboard generator bearing so that the Unit 2 emergency diesel generator A would provide emergency power to safety equipment. Specifically, two separate maintenance activities introduced errors that led to having inadequate oil to lubricate the bearing, and the bearing failed on September 16, 2016, during a 24-hour surveillance.

Description.

On September 16, 2016, 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> into a 24-hour surveillance at full load, the inboard generator bearing for the Unit 2 emergency diesel generator A failed, as evidenced by load swings, overheating, and sparking. Operators secured the diesel, declared it inoperable, documented the failure in Condition Report CR-ANO-2-2016-03307, and complied with Unit 2 Technical Specification 3.8.1.1, "A.C. Sources," Action B. Maintenance personnel discovered significant damage to the bearing indicative of a lack of oil lubrication. On September 28, 2016, the licensee shut Unit 2 down prior to the expiration of the technical specification action statement. The licensee completed repairs and successfully tested the diesel on October 22, 2016, and restarted Unit 2 on October 27, 2016.

During a causal investigation for the lack of lubrication, the licensee identified that the oil level scribe mark on the sight glass was below the minimum level necessary to provide proper oil lubrication to the bearing. The licensee concluded that on November 11,2014, while performing Work Order 356569, maintenance personnel had removed and inadvertently inverted the sight glass, which caused the scribe mark to be below the bottom of the bearing rollers (see diagram below). With the sight glass inverted, the scribe mark was 3/8-inch lower than if it was in the correct orientation. Post-failure measurements identified that the scribe mark was 5/8-inch below the correct position. The licensee concluded that adequate oil was initially provided following the sight glass reinstallation. Evidence to support this included multiple successful surveillance tests with no increase in vibrations, including a 24-hour surveillance on January 12, 2015, and having an oil sample from the bearing on June 22, 2016, with no indications of abnormal wear.

On June 22, 2016, maintenance personnel changed the oil in the inboard generator bearing after taking an oil sample in accordance with Work Order 52656389. Maintenance personnel documented leaving the oil level within the procedural limits relative to the scribe mark. Vibrations and system performance were normal during the post-maintenance runs and surveillance tests on June 26, 2016. The licensee determined that the inboard generator bearing had not been leaking oil between the oil change on June 22, 2016, and the September 16, 2016, surveillance failure.

The licensee concluded that the oil in the inboard generator bearing heated up slowly during the 24-hour surveillance. After 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />, enough oil had vaporized within the bearing casing that the liquid oil level became inadequate to lubricate the bearing, resulting in bearing failure. Therefore, the inspectors concluded that the emergency diesel generator could have failed approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after the start of a postulated event between June 26, 2016, and September 16, 2016. The inspectors concluded that multiple causes led to the lack of oil lubrication. The licensee failed to incorporate vendor manual instructions to properly set and verify the correct oil sight glass scribe mark into Work Order 356569 for maintenance performed in 2014. The licensee failed to train maintenance personnel to adequately identify and control critical parameters during maintenance, specifically the effects of sight glass installation and maintenance on bearing lubrication. The inspectors also noted that work instructions in Work Order 52656389 did not specify the correct amount of oil to add when replacing the oil, or else measure the amount of oil removed and ensure that a like amount of new oil was added to the bearing.

On October 11, 2016, following bearing reassembly, a system engineer checked the level of the new sight glass and identified that the scribe mark was too low again. The licensee found that the new oil level had been marked on the bearing housing prior to assembly, but that the oil level was below the vendor-recommended level. In response, the licensee planned and executed a work order to set the oil level in relation to the generator shaft centerline in accordance with the vendor recommendations. The inspectors noted that the licensee had not yet implemented corrective actions to prevent recurrence of the problem in that licensee's work plans failed to include verification of the oil level relative to the generator shaft centerline after reassembling the bearing. The licensee subsequently corrected the sight glass position and developed training and improved work instructions to ensure that the bearing oil level would be correctly established.

After the diesel bearing failure, the licensee verified through walk downs that all sight glass marks and bearing oil levels were adequate for other safety-related rotating equipment. The inspectors also independently reviewed bearing oil levels.

Analysis.

