IR 05000285/2013018

IR 05000285/2013018; on 07/08/2013 - 10/15/2014; Fort Calhoun Station, Supplemental Inspection for Repetitive Degraded Cornerstones, Multiple Degraded Cornerstones, Multiple Yellow Inputs or One Red Input and Notice of Violation

ML14329B361
Person / Time
Site:	Fort Calhoun
Issue date:	11/25/2014
From:	Vegel T Division of Reactor Safety IV
To:	Cortopassi L Omaha Public Power District
Hay M
References
EA-14-187 IR 2013018
Download: ML14329B361 (84)

Text

November 25, 2014

SUBJECT:

FORT CALHOUN STATION - MANUAL CHAPTER 0350 INSPECTION REPORT AND FINAL SIGNIFICANCE DETERMINATION OF WHITE FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT NO. 05000285/2013018

Dear Mr. Cortopassi:

On October 15, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a team inspection at the Fort Calhoun Station. The inspection focused on the stations high energy line break and environmental qualification programs and the design change and modification processes. The enclosed inspection report presents the results of this inspection. A final exit briefing was conducted with you and other members of your staff on October 16, 2014.

The enclosed inspection report discusses one finding that was preliminarily determined to be White, having low to moderate safety significance. The finding involved the failure to properly implement high energy line break and environmental qualification design requirements. The station reconstituted the applicable harsh environment analysis, ensured all equipment subject to a harsh environment was properly qualified to perform its safety function, and implemented plant modifications that corrected all the identified deficiencies. These corrective actions were reviewed by the NRC and found acceptable prior to plant restart that occurred in December of 2013. On October 21, 2014, you informed Mr. Anton Vegel and Mr. Michael Hay of NRC, Region IV, that the Fort Calhoun Station agreed with the low to moderate risk significance (White) characterization of this finding and that you declined an opportunity to discuss this issue in a Regulatory Conference or to provide a written response.

After considering all available information, the NRC has concluded that the finding is appropriately characterized as White, having low to moderate safety significance. The NRC has also concluded that the failure to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break is a violation of NRC requirements, as cited in the attached Notice of Violation (Notice). The circumstances surrounding this violation are discussed in detail in the enclosed inspection report. In accordance with the NRC Enforcement Policy, the Notice is considered an escalated enforcement action because it is associated with a White finding. The NRC has concluded that the information regarding the reason for the violation, the corrective actions implemented to correct the violation and prevent recurrence, and the date when full compliance was achieved was obtained by the NRC during our inspection activities and detailed in the enclosed inspection report. Therefore, you are not required to respond to this letter unless the description contained in the enclosed report does not accurately reflect your corrective actions or your position. Additionally, since this issue was identified and resolved by the station during the extended shutdown, under increased NRC oversight of the Inspection Manual Chapter 0350 Process, this issue will not be used for future plant performance assessment inputs and is considered closed.

There were six NRC identified findings identified during this inspection that were determined to be of very low safety significance (Green), and involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the NRC Enforcement Policy.

If you contest these violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Fort Calhoun Station.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement, in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Fort Calhoun Station.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response, if you choose to provide one, will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Tony Vegel Director, Division of Reactor Safety

Docket: 50-285 License: DPR-40

Enclosure:

1. Notice of Violation 2. NRC Inspection Report 05000285/2013018 w/Attachments:

1. Supplemental Information 2. Detailed Risk Assessment

REGION IV==

Docket:

05000285 License:

DPR-40 Report:

05000285/2013018 Licensee:

Omaha Public Power District Facility:

Fort Calhoun Station Location:

9610 Power Lane Blair, NE 68008 Dates:

July 8, 2013 through October 15, 2014 Inspectors:

Accompanying Personnel J. Josey, Senior Resident Inspector, Region IV T. Lightly, Project Engineer, Region II C. Smith, Project Engineer, Region IV J. Wingebach, Resident Inspector, Region IV

N. Patel, Electrical Contractor, Beckman and Associates Approved By:

Tony Vegel, Director Division of Reactor Safety

- 2 -

Enclosure 2

SUMMARY OF FINDINGS

IR 05000285/2013018; 07/08/2013 - 10/15/2014; Fort Calhoun Station,

Supplemental Inspection for Repetitive Degraded Cornerstones, Multiple Degraded Cornerstones, Multiple Yellow Inputs or One Red Input.

The report covered a fifteen month period of inspection by an Inspection Manual Chapter 0350 inspection team. One White and six Green, non-cited violations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. The cross-cutting aspect is determined using Inspection Manual Chapter 0310, Components Within the Cross Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

White.

The team identified a violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, associated with the licensees failure to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structure, systems and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions.

Specifically, from initial construction through October 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break. The licensee addressed this deficiency by reconstituting the design analysis associated with the high energy line break and environmental qualification programs, receiving a change to the facilities licensing basis, and implementing plant modifications. This issue was entered into the licensees corrective action program as Condition Report CR 2013-2857.

The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where structures, systems, and components necessary to mitigate the effects of a high energy line break may not have functioned as required. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because it was a deficiency affecting the design and qualification of a mitigating structure, system, or component that resulted in a loss of operability or functionality and represented a loss of system and/or function.

The Region IV senior reactor analyst performed a detailed risk evaluation in accordance with Appendix A, Section 6.0, Detailed Risk Evaluation. The detailed risk evaluation concluded the finding was best characterized as having low to moderate safety significance (White). The minimum calculated change in core damage frequency of 4.1 x 10-6 was dominated by a reactor coolant pump seal cooler loss of coolant accident followed by the failure of four containment isolation valves that were not properly qualified for a harsh environment. The upper bound was shown quantitatively and/or qualitatively to be less than 1.0 x 10-5. The analyst determined that the finding did not affect the external events initiator risk and would not involve a significant increase in the risk of a large early release of radiation.

The team determined that this finding does not have a cross-cutting aspect because the most significant contributor of this finding would have occurred more than three years ago, and therefore, does not reflect current licensee performance. (Section 4OA4.1)

Green.

The team identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with non-conservative errors identified in station calculations. Specifically, the licensee failed to use the yield strength for the most limiting type steel installed in the facility when evaluating changes to the chemical and volume control system, and failed to ensure that the acceptance criteria used for seismic anchors and supports verified that they were within the design requirements. The licensee performed an operability determination for the affected areas that established a reasonable expectation for operability pending final resolution of the problems.

This issue was entered into the licensees corrective action program as Condition Report CR 2013-2857.

The use of non-conservative values in station design analyses is a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it is associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees use of non-conservative yield strength to analyze the pipe break loads during a high energy line break resulted in a condition where structures, systems, and components necessary to mitigate the effects of a high energy pipe break may not have functioned as required. Additionally, the failure to use appropriate acceptance criteria resulted in a condition where structures, systems and components may not have functioned as designed during a seismic event. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, the inspectors determined that the finding was of very low safety significance (Green) because the finding: (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The finding has a cross-cutting aspect in the area of human performance associated with the resources component because the licensee failed to maintain long term plant safety by maintenance of design margins.

Specifically, Calculation FC 07885 failed to use the most limiting yield strength when determining potential pipe break loads which resulted in a reduction of design margin H.2(a). (Section 4OA4.2)

Green.

The team identified three examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVII, Quality Assurance Records, associated with the licensees failure to furnish evidence of an activity affecting quality. Specifically, the licensee failed to maintain records demonstrating that:

the temperature limits for structural concrete in the Auxiliary building would not be exceeded during a high energy line break event, that the predicted flood level in Room 81 during a high energy line break event would not affect required equipment, and that electrical splices inside of the containment were installed in accordance with the plant and the vendor installation instructions. The licensee performed an operability determination for the deficiencies that established a reasonable expectation for operability pending final resolution of the problems.

The licensee entered these deficiencies into their corrective action program for resolution as Condition Reports CR 2013-22556, and CR 2013-12359.

The licensees failure to furnish evidence of completing analyses or maintaining records for the flood level in Room 81 during a high energy line break event, the structural concrete temperatures in the Auxiliary building, and electrical splice installations, is a performance deficiency. This performance deficiency was determined to be more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Inspection Manual Chapter 0609,

Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Initial Screening and Characterization of Findings, dated July 1, 2012, the inspectors determined that the finding was of very low safety significance (Green) because the finding: (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The team determined that this finding does not have a cross-cutting aspect because the most significant contributor of this finding would have occurred more than three years ago, and therefore, does not reflect current licensee performance. (Section 4OA4.3)

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, Corrective Actions, associated with the licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building. Specifically, the team could not locate the analyses for water level in Room 81 following a high energy line break in the room. This deficiency had previously been identified by the licensee and entered into its corrective action program, however, it was improperly closed without completing the analysis. The licensee performed operability assessments for the affected areas that established a reasonable expectation for operability pending final resolution of the problems. The licensee entered this deficiency into their corrective action program for resolution as Condition Report CR 2013-11831.

The licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the licensee failed to take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding: (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c).

(Section 4OA4.4)

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, involving the failure to use conservative inputs.

Specifically, the licensee failed to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition. The licensee performed an operability determination for the affected areas that established a reasonable expectation for operability pending resolution of the problems. The licensee entered this deficiency into their corrective action program for resolution as Condition Report CR 2013-14504, and CR 2013-14168.

The failure to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the performance deficiency called into question the availability and reliability of components required to mitigate the effects of a high energy line break. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:

(1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The team determined this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component involving the failure to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).

(Section 4OA4.5)

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system. Specifically, the licensee implemented a modification to the facility that placed vent holes in the steam supply line guard piping for the steam driven auxiliary feedwater pump which were located below the evaluated flood height in Room 81 and potentially rendered the pump inoperable. The licensee implemented a facility modification to protect the vent holes from water intrusion. The licensee entered this deficiency into their corrective action program for resolution as Condition Reports CR 2013-18308 and CR 2013-18605.

The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined this finding to be of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which remained functional for the vast majority of sequences.

This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).

(Section 4OA4.6)

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system. Specifically, the licensee implemented a modification to the facility that involved the installation of flood barriers surrounding the guard pipes and portions of the steam driven auxiliary feedwater pump steam supply lines that are below the evaluated flood height in Room 81. This modification would have acted like a catch basin and potentially caused the steam driven auxiliary feedwater pump (FW-10) to be inoperable during a high energy line break event. The licensee implemented a facility modification to protect the steam supply piping and vent holes from water intrusion. The licensee entered this deficiency into their corrective action program for resolution as Condition Report CR 2013-22770.

The failure to maintain design control of the auxiliary feedwater system was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the flood barrier installed only protected the FW-10 steam supply from flood waters rising from the floor; however, this water is postulated from a high energy line break, which would both spill onto the floor and spray into Room 81 without regard for direction. This resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A,

The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which remained functional for the vast majority of sequences.

The finding was determined to have a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action component because the licensee did not take appropriate corrective actions to address safety issues, in that, an additional modification was required to protect the FW-10 steam supply from the effects of a high energy line crack or break P.1(d). (Section 4OA4.7)

REPORT DETAILS

4OA4 IMC 0350 Inspection Activities

The inspection team conducted NRC Inspection Manual Chapter 0350 inspection activities, which include follow-up on the Restart Checklist contained in Confirmatory Action Letter (CAL) EA-13-020 issued February 26, 2013. The purpose of this inspection was to perform an assessment of the causes of the performance decline at Fort Calhoun Station (FCS), to assess whether planned corrective actions are sufficient to address the root causes and contributing causes and to prevent their recurrence, and to verify that adequate qualitative or quantitative measures for determining the effectiveness of the corrective actions are in place. These assessments were used by the NRC to independently verify that plant personnel, equipment, and processes were ready to support the safe restart and continued safe operation of the Fort Calhoun Station that occurred in December 2013.

The team used the criteria described in baseline and supplemental inspection procedures, various programmatic NRC inspection procedures, and Inspection Manual Chapter 0350 to assess Omaha Public Power Districts (the licensee) performance and progress in implementing its performance improvement initiatives. The team performed on-site and in-office activities, which are described in more detail in the following sections of this report. This report covers inspection activities from July 8, 2013 through October 15, 2014. Specific documents reviewed during this inspection are listed in the attachment.

The following inspection scope, observations and findings, and assessments, are documented by Confirmatory Action Letter Restart Checklist (CL) item number.

1. Adequacy of Significant Programs and Processes

Section 3 of the Restart Checklist addressed major programs and processes in place at the Fort Calhoun Station. Section 3 reviews also included an assessment of how the licensee addressed the NRC Inspection Procedure 95003 key attributes as described in Section 5.

Item 3.b.2: High Energy Line Break Program and Equipment Qualifications

(1) Inspection Scope a. The team independently assessed the licensees actions associated with reconstitution of the high energy line break and electrical equipment qualification programs. Specifically, the team reviewed the causal analyses, reconstituted calculations, and supporting documents to ensure the plant was within the license and design basis for high energy line break effects. (CL Items 3.b.2)

b. Open items (Licensee Event Reports) related to the electrical equipment qualification and high energy line break programs were reviewed by the team. The team verified the adequacy of the licensees causal analyses and extent of condition evaluations.

In addition, the team verified that adequate corrective actions were identified

associated with the licensees root and contributing causes and extent of condition evaluations, and that, implementation of these corrective actions are either implemented or appropriately scheduled for implementation.

(2) Observations and Findings a. High Energy Line Break Reconstitution A previous NRC team inspection, NRC Inspection Report 05000285/2013008, noted that while the analysis associated with the licensees high energy line break reconstitution program appeared to be adequate, and when all of the proposed modifications were completed should serve to demonstrate regulatory compliance, the licensee had not adequately determined the cause of the electrical equipment qualification and high energy line break programs deficiencies and implement corrective actions to prevent recurrence. The team also noted that the licensees equipment qualification program was not ready for inspection.

This NRC inspection performed an in-depth assessment of the facilities actions associated with reconstitution of the high energy line break and equipment qualification programs, and the associated design changes and modifications.

Determine that the problem was evaluated using a systematic methodology to identify the root and contributing causes.

The team determined that the licensee evaluated the identified issues using a systematic methodology to identify the root and contributing causes.

Root Cause Analysis 2013-01796 employed the use of event and causal factor charting, barrier analysis, and comparative timeline. The licensee identified the following as the root cause for why code requirements for CVCS piping were exceeded:

FCS construction project management failed to ensure that initial construction procedures for design and installation of small bore piping systems and supports specified analyses that put FCS in full compliance with USAS B31.7.

The licensees root cause analysis also identified the following contributing causes:

CC-1: Fort Calhoun Station did not recognize the value of detailed and comprehensive small bore piping and support analyses when the generic methodology was repeatedly challenged from initial construction to 1993.

CC-2: From 1993 to present, Fort Calhoun Station performed inadequate engineering analyses to demonstrate small bore piping and supports meet code compliance. These deficiencies were related to engineering judgments.

CC-3: Fort Calhoun Station did not effectively use the corrective action program to resolve issues identified with the station small bore piping.

