ML14083A409

IR 05000313; 05000368-13-012; on 07/15/2013 - 02/10/2014; Arkansas Nuclear One; Augmented Inspection Team Follow-up Report; Inspection Procedure 71153, Follow-up of Events and Notices of Enforcement Discretion.

ML14083A409
Person / Time
Site:	Arkansas Nuclear
Issue date:	03/24/2014
From:	Dapas M NRC Region 4
To:	Jeremy G. Browning Entergy Operations
G. Werner
References
71153, EA-14-008 IR-13-012
Download: ML14083A409 (87)

See also: IR 05000368/2013012

Text

UNITED STATES

NUCLEAR REGULATORY COMMISSION

REGION IV

1600 E. LAMAR BLVD.

ARLINGTON, TX 76011-4511

March 24, 2014

EA-14-008

Jeremy Browning, Site Vice President

Entergy Operations, Inc.

Arkansas Nuclear One

1448 SR 333

Russellville, AR 72802-0967

SUBJECT: ARKANSAS NUCLEAR ONE - NRC AUGMENTED INSPECTION TEAM

FOLLOW-UP INSPECTION REPORT 05000313/2013012 AND

05000368/2013012; PRELIMINARY RED AND YELLOW FINDINGS

Dear Mr. Browning:

On February 10, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed the

Augmented Inspection Follow-up Inspection at the Arkansas Nuclear One, Units 1 and 2. The

enclosed inspection report presents the results of this inspection. A final exit briefing was

conducted with you and other members of your staff on February 10, 2014.

The enclosed inspection report discusses two findings, one that has preliminarily been

determined to be Red with high safety significance for Unit 1, and one that has preliminary been

determined to be Yellow with substantial safety significance for Unit 2, that may require

additional regulatory oversight. As described in Section 4OA3.9 of the enclosed report, the

findings are associated with the March 31, 2013, Unit 1 stator drop that affected safety-related

equipment on both units.

The cause for the stator drop was not following a quality-related procedure, in that, the

overhead temporary hosting assembly was not properly designed; the associated calculation

was not reviewed; and the assembly was not load tested as required. During the movement of

the Unit 1 stator, the overhead temporary hoisting assembly collapsed, causing the 525-ton

stator to fall on and extensively damage portions of the Unit 1 turbine deck and subsequently to

fall over 30 feet into the train bay. The stator drop resulted in a Unit 1 loss of offsite power for

6 days and a Unit 2 reactor trip and loss of offsite power to one vital bus. The dropped stator

ruptured a common fire main header in the train bay, which caused flooding in Unit 1 and water

damage to the electrical switchgear for Unit 2. The alternate alternating current diesel generator

(station blackout) electrical supply cables to both units were pulled out of the electrical

switchgear and the diesel was therefore not available to either unit. In addition, there was one

fatality and eight individuals were injured. The Occupational Safety and Health Administration

(OSHA) conducted an independent inspection focusing on industrial safety aspects of the event

and issued four separate Citations and Notification of Penalties on September 26, 2013, with

proposed fines to the three involved contractors and Entergy Operations, Incorporated.

J. Browning -2-

Your staff conducted extensive reviews of this event in the root cause evaluation, documented

in Condition Report CR-ANO-C-2013-00888. Corrective actions included: repairing the

damaged Unit 1 turbine structure, fire main system, and both Unit 1 and Unit 2 electrical

systems; modifying procedures related to handling of heavy loads; training your staff on the

revised requirements for handling heavy loads; and providing additional oversight for the

subsequent Unit 1 replacement stator lift. The NRC inspectors observed many of the repair

activities, including the removal of the dropped stator and the subsequent Unit 1 replacement

stator lift. We noted that in your root cause evaluation, your staff did not address Entergys

oversight of the contractors involved with the stator lift. The NRC independently determined that

Entergy did not ensure adequate supervisory and management oversight of the contractors and

other supplemental personnel involved with the stator lift, and this contributed to the event.

These findings were assessed based on the best available information, using the applicable

Significance Determination Process. The final resolution of these findings will be conveyed in

separate correspondence. These findings also constitute an apparent violation of NRC

requirements which is being considered for escalated enforcement action in accordance with

the NRC Enforcement Policy, which appears on the NRCs Web site at:

http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

In accordance with NRC Inspection Manual Chapter 0609, Significance Determination

Process, we intend to complete our evaluation and issue our final determination of safety

significance within 90 days from the date of this letter. The NRCs significance determination

process is designed to encourage an open dialogue between your staff and the NRC; however,

the dialogue should not affect the timeliness of our final determination.

During the exit meeting, conducted on February 10, 2014, you requested a regulatory

conference to discuss these findings. As such, a regulatory conference to discuss the apparent

violation has been scheduled for Thursday, May 1, 2014, from 1 - 5 p.m. at the Nuclear

Regulatory Commission Region IV office in Arlington, Texas. We encourage you to submit

supporting documentation at least one week prior to the conference in an effort to make the

conference more efficient and effective. This conference will be open to public observation in

accordance with Section 2.4, Participation in the Enforcement Process, of the NRC

Enforcement Policy. The NRC will issue a public meeting notice and press release to announce

this conference. At the February 10th exit meeting, both you and your staff expressed concerns

that the NRC was not providing any credit for B.5.b mitigation equipment in the NRCs

preliminary risk analysis. As part of our risk analysis, we acknowledged that some credit may

be appropriate. We encourage you to be prepared to discuss, at the regulatory conference,

what range of credit should be applied and the supporting basis, to include such things as

procedures, training, pre-staging of equipment, etc.

Please contact Gregory Werner at 817-200-1574, and in writing, within 10 days from the issue

date of this letter to confirm your intentions to attend a regulatory conference as described

above. If we have not heard from you within 10 days, we will continue with our final significance

determination and enforcement decision.

Because the NRC has not made a final determination in this matter, no Notice of Violation is

being issued for these inspection findings at this time. In addition, please be advised that the

J. Browning -3-

number and characterization of the apparent violation may change based on further NRC

review.

In addition, the NRC inspectors documented three findings of very low safety significance

(Green) in this report. Two of these findings involve violations of NRC requirements. The NRC

is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the

Enforcement Policy.

If you contest these non-cited violations, you should provide a response within 30 days of the

date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory

Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the

Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory

Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Arkansas

Nuclear One.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a

regulatory requirement in this report, you should provide a response within 30 days of the date

of this inspection report, with the basis for your disagreement, to the Regional Administrator,

Region IV; and the NRC resident inspector at the Arkansas Nuclear One.

In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding,

a copy of this letter, its enclosure, and your response (if any) will be available electronically for

public inspection in the NRCs Public Document Room or from the Publicly Available Records

(PARS) component of the NRC's Agencywide Documents Access and Management System

(ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-

rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Marc L. Dapas

Regional Administrator

Docket Nos: 50-313, 50-368

License Nos: DRP-51, NPF-6

Enclosure: Inspection Report 05000313/2013012 and 05000368/2013012

w/Attachment 1: Supplemental Information

w/Attachment 2: Unit 1 Outage Detailed Risk Evaluation

w/Attachment 3: Unit 2 At-Power Detailed Risk Evaluation

Electronic Distribution to Arkansas Nuclear One

J. Browning -4-

Electronic distribution by RIV:

Regional Administrator (Marc.Dapas@nrc.gov)

Deputy Regional Administrator (Steven.Reynolds@nrc.gov)

DRP Director (Kriss.Kennedy@nrc.gov)

DRP Deputy Director (Troy.Pruett@nrc.gov)

DRS Director (Acting) (Jeff.Clark@nrc.gov)

DRS Deputy Director Acting (Geoffery.Miller@nrc.gov)

Senior Resident Inspector (Brian.Tindell@nrc.gov)

Resident Inspector (Matthew.Young@nrc.gov)

Resident Inspector (Abin.Fairbanks@nrc.gov)

Acting Branch Chief, DRP/E (Greg.Werner@nrc.gov)

Senior Project Engineer, DRP/E (Michael.Bloodgood@nrc.gov)

Project Engineer, DRP/E (Jim.Melfi@nrc.gov)

ANO Administrative Assistant (Gloria.Hatfield@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Michael.Orenak@nrc.gov)

Branch Chief, DRS/TSB (Ray.Kellar@nrc.gov)

ACES (R4Enforcement.Resource@nrc.gov)

OE (Roy.Zimmerman@nrc.gov)

OE (Nick.Hilton@nrc.gov)

OE (Lauren.Casey@nrc.gov)

NRR_OE (Carleen.Sanders@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

Branch Chief, ACES (Vivian.Campbell@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Technical Support Assistant (Loretta.Williams@nrc.gov)

Congressional Affairs Officer (Jenny.Weil@nrc.gov)

RIV/ETA: OEDO (Ernesto.Quinones@nrc.gov)

ROPreports@nrc.gov

OEMail Resource@nrc.gov

RidsOeMailCenter Resource;

NRREnforcement.Resource

RidsNrrDirsEnforcement Resource

R:\REACTORS\ANO\2013\ANO2013012-LMW.docx ML

SUNSI Rev Compl. Yes No ADAMS Yes No Reviewer Initials GEW

Publicly Avail. Yes No Sensitive Yes No Sens. Type Initials GEW

SRRA:NRR/

SRI:DRS/TSB SRI:DRS/EB1 PE:DRP/E RI:DRS/EB2 SRA:DRS/EB2

DRA/APOB

LWilloughby RLatta JMelfi NOkonkwo DLoveless JMitman

via email via email via email via email J.Dixon for Via email

3/13/14 3/6/14 3/5/14 3/4/14 3/12/14 3/10/14

SES:ACES C:ORA/ACES RC:ORA AC:DRP/E DD:DRP D:DRP

RBrowder VCampbell KFuller GWerner TPruett KKennedy

/RA/ /RA/ /RA/ /RA/ /RA/ /RA/

3/14/14 3/17/14 3/17/14 3/13/14 3/13/14 3/18/14

OE NRR RA

LCasey CSanders MDapas

via email via email /RA/

3/21/14 3/24/14 3/24/147

OFFICIAL RECORD COPY

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 05000313; 05000368

License: DRP-51; NPF-6

Report: 05000313; 05000368/2013012

Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Units 1 and 2

Location: Junction of Hwy. 64 West and Hwy. 333 South

Russellville, Arkansas

Dates: July 15, 2013 through February 10, 2014

Inspectors: Leonard Willoughby, Senior Reactor Inspector

Bob Latta, Senior Reactor Inspector

Jim Melfi, Project Engineer

Nnaerika Okonkwo, Reactor Inspector

Approved Gregory Werner

By: Acting Chief, Project Branch E

Division of Reactor Projects

-1- Enclosure

SUMMARY

IR 05000313; 05000368/2013012; 07/15/2013 - 02/10/2014; Arkansas Nuclear One;

Augmented Inspection Team Follow-up Report; Inspection Procedure 71153, Follow-up of

Events and Notices of Enforcement Discretion.

The inspection activities described in this report were performed by four inspectors from the

NRCs Region IV office. One preliminary finding of high safety significance (Red), one

preliminary finding of substantial safety significance (Yellow), and three findings of very low

safety significance (Green) are documented in this report. Both of the preliminary findings

constitute an apparent violation and two of the Green findings involved violations of NRC

requirements. The significance of inspection findings is indicated by their color (Green, White,

Yellow, or Red), which is determined using Inspection Manual Chapter 0609, Significance

Determination Process. Their cross-cutting aspects are determined using Inspection Manual

Chapter 0310, Components Within the Cross-Cutting Areas. Violations of NRC requirements

are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for

overseeing the safe operation of commercial nuclear power reactors is described in

NUREG-1649, Reactor Oversight Process.

A. NRC-Identified Findings and Self-Revealing Findings

Cornerstone: Initiating Events

• Unit 1 Apparent Violation. The inspectors reviewed a self-revealing apparent

violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures and

Drawings, which states, in part, that activities affecting quality shall be

prescribed by documented instructions, procedures, or drawings, of a type

appropriate to the circumstances and shall be accomplished in accordance with

these instructions, procedures or drawings. The licensee did not follow the

requirements specified in Procedure EN-MA-119, Material Handling Program, in

that, the licensee did not perform an adequate review of the subcontractors

lifting rig design calculation and the licensee failed to conduct a load test of the

lifting rig prior to use. The licensee initiated Condition Report

CR-ANO-C-2013-00888 to capture this issue in the corrective action program.

The licensees corrective actions included repairing damage to the Unit 1 turbine

deck, fire main system, and electrical system. In addition, changes were made to

various procedures including Procedure EN-DC-114, Project Management, to

provide guidance on review of calculations, quality requirements, and standards

associated with third party reviews.

The inspectors determined that the finding was more than minor because it was

associated with the procedural control attribute of the initiating event cornerstone,

and adversely affected the cornerstones objective to limit the likelihood of events

that upset plant stability and challenge critical safety functions during shutdown,

as well as power operations. The stator drop affected offsite power to Unit 1,

resulting in a loss of offsite power for approximately 6 days and a loss of the

alternate AC diesel generator. The inspectors used Inspection Manual

Chapter 0609, Attachment 0609.04, Initial Characterization of Findings, dated

June 19, 2012, to evaluate the significance of the finding. Since the plant was

shutdown, the inspectors were directed to Inspection Manual Chapter 0609,

Appendix G, Attachment 1, Shutdown Operations Significance Determination

-2-

Process Phase 1 Operational Checklists for Both PWRs and BWRs, Checklist 4,

dated May 25, 2004. Using Appendix G, Attachment 1, Checklist 4, the

inspectors concluded that this finding represented a degradation of the licensees

ability to add reactor coolant system inventory when needed since a loss of

offsite power occurred and therefore, this finding required a Phase 3 analysis. A

shutdown risk model was developed by modifying the at-power Arkansas Nuclear

One Unit 1 Standardized Plant Analysis Risk Model, Revision 8.19. The NRC

risk analyst assessed the significance of shutdown events by calculating an

instantaneous conditional core damage probability. The results were dominated

by two sequences. The largest risk contributor (approximately 97 percent) was

based on a failure of the emergency diesel generators without recovery. The

second largest risk contributor was the failure to recover decay heat removal.

The result of the analysis was an instantaneous conditional core damage

probability of 3.8E-4; therefore, this finding was preliminarily determined to have

high safety significance (Red).

This finding had a cross-cutting aspect in the area of human performance

associated with field presence, because the licensee did not ensure adequate

supervisory and management oversight of work activities, including contractors

and supplemental personnel. Specifically, the licensee did not provide a

sufficient level of oversight in that, the requirements in Procedure EN-MA-119, for

design approval and load testing of the temporary hoisting assembly, were not

followed [H.2] (Section 4OA3.9).

• Unit 2 Apparent Violation. The inspectors reviewed a self-revealing apparent

violation of 10 CFR 50, Appendix B, Criterion V, Instructions, Procedures and

Drawings, which states, in part, that activities affecting quality shall be

prescribed by documented instructions, procedures, or drawings, of a type

appropriate to the circumstances and shall be accomplished in accordance with

these instructions, procedures or drawings. The licensee did not follow the

requirements specified in Procedure EN-MA-119, Material Handling Program, in

that, the licensee did not perform an adequate review of the subcontractors

lifting rig design calculation and the licensee failed to conduct a load test of the

lifting rig prior to use. The licensee initiated Condition Report

CR-ANO-C-2013-00888 to capture this issue in the corrective action program.

The licensees corrective actions included repairing damage to the Unit 1 turbine

deck, fire main system, and electrical system. In addition, changes were made to

various procedures including Procedure EN-DC-114, Project Management, to

provide guidance on review of calculations, quality requirements, and standards

associated with third party reviews.

The inspectors determined that this finding was more than minor because it was

associated with the procedural control attribute of the initiating event cornerstone,

and adversely affected the cornerstones objective to limit the likelihood of events

that upset plant stability and challenge critical safety functions during shutdown,

as well as power operations. The stator drop caused a reactor trip on Unit 2 and

damage to the fire main system which resulted in water intrusion into the

electrical equipment causing a loss of startup transformer 3. This resulted in the

loss of power to various loads, including reactor coolant pumps, instrument air

compressors, and the safety-related Train B vital electrical bus. The inspectors

used Inspection Manual Chapter 0609, Attachment 0609.04, Initial

-3-

Characterization of Findings, dated June 19, 2012, and Appendix A, The

Significance Determination Process (SDP) for Findings At-Power, dated

June 19, 2012, to evaluate the significance of the finding. Since this was an

initiating event, the inspectors used Exhibit 1 of Appendix A and determined that

Section C, Support System Initiators, was impacted because the finding

involved the loss of an electrical bus and a loss of instrument air. The inspectors

determined that Section E, External Event Initiators, of Exhibit 1 should also be

applied because the finding impacted the frequency of internal flooding. Since

Sections C and E were impacted, a detailed risk evaluation was required. The

NRC risk analyst used the Arkansas Nuclear One, Unit 2 Standardized Plant

Analysis Risk Model, Revision 8.21, and hand calculation methods to quantify the

risk. The model was modified to include additional breakers and switching

options, and to provide credit for recovery of emergency diesel generators during

transient sequences. Additionally, the analyst performed additional runs of the

risk model to account for consequential loss of offsite power risks that were not

modeled directly under the special initiator. The largest risk contributor

(approximately 96 percent) was a loss of all feedwater to the steam generators,

with a failure of once-through cooling. The result of the analysis was a

conditional core damage probability of 2.8E-5; therefore, this finding was

preliminarily determined to have substantial safety significance (Yellow).

This finding had a cross-cutting aspect in the area of human performance

associated with field presence, because the licensee did not ensure adequate

supervisory and management oversight of work activities, including contractors

and supplemental personnel. Specifically, the licensee did not provide a

sufficient level of oversight in that, the requirements in Procedure EN-MA-119, for

design approval and load testing of the temporary hoisting assembly, were not

followed [H.2] (Section 4OA3.9).

Cornerstone: Mitigating Systems

• Green. The inspectors reviewed a self-revealing, non-cited violation of Unit 1

Technical Specification 5.4.1.a and Unit 2 Technical Specification 6.4.1.a,

involving the licensees failure to develop and implement procedural controls for

response to internal flooding. Specifically, the licensee did not incorporate any

instructions for the operation of the permanently installed temporary fire pump

into procedures, which resulted in flooding due to the ruptured fire main header

and not securing the temporary fire pump for approximately 50 minutes. The

licensees corrective actions included changing Checklist 1104.032, Fire

Protection Systems, Revision 76, to include guidance for securing the temporary

fire pump in the event of a leak or rupture in the fire main header and provided

personnel training on this change. This issue was entered into the corrective

action program as Condition Reports CR-ANO-C-2013-01072 and

CR ANO-C-2013-01962.

The inspectors determined that the licensees failure to develop and implement

adequate procedural controls for the permanently installed temporary fire pump

was a performance deficiency. The performance deficiency was more than

minor because it was associated with the procedural quality attribute of the

mitigating systems cornerstone and affected the cornerstones objective to

ensure the availability, reliability, and capability of systems that respond to

-4-

initiating events to prevent undesirable consequences (i.e. core damage).

Specifically, if the necessary flood prevention/mitigation actions cannot be

completed in the time required, much of the stations accident mitigation

equipment could be adversely impacted.

Unit 1 Analysis:

Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of

Findings, dated June 19, 2012, Table 3, Section A, directs the user to

Appendix G. The inspectors used Inspection Manual Chapter 0609, Appendix G,

Attachment 1, Shutdown Operations Significance Determination Process

Phase 1 Operational Checklists for Both PWRs and BWRs, dated May 25, 2004,

Checklist 4, to evaluate the significance of the finding. The inspectors

determined that the finding was of very low safety significance (Green) because

the finding did not: (1) increase the likelihood of a loss of reactor coolant system

inventory, (2) degrade the licensees ability to terminate a leak path or add

reactor coolant system inventory when needed, or (3) degrade the licensees

ability to recover decay heat removal once it is lost.

Unit 2 Analysis:

Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of

Findings, dated June 19, 2012, Table 3, Section E, Step 2, directs the user to

Appendix F, Fire, Protection Significance Determination Process, dated

September 20, 2013. The inspectors used Appendix F, to evaluate the

significance of the finding. The finding involved a fixed fire protection system and

the fire water supply (temporary fire pump). The finding was screened against

the qualitative screening question in Appendix F, Task 1.3.1 and the inspectors

determined it was of very low safety significance (Green), because the reactor

was able to reach and maintain safe shutdown.

The finding had a cross-cutting aspect in area of the human performance

associated with documentation, because the licensee failed to create and

maintain complete, accurate, and up-to-date documentation for the use of the

temporary fire pump [H.7] (Section 4OA3.1).

