IR 05000285/2013017

IR 05000285-13-017, July 8, 2013 Through March 13, 2014, Fort Calhoun Station - Manual Chapter 0350 Inspection Report and Final Significance Determination of White Finding and Notice of Violation

ML14115A411
Person / Time
Site:	Fort Calhoun
Issue date:	04/25/2014
From:	Vegel T Division of Nuclear Materials Safety IV
To:	Cortopassi L P Omaha Public Power District
Hay M
References
EA-13-222 IR-13-017
Download: ML14115A411 (64)

Text

April 25, 2014

EA-13-222 -- -

SUBJECT:

Dear Mr. Cortopassi:

On March 13, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a team inspection at the Fort Calhoun Station. The inspection focused on the the identification, evaluation, and corrective actions associated with providing adequate tornado missile protection for plant structures, systems, and components. The enclosed inspection report presents the results of this inspection. A final exit briefing was conducted with you and other members of your staff on March 14, 2014. The enclosed inspection report discusses one finding that was preliminarily determined to be White, having low to moderate safety significance. This finding involved the failure to provide adequate tornado missile protection for equipment important to safety. The station implemented plant modifications correcting all identified deficiencies. These corrective actions were reviewed by the NRC and found acceptable prior to plant restart that occurred in December of 2013. On March 18, 2014 you informed Mr. Anton Vegel and Mr. Michael Hay of NRC, Region IV, that the Fort Calhoun Station agreed with the low to moderate risk significance (White) characterization of this finding and that you declined an opportunity to discuss this issue in a Regulatory Conference or provide a written response. After considering all available information, the NRC has concluded that the finding is appropriately characterized as White, having low to moderate safety significance. The NRC has also concluded that the failure to adequately protect the facility from tornado generated missiles is a violation of NRC requirements, as cited in the attached Notice of Violation (Notice). The circumstances surrounding this violation are discussed in detail in the enclosed inspection report. In accordance with the NRC Enforcement Policy, the Notice is considered escalated enforcement action because it is associated with a White finding. The NRC has concluded that the information regarding the reason for the violation, the corrective actions implemented to correct the violation and prevent recurrence, and the date when full compliance was achieved was obtained by the NRC during our inspection activities. Therefore, you are not required to respond to this letter unless the description contained in the enclosed report does not accurately reflect your corrective actions or your position. Additionally, since this issue was identified and resolved by the station during the extended shutdown, under increased NRC oversight of the Inspection Manual Chapter 0350 Process, this issue will not be used for future plant performance assessment inputs and is considered closed. There were three NRC identified findings identified during this inspection that were determined to be of very low safety significance (Green), and involved violations of NRC requirements. Additionally, the NRC determined that one traditional enforcement Severity Level IV violation of occurred. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the NRC Enforcement Policy. Although these findings were determined to be of very low safety significance, they are of concern to the NRC because they reflect a continuing pattern of station personnel failing to understand and use design and licensing basis information when evaluating degraded and non-conforming conditions and implementing changes to the facility. The NRC understands the station has long term corrective actions to address these areas and plans to review the effectiveness of the actions during future NRC inspections. Additionally, the NRC looks forward to having discussions on this topic during the next public meeting currently scheduled for May 13, 2014. If you contest these violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Fort Calhoun Station. If you disagree with a cross-cutting aspects assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC Resident Inspector at the Fort Calhoun Station. In accordance with 10 CFR 2.390 of the NRC's Rules of Practice and Procedures, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). - - 1. 2. 1. 2. Task Interface Agreement 2013- 3. Detailed Risk Assessment Regional Administrator (Marc.Dapas@nrc.gov) Deputy Regional Administrator (Steven.Reynolds@nrc.gov) MC0350 Chairman (Anton.Vegel@nrc.gov) MC0350 Vice Chairman (Louise.Lund@nrc.gov) DRP Director (Kriss.Kennedy@nrc.gov) DRP Deputy Director (Troy.Pruett@nrc.gov) Acting DRS Director (Jeff.Clark@nrc.gov) Acting DRS Deputy Director (Geoff.Miller@nrc.gov) Senior Resident Inspector (John.Kirkland@nrc.gov) Resident Inspector (Jacob.Wingebach@nrc.gov) Branch Chief, DRP/F (Michael.Hay@nrc.gov) Project Engineer, DRP/F (Chris.Smith@nrc.gov) FCS Administrative Assistant (Janise.Schwee@nrc.gov) Public Affairs Officer (Victor.Dricks@nrc.gov) Public Affairs Officer (Lara.Uselding@nrc.gov) Branch Chief, DRS/TSB (Ray.Kellar@nrc.gov) Project Manager (Joseph.Sebrosky@nrc.gov) RITS Coordinator (Marisa.Herrera@nrc.gov) ACES (R4Enforcement.Resource@nrc.gov) ACES Senior Enforcement Specialist (Rachel.Browder@nrc.gov) Regional Counsel (Karla.Fuller@nrc.gov) Technical Support Assistant (Loretta.Williams@nrc.gov) Congressional Affairs Officer (Jenny.Weil@nrc.gov) RIV/ETA: OEDO (Joseph.Nick@nrc.gov) MC 0350 Panel Member (Micheal.Markley@nrc.gov) MC 0350 Panel Member (Michael.Balazik@nrc.gov) OE Director (Roy.Zimmerman@nrc.gov) OE/EB Branch Chief (Nick.Hilton@nrc.gov) OE/EB Senior Enforcement Specialist (Gerry.Gulla@nrc.gov) NRR/DIRS/IPAB/IAET Allegations Specialist (Carleen.Sanders@nrc.gov) NRREnforcement.Resource ROPreports File located: R:\_Reactors\2014\_FCS 0350 IR 050002852013017.pdf SUNSI Rev Compl. Yes No ADAMS Yes No Reviewer Initials MCH Publicly Avail Yes No Sensitive Yes No MCH SRI:DRP/C BC:DRP/F C:ORA/ACES SRA DD:DNMS JJosey MHay RBrowder DLoveless AVegel /RA/ /RA/ /RA/ /RA/ /RA/ 4/10/14 4/16/14 4/15/14 4/16/14 4/25/14 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax Enclosure 1 Omaha Public Power District (OPPD) Docket No. 50-285 Fort Calhoun Station License No. DPR-40 EA-2013-222 During a U.S. Nuclear Regulatory Commission (NRC) inspection conducted from July 8 through March 13, 2014, a violation of NRC requirements was identified. In accordance with the NRC Enforcement Policy, the violation is listed below: 10 CFR Part 50, Appendix B, Criterion measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into Contrary to the above, from initial construction through July 2013, measures established by the licensee failed to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which 10 CFR 50, Appendix B, applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to fully incorporate applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition. The NRC has concluded that information regarding the reason for the violation, the corrective actions taken and planned to correct the violation and prevent recurrence, and the date when full compliance will be achieved was obtained by the NRC during our inspection activities and discussed in the enclosed report. However, you are required to submit a written statement or explanation pursuant to 10 CFR 2.201 if the description therein does not accurately reflect your corrective actions or your position. In that case, or if you choose to respond, clearly mark your response as a "Reply to a Notice of Violation," include the EA number, and send it to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional Administrator, Region IV, and a copy to the NRC Resident Inspector at the Fort Calhoun facility, within 30 days of the date of the letter transmitting this Notice of Violation (Notice). If you choose to respond, your response will be made available electronically for public accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. Therefore, to the extent possible, the response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). Dated this 25th day of April 2014. Enclosure 2 - White and three-Additionally, one traditional enforcement Severity Level IV violation was identified. - - A. NRC-Identified Findings and Self-Revealing Findings Cornerstone: Mitigating Systems White. The team identified multiple examples of a violation of 10 CFR 50, Appendix B, Criterion III, failure to establish applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition. Specific examples included the steam driven auxiliary feedwater pump exhaust stack, auxiliary feedwater components located in Room 81, raw water pump electrical pull boxes PB-128T and PB-129T, and diesel generator fuel oil storage tank fill and vent lines. The licensee implemented plant modifications to adequately protect all affected equipment from tornado generated missiles and entered the deficiencies into its corrective action program for resolution as Condition Reports CR 2013-03839, 2013-03842, 2013-14117, and 2013-14246. The failure to ensure that station components were adequately protected from tornado missiles was a performance deficiency. In accordance with NRC performance deficiency was determined to be more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the finding affected the reliability of required components following a postulated tornado-generated missile impact. The team evaluated the finding using Inspection Manual Chapter ion Process (SDP) for Findings athe lack of equipment specifically designed to mitigate a severe weather initiating event (tornado) and could have degraded two or more trains of a multi-train system. The Region IV senior reactor analyst performed a detailed risk evaluation in concluded the finding was characterized as having low to moderate safety significance (White). The calculated change in core damage frequency of 2.6 x 10-6 was dominated by a tornado-induced non-recoverable loss of offsite power with the failure of the emergency power supply system. The analyst determined that the finding did not affect the internal events initiator risk and would not involve a significant increase in the risk of a large early release of radiation. The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c)(Section 4OA4.1). Green. The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion failure to promptly identify and correct a condition adverse to quality. Specifically, from August 2005 to July 15, 2013 the licensee failed to promptly identify and correct inadequate Class 1 structures wall thickness deficiencies to protect systems and components contained within from tornado generated missiles. The licensee resolved this issue by implementing changes to the facility through a licensing amendment that was reviewed and approved by the NRC. This issue has been entered into the corrective action program as Condition Report CR 2013-14363. verse to quality was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Inspection Manual Chapter 0609, Appendix rmination Process for Findings at he finding was determined to have very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; (4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-e program; and (5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. The team determined this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component