IR 05000285/2011014

IR 05000285-11-014; on 09/12/2011 - 02/29/2012; Fort Calhoun Station; Special Inspection; Violations of 10 CFR Part 50, Appendix B, Criterion III and Criterion XVI, and License Condition 3.D were identified

ML12072A128
Person / Time
Site:	Fort Calhoun
Issue date:	03/12/2012
From:	Anton Vegel Division of Reactor Safety IV
To:	Bannister D J Omaha Public Power District
References
EA-12-023, FOIA/PA-2013-0250 IR-11-014
Download: ML12072A128 (90)

Text

March 12, 2012

EA-12-023 David J. Bannister, Vice President and Chief Nuclear Officer Omaha Public Power District Fort Calhoun Station FC-2-4 P.O. Box 550 Fort Calhoun, NE 68023-0550 Subject: FORT CALHOUN STATION - NRC SPECIAL INSPECTION REPORT 05000285/2011014; FINDING OF PRELIMINARY HIGH SAFETY SIGNIFICANCE

Dear Mr. Bannister:

On February 29, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a reactive inspection pursuant to Inspection Procedure 93812, "Special Inspection," at your Fort Calhoun Station in response to a fire in the safety-related 480 Vac electrical distribution system. The enclosed inspection report documents the inspection results, which were discussed on February 29, 2012, with you and other members of your staff. The special inspection commenced on September 12, 2011, in accordance with NRC Management Directive 8.3, "NRC Incident Investigation Program," and Inspection Manual Chapter 0309, "Reactive Inspection Decision Basis for Reactors," based on the initial risk and deterministic criteria evaluation made by the NRC on September 7, 2011. The special inspection reviewed the circumstances surrounding the fire that resulted in a loss of power to six of nine safety-related 480 Vac buses and the resulting declaration of an Alert which occurred on June 7, 2011. The inspection also examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. At the time of the fire, the plant was in cold shutdown and had declared a Notice of Unusual Event due to flooding along the Missouri River. When immediate response measures were taken for the fire, plant operators exited the Alert and returned to the Notice of Unusual Event condition. As a result of impacts to the site from the flood and because the plant remained safe and stable in cold shutdown, the NRC delayed conducting the special inspection to avoid diverting necessary resources from the ongoing flooding event and mitigation efforts. During the fire event discussed in this report the reactor remained in a safe and stable condition.

The enclosed inspection report documents the preliminary results of the inspection, including a finding involving deficient modification and maintenance of the safety-related 480 Vac electrical distribution system and a failure to maintain in effect all provisions of the approved fire protection program, each a contributor to the fire. The inspection team determined that prior to the fire, your staff failed to adequately investigate the source of an acrid odor in the west switchgear room that had been present for three days. A proper investigation may have prevented the fire. Following the fire, your staff appropriately performed a causal analysis to identify the potential contributors to the electrical distribution system failures, but failed to promptly collect plant data or assess the operator and fire brigade response which impeded your staff's understanding of the event significance. The NRC determined that because your staff took compensatory measures to ensure that high resistance connections were corrected in the other affected load centers, and reactor shutdown cooling systems were not directly affected, this finding did not represent an immediate safety concern. The fire event discussed in this inspection report occurred while the plant was in a cold shutdown condition. The preliminary risk assessment demonstrates that the majority of the risk relates to operating the plant at power. The NRC assessed this finding based on the best available information, including influential assumptions, using the applicable Significance Determination Process (SDP). The finding has preliminarily been determined to be of high safety significance (Red). The preliminary significance was based on the high fire frequency given the short period of time that the breaker cradles had been in service, the significant damage caused by a failure, and the inability of plant personnel to enter the switchgear rooms following a postulated fire in time to successfully minimize dc loads on the vital batteries. We understand that differences between the NRC's evaluation and that of your staff included:

(1) the impact of postulated seismic events on the 480 volt breaker cradles and bolted buswork; (2) the vulnerability time used to calculate the common cause potential of a second fire; and (3) credit for the turbine-driven auxiliary feedwater pump following battery depletion. Additionally, while considered as a qualitative input, the NRC considered the shutdown risk following a postulated fire to be a significant risk factor. The details of all primary assumptions associated with the preliminary significance determination are documented in Attachment 3 of the enclosed report. In summary, during the event on June 7, 2011, the plant remained in a safe and stable shutdown condition. The NRC found that deficient modification and maintenance of the safety-

related 480 Vac electrical distribution system were the primary contributors to the fire and these latent conditions existed during periods when the plant was at power. The NRC used probabilistic assessment tools to evaluate the significance of this issue and determined that based on the best available information this was preliminarily a finding of high safety significance.

The finding is also associated with apparent violations of NRC requirements and is being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on the NRC's Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. In accordance with NRC Inspection Manual Chapter (IMC) 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staff's final determination. Before we make a final decision on this matter, we are providing you with an opportunity to: (1) submit, in writing, either your acceptance of this preliminary significance determination or your position on the significance of this finding to the NRC in writing, or (2) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, the Conference will be open for public observation, which will require a public meeting notice and a press release. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either you fail to meet the appeal requirements stated in the Prerequisite and Limitation Sections of Attachment 2 of IMC 0609. Please contact Geoffrey Miller at 817-200-1137 and respond in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.

The final resolution of this matter will be conveyed in separate correspondence. Since the NRC has not made a final determination in this matter, a Notice of Violation is not being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violations may change as a result of further NRC review. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA/ Anton Vegel, Director Division of Reactor Safety Docket: 50-285 License: DPR-40

Enclosure:

NRC Inspection Report 0500285/2011014 w/Attachments Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Significance Determination Evaluation Attachment 4: Diagrams of Electrical Distribution System Attachment 5: Table of Digital Low Resistance Ohmmeter Readings Electronic Distribution for Fort Calhoun Station

SUMMARY OF FINDINGS

IR 05000285/2011014; 09/12/2011 - 02/29/2012; Fort Calhoun Station; Special Inspection; Violations of 10 CFR Part 50, Appendix B, Criterion III and Criterion XVI, and License Condition 3.D were identified.

This report covered an 8-day period (September 12 - September 16, and December 12 - December 14, 2011) of onsite inspection, with additional in-office review through February 29, 2012. One finding was identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." The crosscutting aspects were determined using IMC 0310, "Components within the Cross-Cutting Areas." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Initiating Events

AV. The failure to ensure that the 480 Vac electrical power distribution system design requirements were properly implemented and maintained through proper maintenance, modification, and design activities led to a catastrophic fire in a switchgear impacting the required safe shutdown capability of the plant. Three self-revealing apparent violations were identified with this performance deficiency:

• A violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the failure to ensure that design changes were subject to design control measures commensurate with those applied to the original design and that measures were established to assure that applicable regulatory requirements and the design basis for those safety-related structures, systems, and components were correctly translated into specifications, drawings, procedures, and instructions;

• A violation of 10 CFR Part 50, Appendix B, Criterion XVI "Corrective Action," for the failure to establish measures to assure that a significant condition adverse to quality was promptly identified and corrected, and measures taken to preclude repetition;

• A violation of License Condition 3.D, "Fire Protection Program," for the failure to ensure that the electrical protection and physical design of the 480 Vac electrical power distribution system provided the electrical bus separation required by the fire protection program.

Specifically: (1) design reviews and work planning for a modification to install twelve new 480 Vac load center breakers failed to ensure that the cradle adapter assemblies had a low-resistance connection with the switchgear bus bars by establishing a proper fit and requiring low resistance connections; (2) preventive maintenance activities were inadequate to ensure proper cleaning of conductors, proper torquing of bolted conductor and bus bar connections, or adequate inspection for abnormal connection temperatures; and (3) design reviews of the electrical protection and train separation of the 480 Vac electrical power distribution system were inadequate to ensure that a fire in load center 1B4A would not adversely impact operation of redundant safe shutdown equipment in load center 1B3A, as required by the fire protection program. The licensee entered these issues into their corrective action program under numerous condition report numbers, which are described in the body of this report. The performance deficiency was determined to be more than minor because it affected the Initiating Events Cornerstone and was associated with both the protection against external events attribute (i.e., fire) and the design control attribute. The finding affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," Table 4a, directed the process to a Phase 3 analysis because the finding increased the likelihood of an external event (fire), and impacted mitigating systems needed to respond to that initiating event. A Phase 3 analysis was completed using the plant-specific Standardized Plant Analysis Risk Model for Fort Calhoun, Revision 8.15, the Individual Plant Evaluation of External Events (IPEEE), and hand calculations. The analysis covered the risk affected by the performance deficiency for postulated fires of any of the remaining nine continuously energized breakers including the potential for multiple fire initiators. Additionally, seismically-induced fires were postulated based on the characteristics of the performance deficiency. Based in the best available information the performance deficiency was preliminarily characterized as a finding of high safety significance (Red). This performance deficiency had a crosscutting aspect in the area of human performance associated with the resources component because the licensee did not ensure that personnel, equipment, procedures, and other resources were adequate to assure nuclear safety. Specifically, the licensee did not ensure that design documentation, procedures, and work packages were adequate to assure that design margins were maintained. H.2(c) (Section 3.10).

B. Licensee-Identified Violations

None.

REPORT DETAILS

1.0 Basis for Special Inspection On June 7, 2011, a switchgear fire occurred at the Fort Calhoun Station while the plant was shut down for a planned refueling outage. The fire resulted in a loss of power to six of nine safety-related 480 Vac electrical distribution buses and two of four safety-related 4160 Vac buses. This event met the following deterministic criteria of Management Directive 8.3 for a detailed follow up team inspection:

• The event resulted in the loss of the spent fuel pool cooling function and could have resulted in the loss of a safety function or multiple failures in systems used to mitigate an event had the event occurred at power.

• The event resulted in significant unexpected system interactions. Specifically, combustion products from the fire caused a fault across an open bus-tie breaker on island bus 1B3A-4A, and feeder breaker 1B3A tripped unexpectedly resulting in loss of power to the opposite train bus. Also, the event resulted in grounds on both trains of safety-related direct current power used for breaker operation and electrical protection.

• The event involved questions or concerns pertaining to licensee operational performance, since an acrid odor was reported in the area of the fire three days prior to the fire, but the licensee did not identify the source of the odor or prevent the fire. The Maximum Conditional Core Damage Probability for the event was estimated to be 3.4 x 10-4, which is in the range for an Augmented Inspection Team. However, the NRC determined that the appropriate level of response was a Special Inspection because the plant would remain safe and stable in cold shutdown through the period of the inspection.

At the time of the fire, Fort Calhoun Station was experiencing impacts from flooding of the Missouri River and had declared a Notice of Unusual Event on June 6, 2011. The NRC determined that licensee attention should focus on that ongoing situation while assessing the causes and impacts of the fire as resources permitted. When a preliminary cause of the fire was identified, the NRC began the Management Directive 8.3 evaluation process. The NRC conducted the special inspection to better understand the circumstances surrounding the response of the electrical distribution system and plant personnel leading to and following the fire in the 1B4A switchgear, which adversely affected the safety function of multiple safety systems used for accident mitigation. The team used NRC Inspection Procedure 93812, "Special Inspection Procedure," to conduct the inspection. The special inspection team performed field walkdowns, reviewed procedures, corrective action documents, operator logs, design documentation, and maintenance records for the electrical distribution system and personnel response. The team interviewed various station personnel regarding the events which occurred on June 7, 2011. The team reviewed the licensee's root cause analysis report, past failure records, extent of condition evaluations, immediate and long term corrective actions, and applicable industry operating experience. A list of documents reviewed is provided in Attachment 1 of this report, and the charter for the special inspection is included as Attachment 2. 2.0 Event Description At approximately 9:30 a.m. on June 7, 2011, while the plant was in cold shutdown, the licensee declared an Alert due to a fire in the west switchgear room. The Halon system in the room automatically actuated and aided in extinguishing the fire. The fire brigade responded, as did off-site fire assistance. The plant was in a planned refueling outage, and was already in a Notice of Unusual Event condition due to flood levels on the Missouri River. For three days prior to the event, the licensee investigated an acrid odor in the switchgear room but was unable to identify the source.

The fire was caused by the catastrophic failure of the feeder breaker for 480 Vac load center 1B4A in the west switchgear room. A large quantity of soot and smoke was produced by the fire which migrated into the non-segregated bus duct (a metal enclosure containing the bus bars for all three electrical phases) connecting the 1B4A bus to island bus 1B3A-4A, even though the bus-tie breaker was open. The safety-related 480 Vac distribution system arrangement is illustrated in Figure 1 of Attachment 4. The smoke and soot were sufficiently conductive that arcing occurred between the bus bars such that island bus 1B3A-4A and the other connected train load center 1B3A were affected. The load center supply breaker 1B3A and the bus-tie breaker tripped, resulting in 480 Vac buses 1B3A and 1B3A-4A being de-energized. Operators manually opened the 4160 Vac feeder breaker upstream of the faulted breaker to de-energize the 1B4A bus. Some minutes later, in accordance with the applicable procedure, operators manually de-energized 4160 Vac buses 1A2 and 1A4, which resulted in de-energizing the remaining 480 Vac buses on the same train as the fire. This left only three of the nine safety-related 480 Vac buses energized. During the early stages of the operators' response to the fire, the electrical distribution system alignment was reconfigured to combat the effects of the fire. When bus 1B3A was de-energized, spent fuel pool cooling pump A (AC-5A) was de-energized. When 4160 Vac bus 1A4 was de-energized, the other spent fuel cooling pump (AC-5B) was also de-energized, resulting in a loss of spent fuel pool cooling. Shutdown cooling for the reactor coolant system continued to operate and was not affected by the event. During the event, both trains of safety-related 125 Vdc power were affected by grounds caused by the effects of the fire in load center 1B4A.

The licensee issued Licensee Event Report (LER) 05000285/2011008-00, dated August 5, 2011, for this issue stating that the root cause was still being determined. The licensee supplemented this report on October 27, 2011 to provide the results of the root cause analysis and to update reportability criteria.

.0 Inspection Results

3.1 Timeline (Charter Item 1)

a. Inspection Scope

The team developed and evaluated a timeline of significant events for the modification of 480 Vac breakers and subsequent June 7, 2011, fire. The team developed the timeline, in part, through a review of control room alarm logs, control room operator log entries, plant voltage plots, review of post-event statements from the on-shift operators, and interviews with plant fire brigade personnel, system engineers, and electrical maintenance personnel.

b. Findings and Observations

The team determined that the licensee did not have a formal process for evaluating plant events against the expected plant response, assessing operator response, or collecting plant response data for events of this type. The team reviewed licensee logs for the event and identified instances in which the logs did not document key actions or events. Examples included not logging entry into Abnormal Operating Procedures, and not logging the times offsite emergency response personnel arrived onsite. The failure to capture important information for complete event reconstruction hampered the licensee's understanding of the event.

The licensee initiated Condition Report CR 2011-7698 to document that Fort Calhoun Station did not have and needed a procedure or process for collecting and assessing event-related information in a timely manner following an event, and that the station had failed to conduct a comprehensive review of the events of June 7, 2011.

Timeline of Events Identified by the Team Some of the entries in the timeline are approximate due to the lack of evidence preservation and lack of post-event data collection by the licensee. The team reviewed a period leading up to the event as well as the day of the event. A brief timeline of post-event actions is provided. This evaluation was performed to assess the effectiveness of licensee's actions taken in response to the safety-related 480 Vac electrical distribution system deficiencies which caused a fire in the west switchgear room. The following timeline was developed: PRIOR TO THE EVENT May 22, 2008 The licensee initiated Condition Report CR 2008-3548 in response to breaker BT-1B3A failing to close. During troubleshooting activities the licensee identified hardened grease on the secondary disconnects and dirty secondary contacts. The root cause analysis determined that Procedure EM-PM-EX-1200, "Inspection and Maintenance of Model ADK-5 Low Voltage Switchgear," was less than adequate.

May 14, 2009 The licensee developed Condition Report CR 2009-2306 and established corrective actions in response to NRC-identified issues of concern with inadequate maintenance of Class 1E circuit breakers and switchgear. Corrective actions included revising maintenance procedures, including Procedure EM-PM-EX-1200. July 14, 2009 The NRC opened Unresolved Item (URI)05000285/2009007-02 involving vendor and industry recommended testing on safety-related and risk significant 4160 Vac and 480 Vac circuit breakers.November, 2009 The licensee performed modification EC 33464 to replace twelve General Electric AK-50 type 480 Vac breakers with Nuclear Logistics Incorporated/Square-D breakers which included the introduction of cradle assemblies to fit the new breakers into existing switchgear. July 2, 2010 The NRC closed URI 05000285/2009007-02 by issuing non-cited violation 05000285/2010004-09 for failure to perform vendor and industry recommended testing on safety-related and risk significant 4160 Vac and 480 Vac circuit breakers. March 2, 2011 The licensee revised procedure EM-PM-EX-1200, "Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear," to add instructions for verifying the material condition of the silver-plated bus stab area for the new breakers installed in 2009. June 4, 2011 An acrid odor was noticed by Operations and electrical maintenance personnel in the switchgear room containing safety-related 480 Vac buses. No condition report was written. The odor was investigated using only non-intrusive visual inspections and sense of smell. The licensee failed to find the source of the odor.

June 6, 2011 The licensee entered Notice of Unusual Event (HU 1, EAL 5) for a river level expected to exceed 1004 feet Mean Sea Level. June 6, 2011 Condition Report CR 2011-5400 was initiated reporting the acrid odor in the switchgear room. JUNE 7, 2011 BREAKER FIRE EVENT 09:27 A high impedance connection caused failure of 480 Vac feeder breaker 1B4A, creating a fire in the 1B4A safety-related switchgear. Breaker 1B4A was destroyed. Load Center 1B4A was heavily damaged.09:27 Control room operators received numerous indications of electrical transients including dc system ground indications on both dc buses, and bus phase currents oscillating from 0 amps to 200 amps on bus 1B4A. Operators also noticed dimming/flickering indicating lights on control room control panels.

9:27 Soot and combustion products from the fire caused an unexpected phase-to-phase fault on non-segregated bus duct conductors between open bus-tie breaker BT-1B4A and island bus 1B3A-4A. This second fault created electrical transients on buses 1B3A and 1B3A-4A, which were part of the redundant train. 09:28 Control room operators attempted to remotely open breaker 1B4A from control room, but the attempts failed. 09:28 Control room operators remotely opened 4160 Vac feeder breaker 1A4-10 which fed 4160/480 Vac transformer T1B-4A. Opening this breaker de-energized 480 Vac bus 1B4A. 09:28 Feeder breaker 1B3A unexpectedly tripped. Bus-tie breaker BT-1B3A tripped. These trips resulted in loss of power to bus 1B3A and island bus 1B3A-4A. Motor control center 3A2 powering the running spent fuel cooling pump was de-energized. 09:30 (Time approximate) Control room operators noticed fire alarm indications in the control room when they heard audible Halon discharge alarms from the west switchgear room. Operators entered Abnormal Operating Procedure (AOP)-6-2, "Fire Emergency: Uncontrolled Areas of Auxiliary Building," for a fire in the switchgear room. 09:31 The control room received a report from security personnel that heavy smoke was coming out of the west switchgear room. 09:31 Control room operators attempted to close feeder breaker 1B3A remotely from the control room. The attempts failed. 09:32 Control room operators entered procedure AOP-32, "Loss of 4160 Vac or 480 Vac Bus Power," for the loss of a safety-related 480 Vac bus. 09:35 (Time approximate) Control room operators sounded the site-wide fire alarm. Fire brigade assembled in designated area to dress out and created a plan of attack. 09:38 Offsite fire departments were contacted for assistance via 911. 09:40 The licensee declared an Alert for a fire affecting the operability of plant safety systems required to establish or maintain safe shutdown. 09:40 (Time approximate) Site fire brigade reported to the control room that smoke was too thick to enter the switchgear room. 10:00 Control room operators de-energized 4160 Vac buses 1A4 and 1A2 per procedure AOP-6, "Fire Emergency." In addition to the other de-energized buses, this de-energized load centers 1B4B, 1B4C, and island bus 1B3B-4B. 10:01 City of Blair volunteer fire department personnel entered the protected area. 10:17 Control room operators entered procedure AOP-36, "Loss of Spent Fuel Pool Cooling," for the loss of both trains of spent fuel pool cooling.

RECOVERY OF SPENT FUEL POOL COOLING AND SUBSEQUENT ACTIONS (June 7, 2011) 10:19 Blair volunteer fire department personnel entered the switchgear room and reported the fire was out, but heavy smoke remained. 10:30 (Time approximate) Additional offsite assistance from the City of Fort Calhoun volunteer fire department entered the protected area. 11:44 The licensee recognized that they also met the Emergency Activation Level criteria for an Alert due to lack of access to a vital area from toxic gases in the switchgear room (Halon/smoke). The licensee remained in an Alert for both a fire affecting the operability of plant safety systems required to establish or maintain safe shutdown and the lack of access to a vital area. 11:44 Operators established a cross-tie configuration from 4160 Vac bus 1A3 through 480 Vac breaker 1B3C to island bus 1B3C-4C to restore power to 480 Vac bus 1B4C. 11:47 Control room operators restored spent fuel pool cooling by starting the train B spent fuel pool cooling pump on the restored 480 Vac bus. 12:23 Chemistry personnel reported that air samples in the west switchgear room indicated that it was safe for personnel to enter. 12:28 Operators exited AOP-36, "Loss of Spent Fuel Pool Cooling."