The team determined that these root and contributing causes reasonably explain why the code requirements for CVCS piping were exceeded. Specifically the team

determined that the corrective actions to replace all of the CVCS piping with butt welded piping and completing piping stress and thermal fatigue analysis would be adequate to address this problem.

Root Cause Analysis 2013-2857 stated that the analytical methods used during the investigation included event and causal factor charting and fault tree analysis. The licensee identified the following as the root causes and contributing cause for the electrical equipment qualification, and high energy line break programs deficiencies.

RC-1: Fort Calhoun Stations response to IE Bulletin 79-01B made inaccurate and simplifying assumptions, without supporting documentation, that compromised the validity and scope of the electrical equipment qualification program, ultimately resulting in the program being non-compliant with 10 CFR 50.49.

RC-2: The electrical equipment qualification program has unique processes that are not integrated into the engineering change process; creating an unnecessary burden on the electrical equipment qualification coordinator, and affecting the sustainability of the electrical equipment qualification program.

CC-1: Engineering has not effectively resolved items identified in the corrective action program.

The team determined that these root and contributing causes reasonably explain why the electrical equipment qualification and high energy line break programs were deficient. The team identified a finding, VIO 05000285/2013018-01, Failure to Correctly Translate Design Requirements into Installed Plant Configuration, which is further discussed in Section 5 of this report.

Root Cause Analysis 2012-07724 employed the use of event and causal factor charting, barrier analysis, cause and effect tree and comparative timeline. The licensee identified the following as the root and contributing causes for why code requirements for thermal fatigue for the chemical and volume control system piping were exceeded:

RC: OPPD Engineering Personnel did not understand the significance of thermal fatigue analysis requirements in draft USAS B31.7, overly relied on Architectural Engineer guidance, and did not have a process in place to prevent the original chemical and volume control system piping design from excluding the cyclical analysis requirements of USAS B31.7.

CC-1: Fort Calhoun Station Calculation FC06484, Resolution of Design Basis Open Items 122 and 145 prescribed that Class I pressurizer spray piping be a representative subsystem for the Class I chemical and volume control system piping.

CC-2: Fort Calhoun Station personnel adopted an approach to credit current calculations, whenever possible, to close design basis document (DBD) action items.

CC-3: PED-QP-3, Calculation Preparation, Review and Approval did not require verification of the vendor calculation assumptions, inputs and conclusions in Fort Calhouns Station Calculation FC06484.

The team determined that these root and contributing causes reasonably explain why the thermal fatigue code requirements for chemical and volume control system piping were exceeded. Specifically, the team determined that the corrective actions to replace all of the CVCS piping with butt welded piping and completing piping stress and thermal fatigue analysis would be adequate to address this problem.

Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem.

The team determined that the root cause analyses were conducted to a level of detail commensurate with the significance of the problems. Specifically, as discussed above, the licensee conducted the evaluations not only by using event and causal factor charting, barrier analysis, and comparative timeline, but also by conducting interviews, and reviewing documents. The licensees root cause analyses techniques were generally thorough and identified the root and contributing causes of deficiencies.

Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience.

The team determined that the root cause analyses included evaluations of both internal and industry operating experience. The team determined that the licensees evaluations of industry operating experience provided sufficient detail such that general conclusions could be established regarding any similarities.

Determine that the root cause evaluation addressed the extent of condition and the extent of cause of the problem.

For extent of condition, the licensee evaluated the extent to which the actual condition exists with other plant equipment. The licensees analyses used the same-same, same-similar, similar-same, and similar-similar evaluation method.

For Root Cause Analysis 2013-01796 the licensee concluded that an extent of condition does exist for small bore safety-related piping supports. However, the licensee did not include large bore piping in the extent of condition. The team questioned if elimination of large bore piping was appropriate given the non-conservative engineering judgment and assumptions documented in other piping stress calculations and thermal stress evaluations. The team identified a finding, NCV 05000285/2013018-02, Use of Non-conservative Values in Design Analyses, which is further discussed in Section 5 of this report.

For Root Cause Analysis 2013-02857 the licensee concluded that an extent of condition exists for programs that do not implement their individual requirements.

For Root Cause Analysis 2013-07724 the licensee concluded that an extent of condition does exist for the following Class I piping systems that do not have a thermal fatigue analysis of record:

• Primary Plant Sampling

• Reactor Coolant Gas Vent

• Reactor Coolant

• Safety Injection

• Waste Disposal

For extent of cause, the licensee reviewed the root cause of an identified problem to determine where it may have impacted other plant processes, equipment, or human performance.

For Root Cause Analysis 2013-01796, the licensee determined that an extent of cause does exist related to structures, systems and components, and processes that could have been adversely affected by piping designs, and the licensee is not in full compliance to the code of record. Identified gaps between the licensing basis and full code compliance were one of the focus areas in the design basis root cause analysis. The following root cause analyses were completed to address licensing and design basis: CR 2012-08125, Engineering Design / Configuration Control (FPD), CR 2012-19723, Failure to Maintain Design Basis Documents, and CR 2013-05570, Engineering Design and Licensing.

For Root Cause Analysis 2013-02857, the licensee determined that an extent of cause did not exist for RC-1 or RC-2.

For Root Cause Analysis 2013-01796, the licensee determined that an extent of cause does exist related to structures, systems and components, and processes that could have been adversely affected by piping designs. The following root cause analyses were completed to address licensing and design basis: CR 2012-08125, Engineering Design / Configuration Control (FPD), CR 2012-19723, Failure to Maintain Design Basis Documents, and CR 2013-05570, Engineering Design and Licensing. The licensees evaluation determined a revision of PED-GEI-3 is recommended to incorporate thermal fatigue considerations for Class I piping, and the review of the code reconciliation between USAS B31.7 and ASME III (CA-6) for other areas if CVCS did not find any additional Class 1 piping that did not comply with USAS B31.7. The licensee determined that an operability determination was required for the following systems prior to plant heat up:

• Primary Plant Sampling

• Reactor Coolant Gas Vent

• Reactor Coolant

• Safety Injection

• Waste Disposal

The team determined that open questions relating to the reclassification of safety related piping in the 1990s are currently being reviewed. The team determined that the licensees corrective actions would only be effective once verification of the Class I and II piping is completed.

Determine that the root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in IMC 0310.

The team determined that the licensees root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in Inspection Manual Chapter 0310. Specifically, the licensee documented their consideration of the Inspection Manual Chapter 0310 cross-cutting aspects in 6 of RCA 2013-01796, Attachment 12 of RCA 2013-02857, and 7 of RCA 2012-07724.

For Root Cause Analysis 2013-02857, the licensee identified several cross-cutting aspects in the areas of human performance, problem identification and resolution, and other components.

For Root Cause Analysis 2013-01796, the final evaluation concluded that the safety culture attributes were not applicable.

For Root Cause Analysis 2012-07724, the final evaluation concluded that the safety culture attributes were not applicable.

The team determined that the licensees assessment appropriately considered the safety culture components described in IMC 0310.

Determine that appropriate corrective actions are specified for each root and contributing cause.

The team reviewed the licensees corrective actions for each of the identified root and contributing causes. The team found that the corrective actions addressed the root and contributing causes.

For Root Cause Analyses 2013-01796 and 2012-07724, the team noted that the corrective actions focused primarily on engineering procedures, and updating the licensing basis to bring it into compliance with code requirements. The team noted that a lot of the corrective actions have been rescheduled. In addition, questions related to the reclassification of safety related piping in the 1990s are currently being reviewed. The team determined that the licensees corrective actions would only be effective once verification of the Class I and II piping is completed.

The team determined that the licensees efforts to reconstitute the high energy line break and electrical equipment qualification programs had missed opportunities to identify nonconformances and the use of non-conservative calculation inputs.

Specifically, during the inspection the team identified the following issues:

• NCV 05000285/2013018-03, Failure to Furnish Evidence of Activities Affecting Quality

• NCV 05000285/2013018-04, Failure to Promptly Identify and Correct Inadequate Internal Flooding Analysis

• NCV 05000285/2013018-05, Use of Non-Conservative Inputs in Thermal Lag Analyses

• NCV 05000285/2013018-06, Failure to Recognize Adverse Design Changes

These findings are further discussed in Section 5 of this report.

Determine that a schedule has been established for implementing and completing the corrective actions.

The team determined that a schedule has been established for implementing and completing the corrective actions. The team found that corrective actions to prevent recurrence had been scheduled or implemented which included procedures changes and implementation of necessary training for engineers. Additionally, corrective actions to address the contributing causes had been scheduled. The team determined that that licensees schedule for implementing corrective actions appeared to be commensurate with the significance of the issues they are addressing.

Determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

The team determined that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.

For Root Cause Analysis 2013-01796, the licensee established, in part, an effectiveness review consisting of modification reviews of design products completed after implementation of the corrective actions to prevent recurrence to determine if modification packages included pipe stress and piping support analysis.

For Root Cause Analysis 20132857, the licensee established, in part, self-assessment requirements for the electrical equipment qualification program, and completed work order reviews for environmentally qualified equipment to ensure that maintenance did not invalidate equipment qualification.

For Root Cause Analyses 2012-07724, the licensee established, in part, an effectiveness review consisting of modification reviews of design products completed after implementation of the corrective actions to prevent recurrence to determine if modification packages included thermal fatigue analysis and piping support analysis.

The licensee also implemented interim actions for the corrective actions to prevent recurrence that would not be completed until 2018. The interim actions will review design basis reconstitution milestones to ensure the licensee is on track for completing corrective actions to prevent recurrence. The interim effectiveness actions also will review the procedure and training changes to ensure they are in compliance with current guidelines.

The team determined that the licensees effectiveness criteria did meet the criteria established in Procedure FCSG 24-7, Effectiveness Review of Corrective Actions to

Prevent Recurrence (CAPRs), Revision 1, in that the effectiveness review specified specific success criteria.

b. The NRC reviewed the licensees causal analyses, corrective actions, and extent of condition associated with Licensee Event Reports 2012-017, Containment Valve Actuators Design Temperature Ratings Below those Required for Design Basis Accidents, 2013-011, Inadequate Design for High Energy Line Break in Rooms 13 and 19 of the Auxiliary building, 2013-015, Unqualified Coating used as a Water Tight Barrier in Rooms 81 and 82, and 2013-016, Reporting of Additional High Energy Line Break Concerns. In addition, the team verified that adequate corrective actions were identified associated with the causes and extent of condition evaluations and that implementation of these corrective actions were either implemented or appropriately scheduled for implementation.

(3) Assessment a. The NRC performed an independent assessment of the licensees actions associated with reconstitution of the high energy line break and electrical equipment qualification programs. Based on these reviews, the team concluded that the licensees analyses, design changes, and modifications associated with the reconstituted programs were adequate and demonstrated regulatory compliance.

The team concluded that the licensee continues to demonstrate weaknesses with regard to identifying nonconforming conditions, and recognizing the use of non-conservative inputs into design calculations. The team noted that these areas are being addressed by the licensee under long term corrective actions that will be reviewed by the NRC during future inspections.

The following Restart Checklist Items were closed:

3.b.2.1 Licensee assessment of high energy line break program and equipment qualifications 3.b.2.2 Adequacy of extent of condition and extent of causes 3.b.2.3 Adequacy of corrective actions 4.5.1.8 Complete EEQ Harsh Environment analysis for Room 13 crack in Steam Generator Blowdown system 4.5.1.9 Develop plan to address Room 13 EEQ harsh environment qualification of electrical equipment 4.5.1.10 Initiate actions to resolve Room 13 EEQ harsh environment qualification of equipment which must be addressed prior to leaving cold shutdown 4.5.1.11 Resolve Room 13 EEQ harsh environment qualification of equipment which must be addressed prior to leaving cold shutdown 4.5.1.12 Perform analysis to address HCV-1385/1386 Main Steam Line Break/Feedwater isolation concern (CR 2011-6757)4.5.1.13 Implement resolution of HCV-1385/1386 Main Steam Line Break/Feedwater isolation concern

b. Licensee Event Reports 2012-017-2, Containment Valve Actuators Design Temperature Ratings Below those Required for Design Basis Accidents, 2013-011-0, Inadequate Design for High Energy Line Break in Rooms 13 and 19 of the Auxiliary building, 2013-015-1, Unqualified Coating used as a Water Tight Barrier in Rooms 81 and 82, and 2013-016-0, Reporting of Additional High Energy Line Break Concerns, are closed.

Item 3.c: Design Changes and Modifications

(1) Inspection Scope A previous NRC team inspection, NRC Inspection Report 05000285/2013008, had performed a limited scope review of Modification EC 53202, Modify Piping and Supports for FW-10 MS Supply for HELB Concerns, Revision 0, looking only at the modification package, since the in-plant modification was not completed at the time of this inspection. The team determined that it appeared that the licensee had appropriately evaluated the modification package, but pending installation and acceptance of this modification and follow-up assessment by the NRC, Restart Checklist Item 3.c would remain open.

This NRC inspection team performed an in-depth assessment of the licensees actions that were taken to address design changes and modifications to the facility.

These items are listed in the Fort Calhoun Station Flooding and Recovery Action Plan, Revision 3, dated July 9, 2012. Specifically, the team assessed the effectiveness of the licensees implementation of changes to facility structures, systems, and components, evaluations required by 10 CFR 50.59, and the Updated Safety Analysis Report, to provide assurance that changes implemented by the licensee have been appropriately implemented. (CL Item 3.c)

(2) Observations and Findings The team performed an independent review of the modifications implemented by the licensee to correct deficiencies identified during the reconstitution of the high energy line break and electrical equipment qualification programs. During this review, the team assessed the effectiveness of the licensees process for preparing the modifications; the associated evaluations required by 10 CFR 50.59, the implementation of the modifications, and how required updates to the Updated Safety Analysis Report were identified for incorporation.

The team determined that during the implementation of Modification EC 53202, the licensee failed to identify non-conformances and the use of non-conservative calculation inputs. Specifically, during the inspection the team identified the following issue:

• NCV 05000285/2013018-07, Failure to Maintain Design Control of the Auxiliary Feedwater System This finding is further discussed in Section 4 of this report.

(3) Assessment Results The team concluded, based on their reviews of the licensees modifications, and actions taken to address the identified deficiencies, that this area had been adequately addressed by the licensee.

The following Restart Checklist Items were closed:

4.5.1.1 Review of EC 53202; FW-10 Steam Line HELB Modification 4.5.1.2 Final SMART Review of EC 53202; FW-10 Steam Line HELB Modification 4.5.1.3 Plant Review Committee review of EC 53202; FW-10 Steam Line HELB Modification 4.5.1.4 Develop Construction Work Orders for EC 53202; FW-10 Steam Line HELB Modification 4.5.1.5 Complete installation of EC 53202; FW-10 Steam Line HELB Modification 4.5.1.6 Prepare EC 52662; Add a new Pipe Support on the SGBD vertical line above FW-1020 4.5.1.7 Install EC 52662; Add a new Pipe Support on the SGBD vertical line above FW-1020

1. Failure to Correctly Translate Design Requirements into Installed Plant Configuration

Introduction.