involving the failure to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action. Specifically, in 2005 the licensee identified that wall thicknesses for areas of the auxiliary building and intake structure were less than design requirements. The licensee failed to enter this deficiency into the corrective action process and inappropriately used an alternate acceptance criteria that was not part of the facility licensing basis H.1(b)(Section 4OA4.2). Green. The inspectors identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion ure to follow Station Procedure NOD-QP-erability Determination Process, when evaluating deficiencies associated with inadequate tornado missile protection for required components. Specifically, Step of why the concern identified does not prevent the item from fulfilling its intended safety function. In each example, the team identified that the operability determination lacked adequate technical justification for why the item was operable with the degraded or nonconforming condition. The licensee addressed these issues by taking corrective actions that provided adequate tornado missile protection in accordance with design basis requirements. The licensee entered this deficiency into its corrective action program for resolution as Condition Reports CR 2013-15429 and 2013-14006. The failure to properly assess and document the basis for operability when a degraded or nonconforming condition was identified was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involving inadequate operability determinations occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system inventory, the finding did not system inventory wability to recover decay heat removal once it was lost. This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision making when performing operability determinations H.1(b)(Section 4OA4.3). Green. The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion to provide adequate instructions or procedures for the construction of temporary barriers to protect raw water pump electrical pull boxes PB-128T and PB-129T from tornado generated missiles in temporary modification EC 60183. The licensee addressed this issue by modifying the temporary barriers. This issue has been entered into the corrective action program as Condition Report CR 2013-13955. The failure to provide adequate instructions for construction of temporary barriers to protect the raw water pump electrical pull boxes from tornado generated missiles was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involving inadequate operability determinations occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix G, finding to have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system inventory, the finding coolant system inventory when needed, and the finding did not degrade the a cross-cutting aspect in the area of human performance associated with the work practices component because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c)(Section 4OA4.4). Other Findings SL-IV. The team identified three examples of a non-cited violation of 10 CFR failure to adequately evaluate changes to determine if prior NRC approval is required. Specifically, from April 19, 2011, through August 17, 2012, the licensee failed to obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in a departure from a method of evaluation described in the Updated Safety Analysis Report. The licensee addressed these issues by submitting a license amendment which was reviewed and approved by the NRC. This issue has been entered into the corrective action program as Condition Reports CR 2013-03839, 2013-04266, 2013-05210, 2013-14363, and 2013-14665. CFR 50.59 and adequately evaluate changes to requirements for tornado missile protection described in the Updated Safety Analysis Report was a performance deficiency. Because this ability to perform its regulatory function, the team evaluated the performance deficiency using traditional enforcement. In accordance with Section 2.1.3.E.6 of the NRC Enforcement Manual, the team evaluated this finding using the significance determination process to assess its significance. Using Inspection Manual Chapter 0609, Appendix Findings At- determined to have very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; (4) did not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-(5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. Therefore, in accordance with Section 6.1.d.2 of the NRC Enforcement Policy, the team characterized this performance deficiency as a Severity Level IV violation. The team determined that a cross-cutting aspect was not applicable to this performance deficiency because the failure to adequately evaluate changes in accordance with 10 CFR 50.59 was strictly associated with a traditional enforcement violation (Section 4OA4.5). The inspection team continued the NRC Inspection Manual Chapter 0350 inspection activities, which included follow-up on the Restart Checklist contained in Confirmatory Action Letter (CAL) EA-13-020 issued February 26, 2013. The purpose of this inspection was to perform an assessment of the causes of the performance decline at the Fort Calhoun Station (FCS), to assess whether planned corrective actions are sufficient to address the root causes and contributing causes and to prevent their recurrence, and to verify that adequate qualitative or quantitative measures for determining the effectiveness of the corrective actions are in place. These assessments were used by the NRC to independently verify that plant personnel, equipment, and processes were ready to support the safe restart and continued safe operation of the Fort Calhoun Station that occurred in December of 2013. The team used the criteria described in baseline and supplemental inspection procedures, various programmatic NRC inspection procedures, and Inspection Manual Chapter progress in implementing its performance improvement initiatives. The team performed on-site and in-office activities, which are described in more detail in the following sections of this report. This report covers inspection activities from July 8, 2013, through March 14, 2014. Specific documents reviewed during this inspection are listed in the attachment. Assessment of NRC Inspection Procedure 95003 Key Attributes Section 5 of the restart checklist assessed the key attributes of NRC Inspection Procedure 95003. The key attributes are listed as separate subsections below. In addition, the NRC reviewed the effectiveness of licensee short term and long term corrective actions associated with these areas to ensure they were adequate to support sustained plant performance improvement. Item 5.a: Design (1) a. The team independently assessed the extent of risk significant design issues associated with the protection of multiple essential structures, systems, and components from tornado generated missiles. This review verified the capability of these structures, systems, and components to perform their intended functions with a sufficient margin of safety. The inspection focused on licensee controls for implementing changes to the facilities licensing and design basis. Information from ate the facility in accordance with the design basis. (CL Item 5.a.1) Assessment of effectiveness of corrective actions for deficiencies involving tornado missile protection design requirements. Evaluation of the interfaces between engineering, plant operations, maintenance, and plant support groups while resolving tornado missile protection design deficiencies. b. Open items (Licensee Event Reports), specifically related to the tornado missile issue, were reviewed by the team. The team verified causal analysis and extent of condition evaluations. In addition, the team verified and contributing causes and extent of condition evaluations, and that, implementation of these corrective actions are either implemented or appropriately scheduled for implementation. (2) a. --- - The inspectors reviewed the licensee actions to address the 37 identified components that were not adequately protected from tornado missiles. elected to change the facilities design and licensing basis and adopt the requirements of Regulatory Guide 1.76 (RG 1.76), Design- 1, as the method for restoring compliance. The licensee also began iRegulatory Guide 1.76. The licensee performed two separate 10 CFR 50.59 evaluations to incorporate the use of Regulatory Guide 1.76 into the facilities current licensing basis. The team, in consultation with the Office of Nuclear Reactor Regulation, determined that b NCV 05000285/2013017-05, Change in Method of Evaluation Following the determination that the 10 CFR 50.59 evaluations did not establish a basis to change the facilities current licensing basis without prior NRC approval, the licensee generated an operability evaluation to allow the use of Regulatory Guide 1.76. The team, in consultation with the Office of Nuclear Reactor Regulation, determined that this operability evaluation was not adequate. This issue is of this report and is documented as: NCV 05000285/2013017- During the NRC support from NRC headquarters experts was obtained. The 10 CFR 50.59 evaluations and the subsequent operability determination did not support the use of Regulatory Guide 1.76 without prior NRC approval was documented as Task Interface Agreement 2013-Agreement Concurrence on Fort Calhoun Tornado Missile Protection Licensing Basis (TIA 2013-07). This document is provided as Attachment 2 of this report. The licensee subsequently submitted an exigent amendment request to incorporate the use of Regulatory Guide 1.76 into the facilities design and licensing basis. This exigent amendment request was reviewed and approved by the NRC on July 26, 2013. NCV 05000285/2013017-Against Tornado Generated Missiles NCV 05000285/2013017-03 b. The NRC condition associated with Licensee Event Reports 2013-005-Control Room HVAC Modification Not Properly Evaluated-009, In addition, the team verified that adequate corrective actions were identified associated with the causes and extent of condition evaluations and that implementation of these corrective actions were either implemented or appropriately scheduled for implementation. (3) a. The NRC independent assessment to validate that all potentially susceptible components had been identified. Based on these reviews, the team determined that the licensee had adequately identified all susceptible components in their extent of condition review. The team also reviewed the modifications installed by the licensee and concluded that, for the most part, the modifications were adequate. However, the team identified that the temporary modification installed for the raw water pump pull boxes was inadequate. The licensee captured this in the corrective action program and redesigned the installed temporary modification so that it provided adequate protection. b. Licensee Event Reports 2013-005-Control Room HVAC Modification Not Properly Evaluated-009, is closed. (4) (1) Failure to Ensure Tornado Missile Protection for Site Components Introduction. The team identified multiple examples of a White violation of 10 CFR Part 50, Appendix B, Criterion III, licensee fully incorporate applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition. Description. During the extended shutdown and associated recovery activities the licensee contracted a vendor to perform a design evaluation of the auxiliary the concerns identified by the assessment, was documented in Condition Report CR 2012-4470. During the teamidentified concerns with regard to tornado missile