• Green. The inspectors reviewed a self-revealing finding for the licensees failure

to provide appropriate work instructions for the replacement of the main

feedwater regulating valve 2CV-0748 linear variable differential transformer

2ZT-0748. Specifically, the licensee failed to translate vendor recommendations

for use of a thread sealant, and torqueing of the adjustment nuts on the linear

variable differential transformer 2ZT-0748 into procedural steps to be

accomplished and verified. The failure to follow these recommendations resulted

in the nuts falling off because of vibration. The licensee initiated Condition

Report CR-ANO-2-2013-00423 and Work Order WT-WTANO-2013-00039 to

update the work instructions and perform maintenance to repair the valve

position indication by adding thread sealant and torqueing the adjustment nuts to

prevent them from loosening.

The inspectors determined that the failure to provide instructions to properly

perform maintenance on linear variable differential transformer 2ZT-0748 was a

-5-

performance deficiency. The performance deficiency was more than minor

because it was associated with the procedure quality attribute of the mitigating

systems cornerstone. It adversely affected the cornerstone objective to ensure

the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences and is therefore a finding. The

inspectors used Inspection Manual Chapter 0609, Attachment 0609.04, Initial

Characterization of Findings, dated June 19, 2012, and Appendix A, The

Significance Determination Process (SDP) for Findings At-Power, dated

June 19, 2012, to evaluate the significance of the finding. The inspectors

determined the finding was of very low safety significance (Green) because the

finding did not: (1) result in an actual loss of operability or functionality, (2)

represent a loss of system and/or function, (3) represent an actual loss of

function of a single train for greater than its technical specification allowed outage

time, (4) represent an actual loss of function of one or more non-technical

specification trains of equipment designated as high safety-significant for greater

than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and (5) involve the loss or degradation of equipment or function

specifically designed to mitigate a seismic, flooding, or severe weather event.

The finding had a cross-cutting aspect in the area of the problem identification

and resolution associated with operating experience, because although the

licensee had collected and evaluated the operating experience, it was not

implemented as procedural steps in linear variable differential transformer

replacement work instructions [P.5] (Section 4OA3.4).

• Green. The NRC identified a non-cited violation of 10 CFR 50.65(b)(2)(i) for the

licensees failure to monitor non-safety-related structures, systems, or

components that are relied upon to mitigate accidents or transients. Specifically,

the Unit 1 decay heat removal pump room level switches, which were credited for

mitigating the effects of internal flooding, were not being monitored as part of the

maintenance rule. The licensees corrective actions included developing a

preventative maintenance task to test the operation of the level switches. This

issue was entered into the corrective action program as Condition Report

CR-ANO-1-2013-03168.

The inspectors determined that the failure to effectively monitor the performance

of both Unit 1 decay heat removal room level switches in accordance with

10 CFR 50.65(a)(1) was a performance deficiency. The performance deficiency

was determined to be more than minor because it affected the equipment

performance attribute of the mitigating systems cornerstone and directly affected

the cornerstone objective of ensuring the availability and reliability of systems

that respond to initiating events to prevent undesirable consequences, in that it

called into question the reliability of flood mitigation equipment. The inspectors

used Inspection Manual Chapter 0609, Attachment 0609.04, Initial

Characterization of Findings, dated June 19, 2012, and Appendix A, The

Significance Determination Process (SDP) for Findings At-Power, dated

June 19, 2012, to evaluate the significance of the finding. The inspectors

determined the finding was of very low safety significance (Green) because the

finding did not: (1) result in an actual loss of operability or functionality, (2)

represent a loss of system and/or function (3) represent an actual loss of

function of a single train for greater than its technical specification allowed outage

time, (4) represent an actual loss of function of one or more non-technical

specification trains of equipment designated as high safety-significant for greater

-6-

than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and (5) involve the loss or degradation of equipment or function

specifically designed to mitigate a seismic, flooding, or severe weather event.

This finding did not have a cross-cutting aspect since the switches were installed

and evaluated in 2003, and therefore it is not indicative of current performance

(Section 4OA3.5.2).

-7-

REPORT DETAILS

4. OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency

Preparedness, Public Radiation Safety, Occupational Radiation Safety, and

Physical Protection

4OA3 Follow-up of Events and Notices of Enforcement Discretion (71153)

.1 (Closed) Unresolved Item 05000313/2013011-001, Control of Temporary Modification

Associated with Temporary Fire Pump

The Augmented Inspection Team identified an unresolved item associated with operator

control of the water supply to the station fire suppression system and the control of a

temporary fire pump modification. Specifically, following the stator drop, a significant fire

water leak occurred in the turbine building train bay as a result of a ruptured eight-inch

fire water header. The Augmented Inspection Team determined that additional

inspection was needed to assess the timeliness of the licensees actions to secure the

fire pumps and terminate the supply of water to the fire main rupture in the turbine

building train bay.

Observations and Findings

Introduction. The Augmented Inspection Team, Follow-up Team (inspectors) reviewed a

self-revealing, Green non-cited violation of Unit 1 Technical Specification 5.4.1.a and

Unit 2 Technical Specification 6.4.1.a, involving the licensees failure to develop and

implement procedural controls for response to internal flooding.

Description. In 1999, the licensee installed a temporary fire pump that could be used

during outages or other times when the permanently installed fire pumps were out of

service. The power supply for this electric fire pump was from the London 13.8 kV line,

which is an additional offsite power source not included in the plant Technical

Specifications. This temporary fire pump allowed the licensee to perform maintenance

on installed fire pumps and still maintain fire water suppression capability for the site. At

the time of the event, the temporary electric fire pump was in service and supplying

water from the intake canal to the station fire suppression system.

The collapse of the temporary hoisting assembly and the drop of the generator stator

ruptured an eight-inch fire main in the train bay. As designed, the diesel-driven fire

pump started when the system pressure dropped below 95 psig. The permanently

installed electric fire pump was not available due to the loss of offsite power, but the

temporary electric fire pump continued to operate since the London 13.8 kV line was

unaffected by the event. The two operating pumps were each capable of supplying

approximately 2,500 gpm at rated system pressure.

At 8:03 a.m., an entry in the control room log stated that all firewater pumps, including

the temporary firewater pump were secured. However, several subsequent log entries

reflected significant water flow from the fire suppression system in the turbine building

and into the Unit 1 auxiliary building. A log entry, made 67 minutes after the event,

stated that fire hydrant 1 was cycled opened then shut in an attempt to lower fire header

-8-

pressure and slow firewater into the train bay. A log entry five minutes later stated that

the temporary fire pump was secured.

The Augmented Inspection Team confirmed through interviews with the operators that

the diesel-driven pump was secured first, and the temporary pump was secured at a

later time following the cycling of fire hydrant 1. The Augmented Inspection Team

reviewed video taken inside the turbine building following the event and confirmed that

the diesel-driven pump was secured at a time consistent with the entry in the station log.

However, the Augmented Inspection Team also identified indications of system pressure

consistent with an operating pump approximately 40 minutes after the event.

Based on uncertainties associated with the time line for operator response, the

inspectors examined the licensees revised sequence of events for securing the supply

of water to the fire main rupture in the turbine building train bay, conducted system walk

downs, and reviewed the available video records of the stator drop event. As a result of

these reviews, the inspectors determined that the initial timeline for securing the

temporary firewater pump, documented in Corrective Action 1, of Condition Report

CR-ANO-C-2013-01072, was at least 10 minutes longer than the previously estimated

time of 8:19 a.m. Specifically, review of video evidence established that the temporary

firewater pump was secured between 8:29 a.m. and 8:38 a.m. This time frame was

predicated on observed flow in the video recording at 8:24 a.m. with pressure beginning

to drop at approximately 8:29 a.m. and no firewater flow from the ruptured pipe evident

at 8:38 a.m.

The inspectors also reviewed the temporary fire pump installation procedure,

the associated 10 CFR 50.59 evaluation, the associated operations training material,

and the corrective actions identified in Condition Report CR-ANO-C-2013-01072. From

these reviews, the inspectors determined that subsequent to the event, extensive

corrective actions had been developed to address the prolonged operator response time

for securing the temporary fire pump. However, the inspectors determined that prior to

the event, there were no specific procedural controls, guidance, or standing orders which

directed operations personnel to secure firewater pumps in the event of flooding

caused by a fire system leak. The licensees corrective actions included changing

Checklist 1104.032, Fire Protection Systems, Revision 76, to include guidance for

securing the temporary fire pump in the event of a rupture in the fire main and provided

training on this change. This issue was entered into the corrective action program as

Condition Reports CR-ANO-C-2013-01072 and CR-ANO-C-2013-01962.

Analysis. The inspectors determined that the licensees failure to develop and

implement adequate procedural controls for the permanently installed temporary fire

pump was a performance deficiency. The performance deficiency was more than minor

because it impacted the procedural quality attribute of the mitigating systems

cornerstone and affected the cornerstones objective to ensure the availability, reliability,

and capability of systems that respond to initiating events to prevent undesirable

consequences (i.e. core damage). Specifically, if the necessary remedial actions cannot

be completed in the time required, some of the stations accident mitigation equipment

could be adversely impacted.

-9-

Unit 1 Analysis:

Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of

Findings, dated June 19, 2012, Table 3, Section A, directs the user to Appendix G. The

inspectors used Inspection Manual Chapter 0609, Appendix G, Attachment 1,

Shutdown Operations Significance Determination Process Phase 1 Operational

Checklists for Both PWRs and BWRs, dated May 25, 2004, Checklist 4, to evaluate the

significance of the finding. The inspectors determined that the finding was of very low

safety significance (Green) because the finding did not: (1) increase the likelihood of a

loss of reactor coolant system inventory, (2) degrade the licensees ability to terminate a

leak path or add reactor coolant system inventory when needed, and (3) degrade the

licensees ability to recover decay heat removal once it is lost.

Unit 2 Analysis:

Inspection Manual Chapter 0609, Attachment 0609.04, Initial Characterization of

Findings, dated June 19, 2012, Table 3, Section E, Step 2, directs the user to

Appendix F, Fire, Protection Significance Determination Process dated September 20,

2013. The inspectors used Appendix F, to evaluate the significance of the finding. The

finding involved a fixed fire protection system and the fire water supply (temporary fire

pump). The finding was screened against the qualitative screening question in

Appendix F, Task 1.3.1 and the inspectors determined it was of very low safety

significance (Green), because the reactor was able to reach and maintain safe

shutdown.

The finding had a cross-cutting aspect in area of the human performance associated

with documentation, because the licensee failed to create and maintain complete,

accurate, and up-to-date documentation for the use of the temporary fire pump [H.7]

(Section 4OA3.1).

Enforcement. Unit 1 Technical Specification 5.4.1.a and Unit 2 Technical

Specification 6.4.1.a, state that, Written procedures shall be established, implemented,

and maintained covering the following activities: The applicable procedures

recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978.

Regulatory Guide 1.33, Quality Assurance Program Requirements (Operation),

February 1978, Appendix A, Section 6.r, requires, in part, implementation of approved

procedures for combating emergencies and other significant events, including other

expected transients that may be applicable. Contrary to the above, since 1999, the

licensee failed to establish a procedure to address the requirements of Regulatory

Guide 1.33, Appendix A, Section 6.r. Specifically, Procedure 1104.032, Fire Protection

Systems, Revision 75, did not contain specific controls or guidance to secure the

temporary fire pump in the event of flooding caused by a fire system leak. Since this

finding is of very low safety significance and has been entered into the corrective action

program as Condition Reports CR-ANO-C-2013-01072 and CR-ANO-C-2013-01962,

this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of

the NRC Enforcement Policy: NCV 05000313/20130012-01; 05000368/20130012-01;

Failure to Adequately Develop and Implement Adequate Procedural Controls to

Remediate the Anticipated Effects of Internal Flooding for Either Unit.

- 10 -

.2 (Closed) Unresolved Item 05000313/2013011-002; 05000368/2013011-002, Damage to

Unit 1 and Unit 2 Structures, Systems and Components

The Augmented Inspection Team concluded that the licensee had appropriate plans in

place to identify affected equipment, control access to the affected areas, and

commence debris removal and repair activities after the stator drop occurred. However,

since a full assessment of the damage to Unit 1 and Unit 2 structures, systems,

components following the dropped stator was not possible until debris had been

removed, an unresolved item was opened to assess the damage.

Observations and Findings

The inspectors reviewed Condition Reports CR-ANO-1-2013-00868 and

CR-ANO-2-2013-00620, and performed visual inspections of walls, floors, structural

supports, and ceilings. The inspectors visually inspected support beams, conduit, cable

raceways, ventilation ducting, hydrogen piping, carbon dioxide piping, instrument air

piping, and equipment in the affected areas.

The inspectors discussed with the licensee the effect of the dropped stator on electrical

busses, raceways and cabling, and the acceptance testing the licensee performed on

the affected cables. The inspectors also reviewed and discussed the post-installation

testing the licensee performed on the repaired Unit 1 4160 Vac switchgear.

The inspectors toured affected areas, looking at the turbine building structures and

components. Acceptance testing of the repaired switchgear was ongoing, but was

mostly completed by the time of the inspection. The inspectors concluded that the

turbine building structures were repaired to the same condition as they were prior to the

stator drop, with exceptions, that included:

The non-load bearing masonry block wall between the machine shop and the

train bay was not replaced. The licensee relocated the machine shop equipment

to a different facility outside the protected area, and intends to use the area

between the train bay and former machine shop as a storage area during future

refueling outages.

The inspectors concluded that the repairs to the turbine building structures and

components were effective.

No findings were identified.

.3 (Closed) Unresolved Item 05000313/2013011-003, Procedural Controls Associated with

Unit 1 Steam Generator Nozzle Dams

The Augmented Inspection Team identified an unresolved item associated with the

procedural controls for the backup air supply systems to the Unit 1 nozzle dams. The

inspectors concluded that additional inspection was required to assess the procedural

controls associated with the primary and backup pressure sources for the steam

generator nozzle dams.

- 11 -

a. Observations and Findings

On March 28, 2013, the Unit 1 steam generator nozzle dams were installed. The nozzle

dams consisted of one rigid plug and two inflatable dams, installed in the reactor coolant

system piping that provided access for work inside the steam generators while

maintaining water inventory in the reactor coolant system. The inflatable nozzle dams

are pressurized to a normal operating pressure of approximately 75 psig. On a loss of

seal pressure, the design of the nozzle dams limits the maximum leakage through the

seals to approximately 2 gpm. The normal system lineup included a regulated 90 psig

primary supply with an independent 80 psig backup pressure source. At the time of the

stator drop event, the primary supply for the nozzle dams consisted of a portable electric

air compressor with the backup supply provided by a second portable electric air

compressor powered by a different train of non-safety-related electrical power. In the

event of loss of both air supplies, the licensees contingency plan provided for the use of

the instrument air system.

The stator drop event resulted in the loss of offsite electrical power to Unit 1 and most of

the power to the containment building, including loss of power to both air compressors

for the nozzle dams. The nozzle dams began to lose pressure, due to the check valves

on the air supply lines leaking. At approximately 9:30 a.m., personnel entered

containment and observed nozzle dam pressure was approximately 50 psig and falling.

The licensees steam generator engineer requested nitrogen bottles be brought into

containment. While waiting for the nitrogen bottles, nozzle dam pressures approached

25 psig, at which point the nozzle dam seals were subject to reactor coolant system

leakage. The steam generator engineer connected the local instrument airline to the

nozzle dams; however, instrument air pressure was reduced to approximately 50 psig

due to the trip of the instrument air compressors following the startup transformer 3

lockout and partial loss of offsite power to Unit 2. Compressed nitrogen bottles were

subsequently taken into containment and aligned to the nozzle dam consoles and seal

pressure was restored to approximately 70 psig. However, as a result of degraded seal

pressure, a small amount of reactor coolant system inventory leaked past the nozzle

dam seals.

Recovery efforts also included connecting a line to the nozzle dams from a distribution

air center supplied by the refueling air compressor. The refueling air compressor was

located outside the containment building and was powered from the London 13.8kV line,

which was not affected by the stator drop event. The refueling air compressor was

placed into service as the primary source of air for nozzle dam seal pressurization with

the nitrogen bottles as the backup source. The licensee established local nozzle dam

checks on a two-hour frequency. The inspectors determined the licensees response to

this event was appropriate.

The inspectors reviewed design documents and industry information associated with the

nozzle dam design. Unit 1 Safety Analysis Report Section 4.2.2.2, Steam Generator,

indicated that the nozzle dams prevent water from entering the steam generators.

Section 4.2.2.2 also stated that the nozzle dams serve no safety function. Engineering

Evaluation ER981203 E101, Engineering Evaluation of the ANO-1 Steam Generator

Nozzle Dams, dated January 1999, documented that the nozzles dam structure

consisted of two redundant inflatable seals and one passive emergency backup seal.

The design of the seals was for the inflatable seals to provide the primary and normal

backup seal and in the unlikely event of both inflatable seals failing, the passive seal

- 12 -

would limit leakage to less than 2 gpm, as stated above. The design of the seal was

consistent with industry guidance to limit leakage on the event of a catastrophic

inflatable seal failure. The inspectors reviewed the original procurement Specification

ANO-M-434, Specification for Arkansas Nuclear One Russellville, Arkansas OTSG

[Once-Through Steam Generator] Nozzle Dams, dated April 20, 1990. The nozzle

dams, including the seals, were procured as non-quality related.

As documented in Condition Report CR-ANO-1-2013-00917, the corrective actions

included leak testing of the nozzle dam check valves and having nitrogen bottles as a

backup source of air in case of loss of electrical power to the air compressors. One of

the contributors to the loss of seal pressure was that in 2010, Procedure OP-5120.504,

OTSG Nozzle Dam Training, Testing and Installation/Removal, Revision 6, was revised

to allow various options for maintaining seal pressure, and nitrogen bottles were no

longer used based on the operational convenience of not bringing the bottles into

containment. The inspectors determined that the change in 2010, to remove the

nitrogen bottles, was non-conservative.

No findings were identified.

.4 (Closed) Unresolved Item 05000368/2013011-004, Main Feedwater Regulating Valve

Maintenance Practices

The Augmented Inspection Team identified an unresolved item associated with licensee

maintenance practices involving the main feedwater regulating valves. The inspectors

concluded that additional inspection was required to assess the effectiveness of the

licensee maintenance practices for the main feedwater regulating valves.

Following the Unit 2 reactor trip on March 31, 2013, operators identified that main

feedwater regulating valve A failed to indicate closed. This indication resulted in the

operators tripping main feedwater pump A and manually initiating the emergency

feedwater actuation system. Operators subsequently placed the auxiliary feedwater

system in service, which required operators to manually inhibit the emergency feedwater

system, rendering both trains of emergency feedwater inoperable and requiring entry

into Technical Specification 3.0.3 for a short period of time. The licensee later

determined that the regulating valve actually had closed, and the valve indication was in

error.

Observations and Findings

Introduction. The inspectors reviewed a Green self-revealing finding associated with a

failure to provide sufficient work instructions for the replacement of the main feedwater

regulating valve 2CV-0748 linear variable differential transformer 2ZT-0748.

Specifically, the licensee failed to translate vendor recommendations to use a thread

sealant and torqueing the adjustment nuts on the linear variable differential transformer

2ZT-0748, into procedural steps to be accomplished and verified. The failure to use

thread sealant and torque the adjustment nuts resulted in the nuts loosening and falling

off because of vibration. The licensee initiated corrective actions, Condition Report

CR-ANO-2-2013-00423 and Work Order WT-WTANO-2013-00039 to perform

maintenance to add thread sealant, and torque the nuts to prevent the nuts from

loosening.

- 13 -

Description. Following the Unit 2 reactor trip on March 31, 2013, operators identified

that main feedwater regulating valve 2CV-0748 went closed; however, the digital

indications provided from the valve linear variable differential transformer and limit

switches falsely showed the valve to be 7.7 percent open. These indications resulted in

the operators tripping main feedwater pump A and manually initiating the emergency

feedwater actuation system in accordance with Procedure 2002-001, ANO standard

Post Trip Action, Revision 13. Operators subsequently placed the auxiliary feedwater

system in service, which required operators to manually inhibit the emergency feedwater

system, rendering both trains inoperable and requiring entry into Technical Specification

3.0.3 for a short period of time. This complicated operator response to the trip.

The licensee later determined that the regulating valve actually had closed, and the

valve indication was in error. Based on its investigation, the licensee determined that

the lower nut, which holds the LVDT 2ZT-0748, MFW 2P-1A DISCH MAIN REG LVDT

on a support plate on which the limit switches were also mounted, was missing. The

missing nut caused the linear variable differential transformer and the valve limit switch,

which provide digital indication for feedwater loop A main regulating valve position, to

show an incorrect valve position indication.