The team identified a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structure, systems and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from initial construction through October 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break.

Description.

The team reviewed the licensees efforts to reconstitute the stations design analyses for the high energy line break program. During this review, the team determined that the licensee had failed to ensure that design requirements were correctly translated into installed plant equipment.

On December 18, 1972, and January 22, 1973, the NRC sent letters to the licensee requesting a detailed design evaluation to substantiate that the design of the Fort Calhoun Station was adequate to withstand the effects of a postulated rupture in any high energy fluid piping systems outside the primary containment.

On March 14, 1973, the licensee submitted their response to the NRC letters referenced above. In their response, the licensee identified the essential structures and equipment required for a safe shutdown which could be damaged by a pipe rupture, and stated that

the main steam and main feedwater systems had been identified as the major high energy systems which had the greatest potential to inhibit safe shutdown in the event of a postulated pipe rupture. The licensee also stated that evaluations would continue to complete the analysis of the effects of a rupture in high energy fluid piping systems. On March 15, 1973, the licensee submitted their final response to the NRC letters. In this response, the licensee identified other piping systems as non-major high energy systems, and determined that they either had no effect on safe shutdown capability, or required deflector plates to be installed to prevent jet impingement on electrical cables.

On May 31, 1978, the NRC Office of Inspection and Enforcement (IE) issued IE Circular 78-08, "Environmental Qualification of Safety-Related Electrical Equipment at Nuclear Power Plants," which requested all licensees of operating plants to examine their installed safety-related electrical equipment that are required to function under postulated accident conditions. On February 8, 1979, the NRC issued IE Bulletin 79-01, which was intended to raise IE Circular 78-08 to the level of a Bulletin (i.e., action requiring a licensee response). This Bulletin required a complete re-review of the environmental qualification of safety-related electrical equipment as described in IE Circular 78-08. Subsequently, on January 14, 1980, the NRC issued IE Bulletin 79-01B which expanded the scope of IE Bulletin 79-01 and requested additional information on environmental qualification of safety-related electrical equipment at operating plants.

On March 3, 1980, the licensee submitted their response to IE Bulletin 79-01B. In this letter, the licensee stated that only the main steam and main feedwater line breaks could cause accident conditions that would challenge safety related electrical equipment. It stated that all other systems had been excluded from review because they did not affect the ability to bring the unit to safe shutdown. This response formed the licensees basis for the stations environmental qualifications, and superseded their high energy pipe rupture response letter dated March 15, 1973.

In August 2007, the licensee initiated Condition Reports CR 2007-02715 and CR 2008-01186, to document issues with the electrical equipment qualification and high energy line break programs. As a result, the licensee performed a focused self-assessment (FSA-07-47) to evaluate the stations environmental qualification program as it relates to the industries best practices. During this assessment, the licensee identified that the station did not meet industry best practices, and the stations response to IE Bulletin 79-01B had made inaccurate simplifying assumptions with regard to high energy piping systems failures.

The licensee ultimately determined that all regulatory requirements were currently being met by the program; the issue was a failure to meet industry best practices. The licensee subsequently performed a root cause analysis to determine why the stations electrical equipment qualification program (this includes the high energy line break program) did not meet industry standards. The licensee determined the root cause of this issue to be, organizational changes caused a loss of knowledge transfer and documentation which was exacerbated by; the historical design basis documents not always being retrievable and auditable, and there being no rigorous review of the environmental qualification program since the early 1990s. The licensees corrective actions focused on complying with industry best practices.

The team noted that the licensee continued to document programmatic weaknesses and documentation deficiencies associated with the electrical equipment qualification and high energy line break programs in the corrective action program. As these issues were resolved, the licensee discovered additional issues with the programs, including lack of design bases analyses, and equipment configuration qualification issues. Based on this, the licensee had recognized the need to reconstitute the electrical equipment qualification and high energy line break programs, and initiated the electrical equipment qualification program corrective action project in 2008. The team noted that this project was being performed outside of the stations corrective action program. As a result of this observation by the team, the licensee initiated Condition Report CR 2013-2857 to evaluate the cause of the programmatic breakdown and correct this issue.

The team reviewed the licensees root cause analyses and noted that the licensee had determined that the causes of the programmatic break downs to be:

RC-1: Fort Calhoun Stations response to IE Bulletin 79-01B made inaccurate and simplifying assumptions, without supporting documentation, that compromised the validity and scope of the electrical equipment qualification program, ultimately resulting in the program being non-compliant with 10 CFR 50.49.

RC-2: The electrical equipment qualification program has unique processes that are not integrated into the engineering change process; creating an unnecessary burden on the electrical equipment qualification coordinator, and affecting the sustainability of the electrical equipment qualification program.

The team determined that this issue had resulted in a condition where twenty four areas in the facility that contained high energy piping had not been evaluated for the effects of a rupture in this piping to ensure that the structures, systems, and components necessary to bring the reactor to safe shutdown following a high energy line break were qualified to be able to perform their specified safety function. Specifically, multiple system components affecting:

• auxiliary feedwater

• charging

• containment isolation

• containment cooling; and

• shutdown cooling

may not have functioned as designed following a high energy line break. A detailed listing of affected equipment is contained in Attachment 3 of this document.

The licensee addressed this deficiency by reconstituting the design analysis associated with the programs, receiving a change to the facilities licensing basis, and implementing plant modifications.

Analysis.

The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that

respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where structures, systems, and components necessary to mitigate the effects of a high energy pipe break may not have functioned as required.

The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because it was a deficiency affecting the design and qualification of a mitigating structure, system, or component that resulted in a loss of operability or functionality and represented a loss of system and/or function.

The Region IV senior reactor analyst performed a detailed risk evaluation in accordance with Appendix A, Section 6.0, Detailed Risk Evaluation. The evaluation concluded the finding was best characterized as having low to moderate safety significance (White).

The minimum calculated change in core damage frequency of 4.1 x 10-6 was dominated by a reactor coolant pump seal cooler loss of coolant accident followed by the failure of four isolation valves containing inappropriate elastomers. The upper bound was shown quantitatively and/or qualitatively to be less than 1.0 x 10-5. The analyst determined that the finding did not affect the external events initiator risk and that the finding would not involve a significant increase in the risk of a large early release of radiation.

The team determined that this finding does not have a cross-cutting aspect because the most significant contributor of this finding would have occurred more than three years ago, and therefore, does not reflect current licensee performance.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from initial construction through October 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break.

The licensee addressed this deficiency by implementing plant modifications and receiving a change to the facilities licensing basis. This finding is associated with a Notice of Violation attached to this report: VIO 05000285/2013018-01, Failure to Correctly Translate Design Requirements into Installed Plant Configuration.

2. Use of Non-conservative Values in Design Analyses

Introduction.

The team identified two examples of a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with non-conservative errors identified in station calculations.

Description.

The team identified two examples where the licensee had non-conservative inputs used in station design analyses.

Example 1: The team reviewed Calculation FC07885, Stress Analysis for Small Bore Piping on Isometric CH4106 High Energy Line Break Assessment, which compared ASME Section III requirements to the requirements of USAS B31.7 for the chemical volume control system small bore piping and supports. This analysis was performed to ensure the piping was capable of withstanding a high energy line break event. During their review the team determined that the calculation did not use the most conservative yield strength between USAS B31.7 and ASME Section III. Specifically, Calculation FC07885 identified that steel type SA312 TP304 had a yield strength (Sy) of 18,900 lbs/in2 and type SA376 TP316 had a yield strength (Sy) of 20,900lbs/in2.

However, the licensee had used the less conservative yield strength of 20,900 lbs/in2 to calculate potential pipe break locations. The team determined that this was non-conservative and informed the licensee of their concerns.

The licensee initiated Condition Report CR 2013-13743 to capture this issue in the stations corrective action program. This does not represent an immediate safety concern because the licensee performed an operability determination for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issue.

Example 2: The team reviewed Calculation FC07234, Evaluation of Shutdown Cooling Mode Temperature and Pressure increase on the SI System Piping and Pipe Supports, Revision 0, which had been prepared to analyze the shutdown cooling system piping and supports because of changes to the entry conditions. During this review, the team determined that the calculation contained the following non-conservative errors:

• The analyses identified an instance where an analyzed piping node exceeded pipe allowable stresses. However, the licensee had instituted non-conservative acceptance criteria that allowed this node to be accepted. Specifically, a finite analysis was used to lower the stress intensification factor for a pipe tee in subsystem SI-191A. This was not fully bounded by the design specifications of the system.

• The calculation allowed the use of piping support displacement criteria which was contrary to the facilities current licensing basis. Specifically, the calculations criterion for additional evaluation for thermal and seismic anchor movements was 1/8 of an inch. However, the stations current licensing basis required that additional evaluation for seismic anchor or support movement be performed at 1/16 of an inch.

• The calculation determined that a pipe support, SIH-243, would experience uplift which would exceed the allowable stress for that support. However, this was determined to be acceptable because the load would distribute to other supports, SIH-8 and SIH-9, and would be within faulted capacities of these supports. The team determined that this was non-conservative because piping supports are required to meet stress allowables for all normal required loadings without crediting faulted load (accident) allowables.

The licensee initiated Condition Reports CR 2013-18639, CR 2013-18253, CR 2013-18086, CR 2013-14637, and CR 2013-18390 to capture these issues in the stations corrective action program. This does not represent an immediate safety concern because the licensee performed an operability determination for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issues.

The team determined the cause of these issues was that the licensee had failed to recognize the use of non-conservative inputs into design analyses, which resulted in a reduction in design margin for the systems.

Analysis.

The use of non-conservative values in station design analyses is a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees use of non-conservative yield strength to analyze the pipe break loads during a high energy line break resulted in a condition where structures, systems, and components, necessary to mitigate the effects of a high energy pipe break, may not have functioned as required, and the failure to use the correct acceptance criteria resulted in a condition where structures, systems, and components may not have functioned as designed during a seismic event. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:

(1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program.

The finding has a cross-cutting aspect in the area of human performance associated with the resources component because the licensee failed to maintain long term plant safety by maintenance of design margins. Specifically, Calculation FC 07885 failed to use the most limiting yield strength when determining potential pipe break loads which resulted in a reduction of design margin H.2(a).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculation methods, or by the performance of a suitable testing program.

Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from August 2007 through October 2013, Station

Calculations FC07234 and FC07885 contained non-conservative inputs which resulted in the analyses failing to demonstrate that design requirements were met. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-13743, CR 2013-18639, CR 2013-18253, CR 2013-18086, CR 2013-14637, and CR 2013-18390. (NCV 05000285/2013018-02, Use of Non-conservative Values in Design Analyses)

3. Failure to Furnish Evidence of Activities Affecting Quality

Introduction.

The team identified three examples of a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVII, Quality Assurance Records, associated with the licensees failure to furnish evidence of an activity affecting quality.

Description.

The team identified three examples of the licensees failure to maintain quality records.

Example 1: Guard pipes surround the steam driven auxiliary feedwater pumps (FW-10)steam supply lines and protect safety-related equipment in the event of a FW-10 steam supply line break. The guard pipes are embedded in the concrete floor of Room 81, and are therefore considered penetrations. The concrete has specific temperature limitations based upon normal operations and accident or short-term operations. The guard pipes have cooling fins to aid in dissipating heat from the steam supply lines to the environment to maintain the temperature of the concrete surrounding the guard pipes within limits.

While reviewing Engineering Change 62391, FW-10 Steam Supply Line A and B Flood Barriers, Revision 0, the team noted that the Engineering Review Group had identified that no calculation was found for the cooling fins for guard pipes AE-31 and AE-32, but the Engineering Review Group failed to enter this deficiency into the corrective action program.

The team questioned whether the fins were adequately sized due to other modifications regarding the guard pipes. The team informed the licensee of their concerns, and the licensee initiated Condition Report CR 2013-22556 to track formal documentation of the heat transfer capability of guard pipe AE-31 and AE-32's fins. The licensee subsequently measured the concrete temperatures surrounding the guard pipes and performed an evaluation to determine whether the concrete would remain below temperature limits during accident conditions. Both the temperature measurements and evaluation determined that the concrete would remain below limits.

The team determined that sufficient records had not been maintained to furnish evidence of activities affecting quality. Specifically:

(1) the licensee could not furnish a calculation that demonstrated the guard pipe fin sizing was adequate;

(2) a calculation would have been required to appropriately size the fins initially; and

(3) the results of the calculation directly affected the auxiliary feedwater system and the structure of the Auxiliary building.

Example 2: While reviewing the stations Environmental Qualification records the team noted that there was no documented record that demonstrated that the Raychem

Splices inside containment were installed in accordance with the specified installation instructions. The team noted that the incorrect installation of these splices could result in the ingress of the moisture into the splice which could affect the ability of the equipment to perform its specified safety functions.

The team informed the licensee of their concerns and the licensee initiated Condition Report CR 2013-14585 to capture this issue in the stations corrective action program.

During subsequent reviews, the licensee determined that the these splices had been installed and inspected as part of the stations response to Information Notice 86-53, Improper Installation of Heat Shrinkable Tubing, and the NRC had reviewed the stations response and found it acceptable. This provided a reasonable basis for operability. However, the team determined that sufficient records had not been maintained to furnish evidence of activities affecting quality.

Example 3: While reviewing Calculations EA-FC-06-032, Environmental Parameters for Electrical Equipment Qualification, Revision 0, and FC 05291, Aux Building Room 81 Flooding Analysis, Revision 0, the team questioned the basis of the maximum flood height used for environmental qualification of equipment in Room 81. Specifically, FC 05291 evaluated the effect of a modification that added an additional potential source of flooding to Room 81, and used as an input of 1.36 feet for the maximum flood level in the room due to a high energy line break. This was cited as coming from USAR, Appendix M, Postulated High Energy Line Rupture Outside Containment, Revision 12, because the original analyses was unavailable. The team reviewed Appendix M and noted that there was not an analytical basis to support the determination of a flood depth of 1.36 feet. The team requested the analyses that supported this determination and the licensee was not able to locate it. The licensee initiated Condition Report CR 2013-12359 to capture this issue in the stations corrective action program.

The licensee subsequently determined that the analyses which established the flood depth in Room 81 following a high energy line break had not been maintained. The licensee performed an operability evaluation for this issue and implemented compensatory measures pending reconstitution of the analyses. The team determined that sufficient records had not been maintained to furnish evidence of activities affecting quality.

Analysis.