12:28 (Time approximate) Electrical Maintenance entered the west switchgear room to determine extent of damage and troubleshoot the failure of 1B3A to close remotely from the control room. 12:28 (Time approximate) Electrical Maintenance manually reset 480 Vac feeder breaker 1B3A and reported that the breaker had tripped on overcurrent. 12:44 Battery charger #3 was aligned to dc bus #2 to restore charging after battery charger #2 was de-energized as a result of the loss of bus 1B4A. 13:15 Licensee exited Alert after confirming that the fire was extinguished in the switchgear room and access had been restored. EVENT REVIEW AND INSPECTION September 12 The NRC Special Inspection Team arrived on site and questioned the extent of condition of cradle finger engagement issues with load center bus stabs of other safety-related 480 Vac load centers. September 13 The licensee declared the remaining eight 480 Vac load centers inoperable. September 15 The licensee began additional causal analysis of the spurious trip of breaker 1B3A. October 12 The licensee removed breaker 1B3A for transfer to vendor for failure analysis.

December 12 Senior Reactor Analyst and Team Lead arrived on site for procedure and additional field walkdowns, additional interviews with plant personnel and risk assessment discussions. 3.2 Operator Response (Charter Item 2)

a. Inspection Scope

The team interviewed Operations personnel who were on shift during the event to evaluate operator and plant responses to the initial indications of the electrical distribution system problems, including electrical grounds, fire, and loss of Class 1E buses. Also, the team reviewed written operator event statements. The team evaluated procedure use and the appropriateness of event classification and reporting. On December 12, 2011, the team observed operator activities in the licensee's simulator which were conducted to improve the team's understanding of plant and operator responses to the event.

b. Findings and Observations

The team had the following observations regarding operator response to the event:

• The on-shift control room operators did not promptly recognize they were dealing with a fire. Multiple annunciator alarms and abnormal control board indications caused, in part by grounds on both trains of safety-related 125 Vdc control power and operator attention to the electrical transient indications delayed the recognition of the fire alarms.

• After the unexpected tripping of breaker 1B3A, operations personnel repeatedly attempted and failed to remotely re-close the breaker. The licensee did not perform an investigation to determine why the breaker had tripped prior to the attempts to reclose the breaker. The licensee later discovered that after tripping, the Nuclear Logistics Incorporated/Square-D breakers must be locally reset prior to being remotely operated. The licensee initiated Condition Report CR 2011-5569 to address deficient operator knowledge on the reset feature of the Nuclear Logistics Incorporated/Square-D breakers.

• Operations personnel de-energized 4160 Vac buses 1A2 and 1A4 per procedure, which also resulted in the loss of all respective downstream 480 Vac buses approximately 30 minutes after the fire. This resulted in the loss of spent fuel pool cooling for approximately 90 minutes, which caused an increase in spent fuel pool temperature of approximately 3 degrees Fahrenheit. The time to boil was approximately 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> in the reactor vessel and 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> in the spent fuel pool. The inspectors concluded that this action was appropriate in view of the possible damage to the electrical power distribution system.

• After the fire was confirmed to have been extinguished, operators placed the electrical distribution system in an abnormal alignment with 480 Vac load center 1B4C powered from bus 1A3, through the island bus 1B3C-1B4C, to provide power to spent fuel pool cooling pump B. Bus 1B4B was also cross-tied to the 1A3 bus. The inspectors concluded that this action was appropriate for the plant conditions, and was covered by procedures. The team identified that the licensee did not have a process for reviewing events of this type, and as a result, failed to adequately collect data, assess the response, and identify conditions and significant conditions adverse to quality in a timely manner. This resulted in the licensee failing to recognize the risk significance of the problems present during the event. Because the licensee did not have a process for review, no overall event assessment was performed. The actual cause of the fire was originally the only condition to receive a root cause assessment. The licensee failed to evaluate operator response, and as a result, did not recognize problems involving diagnosing the symptoms of the fire, control of the fire brigade, and operator lack of understanding of the reset requirements for the new breakers. 3.3 Fire Suppression Review (Charter Item 3)

a. Inspection Scope

The team walked down the west switchgear room (Fire Area 36B), which housed the 1B4A load center and the source of the fire, and the east switchgear room (Fire Area 36A) which contained the 1B3A load center and the 1B3A-1B4A island bus. The team held discussions with licensee staff about the event including operator and fire brigade responses. The team reviewed the licensee's fire protection program including the design, maintenance, testing, and operation of the fire detection and suppression systems in the switchgear rooms. The team performed a walkdown of the automatic detection and Halon suppression systems in the fire area to validate the installation met the design requirements, to evaluate the material condition, and to verify the suppression system design was appropriate for the hazards in the fire area. The team conducted interviews with the fire protection system engineer to determine that the detection system and Halon suppression system had functioned as designed and that the system had been properly returned to service. The team assessed the fire brigade performance by reviewing training and qualification records, conducting interviews with the Operations crew that was on shift during the event, the fire brigade team members who responded to the event, and the Senior Instructional Technician who was responsible for fire brigade training. The team reviewed pre-fire plans and smoke removal plans for the fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of the fire.

b. Findings and Observations

Fire Protection Program:

The licensee's fire protection program was defined in the Updated Safety Analysis Report and NRC safety evaluation reports. Section 9.11.1 of the Updated Safety Analysis Report describes the fire protection system design basis and states, in part, that the design basis of the fire protection system includes commitments to 10 CFR Part 50, Appendix R, Sections III.G, III.J, and III.O.Section III.G, "Fire protection of safe shutdown capability," requires, in part, that fire protection features be provided for structures, systems, and components important to safe shutdown, and that these features be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions is free of fire damage.

Section 9.11.4.5 of the Updated Safety Analysis Report documented that descriptions of plant design and construction features for the fire protection program were contained in Fort Calhoun Station Fire Hazards Analysis and Safe Shutdown

Analysis.

FHA-EA97-001, "Fire Hazards Analysis (FHA) Manual," Revision 16, stated, in part, that a fire in fire area 36B (west switchgear room) might affect all switchgear associated with the west switchgear area, including panels powering one train of redundant components used to provide all safe shutdown requirements. The Fire Hazards Analysis also stated that a 3-hour rated barrier separated fire area 36B from fire area 36A (east switchgear room), and that fire area 36A contained the other redundant train which provided the necessary functions needed to perform safe shutdown. The Fire Hazards Analysis concluded that a fire in fire area 36B would not affect safe shutdown.

Section 9.11.5 of the Updated Safety Analysis Report discusses the safe shutdown analysis. This analysis was documented in EA-FC-89-055, "10 CFR 50 Appendix R Safe Shutdown Analysis," Revision 17, and provided the basis for compliance with Appendix R requirements. The analysis assumed that a fire in a switchgear room would cause a fault in the 480 Vac bus that connected load centers in one room to load centers in the redundant switchgear room, via the island buses. However, the safe shutdown analysis also assumed that the bus-tie breakers in the unaffected switchgear room would open in response to the fault condition, protecting the redundant train. During the fire event in load center 1B4A, the feeder breaker in the redundant train tripped open and de-energized the redundant train load center. The licensee's root cause analysis identified that since the breaker protection scheme did not function as designed, load center 1B3A was de-energized and both trains were impacted from a single fire which was inconsistent with assumptions made in the fire protection program.

The team concluded that fire protection program requirements were not met because the licensee failed to assure that a fire in load center 1B4A would not adversely affect the safe shutdown circuits in the redundant train. This issue is discussed further in sections 3.7 and 3.10. The team also concluded that the licensee had missed opportunities to prevent the fire. For approximately three days prior to the fire, an unusual acrid odor was detected in the west switchgear room, and investigations failed to determine the cause. The team determined that the licensee had used only non-intrusive visual inspections and sense of smell to investigate the unusual odor. Because the switchgear room is a highly ventilated area, the team concluded that the reliance on the sense of smell would not be an effective means to identify the source of the acrid odor. Further, the team determined that the licensee had the capability of performing thermography scans of the switchgear but did not, and did not open any panels or switchgear as part of the investigation. Corrective action program entries discussed other events in which acrid odors were identified, but the source of the odors were never located. The team concluded that the licensee did not perform a thorough investigation of the abnormal odor. This issue was identified by the licensee's root cause analysis as a contributing cause for the event. Condition Report CR 2011-5400 was written to document that operators had identified a strong acrid odor originating in the west switchgear room. Condition Report CR 2011-5852 was written to document deficiencies in the problem identification process related to identifying incipient conditions.

Fire Brigade: Plant fire brigade performance was governed, in part, by Standing Order SO-G-28, "Station Fire Plan," Revision 81, which defines fire brigade responsibilities including the use of pre-fire plans and command and control functions. The pre-fire plan for the west switchgear room showed that the fire brigade staging area was in corridor 53, located on the north end of the room and secondary access was on the south end of the room. Responding to the event, the fire brigade backup team deployed to the secondary access without being directed to do so while the primary team deployed to the designated staging area. This divided the fire brigade team, affecting the team's mitigation capability.

Standing Order SO-G-28, section 4.8.4, stated, in part, that inside the protected area the fire brigade leader shall maintain the command role. Both the City of Fort Calhoun volunteer fire department and the City of Blair volunteer fire department responded to the event. The Blair fire department went to the staging area where the station fire brigade leader was located. The Fort Calhoun fire department went to the south access without being directed to do so by the station fire brigade. Also, contrary to the requirements of SO-G-28 and station fire brigade training, the fire brigade transferred command and control to the offsite fire department when they arrived. The team concluded that the fire brigade response did not demonstrate effective command and control and the station's fire brigade presence added limited value to the outcome of the event because the fire brigade:

• Did not use available tools to determine status of fire (thermography).

• Did not know that the fire brigade leader was responsible for requesting de-energization of electrical equipment.

• Did not declare the fire extinguished because they did not enter the space; this was accomplished by the offsite fire team after entering the space.

• Did not perform a search for victims in the fire area. Discussions with fire brigade members indicated that the station did not perform an accountability check after the fire, and that accountability checks were not typically done.

Condition Reports CR 2011-7356 and CR 2011-9219 documented the fire brigade deficiency in command and control. Condition Reports CR 2011-8275, CR 2011-8600, CR 2011-8672 and CR 2011-9219 document deficiencies in fire brigade training. Condition Reports CR 2011-7624 and CR 2011-8274 document that the station had not conducted a formal debriefing of the fire brigade response to the fire in load center 1B4A.

Station performance associated with fire brigade command and control will be further addressed during the triennial fire protection inspection in March 2012. 3.4 Modification Review (Charter Item 4)

a. Inspection Scope

The team reviewed modification EC 33464, "Replace AK-50 480 V Main and Bus-Tie Breakers With Molded Case Type or Equivalent," Revision 0, which replaced 12 General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices in November 2009. The modification replaced six feeder circuit breakers and six bus-tie breakers. These breakers and their relation to the Fort Calhoun Station electrical distribution system are shown in Figure 1 of Attachment 4. The team interviewed the system engineers responsible for the 480 Vac distribution system and electrical maintenance technicians that maintained the system. The team interviewed Operations personnel and discussed procedures and training for the modification. The team reviewed the modification to determine if the requirements of 10 CFR 50.59, "Changes, Tests and Experiments" were met, including understanding the possible failure modes, and to assess the post-modification testing completeness for cradle and breaker positioning, electrical resistance, and other critical parameters.

b. Findings and Observations

The modification was developed to address obsolescence issues and long-standing maintenance problems with the original AK-50 circuit breakers. Fort Calhoun Station used General Electric AKD-5 Powermaster Low Voltage Drawout Switchgear with a welded aluminum bus bar structure that transitioned to copper bus stabs with silver-plated ends in each breaker cell. The AK-50 circuit breakers connected directly to the silver-plated areas on the line and load stabs. The new Nuclear Logistics Incorporated/Square-D circuit breaker design was an integrated unit consisting of a circuit breaker and cradle assembly. The cradle assembly converted the internal vertical breaker connectors to top and bottom spring-loaded horizontal finger assemblies which connected to the silver-plated bus stabs. The integrated assembly was designed as a retrofit for the existing AKD-5 switchgear.

The modification stated that the new breakers were designed to be one-for-one replacements for the existing breakers. The following differences existed between the original and modified design:

• The new Nuclear Logistics Incorporated/Square D breakers were physically smaller than the existing breakers and would not fit in the existing switchgear without the cradle assembly.

• The switchgear doors had to be replaced because the original doors would not accommodate the new breakers.

• The new cradle finger connector assemblies were not the same length as the connector assemblies on the original breakers, resulting in cradle to bus bar connections which were different than the original design.

• The new electronic trip devices on the breakers had features that the original trip unit did not, including a digital control unit with memory function for retention of current values, an instantaneous overcurrent trip function, and a time-current function. The trip unit had a lithium battery to power the indicators on the electronic trip unit. The team determined that the licensee's modification process failed to recognize the potential for high resistance connections to exist from inadequate cradle finger connector engagement with the switchgear bus bars, and did not recognize that additional failure modes were created by the addition of the cradle assemblies. The modification did not recognize and evaluate the following conditions that contributed to the fire:

• The cradle assembly silver fingers were too long to make contact on the silver-plated portion of the bus stabs without additional changes to the breaker position. By contacting the dissimilar metal (copper), oxidation could build up over time and increase electrical resistance and heating. Condition Report CR 2011-6319 was written, during the extent of condition reviews, for the licensee's discovery of the improper engagement of cradle fingers to silver plating on the stabs.

• Electrical maintenance personnel regularly cleaned only the silver-plated parts of the bus stabs, so they failed to remove hardened grease that was present on the copper part of the stabs where the cradle assembly fingers actually made contact. The hardened grease increased the electrical resistance resulting in increased heating of the connections.

• The modification required verifying low resistance readings between the breaker and cradle, but did not require measuring resistance between the cradle and the bus stabs. Following the fire, the licensee determined that the undamaged breakers had elevated contact resistance between the cradle and the bus stabs. See Attachment 5 for tabulated resistance values.

• Maintenance personnel noted that the design change package did not contain adequate drawings or dimensions for cradle details.

During installation of the modification, the licensee determined that nine out of twelve cradle assemblies did not align with the drawout interlock pin holes. Personnel installing the breakers performed a field change to improve pin alignment, but no analysis or review was performed prior to the field change to ensure it would not adversely impact the new breakers. Condition Report CR 2011-6101 was written to capture this failure.

The team reviewed the implementation of 10 CFR 50.59, "Changes, Tests and Experiments," for the modification by reviewing the licensee's applicability and screening documents and the licensee's implementation procedure, FCSG-23, "10 CFR 50.59 Resource Manual," Revision 7. Section 5.2.2 of FCSG-23 states, in part, that changes that have an adverse effect are required to be evaluated under 10 CFR 50.59 because they have the potential to increase the likelihood of malfunctions, increase consequences, create new accidents, or otherwise meet the 10 CFR 50.59 evaluation criteria. The licensee's screening process concluded that the modification did not have an adverse effect on the design function of the 480 Vac electrical distribution system because the replacement breakers performed the same function as the original components. The team disagreed with this conclusion, in part, because the new breaker and cradle assemblies potentially introduced new failure mechanisms the licensee had not identified and the connections between the breaker to the switchgear bus bars had changed. The team determined additional inspection would be required to determine if the licensee's implementation of the requirements in 10 CFR 50.59 were appropriate for this modification. This issue is documented in section 3.10 as Unresolved Item 05000285/2011014-02, "Failure to Perform Adequate 10 CFR 50.59 Review." The team concluded that the post modification testing failed to ensure that the modification met all 480 Vac electrical distribution system design requirements. The as-left condition of breaker 1B4A was unknown because the as-left resistance readings between the incoming line-side to the load-side of the switchgear following circuit breaker replacement were not confirmed and the engagement of the cradle fingers to the bus bars were not adequately verified. This issue was identified by the licensee's root cause analysis as a contributing cause for the event. Post modification testing also entailed the use of hand held mirrors which offered limited viewing capability to provide the only visual verification of the finger to stab engagement after the installation of the new breakers.

Boroscope images taken after the fire determined that the finger clusters were over-extending the silver-plated sections of the stabs, raising questions about the seismic qualification of the breaker assemblies. The licensee provided a paper stating, in part, that qualification was maintained as long as the cradle finger engagement was greater than 3/4-inch on the bus bar stabs. The paper did not provide a basis for this conclusion. The licensee provided a letter from the vendor, dated August 26, 2011, which indicated that seismic qualification would be maintained as long as the cradle primary disconnect (finger clusters) connection was maintained between 3/4-inch and 1-inch on the bus bar stabs, and the positive (drawout) interlock pin was properly seated in the cubicle stop rail. The letter did not provide an analysis supporting this position. The vendor's seismic qualification report for the new breakers stated that seismic qualification was performed, in part, by testing in accordance with IEEE 344-1975, "IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations." This standard stated that the orientation of the equipment during the test shall be the only orientation for which the equipment is considered qualified, unless adequate justification can be made to extend the qualification to an untested orientation. No qualification testing was performed with nonstandard cradle to bus bar connections. The team concluded that the breaker/cradle assemblies were not in the tested orientation for seismic qualification. The licensee's analysis concluded that the fire was caused by high resistance connections between the cradle connectors and the switchgear bus bars, therefore the cradle connections were not in the tested orientation to meet seismic qualification requirements.

Condition Report CR 2011-7064 was written to document that the breakers might not meet the engagement criteria for seismic qualification. Condition Report CR 2011-7365 was written on September 13, 2011, to address the inoperability of the remaining breaker and cradle assemblies due to the incorrect finger to stab engagement.

The team concluded that the modification adversely affected the availability and reliability of the Class 1E 480 Vac electrical power distribution system, and failed to ensure that the design basis for the 480 Vac electrical power distribution system was maintained. A finding associated with this failure is described in section 3.10. 3.5 Maintenance Review (Charter Item 5)

a. Inspection Scope

The team reviewed the corrective actions developed by the licensee in response to Green noncited violation (NCV)05000285/2010004-09 of Technical Specification 5.8.1(a) for inadequate procedures for performing maintenance of 4160 Vac and 480 Vac safety-related breakers. The violation addressed, in part, the licensee's maintenance program deficiencies for medium and low voltage switchgear. The team reviewed the corrective actions to assess whether they would identify and/or prevent high-resistance connections between breakers and switchgear, as well as problems involving inadequate inspection and cleaning of hardened grease or oxidation. The team reviewed maintenance procedures and work orders for 4160 Vac and 480 Vac breakers, switchgear, and motor control centers. The team also reviewed documents for the safety-related 125 Vdc distribution system components. The team interviewed system engineers responsible for these systems, quality assurance staff, and electrical maintenance personnel responsible for maintaining the systems.

b. Findings and Observations

Condition Report CR 2009-2306 was written in May 2009 in response to NRC-identified issues with maintenance of Class 1E circuit breakers and switchgear.

The NRC issued noncited violation 05000285/2010004-09 for the failure to perform vendor and industry recommended maintenance and testing on safety-related and risk significant 4160 Vac and 480 Vac circuit breakers and switchgear. Condition Report CR 2009-2306 contained corrective action items to identify gaps between the licensee's preventative maintenance program requirements, vendor recommended maintenance, and Electric Power Research Institute guidance which the licensee used as the basis for their maintenance program. Corrective action recommendations included revising Procedure EM-PM-EX-1200, "Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear," to address the identified gaps between preventative maintenance documents and vendor recommendations, and to develop a comparison review for the new breakers installed under modification EC 33464. The team determined that the licensee had identified differences between the maintenance program guidance and the vendor and Electric Power Research Institute guidance, but had not implemented all of the corrective action recommendations. The team concluded that maintenance procedure EM-PM-EX-1200 failed to assure that conditions adverse to quality were identified and corrected because:

• The procedure failed to provide either quantitative or qualitative acceptance criteria for the torquing of bus compartment fasteners. The procedure specified that maintenance personnel check all accessible bus connections and mounting bolts for tightness, but it did not contain appropriate guidance to ensure that torque values were being properly applied to connections in the bus compartment, and did not contain specific guidance to document which fasteners were to be checked. The term "accessible" was not defined.

• The licensee identified that the procedure did not contain adequate instructions for electrical maintenance for the removal of internal divider plates in the switchgear. The bus compartment section was located between the front breaker enclosure and the rear cable compartment. The bus compartment contained all of the welded aluminum bus connections and bus support structures, which had bolted joints. Failure to remove the divider plates limited the inspection and cleaning of the switchgear to only areas that were considered easily accessible. The team concluded that the bus compartment was not considered accessible, and was therefore not included in the maintenance activities.

The licensee's root cause analysis for the failure of bus 1B4A concluded that hardened grease on breaker stabs were a factor in the increased resistance of the connections, contributing to the breaker fire. The team concluded that maintenance personnel were only cleaning portions of the bus bar stabs where the original breaker fingers connected. Engineering, who owned the procedure, had expectations that the entire stab would be cleaned. Condition Report CR 2011-7449 was written to address that electricians understood the terminology in the procedure for the "surfaces of the primary disconnect" to mean the points on the bus bar that the cradle finger clusters engage, which differed from the interpretation by Engineering. Condition Report CR 2011-6253 was written, in part, to document that procedure EM-PM-EX-1200 did not contain sufficient instructions for electrical maintenance to adequately clean and inspect 480 Vac switchgear.