The linear variable differential transformer was replaced during refueling outage 2R22,

which occurred in the fall of 2012. Maintenance work order MWO-5024186-01 had a

note that required thread sealant for the linear voltage differential transformer rod. The

work order did not provide steps for the application of thread sealant for the upper and

lower nuts that hold the linear variable differential transformer rod. The use of a note

was contrary to Procedure EN-AD-101-01, Nuclear Management Manual Procedure

Writer Guide, Section I, Item 7, which specified that, notes are to be used for clarifying

information and are not to contain action instructions.

As corrective actions, the licensee torqued and added thread sealant to the nuts that

held the linear variable differential transformer rod; modified the work order to add steps

to install thread sealant; and, torqued the upper and lower nuts of the linear variable

differential transformer rod. The linear variable differential transformer was also

calibrated and tested.

Analysis. The inspectors determined that the failure to provide instructions to properly

perform maintenance on linear variable differential transformer 2ZT-0748 was a

performance deficiency. The performance deficiency was more than minor because it

was associated with the procedure quality attribute of the mitigating systems

cornerstone. It adversely affected the cornerstone objective to ensure the availability,

reliability, and capability of systems that respond to initiating events to prevent

undesirable consequences, and is therefore a finding. The inspectors used Inspection

Manual Chapter 0609, Attachment 0609.04, Initial Characterization of Findings, dated

June 19, 2012, and Appendix A, The Significance Determination Process (SDP) for

Findings At-Power, dated June 19, 2012, to evaluate the significance of the finding.

The inspectors determined that the finding was of very low safety significance (Green)

because the finding did not: (1) result in an actual loss of operability or functionality, (2)

represent a loss of system and/or function, (3) represent an actual loss of function of a

single train for greater than its technical specification allowed outage time, (4) represent

an actual loss of function of one or more non-technical specification trains of equipment

designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and (5) involve the loss

or degradation of equipment or function specifically designed to mitigate a seismic,

- 14 -

flooding, or severe weather event. The finding had a cross-cutting aspect in the area of

problem identification and resolution associated with operating experience, because

although the licensee had collected and evaluated the operating experience, it was not

implemented as procedural steps in linear variable differential transformer replacement

work instructions [P.5].

Enforcement. This finding does not involve a violation, because there is no regulatory

requirement associated with this finding. As such, and because the associated

performance deficiency is of very low safety significance (Green), it is identified as a

finding: FIN 05000368/2013012-002, Main Feedwater Regulating Valve Maintenance

Practices.

.5 (Discussed) Unresolved Item 05000313/2013011-005, Flood Barrier Effectiveness

The Augmented Inspection Team noted that following the stator drop, a significant fire

water leak occurred in the train bay from a ruptured eight-inch fire header. Due to the

approximately 50 minute time before the pipe rupture was isolated, fire water sprayed

into the auxiliary building and accumulated in the general area access at the 317 foot

elevation. Water also accumulated in the flood protected decay heat vault B, which is

also on the 317 foot elevation. The Augmented Inspection Team concluded that

additional inspection was required to determine the causes and impact of the failed flood

hatches and the partially open decay heat vault B, drain isolation valve.

a. Inspection Scope

Background of Unit 1 and Unit 2 Flood Protection Features

The Arkansas Nuclear One facility was built at a plant grade elevation of 354 feet. The

design basis flood water level for both Unit 1 and Unit 2 has a projected flood elevation

of 361 feet at the site. Safety-related structures, systems, and components necessary

for reaching and maintaining safe shutdown are protected against the design basis flood

level. The flood protection features for both units are similar, but Unit 2 has a more

robust design.

Both units have safety-related structures, systems, and components necessary to

maintain safe shutdown for above the design basis flood water level, including the

emergency diesel generators, 4160 Vac vital and non-vital switchgear, service water

pump motors, and offsite power feeds. Some of this equipment is located in the auxiliary

building below the projected flood level and requires protection. Both units auxiliary

building designs incorporate features to keep water out, such as watertight doors,

equipment hatches, and concrete plugs with a neoprene seal to prevent water from

entering. The incorporated barriers include reinforced concrete walls designed to resist

the static and dynamic forces of the projected flood, with special water-stops at

construction joints to prevent in-leakage. Pipe penetrations through the walls have

special rubber boots or other protective features. In addition, both units have required

safety-related structures, systems, and components on the 317 foot elevation partitioned

into separate rooms to provide protection in the event of flooding. The partition walls are

designed to withstand hydrostatic loading over their full height.

- 15 -

Watertight Rooms in Unit 1 and Unit 2

Unit 1 has two watertight rooms on the 317 foot elevation. Each room contains a train of

safety-related equipment, consisting of a decay heat removal pump, a reactor building

spray pump, a decay heat removal heat exchanger, and a room cooler. Other Unit 1

safety-related pumps, including the high pressure injection pumps and emergency

feedwater pumps, are on the 335 foot elevation and are not in watertight rooms.

Similarly, Unit 2 has watertight rooms for protection of safety-related equipment. Unit 2

has the emergency feedwater pumps protected in watertight rooms located on the 335

foot elevation. Unit 2 has separate trains of low pressure safety injection pumps, high

pressure safety injection pumps, and containment spray pumps in separate vaults on the

317 foot elevation. Unit 2 also has a swing high pressure safety injection pump and

associated room cooler in a separate vault on the 317 foot elevation.

Any water leakage into the auxiliary building would flow into various floor drains and

openings, down to the 317 foot level of each auxiliary building. This leakage would

either go into each units respective dirty waste storage tank or into the units auxiliary

building sump. Sump pumps are provided to remove any small leakage that could seep

through exterior concrete walls and discharge into the dirty waste storage tank. The

water can then be transferred out of the dirty waste storage tank to be processed and

safely disposed of via each units radioactive waste cleanup system. The auxiliary

building sump pumps and dirty waste system are non-safety-related. One sump pump

will automatically start on Unit 1 at a specified level, and a second pump that could be

started manually is available. Unit 2 sump pumps will both start automatically,

depending on Unit 2 sump level.

Augment Inspection Follow-up Team Review

The inspectors reviewed the licensees Condition Report ANO-C-2013-01304 written to

address the condition of water entering the Unit 1 auxiliary building, walked down

various design features of the auxiliary building, interviewed staff, reviewed records, and

associated drawings. Due to the equipment in the turbine building impacted by the

stator drop, non-safety-related power was lost and there was no power to the auxiliary

building sump pumps and dirty waste storage tank system. The licensee identified about

an inch of water in decay heat removal room B and on the general access area of the

317 foot level of the auxiliary building. When water from the broken fire main reached

the removable floor plugs, the water leaked past the plugs into the lower auxiliary

building elevations, because the plug seals were degraded. The water subsequently

reached the 317 foot level of the auxiliary building and filled the auxiliary building sump.

Each decay heat removal room has an isolation valve that allows water in the decay

heat removal room to be drained to the auxiliary building sump. The isolation valve for

the drain from decay heat removal room B was not fully shut and water from the auxiliary

building sump flowed back into the room.

b. Observations and Findings

.1 Flood Mitigation Barriers

The inspectors have not completed their evaluation of the licensees extent of condition

for the degraded flood barriers. As such, this unresolved item will remain open and will

include the consideration of the following items:

- 16 -

(a) Floor Plugs are designed to allow for access and the movement of components into

and out of the lower levels of the auxiliary building. Flood protection for these plugs

was provided by a neoprene seal. The licensee had no specified frequency for seal

replacement. The seal was either too old and it did not seal, or the design was

inadequate in that the seal rolled out of place when the plug was set into the floor.

(b) The decay heat removal room drain valves are manually closed to prevent water

from entering the vault. During the event, one drain valve indicated closed, but the

valve was partially open, allowing water to enter the room. On several occasions

after the event, operators attempted to shut the valve, but it did not fully shut. The

lack of maintenance on the associated reach rods, and/or position indication not

being correct, or a combination of these two conditions, resulted in plant operators

not being able to consistently close the train B decay heat removal vault drain valve.

(c) From its extent of condition review, the licensee identified other paths for water to get

into the auxiliary building. These included: drains in the turbine building, a sump

from the solid radioactive waste storage building (located in the switchyard) to the

Unit 1 auxiliary building sump, unprotected penetrations in the auxiliary building

annex, unprotected electrical conduits entering into the auxiliary building, unsealed

holes in the auxiliary building from the turbine building, and the tendon gallery access

hatches. On March 5, 2014, the licensee submitted a non-emergency 10 CFR 50.72

notification, Event Number 49873, to the NRC for the discovery of pathways that

could bypass flood barriers. For immediate corrective actions, the licensee installed

barriers in the pathways or implemented compensatory measures.

(d) The NRC needs to determine why these items identified in the extent of condition

walk down for the flooding event, caused by the stator drop, were not identified as

part of the flooding walk downs described in Arkansas Nuclear One letters, dated

November 27, 2012 (ML 12334A008 and ML ML12334A006), in response to the

NRCs Request for Information letter, Request for Information Pursuant to Title 10 of

the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3,

and 9.3 of the Near-Term Task Force Review of Insights form the Fukushima Dai-ichi

Accident, dated March 12, 2012 (ML12053A340).

(e) The safety classification of the vault drain valves as non-safety-related does not

appear commensurate with its importance in mitigating a flooding event.

.2 Decay Heat Removal Rooms Flood Level Switches not Scoped into the Maintenance

Rule

Introduction. The inspectors identified a Green non-cited violation of

10 CFR-50.65(b)(2)(i) associated with the licensees failure to monitor non-safety-related

structures, systems, and components that are relied upon to mitigate accidents or

transients.

Description. During inspection of the water intrusion into Unit 1, the inspectors noted

that both Unit 1 decay heat removal rooms contain high level alarm switches that are

credited, in part, with mitigating the effects of internal flooding caused by a moderate

energy line break. Specifically, if there is internal flooding in one of the Unit 1 decay

heat removal rooms as indicated by the room level switch, operators are dispatched to

- 17 -

ensure that the other Unit 1 train decay heat removal room is isolated. The inspectors

noted that the failure of these switches could result in operators failing to take actions to

mitigate internal flooding.

The level switches associated with Unit 1 decay heat removal rooms provide a control

room alarm. The annunciator response Procedure 1203.012H, Annunciation K09

Corrective Action, Revision 43, directs the operators to verify that the opposite train

room floor drain valve is closed. This action helps ensure that two trains of safety-

related equipment are not affected by the flooding.

The licensee installed new level switches in 2003, but determined that no preventive

maintenance activity was necessary for these switches. Based on their understanding

that these non-safety-related switches are credited with mitigating an accident, and the

knowledge that the maintenance rule scoping documents did not identify these level

alarm switches, the inspectors questioned how they were being controlled and what type

of preventative maintenance was being performed. The licensees corrective actions

included developing a preventive maintenance task to test the operation of the level

switches and the switches operated properly. The licensee entered this issue into the

corrective action program as Condition Report CR-ANO-2013-03168.

The inspectors, as part of their independent extent of condition review, looked at how the

licensee treats the room level switches in Unit 2 and noted that the licensee had

established preventive maintenance tasks to test the operation of the level switches.

Analysis. The failure to effectively monitor the performance of both Unit 1 decay heat

removal room level switches in accordance with 10 CFR 50.65(a)(1) was a performance

deficiency. The inspectors determined that the performance deficiency was more than

minor because it affected the equipment performance attribute of the mitigating systems

cornerstone, and directly affected the cornerstone objective of ensuring the availability

and reliability of systems that respond to initiating events to prevent undesirable

consequences, in that it called into question the reliability of flood mitigation equipment.

The inspectors used Inspection Manual Chapter 0609, Attachment 0609.04, Initial

Characterization of Findings, dated June 19, 2012, and Appendix A, The Significance

Determination Process (SDP) for Findings At-Power, dated June 19, 2012, to evaluate

the significance of the finding. The inspectors determined the finding was of very low

safety significance (Green) because it did not: (1) result in an actual loss of operability or

functionality, (2) represent a loss of system and/or function, (3) represent an actual loss

of function of a single train for greater than its technical specification allowed outage

time, (4) represent an actual loss of function of one or more non-technical specification

trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and

(5) involve the loss or degradation of equipment or function specifically designed to

mitigate a seismic, flooding, or severe weather event. This finding did not have a cross-

cutting aspect since the switches were installed and evaluated in 2003, and therefore it

is not indicative of current performance

Enforcement. Title 10 CFR 50.65(b)(2)(i) requires, in part, that the scope of the

monitoring program specified in paragraph (a)(1) shall include non-safety-related

structures, systems, and components that are relied upon to mitigate accidents or

transients. Contrary to the above, from initial maintenance rule scoping in 1996 to the

present, the Unit 1 decay heat removal room level alarm switches (non-safety-related)

were not included in the scope of the monitoring program specified in

- 18 -

10 CFR 50.65(a)(1). The inclusion of the Unit 1 decay heat removal room level alarm

switches in the scope of the monitoring program is necessary because these

components are relied upon to mitigate accidents or transients. Since this finding is of

very low safety significance and has been entered into the corrective action program as

Condition Report CR-ANO-1-2013-03168, this violation is being treated as a non-cited

violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000313/2013013-003, Failure to Scope Required Components in the Stations

Maintenance Rule Monitoring Program.

.6 (Closed) URI 05000313; 368/2013011-006, Compensatory Measures for Firewater

System Rupture

The Augmented Inspection Team identified an unresolved item associated with the

licensees compensatory measures for fire suppression prior to the restoration of the

damaged firewater system. The inspectors concluded that additional inspection was

needed to fully assess the effectiveness of the compensatory measures and the

timeliness of the firewater system restoration.

Observations and Findings

The inspectors conducted interviews with on-shift licensee personnel assigned to

establish compensatory measures for the damaged fire main. The inspectors toured the

areas impacted by the damaged fire main and reviewed the Unit 1 and Unit 2 Technical

Requirements Manual.

The Unit 1 stator drop caused damage to an eight-inch fire main pipe that feeds various

fire stations. To control flooding, the fire suppression system was secured until the

damaged piping could be isolated.

The licensee did establish compensatory measures while isolating and repairing the

damaged fire main system. In addition, before the Unit 2 startup, the licensee

established compensatory measures to meet conditions specified in the Unit 2 Technical

Requirements Manual. The inspectors reviewed the compensatory measures

implemented by the licensee and determined that they were appropriate.

No findings were identified.

.7 (Closed) URI 05000368/2013011-007, Timeliness of Emergency Action Level

Determination

The Augmented Inspection Team identified an unresolved item involving the timeliness

of the emergency declaration of a Notification of Unusual Event based on the information

available to the control room operators. The inspectors concluded that additional follow-

up inspection was required to assess the timeliness of the emergency classification

given the information available to the control room operators.

Observations and Findings

The inspectors conducted interviews with on-shift licensee personnel and physically

observed the damaged electrical area in order to make an independent assessment of

the information needed to determine if criteria was met for an emergency declaration.

- 19 -

The inspectors concluded that a correct and timely emergency declaration was made by

the licensee.

The Unit 1 stator drop caused damage to an eight-inch fire main and a wall adjacent to

the Unit 2 4160 Vac non-vital switchgear. The spray from the damaged fire main piping

impacted the Unit 2 switchgear breaker enclosures and accumulated on the floor. The

water spray and/or the water accumulation caused breaker 2A-113 to short and explode,

vaporizing the components within the breaker cubicle.

The initial report to the control room at 9:25 a.m. was that one of the breaker doors on

switchgear bus 2A1 has been knocked open, but licensee personnel were unable to

determine at that time which breaker had been impacted. Light smoke with no visible

fire, from the back of one breaker in switchgear bus 2A2, was reported. There was

standing water around the switchgear. The March 31, 2013, dayshift Unit 2 Shift

Manager walked the inspectors around the Unit 2 non-vital switchgear explaining the

conditions observed in the area after the Unit 1 stator drop event. At the time of the

event, the licensee determined that it was unsafe for personnel to approach the breaker.

Approximately one hour later, conditions were such that licensee personnel could

observe the breaker cubicle to make a preliminary assessment. The licensee noted

metal splatter on the inside of the door that would indicate a high-energy event, i.e.

explosion, from possible water intrusion into the breaker cubicle. According to the Unit 2

station logs, when these observations were reported to the control room operators, the

shift manager declared an emergency declaration of a Notice of Unusual Event at 10:34

a.m. Initial notifications of the Notice of Unusual Event were completed at 10:48 a.m.

per the logs. The inspectors determined that upon identification of the explosion of

breaker 2A-113, the shift manager made the emergency declaration notification to offsite

parties within 15 minutes of the initial emergency declaration.

No findings were identified.

.8 (Closed) Unresolved Item 05000313/2013011-008, Effectiveness of Shutdown Risk

Management Program

The Augmented Inspection Team determined that additional inspection was necessary

to assess the effectiveness of the licensees risk mitigating measures associated with

the stator move.

Observations and Findings

The inspectors reviewed Condition Reports CR-ANO-1-2013-00132 and

CR-ANO-1-2013-01028, as well as Procedures EN-FAP-OU-100, Refueling Outage

Preparation and Milestones, Revision 1 and EN-OU-108, Shutdown Safety

Management Program, Revision 5. These procedures provided a process to assess

the overall impact of plant maintenance on plant risk to satisfy the requirements

of 10 CFR 50.65(a)(4) during the cold shutdown and refueling modes of reactor

operation. Procedure EN-OU-108, Step 5.4, described two types of contingency plans

that needed to be developed. The stator move fell under the definition of an outage risk

contingency plan. Procedure EN-FAP-OU-100 also described the level of contingency

planning necessary based on the probability of an issue/problem occurring and the

potential impact the issue/problem could have. Plant history, industry experience, and

worker knowledge were used to evaluate probability and impact. Probabilities of an

- 20 -

issue/problem were further delineated into High, Medium, or Low, and the impacts

of an issue were also delineated as High, Medium, or Low.

The movement of the stator was a high impact, but low probability event. The inspectors

noted that Procedure EN-FAP-OU-100, Section 7.7, did not require a contingency plan

because of the low probability of the event. The inspectors reviewed Regulatory

Guide 1.182, Assessing and Managing Risk before Maintenance Activities at Nuclear

Power Plants, dated May 2000, which endorses NUMARC 93-01, Industry Guideline

for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, dated

February 11, 2000, Section 11, Assessment of Risk Resulting from Performance of

Maintenance Activities. NUMARC 93-01, Section 11, references NUMARC 91-06,

Guidelines for Industry Actions to Assess Shutdown Management, Section 4.0,

Shutdown Safety Issues.

The inspectors determined that while no specific contingency plan for the stator move

was developed, the licensee did develop a contingency plan for the protection of spent

fuel cooling. The inspectors concluded that no contingency plans were procedurally

required to be developed by the licensee for the stator move and this was consistent

with NUMARC 93-01.

No findings were identified.

.9 (Closed) Unresolved Item 05000313/2013011-009, Effectiveness of Material Handling

Program

The Augmented Inspection Team identified an unresolved item associated with the

licensees implementation of Procedure EN-MA-119, Material Handling Program. The

inspectors determined that the design and test process applied to the crane did not

conform to applicable procedures and standards. However, the inspectors concluded

that additional inspection was needed to assess the effectiveness of the material

handling program implementation in mitigating risk associated with the stator movement

activities.

a. Observations and Findings

Introduction. The NRC identified an apparent violation of 10 CFR 50, Appendix B,

Criterion V, Instructions, Procedures and Drawings, applicable to both Unit 1 and

Unit 2. Criterion V states, in part, that activities affecting quality shall be prescribed by

documented instructions, procedures, or drawings, of a type appropriate to the

circumstances and shall be accomplished in accordance with these instructions,

procedures or drawings. The licensee did not follow the requirements specified in

Procedure EN-MA-119, in that, the licensee did not perform an adequate review of the

subcontractors lifting rig design calculation, and the licensee did not conduct a load test

of the lifting rig prior to use. The licensee initiated Condition Report

CR-ANO-C-2013-00888 to capture this issue in its corrective action program. The

licensee's corrective actions included repairing damage to the Unit 1 turbine deck, fire

main system, and electrical system. In addition, changes were made to various

procedures including Procedure EN-DC-114, Project Management, to provide

guidance on review of calculations, quality requirements, and standards associated with

third party reviews.

- 21 -

Description. The Augmented Inspection Team evaluated the effectiveness of measures

to reduce the potential for a load drop consistent with the program requirements

specified in Procedure EN-MA-119. They determined through interviews and

documentation reviews, that the licensees pre-outage evaluations were primarily

focused on ensuring that the temporary hoisting assembly did not overload the existing

plant structures. The Augmented Inspection Team also established that the project

management organization considered the temporary crane installed by the subcontractor

in the turbine building to be a temporary hoisting assembly. Procedure EN-MA-119,

Section 5.2, Load Handling Equipment Requirements, Item 7, stated, in part, that the

following measures were to be used to establish the temporary hoisting assemblies

structural integrity:

• Licensee engineering support personnel shall approve the design of vendor

supplied temporary overhead cranes.