The licensees failure to furnish evidence of activities which affected quality was a performance deficiency. The performance deficiency is more-than-minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the lack of evidence of calculations for concrete temperatures in the Auxiliary building and the flood height in Room 81 following a high energy line break, and records which demonstrated that the Raychem Splices inside containment were installed in accordance with the specified installation instructions, represents instances where the licensee was not able to substantiate that the design of the facility was adequate following modifications. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, the team determined that the finding was of very low safety significance (Green) because the finding:

(1) was not a deficiency affecting the design and qualification of a mitigating

structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. This finding does not have a cross-cutting aspect because the most significant contributor of this finding, which could not be determined, would have occurred prior to three years ago, and therefore, is not representative of current licensee performance.

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVII, Quality Assurance Records states, in part, that, sufficient records shall be maintained to furnish evidence of activities affecting quality. Contrary to the above, the licensee failed to maintain sufficient records to furnish evidence of activities affecting quality. Specifically, prior to December 13, 2013, the licensee was unable to furnish evidence of calculations that demonstrated that the structural concrete temperatures would remain below limits, what the flood height in Room 81 following a high energy line break would be, and records which demonstrated that the Raychem Splices inside containment were installed in accordance with the specified installation instructions. Because this finding is of very low safety significance and has been entered into the corrective action program as Condition Report CR 2013-22556, the violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy:

NCV 05000285/2013018-03, Failure to Furnish Evidence of Activities Affecting Quality.

4. Failure to Promptly Identify and Correct Inadequate Internal Flooding Analysis

Introduction.

The team identified a Green, non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Actions, associated with the licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building.

Description.

While reviewing the stations high energy line break reconstitution efforts, the team noted an issue with Calculations EA-FC-06-032, Environmental Parameters for Electrical Equipment Qualification, Revision 0, and FC 05291, Aux Building Room 81 Flooding Analysis, Revision 0 (NCV 2013018-03). Specifically, the team could not locate the analyses for water level in Room 81 following a high energy line break in the room.

The team informed the licensee of their concern and during follow up discussions the team determined that the licensee had previously entered this issue in the stations corrective action program as Condition Report CR 2012-07534. Through subsequent review of this condition report the team determined that the action item associated with this issue, 2012-07534-002 RE, had been closed improperly without the issue being resolved. The team determined that the licensee had failed to promptly correct a condition adverse to quality.

The team informed the licensee of their concerns and the licensee initiated Condition Report CR 2013-12359 to capture this issue in the stations corrective action program.

This does not represent an immediate safety concern because the licensee performed

operability assessments for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issue.

Analysis.

The licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the licensee failed to take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:

(1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Contrary to the above, the licensee failed to establish measures to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances were promptly identified and corrected. Specifically, from 1989 until present, the licensee failed to properly calculate the flood level in Room 81 following a high energy line break. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Report CR 2013-11831. (NCV 05000285/2013013-04, Failure to Promptly Identify and Correct Inadequate Internal Flooding Analysis)

5. Use of Non-Conservative Inputs in Thermal Lag Analyses

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, involving the failure to use conservative inputs.

Description.

While reviewing Calculation FC 08060, Thermal Lag Analysis for Equipment in Room 81 at Fort Calhoun Station, Revision 0, the team identified four

instances where the licensee had failed to verify inputs used in the analysis.

Specifically:

1. Emissivity values for stainless steel ranges from 0.17-0.9. However, the emissivity

value used in the analysis was 0.8.

2. An assumption used in the analysis was that no equipment was within the zone of

influence of jet impingement of the High Energy Line Breaks. The team walked the area down and determined that this assumption was not correct.

3. During a walkdown of Room 81, the inspector identified that there is Rockbestos

cable Firewall III which was not evaluated in the thermal lag analysis.

4. The team identified that the process fluid temperature was not considered in the

thermal lag analysis.

The team determined that:

(1) not all of the inputs were conservative;

(2) not all the assumptions used were verified;

(3) not all of the equipment and components were analyzed; and

(4) not all of the process fluid temperatures were considered in the thermal lag analysis.

The team informed the licensee of their concerns and the licensee initiated Condition Reports CR 2013-14504 and CR 2013-14168 to capture these issues in the stations corrective action program. This does not represent an immediate safety concern because the licensee performed an operability determination for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issue.

Analyses. The failure to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the performance deficiency called into question the availability and reliability of components required to mitigate the effects of a high energy line break. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:

(1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and

(4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The team determined this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component involving the failure to use conservative

assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee failed to establish measures which assured that applicable regulatory requirements and the design bases, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from June 12, 2012, through July 2013, the licensee failed to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-14504 and CR 2013-14168.

(NCV 05000285/2013018-05, Use of Non-Conservative Inputs in Thermal Lag Analyses)

6. Failure to Recognize Adverse Design Changes

Introduction.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system.

Description.

While reviewing Engineering Change 53202, Modify Piping and Supports for FW-10 MS Supply for HELB Concerns, Revision 0, the team identified that the licensee had added vent holes to the AE-31 and AE-32 guard pipes. The guard pipes encapsulate the steam supply lines to the turbine-driven auxiliary feedwater pump (FW-10), and were installed to contain steam in the event of a break in the supply lines.

The vent holes were added to provide a relief path for this steam. However, the vent holes were located below the evaluated flood height in Room 81. Flood water, which is postulated to occur from a high energy line break in piping, such as the main steam or main feedwater systems in Room 81, could condense steam within the supply lines to FW-10, resulting in slug flow or insufficient steam quality to the turbine, rendering FW-10 inoperable.

The team informed the licensee of their concern and the licensee initiated Condition Reports CR 2013-18308 and CR 2013-18605. During an extent of condition review, the licensee identified that a portion of the FW-10 steam supply line would be below the evaluated flood height in Room 81. To address the identified issues the licensee implemented Engineering Change 62391, FW-10 Steam Supply Line A and B Flood Barriers, Revision 0, in order to protect the AE-31 and AE-32 guard pipe vent holes and steam supply lines from flood water.

The team determined that the licensee had failed to fully evaluate all impacts of adding vent holes in the guard pipes when developing the modification.

Analysis.

The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined this finding to be of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which would remain functional for the vast majority of sequences. This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from initial construction through September 26, 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-18308 and CR 2013-18605.

(NCV 05000285/2013018-06, Failure to Recognize Adverse Design Changes)

7. Failure to Maintain Design Control of the Auxiliary Feedwater System

Introduction.

The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system.

Description.

While reviewing Engineering Change 53202, Modify Piping and Supports for FW-10 MS Supply for HELB Concerns, Revision 0, the inspectors identified that the AE-31 and AE-32 guard pipe vent holes were located below the evaluated flood height in Room 81 (05000285/2013018-06).

In order to protect the steam supply lines from flood waters resulting from a high energy line break the licensee prepared Engineering Change 62391, FW-10 Steam Supply Line A and B Flood Barriers, Revision 0. This modification involved the installation of flood barriers, rectangular boxes without lids, surrounding the guard pipes and portions of the FW-10 steam supply lines that are below the evaluated flood height in Room 81.

The team reviewed Engineering Change 62391 and determined that the licensee had not evaluated the effects of water spraying into the flood barriers from a crack or break in any of the high energy systems in Room 81, which is the same source of water in the flood analysis. Major high energy systems in Room 81 include main steam and main feedwater systems. Water spraying into the flood barrier from a high energy line break in Room 81 could have the same effect as with the flood barrier not in place.

The team informed the licensee of their concerns, and the licensee initiated Condition Report CR 2013-22770 to capture this issue in the stations corrective action program.

To address the identified issues the licensee issued a Field Design Change Request to Engineering Change 62965 to add a cover to the flood barriers.

Analysis.

The failure to maintain design control of the auxiliary feedwater system was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the flood barrier installed only protected the FW-10 steam supply from flood waters rising from the floor; however, this water is postulated from a high energy line break, which would both spill onto the floor and spray into Room 81 without regard for direction. This resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which should remain functional for the vast majority of sequences. The finding was determined to have a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action component because the licensee did not take appropriate corrective actions to address safety issues, in that, an additional modification was required to

protect the FW-10 steam supply from the effects of a high energy line crack or break P.1(d).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from November 24, 2013, until December 15, 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-18308 and CR 2013-18605.

(NCV 05000285/2013018-07, Failure to Maintain Design Control of the Auxiliary Feedwater System)

A1 -

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Anderson, Manager, Design Engineering

C. Cameron, Supervisor Regulatory Compliance

L. Cortopassi, Site Vice President

E. Dean, Plant Manager

M. Ferm, Manager, System Engineering

M. Frans, Manager, Engineering Programs

H. Goodman, Site Engineering Director

M. Greeno, NRC Inspection Readiness Team Contractor

W. Hansher, Supervisor, Nuclear Licensing

R. Haug, Senior Consultant

K. Ihnen, Manager, Site Nuclear Oversight

R. Hugenroth, Supervisor, Nuclear Assessments

E. Matzke, Senior Licensing Engineer

J. McManis, Manager Engineering Programs

B. Obermeyer, Manager, Corrective Action Program

T. Orth, Director, Site Work Management

A. Pallas, Manager, Shift Operations

M. Prospero, Division Manager, Plant Operations

B. Rash, Recovery Lead

R. Short, Manager, Recovery

T. Simpkin, Manager, Site Regulatory Assurance

M. Smith, Manager, Operations

S. Swanson, Operations Director

K. Wells, Nuclear Design Engineer Design Electrical/I&C

J. Wiegand, Manager, Operations Support

G. Wilhelmsen, Exelon Nuclear Partners

J. Zagata, Reliability Engineer

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000285/2013018-01

VIO

Failure to Correctly Translate Design Requirements into

Installed Plant Configuration (Section 4OA4)05000285/2013018-02

NCV

Use of Non-conservative Values in Design Analyses

(Section 4OA4)05000285/2013018-03

NCV

Failure to Furnish Evidence of Activities Affecting Quality

(Section 4OA4)05000285/2013018-04

NCV

Failure to Promptly Identify and Correct Inadequate Internal

Flooding Analysis (Section 4OA4)05000285/2013018-05

NCV

Use of Non-Conservative Inputs in Thermal Lag Analyses

(Section 4OA4)05000285/2013018-06

NCV

Failure to Recognize Adverse Design Changes

(Section 4OA4)05000285/2013018-07

NCV

Failure to Maintain Design Control of the Auxiliary Feedwater

System (Section 4OA4)

Closed

05000285/2012-017-2

LER

Containment Valve Actuators Design Temperature Ratings

Below those Required for Design Basis Accidents

(Section 4OA4)

05000285/2013-011-0

LER

Inadequate Design for High Energy Line Break in Rooms 13

and 19 of the Auxiliary Building (Section 4OA4)

05000285/2013-015-1

LER

Unqualified Coating used as a Water Tight Barrier in Rooms

and 82 (Section 4OA4)

05000285/2013-016-0

LER

Reporting of Additional High Energy Line Break Concerns

(Section 4OA4)