The team identified additional events in the licensee's corrective action program involving failures in the 480 Vac electrical power distribution system. The team reviewed Condition Report CR 2008-3548, "Root Cause Analysis Report: Failure of 480 Vac Breaker BT-1B3A to Close during Hot Bus Transfer of 1B3A," which was written in May, 2008, to document a significant condition adverse to quality. This failure resulted in the loss of bus 1B3A. This analysis concluded, in part, that preventative maintenance procedure EM-PM-EX-1200 was less than adequate and was a contributing cause to the loss of bus 1B3A. The analysis identified the following weaknesses in the procedure:

• The procedure contained conditional procedure steps that allowed skipping the cleaning and inspection of 480 Vac breaker cubicles.

• System Engineers were not aware that 480 Vac breaker cubicles were not being cleaned as required by the Preventative Maintenance program requirements.

• Breaker BT-1B3A had high resistance connections, which occurred as a result of procedural deficiencies that failed to remove dirt and hardened grease, contributing to a significant condition adverse to quality. The licensee implemented corrective actions to address the deficiencies, which included revising procedure EM-PM-EX-1200 to add steps to inspect the engagement of electrical contacts. The procedure had existing steps to clean primary and secondary connections, but they were not appropriately followed due to different interpretations of the requirements. Condition Report CR 2008-3548 also noted that other breakers had been inspected and additional problems identified including grease buildup on bus-tie breakers BT-1B3B, BT-1B4B, BT-1B3C, and BT-1B4C. The analysis discussed previous instances of high resistance connections, including a previous significant condition adverse to quality in the failure of the field flash circuit for an emergency diesel generator. The analysis concluded that the preventative maintenance program was ineffective at identifying and correcting high resistance electrical connections before equipment failure. The team noted that Condition Report CR 2008-3548, "Root Cause Analysis Report: Failure of 480 Vac Breaker BT-1B3A to Close during Hot Bus Transfer of 1B3A," was identified in the licensee's root cause analysis for the fire in breaker 1B4A as part of their internal operating experience review, and concluded that the described event was a missed opportunity to prevent the fire.

Condition Report CR 2011-6363 was written to report that during the extent of condition inspections for the fire in load center 1B4A hardened grease was found between the bolted connections of the bus work in load center 1B4B. The team concluded that this hardened grease condition was another example related to inadequate maintenance of the 480 Vac distribution system. The team's review of corrective actions associated with the issues leading to NCV 05000285/2010004-09 and issues involving previous failures of electrical distribution components led the team to conclude that inadequate maintenance practices contributed to the fire in load center 1B4A. The team concluded that the failure to prevent high resistance electrical connections was a direct contributor to the fire in load center 1B4A on June 7, 2011 and that the licensee had failed to prevent recurrence of this significant condition adverse to quality. The team concluded the inadequate maintenance procedures also failed to ensure that seismic qualification was maintained. A finding associated with this failure is described in section 3.10.

.6 Root Cause Evaluation and Event Review (Charter Item 6)

a. Inspection Scope

The inspection team evaluated the licensee's root cause analysis "Fort Calhoun Station Corrective Action Program Root Cause Analysis Report, Breaker Cubicle 1B4A Fire, Condition Report 2011-5414," Revision 0, and associated analysis tools including Event and Causal Factors Analysis, Gap Analysis, and Hazard-Barrier-Target

Analysis.

The team reviewed corrective actions and extent of condition reviews associated with the fire in switchgear 1B4A and events leading up to the fire. The team interviewed licensee personnel involved with the modification, installation and testing of the 480 Vac Nuclear Logistics Incorporated/Square-D circuit breakers and personnel assigned to the licensee's root cause investigation team. The team evaluated the licensee's investigation and corrective actions to determine whether the licensee appropriately assessed all possible impacts from the fault currents, heat, and combustion products. The team also assessed whether the corrective actions were appropriate to correct the root and contributing causes. The team inspected the remaining quarantined equipment and parts.

b. Findings and Observations

The licensee provided the inspection team with the results of the root cause analysis as described in "Fort Calhoun Station Corrective Action Program Root Cause Analysis Report, Breaker Cubicle 1B4A Fire, Condition Report 2011-5414," Revision 0, dated September 12, 2011, when the team arrived onsite. The licensee's analysis identified two root causes for the event; a programmatic root cause and a probable physical root cause. The analysis also identified nine contributing causes for the fire. The programmatic root cause was identified as a design process failure to identify the silver plating on the bus bars as a critical interface when specifying replacements for the AK-50 circuit breakers. The physical root cause was identified as high resistance connections due to breaker cradle fingers engaging the bus stabs in a contact area of hardened grease and copper oxide buildup. This cause was derived from empirical data obtained from the extent of condition inspections of the undamaged 480 Vac breakers because limited physical data remained after the catastrophic failure of the 1B4A breaker and load center for a definitive analysis. The extent of condition inspections included photographs and boroscope imagery of the in-situ cradle finger engagement with the copper/silver-plated bus bars in the remaining ten load center breakers. The images showed varying degrees of finger engagement with the bus stabs. Digital Low Resistance Ohmmeter readings were taken on the remaining load center breakers and the as-found readings are tabulated in Attachment 5 and ranged from 61.9 micro-ohms to 835 micro-ohms. The licensee established 100 micro-ohms as an acceptable value. The licensee attributed the higher values to a combination of finger over-travel and buildup of copper oxide in combination with hardened grease residue that had not been cleaned from the stabs prior to installation of the new breakers.

The breaker vendors disagreed with the licensee's conclusion about the physical cause of the fire. Vendor reports concluded that a fault in the bus compartment section from a foreign object or other cause was a credible failure mechanism. Forensic experts were contracted by the licensee to review the event. Initial contractor forensic inspections concluded that a high resistance connection on the line side of the bus had caused the failure; however, due to extensive damage from the event, little physical evidence remained to conclusively determine the root cause.

On September 7, 2011, one of the forensics contractors submitted an assessment report to Fort Calhoun Station describing three possible failure scenarios: 1. Failure of a copper to aluminum bus bolted connection leading to in-line arcing and phase-to-phase-to-ground faulting. 2. Failure at the finger contacts between cradle and bus stabs. 3. Phase-to-ground fault at a load leading to phase-to-phase-to-ground faulting at a breaker. The licensee's root cause analysis discredited failure in the bus compartment section and discounted scenarios one and three based, in part, on results of the extent of condition reviews. The team concluded that the failure of a copper to aluminum bus bolted connection or fault in the bus compartment from a foreign object or other cause were credible failure scenarios. Contributing causes identified included the following:

• Engineering had limited knowledge of the GE-AKD-5 switchgear resulting in an overreliance on vendor knowledge and skill. Station personnel relied on vendors to the point that a dependent, rather than an interdependent, relationship existed between vendors and station personnel.

• Access to the bus compartment of the GE-AKD-5 switchgear was difficult, limiting the selection of inspection/testing methods.

• Pre-installation procedure prerequisites require the performance of EM-PM-EX-1200, "Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear," which directed maintenance personnel to wipe the cubicle disconnects. This cleaning method was insufficient to remove hardened grease. Additionally, there was no independent verification that the stabs were clean.

• Failure to confirm as-left resistance readings on the line side to load side connections following the modification. The root cause analysis identified the following additional performance issues:

• The root cause of CR 2008-3548 concluded that breaker cubicle preventative maintenance activities had not been conducted to clean and inspect the 480 Vac switchgear breaker cubicles.

• EM-PM-EX-1200, "Inspection and Maintenance of Model GE-AKD-5 Low Voltage Switchgear," did not contain sufficient instructions to remove load center bus compartment divider plates. The licensee's analysis also identified that circuit breaker 1B3A tripped due to overcurrent. This was originally classified as a lower level condition in the corrective action program. The inspectors questioned this condition level classification, in part, because the licensee had a limited understanding of the cause of the 1B3A trip and the determination that the issue was a nuclear safety concern because it adversely impacted the fire protection program basis assumptions for train separation. This issue was elevated by the licensee to a condition level "A" and categorized as a significant condition adverse to quality, requiring a root cause analysis. The root cause analysis for the tripping of breaker 1B3A was in progress when the team left the site. This item is addressed in section 3.10 as an unresolved item requiring further review.

The inspectors determined that the root cause analysis for the fault and fire in load center 1B4A was narrowly focused in that it rejected credible failure scenarios which had been identified and reported by contracted forensic experts and vendors; the analysis did not address the potential seismic implications of the installed breakers or bus compartment connections; and the identified programmatic root cause failed to include several underlying organizational and programmatic factors identified in the analysis, including errors in the development and review of engineering analyses and plant configuration changes, inconsistent supervisory oversight and reinforcement of design engineering activities, and lack of senior management oversight and critical reviews. The team concluded that the extent of the fire damage obliterated evidence needed to identify the precise cause of the fire. While all parties agreed the cause involved a high resistance connection and resultant heating, arcing and eventual high-energy faulting, disagreement on the exact location existed. The location of the worst damage made it plausible that the high resistance connection could have been a bolted bus bar connection or the bus stab-to-cradle connections. Further, the poor maintenance procedures and records and incomplete maintenance completion history support failure at a bus bar connection, while poor modification fit up, testing, and the presence of hardened grease support failure at the stab-to-cradle connection. Therefore, the team concluded both failure mechanisms must be considered and corrected since either one alone could have been enough to cause the fire. The team noted that the root cause analysis appropriately addressed the impact of the event on the station's fire protection program. 3.7 Electrical Protection and Separation (Charter Item 7)

a. Inspection Scope

The team reviewed the response of the electrical power distribution system to the electrical fault and subsequent fire to determine if problems existed in electrical protection, separation and coordination. The team analyzed the responses of the 480 Vac breakers and switchgear and the 125 Vdc control power system, and the impact of dc control power on the ability to operate breakers remotely. The team reviewed technical material for Nuclear Logistics Incorporated/Square-D cradle and circuit breaker assembly, the Micrologic 5.0A electronic trip unit, AKD-5 switchgear, electrical design calculations, voltage transient plots, and the Updated Safety Analysis Report. Also, the team used the developed timeline, interviews with Operations personnel, system engineering and electrical maintenance personnel to determine whether the electrical distribution system responded as designed and as expected to the individual events and actuations associated with the fire.

The team reviewed the licensee's conclusions about the response of the electrical power distribution system, reviewed the technical material and time-current characteristics curves for the trip units on breakers 1B3A and BT-1B3A to determine what coordination existed between the breakers, and reviewed the system design criteria to determine what protection was required. The team also reviewed time-voltage plots for the 4160 Vac buses for the period of the event to provide insight into the response of the 480 Vac distribution system. Fort Calhoun Station did not plot electrical parameters for the 480 Vac distribution system.

b. Findings and Observations

The team concluded that the licensee failed to maintain the electrical power distribution system design and licensing bases. The system was designed to provide two redundant, electrically and physically independent distribution trains of electrical power to safety-related loads during anticipated operational occurrences, design basis accidents, and external events. The design basis included provisions to limit fire damage to one train of the electrical distribution system, as described in Section 8.1.1 of the Updated Safety Analysis Report.

Omaha Public Power District was licensed in accordance with the draft design criteria published in the Federal Register (32FR10213) on July 11, 1967. These criteria were different than the final general design criteria published by the Atomic Energy Commission in 10 CFR Part 50, Appendix A, on February 20, 1971.

Appendix G of the Updated Safety Analysis Report, "Responses to 70 Criteria," described the draft general design criteria to which Omaha Public Power District was required to adhere. Design Criterion 3, "Fire Protection," stated, in part, that the reactor facility shall be designed to minimize the probability of events such as fires and explosions, and to minimize the potential effects of such events to safety.

The safety-related 480 Vac distribution system arrangement is illustrated in Figure 1 of Attachment 4. The nine 480 Vac load centers were comprised of AKD-5 low voltage switchgear. The load centers were single-ended units with a delta-delta connected power transformer on one end providing the step down function from 4160 Vac to 480 Vac. The system consisted of six main buses and three island buses. The island bus sections were connected to one of the adjacent bus sections by a normally closed bus-tie circuit breaker. The other bus-tie breaker was kept open and electrically interlocked to prevent cross-connecting the 4160 Vac buses. Three load centers were supplied by the 1A3 bus; three load centers were supplied by the 1A4 bus.

The licensee's root cause investigation concluded that the fire in load center 1B4A was the result of high resistance connections on the line side of the 1B4A feeder breaker cubicle, which caused overheating and failure of the cradle finger clusters, resulting in bus grounding and phase-to-phase shorting. The investigation also determined that combustion products from the fire caused a fault on the island bus side of bus-tie breaker BT-1B4A, which resulted in an overcurrent condition through breakers 1B3A and BT-1B3A. The design of the overcurrent protection scheme for these breakers was such that breaker BT-1B3A should have opened before breaker 1B3A to isolate the fault without tripping breaker 1B3A. The licensee's initial investigation determined that breaker 1B3A tripped on a short-time overcurrent fault and concluded that since the breaker protection scheme did not operate as designed, bus 1B3A was de-energized which resulted in the loss of multiple electrical power distribution system trains from a single fire. Appropriate breaker coordination was required by the licensee's fire protection program to ensure that the plant could achieve and maintain safe shutdown conditions following a fire. Because Fort Calhoun Station utilized an ungrounded-delta electrical distribution system with no means for ground fault tripping of load centers and did not use instantaneous overcurrent trip protection, the only electrical fault protection on the 480 Vac bus feeders and bus-tie breakers was long-time and short-time overcurrent protection. The team requested trip data for the breakers because the new electronic trip units had onboard memory which provided the capability to store and retrieve values of sensed current; however the team was informed that this data was not available, as it had been inadvertently deleted. This failure resulted in the loss of important data for the event. The team could not substantiate the licensee's conclusion that breaker 1B3A tripped on overcurrent.

Additional NRC inspection and licensee investigation prompted the licensee to initiate another root cause analysis to investigate the tripping of breaker 1B3A as a separate event. Condition Report CR 2011-5613 was written to document the unexpected tripping of breaker 1B3A. Condition Report CR 2011-6621 was written to determine if train separation design basis assumptions were still valid, and was elevated to a category A condition level (significant condition adverse to quality) to investigate the breaker 1B3A spurious trip. Condition Report CR 2011-7654 was written to document that no guidance existed for maintenance personnel to identify the fault data for the trip of breaker 1B3A. Condition Report CR 2011-7655 was written to document that the fault data for the trip of breaker 1B3A had not been recovered. The licensee removed breaker 1B3A from service and on October 12, 2011 sent it to the vendor for additional testing and analysis. The licensee's analysis for breaker 1B3A had not been completed when the team left the site. This issue is being addressed as part of unresolved item 05000285/2011014-03, "Cause of Breaker 1B3A Trip Not Understood."

The team reviewed boroscope images of the remaining cradle to bus bar connections in the unaffected switchgear, condition reports, and resistance measurements for the cradle finger to bus bar engagement. Based on these reviews, the team questioned the operability of the remaining load centers. The licensee subsequently declared the remaining 480 Vac load centers inoperable, and began the long-term implementation of corrective actions which included electroplating the load center bus bars to ensure adequate silver-plating on all the 480 Vac bus bar stabs, and modifying the cradle fit in the breaker cubicles to achieve appropriate cradle finger to bus bar engagement. This concern was entered in to the licensee's corrective action program as Condition Report CR 2011-7365. The ungrounded 125 Vdc distribution system, illustrated in Figure 2 of Attachment 4, consisted of three battery chargers, two storage batteries, two main distribution panels, manual transfer switches and other distribution equipment necessary for operation of the plant. The dc control power for each 4160 Vac and 480 Vac load center was fed via manual transfer switches, which allowed manual selection of either dc train as the source of control power to the buses. The manual transfer switches were designed with both trains of dc power in a common enclosure, with the normal and emergency supplies to the manual transfer switches fed from their respective dc buses via independent circuit breakers that were designed to provide selective fault protection and train separation. During the event, ground alarms were received in the control room for both dc buses due to extensive damage inside load center 1B4A. Battery charger #2 was de-energized, and battery charger #3 had to be manually aligned to power dc bus #2.

The team questioned the cause for the grounds, what affect the grounds had on the operability of the dc system, and what separation criteria the design was required to meet. The ground on dc bus #1 was caused by the failure of a conductor in the close permissive interlock circuitry between bus-tie breaker BT-1B3A and breaker 1B4A. The interlock was designed to prevent the cross-connection of 4160 Vac buses by preventing both bus-tie breakers and feeder breakers from being closed at the same time. The grounds on dc bus #2 were attributed to damage in control circuits associated with component cooling water pump AC-3B and condenser evacuation pump FW-8B. Control circuits for these pumps had auxiliary switches associated with the pumps on the opposite train that permitted an auto-start feature when the breaker for the running pump opened. Similar to the bus-tie breaker interlock, the cable connecting the auto-start feature to the control circuit was grounded by the fire in the opposite train. The team concluded that dc control power remained available to the safety-related 4160 Vac buses throughout the event, and the grounds on the dc buses would not have prevented the dc system from performing its safety function. Because the system was normally ungrounded, a single ground on either the positive or negative bus of the system did not result in the loss of a circuit, but did indicate a degraded condition.

Condition Report CR 2011-5428 was written to document that after the fire in bus 1B4A, both dc trains had grounds. Condition Report CR 2011-7484 was written to document that further investigation of the independence of the dc distribution systems was needed to address the identification of grounds on both dc buses during the fire. This condition report was subsequently downgraded and closed after an operability assessment determined that the dc distribution system had remained operable throughout the event. The licensee developed and performed temporary modification EC 53288, "DC Bus 1 and 2 Lifted Leads due to 1B4A Fire," Revision 0 to remove the grounds on the dc buses and allow bus 1B3A-4A to be returned to service.

Omaha Public Power District committed to meeting the criteria in IEEE 384-1981, "IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits." This standard describes independence requirements for Class 1E equipment, including those required for safe shutdown. Section 5.10.1 stated that an electrically generated fire in one Class 1E division shall not cause a loss of function in its redundant Class 1E division. Omaha Public Power District also committed to the design criteria in IEEE 308-1974, "IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations." Criterion 5.2.2(3), "Independence," stated that distribution circuits to redundant equipment shall be physically and electrically independent of each other. Criterion 4.6, "Equipment Protection," stated that Class 1E power equipment shall be physically separated from its redundant counterpart or mechanically protected as required to prevent the occurrence of common failure modes due to design basis events. The standard defines design basis events to include postulated phenomena such as fire. This issue is being addressed in Section 3.10 as part of unresolved item 05000285/2011014-03, "Cause of Breaker 1B3A Trip Not Identified."

The team concluded that the provisions of License Condition 3.D, "Fire Protection Program," were not maintained because the design basis provisions discussed in IEEE 384-1981, IEEE 308-1974, and the Updated Safety Analysis Report to limit fire damage to one train of the equipment necessary for safe shutdown were not maintained. A finding associated with this failure is described in section 3.10.

3.8 Planned Repairs (Charter Item 8)

a. Inspection Scope

The team observed the in-progress repair work on modification EC 53257, "480V 1B4A Repair/Replacement," which was written to rebuild the switchgear and replace circuit breakers. The rebuild of the 1B4A load center was being performed by the breaker vendor and included redesign of the switchgear internal structure to change the cradle to bus bar connections to bolted connections, replacement of all the original General Electric circuit breakers with Nuclear Logistics Incorporated/Square-D breaker/cradle assemblies, restoration of the bus duct from bus 1B4A to island bus 1B3A-4A, replacement of the control components, and replacement of internal wiring. Because the licensee had contracted with the vendor to rebuild the damaged load center, the team also reviewed the licensee's and vendor quality assurance process for the repair, the licensee's oversight of the vendor, the scheduled acceptance testing methods, and the in-progress work orders. The team reviewed the repair methods for heat sensitive components including cable jackets and insulation, connections, and instrumentation. The team interviewed vendor technicians involved in the rebuild, and licensee personnel responsible for oversight of the project. The team also reviewed the effectiveness of the licensee's inspections and efforts to clean and remove combustion products.

b. Findings and Observations

The team concluded that licensee oversight of the work process was limited in scope. The team observed that:

• Vendor technicians performing the repairs did not have work instructions at the work location.

• The technician performing the installation was also performing the quality assurance function.

• Controls were not in place to ensure material was being adequately inventoried and accounted for while being used in the safety-related switchgear.

• Licensee staff stated that the station had turned the repair process over to the vendor as a turn-key operation and the vendor was responsible for the quality assurance oversight of the repair; the licensee would perform acceptance testing only after the vendor had completed the repairs. The team identified that the in-progress repair activities were not in accordance with the licensee's quality control process for safety-related equipment, and as a result the licensee staff halted the repair work. The licensee performed an investigation and identified that Omaha Public Power District Construction Management personnel had not followed the requirements of Procedure SO-M-100, "Conduct of Maintenance," Revision 54, for control of contracted personnel prior to allowing the vendor to begin work. The team considered the failure to follow the requirements of Procedure SO-M-100, "Conduct of Maintenance," Revision 54, to be a violation of NRC requirements. Specifically, Fort Calhoun Station's Technical Specification 5.8.1, requires, in part, that the licensee establish and implement the written procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978, which includes procedures governing maintenance of safety-related equipment. Using Inspection Manual Chapter 0612, the inspectors determined the safety significance of this violation to be minor since the equipment was not restored to service. Minor violations represent items of low safety significance and are not typically subject to formal enforcement action or documentation by the NRC; however, the violations must still be corrected by the licensee.