• The temporary overhead crane shall be designed for 125 percent of the projected

hook load and shall be load tested in all configurations for which it will be used.

• Load bearing welds are required to be inspected before and after the load test.

Section 5.2, Item 7, also included a note indicating that specially designed lifting devices

may be designed and tested to other approved standards.

Based on the results of the Augmented Inspection Teams evaluation of the material

handling program, the inspectors determined that the temporary hoisting assembly had

not been load tested. The Augmented Inspection Team also established that although

the note in Procedure EN-MA-119 allowed the use of alternate standards in lieu of load

testing, the licensee could not identify objective evidence to demonstrate that an

alternate approved standard had been used for the design and testing of the temporary

hoisting assembly.

The inspectors, based on their independent review, determined that the temporary

hoisting assembly design was based, in part, on an incorrect assumption, and the frame

was not designed to support the stator load. The licensee concluded that one of the root

causes for the temporary lift assembly collapse was that the sub-contractors design did

not ensure that the lift assembly north tower could support the loads anticipated for the

lift.

In addition, the licensee, based on its root cause evaluation, concluded that the

subcontractor failed to conduct the required load testing of their modified temporary lift

assembly before its use. Specifically, the licensee concluded that:

• The north tower structure of the temporary lift assembly had not been subject to

a load test or previously used in lifts of equal or greater capacity to that of the

Unit 1 stator.

• Occupational Safety and Health Administration (OSHA) regulation

CFR 29.1910.179 (k)(1) required that prior to initial use of a new or altered crane,

the crane shall be tested to insure compliance with this section.

- 22 -

• The industry consensus standard, American Society of Mechanical Engineers

NQA-1-2008, to which the subcontractor designed the temporary lift assembly,

required load testing to ensure the structural and mechanical capacity of new or

modified cranes.

Based on the results of their review, the inspectors concluded that the licensee failed to

properly implement the requirements specified in Procedure EN-MA-119. Specifically,

the inspectors identified that the licensee failed to:

• Adequately review and approve the subcontractors design

Calculation 27619-C1 as required by Section 5.2[7](a).

• Ensure that a load test of the assembly to at least 125 percent of the projected

hook load was conducted, and that the assembly be load tested in all

configurations for which it will be used, as required by Section 5.2[7](b).

The licensee initiated Condition Report CR-ANO-C-2013-00888 to capture this issue in

its corrective action program. The licensees corrective actions included repairing

damage to the Unit 1 turbine deck, fire main system, and electrical system. In addition,

changes were made to various procedures including Procedure EN-DC-114, Project

Management, to provide guidance on review of calculations, quality requirements, and

standards associated with third party reviews.

Unit 1:

Analysis. The inspectors determined that the failure to implement the requirements of

Procedure EN-MA-119 was a performance deficiency. Specifically, the licensee failed

to: (1) independently review the subcontractors calculation for the design of the

temporary hoisting assembly as specified in Procedure EN-MA-119, Section 5.2[7](a),

and (2) perform a load test of the assembly to 125 percent of the projected hook load

and load test the assembly in all configurations for which it will be used, as required by

Procedure EN-MA-119 Section 5.2[7](b). The finding was more than minor because it

was associated with the procedural control attribute of the initiating event cornerstone,

and adversely affected the cornerstones objective to limit the likelihood of events that

upset plant stability and challenge critical safety functions during shutdown, as well as

power operations. The stator drop affected offsite power to Unit 1, resulting in a loss of

offsite power for approximately 6 days and a loss of the alternate AC diesel generator.

The inspectors used Inspection Manual Chapter 0609, Attachment 0609.04, Initial

Characterization of Findings, dated June 19, 2012, to evaluate the significance of the

finding. Since the plant was shutdown, the inspectors were directed to Inspection

Manual Chapter 0609, Appendix G, Attachment 1, Shutdown Operations Significance

Determination Process Phase 1 Operational Checklists for Both PWRs and BWRs,

Checklist 4, dated May 25, 2004. Using Appendix G, Attachment 1, Checklist 4, the

inspectors concluded that this finding degraded the licensees ability to add reactor

coolant system inventory when needed since a loss of offsite power occurred, and

therefore, this finding required a detailed risk analysis. A shutdown risk model was

developed by modifying the at-power Arkansas Nuclear One Unit 1 standardized plant

analysis risk (SPAR) model, Revision 8.19. The NRC risk analyst assessed the

significance of shutdown events by calculating an instantaneous conditional core

damage probability. The results were dominated by two sequences. The largest risk

contributor (approximately 97 percent) was from a failure of the emergency diesel

- 23 -

generators without recovery. The second largest risk contributor was the failure to

recover decay heat removal. The result of the analysis was an instantaneous

conditional core damage probability of 3.8E-4; therefore, this finding was preliminarily

determined to have high safety significance (Red). Refer to Attachment 2 for the Unit 1

outage detailed risk evaluation.

This finding had a cross-cutting aspect in the area of human performance associated

with field presence, because the licensee did not ensure adequate supervisory and

management oversight of work activities, including contractors and supplemental

personnel. Specifically, the licensee did not provide a sufficient level of oversight in that,

the requirements in Procedure EN-MA-119, for design approval and load testing of the

temporary hoisting assembly, were not followed [H.2].

Unit 2:

Analysis. The inspectors determined that the failure to implement the requirements of

Procedure EN MA-119 was a performance deficiency. Specifically, the licensee failed

to: (1) independently review the subcontractors calculation for the design of the

temporary hoisting assembly as specified in Procedure EN-MA-119, Section 5.2[7](a),

and (2) perform a load test of the assembly to 125 percent of the projected hook load

and load test the assembly in all configurations for which it will be used, as required by

Procedure EN-MA-119 Section 5.2[7](b). The finding was more than minor because it

was associated with the procedural control attribute of the initiating event cornerstone,

and adversely affected the cornerstones objective to limit the likelihood of events that

upset plant stability and challenge critical safety functions during shutdown, as well as

power operations. The stator drop caused a reactor trip on Unit 2 and damage to the

fire main system which resulted in water intrusion into the electrical equipment causing a

loss of startup transformer 3. This resulted in the loss of power to various loads,

including reactor coolant pumps, instrument air compressors, and the safety-related

Train B vital electrical bus. The inspectors used Inspection Manual Chapter 0609,

Attachment 0609.04, Initial Characterization of Findings, dated June 19, 2012, and

Appendix A, The Significance Determination Process (SDP) for Findings At-Power,

dated June 19, 2012, to evaluate the significance of the finding. Since this was an

initiating event, the inspectors used Exhibit 1 of Appendix A and determined that

Section C, Support System Initiators, was impacted because the finding involved the

loss of an electrical bus and a loss of instrument air. The inspectors determined that

Section E, External Event Initiators, of Exhibit 1 should also be applied because the

finding impacted the frequency of internal flooding. Since Sections C and E were

impacted, a detailed risk evaluation was required. The NRC risk analyst used the

Arkansas Nuclear One, Unit 2 Standardized Plant Analysis Risk Model, Revision 8.21,

and hand calculation methods to quantify the risk. The model was modified to include

additional breakers and switching options, and to provide credit for recovery of

emergency diesel generators during transient sequences. Additionally, the analyst

performed additional runs of the SPAR model to account for consequential loss of offsite

power risks that were not modeled directly under the special initiator. The largest risk

contributor (approximately 96 percent) was a loss of all feedwater to the steam

generators, with a failure of once-through cooling. The result of the analysis was a

conditional core damage probability of 2.8E-5; therefore, this finding was preliminarily

determined to have substantial safety significance (Yellow). Refer to Attachment 3 for

the Unit 2 at-power detailed risk evaluation.

- 24 -

This finding had a cross-cutting aspect in the area of human performance associated

with field presence, because the licensee did not ensure adequate supervisory and

management oversight of work activities, including contractors and supplemental

personnel. Specifically, the licensee did not provide a sufficient level of oversight in that,

the requirements in Procedure EN-MA-119, for design approval and load testing of the

temporary hoisting assembly, were not followed [H.2].

Enforcement (Unit 1 and Unit 2). Title 10 of the Code of Federal Regulations (CFR)

Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, states, in

part, that activities affecting quality shall be prescribed by documented instructions,

procedures, or drawings, of a type appropriate to the circumstances and shall be

accomplished in accordance with these instructions, procedures, or drawings. Quality

Procedure EN-MA-119, Material Handling Program, Section 5.2[7], Temporary

Hoisting Assemblies, Step (a) states, in part, that vendor supplied temporary overhead

cranes or supports, winch-driven hoisting or swing equipment, and other assemblies are

required to be designed or approved by engineering support personnel. The design is

required to be supported by detailed drawings, specifications, evaluations, and/or

certifications. Quality Procedure EN-MA-119, Material Handling Program,

Section 5.2[7] Temporary Hoisting Assemblies, Step (b) states, in part, that the

assembly shall be designed for at least 125 percent of the projected hook load and

should be load tested and held for at least five minutes at 125 percent of the actual load

rating before initial use. The assembly shall be load tested in all configurations for which

it will be used.

Contrary to the above, on March 31, 2013, the licensee did not accomplish the stator lift

and move, an activity affecting quality, as prescribed by documented instructions and

procedures. Specifically:

a. The licensee approved a design for the temporary hoisting assembly that was

not supported by detailed drawings, specifications, evaluations, and/or

certifications. In addition, the temporary hoisting assembly was not

adequately designed for at least 125 percent of the projected hook load. The

licensee failed to identify the load deficiencies in vendor

Calculation 27619-C1, Heavy Lift Gantry Calculation, and the incorrectly

sized component in the north tower structure of the temporary hoisting

assembly.

b. The licensee failed to perform a load test in all configurations for which the

temporary hoisting assembly would be used.

As a result, on March 31, 2013, while lifting and transferring the main generator stator,

the temporary overhead crane collapsed, causing the 525-ton stator to fall on and

extensively damage portions of the plant.

For Unit 1:

The Unit 1 finding has been preliminary determined to be of high safety significance

(Red) and will be treated as an apparent violation and tracked as

AV 05000313/20130012-004; Unit 1 - Failure to Follow the Materials Handling Program

during the Unit 1 Generator Stator Move.

- 25 -

For Unit 2:

The Unit 2 finding has been preliminary determined to be of substantial safety

significance (Yellow) and will be treated as an apparent violation and tracked as

AV 05000368/20130012-005; Unit 2 - Failure to Follow the Materials Handling Program

during the Unit 1 Generator Stator Move.

.10 (Closed) URI 05000313/2013011-010, Causes and Corrective Actions Associated with

the Dropped Heavy Load Event

The Augmented Inspection Team identified an unresolved item associated with the

licensees identified causes and planned corrective actions for the March 31, 2013,

temporary crane failure. The root cause evaluation effort was still in progress at the

conclusion of the inspection. The Augmented Inspection Team concluded additional

follow-up inspection was necessary to assess the adequacy of the licensees identified

causes and corrective actions when completed.

Observations and Findings

Condition Report CR-ANO-C-2013-00888, documented the root cause evaluation for the

Unit 1 Main Turbine Generator Stator, drop that occurred on March 31, 2013. The

licensee identified a total of two root causes and four contributing causes, with the two

root causes and two of the four contributing causes being attributed to the contractor

performance. The report was finalized on July 22, 2013.

The stator contractor, Siemens Energy, Inc. (Siemens), and their heavy lift

subcontractor, Bigge Crane and Rigging Co. (Bigge), declined to participate on the root

cause evaluation team. The root cause team concluded that, if it had full access to

material, personnel, and records from the two vendors, the team might have identified

additional contributing causes along with corrective actions. However, the root cause

team did conclude that enough information was available to it and that information was

sufficiently adequate to identify why the event occurred and to establish the associated

corrective actions.

The root cause team evaluated a number of different areas, including: extent of

condition, extent of cause, operating experience, safety culture, vendor oversight, and

organizational and programmatic weakness. Actual nuclear safety and radiological

safety were also evaluated. The licensee concluded that the event was mitigated by

safety-related equipment and appropriate operator response. Control room operators, in

both units, were able to respond and take necessary corrective actions to mitigate the

effects of equipment damage from the stator drop. The structures, systems, and

components for both units responded as designed with no significant challenge to

nuclear or radiological safety.

The root causes were:

1. The root cause of the temporary lift assembly collapse was that the Bigge design

did not ensure the lift assembly north tower could support the loads anticipated

for the lift.

- 26 -

2. Bigge failed to perform required load testing of the temporary lift assembly prior

to its use in accordance with OSHA regulation.

The four contributing causes were:

1. Siemens and Bigge inaccurately represented that the hoist assembly had been

used at other electric power stations to lift components that exceeded the

anticipated weight of the Unit 1 stator.

2. Siemens failed to provide adequate oversight and control of Bigges

performance.

3. Procedure EN-MA-119 does not provide clear guidance regarding independent

reviews of special lift equipment.

4. Supplemental Project personnel lacked sufficient knowledge of OSHA and ASME

NQA-1 application to temporary lift assemblies and accepted Bigges assertion

that load testing was not required based on a combination of engineering

analysis and previous use.

The inspectors determined that the root causes did identify why the temporary hoisting

assembly failed. The inspectors noted that contributing causes identified various

inadequacies in procedures, oversight of the subcontractor by the primary contractor,

and knowledge of applicable standards by supplemental personal. However, it was not

clear to the inspectors that the root causes or contributing causes addressed the

licensees oversight of contractors. The NRC conducted an independent review of the

event, and as part of its review of Unresolved Item 2013011-009, Effectiveness of

Material Handling Program, the NRC identified a cross-cutting aspect H.2, Field

Presence, associated with the licensee not ensuring adequate supervisory and

management oversight of work activities, including contractors and supplemental

personnel.

The licensee implemented appropriate corrective actions to ensure the subsequent lift of

the dropped stator and the Unit 1 replacement stator were performed safely considering

lessons-learned from the root cause evaluation. Actions were implemented to ensure

the safety of personnel and equipment during the lift of the replacement stator from the

train bay to the generator pedestal.

No findings were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On February 10, 2014, the inspectors presented the inspection results to Mr. J. Browning, Site

Vice President, and other members of the licensee staff. The licensee acknowledged the issues

presented. Proprietary information was provided to the team and the information is being

handled in accordance with NRC policies.

- 27 -

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Browning, Site Vice President

J. McCoy, Engineering Director

D. Perkins, Maintenance Manager

L. Blocker, Nuclear Oversight Manager

D. James, Regulatory and Performance Improvement Director

S. Pyle, Regulatory Assurance Manager

N. Mosher, Licensing Specialist

C. ODell, Production Manager

R. Byford, Training Manager

B. Gordon, Projects and Maintenance Services Manager

T, Evans, Production General Manager

T. Sherrill, Chemistry Manager

R. Harris, Emergency Plan Manager

J. Tobin, Security Manager

P. Williams, Operations Manager

T. Chernivec, Performance Improvement Manager

B. Daibu, Design and Program Engineering Manager

NRC Personnel

K. Kennedy, Division Director (telephonically)

L. Willoughby, Senior Reactor Inspector

B. Latta, Senior Reactor Inspector

J. Melfi, Reactor Inspector

N. Okonkwo, Reactor Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000313/2013012- AV Unit 1 - Failure to Follow the Materials Handling Program during

004 the Unit 1 Generator Stator Move

05000368/2013012- AV Unit 2 - Failure to Follow the Materials Handling Program during

005 the Unit 1 Generator Stator Move

Opened and Closed

05000313;368/ NCV Failure to Adequately Develop and Implement Adequate

2013012-001 Procedural Controls to Remediate the Anticipated Effects of

Internal Flooding for Either Unit

05000368/2013012- FIN Main Feedwater Regulating Valve Maintenance Practices

002

A1-1 Attachment 1

Opened and Closed

05000313/2013012- NCV Failure to Scope Required Components in the Stations

003 Maintenance Rule Monitoring Program

Closed

05000313/2013011- URI Control of Temporary Modification Associated with Temporary

001 Fire Pump

05000313;368/ URI Damage to Unit 1 and Unit 2 Structures, Systems and

2013011-002 Components

05000313/2013011- URI Procedural Controls Associated with Unit 1 Steam Generator

003 Nozzle Dams

05000368/2013011- URI Main Feedwater Regulating Valve Maintenance Practices

004

05000313:368/ URI Compensatory Measures for Firewater System Rupture

2013011-006

05000368/2013011- URI Timeliness of Emergency Action Level Determination

007

05000313/2013011- URI Effectiveness of Shutdown Risk Management Program

008

05000313/2013011- URI Effectiveness of Material Handling Program

009

05000313/2013011- URI Causes and Corrective Actions Associated with the Dropped

010 Heavy Load Event

Discussed

05000313/2013011- URI Flood Barrier Effectiveness

005

LIST OF DOCUMENTS REVIEWED

Calculations

NUMBER TITLE REVISION/DATE

27619-C1 Bigge - Heavy Lift Gantry - ANO Stator Replacement 0

Project

83-D-1140-05 Flooding Potential Due to Sprinkler System 'F' December 8,

1982

83-D-2038-01 Flooding Potential Due to Sprinkler System Actuation at December 8,

Elev 317', 335' and 354' 1982

83-D-2057-03 Corridor 2104 Flooding Chronology October 19,1983

A1-2

83E-0062-11 Ponding Level Estimation at Elev. 317'-0 0

83E-0062-12 Ponding Evaluation Fire Zone 105-T & 144-D 1

83-E-0062-13 Summary Calc. 0 Flooding Depths Due to Fire Protection July 15, 1985