The failure to ensure adequate lubrication to the inboard generator bearing so that the Unit 2 emergency diesel generator A would be capable of performing its safety functions for the intended mission time is a performance deficiency. This performance deficiency is more than minor, and therefore is a finding, because it is associated with the procedure quality attribute of the mitigating systems cornerstone, and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensee failed to properly pre-plan and perform work that could affect this safety-related system in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances such that the minimum bearing oil level was correctly marked and maintained. This performance deficiency subsequently affected the availability and reliability of the emergency diesel generator, a mitigating system.

Using NRC Manual Chapter 0609, Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, Exhibit 2, "Mitigating Systems Screening Questions," the inspectors determined that the finding required a detailed risk evaluation because an actual loss of function of a single train of mitigating equipment occurred for greater than its technical specification allowed outage time.

As determined by a Significance and Enforcement Review Panel (SERP), the total increase in core damage frequency for the performance deficiency was preliminarily estimated to be between 3.0E-6/year and 9.6E-6/year, or of low to moderate safety significance (White). See Attachment 2 of this report for the results of the detailed risk evaluation and SERP.

The inspectors determined this finding has a cross-cutting aspect in the human performance area of Work Management [H.5,], because the primary cause of the performance deficiency involved the failure to plan, control, and execute work activities such that nuclear safety is the overriding priority.

Enforcement.

Unit 2 Technical Specification 6.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, "Quality Assurance Program Requirements," Revision 2, Appendix A, February 1978. Regulatory Guide 1.33, Appendix A, Section 9.a, states, in part, that maintenance that can affect the performance of safety-related equipment should be properly pre-planned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to the above, on November 11, 2014, the licensee failed to properly pre-plan and perform maintenance that can affect the performance of safety-related equipment in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Specifically, on November 11, 2014, while performing Work Order 356569, and on June 22, 2016, while performing Work Order 52656389, the licensee failed to provide adequate work instructions for maintenance to Unit 2 emergency diesel generator A inboard generator bearing, a safety-related system, such that the minimum bearing oil level was correctly marked and maintained to ensure adequate lubrication to the bearing. As a result, the licensee first reinstalled the sight glass with the oil level scribe mark below the bottom of the bearing rollers, and subsequently replaced the oil with an inadequate volume, causing the bearing to fail on September 16, 2016, during a 24-hour surveillance.

The licensee documented the issue in Condition Report CR-ANO-2-2016-03307. The licensee replaced the damaged parts, machined the shaft and installed a sleeve, and raised the sight glass scribe mark to the correct level for adequate lubrication to the bearing. This violation is being treated as an apparent violation pending a final significance determination. AV 05000368/2016011-01 "Failure to Ensure Adequate Lubrication for Emergency Diesel Generator Bearing."

.2 (Closed) LER 05000368/2016-001-00, Failure of One Emergency Diesel Generator and Subsequent Required Shutdown of Arkansas Nuclear One, Unit 2 On September 16, 2016, the Unit 2 emergency diesel generator A inboard generator

bearing failed during a 24-hour surveillance. Operators declared the emergency diesel generator inoperable. When it became apparent that repairs could not be completed within the Technical Specification 3.8.1.1 action statement requirement, operators shut Unit 2 down. The licensee determined that the bearing failed due to inadequate lubrication, and that the diesel had been inoperable since June 22, 2016. The enforcement aspects of this violation are discussed in Section 4OA3.1 of this report. This licensee event report is closed. These activities constituted completion of two event follow-up samples, as defined in Inspection Procedure 71153.

4OA6 Meetings, Including Exit Exit Meeting Summary On December 21, 2016, the inspectors presented the inspection results to Mr. Rich Anderson, Site Vice President, and other members of the licensee staff.

The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Anderson, Site Vice President

P. Butler, Design and Program Engineering Manager

T. Chernivec, Outage Manager

B. Daiber, Recovery Manager

B. Davis, Engineering Director

T. Evans, General Manager of Plant Operations

D. Marvel, Maintenance Manager

D. Perkins, Operations Manager

S. Pyle, Regulatory Assurance Manager

B. Short, Senior Licensing Specialist

M. Skartvedt, Systems and Components Engineering Manager

D. Vest, Senior System Engineer

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

05000368/2016011-01 AV Failure to Ensure Adequate Lubication for Emergency Diesel Generator Bearing (Section 4OA3.1)

05000368-2016001-00 LER Failure of One Emergency Diesel Generator and Subsequent Required Shutdown of Arkansas Nuclear One, Unit 2 (Section 4OA3.2)