The licensee initiated Condition Report CR 2011-7367 to address that the in-progress repair activity was not in accordance with the licensee's quality control process for safety-related equipment and to document the limited oversight being provided for the repair of the safety-related 1B4A load center. Condition Report CR 2011-7565 was written to address oversight of contractors performing work on the switchgear and to document that the investigation had required considerable management resources to resolve the issue, resulting in the bus work being shut down for seven days. The team concluded that this was a conservative decision by the licensee. The team determined that the licensee had not appropriately considered electrical separation for Class 1E and non-Class 1E cabling in the modification repairing the switchgear. The team determined that: (1) inspections of the wiring in 1B4A had discovered deficiencies in separating Class 1E and non-Class 1E cabling; and (2) the licensee followed different industry standards for existing panel wiring and new panel wiring. The guidance in IEEE 384-1974, "IEEE Trial-Use Standard Criteria for Separation of Class 1E Equipment and Circuits" was used for existing panels and the guidance in IEEE 384-1981, "IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits" was used for new panels. The licensee initiated Condition Report CR 2011-7485 to determine if the proper requirements for electrical separation were being applied to the new 1B4A load center wiring. Condition Report CR 2011-7759 was initiated to document that the inspection of the wiring in 1B4A found deficiencies which required rework. Condition Report CR 2011-7887 was initiated to document the need for Design Engineering guidance on how to maintain proper cable separation and internal panel wiring separation for 1B4A. The 1B4A load center rebuild and associated corrective actions were not finished when the team left the site. For modification EC 53517, the licensee had contracted with the Electric Power Research Institute to perform Indenter testing of cable jackets to determine jacket conditions. Indenter testing is a nondestructive method of evaluating the degradation of cable insulation and jacket material. The technique uses a device that presses an instrumented anvil against the cable surface under a controlled rate and measures displacement and force. The response is compared to known good samples, and provides an indication of the jacket condition. The licensee also contracted with Analysis and Measurement Services Corporation to perform additional cable characterization testing. Characterization testing performed a series of dc resistance measurements, ac impedance measurements, time-domain reflectometry testing, and insulation resistance measurements. The team reviewed the vendor reports and results and identified no concerns with the tests, results or repairs. The team also reviewed the following modifications written for corrective actions:

• EC 53517, "Repair 1B4A Fire Damaged Cables," Revision 0, which repaired cables damaged by the fire, including cables in cable trays above the 1B4A load center.

• EC 53751, "Adjust Rail Stops for Masterpact NW Breakers," Revision 0, which was written to apply additional silver plating to the bus stabs, and adjust the internal rail stops in the main and bus-tie breaker cubicles on 480 Vac load centers 1B3A, 1B3B, 1B4B, 1B3C, and 1B4C to facilitate better connections between the finger clusters on the cradle and the switchgear bus stabs.

• EC 53347, "Modify Back Panels on 480 Volt Buses," Revision 1, which was written to modify the divider plates inside the 480 Vac load centers to facilitate removal and allow internal inspections and maintenance of the bus compartment. The team identified no concerns with the planned corrective actions. Because the 1B4A switchgear was being replaced and all damaged cables had been repaired or replaced, no combustion products should remain in the switchgear or cabling. Condition Report CR 2011-5454 was written to address the need to de-energize battery chargers and inverters in the west switchgear room and to clean the interiors, which had been completed.

.9 Risk Assessment Information (Charter Item 9)

a. Inspection Scope

The team gathered information needed to assess the risk impact of the performance deficiency identified in this report. The team identified the total population of impacted equipment which included all nine safety-related 480 Vac switchgear and both safety-related 125 Vdc electrical distribution trains. The team identified the length of time the equipment was susceptible to failure and additional potential failure mechanisms for the cause of the fire. During the week of December 12, 2011, the team observed simulator runs of the fire scenario to improve their understanding of licensee and plant responses to the event.

b. Findings and Observations

Attachment 3 to this report describes the risk assessment methods and results. 3.10 Findings

.1 Failure to Ensure that the 480 Vac Electrical Power Distribution System Design Requirements were Implemented and Maintained

Introduction.

The team identified a finding of preliminarily high safety significance (Red) for the failure to ensure that the 480 Vac electrical power distribution system design requirements and fire protection program requirements were properly implemented and maintained through proper modification, maintenance, and design activities. Three self-revealing violations were associated with this performance deficiency:

• A violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," for the failure to ensure that design changes were subject to design control measures commensurate with those applied to the original design and that measures were established to assure that applicable regulatory requirements and the design basis for those safety-related structures, systems, and components were correctly translated into specifications, drawings, procedures, and instructions;

• A violation of 10 CFR Part 50, Appendix B, Criterion XVI "Corrective Action," for the failure to establish measure to assure that a significant condition adverse to quality was promptly identified and corrected, and measures taken to preclude repetition;

• A violation of License Condition 3.D, "Fire Protection Program," for the failure to ensure that the electrical protection and physical design of the 480 Vac electrical power distribution system provided the electrical bus separation required by the fire protection program.

Description.

On June 7, 2011, while the plant was in cold shutdown, the licensee declared an Alert due to a catastrophic fire in the west switchgear room. The Halon system in the room automatically actuated and aided in extinguishing the fire. The fire brigade responded, as did off-site fire assistance. The plant was in a planned refueling outage, and was already in a Notice of Unusual Event condition due to flood levels on the Missouri River. The fire was caused by the failure of a feeder breaker for 480 Vac load center 1B4A. A large quantity of soot and smoke was produced by the fire which migrated into a non-segregated bus duct (a metal enclosure containing the bus bars for all three electrical phases) connecting the 1B4A bus to island bus 1B3A-4A, even though the bus-tie breaker was open. The smoke and soot was sufficiently conductive that three phase shorting occurred between the bus bars such that island bus 1B3A-4A and the other connected train load center 1B3A were adversely affected. The load center supply breaker 1B3A tripped, resulting in 480 Vac buses 1B3A and 1B3A-4A being de-energized. Operators manually opened the 4160 Vac feeder breaker upstream of the faulted breaker to de-energize the 1B4A bus. Some minutes later, in accordance with the applicable procedure, operators manually de-energized 4160 Vac buses 1A2 and 1A4, which resulted in de-energizing the remaining 480 Vac buses on the same train as the fire. This left only three of the nine safety-related 480 Vac buses energized.

The event resulted in the loss of spent fuel pool cooling, loss of safety-related load center 1B4A, unexpected tripping of the opposite train load center 1B3A, and grounds on both trains of safety-related 125 Vdc power. These failures adversely impacted the required safe shutdown capability as required by the licensee's fire protection program. The licensee attributed the breaker failure and subsequent fire, in part, to a permanent plant modification, EC 33464, "Replace AK-50 480 V Main and Bus-Tie Breakers With Molded Case Type or Equivalent," Revision 0, which replaced 12 General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices. The modification replaced six feeder circuit breakers and six bus-tie breakers, including breaker 1B4A. The licensee also attributed the breaker failure and subsequent fire to inadequate maintenance effectiveness which contributed to conditions that resulted in failure of the modification to maintain the 480 Vac electrical power system design basis. The team concluded that deficiencies in the modification and maintenance process were the most probable cause of the fire event. A. Design Modification As discussed in section 3.4, the licensee installed permanent plant modification, EC 33464 in November 2009. The modification replaced six 480 Vac safety-related feeder circuit breakers and six 480 Vac safety-related bus-tie breakers. The new circuit breaker design differed from the original breakers due, in part, to the introduction of a cradle assembly. The cradle assembly converted the internal vertical breaker connectors to top and bottom spring-loaded horizontal finger assemblies which connected to the silver-plated bus stabs. The modification failed to account for differences in the new breaker assemblies, including the differences in length of the cradle finger assemblies. When the new breakers were installed, the cradle fingers did not mate with the switchgear bus bars on the silver-plated area as designed but over-travelled to rest on the copper portion of the bus bar. Because the modification process failed to ensure the cradle fingers were properly engaged with the switchgear bus bars, high resistance connections developed resulting in a catastrophic fire which destroyed load center 1B4A and adversely impacted the redundant train of safe shutdown equipment.

The team concluded that the modification adversely affected the availability and reliability of the Class 1E 480 Vac electrical power distribution system, and failed to ensure that the design basis for the 480 Vac electrical power distribution system was maintained.

B. Maintenance Effectiveness As discussed in section 3.5, inadequate maintenance practices contributed to the fire event. The licensee had previously identified significant conditions adverse to quality in the preventative maintenance program for the 480 Vac breakers and switchgear, concluding that the program was ineffective at identifying and correcting high resistance electrical connections before equipment failure. The licensee's failure to ensure that the 480 Vac switchgear was properly maintained, including cleaning bus bars of hardened grease and oxidation and inspecting the bus compartment sections contributed to the high resistance connections in the switchgear, which resulted in equipment failure. The team concluded that the failure to prevent high resistance electrical connections through adequate maintenance was a direct contributor to the fire in load center 1B4A, and that the licensee had failed to prevent recurrence of this significant condition adverse to quality. C. Train Separation As discussed in sections 3.3 and 3.7, the 480 Vac electrical power distribution system responded to the fire event in an unexpected manner. The fire in load center 1B4A adversely impacted the redundant train of equipment used to safely shut down the reactor, which the licensee's fire protection program concluded would not happen. The team concluded that the provisions of License Condition 3.D, "Fire Protection Program," were not maintained because the design basis provisions to limit fire damage to one train of the equipment necessary for safe shutdown were not maintained.

Analysis.

The failure to ensure that the 480 Vac electrical power distribution system design requirements were properly implemented and maintained through proper modification, maintenance, and design activities contributed to create a catastrophic fire in a switchgear that adversely impacted the required safe shutdown capability of the plant. This was a performance deficiency. Specifically: (1) Design reviews and work planning and instructions for a modification to install new 480 Vac load center breakers failed to ensure that the cradle adapter assemblies had low-resistance connections with the bus bars and had a proper fit; (2) Preventive maintenance activities were inadequate to ensure low-resistance bus bar connections; and (3) Design reviews of the electrical protection and train separation of the 480 Vac electrical power distribution system were inadequate to ensure that a fire in load center 1B4A would not prevent operation of equipment needed for safe shutdown in load center 1B3A, as required by the fire protection program. The licensee entered these issues into their corrective action program under numerous condition reports described in the body of this report. In accordance with NRC Inspection Manual Chapter 0612, Appendix B, "Issue Screening," the issue was more than minor because it affected the Initiating Events Cornerstone and was associated with both the protection against external events attribute (i.e., fire) and the design control attribute. The finding affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Manual Chapter 0609.04, "Phase 1 - Initial Screening and Characterization of Findings," Table 4a, directed the process to a Phase 3 analysis because the finding increased the likelihood of a fire. The NRC completed a Phase 3 analysis using the plant-specific Standardized Plant Analysis Risk Model for Fort Calhoun, Revision 8.15, the Individual Plant Evaluation of External Events (IPEEE),

and hand calculations. The exposure period of 1 year represented the maximum exposure time allowable in the significance determination process. The analysis estimated the initiating event likelihood for a single fire of 7.0 X 10-2/yr. The analysis covered the risk affected by the performance deficiency for postulated fires of any of the nine continuously energized breakers including the potential for multiple fire initiators. Additionally, seismically-induced fires were postulated based on the characteristics of the performance deficiency. Finally the analysis determined that the finding did not involve a significant increase in the risk of a large, early release of radiation. The final result was calculated to be 4.0 x 10-4 indicating that the finding was of high safety significance (Red). This performance deficiency had a crosscutting aspect in the area of human performance associated with the resources component because the licensee did not ensure that personnel, equipment, procedures, and other resources were adequate to assure nuclear safety. Specifically, the licensee did not ensure that design documentation, procedures, and work packages were adequate to assure that design margins were maintained.

H.2(c)

Enforcement.

Three self-revealing violations were associated with this performance deficiency. Title 10 CFR Part 50, Appendix B, Criterion III, "Design Control," requires, in part that: (1) design changes, including field changes, be subject to design control measures commensurate with those applied to the original design; (2) measures be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions; and (3) these measures assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled.

Contrary to the above requirement, from November 2009 to June 7, 2011, the licensee failed to ensure that design changes were subject to design control measures commensurate with those applied to the original design; failed to assure that applicable regulatory requirements and the design basis for those safety-related structures, systems, and components were correctly translated into drawings, procedures, and instructions; and failed to ensure that these measures assured that appropriate quality standards were specified and included in the design documents. Specifically, design reviews, work planning and instructions for a modification to install new 480 Vac load center breakers failed to ensure that the cradle adapter assemblies had low resistance connections with the switchgear bus bars by establishing a proper fit and requiring low resistance connections to assure that design basis requirements were maintained. Title 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that measures be established to assure that conditions adverse to quality such as failures, defective material and equipment, and nonconformances are promptly identified and corrected. For significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition. Contrary to the above requirement, from May 22, 2008, to June 7, 2011, the licensee failed to correct a significant condition adverse to quality and take corrective actions to preclude repetition. Specifically, the licensee failed to ensure that their preventative maintenance program for the safety-related 480 Vac electrical power distribution system was adequate to ensure proper cleaning of conductors, proper torquing of bolted conductor or bus bar connections, and adequate inspection for abnormal connection temperatures. In 2008, the licensee identified that preventative maintenance procedure EM-PM-EX-1200, "Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear," was less than adequate as a result of a root cause analysis for the failure of bus-tie breaker BT-1B3A to close on demand and loss of bus 1B3A. The licensee categorized this failure as a significant condition adverse to quality. The analysis concluded that breaker BT-1B3A had high resistance connections which occurred as a result of both procedure deficiencies and inadequate implementation resulting in the failure to remove dirt and hardened grease from electrical connections. The licensee implemented corrective actions to address these procedural deficiencies; however the corrective actions were inadequate to prevent high resistance connections in load center 1B4A due to the presence of hardened grease and oxidation. The procedure did not contain adequate guidance for torquing bolted connections or measuring abnormal connection temperatures due to loose electrical connections in the bus compartment of the switchgear. License Condition 3.D, "Fire Protection Program," requires, in part, that the licensee implement and maintain in effect all provisions of the approved Fire Protection Program as described in the Updated Safety Analysis Report and as approved in NRC safety evaluation reports. Section 9.11.1 of the Updated Safety Analysis Report describes the fire protection system design basis and states, in part, that the design basis of the fire protection systems includes commitments to 10 CFR Part 50, Appendix R, Section III.G.Section III.G, "Fire protection of safe shutdown capability," requires, in part, that fire protection features be provided for structures, systems, and components important to safe shutdown, and that these features be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions is free of fire damage.

Contrary to the above requirement, from November 2009 to June 7, 2011, the licensee failed to implement and maintain in effect all provisions of the approved Fire Protection Program. Specifically, the licensee failed to ensure that design reviews for electrical protection and train separation of the 480 Vac electrical power distribution system were adequate to ensure that a fire in load center 1B4A would not adversely affect operation of redundant safe shutdown equipment in load center 1B3A, such that one train of systems necessary to achieve and maintain hot shutdown conditions were free of fire damage. Combustion products from the fire in load center 1B4A migrated across normally open bus-tie breaker BT-1B4A into the non-segregated bus duct, shorting all three electrical phases. The non-segregated bus ducting electrically connected load center 1B4A with the Island Bus 1B3A-4A and, through normally closed bus-tie breaker BT-1B3A, to the redundant safe shutdown train. The licensee has entered these issues into their corrective action program under numerous Condition Report numbers as described in this report. Pending completion of a final significance determination, the performance deficiency will be considered an apparent violation AV 05000285/2011014-01, "Failure to Ensure that the 480 Vac Electrical Power Distribution System Design Requirements were Implemented and Maintained."

.2 Unresolved Item 05000285/2011014-02, "Failure to Perform Adequate 10 CFR 50.59 Review."

Introduction.

The team identified an unresolved item related to the licensee's implementation of the requirements in 10 CFR 50.59 for modification EC 33464, "Replace AK-50 480 V Main and Bus-Tie Breakers With Molded Case Type or Equivalent," Revision 0, and the adequacy of the design review and screening performed to support the modification.

Description.

In November 2009, the licensee implemented a modification to replace 12 General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices. This modification was developed to address obsolescence issues and maintenance problems with the older AK-50 circuit breakers. Fort Calhoun Station used General Electric AKD-5 Powermaster Low Voltage Drawout Switchgear, with a welded aluminum bus bar structure that transitioned to copper bus stabs in each breaker cell. The original AK-50 circuit breakers connected directly to the silver-plated areas on the line and load stabs. The new Nuclear Logistics Incorporated /Square-D circuit breaker design was an integrated unit consisting of a circuit breaker and cradle assembly. The cradle assembly converted the internal vertical breaker connectors to top and bottom spring-loaded horizontal finger assemblies which connected to the switchgear bus stabs.

The team reviewed the licensee's implementation of the requirements in 10 CFR 50.59, "Changes, Tests and Experiments," for the modification. The team noted that the screening process did not recognize the potential for adverse effects on the design basis function of the 480 Vac electrical distribution system because of the introduction of a cradle assembly that had different connections to the switchgear bus bars. The original breakers did not require the cradle adapter and had connector assemblies which mounted to the silver-plated portion of the bus bars. The new assembly introduced the cradle as an adapter between the breaker and switchgear, and introduced additional resistances in the circuits. The licensee's screening documents stated that the electrical connections on the cradle matched the existing switchgear General Electric breakers; however, the licensee's root cause analysis showed that the cradle finger assemblies were not the same size as the original breaker connections. The team also noted that the licensee's screening process did not recognize the potential for high resistance connections to exist, and did not analyze additional failure mechanisms that may have been created by the addition of the cradle assemblies.

Condition Report CR 2011-6319 was written, after the fire, for the discovery of the improper engagement of cradle fingers to silver plating on the stabs. Further inspection is required to determine if the licensee's implementation of the requirements of 10 CFR 50.59 were appropriate.

.3 Unresolved Item 05000285/2011014-03, "Cause of Breaker 1B3A Trip Not Identified."

Introduction.

The team identified an unresolved item related to an apparent lack of 480 Vac electrical bus protection and coordination associated with the unexpected tripping of feeder breaker 1B3A as a result of a fire in the 1B4A switchgear.

Description.

During the fire event in the 1B4A switchgear on June 7, 2011, the feeder breaker to the 1B3A switchgear tripped unexpectedly, de-energizing a redundant train of safe shutdown equipment. The licensee performed a root cause analysis of the events associated with the fire in switchgear 1B4A and originally concluded that breaker 1B3A tripped on overcurrent based on inspection of the breaker following the event; however, additional investigations could not confirm this conclusion.

Six safety-related feeder breakers and six safety-related bus-tie breakers had been replaced in November, 2009 under permanent plant modification EC 33464.

The modification replaced General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices. The 480 Vac electrical distribution system is illustrated in Figure 1 of Attachment 4 of this report, and is comprised of nine load centers; three load centers are fed from the 4160 Vac bus 1A3 and three load centers are fed from 4160 Vac bus 1A4. There are three island buses which can be energized from either 480 Vac bus via bus-tie breakers.

The 480 Vac electrical distribution system design was such that an electrical fault in the 1B4A load center should trip the normally-closed bus-tie breaker BT-1B3A, isolating the fault from the 1B3A bus. The bus-tie breakers had electronic trip settings with time-overcurrent trip values coordinated with those of the bus feeder breakers. The team reviewed Calculation EC-91-084, "Breaker and Fuse Coordination Study," Revision 8, which was developed to show that adequate overcurrent protection and coordination existed on the safety-related buses. The team reviewed the time-current characteristic curves, breaker vendor materials, licensee breaker calibration data and time-voltage plots of the 4160 Vac bus voltages but was unable to confirm the licensee's original conclusions that breaker 1B3A tripped on overcurrent. The licensee elevated Condition Report CR 2011-6621 to condition level A, requiring a root cause analysis to investigate the breaker 1B3A spurious trip. Condition Report CR 2011-5613 was written to document the unexpected tripping of breaker 1B3A. The licensee removed breaker 1B3A from service and on October 12, 2011 and sent it to the vendor for additional testing and analysis. The licensee's analysis of breaker 1B3A had not been completed during the inspection period. Further inspection is required to determine whether performance deficiencies exist and if they are more than minor.

4OA3 Event Follow-up

(Closed) LER 05000285/2011008-00/01, "Fire in Safety Related 480 V Electrical Bus." On August 5, 2011, the licensee identified a failure of a safety related 480 Vac load center supply breaker in the switchgear room (Bus 1B4A). The licensee identified a failure of a safety related 480 Vac load center supply breaker in the switchgear room (Bus 1B4A). On October 27, 2011, the licensee submitted revision 1 to this LER. This revision included additional information about the root cause of the event and planned corrective actions. The details and findings associated with this event are described in this inspection report. This LER is closed.