Discharges and Know Elevations of Safety Related

Electrical Equipment

CALC-89-D-1011- OTSG Nozzle Dam Safety Evaluation 0

05

83-D-2057-03 Corridor 2104 Flooding Chronology October 19,

1983

Procedures

NUMBER TITLE REVISION

1005.002 Control of Heavy Loads 25

1015.048 Shutdown Operations Protection Plan 9

2201.001 Standard Post Trip Action 13

2203.034 Fire or Explosion 14

1203.012H Annunciator K09 Corrective Action 43

2304-262 Unit 2 Feedwater Control System LOOP A Calibration 12

COPD-24 Risk Assessment Guidelines 46

EN-DC-114 Project Management 14

EN-DC-150 Condition Monitoring of Maintenance Rule Structures 4

EN-FAP-OU-100 Refueling Outage Preparation and Milestones 5

EN-FAP-OU-105 Refueling Outage Execution 1

EN-HU-104 Engineering Task Risk & Rigor 3

EN-LI-102 Corrective Action Process 21

EN-MA-119 Material Handling Program 16

EN-MA-126 Control of Supplemental Personnel 15

EN-OU-108 Shutdown Safety Management Program 5

EN-OU-108 Shutdown Safety Management Program 6

EN-WM-104 Online Risk Assessment 7

OP-1104.032 Fire Protection Systems 75

A1-3

OP-5120.504 OTSG Nozzle-Dam Training, Testing & 6

Installation/Removal

Drawings

NUMBER TITLE REVISION

1000.028-A Temporary Alteration Form -Fire Water System 024-00-0

83E3719 28 Inch OTSG Nozzle Dam 7

A-2441-20-1 Dirty Waste Drain Tank Item T-20 Shop Fabrication 3

Details Bechtel for Arkansas Power

A-411 Radiation Zones Plant Elevation 3170 11-4 6

A-412 Radiation Zones Plant Elevation 3350 11-5 8

A-413 Radiation Zones Plant Elevation 3540 11-6 1

C-202 Auxiliary Building Plan at Elevation 335'-0 14

C-2202 Auxiliary Building Plan at Elevation 335'-0 15

E-001 Station Single Line Diagram

E-2673, Sh. 12 Connection Diagram Terminal Box 4

E-2680, Sh. 3 Connection Diagram Feedwater and Condensate System 13

Console 2CO2

E-2728, Sh. 2 Schematic Diagram Feedwater Control System Train A 10

E-2728, Sh. 4 Schematic Diagram Feedwater Control System Train A 11

E-383 Schematic Diagram Auxiliary Building Sump Pumps 5

E-389 Schematic Diagram - Dirty Liquid and Laundry Radwaste 3

Drain Pumps

LW-321 Overflow Piping to flow Drain Dirty Waste Drain Tank 1

T-20

M-002 Equipment Location Fuel Handling Floor Plan 24

M-003 Equipment Location Operating Floor Plan 40

M-004 Equipment Location Intermediate Floor Plan 37

M-005 Equipment Location Ground Floor Plan 36

M-006 Equipment Location Plan Below Grade 32

M-007 Equipment Location Sections A-A and F-F 18

M-008 Equipment Location Section B-B 32

M-009 Equipment Location Section C-C 13

A1-4

M-010 Equipment Location Section D-D 14

M-011 Equipment Location Misc. Plans and Sections 15

M-0213, Sh. 1 Dirty Radioactive Waste Drainage & Filtration 60

M-0213, Sh. 2 Laundry Waste and Containment & Aux Building Sump 28

Drainage

M-0215 Gaseous Radioactive Waste

M-0219, Sh. 1 Fire Water 83

M-0262, Sh. 4 Piping & Instrument Diagram Areas H.V.A.C. Aux. Bldg. - 3

Rad. Waste

M1-H-35 Sodium Thiosulfate Stg Tank - 99 ID 35'-11 on Side 3

M-2001-N1-71, Sh. Loop A FWCS Demand 0

1

M-2002 Equipment Location Fuel Handling Floor Plan 30

M-2003 Equipment Location Operating Floor Plan 53

M-2004 Equipment Location Intermediate Floor Plan 24

M-2005 Equipment Location Ground Floor Plan 39

M-2006 Equipment Location Plan Below Grade 40

M-2007 Equipment Location Section A-A & F-F 17

M-2008 Equipment Location Section B-B 20

M-2009 Equipment Location Section C-C 14

M-2010 Equipment Location Section D-D 16

M-2011 Equipment Location Misc. Plans & Sections 19

M-2044 Plant Design Drawing Area 24 Containment Auxiliary 32

Building Plan at Elev. 354-0 to 372-0

M-2045 Plant Design Drawing Area 24 Containment Auxiliary 45

Building Plan at Elev. 335-0 to 354-0

M-2046 Plant Design Drawing Area 24 & 26 Containment 26

Auxiliary Building Plan at Elev. 335-0 3

M-2047 Plant Design Drawing Area 24 Containment Auxiliary 34

Building Section A24-A24

M-2048 Plant Design Drawing Area 24 Containment Auxiliary 33

Building Section B24-B24

M-2049 Plant Design Drawing Area 24 Containment Auxiliary 32

Building Section C24-C24

A1-5

M-2050 Plant Design Drawing Area 24 Containment Auxiliary 30

Building Section D24-D24 & J24-J24

M-2063 Plant Design Drawing Area 26 Containment Auxiliary 23

Building Plan Above Grade

M-2064 Plant Design Drawing Area 26 Containment Auxiliary 23

Building Plan Below Grade

M-2065 Plant Design Drawing Area 26 Containment Auxiliary 13

Building Misc. Plans & Sections

M-2066 Plant Design Drawing Area 26 Containment Auxiliary 24

Building Section A26-A26

M-2067 Plant Design Drawing Area 26 Containment Auxiliary 30

Building Misc. Sections

M-2119 Piping and Instrument Diagram, Unit 1/Unit 2, Fire Water, 83

Sheet 1

M-2201-229, Sh. 2CO2 Wiring Diagram 21

06

M-2201-229, Sh. 2CO2 Wiring Diagram 20

10

M-2204, Sh. 1 Piping & Instrumentation Diagram Condensate and 98

Feedwater

M-2204, Sh. 2 Piping & Instrumentation Diagram Condensate and 82

Feedwater

M-2204, Sh. 3 Piping & Instrumentation Diagram Condensate and 46

Feedwater

M-2204, Sh. 4 Piping & Instrumentation Diagram Condensate and 67

Feedwater

M-2204, Sh. 5 Piping & Instrumentation Diagram Condensate and 14

Feedwater

M-2213, Sh. 1 Liquid Radioactive Waste System 60

M-2213, Sh. 2 Liquid Radioactive Waste System 49

M-2213, Sh. 3 Liquid Radioactive Waste System 13

M-2213, Sh. 4 Liquid Radioactive Waste System - Auxiliary Building 15

Elevation 317'-0

M-2213, Sh. 5 Liquid Radioactive Waste System - Auxiliary Building 15

Elevation 335'-0

M-2213, Sh. 6 Liquid Radioactive Waste System - Auxiliary Building 15

Elevations 354'-0 & 372'-6

A1-6

M-2213, Sh. 7 Liquid Radioactive Waste System - Auxiliary Building 5

Elevations 385'-0, 404'-0 & 422'-0

M-2219 Piping and Instrument Diagram, Fire Water, Sheet 1 61

M-2219 Piping and Instrument Diagram, Outside Fire Water, Unit 50

1 One/Unit Two, Sheet 5

M-2219 Piping and Instrument Diagram, Fire Water, Sheet 1 61

M-2219 Piping and Instrument Diagram, Outside Fire Water, Unit 50

1 One/Unit Two, Sheet 5

M-2219, Sh. 1 Fire Water 1

Work Orders

280093 272329 52355991 52380738 50234186-01

Condition Reports Reviewed

CR-ANO-C-2013-01072 CR-ANO-C-2013-00888 CR-ANO-C-2013-01962

CR-ANO-1-2013-00917 CR-ANO-C-2013-01074 CR-ANO-C-2013-00891

CR-ANO-1-2013-00132 CR-ANO-1-2013-01028 CR-ANO-1-2013-01286

WT-WTANO-2013-00039 CR-ANO-2-2012-01432

Condition Reports Generated During the Inspection

CR-ANO-C-2013-01985 CR-ANO-1-2013-01286 CR-ANO-C-2013-01304

CR-ANO-2-2013-00423 CR-ANO-2-2013-01945

Miscellaneous

REVISION/

NUMBER TITLE DATE

1104.032 Fire Protection Systems 75

1CAN111202 Flooding Walkdown Report - Entergy Response to NRC November 27,

Request for Information (RFI) Pursuant to 10 CFR 50.54(f) 2012

Regarding the Flooding Aspects of 0Recommendation 2.3 of

the Near-Term Task Force Review of Insights from the

Fukushima Dai-ichi Accident Aransas Nuclear One - Unit 1

1-OPG-002 Tank Volume Book 3

A1-7

Miscellaneous

REVISION/

NUMBER TITLE DATE

2CAN111202 Flooding Walkdown Report - Entergy Response to NRC November 27,

Request for Information (RFI) Pursuant to 10 CFR 50.54(f) 2012

Regarding the Flooding Aspects of 0Recommendation 2.3 of

the Near-Term Task Force Review of Insights from the

Fukushima Dai-ichi Accident Aransas Nuclear One - Unit 2

A1LP-AO-FPS Fire Protection Systems 12

EC-0044229 Provide Flooding Protection of Room 83 and Room 2079 (Unit 0

1 and Unit 2 Void Areas) Procedures 1203.025 and 2203.008

for Natural Emergencies

Engineering General Flooding of Unit 1 Aux Building April 21, 2013

Review

ER-981203E101 Engineering Evaluation of ANO-1 Steam Generator Nozzle December 7,

Dams 1998

ER-991909 Engineering Request - Connect Temporary Pump to Fire E301-0

System Test Header

ER-991909 Temporary Fire Pump Alteration E101-0

ER-991909 Temporary Fire Pump Alteration E101-1

ER-991909 Temporary Fire Pump Alteration E101-2

ER-ANO-2002- Evaluation for PM requirements for Decay Heat Vaults Level October 20,

1223-001 Switches 2002

Information Notice Deficiencies in Outside Containment Flooding Protection October 9,

No. 87-49 1987

Letter Letter, Phillps to Giambusso, Flooding of Safety Related October 20,

Equipment 1972

LIC-068-27 Pipe Rupture Leakage Criteria June 20,1988

Operator Round Waste Control Operator Rounds, March 20-April 16, 2013

Data

PMCD 2002-3701- PM Evaluation for DHR Room Flood Alarm Level Switches February 20,

P101 2003

ANO Stator Replacement Lift Plan letter from: Bigge Crane & February 8,

Rigging Co. to: Siemens Entergy 2013

EN-S Nuclear Management Manual, 50.59 Review Form- 055-06-0

Attachment 9.1

A1-8

Miscellaneous

REVISION/

NUMBER TITLE DATE

Repetitive Maintenance Task, Calibration of PDT4410

OPS-A3 Unit 1 WCO Log sheet 22

ANO-1 Stator Recovery Slides, Restart Challenge

Presentation 1, Structural & Mechanical Damage

Assessment & Repair

ANO-1 Stator Recovery Slides, Restart Challenge

Presentation 2, Electrical Damage Assessment

ANO-1 Stator Recovery Slides, Restart Challenge

Presentation 3, Electrical Testing

Unit 1 Outage schedule 0

EOOS Chart, ANO Unit 2, July 25, 2013

P.O. 31028-0159- Purchase Order for Replacement of Cubicle for Unit 1-A2 May17, 2013

PO Switchgear NSR/PP

TRM-U1 Technical Requirements Manual 44

TRM-U2 Technical Requirements Manual 52

2A-113_1.jpg Picture of 2A-113 Breaker Door

2A-113_3.jpg Picture of 2A-113 Breaker Door

Fire water system status 4-2-13 0502

Fire water system status 4-3-13 0609

Fire water system status 4-3-13 1109

Fire water system status 4-3-13 1800

Fire water system status 4-4-13 0451

Fire water system status 4-4-13 1800

Fire water system status 4-7-13 0600

Fire water system status 4-11-13 1245

Fire water system status 4-12-13 0400

Fire water system status

Log Entries Report for Fire Water up to 4-12-13 0400

Sequence of Events up to 4-12-13

A1-9

Miscellaneous

REVISION/

NUMBER TITLE DATE

Tagout 1R24-1 - FS-009-B-FS RUPTURE with P&ID Markup

Tagout 1R24-1 - FS-009-C-FS RUPTURE with P&ID Markup

Tagout 1R24-1 - FS-009-D-FS RUPTURE and 2C23-1 -

FS 019-2HR-36 with P&ID Markup

Tagout 1R24-1 - FS-009-FS RUPTURE with P&ID Markup

Vendor Documents

NUMBER TITLE REVISION

TDF130 0320 Fisher Control Systems Instruction Manual Actuators Types 5

470, 471, 475 & 478 Series

TDG200 0080 For Model 3172 Aux Bldg Sump Pumps

TDO045 210 OMEGA Level Switch Series LV-70 - Maintenance Section

TDR340.0060 Installation and Maintenance Instruction McCannaflow 0

Flanges Ball Valves Class 150 & 300 1 Thru 4

Engineering Information Records

NUMBER TITLE REVISION

DCP 94-2008 Feedwater Control Systems Upgrade July 26,1995

ECT-44312-02 SU 1 A1 & A2 Live Bus Test July 21, 2013

ECT-44312-03 Functional Testing for Breaker 2A-903 July 20, 2013

ECT-44312-04 Functional Testing for Breaker 2A-901 July 24, 2013

ECT-44312-05 Functional Testing for Startup Transformer #2 A-1 Feeder July 8, 2013

breaker A-111

System Training Manuals

NUMBER TITLE REVISION

STM 1-52 Dirty Liquid Radwaste 7

STM 2-33 System Training Manual Alternate AC Diesel Generator 22

STM 2-69 System Training Manual Feedwater System Control 13

STM 2-19 System Training Manual Main Feedwater System 14

A1-10

Unit 1

Outage Detailed Risk Evaluation

(Phase 3 Risk Assessment Loss of Offsite Power)

Revision 1b

Probabilistic Risk Assessment (PRA) Analyst: Jeff Mitman, Senior Reliability and Risk

Analyst, NRR/DRA/APOB

Independent Reviewer Donald Chung, Reliability And Risk Analyst,

NRR/DRA/APOB

Region IV Reviewer David Loveless, Senior Risk Analyst

A2-1 Attachment 2

1.0 Introduction

On March 31st 2013, at 7:50 am, Arkansas Nuclear One Unit 1 (ANO1) experienced a

loss of offsite power (LOOP). This LOOP event occurred because while lifting and

transferring the Unit 1 main generator stator to the train bay, the hoist assembly failed.

The dropped stator fell on to the turbine deck and into the train bay. This event resulted

in multiple damages in the turbine building including damage to electrical buses

supplying offsite power to Unit 1, and damage to the fire suppression piping.

At the time of this event, Unit 1 was in a refueling outage. It had been shutdown for

approximately 7 days. Fuel was in the reactor vessel, the reactor cavity was flooded up,

and both trains of decay heat removal system were in service. With the loss of offsite

power, both Unit 1 emergency diesel generators (EDG) started and loaded their

respective buses. Decay heat removal was quickly restored. Once decay heat removal

was restored the unit was quasi stable, with no offsite power available due to damage to

the non-vital electrical buses, with EDGs powering the vital busses and the decay heat

removal system operating and providing decay heat removal to the reactor vessel.

Dropping the generator stator caused the following damage:

• Offsite power was lost - it took six days to recover

• The station blackout diesel generators (called the AAC) connection to the plant

was severed rendering the ACC non-functional

• Fire watering piping was damaged requiring shutdown of the fire protection

system. The damage to the piping also caused flooding in the Unit 1 and 2

structures with tens of thousands of gallons of water challenging critical

equipment

2.0 Discussion of the Performance Deficiency

The licensee failed to properly implement Engineering Procedure EN-MA-119, Material

Handling Program. The following two examples are presented:

The licensee failed to adequately review and approve Bigge Calculation 27619-C1 as

required by Section 5.2[7] (a)

Engineering Procedure EN-MA-119, Section 5.2[7] requires temporary hoisting

assemblies to be designed or approved by Engineering Support Personnel (ESP). The

design calculation did not adequately consider the loads that would be experienced by

the lift. Entergys review and approval process failed to identify the calculation

deficiencies and the weak component in the north tower structure. Specifically,

Entergys ESP failed to adequately review and identify the flaw in Calculation 27619-C1

consistent with the requirements of procedure Section 5.2[7] (a) which states that

temporary hoisting assemblies are required to be designed or approved by ESP.

The licensee failed to ensure that a load test of the assembly to at least 125 percent of

the projected hook load or to another approved standard was performed as required by

Section 5.2[7](b) and associated note.

A2-2

3.0 Plant Conditions Prior to the Event

Plant equipment and conditions were as follows:

• Unit was in refueling outage with fuel in the reactor, head removed, and refueling

canal flooded

• Estimated time to boil (TTB) was 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />

• Estimated time to core uncovery was 4 days

• Both trains of reactor shutdown cooling (SDC) were in service

• Plant electrical lineup was in a plant shutdown configuration to support

maintenance and testing as follows:

o 6900 Volt Bus H2 was de-energized.

o 6900 Volt Bus H1 was energized.

o 4160 Volt Bus A2 was de-energized.

o Safety-related 4160 Volt Buses A3 and A4 were cross tied and supplied

power via non-safety-related 4160 Volt bus A1.

o 480 Volt buses B5 and B6 were cross tied.

o Green train battery D06 had been disconnected from D02 bus.

o D04 battery charger was supplied from Swing MCC B56 to provide power

to Green train DC bus D02.

o B56 was aligned to B5.

4.0 Plant Conditions after Initiating Event Initiated

Time to boil was estimated at eleven hours and time to core uncovery without mitigation

was estimated at four days.

The following equipment was unavailable after event initiation:

• Offsite power

• Station blackout diesel generator - ACC

• Fire water

• All balance of plant equipment

• Gravity feed from the borated water storage tank (BWST) as water

level in the BWST was lower than water level in reactor coolant

system (RCS)

• Instrument air (IA) was unavailable - the analyst assumed that all

air operated valves failed in a safe direction, i.e., the systems IA

supported remained available (Note: 1) the DHR heat exchanger

bypass valves fail shut on loss of air, 2) the service water supply

valve to the DHR heat exchanger fails full open on loss of air)

• Starting air compressors for the emergency generators

• Normal lighting

A2-3

The following equipment was available after the event initiation to mitigate

the event:

• Both emergency diesel generators and their respective electrical

distribution systems

• Both decay heat removal trains (two pumps)

• Both high pressure injection (HPI) trains (three pumps)

• Reactor building spray systems - note these were not credited in

the analysis, however, the non-crediting had no effect on the

quantitative results

5.0 Significance Determination Process (SDP) Phase 2 Summary

No Phase 2 was conducted.

6.0 Initiation of a Phase 3 SDP Risk Assessment

A Phase 3 SDP risk assessment was performed by the Office of Nuclear Reactor

Regulation (NRR).

The analysts used the following generic references in preparing the risk assessment:

• NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown

Management. December 1991

• NUREG/CR-6883, The SPAR-H Human Analysis Method. August 2005

• NUREG-1842, Good Practices for Implementing Human Reliability Analysis.

April 2005

• NUREG/CR-6595 Revision 1, An Approach for Estimating the Frequencies of

Various Containment Failure Modes and Bypass Events. October 2004

• INL/EXT-10-18533 Revision 2, SPAR-H Step-by-Step Guidance. May 2011

• RASP Manual Volume 1 - Internal Events, Revision 2.0 date January 2013

• NUREG/CR-1278, Handbook of HRA with Emphasis on Nuclear Power Plant

Applications. August 1983

The analyst used the following plant specific references:

• EOP: 1202.007, Degraded Power

• AOPs:

o 1203.024, Loss of Instrument Air

o 1203.028, Loss of Decay Heat Removal

o 1203.050, Unit 1 Spent Fuel Pool Emergencies

• Calculation: 89-E-0017-01, Time to Boiling and Time to Core Uncovery after Loss

of Decay Heat Removal, Unit 1, Revision 7

A2-4

• Procedure: 1103.018, Maintenance of RCS Water Level

7.0 Development of the Model

No Low Power/Shutdown (LP/SD) SPAR model exists for ANO Unit 1. Therefore, the at-

power ANO1 SPAR model was modified to allow analysis of the LOOP event. A new

event tree (ET) was created to analyze the event.

This ET is shown in Figure A-1 of Appendix A. The ET was linked to a mix of existing

at-power fault trees (FT) and new FTs, as applicable. The existing FTs were modified as

necessary to appropriately describe system dependencies during shutdown conditions

and the different success criterion. The ET and high level FTs are shown in Appendix A.

Modeling Assumptions

• PRA mission time is normally assumed to be 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. However,

after the event was initiated it took approximately six days to

recovery offsite power. If the emergency diesel generators failed

after running successfully for three days the time to core uncovery

was over three days after loss of DHR. Thus the emergency

diesel generator mission time was modified to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

• The Division 2 normal AC power is from 4Kv bus A2. However,

bus A2 was unavailable for maintenance and bus A4 was

receiving power from 4Kv bus A3 via breaker A-310 and A-410. A

model change was made to reflect this alternative alignment and

the associated interlocks and their failure probabilities.

• As identified above, the Green train battery D06 had been

disconnected from D02 bus. D02 DC bus was being fed from a

battery charger supplied from Div. 1 AC power. With this

arrangement, the Div. 2 DC system would (and did) de-energize

on a loss of Div. 1 AC power. If the Div. 1 AC power is restored

with an EDG start then Div.2 DC power would be (and was)

restored. However, if the Div. 1 EDG did not restore AC power to

the battery charger, the Div. 2 DC power would remain de-

energized. The consequence of this is that without DC power

from a Div. 1 battery charger the Div. 2 EDG would not start

normally. In fact, during the event, the Div.2 EDG start was

delayed about 10 seconds until the Div. 1 EDG restored Div.2 DC

power. The model was modified to allow for a manual realignment

of Div. 2 DC power directly to the Div. 1 battery. This human

action (HFE) was given a failure probability of 4E-3 (DCP-XHE-

XM-DD11D12). Notes: 1) An alternative means of re-energizing

the Div. 2 DC system would be to restore the Div. 2 battery from

its maintenance status. The licensee indicated that this could be

accomplished in about 30 minutes once the problem and solution

were identified and the decision made to proceed. This recovery

method was not modeled as it is assumed that the failure

probability of the primary method was adequately low to negate

A2-5

the need for the additional recovery method. 2) Both EDGs can

be manually started without DC power during a proceduralized

process that the licensee estimates would take about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

This capability was not explicitly modeled as the analyst assumed

that this procedure is adequately credited as part of the diesel

recovery analysis incorporated into the event tree.

• As noted above, instrument air failed during the event. Without

instrument air, there is no means to recharge the EDG start air

receiver tanks. The receiver tanks have sufficient capacity for

about 10 normal starts of the EDGs. Thus if the EDGs did not

start initially, there would be a limited number of starts before the

tanks deplete. This dependency was modeled.

• On loss of instrument air the DHR heat exchanger bypass valves

fails full closed, i.e., in the safe direction. Also the service water

supply valves to the DHR heat exchangers fail full open also in the

safe direction. These attributes were not modeled.