protection. Specifically, the vendor questioned whether the auxiliary feedwater components in Room 81 had been analyzed to show protection from tornado generated missiles with respect to plastic blowout panels in the roof, and whether the exhaust stack for the turbine driven auxiliary feedwater (AFW) Pump FW-10 was adequately protected for tornado Attachment - report. For the auxiliary feedwater components in Room 81, the licensee described its basis for not requiring tornado missile protection to be the reliance upon External Events (IPEEE), and for the exhaust stack for the turbine driven auxiliary feedwater pump, the licensee cited Station Calculation Hazard for FW- Both of these responses were based on the low probability of a missile impacting the components of interest. for the identified components. The team reviewed the facilities Updated Safety Analysis Report and noted that Appendix G specified that the licensee complied with Draft General Design Criteria GDC-2, published July 11, 1967. Draft General Design Criteria GDC-2 requires that the systems and components needed for accident mitigation remain fully functional before, during, and after a tornado event. The team reviewed Section 5.8.2 of the Updated Safety Analysis Report, which describes that design basis for tornado generated missiles was for protection of the facility during a severe accident and to ensure safe shutdown and isolation of the reactor. Finally, Section 5.11 of the Updated Safety Analysis Report describes that Class 1 structures were also designed to withstand the spectrum of tornado generated missiles, listed in Section 5.8.2.2. Based on this information the team determined that the Updated Safety Analysis Report did not incorporate probabilistic methodologies as part of the licensing basis for the Fort Calhoun Station. The team reviewed the pertinent sections of the stations IPEEE and Calculation EA06-006. The team determined that had been performed in accordance with Generic Letter 88-Events (IPEEE) for Severe Accident Vulnerabilities 4. The IPEEE was a probabilistic evaluation with a stated purpose of: developing an appreciation of severe accident behavior; understanding the most likely severe accident sequences that could occur at the plant under full power operating conditions; gaining a qualitative understanding of the overall likelihood of core damage and radioactive material release; and reducing, if necessary, the overall likelihood of core damage and radioactive material release by modifying hardware and procedures that would help prevent or mitigate severe accidents. the team determined that the IPEEE was to be used as a tool for systematically searching for and identifying vulnerabilities associated with external events. These vulnerabilities were to be reviewed to determine whether changes were needed to be made to the facility. Therefore, the protecting components in Room 81 was not appropriate. The team noted that a similar issue had been evaluated under Task Interface Agreement 2011-011, - Task Interface Agreement (TIA) Evaluation of Point Beach Nuclear Plant Tornado Missile Protection Licensing Basis (TIA 2011-dated August 16, 2011, (ML11228A257). It had been determined that non-licensing basis documentation, and judgments of low probability to demonstrate compliance with the licensing basis, are not acceptable without submitting the respective material for NRC staff review and inclusion in the Updated Safety Analysis Report. With respect to Station Calculation FC06081, the team determined that this calculation had been developed using non-licensing basis information and used probabilistic methodologies. Specifically, the licensee used information from NUREG-Nuclear Power Plants: -Basis Tornado and Tornado Missiles for Nuclear Power Plants, Revision 1, to deviate from the stations licensing basis for tornado wind speed and postulated missiles. This information was then used to develop the probability of a missile striking the exhaust stack of the turbine driven auxiliary feedwater pump. The team noted that Regulatory Issue Summary (RIS) 2008- contained information that was applicable to this issue. The team determined that while the main focus of this regulatory issue summary dealt with the use of TORMIS, applicable to the turbine driven auxiliary feedwater pump issue. Specifically, this section specified that TORMIS was not a risk informed approach, but goes on to state: A licensee may submit a license amendment application proposing other means for modifying the current licensing basis for tornado missile protection. Such an application could utilize a risk-informed change process consistent with the guidelines of Regulatory Guide Probabilistic Risk Assessment in Risk-Informed Decision on Plant-Specific amendment to revise plant technical specifications, associated with tornado missile features, in accordance with Regulatory Guide Plant-Specific Risk-Informed Decision Making: issued August 1998. If a risk-informed process was proposed, it would have to meet the five key principles of risk informed regulation called out in Regulatory Guide 1.174, including the need for possible exemptions to the regulations or GDC requirements. Sufficient probabilistic risk assessment quality with respect to modeling of tornado initiators would have to be demonstrated. A topical report consistent with the above guidelines could be submitted for NRC staff review. Based on this, the team determined that the licensee had not received a license amendment to use the probabilistic methodology employed in Station Calculation FC06081. Therefore, the team concluded that the use of non-licensing basis documentation, and judgments of low probability to demonstrate compliance with the licensing basis, were not acceptable without submitting this material for NRC staff review and approval. The team informed the licensee of its concerns and the licensee initiated Condition Reports CR 2013-03839, 2013-03842, 2013-14117, and 2013-14246 to address these issues. Subsequent extent of condition reviews by the licensee identified additional components that were inadequately tornado missile protected. Specifically, 37-unprotected components were identified. They identified components included emergency diesel generator fuel oil supplies, auxiliary feedwater pumps, raw water system cabling and components, the intake structure sluice gates, the main steam relief valve stacks, control room HVAC condensers, the boric acid storage tank, and the emergency feedwater storage tank. The licensee applied for an exigent license amendment and implemented facility modifications to protect the identified components. Analysis. protected from tornado missiles was a performance deficiency. In accordance with performance deficiency was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency affected the reliability of multiple systems following a postulated tornado-generated missile impact. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, ion Process (SDP) For Findings aevaluation because it involved the lack of equipment specifically designed to mitigate a severe weather initiating event (tornado), and could have degraded two or more trains of a multi-train system. The Region IV senior reactor analyst made the following influential assumptions in assessing the risk of the subject performance deficiency: Selection of Tornado Hazard Use of Missile Impact Parameter Method Population of Potential Missiles Selection of Tornado Intensity Loss of Offsite Power Failure of Condensate Storage Tank Selection of Relative Target Size There were three dominant accident sequence cutsets associated with this performance deficiency. All involved a non-recoverable loss of offsite power. In order of significance, these sequences are: 1. Loss of all auxiliary feedwater and failure of once-through cooling; 2. Loss of the emergency power system with failure to recover a diesel generator prior to battery depletion; and 3. Loss of Diesel Generator 1 from tornado missile impact and random loss of Diesel Generator 2 with failure to recover prior to battery depletion. The total change in core damage frequency is 2.6 x 10-6 (WHITE). This finding did not involve a significant increase in the risk of a large, early release of radiation, because Fort Calhoun Station has a large, dry containment. The significance of this finding is considered to be core damage frequency-dominant. The detailed risk evaluation is documented in Attachment 3 to this inspection report. The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c). Enforcement. Title 10 CFR Part 50, Appendix B, Criterion regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and from initial construction through July 2013, measures established by the licensee failed to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, the licensee failed to fully incorporate applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition. The licensee addressed this deficiency by implementing plant modifications that protected the affected equipment from tornado generated missiles. This finding is associated with a Notice of Violation attached to this report: VIO 05000285/2013017-01, (2) Failure to Promptly Identify and Correct a Condition Adverse to Quality Introduction. The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion to promptly identify and correct a condition adverse to quality associated with Class I structures. Description. During the teams review of the stations USAR, they determined that USAR, Section 5.11, required that the facilities Class I structures be designed to withstand the spectrum of tornado generated missiles, the most critical of which, is a pipe, 3 inches in diameter and 10 feet long, moving at a velocity of 640 feet per second. The team determined that the licensing basis approved methodology for determining the required concrete wall thickness of Class I structures to show protection for tornado generated missiles was NavDocs P-ign of Protective ated August 1950. Station Calculation FC07012 0, dated August 2005, was generated to evaluate Class I structures ability to withstand missiles. The team reviewed Station Calculation FC07012 and noted that the analysis established that the Class I structure wall thickness was required to be 2.42 feet thick to show protection from a projectile moving at 640 feet per second based on the licensing basis methodology. However, the analysis went on to state that the wall thickness of the Auxiliary Building ranges from 1.5 feet to 2 feet thick, and the wall thickness of the Intake Structure below 1007 feet 6 inches is 2 feet to 2 feet 10 inches (some of the Intake Structural wall below 1007 feet 6 inches is exposed above grade and subject to tornado missiles). The calculation identified that this was a nonconformance and was in conflict with the requirements derived from the licensing basis detailed in the facilities Updated Safety Analysis Report. However, the calculation went on to state that the auxiliary building walls were sufficient at 1.5 feet thick when evaluated against other acceptance criteria, an example of which was NUREG CR-4461, Climatology of the Contiguous United States Pacific Northwest National Laboratory, 1. The team determined that the licensee had identified a condition adverse to quality, in that, the facility was not adequately protected from tornado generated missiles as described in the Updated Safety Analysis Report, Section 5.11. However, the licensee did not enter this issue into the corrective action program for evaluation and resolution. Instead, the licensee used alternate acceptance criteria that were not part of the licensing basis. Based on this, the team determined that the licensee had failed to promptly identify and correct a condition adverse to quality. The team informed the licensee of their concerns and the licensee initiated Condition Report CR 2013-14363 to capture this issue in its corrective action program. Analysis. quality was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Inspection Manual Chapter 0609, Appendix rmination Process for Findings at because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; (4) did not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significance in accordance with the did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. The team determined that although this finding occurred more than three years ago, this finding is representative of current plant performance. Therefore, this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component, because the licensee failed to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b). Enforcement. 