4OA6 Meetings

Exit Meeting Summary

The inspection team briefed members of Fort Calhoun Station staff on September 15, 2011, following completion of the first onsite portion of the inspection. An exit meeting was performed on February 29, 2012, with Mr. D. Bannister, Vice President and Chief Nuclear Officer, and other members of Fort Calhoun Station staff. The inspectors verified whether the licensee considered any materials provided to or reviewed by the inspectors to be proprietary. None were identified.

ATTACHMENT 1:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

C. Cameron Supervisor - Regulatory Compliance C. Sterba Digital Design Engineering - Supervisor D. Bannister Vice President and Chief Nuclear Officer D. Digiacinto System Engineer - Electrical E. Matzke Compliance

G. Barna Electrical Maintenance Superintendent J. Adams Design Electrical Engineering J. Geschwender Probabilistic Risk Assessment J. Herman Division Manager - Nuclear Engineering J. Niedermeyer Lead RCA Investigator

M. Cooper Licensing Engineer M. Prospero Plant Manager M. Riva Fire Protection System Engineer P. Delizza Senior Instructional Technician S. Miller Manager - Design Engineering

W. Goodell Division Manager - Nuclear Performance Improvement and Support

NRC Personnel

J. Kirkland Senior Resident Inspector J. Wingebach Resident Inspector

LIST OF ITEMS

Opened

05000285/2011014-01 AV Failure to Ensure that the 480 Vac Electrical Power Distribution System Design Requirements were

Implemented and Maintained (Section 3.10.1)

05000285/2011014-02 URI Failure to Perform Adequate 10 CFR 50.59 Review (Section 3.10.2)

05000285/2011014-03 URI Cause of Breaker 1B3A Trip Not Identified (Section 3.10.3)

Opened and Closed

None.

Closed

05000285/LER-2011-008-00/01 LER Failure of Safety Related 480 volt AC Load Center Supply Breaker in Switchgear Room (Bus 1B4A) (Section 4OA3)

Attachment 1

DOCUMENTS REVIEWED

CALCULATIONS Number Title Revision

FC-5690 Battery Load Profile and Voltage Drop Calculation 7

FC-5690 Battery Load Profile and Voltage Drop Calculation 8

EA 91-084 Breaker and Fuse Coordination Study 8

EA 99-005 FCS Electrical System Data Base Documentation 5

EA 90-057 Updated Degraded Voltage Calculation 4160V/480V 9

CONDITION REPORTS (CR)

2008-3548 2011-6002 2011-7416* 2011-7722 2011-8273 2008-4611 2011-6101 2011-7419* 2011-7723 2011-8274* 2009-0022 2011-6192 2011-7422* 2011-7752 2011-8275

2009-2306 2011-6253 2011-7445* 2011-7759* 2011-8308

2009-3437 2011-6274 2011-7446* 2011-7778 2011-8417

2010-5140 2011-6300 2011-7449* 2011-7779* 2011-8600 2011-3384 2011-6319 2011-7456* 2011-7887* 2011-8672 2011-5400 2011-6347 2011-7484* 2011-7911* 2011-8673

2011-5414 2011-6363 2011-7491 2011-7924* 2011-9026

2011-5428 2011-6429 2011-7540 2011-7925 2011-9028*

2011-5443 2011-6576 2011-7553 2011-8105 2011-9030*

2011-5569 2011-6621 2011-7624 2011-8108 2011-9219* 2011-5575 2011-7064 2011-7627 2011-8134 2011-6117 2011-5613 2011-7356* 2011-7631 2011-8201 2011-5454

2011-5659 2011-7365* 2011-7654 2011-8207 2011-6037

2011-5852 2011-7367* 2011-7655* 2011-8261

2011-5969 2011-7410* 2011-7698* 2011-8272 *Issued as a result of inspection activities.

Attachment 1 DESIGN BASIS DOCUMENTS (DBD) Number Title Revision

SDBD-EE-201 AC Distribution 23

SDBD-EE-202 DC Distribution 18

PLDBD-NU-61 Regulations, Codes and Standards 16

DRAWINGS Number Title Revision 0223R0454, Sh. 8 125 Vdc SWGR Distribution- Unit 1A1 - 1A3 208/120 Vac Misc Circuit Source 3 11405-E-5, Sh. 2 480 Volt Auxiliary Power One Line Diagram P &

ID 29 11405-E-8, Sh. 1 125 Volt DC Misc Power Distribution Diagram P &

ID 62

11405-E-8, Sh. 2 125 Volt DC Misc Power Distribution Diagram P &

ID 12

11405-E-9, Sh. 4 120 Volt Instrument Bus 3 One Line Diagram P & ID 7 11405-E-18, Sh. 2 Schematic Diagram 480V Bus Tie Breaker

BT-1B3A 3 11405-E-67, Sh. 85 Cable Tray Sections (57S-C4) 1

11405-E-73, Sh. 3 Switchgear Diesel Generator & Electrical Penetration Area Tray & Conduit Layout Plan Elevation 1011'-0" & 1013'-0" 20 11405-E-120, Sh. 122

IB-3A Panel Schedule 6 11405-E-360, Sh. 7

ATD-D1 &

ATD-D2, 1B3A-4A-MTS, 1B3B-4B-MTS & 1B3C-4C-MTS Transfer Switch Control Schematics 1 124B4392, Sh. 19 Bus Tie Breaker

BT-1B3A Trip Circuit 7 124B4392, Sh. 46 Bus Tie Breaker

BT-1B4A Close Circuit 8

24B4392, Sh. 47 Bus Tie Breaker

BT-1B4A Close Circuit 7

136B3219, Sh. 3 Electrical Control Valves and Pumps Elementary Diagram 8 161F531, Sh. 8A 13.8 kV Emergency Power Supply 38 161F544, Sh. 3 Elementary Diagram Feedwater Regulating System 25

161F575, Sh. 24 Elementary Diagram Annunciator Schemes 26

161F597, Sh. 3 Elementary Diagram

AI-30A 12

161F598, Sh. 10 Elementary Diagram

AI-30B 20

Attachment 1 Number Title Revision 168R0631

AKD-5 Powermaster Indoor Unit Substation No. 01 (1B3A) 10 168R0632

AKD-5 Powermaster Indoor Unit Substation No. 02 (1B4A) 12 2D4778, Sh. 2 D.C. Bus Panel Specifications 4 3-368, Sh. 1 Halon System for Switchgear Room 6

4778 293 206-001 Technical Support Center One Line Diagram P&

ID 44

B-4096, Sh. 1 125 Vdc Manual Transfer Switch Mounting Panel 0

D-4039, Sh. 1 125 Vdc Manual Transfer Switch Wiring Diagram 1

D-4094, Sh. 1 Fire Detection System Ground Floor Plan 8 D-4409 13.8 kV One Line Diagram P &

ID 26 FIG 8.1-1 Simplified One Line Diagram Plant Electrical System P &

ID 141

MISCELLANEOUS DOCUMENTS Number Title Revision/Date EPRI Letter with Attachment to FCS discussing Cable Inspections and Indenter Testing at Ft. Calhoun Station 8/1/2011

Whitepaper: DC Bus Interaction During and Following the Fire in 1B4A

Whitepaper: OPPD Oversight of NLI Repairs to Bus 1B4A 9/19/2011

Reportability Evaluation for Condition Report 2011-7064 9/13/2011

Operability Evaluation for Condition Report 2011-7484 11/1/2011

System Health Reports for Electrical Distribution System

1/1/2010 Through 3/31/2011

Nuclear Logistics Inc. Quality Assurance Manual 11

Fort Calhoun Unit 1 Operations Logs

6/4/2011 to 6/7/2011

Fort Calhoun Station Emergency Response Organization Log Sheets 6/7/2011

Attachment 1 Number Title Revision/Date Personnel Statements 6/7/2011

Electrical Load Distribution Listing: 4160Vac and 480Vac - Volume 3 56

2011411 Fire Protection Impairment Permit 7/22/2011 48049-136-05 Instruction Bulletin for Micrologic 2.0A, 3.0A, 5.0A and 6.0A Electronic Trip Units

Attachment 1 to

CR 2011-6621 Root Cause Analysis Charter (1B3A) 0

EA-89-055 10

CFR 50 Appendix R Safe Shutdown Analysis 17 EPRI

1000014 Technical Evaluation Circuit Breaker Maintenance Programmatic Considerations 12/2000 EPRI

TR-112938 Routine Preventive Maintenance for AK and AKR Type Circuit Breakers 1 FDCR 54025 Field Design Change Request for

EC 53751 10/7/2011

FHA-EA97-001 Fire Hazards Analysis 16

GET-6450 Distribution System Feeder Overcurrent Protection

IEEE Standard 308 IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations 1974 IEEE Standard 344 IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations 1975 IEEE Standard 384 IEEE Trial-Use Standard Criteria for Separation of Class 1E Equipment and Circuits 1974 IEEE Standard 384 IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits 1981

LD-09315397-04 Letter from NLI to OPPD -

AKD-5 Switchgear Cubicle Adjustment 1

LD-09315397-3 Letter from NLI to OPPD - Fire in low voltage switchgear 1B4A 2

LD-09315397-10 Letter from NLI to OPPD - LGSB4 Cradle Primary Disconnect

1/20/2012

LIC-11-0073 Licensee Event Report 2011-008 for the Fort Calhoun Station 0

Attachment 1 Number Title Revision/DateLIC-11-0106 Licensee Event Report 2011-008 for the Fort Calhoun Station 1

LIC-87-657 Compliance with Regulatory Guide 1.97, Revision 2 11/24/1987 NFPA

600 Standard on Industrial Fire Brigades 1992

QR-09311002-01 Seismic Qualification Report for Square D Masterpact

Replacement Circuit Breaker Model LGSB4 3

MODIFICATIONS (EC) Number Title Revision 33464 Replace

AK-50 480V Main & Bus-Tie Breakers With Molded Case Type or Equivalent 0 53257 480V 1B4A Repair/Replacement 0 53288 DC Bus 1 and 2 Lifted Leads Due to 1B4A Fire 0 53347 Modify Back Panels on 480 Volt Buses 0 53517 Repair 1B4A Fire Damaged Cables 0 53751 Adjust Rail Stops for Masterpact NW Breakers

0

PROCEDURES Number Title Revision

AOP-06 Fire Emergency 25

AOP-32 Loss of 4160 Volt or 480 Volt Bus Power 17

AOP-36 Loss of Spent Fuel Pool Cooling 7

ARP-CB-20/A17 Annunciator Response Procedure A17 Control Room Annunciator A17

EC 31743

ARP-CB-20/A18 Annunciator Response Procedure A18 Control Room Annunciator A18

EC 51328

EM-PM-EX-0201 NLI Masterpact NW Circuit Breaker Inspection 19

EM-PM-EX-1100 480 Volt Motor Control Center Maintenance 29

EM-PM-EX-1200 Inspection and Maintenance of Model

ADK-5 Low Voltage Switchgear 9

EM-PM-EX-1200 Inspection and Maintenance of Model

ADK-5 Low Voltage Switchgear 10

Attachment 1 Number Title Revision

EM-PM-EX-1200 Inspection and Maintenance of Model

ADK-5 Low Voltage Switchgear 11

EM-PM-EX-1200 Inspection and Maintenance of Model

ADK-5 Low Voltage Switchgear 12

EM-PM-EX-1200 Inspection and Maintenance of Model

AKD-5 Low Voltage Switchgear 12a

EM-PM-EX-1400 4160 Volt Switchgear Inspection 37

EM-CP-05-1B3A Calibration of the Main Circuit Breaker Located in Cubicle 1B3A 9

EM-CP-05-1B3A Calibration of the Main Circuit Breaker Located in Cubicle 1B3A 10

EM-CP-05-BT-1B3A Calibration of the 480 Vac Tie Breaker Located in Cubicle

BT-1B3A 13

EOP-ATT EOP/AOP Attachments 31

EPT-56 Real Event Reports 1

FCSG-23 10

CFR 50.59 Resource Manual 7

FCSG-24 Corrective Action Program Guideline 37

IC-CP-01-3503 Calibration of Hot Spot Indicator on Westinghouse 4160/480 Volt Transformer T1B-4A

EC 31744

MD-AD-0004 Maintenance Work Instructions Writer's Guide 27

MD-AD-0007 Administrative Procedure Bolting 7

NOD-QP-3 10

CFR 50.59 and 10

CFR 72.48 Reviews 31

NOD-QP-19 Attachment 7 Rapid Response Data Collection Form 41

NOD-QP-31 Operability Determination Process 47

PED-GEI-15 Meeting Independence Criteria 4

PED-GEI-28 Preparation of Construction Work Orders

20

PED-SEI-34 Maintenance Rule Program 8

QAM-42 Quality Assurance Manual - Approval of Suppliers 0

SC-CP-08-1B4A Calibration of the Protective Relays for 480-1B4A Bus

EC 47970

SO-G-21 Modification Control 90

Attachment 1 Number Title Revision

SO-G-28 Station Fire Plan 81

SO-G-91 Control and Transportation of Combustible Materials 27

SO-G-102 Fire Protection Program Plan 10

SO-M-2 Preventative Maintenance Program 44

SO-M-100 Conduct of Maintenance

54

SO-M-101 Maintenance Work Control 90

SO-O-1 Conduct of Operations 88

SO-O-46 Post Trip Reviews 17

SO-R-1 Reportability Determinations 23

SO-R-2 Condition Reporting and Corrective Action 50

SP-CP-08-480-1B4A Calibration of the Protective Relays for 480-1B4A Bus 17

VENDOR DOCUMENTS Number Title Revision

GEK-7302 Installation and Operation of Type AK Power Circuit Breakers

TD A610.0100 Operators Manual for ASCO Model 432 Automatic Transfer Switch 0 TD G080.1910 Instruction Manual for

AKD-5 Powermaster Switchgear 0 TD N967.0040 Instruction Manual for NLI/ Square D Masterpact Breaker / Cradle SDS Part No: LGSB4 0

WORK ORDERS (WO)

138268

181503-12

181503-19

357838

417316

158317

181503-13

181503-24

370591

417317

181503-07

181503-14

181503-30

370593

418204

181503-08

181503-15

304692

411006-02

418360

181503-09

181503-16

305490

416219

421870

181503-10

181503-17

307443

417089

423508

181503-11

181503-18

314021

417313

Attachment 2 ATTACHMENT 2

SPECIAL INSPECTION CHARTER

September 7, 2011

ML11250A036 MEMORANDUM TO: Sam Graves, Senior Reactor Inspector

Engineering Branch 2

Division of Reactor Safety

FROM:

Anton Vegel, Director

Division of Reactor Safety

SUBJECT:

SPECIAL INSPECTION TEAM CHARTER TO EVALUATE THE BREAKER FIRE AND OPERATOR RESPONSE AT FORT CALHOUN STATION

In response to the breaker fire and resulting Alert declaration, a Special Inspection Team (SIT) is being chartered.

You are hereby designated as the SIT leader.

A. Basis

On June 7, 2011, a switchgear fire occurred at the Fort Calhoun Station that caused a loss of power to multiple buses.

This event met the following deterministic criteria of Management Directive 8.3 for a detailed follow up team inspection: * The event resulted in the loss of the spent fuel pool cooling function, and could have resulted in the loss of a safety function or multiple failures in systems used to mitigate an actual event had the event occurred at power. * The event resulted in significant unexpected system interactions.

Specifically, the faulted bus arced across open tie breaker

BT-1B4A, causing an overload on the island bus 1B3A-4A and bus 1B3A, nullifying train separation and eventual loss of power to the 1B3A bus.

Also, the event affected both trains of direct current control power, used for breaker operation and protection, although the extent of the impact is not yet known. * The event involved questions or concerns pertaining to licensee operational performance, since an acrid odor was reported in the area of the fire 3 days prior to the fire, but the licensee did not identify the source or prevent the fire.

The Maximum Conditional Core Damage Probability for the event was estimated to be

3.4 x 10-4, which is in the range for an Augmented Inspection Team.

However, based on currently available information, the appropriate level of NRC response was determined to be a special inspection because the plant will remain in cold shutdown through the period of the inspection and the licensee is still performing their root cause assessment and making repairs.

Attachment 2

B. Event Description

On June 7, 2011, at approximately 0930, with the plant in cold shutdown, the licensee declared an Alert due to a fire in the west switchgear room.

The fire brigade responded, but the fire was suppressed by de-energizing the affected buses and automatic halon system actuation.

The plant was in an outage, and was already in a Notice of Unusual Event condition due to flood levels on the Missouri River.

The running spent fuel pool cooling pump was de-energized; the other spent fuel cooling pump had no power after its bus was de-energized.

Shutdown cooling was not lost during the event.

The electrical power distribution system has two Class 1E 4160 Vac buses, and these each supply three 480 Vac load center buses that further supply motor control centers.

Each of the three pairs of 480 Vac load centers share a 480 Vac "island" bus that has tie breakers to both, but only one tie breaker to each island bus is normally closed.

For 3 days prior to the event, the licensee investigated an acrid odor in the west switchgear room, but was unable to identify the source.

The fire was caused by the catastrophic failure of the supply breaker for load center 1B4A.

A large quantity of sooty smoke was produced that facilitated the resulting fault that arced across the open tie breaker

BT-1B4A, such that the island bus and the other connected train load center

1B3A were affected.

The resulting large load increase eventually tripped the load center supply breaker 1B3A and tie breaker

BT-1B3A on short time over current.

Operators manually opened the 4160 Vac supply breaker upstream of the faulted 1B4A breaker to de-energize the 1B4A bus.

Some minutes later, by procedure, operators manually de-energized 4160 Vac bus 1A4, which resulted in de-energizing the remaining 480 Vac buses 1B4B and 1B4C on the same train.

The faulted breaker was a replacement for an original General Electric breaker that was obsolete.

The replacement Square D breakers were not an exact fit into the General Electric

AK-5 switchgear, so a transition piece, called a breaker cradle assembly, is used.

The breaker cradle assembly inserts into the switchgear cubicle first, followed by breaker insertion into the cradle assembly.

The cradle assembly has finger clusters that engage the bus bar stabs at the back of the switchgear, and has stabs on the breaker side of the cradle assembly that accept the breaker finger clusters.

The licensee replaced all six load center supply breakers and all six island bus-tie breakers with Square-D circuit breaker and cradle assemblies in 2009 by engineering change EC-33464.

Post-event inspections showed that the cradle-to-bus-stab connections associated with breaker 1B4A were vaporized or melted, indicating that the connections had excessive electrical resistance.

When reviewing the extent of condition in other breakers, the licensee found a breaker on load center 1B3B with abnormally high resistance on all three phases.

Boroscope photos showed that cradle finger engagement inappropriately extended beyond the silver plated contact surface of the bus stabs to copper surfaces.

These copper surfaces had evidence of hardened grease and oxidation, which would increase contact resistance.

The bus stabs were wiped, and the subsequent resistance readings were greatly reduced.

The licensee has found high resistance readings on eight of the 10 breakers that were not damaged in the event, although the remaining two breakers exceeded the manufacturer's recommended resistance.

Attachment 2 The failure mechanism appears to involve time-dependent excessive contact resistance due to the oxidation as well as pre-existing hardened grease.

The lack of proper alignment between the cradle fingers and the bus stabs such that dissimilar metals are in contact may have contributed to the oxidation.

The licensee issued

LER 2011-008, Revision 0, dated, August 5, 2011 on this issue stating that the root cause was still being determined. This configuration exists on other 480 Vac breakers, and could result in malfunctions of other components.

The licensee is determining the extent of condition.

B. Scope The SIT is expected to perform data gathering and fact finding in order to address the following:

1. Timeline:

Identify and document a timeline of significant events associated with the modification of 480 Vac breakers and subsequent fire impacting multiple 480 Vac Class 1E buses.

2. Operator Response:

Assess operator actions taken in response to the initial indications of a problem and the subsequent ground, fire, and loss of Class 1E

buses.

Evaluate procedure use and adequacy for this event.

Assess the appropriateness of the event classification and reporting.

3. Fire Suppression Review:

Review the response of the fire brigade and automatic fire detection and suppression systems to determine whether they functioned as expected, and whether the design was appropriate for the hazard.

4. Modification Review:

Review the 2009 modification (EC 33464) that installed 12 Square D breakers and cradles to replace the previous GE breakers to determine whether the modification properly considered 10

CFR 50.59 requirements, and the possible failure modes.

Assess the post-modification testing completeness for cradle and breaker positioning, electrical resistance, and other critical parameters.

5. Maintenance Review:

Review corrective action for

NCV 05000285/2010004-09 related to inadequate switchgear maintenance.

In particular, assess the adequacy of corrective actions for any identified problems that would identify and/or prevent high-resistance connections between breakers and switchgear, as well as problems involving inadequate inspection and cleaning of hardened grease or oxidation.

6. Root Cause Evaluation and Event Review:

Evaluate the licensee's efforts to assess the root and contributing causes for this event.

Assess the licensee's damage inspections and extent of condition assessments to determine whether the licensee appropriately assessed all possible impacts from the fault currents, heat, and soot.

Assess the planned action to correct damage, as well as whether these actions are appropriate to correct the root and contributing causes.

7. Electrical Protection and Separation:

Assess the timeline to identify individual events and actuations that represent the response or lack of response by the electrical power distribution system and the breaker control power system.