Section 4OA3: Follow-up of Events and Notices of Enforcement Discretion

Procedures

Number Title Revision

OP-2104.036 Emergency Diesel Generator Operations 091

Drawings

Number Title Revision M2012-107-1 Bearing Assembly 001

Condition Reports

(CRs)

CR-ANO-2-2014-00506

CR-ANO-2-2016-03307

CR-ANO-2-2013-00012

Work Orders

(WOs)

52590333

298024

356569

52620361

52656389

Miscellaneous

Number Title Revision TD C470.0090 Instructions for Two Bearing Spherical Roller Oil Lubricated Alternators 000

Arkansas Nuclear One, Unit 2 Failure of Emergency Diesel Generator A Bearing Detailed Risk Evaluation Conclusion: The total increase in core damage frequency for the performance deficiency was estimated to be between 3.0E-6/year and 9.6E-6/year, or of low to moderate safety significance (White).

Assumptions:

1. Exposure Time.

Exposure time ("t" + repair time) was 117 days, which is the sum of the "t" period of 86 days, when the emergency diesel generator was degraded, and the repair time of 31 days.

The repair time was analyzed as 12 days at-power and 19 days shutdown.

2. Available run time.

Emergency diesel generator would have been able to run and power electrical bus 2A-3 for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> during the 86-day "t" period.

3. Common cause.

The potential for a common cause failure on emergency diesel generator B was assumed.

The performance deficiency of failing to provide adequate lubrication to the inboard generator bearing, when viewed in broader context and not at the piece-part level, had the potential to fail the other emergency diesel generator.

4. Recovery credit.

Recovery credit for emergency diesel generator A was not given based on the nature of the failure and because repair of the bearing and restoration of emergency diesel generator A to service took 31 days.

Internal Events

The increase in core damage frequency from internal events was estimated using three discrete time periods:

The "t" period between June 22 and September 16, 2016, which covers from when the bearing oil level was at a level which would have only supported 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> of diesel run time if demanded until the bearing failed,

The at-power repair time between September 16 and 28, 2016, when the diesel was out of service to repair the bearing and the plant was at power or in shutdown conditions before establishing shutdown cooling on the shutdown cooling system, and

The shutdown repair time between September 28 and October 17, 2016 when the diesel was out of service to repair the bearing and the plant had was in conditions after shutdown cooling on the shutdown cooling system had been established until the bearing was repaired and the diesel was functional.

The total increase in core damage frequency with the breakdown of contributions from each of these time periods is given in the table below:

Internal Events Incremental Conditional Core Damage Probability Exposure Period Increase in Core Damage Frequency

86 day "t" Period (06/22 - 09/16/2016) 2.5 x 10-6/year

12 day at-power repair period (09/16 - 09/28/2016) 4.2 x 10-7/year 19 day shutdown repair period (09/28 - 10/17/2016) 3.3 x 10-8/year

Total Increase in Core Damage Frequency 2.9 x 10-6/year

A. Estimate for the 86-day "t" period between June 22 and September 16, 2016

Emergency diesel generator A was unable to perform its mission beginning on June 22, 2016, following maintenance to replace the oil in the inboard bearing.

The analyst selected this date based on the inspection staff's assumption that failure of the bearing would occur during any run of greater than 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after the oil refilling evolution that occurred on June 22, 2016.

The diesel generator bearing failed on September 16, 2016.

This resulted in an exposure time of 86 days. Emergency diesel generator A was assumed to be able to run for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> during the "t" period.

The analyst requested a case-specific SPAR model from Idaho National Laboratory for the ability of the emergency diesel generator to run for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />.

This revised model split the standard basic event for late failures of emergency diesel generator A to run into two separate basic events for before and after the 14-hour time.

This splitting served to reflect the situation that only losses of offsite power (LOOPs) with durations greater than 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> would result in a risk increase attributable to the bearing failure.

The revised model also incorporated post-processing rules to adjust the recovery factors for offsite power to credit the ability of diesel generator A to run for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />.

Average test and maintenance was assumed for the period. The results of this analysis yielded an estimate in the increase in core damage frequency of 2.5E-6/year for the "t" period. B. Estimate for the 12-day repair time period between September 16 and 28, 2016 The bearing took 31 days to repair until the emergency diesel generator was considered functional.

This time started when the bearing failed and ended when maintenance was complete prior to the successful post-maintenance testing.

The repair time included at-power time and shutdown time.