10 CFR Part 50, Appendix B, Criterion requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and are promptly identified and corrected. Contrary to the above, from August 2005 to July 15, 2013, measures established by the licensee failed to assure that an identified condition adverse to quality was corrected. Specifically, the licensee failed to promptly identify and correct inadequate Class 1 structures wall thickness deficiencies to protect systems and components contained within from tornado generated missiles. The licensee resolved this issue through the licensing amendment process. Because the finding was of very low safety significance (Green) and has been entered into the corrective action program as Condition Report CR 2013-14363, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000285/2013017-02 (3) Failure to Follow Operability Procedure Introduction. The inspectors identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion NOD-QP-31, erability Determination Process, for evaluating tornado missile protection deficiencies. Description. In each of the following examples, the team identified that the operability determination lacked adequate technical justification for why the item was operable with the degraded or nonconforming condition. Example 1: Condition Report CR 2013-13955 documented that the temporary barriers installed to protect raw water pump pull boxes PB-128T and PB-129T from tornado generated missiles was not adequate. Specifically, a gap at the top of the barrier could allow a missile to damage the pull boxes which could prevent the pumps from performing their specified safety function. The immediate operability determination for this condition report did not provide an adequate technical basis for concluding that these pull boxes would remain operable for the identified condition. The licenseeadequately address the lack of protection from tornado generated missiles. This issue was entered into the corrective action program as Condition Report CR 2013-14006. Example 2: The operability evaluation NOD-QP-31.1-2013-14363, documented in Condition Report CR 2013-14363, did not demonstrate compliance with the current licensing basis. Specifically, the licensee evaluated the stations systems and components that were needed to support Mode 4 and Mode 5 operations with respect to tornado generated missiles against the requirements contained in Regulatory Guide (RG 1.76) 1.76, Design-Basis Tornado and 1. This standard was not part of the facilities current licensing basis and relaxed current licensing basis requirements contained in the Updated Safety Analysis Report with respect to tornado generated missiles. After consultation with the Office of Nuclear Reactor Regulation, the team determined that this operability determination did not provide an adequate technical basis for concluding that these structures would remain operable following a tornado generated missile impact. The . This issue was entered into the corrective action program as Condition Report CR 2013-15429. The team determined that for each of the above examples, the operability determination lacked adequate technical justification for why the structure, system, or component was operable with respect to the identified degraded or nonconforming condition. The team noted that Station Procedure NOD-QP- 4.3.15of operabiliidentified does not prevent the item from fulfilling its intended safety function(s). This should demonstrate that the item is not exceeding its design basis specified in the refere Analysis. The failure to properly assess and document the basis for operability when a degraded or nonconforming condition was identified was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involving inadequate operability determinations occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix mined the finding to have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system add reactor coolant system inventory when needed, and the finding did not degrade a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision making when performing operability determinations H.1(b). Enforcement. 10 CFR Part 50, Appendix B, Criterion ctivities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Station Procedure NOD-QP-operability of safety-related components, Step 4.3.15, required the licensee to properly assess and document the basis for operability when a degraded or nonconforming condition is identified. Contrary to the above, on July 8, and July 15, 2013, the licensee failed to complete activities affecting quality in accordance with prescribed procedures. The licensee addressed these issues by taking corrective actions that provided adequate tornado missile protection in accordance with design basis requirements. Because the finding was of very low safety significance (Green) and has been entered into the corrective action program as Condition Reports CR 2013-15429 and 2013-14006, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000285/2013017-03 (4) Inadequate Temporary Modification to Protect Against Tornado Generated Missiles Introduction. The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion of temporary barriers to protect raw water pump electrical pull boxes PB-128T and PB-129T from tornado generated missiles associated with temporary modification EC 60183. Description. While performing walk downs of the facility to inspect modifications being implemented to address issues identified with tornado missile protection, the team inspected the temporary barriers constructed to protect raw water pump electrical pull boxes PB-128T and PB-129T. During this inspection, the team noted that a gap existed at the top of the barrier which could allow a tornado generated missile to damage the pull boxes. The team subsequently reviewed temporary modification package EC 60183 and determined that it did not provide sufficient guidance to ensure that there were no gaps/openings which would allow missiles to impact the pull boxes. The team informed the licensee of this concern. The licensee reviewed this issue, and stated that the cabling in the pull box was located at the bottom and if a missile were to impact the box it would not damage the cabling and the pumps would not be affected. The team questioned the lconfiguration. Subsequently, the licensee determined that the cables were not configured as previously stated, and therefore, the barriers would not protect the pull boxes as intended. The licensee initiated Condition Report CR 2013-13955 to capture this issue in the stations corrective action program for resolution. Analysis. The failure to provide adequate instructions for construction of temporary barriers to protect the raw water pump electrical pull boxes from tornado generated missiles was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix determined the finding to have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system inventory, reactor coolant system inventory when needed, and the finding did not degrade the a cross-cutting aspect in the area of human performance associated with the work practices component because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c). Enforcement. 10 CFR Part 50, Appendix B, Criterion , documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Contrary to the above, from April 27 through July 8, 2013, the licensee failed to adequately prescribe documented instructions or procedures for activities affecting quality. Specifically, the licensee failed to provide adequate instructions or procedures to ensure proper construction of temporary barriers to protect the raw water pump electrical pull boxes from tornado generated missiles. The licensee addressed this issue by modifying the temporary barriers. Because the finding was of very low safety significance (Green) and has been entered into the corrective action program as Condition Report CR 2013-13955, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000285/2013017-04Modification to Protect Agains (5) Failure to Obtain Prior NRC Approval for a Change in Method of Evaluation Introduction. The team identified a Severity Level IV, non-cited violation of 10 CFR failure to adequately evaluate changes to determine if prior NRC approval is required. Description. The team identified the following examples of inadequate 10 CFR 50.59 evaluations performed by the licensee. Example 1: While reviewing the Updated Safety Analysis Report, the team noted that Updated Safety Analysis Report, Section 5.8.2, described the specific requirements for tornado missile protection for the facility. While reviewing Sections this section had incorporated probabilistic requirements for tornado missile protection. Specifically, it stated: protection is provided for the control room air conditioning condensers (Section 9.10) and the AFW pump turbine exhaust, due to the low probability of tornado missile damage. Upon review of Section the team noted it too incorporated probabilistic requirements for tornado missile protection. Specifically, it stated: Section located on the auxiliary building roof for the refrigeration units are protected from 360 mph tornado winds. Standard Review Plan (SRP), Section 2.2.3, was used to design the air cooled condensers windscreen. The SRP criteria was met, therefore, no tornado missile shielding for the air cooled condensers is required. (Reference Station Calculation FC06375) The team questionereference to the use of the Standard Review Plan. The team reviewed original licensing basis documented in the Safety Evaluation Report, dated August 9, 1972. Through this review, the team determined that Fort Calhoun Station was designed and licensed using a deterministic methodology associated with tornado missile protection. Based on this, the team questioned by what method the licensee had incorporated these changes into the current licensing basis. During discussions with the licensee, the team determined that the licensee had used NUREG Reports for Nuclear Power Plants: sing a probabilistic approach for determining if tornado missile protection was required based on impact probabilities. The licensee indicated that they understood that NUREG 0800 constituted guidance from the NRC, which allowed the option for a licensee to choose which methodology was to be used for assessing tornado missile protection requirements. The licensee indicated that based on this understanding they had generated Calculations Air Conden 0, and EA06-Revision 1, to establish the probabilistic basis for the control room air conditioning