Attachment 2 Assess whether these systems responded as expected, and whether problems exist in the required level of electrical protection and separation.

This should include the fire's impact on direct current control power and the ability to operate breakers remotely or automatically.

8. Planned Repairs:

Evaluate the repair methods the licensee plans to use or have used in repairing fire damage, paying particular attention to heat-sensitive components such as cable jackets and insulation, relays, transformers, etc.

Assess the effectiveness and extent of inspection and cleaning to identify and remove soot.

9. Risk Assessment Information:

Gather information that may be needed to assess the risk impact of any performance deficiencies identified by this inspection.

Pay particular attention to identifying the total population of equipment impacted, any performance deficiencies, the failure mechanism(s), and the length of time that the equipment was susceptible to failure.

C. Guidance While on site, you will provide daily status briefings to Region IV management.

You should notify Region IV management of any potential generic issues related to this event for discussion with the program office.

Safety concerns that are not directly related to this event should be reported to the Region IV office for appropriate action.

The inspection results will be documented in a Special Inspection report and should be issued within 45 days of the completion of the inspection.

The guidance in NRC Inspection Procedure 93812, "Special Inspection," and NRC Management Directive 8.3, apply to your inspection.

This Charter may be modified should the team develop significant new information that warrants review.

If you have any questions regarding this charter, contact Neil O'Keefe at (817) 860-8137.

Attachment 3 ATTACHMENT 3 PRELIMINARY PHASE 3 SIGNIFICANCE DETERMINATION IMPROPER MODIFICATION/MAINTENANCE OF VITAL 480 VAC SWITCHGEAR

Analyst Assumptions

1. The Standardized Plant Analysis Risk Model for Fort Calhoun (SPAR), Revision 8.15, as modified by the analyst to include additional 480 Vac island buses and nonrecovery basic events for failure of 480 Vac load centers, was the best tool for quantifying the risk of the subject performance deficiency.

2. The SPAR, Revision 8.15 was modified to include 480 Vac Island Buses 1B3B-4B and 1B3C-4C including the appropriate mapping of safety functions supported by these buses.

3. The analyst assumed that, for this evaluation, basic events involving breaker failures for the nine 480 Vac normally-closed supply breakers plus the two

4160 Vac supply breakers and/or bus failures could be appropriately divided into a revised nominal failure rate and a nonrecovery whose product is equal to the original nominal failure rate as provided in Table 1.

Table 1Revised/Additional Baseline Basic Events Basic Event Original RevisedNonrecovery BE Value

ACP-CRB-CO-1B3A 3.6E-061.2E-05ACP-BAC-1B3A-REC 3.0E-01ACP-CRB-CO-1B3B 3.6E-061.2E-05ACP-BAC-1B3B-REC 3.0E-01ACP-CRB-CO-1B3C 3.6E-061.2E-05ACP-BAC-1B3C-REC 3.0E-01ACP-CRB-CO-1B4A 3.6E-061.2E-05ACP-BAC-1B4A-REC 3.0E-01ACP-CRB-CO-1B4B 3.6E-061.2E-05ACP-BAC-1B4B-REC 3.0E-01ACP-CRB-CO-1B4C 3.6E-061.2E-05ACP-BAC-1B4C-REC 3.0E-01ACP-CRB-CO-BT1B3A 3.6E-061.2E-05ACP-BAC-1B3A4A-REC 3.0E-01ACP-CRB-CO-BT1B3B 3.6E-061.2E-05ACP-BAC-1B3B4B-REC 3.0E-01ACP-CRB-CO-1BT1B3C 3.6E-061.2E-05ACP-BAC-1B3C4C-REC 3.0E-01ACP-BAC-LP-1A3 9.6E-062.2E-04DIV-A-AC-REC 4.3E-02ACP-BAC-LP-1A4 9.6E-062.2E-04DIV-B-AC-REC 4.3E-02

4. The twelve subject breaker cubicles were modified in November 2009 and were in service from that point until the fire in June 2011.

5. Given that the reactor was in operation from November 2009 through April 2011, this finding is being evaluated as an at-power event because the failure was more likely to have occurred during power operations than at shutdown, and the failure mode was determined to be independent of plant or system operational mode.

Attachment 3 6. Using best-available information, the inspectors concluded that the fire was caused by high-resistance connections between the cradle assembly and switchgear bus bars, and/or at the bolted connections of the bus bars, which resulted in overheating of the connections under load.

The deficient connections were a result of inadequate maintenance and/or modification.

7. Nine of the twelve 480 Vac supply breakers were closed for most of the time from November 2009 to June 2011.

8. The analyst evaluated the time frame over which the finding was reasonably known to have existed.

The analyst determined that the breaker cubicles could have failed at any time from their installation in November 2009 until the failure in June, 2011, which was approximately 19 months.

9. In accordance with Manual Chapter 0609, Appendix A, Attachment 2, "Site Specific Risk-Informed Inspection Notebook Usage Rules," Rule 1.1, "Exposure Time," the analyst determined that the maximum exposure time used in the SDP should be used, which is limited to 1 year.

10. The inspectors noted that the fire in Bus 1B4A caused the failure of Island Bus 1B3A-4A despite Breaker

BT-1B4A being open.

Therefore, the analyst assumed that any postulated fire in a 480 Vac load center with a normally-open tie breaker would cause the failure of its associated island bus.

11. The inspectors noted that all three island buses were physically located inside the switchgear containing the load center with the normally-closed tie breaker.

One example is that Bus 1B3A is located in the same physical switchgear as Bus 1B3A-4A.

Therefore, a hot gas layer would be free to communicate between cubicles in these switchgear.

Therefore, analyst determined that any postulated fire in a 480 Vac load center with a normally-closed tie breaker would cause the failure of its associated island bus.

Likewise, any postulated fire in a normally-closed tie breaker cradle would cause the failure of the associated load center.

12. During the exposure period, a postulated failure of the breaker and/or cradle for these nine normally-closed breakers would result in a fire that would cause severe damage to the bus, making the associated 480 Vac buses listed in Table 2 unrecoverable.

Attachment 3

Table 2Unrecoverable Bus Failures

From Postulated Fires Fire Location Buses Failed Breaker Cradle 1B3A 1B3A 1B3A-4A Breaker Cradle 1B3B 1B3B 1B3B-4B Breaker Cradle 1B3C 1B3C 1B3C-4C Breaker Cradle 1B4A 1B4A 1B3A-4A Breaker Cradle 1B4B 1B4B 1B3B-4B Breaker Cradle 1B4C 1B4C 1B3C-4C Breaker Cradle

BT-1B3A 1B3A 1B3A-4A Breaker Cradle

BT-1B4B 1B4B 1B3B-4B Breaker Cradle

BT-1B3C 1B3C 1B3C-4C

13. The analyst determined that those buses documented under Assumption 12 as unrecoverable were not available for operation at any time during the mission times covered by the subject evaluation.

14. By plant procedures, both 480 Vac and 4160 Vac buses are de-energized in an effort to isolate electric power to the affected bus.

Table 3 indicates the additional buses that would be de-energized by operators following a postulated fire.

Table 3Buses De-energized Following Postulated Fires Fire Location Buses De-energized Breaker Cradle 1B3A 1B3B1B3C 1A3 1B3C-4C

Breaker Cradle 1B3B 1B3A1B3C 1A3 1B3C-4C 1B3A-4A Breaker Cradle 1B3C 1B3A1B3B 1A3 1B3A-4A

Breaker Cradle 1B4A 1B4B1B4C 1A4 1B3B-4B

Breaker Cradle 1B4B 1B4A1B4C 1A4

Breaker Cradle 1B4C 1B4A1B4B 1A4 1B3B-4B

Breaker Cradle

BT-1B3A 1B3B1B3C 1A3 1B3C-4C

Breaker Cradle

BT-1B4B 1B4A1B4C 1A4

Breaker Cradle

BT-1B3C 1B3A1B3B 1A3 1B3A-4A

15. Given the plant design of the normally-open bus-tie breakers and the associated bus work, the smoke from a postulated fire in a 480 Vac load center with a normally-open bus-tie breaker will cause a fault in the nonsegregated bus resulting in the de-energization of the associated cross-train bus.

Table 4 documents these additional buses that would be de-energized.

Attachment 3 Table 4Buses De-energized by Fire Faults From Postulated Fires Fire Location Buses Failed Breaker Cradle 1B3B 1B4B Breaker Cradle 1B4A 1B3A Breaker Cradle 1B4C 1B3C

16. The analyst assumed that the buses de-energized as documented under Assumptions 14 and 15 had the potential to be recovered prior to core damage, given appropriate operator action.

17. The breaker failure probability can be calculated by multiplying 1 failure of 9 breaker cradles that are normally subject to electrical load and dividing by the 19 months that they were in service.

18. In accordance with Abnormal Operating Procedure,

AOP-06, "Fire Emergency," Revision 25, a fire in a vital 480 Vac load center requires operators to initially de-energize the associated 4160 Vac switchgear, opening all of the normally-closed breakers on that side of the ac power system.

19. The baseline core damage frequency was determined to be based on the frequency of an energetic fault in the most limiting fire scenario.

The generic fire for vital switchgear from NRC Inspection Manual Chapter 0609, Appendix F, Attachment 4 is 4.70 x 10-6/year per vertical section.

The smaller switchgear at Fort Calhoun Station has 5 vertical sections, resulting in an initiating event frequency of 2.4 x 10-5/year.

Therefore, as an example, the baseline risk for the postulated failure of Switchgear 1B4A, with a conditional core damage probability of 6.4 x 10-5, will be 1.5 x 10-9/year.

20. Following any of the fires postulated in Assumption 12 a reactor transient would occur, either directly from instrumentation and/or lost equipment or via licensed operators following plant procedures or required Technical Specifications.

21. Abnormal Operating Procedure,

AOP-06, "Fire Emergency," Revision 25, directs operators to close and de-energize pressurizer power-operated relief valves and their associated block valves prior to de-energizing vital buses during a fire.

As such, the analyst assumed that the pressurizer power-

operated relief valves would not be available throughout the postulated event.

22. For the estimation of conditional core damage probability (CCDP), a 24-hour mission time was assumed.

However, in order to calculate common cause failure of a second circuit breaker fire to start, a vulnerability time of 56 hours6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> was assumed based on the following considerations:

Attachment 3 Technical Specification 2.7(2)f. permits one of the buses connected to Bus 1A3 or 1A4 to be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Technical Specification 2.7(2), "Modification of Minimum Requirements," requires that with Paragraph f not met: ". . . the reactor shall be placed in hot shutdown within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

If the violation is not corrected within an additional 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, the reactor shall be placed in a cold shutdown condition within an additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />."

The analyst noted that licensed operators may decide to cool down the reactor more rapidly than required by Technical Specifications.

However, many of the scenarios would require multiple manual system alignments to achieve cold shutdown presenting a potential that reactor cooldown timing would be limited more by manpower available than by license restrictions.

Therefore, for the calculation of common cause failure, the analyst assumed that the reactor would be in a condition above cold shutdown for 56 hours6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> following a postulated bus fire.

23. In lieu of a complex (while more traditional) common cause failure analysis, the analyst assumed that there was a potential for a second fire to initiate during the Technical Specification Allowed Outage Time and evaluated all potential two fire combinations.

This was necessitated by both the frequency of a postulated fire and the consequences being too high to truncate.

24. The nonrecovery probability for restoration of buses that were manually de-energized during a postulated fire can be best quantified using the

SPAR-H Method described in NUREG/CR-6883, "The

SPAR-H Human Reliability Analysis Method."

25. The operators, electricians and fire brigade personnel responding to the fire and the associated reactor event will be under high stress throughout the response.

Therefore, all human reliability analysis would use high stress as a performance shaping factor in both the diagnosis and actions.

26. Given the need to ensure that the fire is extinguished and then to evacuate Halon and smoke products from the east and west switchgear rooms following a postulated fire, the analyst reviewed the timing during the actual event.

The space was not cleared, such that maintenance personnel could access the area, until almost 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the report of the fire.

Therefore, the analyst determined that no recovery potential should be credited for core damage sequences lasting 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or less.

27. Based on the need to ensure that all faults are properly isolated, the evolution of determining that a de-energized switchgear was capable of being energized again following a postulated fire was considered to be moderately complex.

Therefore the diagnosis portion of this human reliability analysis should be increased.

Attachment 3 28. Given the condition of Bus 1B4A following the fire, the analyst assumed that the smoke, soot coating of equipment, heat and lighting conditions in which operators and electricians would be locating, measuring and isolating all faults following any postulated fire in a 480 Vac bus would make these functions more difficult.

Therefore, the ergonomics were considered to be poor for the diagnosis portion of the human reliability analysis.

29. The twelve 480 Vac supply breakers had a unique design requiring maintenance personnel to perform a local reset operation after a trip prior to reclosing the breaker.

This delayed the operators in closing the breakers because of insufficient instructions to the operators, combined with a lack of familiarity with the design.

Therefore, the analyst assumed that the procedures for the action portion of the human reliability analysis were poor.

30. A seismic event could result in the failure of the breaker/breaker cradle interface and/or bolted bus bars in a manner similar to the fire that occurred on June 7, 2011.

31. The failure discussed under Assumption 30 would occur with about the same fragility of the offsite power insulator stacks which represents the vibration levels that start to cause differential motion between uncoupled components.

32. Failures of more than two breaker cradles following a seismic event are possible.

However, the evaluation of the risk for these scenarios would become prohibitive based on the large number of scenarios that would be possible and would not be expected to contribute significantly to the overall risk.

33. Once the plant is in cold shutdown, as required by Technical Specifications, the unavailability of two 480 Vac busses will continue to impact the risk of plant shutdown for several months while investigation and repairs are conducted.

34. The shutdown risk referred to under Assumption 33 is best evaluated in a qualitative manner for the subject significance determination.

35. The 480 Vac distribution system at Fort Calhoun Station supports the cooling of the spent fuel pool.

As a result, the subject performance deficiency impacts the risk of core damage in the spent fuel pool.

This risk is best evaluated in a qualitative manner for the subject significance determination.

36. While Assumption 8 describes a straight-line failure rate for the subject breaker cubicles, the actual failure frequency would most likely be better described as some form of an exponential curve.

As such, the failure frequency would have been higher for the year of the exposure period than for the preceding 9 months.

The additional risk associated with the higher failure rate is best evaluated in a qualitative manner for the subject significance determination.

37. For some fire scenarios, a fire in one bus will affect the dc control power for buses in the opposite train.

As a result, manual operations of breakers would Attachment 3 be required for operator responses, increasing the risk associated with the finding.

The additional risk resulting from the additional work load on operators responding to the postulated events is best evaluated in a qualitative manner for the subject significance determination.

38. Because during all postulated scenarios, one switchgear room would be inaccessible for 2-1/2 hours and the other would be filled with Halon making operator actions difficult and delayed, operators would not be able to strip plant lighting loads within 15 minutes as required by plant procedures.

The result would lead to vital battery depletion in approximately 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Exposure Period As stated in Assumptions 4, 7 and 8, the twelve subject breaker cubicles were modified in November 2009 and were in service from that point until the fire in June 2011.

The analyst evaluated the time frame over which the finding was reasonably known to have existed.

The analyst determined that the breaker cubicles could have failed at any time from their installation in November 2009 until the failure in June, 2011, which was approximately 19 months.

The repair time for the failed buses continued as of December 2011.

As stated in Assumption 9, in accordance with Manual Chapter 0609, Appendix A, Attachment 2, "Site Specific Risk-Informed Inspection Notebook Usage Rules," Rule 1.1, "Exposure Time," the analyst determined that the maximum exposure time used in the SDP should be used, which is limited to 1 year.

Fire-Induced Risk

Fire Initiating Event Likelihood As stated in Assumption 17, the breaker cubicle failure probability can be calculated by multiplying 1 failure of 9 breaker cradles and dividing by the 19 months that they were in service.

Given that a breaker cubicle failure would result in catastrophic failure of the associated vital bus, the analyst calculated the initiating event likelihood (Fire) as follows:

Fire = failures ÷ (breakers * months) =

1 ÷ (9 breakers *

19 months)

=

5.9 x 10-3 /month *

12 months/year =

7.0 x 10-2 /year

Attachment 3 Safety Impact

As stated in Assumption 12, any postulated fire in one of the nine normally closed breakers would result in the long-term failure of two vital 480 Vac buses.

The risk-important equipment supplied by these buses would not be available throughout the accident sequences modeled and subsequent repair.

Additionally, as stated in Assumptions 14 and 15, any postulated fire in one of the nine normally-closed breakers would result in operators de-energizing multiple additional vital buses and the potential de-energization of one additional bus caused by fire-related faults.

The risk-important equipment supplied by those buses would not be available until the fire was extinguished, smoke and Halon removed from the switchgear rooms, plant personnel were capable of determining that the buses were safe to re-energize, and operators re-energized the buses and reconnected the risk-important loads.

Application of Recovery As stated in Assumptions 13 and 16, the potential for recovery of vital buses was grouped into the following categories:

1. The analyst determined that those buses documented under Assumption 12 as unrecoverable were damaged and not available for operation at any time during the 24-hour mission time.

Additionally, they would not be available for the 56-hour vulnerability time for impact from a second postulated fire as covered by the subject evaluation.

2. The nonrecovery probability for restoration of undamaged 480 Vac buses de-energized by operators during a postulated fire were quantified using the

SPAR-H Method described in NUREG/CR-6883, "The

SPAR-H

Human Reliability Analysis Method."

This analysis is documented in Table 5.

3. The nonrecovery probability for restoration of undamaged 480 Vac buses de-energized by fire-induced faults during a postulated fire were quantified using the

SPAR-H Method described in NUREG/CR-6883, "The

SPAR-H Human Reliability Analysis Method."

This analysis is documented in Table 5.

4. The nonrecovery probability for restoration of 4160 Vac buses de-energized by operators during a postulated fire were quantified using the

SPAR-H Method described in NUREG/CR-6883, "The

SPAR-H Human Reliability Analysis Method."

This analysis is documented in Table 6.

Attachment 3

Table 5 Recovering 480 Vac Electrical Buses De-energized during Fire Performance Shaping Factor Diagnosis Action

PSF Level MultiplierPSF Level Multiplier

Time: Nominal 1.0Nominal 1.0Stress: High 2.0High 2.0Complexity: Moderately Complex 2.0Nominal 1.0Experience: Nominal 1.0Nominal 1.0Procedures: Nominal 1.0Available, but Poor 5.0Ergonomics: Poor 10.0Nominal 1.0Fitness for Duty: Nominal 1.0Nominal 1.0Work Processes: Nominal 1.0Nominal 1.0

Nominal 1.0E-02

1.0E-03

Adjusted 4.0E-01

2.0E-02

Odds Ratio 2.9E-01

9.9E-03

Composite 40

10

Failure to Re-energize 480 Vac Bus Following Fire Probability: 3.0E-01

Attachment 3

Table 6 Recovering 4160 Vac Electrical Buses De-energized during Fire Performance Shaping Factor Diagnosis Action

PSF Level Multiplier PSF Level Multiplier

Time: Nominal 1.0Nominal 1.0Stress: High 2.0High 2.0Complexity: Moderately Complex 2.0Nominal 1.0Experience: Nominal 1.0Nominal 1.0Procedures: Nominal 1.0Nominal 1.0Ergonomics: Nominal 1.0Nominal 1.0Fitness for Duty: Nominal 1.0Nominal 1.0Work Processes: Nominal 1.0Nominal 1.0

Nominal 1.0E-02

1.0E-03

Adjusted 4.0E-02

2.0E-03

Odds Ratio 3.9E-02

2.0E-03

Composite 4

2

Failure to Reenergize 4160 Vac Bus Following Fire Probability:

4.1E-02

Adjustments to SPAR

The analyst noted that the results of the initial SPAR evaluation were more significant than the licensee's evaluation. In reviewing these differences, it was noted that the licensee's model provided for recovery of auxiliary feedwater during a station blackout, following battery depletion.

The licensee stated that Fort Calhoun Station had a unique arrangement for auxiliary feedwater. Auxiliary Feedwater Pump

FW-54 is diesel driven and does not rely on vital ac or dc power.

The pump is supplied with fuel from Diesel Fuel Oil Storage System Tank

FO-10. Tank

FO-10 has a minimum volume of 10,000 gallons of diesel fuel as required by Technical Specification 2.7.

Eight thousand gallons of the tank's inventory are readily available for use by Pump

FW-54.

Therefore, the pump could run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without fuel addition.

The analyst noted that the condensate storage tank would provide about 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> of water based on licensee calculated steam generator steaming rates.

Therefore, makeup water sources were not assessed.

Attachment 3 Traditionally, SPAR methodology assumes that auxiliary feedwater fails upon loss of vital batteries.

This failure is dominated by difficulties in starting, maintaining and controlling flow through turbine-driven pumps.

Given the postulated failure of the turbine- driven pump, the steam generators boil dry and the scenario leads to core damage.

Providing a reliable diesel-driven pump resolves this problem, and the pump could theoretically continue to feed the steam generators for the 24-hour mission time.

To give credit for Pump

FW-54, the failure mechanisms of the system, including the operator actions required to continue to feed the steam generators for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> were evaluated.