CONDITION REPORTS

NUMBER

2013-12245

2013-02857

2013-12249

2013-05570

2013-11502

2013-11532

2013-08675

2012-07724

2013-05206

2013-22784

2013-15555

199600523

2011-3198

200500704

200501568

200002402

200700120

200601796

200601606

200601755

200502333

200501568

200500704

200402691

200402145

200304519

200002147

2013-21877

2013-21820

2013-20453

2013-18633

2013-18162

2013-18343

2013-18158

2013-16341

2013-14793

2013-12672

2012-00549

2011-5759

2011-4297

2011-3965

2011-3198

2009-4958

2009-3598

2009-0409

2008-2495

2008-1716

2008-1710

2007-2692

199801227

2013-01796

20184

200700702

20468

2013-21285

2013-18639

2013-18390

2013-18253

2013-18252

2013-18086

2013-14706

2013-14703

2013-14637

2013-11287

2013-09422

2013-07551

2013-06943

2012-05244

2012-05202

2012-04847

2011-4979

200101822

199802045

2008-5517

2010-5603

2013-15223

2013-04590

2013-14637

199500039

199500437

199600082

199600137

199600331

199600340

199600353

199600400

199600639

199600786

199600791

199600858

199601225

199601226

199601321

199601368

199601403

199601405

199601491

199601624

199700008

199700177

199700198

199700205

199700422

199700426

199700472

199700475

199700473

199700495

199700782

199701020

199701073

199701160

199701261

199701532

199701566

199701623

199701679

199701710

199800072

199800376

199800828

199800855

199800888

199800889

199800915

199800918

199800938

199801153

199801225

199801227

199801822

199801826

199801877

198802168

199900484

199901002

199901103

199901198

199901492

199901677

199901953

199902001

199902028

199902047

199902321

199902307

200000377

200000699

200002018

200002147

200100051

200100391

200100690

200101212

200101367

200001921

200002145

200002525

200100374

200100606

200101093

200101352

199902276

200000133

200001844

200002079

200002402

200100372

200100577

200100959

201101332

200101300

200100909

200100536

200100368

200002401

200002079

200001511

199902515

199902183

199902129

199902485

200001495

200002065

200002345

200100317

200100507

200100894

200101288

199902123

199902417

200001078

20002050

200002252

200100290

200100476

200100827

200101255

200101382

200101581

200101597

200101873

200102142

200102204

200102283

200102386

200102440

200102482

200102491

200102306

200120470

200102598

200102654

200102873

200102985

200103118

200103278

200103285

200103316

200103369

200103499

200103499

200103565

200103573

200103831

200200898

200200906

200201000

200200720

200200970

200200973

200201112

200201144

200201140

200201368

200201564

200201851

200201563

200201557

200201319

200202320

200201237

200201840

200201705

200201619

200301841

200201612

200201593

200203684

200201924

200201860

200203079

200201950

200201923

200302036

200301129

200300403

200204171

200202827

200301044

200300772

200301590

200303065

200303438

200300251

200301628

200303165

200302959

200501758

200501809

200502284

200502286

200502281

200502242

2010-2250

2012-08621

2013-02857

2011-7463

2012-15687

2013-10907

2013-05217

2013-04395

2012-07901

2012-19124

2012-10165

2012-18937

2013-14168

2013-14477

2008-1176

2011-7462

2011-7496

2011-7494

2012-01655

200302881

200302324

200303503

200303510

200303549

200303555

200303662

200303665

200304010

200303990

2007-2452

200304189

2007-0591

2007-1969

2007-3312

2007-00613

2007-00662

2007-3435

2007-0494

2007-4815

2007-4772

2007-0354

2007-2596

2007-4787

2008-0811

2007-2540

2008-2481

2008-0990

2008-1628

2007-4352

2008-2495

2008-1630

2008-1716

2008-0195

2008-2567

2008-2253

2008-2484

2008-1602

2008-2609

2008-2491

2007-2692

2008-1707

2008-2660

2008-2489

2007-4758

2008-2482

2008-2900

2008-1813

2008-0649

2007-4007

2008-3002

2008-1629

2008-1605

2007-4967

2008-3092

2008-0930

2008-1715

2008-1569

2008-3905

2007-2925

2008-2483

2008-1706

2008-4172

2011-05242

2011-05243

2013-22770

2013-22556

2013-04544

2013-02711

2007-02715

2013-20253

2011-07496

2012-08520

2012-02498

2013-13217

2012-02115

2013-02857

2013-13217

2013-19500

PROCEDURES

NUMBER

TITLE

REVISION

PED-QP-15

Electrical Equipment Qualification Program

SO-G-56

Qualified Life Program

PED-GEI-5

Electrical Equipment Qualification Evaluation

EEQ

Electrical Equipment Qualification Manual -Enclosure 1

PROCEDURES

NUMBER

TITLE

REVISION

PED-QP-2

Configuration Change Control

PED-GEI-60

Preparation Substitute Replacement Items

CALCULATIONS

FC08060

FC07885

FC08027

FC07234

FC08145

FC08025

FC06421

FC07283

EA-FC-12-205

FC04276

FC06740

FC07096

EA11-023

FC08255

FC08303

FC08302

FC08304

EA90-031

EA-FC-93-003

FC 08124

FC 05361

FC 07890

FC 08038

EA-FC-02-004

ENGINEERING CHANGES 202

54173

54335

246

2391

57139

DRAWINGS

NUMBER

TITLE

REVISION

C-4113

Subsystem #MS-4099A Aux. Feedwater Pump FW-10 Pipe

Routing From MS-383A Penetrations & Restraint Details

A

C-4114

Subsystem #MS-4099A Aux. Feedwater Pump FW-10 Pipe

Routing from MS-381A, Penetrations, & Restraints Details

D-4318

CQE Piping Isometrics - Seismic Sub. System - # MS-

4099A

MISCELLANOUS

NUMBER

TITLE

REVISION/

DATE

Technical Report 13-

0376-TR-001

Metallurgical Evaluation of Small Bore Socket Welds

Rev. 0

LIC-88-0873

NRC Bulletin 88-08, Thermal Stresses in Piping

Connected to Reactor Coolant Systems

AREVA Doc No 32-

9146950-000

Exemption from Fatigue for RCS attached Class 1 piping

for Fort Calhoun Station

AREVA Doc No 51-

9148493-000

Fort Calhoun Code Reconciliation for Class 1 Attached

Piping Reanalysis

LIC-13-0187

Fort Calhoun Station (FCS) License Amendment

December 13,

MISCELLANOUS

NUMBER

TITLE

REVISION/

DATE

Commitment - Piping Code Discrepancies

2013

EEQ-H-01

ASCO Solenoid NP Series Valves

EEQ-H-02

Namco Limit switches

EEQ-H-05

Conax Electrical Penetrations

EEQ-H-21

Rockbestos Pyrotrol Cables

EEQ-H-24

Victoreen Radiation Monitor

LER 2012-015

Electrical Equipment Impacted by HELB outside

Containment

EEQ-H-31

Graboot Connectors

EEQ-H-03

ITT Conoflow

NED-11-0098 DEN

SMART Assignment Approval for EC 53202, Modifying

Piping and Supports for FW-10 MS Supply for HELB

Concerns

August 15, 2011

WORK ORDERS

00492949-01

00199528-01

411399-01

395469-03

232

54039

54110

57732

2965

00455673

00455680

00455678

ACTION REQUEST

00060099

00060100

Detailed Risk Evaluation

Failure to Ensure Equipment Qualified for Harsh Enviroment

A2 -1

(1) The Model Revision and Other Probabilistic Risk Assessment Tools Used

The analyst utilized the Standardized Plant Analysis Risk Model for Fort Calhoun

Station, Versions 8.20 and 8.21, and hand calculation methods to quantify the risk of the

subject performance deficiency.

(2) Assumptions

1. The risk impact of the subject performance deficiency was limited to high-energy

line breaks in the rooms or areas of concern.

2. The subject performance deficiency impacted plant risk from initial reactor startup

through October 2013. Therefore, in accordance with the Risk Assessment of

Operational Events Handbook, Volume 1, Internal Events, Revision 2, Section

2.6, Exposure Time Greater than 1 Year, the maximum exposure time was set

to the 1 year assessment period.

3. The best available model for quantifying the risk for high-energy line breaks is the

Standardized Plant Analysis Risk (SPAR) model for Fort Calhoun Station, Unit 1,

Versions 8.20 and 8.21.

4. The analyst noted that neither version of the SPAR model provided for evaluation

of conditions affecting a reactor coolant pump seal cooler loss of coolant

accident. Therefore, the best available evaluation method was to create a model

specifically designed for this initiator, using the SPAR Version 8.20.

5. The best available source of information related to pipe failure rates for Fort

Calhoun Site is the EPRI Technical Report 3002000079.

6. The best available source of information related to failures of auxiliary steam

system and their potential impacts for the Fort Calhoun Station is Combustion

Engineering Nuclear Power LLC Report ST-2000-0627.

7. The failure of the diaphragms in HCV-438A and HCV-438C would be unlikely to

very unlikely upon successful cooldown by operators following a reactor coolant

pump seal cooler failure as described in the licensees white paper entitled,

Overview of RCP Seal Cooler Containment Isolation Valve Elastomer

Significance.

8. The change in core damage probability for all air-operated valves that fail upon

loss of air to their risk-significant position would be negligible given inadequate

elastomers.

9. The CDF for inadequate elastomers would be negligible for all valves that fail in

the direction that supports system function for the high-energy line break that

causes the failure.

10. The failure of hot leg injection at the Fort Calhoun Station would only impact the

plant response to a large-break loss of coolant accident.

11. The inability of operators to sample the containment environment following an

accident would not significantly impact the core damage frequency.

2. Components that exceeded their harsh environment qualification limits during a

postulated event would fail.

13. Upon failure of the elastomers in an air-operated valve, the valve would move to

the position it was designed for upon loss of instrument air.

14. Overfilling of the steam generators results in failure of Pump FW-10, Turbine-

Driven Auxiliary Feedwater Pump, via flooding of the steam supply line.

15. A break in the auxiliary steam system piping in either diesel generator room

would not result in a direct transient.

16. Following a postulated break in the auxiliary steam system piping in either diesel

generator room, the associated diesel generator would be restored to operable

status within the Technical Specification allowed outage time or the plant would

be shut down and cooled down.

17. A failure frequency of 1 x 10-3/year provides a clear upper bound for the

frequency of an auxiliary steam system pipe break in any room in the plant.

18. Upon a postulated auxiliary steam line break on the Intake Structure operating

deck the rotating screens would fail causing a loss of raw water.

19. The change in failure frequency of socket welded pipe caused by the lack of

ability to perform nondestructive examination can be bounded by increasing the

failure frequency by a factor of approximately 100.

20. Given the as-found condition of the turbine-driven auxiliary feedwater pump

steam supply piping guard pipe, a postulated failure of the supply piping would

supply steam to Room 56E in sufficient quantities to fail the 1A3 side electrical

busses in the room.

21. The licensees initiating event frequencies for main-steam line break and main

feedwater line break outside containment include a wide range of pipe break

sizes.

2. Given Assumption 21, the use of the licensees initiating event frequencies for an

evaluation of post-break flooding in Room 81 provides an upper bound.

(3) Calculation discussion

The licensee failed to correctly translate the design requirements associated with high-

energy line breaks into structures, systems, and components necessary to bring the

reactor to safe shutdown. The analyst determined that this performance deficiency

affected plant risk in three ways. Specifically:

(1) Fifty-eight air-operated valves had diaphragms and/or other elastomers that

were not qualified for the harsh environment they would be subjected to

following a postulated accident and/or high-energy line break. The

characterization of each of these valves is documented in Table 1.

(2) Nineteen areas in the plant contained auxiliary steam system piping. The

licensee had not evaluated these areas for breaks in the auxiliary steam

system piping, resulting in some components not being capable of

withstanding such an environment. The plant areas and the functional

groups identified for these areas are documented in Table 4.

(3) Five areas in the plant contained high-energy piping that had not been

evaluated for breaks. As a result, multiple risk-significant components were

not properly protected or qualified for the resulting harsh environment. The

characterization of these areas is documented in Table 5.

Evaluation 1: Air-Operated Valves with Inappropriate Elastomers

The licensee identified 58 air-operated valves had diaphragms and/or other

elastomers that were not qualified for the harsh environment they would be

subjected to following a postulated accident and/or high-energy line break. The

analyst identified similarities among various valves and grouped them into nine

functional groups to simplify the analysis. The functional groups and

characterization of these valves are documented in Table 1.

Table 1

Air-Operated Valves Containing Inappropriate Elastomers

Valve

Description

Location

Group Frequency

(per year)

Bounding

CCDF

CDF

CCW INLET INBOARD ISO VALVE

Total Change in Core Damage Frequency for Inappropriate Elastomers:

4.10 x 10-6

NOTES:

NOTE 1: All Group 4 valves were analyzed together. The total risk is documented as the risk for Valve HCV-238 in Table 1.

NOTE 2: The various failure modes and combinations for the valves in Group 9 were analyzed in a single model. The total

risk evaluated for all four valves is documented as the risk for Valve HCV-438B in Table 1.

Group 1: Valves fail in the safety/risk-significant direction.

Group 2: For the harsh environment of concern, the valves would fail in the risk-significant direction.

Group 3: Valves would fail open and increase the likelihood of over filling the steam generators.

Group 4: Valve failures affect hot leg injection and are only of concern during large-break loss of coolant accidents.

Group 5: These valves fail in the risk-significant direction (open), but are required to isolate a failure of line.

Group 6: These valves do not have a risk-significant function for high-energy line break.

Group 7: Valve is normally open and fails as is. Open is dominant risk function. Valve must close for hot leg injection.

Group 8: Valve fails closed effecting containment isolation, but sampling function is lost.

Group 9: Component cooling water isolation valves affect plant response to reactor coolant pump heat exchanger

intersystem loss of coolant accident.

A2 -9

For the 58 valves in Table 1, the licensee had determined that each of these valves

contained the elastomer Nitrile which would be exposed to elevated temperatures

beyond its nominal design range following postulated high-energy line break

scenarios. While the Nitrile elastomers are not rated for operation in harsh

environments, the licensee noted that manufacturers literature indicates that operation

of elastomers for restricted time periods in these environments may be acceptable.

The analyst evaluated each of the valve groups from Table 1 as follows:

Group 1: All Group 1 valves were determined to fail in the risk-significant direction.

Should the elastomers in any of these valve actuators fail, springs would drive the

valve in the appropriate direction. Therefore, the change in risk, given the

performance deficiency was negligible for these valves.

Group 2: The analyst noted that Group 2 valves had risk-significant functions that

required the valve to open or close depending on the system function demanded.

The analyst reviewed the initiating events that would result in a harsh environment

surrounding each valve. In each case, the risk-significant function of the valve

following the initiator causing the harsh environment was to go to the failed

position. Should the elastomers in the valve actuator fail, springs would drive the

valve in the appropriate direction. Therefore, the change in risk, given the

performance deficiency was negligible for these valves.

Group 3: The analyst determined that all Group 3 valves would fail open and increase

the likelihood of over filling the steam generators. Over filling the steam generators,

while providing additional short-term cooling, results in the failure of the turbine-driven

auxiliary feedwater pump by flooding the steam supply line. The analyst used the

Standardized Plant Analysis Risk (SPAR) Model for Fort Calhoun Station, Version 8.20

to quantify a bounding conditional core damage probability (CCDPFW-10) for the loss of

Feedwater Pump FW-10 following a high-energy line break. The baseline (CCDPBase)

for each scenario was also quantified. In accordance with Assumption 2, the exposure

period (EXP) used was one year. The frequency (Containment) of a high-energy line

break for containment was determined to be approximately the sum of the frequencies

of the following initiators:

From plant-specific SPAR model:

Large-break loss of coolant accident (2.50 x 10-6 /year)

Medium-break loss of coolant accident (1.50 x 10-4 /year)

Small-break loss of coolant accident (3.67 x 10-4 /year)

Reactor vessel rupture (1.00 x 10-7 /year)

From licensees probabilistic risk assessment:

Main steam line break inside containment (2.10 x 10-4 /year)

Main feedwater line break inside containment (7.70 x 10-5 /year)

Main feedwater line break upstream of check valve (3.90 x 10-5 /year)

The resulting high-energy line break frequency for containment was 8.46 x 10-4 /year.

The frequency (Room 81) of a high-energy line break in auxiliary building Room 81 was

determined to be approximately the sum of the frequencies of the following initiators:

Main Steam Line Break (1.80 x 10-4 /year)

Main Feedwater Line Break (3.00 x 10-4 /year)

The resulting high-energy line break frequency for Room 81 was 4.80 x 10-4/year.

The analyst noted that for each high-energy line break initiator; there was an alternate

valve in another area that was not impacted directly by the harsh environment. Should

the alternate valve close, the steam generators would not overfill. Therefore, the

analyst used a single train failure rate (PRandom) of 1.0 x 10-2 to account for the random

failure of the opposite train valve.

The analyst determined that a high-energy line break in Room 81 was best

represented by a loss of main feedwater initiator in the site-specific SPAR model. The

analyst quantified the conditional core damage probability for a loss of main feedwater

(CCDPBaseMF81) as the baseline for breaks in Room 81 (4.75 x 10-6). Given the

performance deficiency, over filling of steam generators is possible and would fail

Pump FW-10. The analyst quantified the conditional core damage probability for this

scenario (CCDPMF-FW-10) providing a probability of 2.96 x 10-5. For each of the six

valves in Room 81, the analyst hand calculated the CDF as follows:

CDF = Room 81 * EXP * (CCDPMF-FW-10 - CCDPBaseMF81) * PRandom

= 4.80 x 10-4 /year * 1 year * (2.96 x 10-5 - 4.75 x 10-6) * 1.0 x 10-2

= 1.19 x 10-10

The analyst determined that a high-energy line break in Containment was best

represented by a large-break loss of coolant accident in the site-specific SPAR model.

The analyst quantified the conditional core damage probability for this initiator

(CCDPBaseLL) as the baseline for breaks in Containment (1.90 x 10-3). Given the

performance deficiency, over filling of steam generators is possible and would fail

Pump FW-10. The analyst quantified the conditional core damage probability for this

scenario (CCDPLL-FW-10) providing a probability of 2.75 x 10-3. For each of the four

valves in Containment, the analyst hand calculated the CDF as follows:

CDF = Containment * EXP * (CCDPLL-FW-10 - CCDPBaseLL) * PRandom

= 8.46 x 10-4 /year * 1 year * (2.75 x 10-3 - 1.90 x 10-3) * 1.0 x 10-2

= 7.19 x 10-9

The analyst noted that the total CDF for Group 3 valves was the sum of the change

for each individual valve: 3.70 x 10-8.

Group 4: The analyst noted that all Group 4 valves would affect the reliability of hot

leg injection upon failure. Hot leg injection is a necessary function to ensure that there

will not be unacceptably high concentrations of boric acid in the core region (resulting

in precipitation of a solid phase) during the long-term cooling phase following a

postulated large-break loss of coolant accident. The analyst noted that failure of the

Group 4 valves would not cause a complete loss of hot-leg injection capability.