To determine the increase in core damage frequency, the analyst used Manual Chapter 0609, Appendix A, "The Significance Determination Process for Findings At-Power," and the NRC Standardized Plant Analysis Risk (SPAR) model for the time period from when the bearing failed until the reactor was shut down and operators had cooled the plant down and initiated shutdown cooling with the shutdown cooling system.

This time period spanned from September 16, 2016, until September 28, 2016, or 12 days.

No test and maintenance was assumed in this time period as the unit had implemented its extended emergency diesel generator technical specification limiting condition for operation.

During this period, the diesel was assumed to be totally unavailable and non-recoverable.

The results of this analysis yielded an estimate in the increase in core damage frequency of 4.2E-7/year for the at-power repair period.

C. Estimate for the 19-day repair time period between September 28 and October 17, 2016 To estimate the increase in core damage frequency from the initiation of shutdown cooling and until the repairs were complete, the analyst used Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process."

This time period spanned from September 28, 2016, until October 17, 2016, or 19 days.

During this period, the diesel was assumed to be totally unavailable and non-recoverable.

The analyst performed a Phase 2 analysis for the 19 days of repair time using Attachment 2, "Phase 2 Significance Determination Process Template for Pressurized Water Reactors during Shutdown," of Manual Chapter 0609, Appendix G, "Shutdown Operations Significance Determination Process," to estimate the increase in core damage frequency for this time period.

The analyst assumed the increase in core damage frequency would be totally derived from LOOPs in Plant Operational State 1 (as defined in Appendix G) and used Worksheet 3, "Significance Determination Process for a Pressurized Water Reactor Plant - Loss of Offsite Power in Plant Operational State 1 (Reactor Coolant System Closed)).

The results of this analysis yielded an estimate in the increase in core damage frequency of 3.3E-8/year for the shutdown repair period.

External Events

The analyst reviewed the Individual Plant Examination of External Events (IPEEE) for Arkansas Nuclear One, Unit 2, and concluded that floods, transportation accidents and nearby facility accidents did not warrant further consideration. The weather-related LOOP initiator was already addressed by the SPAR model. The remaining external accident initiators were seismic, fire, and high wind.

The increase in core damage frequency from external events is summarized in the table below:

Increase in Core Damage Frequency from External Events External Initiator Increase in Core Damage Frequency

Seismic

2.9 x 10-8/year Individual Fire Areas

6.7 X 10-6/year High Winds negligible

Total Increase in Core Damage Frequency 6.7 X 10-6/year

Seismic.

A postulated seismic event could result in a long-term demand for the emergency diesel generators if the seismic event was large enough to damage the switchyard insulators causing a non-recoverable LOOP.

The analyst assumed that a seismic event would not result in failure of emergency diesel generator A.

However, the analyst also assumed that the alternate AC generator would be unavailable during the postulated seismic events, as it is not seismically qualified.

The analyst used the seismic event trees from the limited use model, which credited 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> of diesel generator A run time, to estimate the increase in core damage frequency from seismic events.

These assumptions were applied over the 98 days that diesel generator A was degraded (86 days) or damaged (12 days during at-power significance determination process conditions) to obtain an increase in core damage frequency of 2.9E-8/year.

The analyst performed a Phase 2 analysis for the 19 days of repair time using Attachment 2, "Phase 2 Significance Determination Process Template for Pressurized Water Reactors during Shutdown," of Manual Chapter 0609, Appendix G, "Shutdown Issues Significance Determination Process," to estimate the increase in core damage frequency for this time period to be 3.3E-10/year.

Combining the two time periods, the analyst estimated the total increase in core damage frequency from postulated seismic events to be 2.9E-8/year.

Fires.

The analyst assumed the dominant fires would be those which would initiate a loss of power to non-safety electrical buses 2A-1, 2A-2, and 2A-9 because all other cutsets involved increases in core damage frequency that were at least an order of magnitude smaller.

Buses 2A1 and 2A2 distribute offsite power to the unit, and bus 2A-9 distributes power from the Alternate AC diesel generator to the unit.

These buses are located in the turbine building in close proximity (see attached diagram), and have no automatic fire suppression available.

Recovery of offsite power or recovery of the alternate AC generator to power these buses was not credited because of the assumed damage to the electrical buses from the fires.

Without any other power sources assumed to the buses, emergency diesel generator B remained the only electrical power source to the unit to carry the plant to a safe and stable state.