condensers and the auxiliary feedwater pump turbine exhaust to not require tornado missile protection. Subsequently, the licensee used 10 CFR 50.59 to change the evaluations determined that the use of a probabilistic evaluation did not require prior NRC approval. The NRC has stated by memorandum dated November 7, 1983, (ML080870278) and in Task Interface Agreement (TIA) Response dated August 16, 2011, (ML11228A257) that licensee's may use probabilistic analysis for tornado missile evaluations. However, these documents further state that the use of this methodology requires prior NRC approval. require prior NRC approval. Specifically, the team determined that the licensee had inappropriately interpreted the information contained in NUREG 0800 as being generically applicable to Fort Calhoun Station without prior approval. Specifically, the original licensing basis had used a deterministic methodology and the change incorporated by the licensee was to use probabilistic methodology. evaluation methodology constituted a departure from a method of evaluation described in the Updated Safety Analysis Report used in establishing the design bases or in the safety analyses. The licensee entered this issue into the corrective action program as Condition Reports CR 2013-03839, 2013-04266, and 2013-05210. Example 2: The stations Updated Safety Analysis Report states that the Fort Calhoun Station is committed to complying with Draft General Design Criteria (GDC) 2, published July 11, 1967, which required that the systems and components needed for accident mitigation remain fully functional before, during, and after a tornado event. Updated Safety Analysis Report, Section 5.8.2.2, Tornado Generated Missilesasis tornado wind speed was 500 miles per hour which resulted in the most critical projectile being a 3 inch diameter, 10 feet long pipe moving at a velocity of 640 feet per second. Following identification of the inadequately protected equipment identified in VIO 2013017-Failure to Ensure Tornado Missile Protection for Site the licensee elected to change the facilities design and licensing basis and adopt the requirements of Regulatory Guide 1.76 (RG Design-Basis 1, as the method for restoring compliance with Draft General Design Criteria (GDC) 2 relative to tornado generated missiles. On June 27, 2013, the licensee approved a 10 CFR 50.59 evaluation as part of EC 60974 0, as the means of adopting Regulatory Guide 1.76. In this evaluation, the licensee determined that the information contained in Regulatory Guide 1.76 constituted a new method of evaluation, and went on to identify that this method had been previously reviewed and approved for use at another facility via a safety evaluation report. Based on this, the licensee determined that Regulatory Guide 1.76 could be implemented without prior NRC approval. The team, in consultation with the Office of Nuclear Reactor Regulation, reviewed t was concluded that Regulatory Guide 1.76 was not a method of evaluation, rather it was an element of a method of evaluation. Therefore, the information contained in Regulatory Guide 1.76, when used in an NRC approved method of evaluation, should demonstrate that the facilities design basis requirements would be met. Based on this, the staff determined that the ed to properly address the requirements of 10 CFR 50.59(a)(2)(i) and the guidance contained in NEI 96-07, 10 CFR dated November 2000, Sections 3.8 and 4.3.8.1. The licensee entered this issue into the corrective action program as Condition Report CR 2013-14363. of this evaluation is contained in Attachment 2 of this letter. Example 3: On July 12, 2013, the licensee approved a 10 CFR 50.59 evaluation as part of EC 6-71A & B Battery Room Ventilation Tornado Missile 0. In this evaluation, the licensee took the position that while Draft GDC 2 stated that would protect systems and components, the stations response documented in both Appendix G to the USAR, and to NRC questions, stated that only structures would resist the forces of tornados and tornado missiles. Therefore, the licensee concluded that the adoption of the requirement to protect systems and components constituted a new method of evaluation, and in adopting this method, the station did not require prior NRC approval. The licensee also concluded that with the adoption of this new method of evaluation and the modifications being made to the facility they included: Creation of Calculation EA 130-014, Tornado SaRevision 0, to provide mode specific target selection criteria to support the expansion of design and performance requirements to additional structures, systems, and components Adoption of RG 1.76, to provide the methodology to select the tornado winds and tornado missiles and their velocities, and in what directions to apply them, in a manner that is approved by the NRC Adoption of Bechtel Topical Report BC-TOP- 2, to provide an approved methodology for evaluating the effect of missiles on concrete and steel barriers Use of NUREG 800, Section 3.5.3, Revision 3, to provide the acceptance criteria necessary to meet the relevant requirements of GDC 2, which have been shown by review to be similar enough to the Draft GDC 2 to be acceptable The team, in consultation with the Office of Nuclear Reactor Regulation, reviewed e staff concluded the following: that Draft GDC 2 does not apply to the facilities systems and components was not correct and was unsupported by the criterions wording. Specifically, Draft GDC 2 required the protection of Final Safety Analysis Report/Update Safety Analysis Report stated that Draft GDC 2 is met, and then described some of the structures used to protect systems and components. Based on this, the staff concluded that the means of protecting many of the systems and components essential to the prevention of accidents was the use of structures, but the protection of such systems and components is still a requirement of the criterion and was not limited to the structures. Therefore, the staff determined that the facilities current licensing basis required the protection of position that this was a new method of evaluation was incorrect. The staff determined that calculation EA 13-014 constituted a method of evaluation, and this method was not included in the Final Safety Analysis Report/Updated Safety Analysis Report. Therefore, this method was required to be evaluated using 10 CFR 50.59. As previously expressed, RG 1.76 is an element of a method of evaluation, requirements of 10 CFR 50.59(a)(2)(i) and the guidance contained in NEI 96-07, Sections 3.8 and 4.3.8.1, with respect to determining whether this change yields results that are conservative or essentially the same as the current licensing basis. The staff noted that Topical Report BC-TOP-9A, Revision 2, is an approved methodology by the AEC that provides general procedures and criteria for the design of structures and components against the effects of missiles. However, the staffs noted that in approving the Topical Report methodology, the AEC stated that this methodology could be used in future instances provided that input parameters to the methodology are reviewed and approved by the staff, and are included in the facilities Safety Analysis Report. Therefore, the meet the requirements of 10 CFR 50.59(a)(2)(ii) and the guidance in NEI 96-07, Section to evaluate new methodologies and document in the 10 CFR 50.59 evaluation the basis for determining that a method is appropriate and approved for the intended application. NUREG 0800, Section 3.5.3, Revision 3, does not provide an approved CFR 50.59 (NUREG 0800 does not have a Safety Evaluation Report associated with it). Therefore, the staff determined that the use of NUREG 0800 to substitute acceptance criteria other than that documented in the Updated Safety Analysis Report was not appropriate. Based on the above the team determined that this was an inadequate evaluation and the changes proposed by the licensee required prior NRC approval. review of this evaluation is contained in Attachment 2 of this letter. The licensee entered this issue into the corrective action program as Condition Report CR 2013-14665. Analysis. CFR 50.59 and adequately evaluate changes to requirements for tornado missile protection described in the USAR was a performance deficiency. Because this performance function, the team evaluated the performance deficiency using traditional enforcement. In accordance with Section 2.1.3.E.6 of the NRC Enforcement Manual the team evaluated this finding using the significance determination process to assess its significance. Using Inspection Manual Chapter 0609, Appendix Significance Determination Process for Findings At-e finding is determined to have very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; (4) did not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significance rogram; and (5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. Therefore, in accordance with Section 6.1.d.2 of the NRC Enforcement Policy, the team characterized this performance deficiency as a Severity Level IV violation. The team determined that a cross-cutting aspect was not applicable to this performance deficiency because the failure to adequately evaluate changes in accordance with 10 CFR 50.59 was strictly associated with a traditional enforcement violation. Enforcement. Title 10 CFR Section (c)(1) states, in part, that a licensee may make changes in the facility as described in the Updated Safety Analysis Report without obtaining a license amendment pursuant to 10 CFR 50.90 only if: (i) a change to the technical specifications incorporated in the license is not required, and (ii) the change, test, or experiment does not meet any of the criteria in paragraph (c)(2). Title 10 CFR 50.59, Section (c)(2) states, in part, that a licensee shall obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would have resulted in a departure from a method of evaluation described in the USAR used in establishing the design bases or in the safety analyses. Contrary to the above, from April 19, 2011, through August 17, 2013, on June 27, 2013, and July 12, 2013, the licensee failed to obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in a departure from a method of evaluation described in the Updated Safety Analysis Report. The licensee addressed these issues by submitting a license amendment which was reviewed and approved by the NRC. Because this violation was entered into the corrective action program as Condition Reports CR 2013-03839, 2013-04266, 2013-05210, 2013-14363, and 2013-14665, to ensure compliance was restored in a reasonable amount of time, and the violation was not repetitive or willful, this Severity Level IV violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy: NCV 05000285/2013017-05, A1-1 Attachment 1 L. Cortopassi, Site Vice President A2-2 LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED Opened and Closed 05000285/2013017-01 VIO Failure to Ensure Tornado Missile Protection for Site Components (Section 4OA4)05000285/2013017-02 NCV Failure to Promptly Identify and Correct a Condition Adverse to Quality (Section 4OA4)05000285/2013017-03 NCV Failure to Follow Operability Procedure (Section 4OA4)05000285/2013017-04 NCV Inadequate Temporary Modification to Protect Against Tornado Generated Missiles (Section 4OA4)05000285/2013017-05 NCV Failure to Obtain Prior NRC Approval for a Change in Method of Evaluation (Section 4OA4) Closed 05000285/2013-005-1 LER Control Room HVAC Modification Not Properly Evaluated 05000285/2013-009 LER Tornado Missile Vulnerabilities -- - - -- - -- -- -- --