Alternate hot-leg injection would be available through motor-operated valves, and

solenoid-operated valves, in series provided redundancy to isolate the lines affected.

Using the SPAR model, the analyst noted that the frequency of a large-break loss of

coolant accident (LLOCA) was 2.5 x 10-6 /year. The analyst quantified the model to

determine the conditional core damage probability for a large-break loss of coolant

accident and failure of all Group 4 valves. The analyst used Basic Event LPI-XHE-XM-

HTLEG, Operator Fails to Initiate LPR Hot Leg Recirculation, as a surrogate for the

failure of the valves. Substituting the baseline failure of this basic event for an

estimated 4.0 x 10-3 probability that alternate methods of hot leg injection would fail

resulted in a conditional core damage probability (CCDPGroup4) of 4.92 x 10-3. The

baseline conditional core damage probability (CCDPBase) was 1.9 x 10-3 for a large-

break loss of coolant accident. The analyst hand calculated the CDF as follows:

CDF = LLOCA * EXP * (CCDPGroup4 - CCDPBase)

= 2.5 x 10-6 /year * 1 year * (4.92 x 10-3 - 1.90 x 10-3)

= 7.55 x 10-9

Group 5: Given a high-energy line break, valves in Group 5 would fail open. To

maintain the steam supply to the turbine-driven auxiliary feedwater pump, Group 5

valves failing open supports the risk-significant function. However, these valves are

also required to isolate a line break in the steam supply line. The analyst reviewed

Drawing 11405-M-252, Sheet 1, Flow Diagram Steam P & ID. The analyst did not

identify any line break in Room 81 that would degrade the function of Pump FW-10

because of the failure to isolate the break. Therefore, the change in risk, given the

performance deficiency was negligible for these valves.

Group 6: The analyst reviewed the function for each of the eight valves in Group 6.

The postulated failure of these valves would only occur with a high-energy line break in

auxiliary building Room 81. Given this line break, the valves in Group 6 would fail

closed when the risk-significant function is open. However, the analyst determined

that the risk-significant function for Group 6 valves would not be needed in response to

a high-energy line break in auxiliary building Room 81. Therefore, the change in risk,

given the performance deficiency was negligible for these valves.

Group 7: Valve HCV-2987, HPSI Alternate Header Isolation Valve, is the only valve

in Group 7. The valve is maintained open during normal plant operations and would

fail as-is given a high-energy line break. The analyst noted that open is the dominant

risk function for this valve. However, the valve is required to close for hot leg injection.

Hot leg injection is a necessary function to ensure that there will not be unacceptably

high concentrations of boric acid in the core region (resulting in precipitation of a solid

phase) during the long-term cooling phase following a postulated large-break loss of

coolant accident. Using the SPAR model, the analyst noted that the frequency of a

large-break loss of coolant accident (LLOCA) was 2.5 x 10-6 /year. The analyst

quantified the model to determine that the conditional core damage probability for a

large-break loss of coolant accident and failure of all hot leg injection was 1.0

(CCDPHLI). The analyst determined that there would be sufficient time following a

large-break loss of coolant accident for operators to safely enter Room 13 and

manually reposition Valve HCV-2987. Therefore, the analyst provided a screening

value (Pscreen) of 0.1 for the probability that operators failed to reposition the valve prior

to the need for hot leg injection. The baseline conditional core damage probability

(CCDPBase) was 1.9 x 10-3 for a large-break loss of coolant accident. The analyst hand

calculated the CDF as follows:

CDF = LLOCA * EXP * (CCDPHLI - CCDPBase) * Pscreen

= 2.5 x 10-6 /year * 1 year * (1.0 - 1.90 x 10-3) * 1.0 x 10-1

= 2.50 x 10-7

Group 8: Valve PCV-742G, Radiation Monitoring Cabinet; Inlet Inboard Isolation

Valve, is the only valve in Group 8. The risk-significant function for the valve is to

close, supporting containment isolation. Given a high-energy line break,

Valve PCV-742G would fail closed. The primary operational function of the valve is to

open following an accident to sample the containment environment. The analyst

determined that, while the inability to sample would cause difficulties in understanding

the condition of the containment environment, it would not have an impact on the core

damage frequency. Therefore, the change in risk, given the performance deficiency

was negligible for this valve.

Group 9: Group 9 consists of Valves HCV-428A, HCV-438B, HCV-438C, and

HCV-438D. These valves are the inlet and outlet containment isolation valves for

component cooling water going to the reactor coolant pump seal coolers. The valves

have two primary functions:

1) To close for containment isolation, and

2) To close to isolate a postulated intersystem loss of coolant accident

following a break of one of four reactor coolant pump seal cooler helix coils.

A one-line diagram of the seal coolers and the Group 9 valves is provided as Figure 1.

4. Top Event HPI, provided from the SPAR, models various failure modes of the

high pressure injection system.

5. Top Event SSC, provided from the SPAR, models various failures of the

secondary plant systems that would prevent normal cool down of the plant.

6. Top Event OTC, provided from the SPAR, models failures of the high pressure

injection system and the primary power-operated relief valves, failures of which

would prevent the feed and bleed function described in the emergency operating

procedures.

7. Top Event CSR, provided from the SPAR, models various failure modes of the

containment spray system assuming that containment coolers are unavailable

because of failure of the component cooling water system.

8. Figure 5 shows the top event, Inboard-Iso-Holds. This fault tree was created by

the analyst and added to the event tree to account for the potential that Valves

HCV-438A and HCV-438C operators fail to remain closed in the containment

environment created by a small-break loss of coolant accident. The failure of the

valves as a result of the performance deficiency were modeled differently at high

reactor coolant system pressures and following a reactor depressurization directed

by the emergency operating procedures. The failure probabilities used were

developed by the analyst using qualitative information provided by the licensee in a

white paper entitled, Overview of RCP Seal Cooler Containment Isolation Valve

Elastomer Significance. The analyst noted that these valves would remain closed

with a differential pressure of approximately 300 psig based on the design of the

plug (See Figure 2).

The licensee performed an assessment to provide background information

regarding the high temperature behavior of Nitrile, the substance used as the

primary elastomer in the 58 subject valves. The Parker O-ring handbook

(Reference 1) indicated that Nitrile materials can be used for limited periods when

exposed to temperatures in the 200-300 degrees Fahrenheit range. However, that

handbook does not specify a relationship between Nitrile lifetime and exposure

temperature. Other references, including earlier versions of the Parker handbook

have provided time/temperature relationships for various elastomers. The licensee

extrapolated this information to estimate the lifetime-exposure temperature

relations for Nitrile for the purposes of gaining insight with regard to risks of loss of

function for selected valves with Nitrile components. Specifically, this information

was used to support the licensees judgments regarding the failure probability of

Nitrile when subjected to limited duration exposures to elevated temperatures

beyond their nominal design ranges.

Valves HCV-438A, HCV-438B, HCV-438C, and HCV-438D use Nitrile based

elastomers for the air filter regulator and actuator. Valves HCV-438A and HCV-

438C, located in containment, perform a function in the closed position to establish

containment isolation upon receipt of a Containment Isolation Actuation Signal

coincident with Component Cooling Water low pressure. These valves fail open.

9. Figure 6 shows the top event, Out-Iso-Holds. This fault tree was created by the

analyst and added to the event tree to account for the potential that Valve

Operators for HCV-438B and HCV-438D fail to remain closed against the

differential pressure created when Valves HCV-438A and HCV-438C fail open

following a break of one of four reactor coolant pump seal cooler helix coils. The

analyst noted that the valves would fail open under differential pressures near 180

psig, indicating that the valves would most likely always fail open. However,

Emergency Operating Procedure EOP-20, Functional Recovery Procedure, Step

14.c.2 directs operators to manually close these valves with a hand jack. The

analyst used a screening value of 0.1 as the human error probability for operators

failing to close the outboard valves. This action requires depressurization of the

reactor coolant system; an environment in Room 13 that would permit operator

access; and access to necessary equipment.

10. Top Event SDC, provided from the SPAR, models various failures of the

shutdown cooling system that would prevent placing the plant in cold shutdown.

11. Top Event HPR, provided from the SPAR, models various failures of the high

pressure injection system and other components that would prevent establishing

recirculation by successfully transferring the system suction source from the

refueling water storage tank to the containment sump.

Figure 2

CCW Isolation Valve Design

2. Top Event LSHR, provided from the SPAR, models the failure of operators to

refill the emergency feedwater storage tank so that long-term secondary heat

removal can continue if depressurization of the reactor is not successful.

The analyst quantified the event tree shown in Figure 3 using the SAPHIRE

software and quantification engine with a truncation value of 1 x 10-13. For the

readers benefit, the approximate split fractions for each top event are provided in

Table 2. The sequence results for the baseline and case evaluations are

documented in Table 3. The total CDF for the Group 9 valves was determined to

be 3.8 x 10-6.

Figure 6

Failure of Inboard Group 6 Valves to Remain Closed

Event Tree

Table 2

Split Fractions for Reactor Coolant Pump Seal Cooler Loss of Coolant Accident Event Tree

Top Event

Definition

Probability

Initiator

Reactor Coolant Pump Seal Cooler Failure ( /year)

5.00E-04

RPS

Failure of the Reactor Protection System

2.04E-06

Inboard-Isol

Failure to Isolate Component Cooling Water to the Seal

Cooler

4.91E-04

FW

Failure of the Main and Auxiliary Feedwater Systems

4.77E-04

HPI

Failure of High Pressure Injection

6.11E-02

SSC

Failure to Cool Down the Reactor using Secondary

Systems

1.05E-03

OTC

Failure of Once Through Cooling

8.71E-02

CSR

Failure of the Containment Cooling Systems

8.37E-05

Inboard-Iso-

Holds

Valves 438A and C fail from Inappropriate Elastomers

7.58E-02

Out-Iso-Holds

Valves 438B and D Reopen and Operators Fail to

Manually Close

1.00E-01

SDC

Failure of Shutdown Cooling

7.42E-03

HPR

Failure of High Pressure Recirculation

6.13E-02

LSHR

Failure of Long-Term Secondary Heat Removal

1.00E-04

Table 3

Sequence Results for Seal Cooler Failure Event Tree

Sequence:

Sequence Frequency

(per year)

Baseline Frequency

(per year)

3.22E-08

3.22E-08

2.20E-09

2.20E-09

3.79E-06

3.22E-12

3.22E-12

2.20E-13

2.20E-13

3.98E-09

4.39E-11

4.39E-11

3.06E-05

3.06E-05

1.46E-08

1.46E-08

9.97E-10

9.97E-10

1.81E-09

2.00E-11

2.00E-11

2.08E-08

2.08E-08

1.46E-08

1.46E-08

2.46E-07

2.46E-07

1.02E-09

1.02E-09

Total

3.47E-05

3.09E-05

Total CDF

3.80E-06

Results for Section 1, Air-Operated Valve Elastomers

The analyst determined that the total best estimate CDF for all air-operated

valves with inappropriate elastomers was the sum of the independent CDF for

each valve. Therefore, the best estimate CDF for this portion of the risk related

to the performance deficiency was 4.1 x 10-6 as documented in Table 1.

Evaluation 2: Auxiliary Steam System Piping Breaks

The licensee identified 19 areas in the plant that contained auxiliary steam

system piping. The licensee had not evaluated these areas for breaks in the

auxiliary steam system piping, resulting in some components not being capable

of withstanding such an environment. The analyst identified similarities among

various valves and grouped them into four functional groups to simplify the

analysis. The functional groups identified, and the grouping of each of these

valves, are documented in Table 4.

TABLE 4

Auxiliary Steam System Area Groups

Room

Description

Location

Group

Open Corridor: Contains several Motor-

Control Centers that support HCV-347 and

HCV-348, Shutdown Cooling Suction

Valves, and HCV-383-3 and HCV-383-4,

Sump Suction Valves

Auxiliary Building

Not Harsh

Spent Fuel Pool Heat Exchanger Room

Auxiliary Building

No PRA

Changing Pumps Room

Auxiliary Building

Not Harsh

Compressor Room: Includes Steam-Driven

and Motor-Driven Auxiliary Feedwater

Pumps

Auxiliary Building

Not Harsh

Open Corridor: Boric Acid Pumps and

Tanks

Auxiliary Building

Not Harsh

Waste Evaporator Room

Auxiliary Building

No PRA

Storage Room

Auxiliary Building

No PRA

Switchgear Room (Vital and Nonvital)

Auxiliary Building

Not Harsh

Electrical Penetration Area

Auxiliary Building

Not Harsh

Diesel Generator Room 1

Auxiliary Building

Harsh

Diesel Generator Room 2

Auxiliary Building

Harsh

Diesel Ventilation Enclosure

Auxiliary Building

Not Harsh

Equipment Hatch Enclosure

Auxiliary Building

Not Harsh

Ventilation Equipment Area: Includes

component cooling water and spent fuel pool

Auxiliary Building

Not Harsh

Main Steam Vault: Supports Main Steam,

Main Feedwater, and Auxiliary Feedwater.

Auxiliary Building

Bounded

Mechanical Equipment Room

Auxiliary Building

No PRA

Lower

Level

Primarily Circulating Water Pumps

Auxiliary Building

Not Harsh

Operating

Deck

Fire Pumps (1 Diesel, 1 Electric) and

Rotating Screens

Intake Structure

Harsh

TABLE 4

Auxiliary Steam System Area Groups

Room

Description

Location

Group

Raw Water

Vault

Safety-Related Raw Water Pumps and

Associated Equipment

Intake Structure

Not Harsh

Group Definitions:

Not Harsh: Calculations indicate that breaks of the auxiliary steam system in these areas would

not result in a harsh environment as defined by the licensees design basis.

Bounded: Calculations indicate that breaks of the auxiliary steam system in these areas are

bounded by more energetic failures. Therefore, all equipment in the area was

previously qualified.

No PRA: No risk-significant equipment, as defined in the probabilistic risk assessment, is

contained in these rooms. Therefore, regardless of qualification status, change in

risk would be negligible.

Harsh: Calculations indicated that breaks of the auxiliary steam system in these areas

would cause a harsh environment. Evaluation of the change in risk was quantified.

Auxiliary steam piping and components were installed in each of the 19 plant

areas listed in Table 4. The licensee had failed to analyze these areas, and

other equipment in the vicinity, for the environmental conditions that would result

from a high-energy break of the auxiliary steam system. The analyst evaluated

each of the four area groups from Table 4 as follows:

Not Harsh: The eleven areas listed in this group were evaluated by the

licensee to assess the impact of a break of the auxiliary steam system.

None of the areas in this group were determined to result in a harsh

environment as described by the licensees equipment qualification

program. By definition, equipment design criteria at Fort Calhoun Station

should result in plant components being able to continue to function

normally provided the environment is not harsh. Therefore, the CDF,

given the performance deficiency, was negligible for components in areas

in the Not Harsh group.