These included the following: * Pump

FW-54 must continue to run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, including fuel supply, suction source, and the operator attention necessary. * Operators must transfer the discharge of the system to the auxiliary feedwater nozzles and manually throttle discharge Valves

HCV-11078 and

HCV-11088 prior to battery depletion. * Operators must ensure that there is sufficient auxiliary feedwater flow to prevent core damage. * The reactor coolant pump seals must remain intact for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without vital ac or dc power. The analyst determined that the reactor coolant pump seals at Fort Calhoun Station were of the upgraded seal design.

Therefore, the analyst utilized the value for the probability of seal failure during an extended loss of power, documented in the SPAR model.

This value was 8.9 x 10-3. * Operators must isolate the condensate storage tank prior to loss of pressure in the associated nitrogen bottle.

This action requires manual isolation of the hotwell supply line before the air-operated valve fails open and the condensate storage tank inventory is vacuum dragged to the condenser. * Operators have a varying amount of time to perform these actions, depending on the success or failure of two operator actions: (1) operators minimize dc loads on the battery quickly following a station blackout and; (2) operators flood the steam generators to 94 percent wide-range level prior to battery depletion using either Pump

FW-54 or the turbine-

driven auxiliary feedwater pump.

The analyst used generic steam generator data and certain plant-specific information from the Final Safety Analysis Report to calculate the approximate time that operators would have to successfully operate Pump

FW-54 following battery depletion conditional upon the success or failure of these two actions. Table 7 documents those times.

Attachment 3

The analyst quantified the probability that the operators fail to minimize dc loads in a short period of time using the

SPAR-H method described in NUREG/CR-6883, "The

SPAR-H Human Reliability Analysis Method."

The procedural requirements in Emergency Operating Procedure

EOP-00, "Standard Post Trip Actions," and Emergency Operating Procedure Attachment 6, "Minimizing DC Loads," were evaluated.

The analyst assumed that this particular action did not require a significant amount of diagnosis because the

EOP-00 has a step and multiple notes reminding the operators to take the action when necessary.

The analyst adjusted the nominal human error probabilities using the following performance shaping factors: * Available time was 15 minutes.

The analyst assumed that this was just enough time to coordinate with two plant operators and to open breakers in the turbine building and the auxiliary building.

Therefore, a factor of 10 was used. * The stress was assumed to be high because of an ongoing station blackout.

Therefore, a factor of 2 was used. * The complexity was assumed to be moderate because of the coordination needed with plant operators at two different locations and the low lighting during the station blackout conditions.

Therefore, a factor of 2 was used.

In addition to these three shaping factors, the analyst adjusted the final result using the odd's ratio1 as documented in the draft NUREG, Section 2.5.

The probability that operators would fail to minimize dc loads within 15 minutes of a station blackout was calculated to be 3.9 x 10-2.

NOTE:

This value was used in calculating the baseline risk of the condition.

However, as stated in Assumption 38, the analyst determined that operators would fail to minimize dc loads.

Using a similar approach, the analyst calculated probabilities of human error for each of the required operator actions listed above.

The times available, documented in Table 8, were used to modify the performance shaping factors

1 Odd's ratio is a method of accounting for the number of successes as well as failures when calculating a conditional human error probability.

This method of accounting for uncertainties associated with individual performance shaping factors is described in NUREG/CR-6883, "The

SPAR-H Human Reliability Analysis Method," and tends to provide a less conservative result. Table 7Time to Steam Generator Dryout During Station Blackout Case Minimize dc Loads Time to Depletion Flood Generators Time for Boil Down Total Time 1 Success 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Success 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 13 hours 2 Success 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Failure 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 10.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 3 Failure 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Success 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 6.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 4 Failure 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Failure 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 4.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Attachment 3 based on the time operators had to respond to the particular action.

The HRA values calculated are documented in Table 8.

Table 8Operator Failure Probabilities

Performance Shaping Factors

Operator Action Time Available Time Stress Procedure Experience Failure Probability Minimize dc Loads 8, 9 15 minutes 10 2.0 1.0 1.0 3.9 x 10-2 Flood S/Gs to 94% 4,9 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 1.0 2.0 1.0 0.5 1.0 x 10-3 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 0.1 2.0 1.0 0.5 1.0 x 10-4 Swap to AFW nozzle and throttle AFW Valves 3,8 <3 hours 1.0 1.0/2.02 0.5/2.05 1.0/3.07 3.8 x 10-1 >4.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 0.1 1.0/2.02 0.5/2.05 1.0/3.07 5.7 x 10-2 Provide Sufficient Flow 4,9 2 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 0.1 2.0 0.5 1.0 1.0 x 10-4 Isolate CST 4 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 1.0/0.11 2.0 0.5/1.06 1.0 1.2 x 10-3

Notes:

1 Nominal time was available for diagnosis, but there was barely adequate time to take the action.

2 Nominal stress was used for diagnosis because of control room environment and verbatim emergency operating procedure compliance.

High stress in the field because actions would affect plant safety.

3 The following items also had the Complexity PSF changed to 0.1 for an obvious diagnosis, and 2.0 for a moderately complex action: minimize dc loads and swap to AFW nozzles.

4 Complexity values adjusted to indicate an obvious diagnosis based on emergency operating procedure review.

5 The procedures for diagnosing the need for this step were symptom based, but the procedures for implementation were considered by the analyst to be poor.

6 The procedures for diagnosing the need for this step were symptom based, but the procedures for implementation were considered by the analyst to be nominal.

The experience of operators is nominal for diagnosing this need, but they do not routinely operate the valve gags in this situation.

8 The ergonomics were considered poor for swapping the AFW nozzle because an unfamiliar task would have to be done without normal lighting.

9 These actions did not include a significant amount of diagnosis.

Therefore, only the action failure probability was calculated.

Attachment 3

The analyst created an event tree to model the actions required to successfully use Pump

FW-54 following battery depletion.

This event tree, provided below, covered each of the functions required to achieve success, as well as the probability that actions affecting the time available (i.e., minimizing dc loads) would be completed.

The analyst used the SPAR to quantify Fault Tree

AFW-FW54, "Fort Calhoun PWR G AFW

FW-54," and provide a probability that the Pump

FW-54 train would fail from stochastic reasons at any time during the accident sequence.

The probability of failure was determined to be 3.1 x 10-2.

The analyst then quantified the event tree using the human reliability values listed in Table 8 and the solution from the SPAR fault tree for Pump

FW-54 as split fractions.

This quantification provided the total failure probability of the Pump

FW-54 train during an unrecovered station blackout, upon depletion of the station vital batteries.

The probability was quantified as 1.1 x 10-1.

Given Assumption 38, the depletion of station batteries would take place at 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Therefore, in the event tree, the Top Event, "Minimize-D," was always failed.

The analyst requantified the event tree and determined that the total nonrecovery probability was 4.0 x 10-1 for most cutsets.

The analyst modified the SPAR model to include the attached Event Tree, "FW54 Cooling Following Battery Depletion."

The analyst created a transfer to this tree from Event Tree, "Fort Calhoun PWR G Transient," for Sequences 13, 14, and 15.

Attachment 3

Attachment 3

Attachment 3 Treatment of Common Cause Component Failure Probability

Given the unique sets of buses affected by any given postulated fire and the independence of the fire initiators, the analyst determined that the classic alpha-factor method was not appropriate to evaluate the common cause failure probability for the nine vital 480 Vac buses associated with the performance deficiency.

As such, in lieu of classical treatment, the analyst quantified the potential that a second independent fire occurs during the time that the plant would likely be maintained above cold shutdown.

As stated in Assumptions 22 and 23, the analyst determined that any postulated independent second fire that occurred within 56 hours6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> (Overlap Time) of the first should be evaluated in combination with the first as an at-power event.

Therefore, the analyst calculated the conditional probability that overlapping fires would impact the at-power risk (POverlap) as follows:

POverlap =

Overlap Time *

Fire

=

56 hours6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> ÷

8760 hour0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br />s/year *

7.0 x 10-2 /year =

4.5 x 10-4

Quantification of Conditional Core Damage Probabilities

As stated in Assumptions 1, 2, and 3, the analyst created a more detailed model of the electrical distribution system than that provided in the Fort Calhoun SPAR, Revision 8.15.

The changes included appropriate mapping of risk-significance plant equipment and functions supported by these buses.

Idaho National Laboratories assisted in incorporating these changes into the SPAR model and validating the impact.

The analyst calculated the change in risk related to this performance deficiency using the following method:

The analyst quantified the new model and reestablished a baseline risk for:

Internal Core Damage Frequency 9.3 x 10-6 /year Single Energetic Switchgear Fire CDF 1.5 x 10-9 /year Seismically-Induced LOOP CCDP 1.2 x 10-3

For each of the postulated fires documented in Assumptions 12 and 23 the analyst set the failure probability of the associated vital buses and/or supply breakers to 1.0.

The analyst quantified the conditional core damage probability for each of the nine postulated fires.

The results are provided in Table 9. Table 10 provides the change sets used for each postulated fire.

Attachment 3

Table 9 Conditional Core Damage Probabilities Postulated Fire: Case CCDP:

1B4A 6.4E-051B3A 3.1E-051B3B 6.1E-051B3C 5.8E-051B4B 2.3E-051B4C 3.8E-051B3A-4A 3.1E-051B3B-4B 2.3E-051B3C-4C 5.8E-05

The analyst then quantified the conditional core damage probability for each combination of two breaker cubicle fires.

As stated in Assumption 23, these independently-initiated fires are being evaluated in lieu of a more complex common cause failure evaluation.

These results are documented in Table 11.

Attachment 3

Table 10 Affected Basic Events for Each of Nine Postulated Fires

Breaker 1B4A Breakers 1B4Bor

BT-1B4B Breaker 1B4C Breakers 1B3A or

BT-1B3A Breaker 1B3B Breakers 1B3COr

BT-1B3C

ACP-BAC-LP-1B4A

ACP-BAC-LP-1B4BACP-BAC-LP-1B4C

ACP-BAC-LP-1B3A

ACP-BAC-LP-1B3B

ACP-BAC-LP-1B3C

ACP-BAC-LP-1B3A4A

ACP-BAC-LP-1B3B4B

ACP-BAC-LP-1B3C4C

ACP-BAC-LP-BT1B3A

ACP-BAC-LP-1B3B4B

ACP-BAC-LP-1B3C4C

ACP-CRB-CO-1B3A

ACP-CRB-CO-1B4A

ACP-CRB-CO-1B4A

ACP-CRB-CO-1B3B

ACP-CRB-CO-1B3A

ACP-CRB-CO-1B3A

ACP-CRB-CO-1B4B

ACP-CRB-CO-1B4C

ACP-CRB-CO-1B4B

ACP-CRB-CO-1B3C

ACP-CRB-CO-1B3C

ACP-CRB-CO-1B3B

ACP-CRB-CO-1B4C

ACP-BAC-LP-1A4

ACP-CRB-CO-1B3CACP-CRB-CO-1BT1B3C

ACP-CRB-CO-1B4B

ACP-CRB-CO-BT1B3A

ACP-CRB-CO-BT1B3B

ACP-CRB-CO-BT1B3B

ACP-BAC-LP-1A3

ACP-CRB-CO-BT1B3A

ACP-BAC-LP-1A3

ACP-BAC-LP-1A4

ACP-BAC-LP-1A4

ACP-CRB-CO-1BT1B3C

ACP-BAC-LP-1A3

Attachment 3

Table 11 Combinations of 2 Fires - Conditional Core Damage Probability

1B4A 1B3A 1B3B 1B3C 1B4B 1B4C 1B3A-4A 1B3B-4B 1B3C-4C 1B4A

7.4E-021.9E-011.8E-018.4E-051.7E-047.4E-028.4E-051.8E-011B3A 7.4E-02

8.0E-057.1E-052.6E-022.6E-02

2.6E-027.1E-051B3B 1.9E-01 8.0E-05

2.5E-046.7E-026.8E-028.0E-056.7E-022.5E-041B3C 1.8E-01 7.1E-052.5E-04

6.1E-027.7E-027.1E-056.1E-02

1B4B 8.4E-05 2.6E-026.7E-026.1E-02

4.0E-052.6E-02

6.1E-021B4C 1.7E-04 2.6E-026.8E-027.7E-024.0E-05

2.6E-024.0E-057.7E-021B3A-4A

8.0E-057.1E-052.6E-022.6E-02

2.6E-027.1E-051B3B-4B 8.4E-05 2.6E-02

6.1E-02

4.0E-052.6E-02

2.5E-041B3C-4C 1.8E-01 7.1E-052.5E-04

6.1E-02

7.1E-052.5E-04

Table 12 Change in Core Damage Frequency for Single Postulated Fires Postulated Fire: Exposure Period Failure Frequency Case CCDP ICCDP (days) (/year)

1B4A 3657.0E-02 6.4E-054.5E-061B3A 3657.0E-02 3.1E-052.1E-061B3B 3657.0E-02 6.1E-054.3E-061B3C 3657.0E-02 5.8E-054.1E-061B4B 3657.0E-02 2.3E-051.6E-061B4C 3657.0E-02 3.8E-052.7E-061B3A-4A 3657.0E-02 3.1E-052.1E-061B3B-4B 3657.0E-02 2.3E-051.6E-061B3C-4C 3657.0E-02 5.8E-054.1E-06

Attachment 3 Calculation of Change in Core Damage Frequency

The analyst calculated the change in core damage frequency for each postulated fire as documented in Table 12.

The sum of the change in core damage frequencies, 2.7 x 10-5, is the best estimation of the fire-induced risk for single fire scenarios caused by the subject performance deficiency.

The analyst calculated the change in core damage frequency for each of the 63 postulated fire combinations documented in Table 11.

The sum of the change in core damage frequencies, 8.1 x 10-5, is the best estimation of the fire-induced risk for multiple fire scenarios caused by the subject performance deficiency.

This represents the risk from common cause failures of the subject breaker cubicles.

Although there is some overlap in the quantification of single and multiple fires, the analyst determined that this dependence was negligible in the final result.

The sum of the fire-induced change in core damage frequencies is 1.1 x 10-4.

Seismically-Induced Risk

The analyst determined that, for the subject performance deficiency to affect the core damage frequency related to seismic events, the event must result in a fire in at least one of the nine normally-closed 480 Vac breakers.

The analyst noted that the dominant risk would result when the seismic event was large enough to result in a loss of offsite power from failure of the switchyard insulators.

Additionally, to quantify the increase in core damage frequency (CDF) caused by the inadequately modified/maintained 480 Vac switchgear, the analyst must know the probability that combinations of 480 Vac buses would fail as a result of the performance deficiency, as well as the change in core damage probability assuming that the above postulated conditions occurred.

As such, the analyst evaluated the subject performance deficiency by determining each of the following parameters for any seismic event producing a given range of median acceleration "a" [SE(a)]:

1. The frequency of the seismic event SE(a) ( SE(a)) ; 2. The probability that a LOOP occurs during the event (P

LOOP-SE(a)); 3. The probability that a given combination of buses fail during the event (P Bus-SE(a)); 4. The number of combinations to be analyzed (Comb);

5. The baseline core damage probability (CCDP SE(a)); and 6. The sum of the conditional core damage probabilities (CCDP Bus-SE(a))

The CDF for the acceleration range in question (CDF SE(a)) can then be quantified as follows:

CDF SE(a) =

SE(a) *

P

LOOP-SE(a) *

P Bus-SE(a) * (CCDP Bus-SE(a) - (Comb * CCDP SE(a)))

Attachment 3

Given that each range "a" was selected by the analyst specifically to be independent of all other ranges, the total increase in risk, CDF, can be quantified by summing the CDFSE(a) for each range evaluated as follows:

CDF =

CDFSE(a) a=.05 over the range of SE(a).

Frequency of the Seismic Event

NRC research data indicates that seismic events of 0.05g or less have little to no impact on internal plant equipment.

Therefore, the analyst assumed that seismic events less than 0.05g do not directly affect the plant.

The analyst assumed that seismic events greater than 1.0g lead to core damage.

The analyst, therefore, examined seismic events in the range of 0.05g to 1.0g.

The analyst divided that range of seismic events into segments (called "bins" hereafter).

Specifically, seismic events from 0.05-0.08g, 0.08-0.15g, 0.15-0.25g, 0.25-0.30g, 0.30-0.40g, 0.40-0.50g, 0.50-0.65g, 0.65-0.80g, and 0.80-1.0g defined each bin.

These bins were selected from the published hazard curve for the Fort Calhoun Station at frequencies presumed to affect plant equipment differently.

In order to determine the frequency of a seismic event for a specific range of ground motion (g in peak ground acceleration), the analyst used the Risk Assessment of Operation Events (RASP) Handbook, Volume 2, "External Events," and obtained values for the frequency of the seismic event that generates a level of ground motion that exceeds the lower value in each of the bins.

The analyst then calculated the difference in these "frequency of exceedance" values to obtain the frequency of seismic events for the binned seismic event ranges.

For example, according to the RASP, the frequency of exceedance for a 0.08g seismic event at Fort Calhoun Station is estimated at 5.6 x 10-4/yr and a 0.15g seismic event at 2.3 x 10-4/yr.

The frequency of seismic events with median acceleration in the range of 0.08g to 0.15g [SE(0.08-0.15)] equals the difference, or 3.2 x 10-4/yr.

Probability of a Loss of Offsite Power

The analyst assumed that a seismic event severe enough to break the ceramic insulators on the transmission lines will cause an unrecoverable loss of offsite power.

Attachment 3 The analyst obtained data on switchyard components from the Risk Assessment of Operating Events Handbook; Volume 2, "External Events," Revision 4, which referenced generic fragility values listed in:

NUREG/CR-6544, "Methodology for Analyzing Precursors to Earthquake-

Initiated and Fire-Initiated Accident Sequences," April 1998; and

NUREG/CR-4550, Vols 3 and 4 part 3, "Analysis of Core Damage Frequency: Surry / Peach Bottom," 1986

The references describe the mean failure probability for various equipment using the following equation:

Pfail(a) = [ ln(a/am) / (r2 + u2)1/2]

Where is the standard normal cumulative distribution function and a = median acceleration level of the seismic event; am= median of the component fragility; r= logarithmic standard deviation representing random uncertainty; u= logarithmic standard deviation representing systematic or modeling uncertainty.

In order to calculate the LOOP probability given a seismic event the analyst used the following generic seismic fragility: am = 0.3g r =

0.30 u =

0.45

Using the above normal cumulative distribution function equation the analyst determined the conditional probability of a LOOP given a seismic event.

For each of the bins the calculation was performed substituting for the variable "a" (peak ground acceleration) the acceleration levels obtained from the bins described above.

Table 13 shows the results of the calculation for various acceleration levels.

Table 13 Peak Ground Acceleration/Probability of LOOP

0.05g

2.0E-3

0.3g 6.0E-1

0.8g 9.8E-1

0.15g

2.1E-1

0.5g 8.8E-1

Given Assumptions 30 and 31, the independent probability that any given breaker cubicle would fail within an associated bin would be equal to the probability of a LOOP.

Continuing this logic, the failure probability of any two breaker cubicles would be the square of the conditional LOOP probability for the bin.

Attachment 3 Conditional Change in Core Damage Probability

The analyst evaluated the spectrum of seismic initiators to determine the resultant impact on the reliability and availability of mitigating systems affecting the subject performance deficiency.

The analyst used the Fort Calhoun Station Revision 8.15 SPAR Model (as modified), to perform the evaluations.

The analyst first created a baseline case by setting the initiating event probability for a LOOP to 1.0 and all other initiating event probabilities in the SPAR model to zero.

Offsite power was assumed to be nonrecoverable following seismic events that break the ceramic insulators (low fragility components) on the transmission lines.

Therefore, the analyst set the nonrecovery probabilities for offsite power to 1.0.

The modified SPAR model quantified the resultant conditional core damage frequency as 1.2 x 10-3, which represented the baseline case that is used in the above equation.

The SPAR Model was then used to quantify the case values using the change sets described in Table 10.

The change in conditional core damage probability was calculated for each postulated single fire within each bin and for each combination of two fires designated in Table 11.

The analyst noted that the seismic failure of multiple breakers would be a likely scenario.

However, these were not evaluated given the significant amount of effort required to perform such calculations and that the change in core damage frequency for postulated single seismically-induced fires already exceeded the Yellow/Red Threshold.

Phase 3 Seismic Results

Considering the factors described above for each bin, namely, * The frequency of the seismic event; * The probability that a LOOP occurs during the event; * The probability that a given vital bus would fail during the event; * The baseline core damage probability; and * The conditional core damage probabilities

The total increase in seismically-induced risk, CDFSeismic, can be quantified by summing the CDFSE(a) for each bin as follows:

1 CDF =

CDFSE(a) a=.05

Given the assumptions, the total increase in core damage frequency was estimated to be about 2.8 x 10-4 from single and double initiated fires for seismic events ranging from 0.05g to 1.0g.

High Winds, Floods, and Other External Events Attachment 3 The analyst reviewed the licensee's Individual Plant Examination of External Events and determined that no other credible scenarios initiated by high winds, floods, fire, and other external events could initiate a failure of the subject breaker cubicles.

Therefore, the analyst concluded that external events other than fires initiated by the performance deficiency and/or seismic events are not significant contributors to risk for this finding.