A2-3 -- -- -- -- -- -- - - - - - - - - - - - - - - - - - - - - - --

A2-4 -- - -- - - -

A2-5 - -- - -- - - -

A2-1 Attachment 2 - ------- - S. Bahadur - 2 - A2-2 --- -- ---

S. Bahadur - 3 - A2-3 On June 27, 2013, the licensee approved a 10 CFR 50.59 evaluation as part of Engineering Change EC Revision 0, as the means of adopting Regulatory Guide 1.76. In this evaluation, the licensee determined that the information contained in Regulatory Guide 1.76 constituted a new method of evaluation, and went on to identify that this method had been previously reviewed and approved for use at another facility via a safety evaluation report. Based on this evaluation, the licensee determined that Regulatory Guide 1.76 could be implemented at FCS without prior NRC approval. This change would consist of different types of tornado generated missiles than those described in the FCS structures, other than the containment, were designed to withstand a tornado with a maximum wind velocity of 300 miles per hour. This change would reduce the tornado wind speed velocity to 230 miles per hour. - -- -1 - 1 64 FR 53599, SOC examples 1, 4, and 5 provide additional insight on changes to elements of a method of evaluation described in the USAR.

S. Bahadur - 4 - A2-4 - - 1. - 2. -- 3.

S. Bahadur - 5 - A2-5 - - --- a. b. c. d. ----

S. Bahadur - 6 - A2-6 ----- ---

S. Bahadur - 7 - A2-7 - 2 2 The NRC does not have specific qualification requirements for SSCs, except for electric equipment important to safety, as set forth in 10 CFR 50.49.

S. Bahadur - 8 - A2-8 -

S. Bahadur - 9 - A2-9 S. Bahadur -13- A2-10 - -

Attachment 3 Detailed Risk Evaluation Failure to Ensure Tornado Missile Protection for Site Components A3-1 Attachment 3 (1) The detailed risk evaluation model revision and other PRA Tools used The analyst utilized the Standardized Plant Analysis Risk Model for Fort Calhoun Station, Revision 8.21 and hand calculation methods to quantify the risk of the subject performance deficiency. (2) Influential assumptions 1. The risk impact of the subject performance deficiency was limited to tornado-induced initiators and potential damage to site systems, structures, and components. 2. The subject performance deficiency impacted plant risk from initial reactor startup through July 2013. Therefore, in accordance with the Risk Assessment of was set to the 1-year assessment period. 3. The best available source of information related to tornadic activity around the Fort Calhoun Site is the site tornado hazard curve developed for the Individual Plant Examination of External Events for Fort Calhoun Station in accordance with the methods described in NUREG/CR- 1982. 4. The missile impact parameter method used in the Individual Plant Examination of External Events for Fort Calhoun Station is the best available method for evaluating the frequency of missile impacts. 5. The best estimate population of potential missiles is 30,000 representing the mean value used in NUREG/CR-2944. 6. Based on the definitions from the Fujita-Pearson Scale, only F2 and greater intensity tornados are capable of producing missiles. 7. All postulated F2 or greater tornados and/or their associated storm fronts would likely result in a loss of offsite power that is not recoverable within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This loss of offsite power may be caused by either onsite switching or offsite grid-related damage. 8. Thirty-five of the thirty-seven unprotected targets were considered small targets. The Main control room air conditioning condensers were considered medium targets, and the Room 81 blowout panels were considered large targets. 9. The best available model to assess the conditional core damage probabilities for equipment damaged by postulated tornado missiles was the Standardized Plant Analysis Risk Model for Fort Calhoun Station, Version 8.21.

A3-2 10. The condensate storage tank at Fort Calhoun Station represents a large target that is not designed for tornado-force winds or missiles. Therefore, the analyst assumed that any tornado with high enough wind velocities to cause a loss of offsite power and damage unprotected equipment would damage the condensate storage tank. (3) Calculation discussion A detailed risk evaluation was performed consistent with NRC Inspection Manual Chapter (IMC) 0609 Appendix . To conduct a risk assessment and determine the change in core damage frequency (CDF) an analyst must solve the following equation: CDF = [(IEFcase * CCDPcase) - (IEFbase * CCDPbase)] * EXP Where: IEFcase Initiating Event Frequency of the case being evaluated CCDPcase IEFbase Initiating Event Frequency of the baseline CCDPbase Conditional Core Damage Probability of the baseline EXP The Exposure Period including repair time Using the best available tools to the analyst, the conditional core damage probability of the case needs to be broken down into three parts: 1. Missile Impact Probability (PMS); 2. Conditional Core Damage Probability (CCDP); and 3. Applied Nonrecovery Factor (PNR). The conditional core damage probabilities can then be calculated as: CCDPcase = PMS * CCDP * PNR CCDPbase = PMS * CCDPSPAR-Base * PNR Initiating Event Frequency Tornado Occurrence Rate: As discussed under Assumption 1, the risk impact of the subject performance deficiency was limited to tornado-induced initiators and potential damage to site systems, structures, and components. The analyst performed a review of following three data sources: 1. National Severe Storms Forecast Center database (1950 1990)

A3-3 a. Collected by the licensee b. 125 nautical mile radius around plant site c. Evaluated and documented in the IPEEE d. Used wind speed-adjusted average tornado area 2. Tornado History Project database (1950 2013) a. Collected by the agency b. 16,445 miles2 in 30 counties surrounding the plant 3. US Geologic Survey (1957 2006) a. Collected by the agency b. Utilized SeverePlot software c. 150 mile radius around plant site The analyst calculated the occurrence rate (FO) for all tornados in a data set. The appropriate equation is as follows: FO = (z * t) ÷ A Where: z Average Tornado Area t = Total Events ÷ Statistical Sample Size The analysts noted that the results of each study were the same within a factor of 2. enter database was selected as the best available information because the analysis was performed in a more rigorous manner. Tornado Data Correction: In evaluating the data set, the analysts and the licensee accounted for missing data and variations in intensity across the tornado length and path. Missing data was accounted for as documented in Table 1. The intensity of these tornados was categorized based on the weighted average intensity of the properly classified observations. Intensity adjustments were made using a correction factor. The analyst noted that observations assigned a Fujita-Pearson intensity are based on the worst damage observed along the damage path. Random encounter errors occur when the tornado travels along a path that is not populated by structures, vehicles or vegetation with damage potential. Length and width of a tornado represent the dimensions of the tornado damage track. Random encounter errors and variations in intensity need to be accounted for in developing the hazard. The analyst observed the variations of intensity in Figure 1. The analyst determined that the methodology used in A3-4 the Fort Calhoun Individual Plant Evaluation of External Events was appropriate for correcting these errors. Figure 1 Finally, the analyst noted that the point strike frequency should be adjusted for the characteristic width of the site. The licensee considered the auxiliary, intake, service and turbine buildings to be the facilities under hazard. According to the Fort Calhoun Nuclear Power Station Tornado Risk Assessment, Science Applications International Corporation, December 1993, the characteristic width was calculated to be 547.88 feet, as shown in Figure 2.