Bounded: Room 81 was the only area listed in this group. The licensee

evaluated the impact of a break of the auxiliary steam system in this

room. The harsh environment quantified in this analysis was determined

to be bounded for temperature and humidity by the main steam and main

feedwater line breaks previously analyzed. All equipment in Room 81

was properly qualified for harsh environments except for flooding, as

discussed later and documented in Table 5. The analyst determined

qualitatively that a break of the auxiliary steam system piping in Room 81

would not provide sufficient flooding to affect components not previously

analyzed for submersion. Therefore, the CDF, given the performance

deficiency, related to auxiliary steam piping, was negligible for

components in Room 81, the Bounded group.

No PRA: The four areas listed in this group were evaluated by the

licensee to assess the impact of a break of the auxiliary steam system.

These areas were determined to result in a harsh environment following

an auxiliary steam system piping break, as described by the licensees

equipment qualification program. However, the analyst noted that there

was no equipment modeled in the licensees probabilistic risk assessment

in any of these areas. By definition, equipment that is not included in a

properly developed probabilistic risk assessment is of low risk

significance. As such, regardless of qualification status, the failure of

equipment in these areas following a postulated break of the auxiliary

steam system would not be risk-significant. Therefore, the CDF, given

the performance deficiency, was negligible for components in areas in the

No PRA group.

Harsh: The three areas listed in this group were evaluated by the

licensee to assess the impact of a break of the auxiliary steam system.

All of the areas in this group were determined to result in a harsh

environment, following a postulated break in the auxiliary steam system

piping, as described by the licensees equipment qualification program.

The analyst provided an upper bound risk assessment for each of these

areas as follows:

Room AB063: The analyst assessed the risk of an auxiliary steam line

break in Auxiliary Building Room AB063, Diesel Generator Room 1.

The analyst noted that a high-energy line break in this room would not

cause an initiator. According to Combustion Engineering Nuclear Power

LLC, ST-2000-0627, the plant-wide frequency of a break of the auxiliary

steam system would be approximately 6.44 x 10-4/year for various rooms

in the facility. As a bounding assumption, the analyst assumed that the

failure frequency of the auxiliary steam system in Room AB063 (63)

would be no higher than 1 x 10-3/year.

The analyst assumed that, given a postulated high-energy break of the

auxiliary steam system, Diesel Generator 1 would be inoperable and the

Technical Specification allowed outage time would be entered. Following

the Technical Specification requirements, plant operators would shut

down the reactor in 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> and cool down the reactor coolant system in

another 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. In order for the diesel generator to be demanded

during these 108 hours0.00125 days <br />0.03 hours <br />1.785714e-4 weeks <br />4.1094e-5 months <br />, a loss of power would need to occur on the

associated vital bus. The probability of a loss of offsite power occurring

during the period (PLOOP-108) was calculated to be 3.51 x 10-4.

In accordance with Assumption 2, the exposure period (EXP) was the

1-year assessment period. The analyst then calculated the bounding

CDF (CDFAB063), by assuming a conditional core damage probability

(CCDP) of 1.0 as follows:

CDFAB063

= 63 * PLOOP-108 * CCDP * EXP

= 1 x 10-3/year * 3.51 x 10-4 * 1.0 * 1.0 year

= 3.5 x 10-7

Room AB064: The analyst assessed the risk of an auxiliary steam line

break in Auxiliary Building Room AB064, Diesel Generator Room 2.

The analyst noted that a high-energy line break in this room would not

cause an initiator. According to Combustion Engineering Nuclear Power

LLC, ST-2000-0627, the plant-wide frequency of a break of the auxiliary

steam system would be approximately 6.44 x 10-4/year for various rooms

in the facility. As a bounding assumption, the analyst assumed that the

failure frequency of the auxiliary steam system in Room AB064 (64)

would be no higher than 1 x 10-3/year.

The analyst assumed that, given a postulated high-energy break of the

auxiliary steam system, Diesel Generator 2 would be inoperable and the

Technical Specification allowed outage time would be entered. Following

the Technical Specification requirements, plant operators would shut

down the reactor in 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> and cool down the reactor coolant system in

another 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. In order for the diesel generator to be demanded

during these 108 hours0.00125 days <br />0.03 hours <br />1.785714e-4 weeks <br />4.1094e-5 months <br />, a loss of power would need to occur on the

associated vital bus. The probability of a loss of offsite power occurring

during the period (PLOOP-108) was calculated to be 3.51 x 10-4.

In accordance with Assumption 2, the exposure period (EXP) was the 1

year assessment period. The analyst then calculated the bounding CDF

(CDFAB064), by assuming a conditional core damage probability (CCDP)

of 1.0 as follows:

CDFAB064

= 64 * PLOOP-108 * CCDP * EXP

= 1 x 10-3/year * 3.51 x 10-4 * 1.0 * 1.0 year

= 3.5 x 10-7

Intake Operating Floor: The analyst assessed the risk of an auxiliary

steam line break in the Intake Structure operating floor. The analyst

noted that a high-energy line break in this room would potentially cause a

reactor trip, loss of functional screens, and loss of the fire pumps.

According to Combustion Engineering Nuclear Power

LLC, ST-2000-0627, the plant-wide frequency of a break of the auxiliary

steam system would be approximately 44 x 10-4/year for various rooms in

the facility.

As a bounding assumption, the analyst assumed that the failure

frequency of the auxiliary steam system on the Intake Structure Operating

Deck (Intake) would be no higher than 1 x 10-3/year. The analyst assumed

that, given a postulated high-energy break of the auxiliary steam system,

the rotating screens would fail causing a loss of raw water. The analyst

quantified the conditional core damage probability using the SPAR model,

Version 8.20.

In accordance with Assumption 2, the exposure period (EXP) was the

1-year assessment period. The analyst then calculated the bounding

CDF (CDFIntake) as follows:

CDFIntake

= Intake * CCDP * EXP

= 1 x 10-3/year * 7.09 x 10-4 * 1.0 year

= 7.1 x 10-7

Results for Section 2, Auxiliary Steam System Piping Breaks

The analyst determined that, because each of the area failure

probabilities were selected to be independent of each other, the total

bounding CDF from the postulated failure of auxiliary steam system

piping was the sum of the area frequencies. Therefore, the highest that

the CDF could be for this portion of the risk related to the performance

deficiency was 1.4 x 10-6.

Evaluation 3: High-Energy Line Break Area

The licensee identified five areas in the plant that contained high-energy

piping that had not been properly evaluated for breaks. As a result,

multiple risk-significant components were not properly protected or

designed for the resulting harsh environment. The analyst reviewed each

of the areas to identify equipment affected, initiating events of concern,

initiating event frequencies and the conditional core damage probabilities.

The evaluation of these areas and the risk characterization for each, are

documented in Table 5.

Table 5

Harsh Environment Rooms

Bounding Risk Assessment Results

Location

Area Name

Scenario

Total CDF

(Affected Equipment)

Risk

Auxiliary Building

Room 12

Letdown Heat Exchanger

Room

5.36 x 10-7

Main Feedwater

1.43 x 10-9

Intersystem LOCA

5.35 x 10-7

Auxiliary Building

Room 13

Lower Mechanical

Penetration Room

5.41 x 10-7

Valves 438B and 438D

1.35 x 10-10

Sump Recirculation

5.78 x 10-9

Intersystem LOCA

5.35 x 10-7

Auxiliary Building

Room 19

Compressor Room

5.39 x 10-7

SPAR Run:

-

Loss of all 3-side

Switchgear

-

Failure of Pump FW-10

-

Failure of Pump FW-6

Auxiliary Building

Room 69

Ventilation Equipment Area

5.58 x 10-9

SPAR Run:

-

Loss of Component

Cooling Water

-

Bounding Frequency

Auxiliary Building

Room 81

Main Steam Vault

1.82 x 10-6

-

Main Feedwater Break

1.26 x 10-6

Loss of all Auxiliary

Feedwater

-

Main Steam Line Break

5.63 x 10-7

Loss of Pumps FW-10

and FW-6

Total Upper Bound CDF:

3.4 x 10-6

Initiating Event Frequency for High-Energy Line Break Areas

The licensee identified plant areas that had not been completely evaluated for

the impacts of postulated high-energy line breaks. The five areas documented in

Table 5 are those areas identified by the inspectors that had potentially

significant equipment that was not properly qualified for the harsh environment

that would occur following a postulated high-energy line break in the area.

The analyst determined the initiating event frequency for multiple scenarios

involving high-energy line breaks. For each plant area of interest, the analyst

used best available information to quantify the total frequency of a high-energy

line break and/or identify a clear upper bound frequency.

Conditional Core Damage Probability for High-Energy Line Break Areas

For each scenario, the analyst quantified a bounding baseline and case

conditional core damage probability using the site-specific SPAR model,

Version 8.21. Each scenario documented in Table 5 is designated by the initiator

used in the model, the component failures of interest, or the entire sequence

used to quantify the scenario.

Upper Bound Results for High-Energy Line Break Areas

The analyst used a spreadsheet to maintain the detailed scenario specific inputs

and results. The final, bounding results for each scenario and the total upper

bound CDF for each room are documented in Table 5.

Room 13:

The high-energy lines of interest in the Lower Mechanical Penetration Room

were steam generator blowdown piping and the low-pressure portion of the

letdown piping as shown in Figure 7. The analyst noted that the risk-significant

equipment in the room included:

• Component Cooling Water Valves HCV-438B and HCV-438D

Letdown Stop Valve HCV-204

Effects from Impact to Motor-Control Centers in Corridor 4

Shutdown Cooling Isolation Valves HCV-347 and HCV-348

Sump Recirculation Valves HCV-383-3 and HCV-383-4

The analyst evaluated three scenarios encompassing the change in risk from the

performance deficiency in Room 13:

(1) Failure of Containment Sump Recirculation:

The analyst estimated the baseline high-energy line break frequency in

Room 13 to be 2.77 x 10-6/year from a breach of the blowdown system.

However, the analyst noted that the licensee had determined they had been

unable to inspect the socket welds in this area of the plant. As corrective

action, the licensee replaced all applicable socket welds with butt welds. In

order to account for the lack of ability to inspect the previous welds, the

analyst increased the failure probability of the lines and used an initiating

event frequency (13) of 3.0 x 10-4/year as a bounding assumption

(Assumption 19).

Using this initiating event frequency, the analyst performed an assessment of

the failure of the blowdown system piping in the room, assuming that the

conditional core damage probability was bounded by a loss of main

feedwater initiator. The resulting baseline (CCDPBase4) was 4.75 x 10-6.

Figure 7

One-Line Diagram of Letdown System

Given the performance deficiency, a harsh environment would be created in

Corridor 4 resulting in the loss of sump recirculation. The analyst quantified

the case by analyzing a loss of main feedwater with the failure of

Valves HCV-347, HCV 348, HCV-383-3, and HCV-383-4. The conditional

core damage probability (CCDPCorridor4) was 2.40 x 10-5. The CDF

(CDFCorridor4) was calculated as follows:

CDFCorridor4

= 13 * (CCDPCorridor4 - CCDPBase4) * EXP

= 3 x 10-4/year * (2.4 x 10-5 - 4.75 x 10-6) * 1.0 year

= 5.8 x 10-9

(2) Failure of Valves 438B and 438D

Using the model developed to analyze the loss of reactor coolant pump seal

heat exchanger pipe, the analyst calculated the potential effect of a blowdown

system pipe break in Room 13 on Valves HCV-438B and HCV-438D. The

change in conditional core damage probability, assuming random initiators,

was 4.5 x 10-7. The analyst then multiplied this times the bounding frequency

for a blowdown system piping break to obtain a CDF of 1.4 x 10-10.

(3) Letdown System Intersystem Loss of Coolant Accident

In addition to a random pipe failure, the analyst noted that a random failure of

the operating letdown system control valve could result in overpressurization

of the low pressure system piping and cause an intersystem loss of coolant

accident. Such a sequence would occur as follows:

a) The operating letdown control valve (either Valve HCV-101-1 or

HCV-101-2) randomly transfers open. The annual frequency of this

event was about 2.1 x 10-2/year from the licensees probabilistic risk

assessment;

b) Valve HCV-204, the letdown stop valve, fails to close on high flow

(Probability about 9.5 x 10-4 per demand);

c) Temperature Control Valve TCV-202, a letdown stop valve, fails to

close on high system temperature (Probability about 9.5 x 10-4 per

demand plus common cause failure of TCV-202 and HCV-204

estimated at 2.5 x 10-5 per demand); and

d) Low pressure system piping, designed for 600 psig, fails when

pressurized to near 2000 psig.

Upon failure of the system piping in Room 13, the analyst assumed that,

given the performance deficiency, the harsh environment would fail Valve

HCV-204, preventing operator intervention. The bounding CDF for this

postulated intersystem loss of coolant accident was 5.4 x 10-7.

The total CDF for Room 13 was the sum of the independent analyses

above (5.4 x 10 7).

Room 12:

The Letdown Heat Exchanger Room contains letdown piping downstream of

HCV-204 in Room 13, plus additional high-energy piping. The analyst noted

that the affect that the performance deficiency would have on equipment in

Room 12 could be bounded by the evaluation of the blowdown and letdown

systems piping in Room 13. Therefore the total CDF for Room 12 was

5.4 x 10-7.

Room 19:

The primary high-energy line of concern in the Compressor Room is

approximately 150 feet of steam supply piping to the Pump FW-10 turbine.

The analyst noted that the risk-significant equipment in the room included:

Auxiliary Feedwater Pump FW-10

Auxiliary Feedwater Pump FW-6

Instrument Air System Compressors

Guard Pipe protecting Room 56 (See Figure 8)

The analyst noted that the primary effect of the performance deficiency was

that the guard pipe, designed to protect Room 56E, East Switchgear Room,

from a line break in Room 19 was degraded. The analyst assumed that

steam in the guard pipe would inundate Room 56E in sufficient quantities to

fail the 1A3 side electrical buses in the room.

The analyst reviewed simple calculations that indicated the air conditioning

unit in Room 19 was large enough to remove the moisture from a steam line

break in the room. Room 19 is a very large room and the air handling unit is

positioned between the steam line and the instrument air compressors. As a

result, the analyst assumed that the steam line break would not result in a

loss of all instrument air to the plant.

The analyst reviewed a spreadsheet developed by the licensee, in

accordance with the EPRI Technical Report 3002000079 method, for the 150

feet of steam piping. The calculated initiating event frequency (19) was 8.43

x 10-5/year.

Figure 8

One-Line Diagram of Steam Supply to Pump FW-10

Guard Pipes Indicated

Using the plant-specific SPAR model, the analyst quantified the conditional

core damage probability for a failure of the Pump FW-10 steam supply line.