• As discussed above, the RCS level at the beginning of the event

was higher than the BWST level. Therefore, at the beginning of

the event there was no capability to gravity feed the RCS from the

BWST. The licensee asserted that they have capabilities to refill

the Unit 1 BWST from the Unit 2 RWT. However, once the BWST

was refilled RCS level would still be higher than the BWST level.

However, if RCS boiling were to commence, then the level in the

RCS would decrease. Level would decrease below the Unit 1

BWST level at which point level would allow gravity feeding of the

Unit 1 RCS. However, boiling would cause the Unit 1 reactor

building (i.e., containment) to pressurize. This elevated pressure

would preclude gravity feed. The licensee could depressurize the

reactor building. These capabilities are un-proceduralized and

were not credited in the modeling.

• Time to boil (TTB) was changed from 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />. Time

to core uncovery was changed from 3 to 4 days to 4 days. Both

changes are based on revised calculations from the licensee.

These changes had no impact on the HRA analysis. However,

the change in the core uncovery time did lower the non-recovery

probabilities marginally.

HRA Analysis

Shutdown operation is highly dependent on operator actions as most of the required

actions are manual (e.g., initiating feed of the RCS). HRA analysis was conducted to

properly characterize the required manual actions. The human error probabilities

(HEPs) were calculated using the Low Power Shutdown SPAR-H worksheets from

NUREG/CR-6883, The SPAR-H Human Reliability Analysis Method

and INL/EXT-10-18533 and SPAR-H Step-by-Step. Consideration was given to the

following:

A2-6

• available time to perform the manual actions,

• stress levels of the crew during the event,

• complexity of the diagnoses and required recovery actions,

• crew experience and applicable and relevant training,

• quality and thoroughness of procedures,

• ergonomics,

• fitness of duty issues, and

• available work processes

Table 1 shows a summary of the dominant HEPs, a detailed discussion of the HEPs is

given in Appendix B.

In addition to the calculation of specific HEPs for this condition, sequences or cutsets

which involved multiple operator actions were examined for human action dependency.

For the dominant HEPs no dependent couplets were found.

In addition, the cutsets were reviewed to find those that contained two or more HEPs in

a single sequence of cutset. For those cutset with multiple HEPs, the HEPs were

reviewed to determine if the product of the HEPs was less than 1E-6. For those cutsets

a floor, or cutoff, was applied as directed by RASP Manual Volume 4 - Shutdown

Events, Revision 1 Appendix B. Because of the long times to core damage, a cutoff of

1E-7 was applied. This conservative assumption did not materially affect the results.

Normal lighting was impacted by the LOOP. This could have an impact on the ability of

the equipment operators to perform tasks outside of the main control. This impact was

not assessed.

A detailed description of the HEPs is given in Appendix B.

Table 1

Summary of Dominant HRA Results

Human Description Time Time Mean Mean Total

Error Needed Available Diagnosi Action Mean

Event s HEP HEP HEP

SD-XHE-D-LOSDC Operator Fails to Diagnose 5 minutes 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> 2E-5 n/a 2E-5

Loss of SDC before boiling

SD-XHE-XL-LOSDC Operator Fails to Recover 30 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> n/a 4E-4 4E-4

Loss of SDC before Boiling minutes

SD-XHE-XL-MINJ Operator Fails to Inject (AC 30 4 days n/a 2E-5 2E-5

power available) before minutes

Level Reaches TAF

SD-XHE-XL-LPR Operator Fails to Initiate 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 5 days 2E-5 2E-4 2.2E-4

Low Pressure Recirc

SD-XHE-XM-BWST Operator Fails to Refill 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 5 days n/a 2E-5 2E-5

BWST during Shutdown

DCP-XHE-XM-DD11D12 Operator Action to Align 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 2E-3 2E-3 4E-3

125VDC Panel D11 to

Feed 125VDC Panel D21

A2-7

8.0 Conditional Core Damage Probability (CCDP) Assessment Results

A detailed Phase 3 Significance Determination Process risk analysis was performed

consistent with NRC Inspection Manual Chapter (IMC) 0609 Appendix G. Step 4.3.8 of

this procedure directs the analyst to assess the significance of shutdown events by

calculating an instantaneous conditional core damage probability (ICCDP). (Throughout

this assessment, the analyst has used the terminology of CCDP instead of ICCDP for

simplicity.) This assessment was performed by setting the initiating event frequency

(IEF) for loss of offsite power to 1.0 and all other IEF to zero. The above described

SPAR model was evaluated using the SAPHIRE code version 8.0.9.0.

As this SDP evaluates an actual event in which no external events occurred, there was

no risk from external events. As discussed in the above paragraph, this would include

setting any external event IEF to zero.

The truncation limit was set at 1E-16.

The result of the CCDP analysis is 3.8E-4; based on these results the finding is

preliminary Red. The top cutsets are in Appendix C. The analyst did not perform

uncertainty analysis.

Table 2

CCDP Results

Sequence Point Estimate Cut Set Count

4 1.6E-5 6784

6 2.1E-8 2072

8 3.3E-7 13225

11 1.0E-7 553

13 4.3E-9 79

15 7.2E-9 359

19 3.7E-4 3955

Total 3.8E-4 27027

The results are dominated by two sequences. The largest contributor is from Sequence

19 which comprises a failure of the emergency diesel generators (EDG) without

recovery. Both the EDG and EDG non-recovery failure probabilities were calculated

using the standard SPAR methods and models. Sequence 4 is also a significant

contributor. Sequence 4 cutsets are dominated by failure to recover DHR.

The numeric results above quantify to a preliminary Red finding. However, given the

time to core damage, recovery may be possible with temporary systems such as B.5.b

equipment. The analyst is unaware of procedures or training to cool the RCS during

these conditions. In addition, condition in the reactor building may become difficult if not

life threatening once boiling begins. In conclusion, some credit for these types of actions

may be warranted. However, neither SPAR-H nor any other HRA method was ever

intended to quantify these types of scenarios. However, using SPAR-H yields failure

probabilities between 0.1 and 0.5. If significant credit were given, this could reduce the

finding into the Yellow range.

A2-8

9.0 Conditional Large Early Release Probability (CLERP) Assessment

The figure of merit for this analysis is incremental conditional large early release

probability (ICLERP). This ICLERP analysis is based on the method for shutdown

described in NUREG/CR-6595 Revision 1, An Approach for Estimating the Frequencies

of Various Containment Failure Modes and Bypass Events, dated 10/2004. This report

supplies simplified containment event trees (CET) to determine if the core damage

sequence contributes to LERF. NUREG/CR-6595 presents its analysis in terms of

LERF, which is interpreted here as ICLERP.

NUREG/CR-6595 defines LERF as the frequency of those accidents leading to

significant, unmitigated releases from containment in a time frame prior to effective

evacuation of the close-in population such that there is a potential for early health

effects. This is identical to the definition of LERF in IMC 0609 Appendix H. Figure 4.2

(PWR Large Dry and Sub-atmospheric Containment Event Tree) from NUREG/CR-6595

is applicable to the ANO1 event.

This event occurred seven days after shutdown. The earliest core damage could occur

would be four days after event initiation. Thus core damage would not occur until 11

days after shutdown. Based on this time and the recommended approach given by

NUREG/CF-6595 no large early release could occur.

10.0 Sensitivity Analysis

Several sensitivity cases were conducted to further understand the event risk

significance. The cases are described below.

Case 1: Loss of Instrument Air

The LOOP event on Unit 1 in combination with the partial LOOP in Unit 2 combined to

cause a loss of instrument air on Unit. There does not appear to be any impact on

Unit 1 from the loss of air. However, instrument air was being supplied to the steam

generator nozzle dams. If the nozzle dams had failed, water level could have drained to

the bottom of the steam generator openings. The nozzle dam design appears to

preclude a significant inventory on loss of air. The design limits the leakage to 2 gpm on

each nozzle dam. With several hundred thousand gallons of water above the nozzle

dams this leakage rate is insignificant.

Case 2: HRA No Cutoff

A case was conducted to verify the sensitivity of the results to the cutoff value. This

case was run with truncation level of 1E-16. The calculated CCDP was 1.6E-4. This

indicates that the cutoff implementation is a second order effect only.

A2-9

Sequence Point Estimate

4 1.6E-05

6 1.7E-08

8 3.3E-07

11 6.0E-10

13 6.1E-13

15 1.8E-10

19 3.7E-04

Total 3.8E-04

Case 3: DC Flooding

The stator drop severed a fire water header pipe. It took approximately 45 minutes to

stop this leakage. Before the leakage was stopped, water accumulated into the Unit 1

and 2 turbine buildings where it caused a small Unit 2 kV fire/explosion. This caused a

loss of offsite power to one division of Unit 2 AC power which was mitigated by the

associated emergency diesel generator. Water also started to accumulate into the

Unit 1 SDC/DHR B pump vault. If this accumulation continued it could have failed the

pump. Potentially it could have impacted other Unit 1 equipment. Sensitivity cases were

conducted with various flooding probabilities and various combinations of impacted

equipment. Those combinations and their impacts are presented in the below table.

These analyses assume that the flooding could not impact the Unit 1 emergency diesel

generator or their associated 4kV switch gear and 480 v MCCs.

This analysis shows that if the flooding had not been terminated in a timely manner it

could have had a significant impact on plant safety.

CCDP

Impacted Equipment

Flood Probability = 0.1 Flood Probability = 1.01

A LPI/SDC/DHR pump 4E-4 5E-4

B LPI/SDC/DHR pump 8E-4 4E-3

Both LPI/SDC/DHR pumps 1E-3 5E-2

A single HPI pump (either

no impact no impact

A, B or C)

Any combination of two HPI

no impact no impact

pumps

All three HPI pumps no impact no impact

All of HPI and SDC/DHR 1E-3 1E-1

Notes:

1) If the associated basic events are set to True instead of 1.0 the CCDPs are somewhat

lower as would be expected.

2) These sensitivity cases were run with truncation set to 1E-8.

A2-10

Case 4: Impact of Loss of EDG Starting Air Compressors

The LOOP caused a loss of normal EDG starting air. If multiple starts of the EDG were

required this could impact the restoration of the emergency power. While it is difficult to

quantify the change in the EDG non-recovery probability, it is straight forward to

calculate the impact of non-recovery probabilities on the CCDP. The analyst assumed

that the non-recovery probability was double from 4.0E2 (for 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />) to 8.0E-2. The

new CCDP is 7.5E-4.

Case 5: Impact of EDG 2 in Maintenance

When the generator stator was dropped, the licensee was making plans to start

maintenance on the Div. 2 emergency diesel generator. This maintenance was

imminent. No licensee restrictions were in place to delay this maintenance until after the

generator stator lifts had been completed. If this EDG maintenance had been started

and sufficiently progressed to preclude restoration this would have significantly

increased the risk. This sensitivity case places the Div. 2 EDG in maintenance. The

new CCDP is 3.5E-3.

A2-11

Appendix A: Model Figures

A2-12

Figure A-1: Loss of Offsite Power Event Tree

LOOP Event Occurs EMERGENCY POWER OPERATOR FAILS TO DIAGNOSIS LOSS OF Recover RHR/SDC Gravity or Forced Feed GRAVITY FEED (without LOW PRESSURE BWST REFILL OPERATOR FAILS TO LATE RECOVERY OF # End State

during Mode 6 AVAILABLE RECOVER OFFSITE RHR/DHR BEFORE DURING SHUTDOWN (with AC power) after AC Power) before TAF RECIRCULATION during RECOVER EMERGENCY SDC/DHR COOLIING (Phase - CD)

POWER IN 72 HOURS BOILING (11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />) before Boiling (11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />) Loss of SDC/DHR Shutdown DIESEL IN 96 HOURS

IE-M6-LOOP EPS OPR-72H LORHR-D SDC-REC MINJ G-FEED LPR-SD REFILL DGR-96H LTREC

1 OK

2 OK

3 OK

6 Days

4 CD

LTREC-6D

4E-4

5 OK

5 Days

6 CD

LTREC-5D

7 OK

4 Days

8 CD

9 OK

10 OK

6 Days

11 CD

LTREC-6D

2E-5

12 OK

5 Days

13 CD

LTREC-5D

14 OK

4 Days

15 CD

Undeveloped Branch as Probability is 0.0

16 OK

0% (Undeveloped branch as given failure)

17 OK

1.95E-3

100%

18 OK

100 %

4E-2 4 Days

19 CD

A2-13

Figure A-2: Emergency Power Failure Fault Tree

EMERGENCY POWER FAILS

EPS

FAILURE OF AC POWER FROM

SWITCHGEAR A3

ACP-SWGR-A3 Ext

FAILURE OF AC POWER FROM

SWITCHGEAR A4

ACP-SWGR-A4 Ext

Figure A-3: Offsite Power Recovery Fault Tree

OPERATOR FAILS TO

RECOVER OFFSITE POWER IN

24 HOURS

OPR-24H

OPERATOR FAILS TO

RECOVER OFFSITE POWER IN

24 HOURS

OEP-XHE-XL-NR24H 2.31E-02

Note that the non-recovery probability was set to one in a change set

A2-14

Figure A-4: Diagnose Loss of RHR/DHR Fault Tree

DIAGNOSIS LOSS OF RHR

BEFORE BOILING

LORHR-D

Operator Fails to Diagnose

Loss of SDC before boiling

SD-XHE-XD-LOSDC 2.00E-05

A2-15

Figure A-5: Recovery RHR/SDC Fault Tree

Recover RHR/SDC DURING

SHUTDOWN

SDC-REC

DHR HARDWARE FAILURES Operator Fails to Recover Loss

of SDC/DHR before Boiling

DHR3 SD-XHE-XL-LOSDC 4.00E-04

FAILURE OF DHR SUCTION INSUFFICIENT FLOW TO RCS

PATH FROM RCS INLET INLET HEADERS DURING DHR

DHR02 DHR03

RCS Suction MOV CV-1404 to DHR TRAIN A FAILS

LPI Fails

LPI-MOV-OC-CV1404 8.13E-07 DHR-TRAINA Ext

RCS Suction MOV CV-1410 to DHR TRAIN B FAILS

LPI Fails

LPI-MOV-OC-CV1410 8.13E-07 DHR-TRAINB Ext

RCS Suction MOV CV-1050 to

LPI Fails

LPI-MOV-OC-CV1050 8.13E-07

A2-16

Figure A-6: Gravity and Forced Feed Fault Tree

Gravity or Forced Feed (with AC

power) after Loss of SDC/DHR

MINJ

Operator Fails to Inject (AC

power available) before Level

Reaches TAF

F-FEED-LATE3 SD-XHE-XL-MINJ 2.00E-05

HIGH PRESSURE INJECTION

during Shutdown

HPI-SD Ext

LOW PRESSURE INJECTION

LPI-SD Ext

Gravity Feed before Core

Damage

G-FEED-1 Ext

Note the gravity feed portion of this FT is set to fail as gravity feed will not work because the physical level of the

BWST is lower than the refueling canal

A2-17

Figure A-7: Gravity Feed (without AC Power) Fault Tree

GRAVITY FEED (without AC

Power) before TAF

G-FEED

Gravity Feed before Core Operator Fails to Gravity Feed

Damage (without power) before Level

Reachs TAF

G-FEED-1 Ext SD-XHE-XL-GRAVITY 4.00E-04

Note this FT is set to fail as gravity feed will not work because the physical level of the BWST is lower than the refueling canal

A2-18

Figure A-8: Low Pressure Recirculation Fault Tree

LOW PRESSURE

RECIRCULATION during

Shutdown

LPR-SD

HARDWARE FAILURES Operator Fails to Initiate Low

DURING LOW PRESSURE Pressure Recirc

RECIRCULATION

LPR2 SD-XHE-XL-LPR 2.20E-04

INSUFFICIENT FLOW TO RCS

INLET HEADERS DURING LPR

LPR01

INSUFFICIENT FLOW TO RCS INSUFFICIENT FLOW TO RCS

INLET HDR A (VIA CKV 14A) INLET HDR B (VIA CKV 14B)

DURING LPR

LPR002 LPR003

INSUFFICIENT FLOW FROM CCF OF RCS INLET CHECK INSUFFICIENT FLOW FROM COMMON CAUSE FAILURE OF

DHR TRAINS TO RCS HEADER VALVES DH-14A&DH-14B TO DHR TRAINS TO RCS HEADER CFS TANK DISCHARGE CKV

A REACTOR VESSEL B CF-1A & DH-14B

LPR0004 LPI-CKV-CF-DH14AB 2.49E-07 LPR0015 CFS-CKV-CF-1A14B 2.49E-07

RCS DISCHARGE CHECK CCF OF RCS INLET CHECK

VALVE DH-14A FAILS VALVES DH-14A&DH-14B TO

REACTOR VESSEL

NO FLOW FROM DHR TRAIN A NO FLOW FROM DHR TRAIN B LPI-CKV-CC-DH14A 1.07E-05 NO FLOW FROM DHR TRAIN A NO FLOW FROM DHR TRAIN B LPI-CKV-CF-DH14AB 2.49E-07

TO RCS HEADER A DURING LPI TO RCS HEADER A DURING LPI TO RCS HEADER B DURING TO RCS HEADER B DURING RCS DISCHARGE CHECK

LPR LPR VALVE DH-14B FAILS

LPR00002 LPR00003 LPR00102 LPR00103

LPI-CKV-CC-DH14B 1.07E-05

NO FLOW FROM SUMP (HDR LPI TRAIN A INJECTION CHECK NO FLOW FROM SUMP (HDR CCF OF INJECTION CHECK NO FLOW FROM SUMP (HDR LPI TRAIN A INJECTION CHECK NO FLOW FROM SUMP (HDR LPI TRAIN B INJECTION

A) TO DHR/LPR TRAIN A VALVE DH-13A FAILS B) TO DHR/LPR TRAIN B VALVES INTO RCS HDR A (13A, A) TO DHR/LPR TRAIN A VALVE DH-17 FAILS B) TO DHR/LPR TRAIN B CHECK VALVE DH-13B FAILS

18)

LPR000004 LPI-CKV-CC-DH13A 1.07E-05 LPR000013 LPI-CKV-CF-HDRA 2.49E-07 LPR000004 Int LPI-CKV-CC-DH17 1.07E-05 LPR000013 Int LPI-CKV-CC-DH13B 1.07E-05

CCF OF INJECTION CHECK DHR TRAIN B INJECTION CCF OF INJECTION CHECK CCF OF INJECTION CHECK

VALVES INTO RCS HDR A (13A, CHECK VALVE DH-18 FAILS VALVES INTO RCS HDR B (17, VALVES INTO RCS HDR B (17,

18) 13B) 13B)

ANO 1 PWR D NO OR NO FLOW FROM SUMP (HDR CCF OF SUMP ISOLATION LPI-CKV-CF-HDRA 2.49E-07 ANO 1 PWR D NO OR NO FLOW FROM SUMP (HDR CCF OF SUMP ISOLATION LPI-CKV-CC-DH18 1.07E-05 LPI-CKV-CF-HDRB 2.49E-07 LPI-CKV-CF-HDRB 2.49E-07

INSUFFICIENT CCOLING FROM A) TO DHR/LPR TRAIN A MOVs 1406 AND 1405 CCF OF LPI INLET CHECK INSUFFICIENT COOLING FROM B) TO DHR/LPR TRAIN B MOVs 1406 AND 1405 CCF OF LPI INLET CHECK

DHR TRAIN A VALVES DH-13A & DH-13B TO DHR TRAIN B VALVES DH-13A & DH-13B TO

DHR-TRNA-COOL Ext LPR0000007 HPI-MOV-CF-CV14056 1.86E-05 REACTOR VESSEL DHR-TRNB-COOL Ext LPR0000107 HPI-MOV-CF-CV14056 1.86E-05 REACTOR VESSEL

480V MCC BUS B51 AC POWER SUMP ISOLATION MOV CV-1405 LPI-CKV-CF-DH13AB 2.49E-07 480V MCC BUS B61 AC POWER SUMP ISOLATION MOV CV-1406 LPI-CKV-CF-DH13AB 2.49E-07

FAILURES FAILS TO OPEN FAILURES FAILS TO OPEN

ACP-MCCB51 Ext HPI SUCTION CHECK VALVE HPI-MOV-CC-CV1405 9.63E-04 ACP-MCCB61 Ext HPI-MOV-CC-CV1406 9.63E-04

BW-3 FAILS (SUCTION HEADER LPI DISCHARGE MOV CV-1401 LPI DISCHARGE MOV CV-1400

A) FAILS TO CLOSE FAILS TO OPEN FAILS TO OPEN

LPR00000022 HPI-CKV-OC-BW3 1.31E-07 LPR00001022 LPR00001025

LPI-MOV-CC-CV1401 9.63E-04 LPI-MOV-CC-CV1400 9.63E-04

SUMP ISOLATION MOV CV-1414 SUMP ISOLATION MOV 1415

FAILS TO REMAIN OPEN FAILS TO REMAIN OPEN

COMMON CAUSE FAILURE OF COMMON CAUSE FAILURE OF CCF OF HPI (MAKEUP) PUMPS

BWST ISOL MOVs 1407 AND HPI-MOV-OC-CV1414 8.13E-07 BWST ISOL MOVs 1407 AND SUCTION CHECK VALVES HPI-MOV-OC-CV1415 8.13E-07

1408 1408 (BW-2/3)

LPI-MOV-CF-BWST 7.78E-06 LPI-MOV-CF-BWST 7.78E-06 HPI-CKV-CF-BW23 2.49E-07

BWST ISOLATION VALVE CV- BWST ISOLATION VALVE CV- HPI SUCTION CHECK VALVE

1407 FAILS TO CLOSE 1408 FAILS TO CLOSE BW-2 FAILS (HEADER B)

LPI-MOV-OO-CV1407 9.63E-04 LPI-MOV-OO-CV1408 9.63E-04 HPI-CKV-CC-BW2 1.07E-05

A2-19

Figure A-9: BWST Refill Fault Tree

BWST REFILL

REFILL

OPERATOR FAILS TO REFILL HARDWARE FAILURE TO

BWST during Shutdown REFILL BWST (undeveloped)

SD-XHE-XM-BWST 2.00E-05 HPI-VCF-FC-BWST 1.00E-03

Figure A10: Diesel Generator Recovery Fault Tree

OPERATOR FAILS TO

RECOVER EMERGENCY

DIESEL IN 72 HOURS

DGR-72H

OPERATOR FAILS TO

RECOVER EMERGENCY

DIESEL IN 72 HOURS

EPS-XHE-XL-NR72H 7.14E-02

A2-20

Figure A-11: SDC/DHR Late Recovery Fault Tree

LATE RECOVERY OF SDC/DHR

COOLIING

LTREC

Late Recovery of SDC/DHR (3

Days)

LTREC-DHR-3D 1.90E-01

Note the value of the late recovery basic event varies with the time available

A2-21

Appendix B: HRA Analysis

A2-13

Human Error Probabilities

A high level discussion of the Human Reliability Analysis (HRA) is presented above in Section 7

on Model Development. Also included above is a summary of the HRA results. The following

discusses the Human Failure Events (HFE), the derivation of the in individual Human Error

Probabilities (HEP). This HRA analysis was done consistent with the guidance of

NUREG/CR-6883, The SPAR-H Human Reliability Analysis Method, dated August 2005.