A3-5 Figure 2 Tornado Hazard Occurrence Rate: The tornado strike intensity was evaluated for the National Severe Storms Forecast Center database. The data was assessed and the analyst calculated the conditional probability of a tornado strike at an intensity equivalent to each of the bins in the Fujita-Pearson Intensity Scale. These conditional probabilities are documented in Table 2. the analyst calculated the hazard for Fort Calhoun Station. Figure 1 shows a graph of the hazard with the frequency of exceedance for each of the bins, as updated by the licensee in July 2011. As stated in Assumption 6, the analyst assumed that only F2 and greater intensity tornados are capable of producing missiles. This was based on the definitions from the Fujita-Pearson Intensity Scale. Therefore the exceedance values for F2 tornados were used during quantification. Table 1 provides the results of these reviews:

A3-6 Data Source Regional Area (miles2) Sample Size (years) Tornado Area (miles2) Events Missing Data Occurrence Rate (per year) IPEEE 64,918 37 0.67 1412 156 3.94e-4 Tornado History Project 16,445 63 0.5 784 43 3.99e-4 SeverePlot 70,686 50 0.4 2458 0 2.82e-4 Table 2 Tornado Hazard at Fort Calhoun Station Intensity Conditional Probability Frequency of Exceedance Overall Site F0 29.9% 2.78E-04 F1 37.5% 1.54E-04 F2 24.8% 7.25E-05 F3 5.6% 2.18E-05 F4 2.1% 6.03E-06 F5 0.2% 3.95E-07 F6 0.0% 1.00E-08 A3-7 1.00E-081.00E-071.00E-061.00E-051.00E-041.00E-030123456Figure 3 Tornado Frequency Hazard for Fort Calhoun Station Occurrence RateFrequency of Exceedance A3-8 Conditional Core Damage Probability of the Event Baseline: The analyst utilized the Standardized Plant Analysis Risk Model for Fort Calhoun Station, Version 8.20, to quantify the baseline conditional core damage probability for a tornado strike at Fort Calhoun. Given Assumptions 7 and 10, the analyst established a baseline tornado-strike model by calculating the probability of core damage from an unrecoverable loss of offsite power with failure of the condensate storage tank. The analyst noted that the condensate storage tank was not modeled in the standardized plant analysis risk model. Therefore, the analyst used the failure-to-start basic event for Auxiliary Feedwater Pump FW-54 as a surrogate. Table 3 documents the changes in basic event parameters used for this calculation. Table 3 Baseline Change Set Basic Event Event Description Original Value Modified Value AFW-EDP-FS-FW54 AFW Diesel-Driven Pump FW-54 Fails to Start 5.09E-03 TRUE IE-******** All Initiating Events various FALSE IE-LOOP Loss of Offsite Power 2.84E-02 1.0 OEP-XHE-XL-NR01H Operator Fails to Recover Power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 5.46E-01 TRUE OEP-XHE-XL-NR02H Operator Fails to Recover Power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 3.39E-01 TRUE OEP-XHE-XL-NR04H Operator Fails to Recover Power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 1.73E-01 TRUE OEP-XHE-XL-NR06H Operator Fails to Recover Power in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 1.10E-01 TRUE OEP-XHE-XL-NR24H Operator Fails to Recover Power in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 2.31E-02 TRUE Based on this approach, the baseline conditional core damage probability was quantified as 4.32 x 10-3. Case Quantification: Based on similarities in the ultimate plant damage state between many of the tornado-strike targets, the analyst created nine model change sets to quantify the risk associated with each postulated impact. Table 4 documents the conditional core damage probability calculated for each of the nine change sets, given the failure of front-line systems.