Failures of emergency diesel generator B comprised most core damage sequences.

The analyst estimated the baseline case conditional core damage probability in the SPAR model for plant centered LOOPs with buses 2A-1, 2A-2, and 2A-9 out of service to be 7.2E-4.

The analyst then estimated a case conditional core damage probability for plant centered LOOPs with the buses 2A-1, 2A-2, and 2A-9 out of service with emergency diesel generator A failed to be 3.9E-2.

To assess the fire risk, the analyst then applied the difference in these conditional core damage probabilities to the ignition frequency for the pertinent fires found in the licensee's calculation

PRA-A2-05-003, "ANO-2 Fire Scenarios Report," Revision 1.

These ignition frequencies included the fire ignition frequencies, non-suppression factors, and severity factors derived in the licensee's implementation of NFPA 805.

A fire that impacted more than one of the three buses of concern had a significant impact on the results.

Therefore, the analyst evaluated the fire spread probabilities.

The severity factors were assumed to be 1.0 for the licensee's NFPA 805 analyses for the fire scenarios of interest.

The analyst then adjusted the severity factors to model more realistic fire scenarios and to remove some of the conservatisms inherent in the NRC and industry approved methodologies.

These methodologies included treatment that a fire started in one electrical switchgear would always spread and render the other redundant electrical switchgear unavailable (e.g., a fire in switchgear 2A-1 would always render switchgears 2A-2 and 2A-9 unavailable).

This simplification was made during the NFPA 805 licensing process because of the close proximity of the cabinets and the low importance of such a fire scenario with all other equipment fully functional. As shown in the following figure (taken from the ANO Unit 2 pre-fire plans and enhanced for emphasis), the simplified modelling assumed a fire in switchgear 2A1 would always affect switchgear 2A2 because of their close proximity to each other (6 feet apart).

Likewise a fire in switchgear 2A2 would always affect switchgear 2A1.

The same spatial relationship and fire

spread assumptions applied to switchgears 2H1 and 2H2.

Switchgear 2A9 is situated between switchgears 2A1 and 2H1 and is 6 inches from each switchgear. The licensee performed simplistic fire modelling in an effort to more realistically estimate the increase in core damage frequency from these fires.

The analyst reviewed the simplistic fire modelling using knowledge of past NRC walkdowns, review of NFPA 805 license documentation for Arkansas Nuclear One, Unit 2, and information from discussions with the licensee and inspectors. The cabinets were divided into the breaker cubicles they contained and the overall fire ignition frequency for the switchgear was broken down into a breaker cubicle fire ignition frequency by dividing the total switchgear fire ignition frequency by the number of breaker cubicles.

Breaker cubicles that were greater than 10 feet away from switchgear 2A9 were then considered as not contributing to the severity of the fire based on calculation

PRA-A2-05-017, "Combined Ignition Source - Cable Tray Fire Scenario Zone of Influence for Arkansas Nuclear One, Unit 2, Applications," Revision 0.

Applying calculation

PRA-A2-05-017 yielded adjusted severity factors of 0.49 to fire scenario 2200-MM-CW and 0.36 to fire scenario 2200-MM-CX.

The analyst used these values as the best-estimate to assess fire spread probabilities between the buses of concern because of the close proximity between these high-energy switchgear cabinets and the lack of automatic fire suppression for these components. The analyst adjusted severity factors over the 86-day "t" period yielded an estimate of the increase in core damage frequency of 6.7E-6/year.

The exposure time was limited to the 86-day "t" period because, during the extended emergency diesel limiting condition for operation time period, a continuous fire watch was present in the fire area containing the 2A-1 and 2A-2 buses.

The analyst assumed those fires in the 12-day at-power repair time would not become severe based on the increased probability of employing manual suppression.

The analyst referred to Table 2E-2, "Manual Suppression Probability per Unit Time and Failure Probability at Delta Time from NUREG/CR-6850," to aid in screening out this 12-day time period.

The following table summarizes the postulated fires and the increase in core damage frequency resulting from the difference in having these fires with and without emergency diesel generator A: Fire Description (Fire in:)

Fire Ignition Frequency (per year) Severity Factor (adjusted) Increase in Core Damage Frequency 2200-MM-CW Switchgear 2A-1 and 2A-2 1.30E-3 0.49 4.9E-6/year 2200-MM-CX Switchgear 2H-1 and 2H-2 6.49E-4 0.36 1.8E-6/year

Total 6.7E-6/year

Other fire scenarios were considered but were screened out because upon preliminary quantification they were found to yield lower increases in core damage frequency than the fires analyzed above.