The Human Error Probabilities (HEPs) for this analysis were calculated using the Low Power

Shutdown SPAR-H worksheets from NUREG/CR-6883. Consideration was given to the

available time to perform the action, the stress levels of the crew during the event, complexity of

the action, crew experience and applicable and relevant training, quality and thoroughness of

procedures, ergonomics, fitness of duty issues, and the available work processes.

A2-14

B1 Operator Fails to Diagnose Loss of SDC before Boiling

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: ANO1 Initiating Event: Basic Event: SD-XHE-XD-LOSDC

Basic Event Description: Operator Fails to Diagnose Loss of SDC before boiling

Part I. DIAGNOSIS WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reasons for

Diagnosis PSF PSF level selection in this

column.

Available Time Inadequate time P(failure) = 1.0 5 minutes required, 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> available

Barely adequate time (2/3 Nominal) 10

Nominal time 1

Extra time (between 1 and 2 x nominal and > than 30 min) 0.1

Expansive time (> 2 x nominal and > 30 min) 0.01 X

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5

Moderately Complex 2

Nominal 1

0.5

Obvious diagnosis 0.1 X Pump stop with loss of power is

Insufficient information 1 obvious

Experience/ Low 10

Training Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50

Incomplete 20

Available, but poor 5

Nominal 1 X

Diagnostic/symptom oriented 0.5

Insufficient information 1

Ergonomics/HMMissing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Unfit P(failure) = 1.0

Duty Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Poor 2

Processes Nominal 1 X

Good 0.8

Insufficient information 1

NHEP = 2.00E-05

Negative PSFs adjustment ( >3 negative PSFs) NA

Final Diagnosis

2.00E-05

HEP

A2-15

B2 Operator Fails to Recover Loss of SDC/DHR before Boiling

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: ANO1 Initiating Event: Basic Event: SD-XHE-XL-LOSDC

Basic Event Description: Operator Fails to Recover Loss of SDC before boiling

Part II. ACTION WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reasons

Action PSF for PSF level selection in

this column.

Available Time Inadequate time P(failure) = 1.0 30 minutes required, 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />

Time Available is the time required 10 available. SDC/DHR pumps are

Nominal time 1 located in the containment one

Time available is 5x the time required 0.1 X boiling occurs into containment

Time available is 50x the time required 0.01 operation of pumps will be effected

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5

Moderately 2 X

Nominal 1

Insufficient information 1

Experience/Training Low 3

Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50 .

Incomplete 20

Available but poor 5

Nominal 1 X

Insufficient information 1

Ergonomics/HMI Missing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Duty Unfit P(failure) = 1.0

Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Processes Poor 5

Nominal 1 X

Good 0.5

Insufficient information 1

Final Action HEP 4.00E-04

A2-16

B3 Operator Fails to Inject (AC power available) before Level Reaches TAF

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: NMP1 Initiating Event: Basic Event: SD-XHE-XL-MINJ

Basic Event Description: Operator Fails to Inject after Level Reaches Scram Setpoint and before it Reaches TAF

Part II. ACTION WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reasons for

Action PSF PSF level selection in this

column.

Available Time Inadequate time P(failure) = 1.0

Time Available is the time required 10

Nominal time 1

Time available is 5x the time required 0.1

Time available is 50x the time required 0.01 X

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5 This assumes that condensate

Moderately 2 continues to run on loss of DC. If

Nominal 1 X racking in core spray is required this

Insufficient information 1 would be moderate.

Experience/Training Low 3

Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50 .

Incomplete 20

Available but poor 5

Nominal 1 X

Insufficient information 1

Ergonomics/HMI Missing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Duty Unfit P(failure) = 1.0

Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Processes Poor 5

Nominal 1 X

Good 0.5

Insufficient information 1

NHEP = 2.00E-05

Negative PSFs adjustment (>3 negative PSFs) NA

Final Action HEP 2.00E-05

A2-17

B4a Operator Fails to Diagnose Need for Low Pressure Recirc

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: ANO1 Initiating Event: Basic Event: SD-XHE-XL-LPR

Basic Event Description: Operator Fails to Initiate Low Pressure Recirc

Part I. DIAGNOSIS WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reasons for

Diagnosis PSF PSF level selection in this

column.

Available Time Inadequate time P(failure) = 1.0 Feed has been started therefore there

Barely adequate time (2/3 Nominal) 10 is at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to restart SDC

Nominal time 1

Extra time (between 1 and 2 x nominal and > than 30 min) 0.1

Expansive time (> 2 x nominal and > 30 min) 0.01 X

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5

Moderately Complex 2

Nominal 1 X

0.5

Obvious diagnosis 0.1

Insufficient information 1 Scram setpoint is an obvious cue

Experience/ Low 10

Training Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50

Incomplete 20

Available, but poor 5

Nominal 1 X

Diagnostic/symptom oriented 0.5

Insufficient information 1

Ergonomics/HMMissing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Unfit P(failure) = 1.0

Duty Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Poor 2

Processes Nominal 1 X

Good 0.8

Insufficient information 1

NHEP = 2.00E-4

Negative PSFs adjustment ( >3 negative PSFs) NA

Final Diagnosis HEP = 2.00E-4

A2-18

B4b Operator Fails Action for Low Pressure Recirc

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: ANO1 Initiating Event: Basic Event: SD-XHE-XL-LPR

Basic Event Description: Operator Fails to Initiate Low Pressure Recirc

Part II. ACTION WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reasons for

Action PSF PSF level selection in this

column.

Available Time Inadequate time P(failure) = 1.0

Time Available is the time required 10

Nominal time 1

Time available is 5x the time required 0.1

Time available is 50x the time required 0.01 X

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5

Moderately 2

Nominal 1 X

Insufficient information 1

Experience/Training Low 3

Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50 .

Incomplete 20

Available but poor 5

Nominal 1 X

Insufficient information 1

Ergonomics/HMI Missing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Duty Unfit P(failure) = 1.0

Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Processes Poor 5

Nominal 1 X

Good 0.5

Insufficient information 1

NHEP = 2.00E-05

Negative PSFs adjustment (>3 negative PSFs) NA

Final Action HEP 2.00E-05

A2-19

B5a Operator Fails Diagnoses for Aligning Alternate DC Power

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: ANO1 Initiating Event: Basic Event: DCP-XHE-XM-DD11D21

Basic Event Description: Operator Action to Align 125VDC Panel D11 to Feed 125VDC Panel D21

Part I. DIAGNOSIS WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reasons for

Diagnosis PSF PSF level selection in this

column.

Available Time Inadequate time P(failure) = 1.0 30 minutes required, aasumed 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

Barely adequate time (2/3 Nominal) 10 battery depletion time is time available.

Nominal time 1

Extra time (between 1 and 2 x nominal and > than 30 min) 0.1 X

Expansive time (> 2 x nominal and > 30 min) 0.01

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5

Moderately Complex 2

Nominal 1 x

0.5

Obvious diagnosis 0.1

Insufficient information 1

Experience/ Low 10

Training Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50

Incomplete 20

Available, but poor 5

Nominal 1 X

Diagnostic/symptom oriented 0.5

Insufficient information 1

Ergonomics/HMMissing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Unfit P(failure) = 1.0

Duty Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Poor 2

Processes Nominal 1 X

Good 0.8

Insufficient information 1

NHEP = 2.00E-03

Negative PSFs adjustment ( >3 negative PSFs) NA

Final Diagnosis

2.00E-03

HEP

A2-20

B5a Operator Fails Action for Aligning Alternate DC Power

HRA Worksheets for LPSD

SPAR HUMAN ERROR WORKSHEET

Plant: ANO1 Initiating Event: Basic Event: DCP-XHE-XM-DD11D21

Basic Event Description: Operator Action to Align 125VDC Panel D11 to Feed 125VDC Panel D21

Part II. ACTION WORKSHEET

PSFs PSF Levels Multiplier for Selected Please note specific reas

Action PSF for PSF level selection in

this column.

Available Time Inadequate time P(failure) = 1.0 30 minutes required, aasumed 4

Time Available is the time required 10 hour battery depletion time is t

Nominal time 1 X available.

Time available is 5x the time required 0.1

Time available is 50x the time required 0.01

Insufficient information 1

Stress Extreme 5

High 2 X

Nominal 1

Insufficient information 1

Complexity Highly 5

Moderately 2

Nominal 1 X

Insufficient information 1

Experience/Training Low 3

Nominal 1 X

High 0.5

Insufficient information 1

Procedures Not available 50 .

Incomplete 20

Available but poor 5

Nominal 1 X

Insufficient information 1

Ergonomics/HMI Missing/Misleading 50

Poor 10

Nominal 1 X

Good 0.5

Insufficient information 1

Fitness for Duty Unfit P(failure) = 1.0

Degraded Fitness 5

Nominal 1 X

Insufficient information 1

Work Processes Poor 5

Nominal 1 X

Good 0.5

Insufficient information 1

Final Action HEP 2.00E-03

A2-21

Appendix C: Cutsets

A2-22

Top 40 Cutsets:

Top 20 Cutsets from Sequence 4

Prob/ Total

1. Cut Set Description

Freq.  %

Total 1.54E-5 100 Displaying 20 of 6784 Cut Sets.

1 3.22E-6 20.9 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

9.63E-4 LPI-MOV-CC-CV1400 LPI DISCHARGE MOV CV-1400 FAILS TO OPEN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

2 3.18E-6 20.6 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

9.51E-4 SWS-AOV-CC-CV3841 FAILURE OF SWS MOV CV-3841 TO PMP P34A TO OPEN

3 3.17E-6 20.5 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

9.47E-4 LPI-MDP-FS-P34B LPI MDP P34B FAILS TO START

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

4 1.21E-6 7.84 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

3.62E-4 LPI-MDP-FR-P34B LPI MDP P34B FAILS TO RUN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

5 1.04E-6 6.75 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

2.48E-5 SWS-AOV-CF-CV38401 CCF OF SWS AOVs CV-3840/3841 TO PUMPS P34A/B TO OPEN

6 9.95E-7 6.44 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.37E-5 LPI-MDP-CF-STRT LPI PUMP COMMON CAUSE FAILURES TO START

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

7 7.70E-7 4.99 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

Common Cause failure of DHR Unit Coolers VUC-1A,1B, 1C & 1D to

1.83E-5 LPI-ACX-CF-VC1XR

RUN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

8 5.31E-7 3.44 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

1.26E-5 LPI-MDP-CF-RUN LPI PUMP COMMON CAUSE FAILURES TO RUN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

9 3.18E-7 2.06 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

9.50E-5 LPI-ACX-CF-VC1CDR Common Cause failure of DHR Unit Coolers VUC-1C and 1D to Run

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

10 1.22E-7 0.79 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

Common Cause failure of DHR Unit Coolers VUC-1A,1B, 1C & 1D to

2.89E-6 LPI-ACX-CF-VC1XS

Start

A2-23

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

11 1.17E-7 0.76 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

9.63E-4 LPI-MOV-CC-CV1400 LPI DISCHARGE MOV CV-1400 FAILS TO OPEN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

12 1.15E-7 0.75 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

9.51E-4 SWS-AOV-CC-CV3841 FAILURE OF SWS MOV CV-3841 TO PMP P34A TO OPEN

13 1.15E-7 0.75 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

9.47E-4 LPI-MDP-FS-P34B LPI MDP P34B FAILS TO START

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

14 1.00E-7 0.65 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

1.00E-7 SD-CUTOFF HFE Cutoff Value for Shutdown

1.00E+0 SD-XHE-XL-LOSDC-C Operator Fails to Recover Loss of SDC/DHR before Boiling (cutoff)

1.00E+0 SD-XHE-XL-LPR-C Operator Fails to Initiate Low Pressure Recirc (cutoff)

15 9.68E-8 0.63 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A308 4160V AC BREAKER 152-308 FAILS TO CLOSE

9.63E-4 LPI-MOV-CC-CV1400 LPI DISCHARGE MOV CV-1400 FAILS TO OPEN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

16 9.55E-8 0.62 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A308 4160V AC BREAKER 152-308 FAILS TO CLOSE

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

9.51E-4 SWS-AOV-CC-CV3841 FAILURE OF SWS MOV CV-3841 TO PMP P34A TO OPEN

17 9.52E-8 0.62 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A308 4160V AC BREAKER 152-308 FAILS TO CLOSE

9.47E-4 LPI-MDP-FS-P34B LPI MDP P34B FAILS TO START

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

18 6.69E-8 0.43 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

2.00E-5 LPI-ACX-CF-VC1CDS Common Cause failure of DHR Unit Coolers VUC-1C and 1D to Start

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

19 4.40E-8 0.28 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

3.62E-4 LPI-MDP-FR-P34B LPI MDP P34B FAILS TO RUN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

20 4.05E-8 0.26 M6-LOOP2 : 04

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

1.00E-3 EPS-XHE-XR-DG1 OP FAILS TO RESTORE DIESEL GENERATOR 1

9.63E-4 LPI-MOV-CC-CV1400 LPI DISCHARGE MOV CV-1400 FAILS TO OPEN

4.20E-2 LTREC-DHR-5D Late Recovery of SDC/DHR (5 Days)

A2-24

Top 20 Cutsets from Sequence 19

Prob/ Total

1. Cut Set Description

Freq.  %

Total 3.62E-4 100 Displaying 20 of 3955 Cut Sets.

1 2.53E-4 70 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

7.96E-2 EPS-DGN-FR-DG2 DIESEL GENERATOR 2 FAILS TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

2 4.33E-5 12 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

1.08E-3 EPS-DGN-CF-DG12R CCF OF DIESEL GENERATORS DG1&DG2 TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

3 9.20E-6 2.54 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

2.89E-3 EPS-DGN-FS-DG2 DIESEL GENERATOR 2 FAILS TO START

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

4 9.20E-6 2.54 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG2 DIESEL GENERATOR 2 FAILS TO RUN

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

5 7.61E-6 2.1 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A308 4160V AC BREAKER 152-308 FAILS TO CLOSE

7.96E-2 EPS-DGN-FR-DG2 DIESEL GENERATOR 2 FAILS TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

6 7.61E-6 2.1 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A408 4160V AC BREAKER 152-408 FAILS TO CLOSE

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

7 7.00E-6 1.94 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

Operator Action to Align 125VDC Panel D11 to Feed 125VDC Panel

2.20E-3 DCP-XHE-XM-DD11D21

D21

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

8 4.31E-6 1.19 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

9.93E-1 SWS-4C-RUNNING SWS MDP P4C IS RUNNING; 4B ALIGNED TO RED TRAIN

1.36E-3 SWS-MDP-FS-P4C SERVICE WATER MDP P4C FAILS TO START

9 3.23E-6 0.89 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

8.09E-5 ACP-CRB-CF-A3A4-12 CCF OF A3-TO-A4 XTIE BREAKERS TO OPEN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

10 3.18E-6 0.88 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

A2-25

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

1.00E-3 EPS-XHE-XR-DG2 OP FAILS TO RESTORE DIESEL GENERATOR 2

11 3.18E-6 0.88 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG2 DIESEL GENERATOR 2 FAILS TO RUN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

1.00E-3 EPS-XHE-XR-DG1 OP FAILS TO RESTORE DIESEL GENERATOR 1

12 3.07E-6 0.85 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG1 DIESEL GENERATOR 1 FAILS TO RUN

9.63E-4 EPS-MOV-CC-CV3807 SWS SUPPLY MOV CV-3807 TO DGN 2 COOLING FAILS TO OPEN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

13 3.07E-6 0.85 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

7.96E-2 EPS-DGN-FR-DG2 DIESEL GENERATOR 2 FAILS TO RUN

9.63E-4 EPS-MOV-CC-CV3806 SWS SUPPLY MOV CV-3806 TO DGN 1 COOLING FAILS TO OPEN

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

14 1.45E-6 0.4 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

3.61E-5 EPS-DGN-CF-DG12S CCF OF DIESEL GENERATORS DG1&DG2 TO START

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

15 9.47E-7 0.26 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.37E-5 EPS-MDP-CF-P16ABS CCF of EDG Fuel Oil Pump to Start

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

16 7.43E-7 0.21 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

1.86E-5 EPS-MOV-CF-SWS CCF OF SWS SUPPLY MOVs 3806 AND 3807

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

17 5.06E-7 0.14 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

1.26E-5 EPS-MDP-CF-P16ABR CCF of EDG Fuel Oil Pump to Run

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

18 3.34E-7 0.09 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

2.89E-3 EPS-DGN-FS-DG2 DIESEL GENERATOR 2 FAILS TO START

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

19 2.77E-7 0.08 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A308 4160V AC BREAKER 152-308 FAILS TO CLOSE

2.89E-3 EPS-DGN-FS-DG2 DIESEL GENERATOR 2 FAILS TO START

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

20 2.77E-7 0.08 M6-LOOP2 : 19

1.00E+0 IE-M6-LOOP LOOP Event Occurs during Mode 6

2.39E-3 ACP-CRB-OO-1A408 4160V AC BREAKER 152-408 FAILS TO CLOSE

2.89E-3 EPS-DGN-FS-DG1 DIESEL GENERATOR 1 FAILS TO START

4.00E-2 EPS-XHE-XL-NR96H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 Days

A2-26

Unit 2

At-Power Detailed Risk Evaluation

Probabilistic Risk Assessment (PRA) Analyst: David Loveless, Senior Risk Analyst

Independent Reviewer Jeff Mitman, Senior Reliability and Risk

Analyst, NRR/DRA/APOB

A3-1 Attachment 3

A. Summary of Issue:

At the time of the event, ANO Unit 2 was operating at 100 percent power.

At approximately 0750 hours0.00868 days <br />0.208 hours <br />0.00124 weeks <br />2.85375e-4 months <br /> on March 31, 2013, the temporary hoist assembly used to lift

and transport the Unit 1 stator from the turbine building failed resulting in the ~524 ton stator

dropping onto the Unit 1 turbine deck (Elev. 386) and then rolling and falling onto the

transport vehicle parked in the train bay (Elev. 354).

The impact of the stator on the Unit 1 turbine deck resulted in substantial damage to turbine

building structural members and to the turbine deck floor in the vicinity of the impact. The

4160 VAC switchgear A1 and A2 located immediately below where the stator impacted the

turbine deck were damaged, rendering offsite power sources from startup #1 and startup #2

transformers inoperable.