Large Early Release Frequency

In accordance with the guidance in NRC Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process," this finding would not involve a significant increase in risk of a large, early release of radiation because Fort Calhoun has a large, dry containment and the dominant sequences contributing to the change in the core damage frequency did not involve either a steam generator tube rupture or an inter-system loss of coolant accident.

Qualitative Considerations of Risk

The analyst noted that several factors that affected the risk of the subject postulated fires were not quantified because practical matters made them significantly more difficult to quantify.

They included the following:

1. Shutdown Risk As documented in Assumptions 33 and 34, the analyst noted that additional risk would be accumulated at the plant following the fires postulated in this analysis.

480 Vac loads at Fort Calhoun Station include component cooling water, containment spray, spent fuel pool cooling and other support systems necessary for maintaining the reactor and/or spent fuel pool cool during shutdown conditions.

The long-lasting effects of a major fire continue to impact plant operations and require additional operator actions throughout the shutdown period while the bus or buses are being repaired.

Additionally, a loss of shutdown cooling during critical shutdown conditions as a result of a postulated fire would cause significant increase in the instantaneous risk of the shutdown reactor.

The analyst determined that these impacts were too numerous to individually identify and the current shutdown risk tools do not lend themselves to assess the impacts quantitatively.

However, the analyst noted that these risks should be considered in making a risk-informed decision.

To estimate the impact of this risk, the analyst evaluated the impact of loss of component cooling water pumps from postulated 480 volt bus fires.

The following assumptions were made:

Attachment 3 a. The impact on Component Cooling Water would be 98 days.

This was based on the bus fire occurring on June 7 and the licensee declaring the remaining buses inoperable on September 13. b. The results from the San Onofre Shutdown SPAR model were good enough to approximate this risk, given that the vast majority of risk impact was the result of human error and not additional equipment failures. c. Each postulated fire scenario that affected one or more component cooling water pumps were quantified.

The estimated incremental conditional core damage probability was 6.9 x 10-5.

The analyst determined that this value was not accurate enough to meet the quantitative requirements of the significance determination process.

However, the actual probability would be added to the final risk determination were it known accurately.

This indicates that shutdown risk during the repair time following a postulated fire would be significant with respect to the subject finding.

2. Seismic Risk from 3 or More Postulated Fires

As documented in Assumption 32, failures of more than two breaker cradles following a seismic event are possible.

However, the evaluation of the risk for these scenarios would become prohibitive based on the large number of scenarios that would be possible and would not be expected to contribute significantly to the overall risk.

The analyst noted that the addition of multiple fire scenarios can add combinations that result in conditional core damage probabilities of 1.0, losses of residual heat removal at shutdown, complete losses of spent fuel pool cooling, as well as failures of all higher pressure injection capability.

As stated above, the analyst determined that these impacts were too numerous and prohibitive to individually evaluate quantitatively.

However, the analyst noted that these risks should be considered in making a risk-informed decision.

To better understand the risk of this contributor, the analyst evaluated the range of risk impact for a seismic event causing three breaker cubicle fires.

The analyst utilized the modified SPAR model to determine the risk of fires involving Buses 1B3A, 1B3B, and 1B3C-4C.

This was considered to be the lowest possible risk from a combination of 3 fires.

The conditional core damage probability for these fires was 7.27 x 10-2.

The analyst then quantified the conditional core damage probability for postulated fires in Buses 1B4A, 1B3B, and 1B3C-4C.

This combination resulting in the highest possible risk was quantified as 1.0. The analyst then performed a seismic evaluation assuming that all fires evaluated resulted in the conditional core damage probabilities listed above.

This resulted in a range of 3.4 x 10-5 to 4.7 x 10-4.

The analyst Attachment 3 noted that neither the low end nor the high could be the result, but only that the result would lay somewhere between the two.

This risk would be additive to the best estimate value indicating that the risk from a seismic event causing three or more breaker cubicle failures would be significant with respect to the subject finding.

3. Risk to Fuel in the Spent Fuel Pool

As documented in Assumption 35, the 480 Vac system at Fort Calhoun Station supports the cooling of the spent fuel pool.

As a result, the subject performance deficiency impacts the risk of core damage in the spent fuel pool.

As few as two postulated fires could result in the complete loss of plant process equipment designed to cool the spent fuel pool.

The current risk tools available to the analyst do not lend themselves to assess the impacts of a loss of spent fuel pool cooling quantitatively.

However, the analyst noted that these risks should be considered in making a risk-informed decision.

The analyst noted that the risk to the spent fuel pool would be substantially less than that for the shutdown reactor.

This is primarily because of the capability to feed and bleed the pool and the acceptability of almost any water source.

Therefore, while this risk would be additive, it would not be significant to the subject evaluation.

4. Potential Loss of Control Power

As stated in Assumption 37, for some fire scenarios, a fire in one bus will affect the dc control power for buses in the opposite train.

For example, a fire in Bus 1B3B would likely destroy Manual Transfer Switch 1B3B-4B-MTS.

This switch controls dc power to Buses 1B4A,

1B4B, 1B3B-4B, and 1B4C.

Loss of control power to these buses will, at a minimum, require local manual operation of all the automatic circuit breakers, including feeder breakers and bus-tie breakers.

Also, this failure would likely impact the undervoltage relays on the 480 buses and might impact the indicator functionality.

As a result, manual operations of all breakers would be required for operator responses, increasing the risk associated with the finding.

The analyst noted that the current SPAR model does not include individual switches and load breakers, nor does it map the effects of dc control power.

There is additional risk resulting from the extra work load on operators responding to the postulated events that was not calculated in this evaluation.

However, the analyst noted that these risks should be considered in making a risk-informed decision.

To better understand the potential impact of this factor, the analyst reran the worst case fire scenario using twice the nonrecovery terms.

The increase in risk was less than twice the original conditional core damage Attachment 3 probability.

Therefore, while this risk would be additive, it would not be significant to the subject evaluation.

5. Calculation of Breaker Cubicle Failure Rate As stated in Assumption 36, the failure frequency was calculated as a straight-line rate for the subject breaker cubicles.

However, the actual failure frequency was most likely some form of an exponential curve.

As such, the failure frequency for the last few months of the exposure period would have been higher than the average failure frequency as calculated.

The quantified risk is proportional to the failure rate.

Therefore, the risk is likely higher and may be substantially higher than quantified.

Because the actual slope of the failure rate curve is unknown, the additional risk resulting from the approximated failure rate could not be quantified.

However, the analyst noted that these risks should be considered in making a risk-informed decision.

To better understand the risk of this contributor, the analyst evaluated the result given a failure rate that was twice the calculated rate with 1/4 the total exposure time.

The resulting total incremental conditional core damage probability was 3.4 x 10-4.

Being 3 times the best estimate value for independent fires, this indicated that, if the failure frequency could be quantified as a decaying rate, the results would be significant with respect to the subject finding.

Sensitivities

The analyst performed a sensitivity study for two of the dominant assumptions in this evaluation.

The following assessments were conducted:

1. Assumptions 30 and 31 indicate that the subject performance deficiency could be affected by seismic activity and an approximate seismic fragility at which a breaker cradle would fail.

The analyst reevaluated the risk given the following three changes to these assumptions:

a. Breaker cradles would fail with a fragility similar to the generic functional failure of electrical components from chatter (approximately 1.0g pga); b. Breaker cradles would not fail from a seismic event; and c. Breaker cradles would fail upon a seismically-induced loss of coolant accident.

2. Assumptions 22 and 23 indicate that two independent fires could occur at times close enough to impact the risk of the at-power plant.

The fundamental assumption provided that the frequency of these fires would Attachment 3 be evaluated over a 56-hour period.

The analyst reevaluated the risk of these two fire scenarios given a 24-hour period and a 72-hour period.

The results of this sensitivity analysis are provided in Table 14.

Table 14Results of Sensitivity Studies Change Evaluated Incremental Conditional Core Damage Probability Independent Fire Seismic Total

Best Estimate Seismic Analysis 1.1 x 10-4 2.7 x 10-4 3.8 x 10-4 Nominal Chatter Functional Failure

6.1 x 10-5 1.7 x 10-4 No Seismic Failure

0.0 1.1 x 10-4 Failure upon Seismic LOOP

8.1 x 10-4 9.2 x 10-4 Two fires in 56 hours6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> (Best Estimate) 1.1 x 10-4

3.8 x 10-4 Two fires in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 6.2 x 10-5

3.3 x 10-4 Two fires in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 1.5 x 10-4

4.2 x 10-4 Highest Combination 1.5 x 10-4 8.1 x 10-4 9.6 x 10-4 Lowest Combination 6.2 x 10-5 0.0 6.2 x 10-5

Conclusions

The senior reactor analyst completed a Phase 3 analysis using the plant-specific Standardized Plant Analysis Risk Model for Fort Calhoun, Revision 8.15, the licensee's Individual Plant Examination of External Events, and hand calculations.

The exposure period of 1 year represented the maximum exposure time allowable in the significance determination process.

The analyst estimated the initiating event likelihood for a single fire of 7.0 x 10-2/year.

The analysis covered the risk affected by the performance deficiency for postulated fires of any of the nine normally-closed breakers including the potential for two independent fire initiators.

The resulting change in core damage frequency (CDF) was 1.1 x 10-4.

Additionally, seismically-induced fires were postulated based on the characteristics of the performance deficiency.

The quantified CDF for seismically-induced fires was 2.7 x 10-4.

Finally, the analyst determined that the finding did not involve a significant increase in the risk of a large, early release of radiation.

The final result was calculated to be 4 x 10-4 indicating that the finding was of high safety significance (Red).

The analyst performed sensitivity studies indicating that only the most negative combination of assumption changes provided a value in the Yellow region.

95.7 percent of the risk range from these sensitivities was in the Red region.

Additionally, qualitative considerations suggest that the actual risk is higher than this calculated value, and could be Red of their own right if properly quantified. Licensee's Proposed Modeling Assumptions Attachment 3 To facilitate better communications on this evaluation, the licensee provided the analyst with a set of proposed modeling assumptions (draft) dated November 14, 2011.

The analyst reviewed the licensee's assumptions to ensure that appropriate treatment was considered.

The following addresses each of the licensee's draft assumptions and how they were dispositioned:

1. Licensee personnel assumed that potential breaker fire consequences should be modeled for the nine normally-closed 480V breakers that were modified in 2009.

The analysts agreed.

This is documented in Assumptions 7 and 12.

2. Licensee personnel reserved the right to challenge the fire frequency.

They stated that not just Fort Calhoun, but any applicable industry data should be used.

The analysts agreed.

However, neither the licensee nor the NRC

analysts have found any additional data.

Additionally, the frequency is probably not linear, so the analysts could potentially justify an even higher failure rate for the year assessed.

Licensee personnel informed the analysts on January 12, 2012, that they were unable to identify additional data applicable to this finding.

3. Licensee personnel assumed that the exposure time should be 1 year and evaluated for at-power operation.

The analysts agreed.

This is documented in Assumptions 5, 8 and 9.

4. Licensee personnel stated that the total mission time should be 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This is opposed to our Assumptions 22 and 23.

The NRC analysts disagree.

While 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is a classical mission time and was used for the actual fire response equipment mission time, Assumption 23 clearly states that the 56 hour6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> vulnerability time is used in an attempt to better quantify the common cause failure probability.

The licensee did not suggest a different method for applying common cause.

However, the team clearly determined that common cause factors existed because of the performance deficiency, and these factors needed to be quantified using the best available methods.

5. Licensee personnel assumed that postulated fires of the bus main breaker or bus-tie breaker would result in failure of the adjacent bus or buses.

Also, a 480 Vac main bus breaker fire adjacent to a normally-

open bus tie breaker was assumed to induce a fault on the island-bus side of the normally-open bus tie breaker and induce a trip of the opposite main bus breaker.

Attachment 3 The NRC analysts agreed with the licensee's definitions of which buses would fail and which would be tripped, as documented in Assumptions 12 through 15.

However, the licensee analysts assumed that cross-tie capability could be used to restore buses to power.

The NRC analysts noted that conditions would not permit operators to simply close a breaker following tripping it to extinguish a fire.

Therefore, the probability of having a bus available is much lower than nominal.

Additionally, the analyst determined that most of the core damage sequences included a loss of opposite train power.

Given a loss of power on the opposite train, power cannot be restored to the switchgear by cross tying the buses.

During a January 12, 2012 phone call with the licensee's PRA group, they stated that their modeling the cross-tie capability did not significantly decrease the calculated risk of this finding.

Therefore, the analysts' concern was alleviated, and the NRC did not model the bus cross-ties.

6. Licensee personnel assumed that, following a postulated fire: a. The block valves would be closed b. The reactor would be manually tripped

c. The associated 4160 Vac buses would be de-energized

Licensee personnel stated that individual supply breakers may or may not be tripped and that load breakers would not be tripped.

The analysts agreed.

This is documented in Assumptions 18, 20 and 21.

7. Licensee personnel assumed that a 480 Vac island-bus fault will trip the 480 Vac main bus breaker that is feeding the island bus.

The analysts agreed.

This is documented in Assumption 11.

8. Licensee personnel stated that operator actions to minimize loads would be ineffective for the dc bus in the same room as the postulated fire.

NOTE:

FCS vital batteries will last 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> without minimizing dc loads.

The first step will increase battery life to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The second step will increase battery life to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

The NRC analysts agreed with the licensee's assumption, as documented in Assumption 38.

However, the analysts also assumed that, the Halon in the opposite train switchgear room would make load minimization ineffective for the opposite train dc bus.

On December 16, 2011, the NRC inspectors walked down the dc load minimization procedure.

The major loads were required to be stripped within 15 minutes; however, most of these breakers are inside the fire area and/or an area filled with Halon.

The inspectors noted that, during the actual fire, plant personnel (other than fire brigade) did not enter these Attachment 3 rooms for over 2-1/2 hours.

Therefore, the analyst did not give credit for minimizing dc loads, and assumed that the vital batteries would deplete in 2.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

During a January 12, 2012 phone call with the licensee's PRA group, the licensee stated that they gave credit for minimization of dc loads on the opposite train on all single fire scenarios and gave credit for minimizing loads for all two fire scenarios if the second fire was more than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the first.

The NRC analysts disagreed with this approach.

It is not clear that the operators would minimize dc loads on the dc train that was unaffected by the fire because that train would continue to be supplied by a battery charger.

Additionally, after the first fire was extinguished, there is a strong possibility that nonvital loads would be reapplied to the unaffected train.

These loads included plant lighting and turbine-generator auxiliaries.

Following the fire on June 7, 2011, operators did not minimize dc loads because they considered the area too hazardous for personnel entry.

9. License personnel made the following assumptions regarding recovery:

a. Local reset of tripped breakers only applies to the twelve 480 Vac supply breakers upon breaker trip due to fault.

The analysts agreed.

No penalty was modeled for other breakers. b. Re-energization of manually de-energized 4160 Vac bus and associated 4160 and/or 480 Vac loads can be performed from the main control room.

The analysts agreed.

The nonrecovery values for the 4160 Vac buses reflect the better ability to re-energize these buses.

Additionally, no penalty was modeled for the failure to energize any bus loads, once the primary bus was energized. c. Energizing a 480 Vac bus from the opposite side through the island bus can be done from the main control room.

The analysts agreed.

However, most core damage scenarios include a failure of the opposite train of power.

Therefore, energizing a bus from the opposite side would likely be reflected in a success sequence. d. Bus 1B3C can be energized via 13.8 kV Transformer T1B-3C-1.

On December 15, 2011, the analyst walked down the procedure for energizing Bus 1B3C via 13.8 kV Transformer T1B-3C-1.

The analyst noted that most of the steps in the procedure required access to the east switchgear room and one step required opening a fire barrier Attachment 3 door between the east and west switchgear rooms.

Following a postulated fire, one room would be filled with smoke while the other was filled with Halon.

Therefore, the analyst determined that this procedure could not be performed before battery depletion.

Additionally, the analyst noted that postulated fires in Buses 1B3C, 1B3C-4C, and 1B4C would prevent the performance of this procedure at any time following the fire and that the 13.8 kV supply would not survive seismic event.

During a January 12, 2012 phone call with the licensee's PRA group, the licensee stated that their dependency review indicated that this recovery was likely to be superseded by the recovery discussed under Item e.

Therefore, they chose not to credit this recovery. e. Steam Generator level indication will be available via the Distributed Control System following battery depletion.

The analyst observed a simulator run that resulted in a station blackout with battery depletion.

The operators noted that the steam generator level indication, powered by the 13.8 kV system did not appear to provide valid level indication.

The licensee has not responded yet on this issue.

However, the analyst determined that the availability of this indication was not relevant, given the credit provided for the use of portable steam generator level indication following battery depletion discussed under Section f. f. Use of portable steam generator level indication is available.

The analysts agreed.

The analyst walked down the procedure for determining steam generator level following battery depletion.

While the communications aspects were somewhat awkward, the analyst determined that the procedure was sound and could provide adequate level indication.

The availability of level indication was a necessary condition for the recovery documented under "Adjustments to SPAR."

10. Licensee personnel stated that they did not believe that the breaker/cradle assemblies would fail during a seismic event.

The NRC analysts disagreed.

The inspectors noted that the root-cause analysis for the June, 2011 event stated that the fire resulted from insufficient cradle connections to the silver plated areas of the copper bus bar stabs, and the presence of hardened grease resulting in high-resistance connections.

The licensee provided an analysis indicating that the breaker/cradle assembly was seismically qualified.

However, the original evaluation and testing was performed with properly plated stabs and proper cradle connections to the bus bars.

This evaluation was not Attachment 3 clearly applicable to the condition of the cradles following the performance deficiency.

Additionally, the vendors disagreed with the conclusions in the licensee's root-cause.

The vendors concluded that the fire likely started in the bus compartment area, which contained bolted connections and welded bus bars, and not the breaker compartment.

The bus compartment area had not been opened, inspected, or cleaned in at least 30 years.

Bolted connections, hardened grease, and housekeeping issues are all items that make a switchgear more susceptible to seismic events.

11. On a phone call, licensee PRA group representatives stated that one reason their Assumption 9.e was important was that the availability of steam generator level indication allowed them to take credit for Turbine-Driven Auxiliary Feedwater Pump 10 continuing to run after vital battery depletion.

The NRC analyst stated that the SPAR rules which apply to the significance determination process assume that plants go to core damage following vital battery depletion.

As discussed under "Adjustments to the SPAR," credit was given to Diesel-Driven Auxiliary Feedwater Pump 54 after vital battery depletion because of the unique configuration of that pump at Fort Calhoun.

However, the analyst noted the following reasons for not crediting Turbine-Driven Auxiliary Feedwater Pump 10 under similar conditions:

1. There is a lot of dependence between using the turbine-driven auxiliary feedwater pump and the diesel-driven pump for use in station blackout following battery depletion

2. Given credit for the turbine-driven auxiliary feedwater pump would be in conflict with the SPAR rules.

Neither the NRC nor Idaho National Laboratories gives credit for turbine-driven pumps after battery depletion in the significance determination process.

As such, all plant SPAR models indicate that the reactor will proceed to core damage upon vital battery depletion.

Here is a listing of some of the documented reasons for this rule: a. No room cooling would be available b. No cooling would be available to the seal condenser c. No pressure indication would be available d. Difficulty relaying level indication to operators of pump controls e. Controls are in high temperature/low light area f. Flow path difficult to control with air-operated valves

g. No capability of "black" operation for venting containment h. Fort Calhoun has small emergency feedwater tank

ELECTRIFigure 1: SimFigure 2: SimA4-1 AttATTACHMENT 4

ICAL DISTRIBUTION DIAGRAMS plified 480 Vac Distribution Diagram plified 125 Vdc Distribution Diagram tachment 4

Attachment 5 ATTACHMENT 5

Fire in 1B4A "Extent of Condition" Digital Low Resistance Ohmmeter Readings

1B3A Supply Breaker Phase As Found Resistance A 114.1 micro ohms B 127.1 micro ohms C 139.1 micro ohms

1B3A Bus-Tie Breaker Phase As Found Resistance A 177 micro ohms B 211 micro ohms C 146 micro ohms

1B3B Supply Breaker Phase As Found Resistance A 764 micro ohms B 835 micro ohms C 399 micro ohms

1B3B Bus-Tie Breaker Phase As Found Resistance A 61.9 micro ohms B 79.0 micro ohms C 74.2 micro ohms

1B3C Supply Breaker Phase As Found Resistance A 316 micro ohms B 109 micro ohms C 98 micro ohms

1B3C Bus-Tie Breaker Phase As Found Resistance A 145 micro ohms B 317 micro ohms C 132.7 micro ohms

1B4B Supply Breaker *** Phase As Found Resistance A 384 micro ohms B 236 micro ohms C 249 micro ohms

1B4B Bus-Tie Breaker *** Phase As Found Resistance A 314 micro ohms B 395 micro ohms C 525 micro ohms

1B4C Supply Breaker Phase As Found Resistance A 121.8 micro ohms B 104.5 micro ohms C 95.1 micro ohms

1B4C Bus-Tie Breaker Phase As Found Resistance A 88.3 micro ohms B 96.5 micro ohms C 87.8 micro ohms *** As-found readings not taken directly at bus, but in adjacent cubicle with additional series electrical connections.