The analyst ensured that the increase in core damage frequency for the screened fire scenarios would not add to the total increase in core damage frequency enough to cause the estimate to cross the White-Yellow threshold in the significance determination process.

Fires during the 19-day shutdown repair period were estimated using Appendix G of Manual Chapter 0609 to be 3.3E-8/year. The analyst estimated the total increase in core damage frequency from postulated fire events to be 6.7E-6/year. High Winds.

A category EF2 or greater tornado could result in loss of the offsite power lines that would not be quickly repairable.

The analyst estimated the frequency of a category EF2 or greater tornado occurring onsite to be 5.31E-5/year using the data developed by the Office of Nuclear Reactor Research utilizing the methodology from "Review of Methods for Estimation of High Wind and Tornado Hazard Frequencies," dated December 2012.

The analyst further reviewed the historical data for tornados and determined that only 1.8% of tornado probability came in the months of June, July, August, and September in which the exposure time fell.

Applying this factor adjusted the initiating event frequency to 9.6E-7/year.

The analyst considered this initiating event frequency to be low enough to screen high winds as not a significant contributor to the total increase in core damage frequency.

Large Early Release Frequency

In accordance with Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process," issued May 6, 2004, the analyst determined that this was a Type A finding, because the finding affected the plant core damage frequency. In accordance with the guidance in Appendix H, this finding would not involve a significant increase in risk of a large, early release of radiation because Arkansas Nuclear One, Unit 2 has a large, dry containment and the dominant sequences contributing to the change in the core damage frequency did not involve either a steam generator tube rupture or an inter-system loss of coolant accident. Therefore, the analyst determined that the significance of this finding was considered to be core damage frequency-dominant, and the impact to large, early release frequency was negligible.

Sensitivity Analyses

The analyst performed sensitivity runs showing the results for various scenarios altering the influential assumptions:

Emergency diesel generator A availability:

The analyst assumed that emergency diesel generator would have failed within the first hour of operation and not run for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />.

This was based on engine performance and failure on September 16, 2016.

The analyst ran sensitivities adjusting the time the engine would run as follows:

If Emergency Diesel Generator A would have failed after running for: The increase in core damage frequency would have been: 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 1.1 x 10-5 / year 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 9.8 x 10-6 / year 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> (base case) 9.6 x 10-6 / year

Dominant fire spreading probability:

For the final estimate of the total increase in core damage frequency, the analyst assumed varying adjusted severity factors for fires which comprised the dominant fire sequences.

The analyst ran sensitivities adjusting the severity factors as follows:

If the severity factor for fire spreading to the opposite train were: The total increase in core damage frequency would have been: 5 percent for both fires 3.1 x 10-6 / year 20 percent for both fires 5.4 x 10-6 / year 36 percent for both fires 7.7 x 10-6 / year 36% for Fire Scenario 2200-MM-CW 49% for Fire Scenario 2200-MM-CX (base case)

9.6 x 10-6 / year 49 percent for both fires 9.8 x 10-6 / year

Common cause not considered to be applicable:

For this sensitivity run, the analyst assumed that the increased potential for common cause failure of emergency diesel generator B and the alternate AC generator was not feasible.

The failure probability for the basic event for emergency diesel generator A was set to 1.0.

This sensitivity yielded a total estimate of the increase in core damage frequency of 6.7E-6/year.

Use of FLEX equipment.

The licensee indicated that they had FLEX procedures and equipment available at the site.

The licensee pointed out that a FLEX diesel generator could be used to power DC loads which would support long-term turbine driven emergency feedwater pump operations.

The NRC has not made a final decision on the crediting of FLEX in significance determination process analyses.

The analyst was aware of Nuclear Energy Institute (NEI) position papers on crediting FLEX in probabilistic risk assessments and document

NEI 16-06, "Crediting Mitigating Strategies in Risk-Informed Decision Making," Revision 0, and noted that these documents have not been endorsed by the NRC.

A draft revision to the NRC Risk Assessment Standardization Project Handbook was also being worked and processed at the time of this analysis.