Falling components impacted the north wall of the train bay causing structural damage and

damage to the fire suppression system, causing substantial fire water spray into the train

bay area. The stator came to rest against the south wall of the train bay on top of the

transport vehicle. Both the north and south non-structural concrete masonry unit walls of

the train bay suffered substantial damage.

The shock from the stator contacting the turbine building, and temporary lift assembly

components falling into the turbine building, caused relays in the Unit 2 switchgear area

located just adjacent to the train bay to actuate resulting in the trip of 2P-32B reactor coolant

pump. This resulted in a trip to the Unit 2 reactor. The Unit 2 post-trip response was normal

except it was complicated by Feedwater Loop A man feedwater regulating valve 2CV- 0748

position indication discrepancy. This caused the operators to trip the main feedwater pumps

and manually initiated Emergency Feedwater.

The stator drop caused a rupture of an eight-inch fire main in the turbine building train bay.

Water from the fire suppression system migrated to several areas of the turbine building on

Unit 2. Offsite power to Unit 2 from startup transformer 3 was lost after water from the

ruptured fire main caused an electrical fault inside the Unit 2 non-safety-related switchgear

in the turbine building. The loss of power from startup transformer 3 resulted in a loss of

train B vital electrical bus (safety-related,) a trip of the running reactor coolant pumps and

charging pump on Unit 2, and a trip of the running instrument air compressors maintaining

instrument air header pressure for both units. Unit 2 emergency diesel generator 2 started

and energized the train B vital electrical bus, while the train A vital and non-vital electrical

buses were re-energized from startup transformer 2. Operators took appropriate actions to

stabilize Unit 2, restore the instrument air system and subsequently cooled Unit 2 to cold

shutdown conditions on natural circulation.

B. Statement of the Performance Deficiency:

The licensee failed to accomplish actions specified in plant procedures. Procedure

EN MA 119, Material Handling Program is a quality-related procedure that controls the

licensees activities for handling and moving loads and rigging equipment at all Entergy

sites. The procedure requires the licensee to review and approve the lifting rig design and

verify that a load test is conducted. The licensee approved an inadequate design and did

not conduct a load test.

A3-2

C. Significance Determination Basis:

1. Reactor Inspection for IE, MS or BI Cornerstones

(a) Screening Logic

Minor Question: In accordance with NRC Inspection Manual Chapter 0612,

Appendix B, Issue Screening, the finding was determined to be more than

minor because it was associated with the procedural control attribute of the

initiating event cornerstone, and adversely affected the cornerstones objective to

limit the likelihood of events that upset plant stability and challenge critical safety

functions during shutdown as well as power operations. The stator drop affected

Unit 2 by causing a complicated reactor trip.

Initial Characterization: Using Manual Chapter 0609, Attachment 4, Initial

Characterization of Findings, the inspectors determined that the finding could be

evaluated using the significance determination process. In accordance with

Table 3, SDP Appendix Router, the inspectors determined that the subject

finding should be processed through Appendix A, The Significance

Determination Process (SDP) for Findings At-Power, Exhibit 1, Initiating Events

Screening Questions, dated June 19, 2012.

Issue Screening: Using Appendix A, Exhibit 1, the inspectors determined that

the finding did not affect loss of coolant accident initiators. The inspectors then

determined that the finding did cause a reactor trip and the loss of mitigation

equipment relied upon to transition the plant from the onset of the trip to a stable

shutdown condition. This mitigation equipment, lost or degraded, included one

source of offsite power, main feedwater, and the alternate ac diesel generator.

Therefore, a detailed risk evaluation was required.

Results: The Region IV senior reactor analyst performed a detailed risk

evaluation in accordance with Appendix A, Section 6.0, Detailed Risk

Evaluation. The detailed risk evaluation result is a preliminary finding of

substantial safety significance (Yellow). The calculated change in core damage

frequency of 2.8 x 10-5 was dominated by the internal event initiated by the stator

drop on March 31, 2013. The analyst determined that the external event risk was

negligible and that the finding would not involve a significant increase in the risk

of a large, early release of radiation.

(b) Detailed Risk Evaluation:

(1) The Phase 3 model revision and other PRA Tools used

The analyst utilized the Standardized Plant Analysis Risk Model for

Arkansas Nuclear One, Unit 2 (SPAR), Revision 8.21 and hand

calculation methods to quantify the risk of the subject performance

deficiency. The model was modified by the analyst and Idaho National

Laboratories to include additional breakers and switching options, and to

provide credit for recovery of emergency diesel generators during

transient sequences. Additionally, the analyst performed additional runs

of the SPAR model to account for consequential loss of offsite power

risks that were not modeled directly under the special initiator.

A3-3

(2) Influential assumptions

1. The subject performance deficiency directly resulted in the Unit 2

event on March 31, 2013. This event would not have occurred had

the performance deficiency not existed. Therefore, the performance

deficiency caused an increase in the nominal initiating event

frequency of 1 over the assessment period.

2. Given Assumption 1, the exposure time was set to the 1-year

assessment period. The actual exposure time that the performance

deficiency existed is not critical.

3. The best available initiating event to model the subject performance

deficiency is the loss of main feedwater initiator. The actual event

was initiated by a general transient. However, a failure of the

indication for Regulating Valve 2CV-748 prevented the main

feedwater system from initiating a reactor trip override. As a result,

operators tripped the operating main feedwater pump and initiated the

emergency feedwater actuation system.

4. The analyst noted that the SPAR model does not model offsite power

to a level sufficient to show failures within the offsite circuits.

Therefore, the failure of Bus 2A2 is an appropriate surrogate for the

Lockout of Startup Transformer 3. This surrogate was considered

appropriate because Bus 2A2 was de-energized for approximately

44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> following the event.

5. The alternate ac diesel generator was unavailable to respond at any

point throughout its mission time because the stator drop caused

significant damage to the control and power cabling associated with

this generator.

6. The analyst noted that Version 8.21 of the SPAR model had not yet

been updated to evaluate the risk of a postulated consequential loss

of offsite power given a reactor trip. Based on NUREG/CR-6890,

Reevaluation of Station Blackout Risk at Nuclear Power Plants, the

conditional probability of a loss of offsite power given a reactor trip at

a large nuclear power plant during times of higher grid loading is

3.91 x 10-3/ trip. Multiple runs of the SPAR model can be made to

quantify the change in risk for these postulated events.

A3-4

(4) Calculation discussion

A detailed risk evaluation performed consistent with NRC Inspection

Manual Chapter (IMC) 0609 Appendix A, Section 6.0, Detailed Risk

Evaluation. To conduct a risk assessment and determine the change in

core damage frequency (CDF) an analyst must solve the following

equation:

CDF = [(IEFcase * CCDPcase) - (IEFbase * CCDPbase)] * EXP

Where:

• IEFcase Initiating Event Frequency of the case being

evaluated

• CCDPcase Conditional Core Damage Probability of the case

• IEFbase Initiating Event Frequency of the baseline

• CCDPbase Conditional Core Damage Probability of the

baseline

• EXP The Exposure Period including repair time

Conditional Core Damage Probability of the Event

The analyst used several surrogate basic events to model the event that

occurred on March 31, 2013. First, the analyst modeled the event as a

loss of main feedwater. The actual event was initiated by a transient.

However, a failure of the indication for Regulating Valve 2CV-748

prevented the main feedwater system from initiating a reactor trip

override. As a result, operators tripped the operating main feedwater

pump and initiated the emergency feedwater actuation system. The

analyst determined that a best estimate analysis would result from using

the Loss of Main Feedwater initiator to model the risk of this event.

The analyst noted that the SPAR model does not model offsite power to a

level sufficient to show failures within the offsite circuits. Therefore, the

analyst used the failure of Bus 2A2 as a surrogate for the Lockout of

Startup Transformer 3. This surrogate was considered appropriate

because Bus 2A2 was de-energized for approximately 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> following

the event.

As a final surrogate, the analyst modeled the gross failure of cabling

associated with the AAC as an operator failure to start the machine. This

surrogate provided the correct logic for the failure while indicating that the

machine could not be recovered within the stated mission time.

The change set developed for the quantification of risk is documented in

Table 1. The total change in core damage frequency calculated was

2.8 x 10-5. This included additional runs performed to account for

consequential loss of offsite power sequences not directly modeled in the

current version of the SPAR.

A3-5

Table 1

SPAR Change Set

Basic Event Event Description Original Modified

Value Value

ACP-BAC-LP-2A2 Division B AC Power 4160V Bus 2A2 Fails 3.34E-05 True

ACP-CRB-OO-152113 Failure of CRB 152-113 to close 2.39E-03 True

EPS-XHE-XM-SBO Operator Fails to Start SBO Diesel 2.00E-02 True

Generator

IE-******** All Initiating Events various False

IE-LOMFW Loss of Main Feedwater 6.89E-02 1.0

The above described SPAR model was evaluated using the SAPHIRE

code Version 8.0.9.0. The truncation limit was set at 1E-12. The result of

the model run was a conditional core damage probability of 2.74 x 10-5.

The analyst noted that Version 8.21 of the SPAR model had not yet been

updated to evaluate the risk of postulated consequential loss of offsite

power given a reactor trip. Based on NUREG/CR-6890, Reevaluation of

Station Blackout Risk at Nuclear Power Plants, the conditional probability

of a loss of offsite power given a reactor trip at a large nuclear power

plant during times of higher grid loading is 3.91 x 10-3/ trip.

Using the same basic event modifications and truncation limit, the analyst

set the loss of offsite power frequency to 3.91 x 10-3 and re-quantified the

model. The result of the model run was a conditional core damage

probability of 7.46 x 10-7. Being mutually exclusive core damage

sequences, the conditional core damage probabilities from the loss of

offsite power and loss of main feedwater sequences can be summed.

The analyst added the sequences to determine the total conditional core

damage probability for the event of 2.8 x 10-5.

Exposure Period

This SDP evaluation is an initiating event that occurred as a result of a

performance deficiency. The calculation is a conditional core damage

probability estimate and exposure time does not apply.

To show that the use of a conditional core damage probability estimate

was appropriate, the analyst assumed that the exposure period started at

March 31, 2013, when the stator was first lifted and ended on April 22,

2013, when the last of the major components affected were returned to

service. This represented approximately 22 days of exposure and repair

time. This exposure time corresponds to the time period that the

condition being assessed was reasonably known to have existed plus the

repair time (per the usage rules of IMC 0308, Attachment 3, Appendix A).

SPAR model basic event IE-LOMFW, representing a Loss of Main

Feedwater initiator would then be set to a frequency corresponding to one

event during the 22 days. The basis for the initiating event frequency

change is that analyst noted, given the conditions of the temporary lift

crane, the load would have always fallen at the time the load was rotated

A3-6

to align with the truck bay. Therefore, the frequency of the loss of main

feedwater, given a stator drop, was assumed to be 1.0 over the 22 day

exposure time.

NOTE: This method of calculation is essentially equivalent to performing

a conditional core damage probability assessment for a loss of main

feedwater event and then subtracting the baseline core damage

probability. Given that the core damage probability is approximately the

integral of core damage frequency over time, at the point in time on

March 31, 2013, where the initiating event occurred, this integral is equal

to the conditional core damage probability multiplied by the integral of the

Dirac delta function. This integral is the numerical equivalent to the

conditional core damage probability.

Initiating Event Frequency

As discussed under Exposure Period above, the analyst determined that

the best method to estimate the change in core damage frequency for the

subject performance deficiency was by quantifying the conditional core

damage probability for the event.

To continue the rough calculation of change in conditional core damage

frequency the analyst increased the number of loss of main feedwater

initiators by one over the exposure time (22-days). Therefore, the

initiating event frequency was set as 4.55 x 10-2 /day.

Baseline Risk

As discussed under Exposure Period above, the analyst determined that

the best method to estimate the change in core damage frequency for the

subject performance deficiency was by quantifying the conditional core

damage probability for the event.

However, for illustrative purposes, the analyst quantified the baseline loss

of main feedwater conditional core damage probability. This value was

5.86 x 10-7. The analyst noted that the SPAR model provides a baseline

initiating event frequency for a loss of main feedwater at 6.89 x 10-2/year.

Change in core damage frequency quantified

Given these calculations and assumptions, the analyst calculated the

change in core damage frequency as follows:

CDF = [(4.55 x 10-2/day * 2.8 x 10-5)

- (6.89 x 10-2/year ÷ 365 days/year * 5.86 x 10-7)] * 22 days

= [1.27 x 10-6 /day - 1.11 x10-10 /day] * 22 days

= 2.79 x 10-5

(5) Analysis of Dominant Cut-sets / Sequences

The dominant accident sequence cutsets involved a loss of main

feedwater, loss of auxiliary feedwater, loss of emergency feedwater, and

A3-7

the failure of once-through cooling. The evaluation of consequential loss

of offsite power provided a dominant accident sequence involving a

transient with consequential loss of offsite power, the loss of all feedwater

to the steam generators and failure of once-through cooling.

Table 2

Core Damage Sequences

Sequence Description Point  % of Cut Set

Estimate Total Count

MFW-14 IEMFW-FW-OTC 2.69E-5 95.6 6,036

LOOP-19 IELOOP-EFW-OTC 3.79E-7 1.3 1,733

LOOP-20-09-10 IELOOP-SBO(EPS)-RSUB-OPR08H- 2.74E-7 1.0 527

DGR08H-EFWMAN-SGDEPLT

MFW-15-10 IEMFW-RPS-FWATWS 1.25E-7 0.4 157

MFW-13 IEMFW-FW-SSRC-HPR 8.98E-8 0.3 1,679

LOOP-20-30 IELOOP-SBO-EFW-OPR08H-DGR08H 8.00E-8 0.3 959

MFW-02-09-04 IEMFW-LOSC-RCPT-HPI 6.14E-8 0.2 814

MFW-15-11 IEMFW-RPS-RCSPRESSURE 3.99E-8 0.1 18

MFW-15-09 IEMFW-RPS-BORATION 3.79E-8 0.1 16

MFW-12 IEMFW-FW-SSCR-CSR 2.63E-8 0.1 560

Others All Additional Sequences Combined 1.33E-7 0.5 3,886

Total CCDP All Sequences 2.81e-5 100.0 16,385

Abbreviations

BORATION Failure of Emergency Boration

CBO Controlled Bleedoff Isolated

CSR Containment Spray Recirculation

DGR08H Nonrecovery of Diesel Generator in 8 Hours

EFW Emergency Feedwater

EFWMAN Manual Control of Emergency Feedwater

EPS Emergency Power System

FW Feedwater System (MFW, EFW, and auxiliary feedwater)

FWATWS Feedwater System under ATWS Conditions

HPI High Pressure Injection

HPR High Pressure Recirculation

IELOOP Initiating Event: Loss of Offsite Power

IEMFW Initiating Event: Loss of Main Feedwater

LOSC Loss of RCP Seal Cooling

OPR08H Nonrecovery of Offsite Power in 8 Hours

OTC Once-Through Cooling

RCPT Reactor Coolant Pumps Tripped

RCSPRESS RCS Pressure Limited

RSUB Reactor Coolant Subcooling Maintained

RPS Reactor Protection System

SBO Station Blackout

SGDEPLT Late Depressurization of Steam Generators

SSCR Secondary Cooling Recovered

The dominant accident sequence cutsets involved a loss of main

feedwater, loss of auxiliary feedwater, loss of emergency feedwater, and

the failure of once-through cooling. The top ten sequence cutsets are

provided in Table 2 of the detailed risk evaluation. The top 100 cutsets

A3-8

for each of two model runs are provided as attachments to this

evaluation.

The results are dominated by one core damage sequence. The largest

contributor is Sequence 14 from the loss of main feedwater tree. The

sequence comprises a failure of all feedwater to the steam generators,

including main feedwater, auxiliary feedwater, and emergency feedwater,

with a loss of once-through cooling. The remainder of the sequences are

dominated by failure of the emergency diesel generators without recovery

of ac power.

(6) Sensitivity Analysis

The SRA performed a variety of uncertainty and sensitivity analyses on

the internal events model as shown below. The results confirm the

recommended Yellow finding.

Sensitivity Analysis 1 - Transient without Loss of Main Feedwater.

The SRA ran the model using a transient as the initiator. The change in

core damage frequency was 1.10 x 10-5 (Yellow).

Sensitivity Analysis 2 - No consequential loss of offsite power.

The SRA ran the model without including the additional runs to calculate

the change in risk from a postulated consequential loss of offsite power.

The change in core damage frequency was 2.74 x 10-5 (Yellow).

Sensitivity Analysis 3 - Potential Recovery of Bus 2A2

The SRA ran the model with the failure of Bus 2A2 probability set to

6.79 x 10-1. This value, calculated using SPAR-H methodology,

represented the probability that operators would fail to recover the bus

prior to core damage, given the adverse and unknown conditions of site

electrical supply. The change in core damage frequency was 1.97 x 10-5

(Yellow).

(7) Contributions from External Events (Fire, Flooding, and Seismic)

Manual Chapter 0609, Appendix A, Section 6.0 requires, when the

internal events detailed risk evaluation results are greater than or equal to

1.0E-7, the finding should be evaluated for external event risk

contribution. The analyst noted that this detailed risk assessment

evaluates an actual event in which no external events occurred.

Additionally, the period of time that the events impacted plant equipment

was small enough that the probability of an external initiator occurring

during this time would be negligible. Therefore, the analyst assumed that

the risk from external events, given the subject performance deficiency

was essentially zero.

A3-9

(8) Potential Risk Contribution from LERF

In accordance with the guidance in NRC Inspection Manual

Chapter 0609, Appendix H, Containment Integrity Significance

Determination Process, this finding would not involve a significant

increase in risk of a large, early release of radiation because Arkansas

Nuclear One, Unit 2 has a large, dry containment and the dominant

sequences contributing to the change in the core damage frequency did

not involve either a steam generator tube rupture or an inter-system loss

of coolant accident.

(9) Total Estimated Change in Core Damage Frequency

The total change in risk caused by this performance deficiency is the sum

of the internal and external events change in core damage frequencies.

This value was 2.8 x 10-5 (YELLOW).

(10) Licensees Risk Evaluation

The licensee provided an assessment of the risk related to the March 31,

2013 event. With similar modeling assumptions, the licensees at-power

probabilistic safety assessment provided a conditional core damage

probability of 2.94 x 10-5/year. This corroborated the NRC analysts

evaluation. However, the licensee calculated per component repair times

for the major components affected by the performance deficiency and

stated that the change in core damage frequency, after removing

qualitative modeling conservatisms was less than 1 x 10-6, resulting in a

Green finding.

Using the licensee's method, the exposure period defined by the licensee

affected the time following the plant transient. However, the licensee did

not adjust the initiating event likelihood to address the increased rate of

failure over this new exposure time.

(11) Summary of Results and Impact

The NRCs quantitative risk assessment was determined to represent a

risk estimate in the Yellow region. Region IV recommends a preliminary

finding of substantial safety significance (Yellow based on change in core

damage frequency).

(d) Peer Review:

Jeff Mitman, Senior Reliability and Risk Analyst, NRR/DRA/APOB

(e) References:

The analysts used the following generic references in preparing the risk

assessment:

• NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power

Plants

A3-10

• NUREG/CR-6883, The SPAR-H Human Analysis Method. August 2005

• NUREG-1842, Good Practices for Implementing Human Reliability Analysis.

April 2005

• NUREG/CR-6595 Revision 1, An Approach for Estimating the Frequencies

of Various Containment Failure Modes and Bypass Events. October 2004

• INL/EXT-10-18533 Revision 2, SPAR-H Step-by-Step Guidance. May 2011

• RASP Manual Volume 1 - Internal Events, Revision 2.0 date January 2013

• Risk Assessment of Operational Events, Volume 2 - External Events,

Revision 1.01, January 2008

• NUREG/CR-1278, Handbook of HRA with Emphasis on Nuclear Power Plant

Applications, August 1983

• NRC Inspection Manual Chapter 0609, Significance Determination Process

The analysts used the following plant specific references:

• Standardized Plant Analysis Risk (SPAR) model for Arkansas Unit 2,

Version 8.21

• Arkansas Nuclear One, Unit 2, Final Safety Analysis Report Page 8.3-12

• EOP: 1202.007, Degraded Power

• AOPs:

o 1203.024, Loss of Instrument Air

o 1203.028, Loss of Decay Heat Removal

o 1203.050, Unit 1 Spent Fuel Pool Emergencies

• Calculation: 89-E-0017-01, Time to Boiling and Time to Core Uncovery after

Loss of Decay Heat Removal, Unit 1, Revision 7

• Procedure: 1103.018, Maintenance of RCS Water Level

A3-11