The analyst assumed that a failure of the subject line would result in a

transient and a failure of Auxiliary Feedwater Pump FW-10 from loss of its

steam supply. The resulting baseline (CCDPBase19) was 7.74 x 10-6. The

analyst then quantified the case, assuming that steam in Room 19

caused the failure of Auxiliary Feedwater Pump FW-6 and steam in the guard

pipe inundated Room 56E in sufficient quantities to fail the 1A3 side electrical

buses in the room. The resulting case value (CCDPRoom19) was 6.39 x 10-2.

As a mitigating factor, the analyst noted that the pipe had an installed

pressure transmitter that would alarm in the main control room following the

low pressure from a line break. Abnormal Operating Procedure AOP-28

directed operators to isolate the line. As a bounding assumption, the analyst

assumed that the operators would fail to isolate the line in accordance with

plant procedures (PISO) with a probability of 1 x 10-1.

The analyst calculated the CDF (CDFRoom19) as follows:

CDFRoom19

= 19 * (CCDPRoom19 - CCDPBase19) * EXP * PISO

= 8.43 x 10-5/year * (6.39 x 10-2 - 7.74 x 10-6) * 1.0 year * 0.1

= 5.4 x 10-7

Room 69:

The Ventilation Equipment Area contains the component cooling water

pumps, the system surge tank, and the spent fuel pool. The analyst

determined that the worst case response to a high-energy line break in the

area would be a loss of component cooling water. Using a bounding initiating

event frequency of 3 x 10-4/year (equivalent to a main steam line break

outside containment), the analyst assumed that such a break would cause

one additional loss of component cooling water initiator that would not have

occurred without the performance deficiency. The analyst quantified the

conditional core damage probability for a loss of component cooling water

using the site-specific SPAR model. The result was 1.86 x 10-5. This result

was dominated by failure of the operators to provide backup component

cooling water via the raw water system. The analyst then calculated the

upper bound CDF (5.58 x 10-9) using a 1-year exposure period.

Room 81:

The major high-energy lines in the Main Steam Vault are system piping from

main feedwater, main steam, auxiliary steam, and the steam supply to

Auxiliary Feedwater Pump FW-10. The licensee had previously evaluated

Room 81 for the effects of temperature, pressure, humidity, and radiation. All

equipment in the room was qualified for these parameters. The licensee

determined that large line breaks in the room could result in excessive

flooding of the room beyond the design/qualified levels. The analyst

determined that flooding could impact the function of the auxiliary feedwater

supply Valves HCV-1107B and HCV-1108B, as well as the auxiliary

feedwater crossover line isolation Valve HCV-1384 shown in Figure 9.

The analyst estimated the initiating event frequency for a large flood in Room

by assuming that any main steam line break or main feedwater line break

could result in major flooding in the room. Using the frequencies of line

breaks from the licensees probabilistic risk assessment, the analyst

calculated a total frequency (Break) of 4.8 x 10-4/year. The analyst noted that

this was a bounding frequency, considering that these break frequencies

included a wide range of break sizes, the smaller (and more frequent of

which) would not cause a significant flood. This frequency was the sum of

the frequency of a main steam line break (BreakMS = 3.0 x 10-4/year)

and (BreakMF = 1.8 x 10-4/year).

The analyst used the plant-specific SPAR model to quantify conditional core

damage probabilities for use in the evaluation. The following values were

quantified:

Loss of Main Feedwater (CCDPBase)

4.75 x 10-6

Loss of Main and Auxiliary Feedwater (CCDPAFW)

2.79 x 10-2

Loss of Main Feedwater and Pumps (CCDP6&10)1.88 x 10-3

FW-10, Turbine Driven

FW-6, Motor Driven

The analyst noted that, given the performance deficiency, a main steam line

break with the failure of Valves HCV-1107B, HCV-1108B, and HCV-1384 in

the closed direction would result in a loss of Pumps FW-10, Turbine-Driven

Auxiliary Feedwater Pump and FW-6, Motor-Driven Auxiliary Feedwater

Pump. The CDF for a main steam line break induced flood in Room 81

(CDFMainSteam) over the 1-year exposure period (EXP) was bounded by the

following:

CDFMainSteam

= BreakMS * (CCDP6&10 - CCDPBase) * EXP

= 3.0 x 10-4/year * (1.88 x 10-3 - 4.75 x 10-6) * 1 year

= 5.63 x 10-7

The analyst noted that, given the performance deficiency, a main feedwater

line break with the failure of Valves HCV-1107B, HCV-1108B, and HCV-1384

in the closed direction would result in a loss of Pumps FW-10, Turbine-Driven

Auxiliary Feedwater Pump and FW-6, Motor-Driven Auxiliary Feedwater

Pump. Additionally, the failure of the main feedwater line piping would fail

Pump FW-54, Diesel-Driven Auxiliary Feedwater Pump for many scenarios.

Given that Valves HCV-1107B and HCV-1108B fail open upon loss of air, to

fail the valve closed would require a smart short of the valve terminal blocks.

To fail the auxiliary feedwater system, both valves would have to fail closed.

As a bounding assumption, the analyst assumed that the highest likelihood of

a valve failing closed would be 50 percent of the flooding scenarios.

Therefore, the probability of both Valves HCV-1107B and HCV-1108B failing

closed following a flood of Room 81 (PClosed) was calculated to be no higher

than 2.5 x 10-1.

The CDF for a main feedwater line break induced flood in Room 81

(CDFMainFeed) over the 1-year exposure period (EXP) was bounded by the

following:

CDFMainFeed = BreakMF * (CCDPAFW - CCDPBase) * PClosed * EXP

= 1.8 x 10-4/year * (2.79 x 10-2 - 4.75 x 10-6) * 0.25 * 1 year

= 1.26 x 10-6

The total CDF for Room 81 was the sum of the independent analyses above

(1.82 x 10-6).

Results for Section 3, High-Energy Line Break Area Evaluation

The analyst determined that, because each of the five area failure

probabilities were selected to be independent of one another, the total

bounding CDF from postulated pipe breaks in the subject areas was the

sum of the area frequencies. Therefore, the highest that the CDF could be

for this portion of the risk related to the performance deficiency (as

documented in Table 5) was 3.4 x 10-6.

Conclusions

As discussed in Section 1, the best-estimate evaluation indicates that the

CDF from the air-operated valves with inappropriate elastomers was

4.1 x 10-6. As discussed in Section 2, the upper bound risk resulting from

auxiliary steam system piping failures was 1.4 x 10-6. Finally, in Section 3,

the analyst documented the upper bound risk from five previously unanalyzed

areas in the plant as 3.4 x 10-6. This results in a best-estimate CDF of 4.1 x

10-6 and an upper bound of no higher than 8.9 x 10-6. Therefore, the subject

finding is of low to moderate safety significance (White).

(4) Sensitivity Analysis

The SRA performed a variety of uncertainty and sensitivity analyses on the

results and modeling as shown below. The results confirm the recommended

White finding.

Sensitivity Analysis 1 - Isolation of Intersystem Loss of Coolant Accident.

The analyst determined the sensitivity of the results to a range of operator

failure probabilities. The analyst used the range of 5 x 10-2 to 2 x 10-1 for the

basic event Out-Iso-Holds111. This provided a factor of 2 above and below

the assumed value. Using this range, the analyst calculated the sensitivity of

the evaluation to the selection of this human error probability. The CDF

range was 1.9 x 10-6 - 7.6 x 10-6 (White).

Sensitivity Analysis 2 - Initiation of Auxiliary Steam Line Break.

The analyst evaluated the effects of varying auxiliary steam line break

frequencies to determine the sensitivity of the analysis to this assumption.

The analyst reviewed the bounding assumptions applied and determined that

the frequency of a steam line break could not be substantially higher than the

x 10-3/year estimated. Auxiliary steam system operates at a pressure of

150 psig or less. Therefore, the likelihood of a steam line break causing a

harsh environment is conditional. For the lower end of the range, the analyst

used the Combustion Engineering Nuclear Power LLC, ST-2000-0627 plant-

wide frequency of 6.44 x 10-4/year for various areas throughout the plant.

The range of CDF was 4.6 x 10-7 - 1.4 x 10-6 (As an upper bound result,

and combined with the best estimate risk, this supports the White finding).

Sensitivity Analysis 3 - Failure of Auxiliary Feedwater Injection Valves.

The analyst determined the sensitivity of the results to the selection of the

failure probability for Valves HCV-1107B and HCV-1108B. To establish a

range, the analyst first noted that the upper bound of the range was that the

valves fail closed under all conditions. This is severely limiting, given the

valves fail open on loss of air requiring a smart short to fail the valves closed.

As a lower bound of the sensitivity, the analyst assumed the valves would fail

open 1 time in 10 and that this conditional probability is independent for each

valve. The range of CDF was 6.1 x 10-7 - 5.6 x 10-6 (As an upper bound

result, this supports the White finding).

(5) Contributions from External Events (Fire, Flooding, and Seismic)

This performance deficiency only impacts the risk of the plant to high-energy

line breaks. No external event is postulated to cause a high-energy line

break.

(6) Potential Risk Contribution from Large, Early Release Frequency

In accordance with the guidance in NRC Inspection Manual Chapter 0609,

Appendix HProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix H" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Containment Integrity Significance Determination Process,

most of the scenarios evaluated related to this finding would not involve a

significant increase in risk of a large, early release of radiation because Fort

Calhoun Station has a large, dry containment and the dominant sequences

contributing to the CDF did not involve either a steam generator tube

rupture or an intersystem loss of coolant accident. However, two scenarios

involved the effects of the performance deficiency on the risk of an

intersystem loss of coolant accident.

The analyst noted that the scenarios reviewed that related to intersystem loss

of coolant accidents took a long time to develop. For the dominant core

damage sequences, core uncovery was predicted between 12 and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

after transient initiation. This would have provided for effective evacuation of

the close-in population prior to release. Therefore, while these ruptures

would result in potentially large releases, the releases would not be early.

The analyst determined that the significance of this finding was considered to

be core damage frequency-dominant, and the impact to large, early release

frequency was negligible.

(7) Total Estimated CDF

The total best estimate CDF caused by this performance deficiency is the

sum of the internal and external events CDFs. This value was 4.1 x 10-6.

Additional scenarios impacting risk were evaluated using bounding analyses.

The analyst determined that the total CDF could be no higher than

8.9 x 10-6. Therefore, this finding is of low to moderate safety significance

(WHITE).

(8) Licensees Risk Evaluation

The licensee did not have an independent evaluation of the overall risk

associated with this performance deficiency. However, the licensee provided

significant input to assist with determination of the high-energy line break

(including environmental qualifications of air-operated valve elastomers) risk

significance. Input included descriptions of high-energy line break scenarios

and associated operator actions, detailed lists of components potentially

subject to a harsh environment, and the baseline probabilistic risk

assessment model results for auxiliary steam ruptures. Lengths of piping for

high-energy systems were provided to assist with calculating initiating event

frequencies.

The licensee provided a position paper on the performance of nitrile

elastomers at high temperature, because some nitrile elastomers could be

exposed to conditions beyond their design service conditions. The position

paper included postulated failure probabilities for harsh environments.

Input provided by the licensee was both quantitative and qualitative.

However, it was not integrated in such a way that it presented a conditional

core damage probability or a conditional large, early release frequency

representing the overall impact of high-energy line break issues.

The analysts took exception with some of the licensees conclusions

regarding nitrile elastomer performance under harsh conditions. The analyst

also assigned higher failure probabilities to selected operator actions

associated with high-energy line break accident scenarios. This was partially

based on the judgment of the uncertainties in material fragilities and event

durations.

(9) Summary of Results and Impact

The NRCs quantitative risk assessment was determined to represent a risk

estimate in the "White" region. The White Finding is based on internal event

initiated CDF.

(c)

Peer Review:

The analyst requested a peer review of this analysis from the Office of Nuclear

Reactor Regulation, Division of Risk Assessment, PRA Operations and Human

Factors Branch. As a result of this review, all peer reviewer comments were

addressed and/or incorporated into the final detailed risk evaluation.

(d)

References:

The analysts used the following generic references in preparing the risk

assessment:

NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power

Plants in the United States

• NUREG/CR-6883, The SPAR-H Human Analysis Method. August 2005

NUREG-1842, Good Practices for Implementing Human Reliability

Analysis. April 2005

NUREG/CR-6595 Revision 1, An Approach for Estimating the

Frequencies of Various Containment Failure Modes and Bypass Events.

October 2004

INL/EXT-10-18533 Revision 2, SPAR-H Step-by-Step Guidance.

May 2011

RASP Manual Volume 1 - Internal Events, Revision 2.0 dated

January 2013

Risk Assessment of Operational Events, Volume 2 - External Events,

Revision 1.01, January 2008

NUREG/CR-1278, Handbook of HRA with Emphasis on Nuclear Power

Plant Applications, August 1983

NRC Inspection Manual Chapter 0609, Significance Determination

Process

The analysts used the following plant specific references:

Standardized Plant Analysis Risk model for Fort Calhoun Station,

Versions 8.20 and 8.21

EPRI Technical Report 3002000079, Pipe Rupture Frequencies for

Internal Flooding Probabilistic Risk Assessments, Revision 3

Licensee White Paper, Performance of Nitrile Valve Elastomers at High

Temperatures

Abnormal Operating Procedure AOP-28, Auxiliary Feedwater System

Malfunctions, Revisions 15 and 18

Emergency Operating Procedure EOP-03, Loss of Coolant Accident

Emergency Operating Procedure EOP-20, Functional Recovery

Procedure

Figure 8.1-1, Simplified One Line Diagram, Plant Electrical System,

P & ID

Fort Calhoun Station Unit No. 1, Updated Safety Analysis Report

Licensee Design Evaluation Elastomers A-155, Temperature Ratings for

Elastomers in Air Operated Valves

Licensees Event Tree, I3Q Elastomer Event Tree 10-01-2013

Probabilistic Risk Assessment Fault Tree @ISLCVCS, CVCS Letdown

Line Outside Containment Overpressurizes, dated August 20, 2014

Drawing 11405-M-252, Sheet 1, Flow Diagram Steam, P & ID,

Revision 113

Drawing 11405-M-253, Sheet 1, Flow Diagram Steam Generator

Feedwater and Blowdown, P & ID, Revision 98

Drawing 11405-M-253, Sheet Cov., Composite Flow Diagram Steam

Generator Feedwater and Blowdown, P & ID, Revision 52

Drawing CHDR 11405-A-5, Primary Plant Ground Floor Plan, P & ID,

Revision 45

Drawing 11405-A-7, Primary Plant Intermediate & Operating Floor Plans,

P & ID, Revision 31

• Drawing 11405-A-8, Primary Plant Operating Floor Plan, P & ID,

Revision 51

Combustion Engineering Nuclear Power LLC, ST-2000-0627, Fort

Calhoun Station Unit 1, Recommendation for Closure of PRA Concern

CCF 099-002, Revision 001