The analyst conducted a best estimate analysis which considered FLEX strategies as recoveries, recognizing that incorporating FLEX credit into the ANO model requires much more effort and approval and the results derived from this best estimate would only be useful as a gross sensitivity check.

The analyst ran two sensitivity cases to evaluate the application of FLEX equipment.

Each of these used an estimated failure probability of 1.0E-1 which

NEI 16-06 describes as mitigating actions are "likely to succeed."

The analyst applied a failure probability of 1.0E-1 for FLEX recovery to the station blackout cutsets contained in the top 100 cutsets yielded from modeling emergency diesel generator A failing to run after 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> with common cause potential on emergency diesel generator B.

This sensitivity case yielded a total estimate of the increase in core damage frequency of 3.0E-6/year.

Combination of sensitivity results:

In the table below, the analyst combined the effects of adjusting the fire severity factor for both the 2A and 2H buses; applying varying recovery credit for FLEX equipment; and considering that the potential for common cause failure of the other diesel generators.

Increased Common Cause Potential? Fire Severity Factor FLEX failure probability Total Increase in Core Damage Frequency

Base case Yes 0.49 for Fire 2200-MM-CW 0.36 for Fire 2200-MM-CX No credit 9.6E-6/year 1 Yes 0.49 for Fire 2200-MM-CW 0.36 for Fire 2200-MM-CX 0.50 5.8E-6/year 2 Yes 0.49 for Fire 2200-MM-CW 0.36 for Fire 2200-MM-CX 0.10 3.0E-6/year 3 No 0.49 for Fire 2200-MM-CW 0.36 for Fire 2200-MM-CX 0.10 2.4E-6/year 4 No 0.20 for both fires 0.50 2.9E-6/year 5 No 0.20 for both fires 0.10 1.9E-6/year

Uncertainties Due to the complexity of the analysis, uncertainties were not able to be captured.

Sensitivity runs were made to address uncertainty.

Qualitative Considerations

Decay heat considerations.

Because the emergency diesel generator A is assumed to run for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> before failing, LOOP scenarios would have the benefit of loads powered by the diesel generator for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> before station blackout conditions occurred.

This power availability would allow the decay heat generation rate to be lower than that of a LOOP which quickly led to station blackout conditions.

This effect would provide a reduction in the overall increase in core damage frequency.

Conservative fire modelling.

As mentioned in the external events from fire section, the licensee's fire model provides conservative estimates of the increase in core damage frequency from fire, even after application of the adjusted severity factors.

Conservative fire heat release rates and initial environmental temperatures are two examples.

These effects, if more accurately assumed, would provide reduction in the overall increase in core damage frequency.

Competing priorities.

In the sequences that lead to core damage, failure of emergency diesel generator A would not be the only failure which could occur.

Control room operators would have numerous competing priorities which could complicate responses and recoveries.

For example, operators may also have to assist in offsite power restoration, emergency diesel generator B restoration, and turbine driven emergency feedwater pump restoration, had these components failed.

These competing priorities would serve to increase the overall increase in core damage frequency.

Licensee's Analysis

The analyst met with the licensee's site probabilistic risk assessment engineers, licensing specialist, and licensing manager on October 12, 2016, during a site visit to discuss the significance of the failed diesel generator bearing.

The licensee personnel discussed that they did not plan to conduct a formal written risk assessment of the condition.

The licensee personnel stated that they had conducted an undocumented analysis which estimated the increase in core damage frequency from internal events to be approximately 1.0E-6/year.

This estimate came from assuming the diesel generator would fail to run consistent with their baseline model assumptions and not that it would run for 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> before failing.

Also in this undocumented analysis, the licensee discussed that the increase in core damage frequency from external events to be enough to make the total increase in core damage frequency to be in the mid-E-6/year range, the range of low to moderate safety significance (White).

The licensee stated that some assumptions in their fire probabilistic risk assessment were conservative and gave estimates for the increase in core damage frequency from fires that were high.

Model Data For internal events and external events from fire and seismic during the 86-day "t" period, the analyst used the limited use model for Arkansas Nuclear One, Unit 2, Version 8.31, ran on SAPHIRE, Version 8.1.4. Truncation at the 1E-12 level was used. For the remainder of the analyses, the analyst used the SPAR model for Arkansas Nuclear One, Unit 2, Version 8.26, ran on SAPHIRE, Version 8.1.4.

Truncation at the 1E-11 level was used.