A3-9 Missile Strike Probability: As documented in the Fort Calhoun Nuclear Power Station Tornado Risk Assessment, Science Applications International Corporation, December 1993, the missile impact -10 per tornado per missile per ft2 for large targets and 2.42 x 10-9 per tornado per missile per ft2 for small targets. The analyst assumed that targets larger than 2000 ft2 were large. Additionally, for several hardened targets, the analyst -9 per tornado per missile per ft2 to indicate a higher probability that the component could survive tornados of strength F2 and F3. The analyst then calculated the missile impact probability by multiplying the total target area, the applicable missile impact parameter, and the selected number of postulated missiles from Assumption 5. Exposure Period As stated in Assumption 2, the subject performance deficiency impacted plant risk from initial reactor startup through July 2013. The analyst evaluated the time frame over which the finding was reasonably known to have existed. The analyst determined that a tornado could have resulted in failure of the unprotected components at any time during this period. Therefore, in accordance with the Risk Assessment of Operational Events Handbook, maximum exposure time was set to the 1-year assessment period. Results The analyst calculated the change in core damage frequency for each of the non-protected components. The results are documented in Table 5.Table 4 Conditional Core Damage Probabilities Change Set Front-Line Systems Failed CCDP Change in CCDP Baseline Baseline Change Set from Table 3 4.23E-03 1 One Raw Water Pump 4.34E-03 2.00E-05 2 Loss of All Raw Water 5.07E-03 7.50E-04 3 Two Raw Water Pumps 4.44E-03 1.20E-04 4 Both Diesel Generators 1.00E-00 9.96E-01 5 Emergency Diesel Generator 1 9.70E-02 9.27E-02 6 Emergency Diesel Generator 2 4.62E-02 4.19E-02 7 Main Steam and Auxiliary Feedwater 1.19E-01 1.15E-01 8 Auxiliary Feedwater Pump FW-10 4.93E-02 4.50E-02 9 Bus 1A3 and Bus 1A1 8.87E-02 8.35E-02 A3-10 Table 5 Tornado Missile Evaluation Results Components: Tornado Area Missile Strike CCDPBase CCDPCase CCDPDelta Nonrecovery Change in Frequency Probability Frequency (/year) (ft2) (/ft2) EFWST 1.54E-04 800 3.21E-09 7.71E-02 4.32E-03 1.19E-01 1.15E-01 1.00E+00 1.36E-06 DG Fuel Fill Line FO-10 1.54E-04 225 2.42E-09 1.63E-02 4.32E-03 1.00E+00 9.96E-01 1.00E-01 2.50E-07 DG Fuel Vent FO-1 1.54E-04 0.6 2.42E-09 4.36E-05 4.32E-03 1.00E+00 9.96E-01 1.00E+00 6.68E-09 CR AC Condensers 1.54E-04 256.5 3.21E-09 2.47E-02 4.32E-03 1.00E+00 9.96E-01 4.01E-03 1.52E-08 Sluice Gate Operators 1.54E-04 190.74 2.42E-09 1.38E-02 4.32E-03 1.10E-02 6.67E-03 1.00E+00 1.42E-08 Boric Acid Tank 1.54E-04 120 2.42E-09 8.71E-03 4.32E-03 6.39E-03 2.07E-03 1.00E+00 2.78E-09 Battery Room Vents 1.54E-04 5.21 2.42E-09 3.78E-04 4.32E-03 1.00E+00 9.96E-01 1.00E+00 5.80E-08 Room 81 Blow Out 1.54E-04 2163 1.23E-10 7.98E-03 4.32E-03 1.19E-01 1.15E-01 1.00E+00 1.41E-07 Aux Building Door 1.54E-04 35 2.42E-09 2.54E-03 4.32E-03 8.78E-02 8.35E-02 1.00E+00 3.27E-08 Room 81 Ducts 1.54E-04 12 2.42E-09 8.71E-04 4.32E-03 1.19E-01 1.15E-01 1.00E+00 1.54E-08 Penthouse VA-42 1.54E-04 18 2.42E-09 1.31E-03 4.32E-03 1.19E-01 1.15E-01 1.00E+00 2.31E-08 Room 81 Roof Openings 1.54E-04 26 2.42E-09 1.89E-03 4.32E-03 1.19E-01 1.15E-01 1.00E+00 3.33E-08 Barrier 49 1.54E-04 157 2.42E-09 1.14E-02 4.32E-03 9.70E-02 9.27E-02 1.00E+00 1.63E-07 CR Door 1036-1 1.54E-04 35 2.42E-09 2.54E-03 4.32E-03 1.00E+00 9.96E-01 1.67E-01 6.49E-08 CR Door 1036-2 1.54E-04 35 2.42E-09 2.54E-03 4.32E-03 1.00E+00 9.96E-01 1.67E-01 6.49E-08 HVAC Conduit 1.54E-04 0.5 2.42E-09 3.63E-05 4.32E-03 1.00E+00 9.96E-01 4.01E-03 2.23E-11 DG Ventilation Louvers 1.54E-04 32 2.42E-09 2.32E-03 4.32E-03 9.70E-02 9.27E-02 1.00E+00 3.31E-08 DG-1 Exhaust 1.54E-04 88 2.42E-09 6.39E-03 4.32E-03 9.70E-02 9.27E-02 1.00E+00 9.12E-08 DG-2 Exhaust 1.54E-04 44 2.42E-09 3.19E-03 4.32E-03 4.62E-02 4.19E-02 1.00E+00 2.06E-08 A3-11 RW Branch Line 1.54E-04 2 2.42E-09 1.45E-04 4.32E-03 5.07E-03 7.50E-04 1.00E+00 1.68E-11 Strainer Opening A 1.54E-04 28 2.42E-09 2.03E-03 4.32E-03 5.07E-03 7.50E-04 1.00E+00 2.35E-10 Strainer Opening B 1.54E-04 28 2.42E-09 2.03E-03 4.32E-03 5.07E-03 7.50E-04 1.00E+00 2.35E-10 Pull Box A 1.54E-04 41 2.42E-09 2.98E-03 4.32E-03 4.34E-03 2.00E-05 1.00E+00 9.16E-12 Pull Box B 1.54E-04 41 2.42E-09 2.98E-03 4.32E-03 4.34E-03 2.00E-05 1.00E+00 9.16E-12 Pull Box C 1.54E-04 41 2.42E-09 2.98E-03 4.32E-03 4.34E-03 2.00E-05 1.00E+00 9.16E-12 Pull Box D 1.54E-04 41 2.42E-09 2.98E-03 4.32E-03 4.34E-03 2.00E-05 1.00E+00 9.16E-12 Intake East Stairwell 1.54E-04 63 2.42E-09 4.57E-03 4.32E-03 5.07E-03 7.50E-04 1.00E+00 5.28E-10 Intake West Stairwell 1.54E-04 63 2.42E-09 4.57E-03 4.32E-03 5.07E-03 7.50E-04 1.00E+00 5.28E-10 Manhole MH-31 1.54E-04 7 2.42E-09 5.08E-04 4.32E-03 4.44E-03 1.20E-04 1.00E+00 9.39E-12 Manhole MH-5 1.54E-04 7 2.42E-09 5.08E-04 4.32E-03 4.44E-03 1.20E-04 1.00E+00 9.39E-12 RW Pull Boxes 1.54E-04 80 2.42E-09 5.81E-03 4.32E-03 5.07E-03 7.50E-04 1.00E+00 6.71E-10 Pump Cover A 1.54E-04 4 2.42E-09 2.90E-04 4.32E-03 4.34E-03 2.00E-05 1.00E+00 8.94E-13 Pump Cover B 1.54E-04 4 2.42E-09 2.90E-04 4.32E-03 4.34E-03 2.00E-05 1.00E+00 8.94E-13 Pump Cover C 1.54E-04 4 2.42E-09 2.90E-04 4.32E-03 4.34E-03 2.00E-05 1.00E+00 8.94E-13 Pump Cover D 1.54E-04 4 2.42E-09 2.90E-04 4.32E-03 4.34E-03 2.00E-05 1.00E+00 8.94E-13 Room 66 from Room 65 1.54E-04 80 2.42E-09 5.81E-03 4.32E-03 9.70E-02 9.27E-02 1.00E+00 8.29E-08 Room 81 Door 1.54E-04 35 2.42E-09 2.54E-03 4.32E-03 1.19E-01 1.15E-01 1.00E+00 4.49E-08 Aux Building Stack 1.54E-04 13 2.42E-09 9.44E-04 4.32E-03 1.19E-01 1.15E-01 1.00E+00 1.67E-08 A3-12 (4) Analysis of Dominant Cut-sets / Sequences All accident sequences involved a tornado-induced non-recoverable loss of offsite power with missiles impacting one of the subject unprotected targets. The dominant sequence included the failure of the emergency feedwater storage tank. These sequences are documented in Table 6. Table 6 Core Damage Sequences Failure of Emergency Feedwater Storage Tank Sequence Description Point Estimate % of Total Cut Set Count LOOP-21 IELOOP-AFW-OTC 1.16E-1 97.5 50 LOOP-22-30 IELOOP-EPS(SBO)-AFW-OPR01H- DGR-01H 2.16E-3 1.8 38 LOOP-19 IELOOP-AFW-OPR06H-HPR 3.22E-4 0.3 515 Others All Additional Sequences Combined 5.18E-4 0.4 3,348 Total CCDP All Sequences 1.19E-1 100.0 3,951 Abbreviations: AFW Auxiliary Feedwater DGR01H Nonrecovery of Diesel Generator in 1 Hour EPS Emergency Power System HPR High Pressure Recirculation IELOOP Initiating Event: Loss of Offsite Power OPR01H Nonrecovery of Offsite Power in 1 Hour OPR06H Nonrecovery of Offsite Power in 6 Hours OTC Once-Through Cooling SBO Station Blackout (5) Sensitivity Analysis The SRA performed a variety of uncertainty and sensitivity analyses on the results and modeling as shown below. The results confirm the recommended White finding. Sensitivity Analysis 1 Selection of Tornado Hazard. As stated above, the analyst noted that the results of each tornado study were the same within a factor of 2. Using this range, the analyst calculated the sensitivity of the evaluation to the selection of the tornado hazard. The change in core damage frequency range was 1.3 x 10-6 4.1 x 10-6 (White). Sensitivity Analysis 2 Population of Potential Missiles. The analyst determined the sensitivity of the results to the number of postulated missiles assumed. To establish a range, the analyst calculated the change in core damage frequency assuming 15,000 missiles then 60,000. The range of change in core damage frequency was 1.3 x 10-6 5.1 x 10-6 (White).

A3-13 Sensitivity Analysis 3 Selection of Tornado Intensity. The analyst determined the sensitivity of the results to the selection of tornado intensity at which missiles of concern could be generated. To establish a range, the analyst calculated the change in core damage frequency assuming F1 tornados could affect the unprotected components then assuming an F3 or larger tornado would be required to negatively impact the site. The range of change in core damage frequency was 5.2 x 10-7 4.6 x 10-6 (White). NOTE: The lower value, while Green, is less than a factor of 2 from the White threshold. (6) Contributions from External Events (Fire, Flooding, and Seismic) This performance deficiency only impacts the risk of the plant to a postulated tornado, which is an external event. The response of the plant to other external events, or to any internal initiators, was not affected. (7) Potential Risk Contribution from LERF In accordance with the guidance in NRC Inspection Manual Chapter 0609, Appendix H, involve a significant increase in risk of a large, early release of radiation because Fort Calhoun Station has a large, dry containment and the dominant sequences contributing to the change in the core damage frequency did not involve either a steam generator tube rupture or an inter-system loss of coolant accident. (8) Total Estimated Change in Core Damage Frequency The total change in risk caused by this performance deficiency is the sum of the internal and external events change in core damage frequencies. This value was 2.6 x 10-6 (WHITE). (9) s Risk Evaluation The licensee did not have an independent evaluation of the overall risk associated with this performance deficiency. However, licensee analysts noted that the methods described in NUREG/CR-2944 are intended for bounding screening analyses and are conservative for the Fort Calhoun Station application. More sophisticated tornado analysis methods exist which explicitly treat the stochastic processes of missile release, transport, and impact. An example is the TORMIS computer code (ref. NRC regulatory issue summary 2008-14). However, these tools were not readily available to the utility or the NRC analyst. In discussing the target vulnerabilities, the licensee provided arguments as to why they believed the selected analysis approach to be conservative. The licensee analysts noted that many of the targets associated with the performance deficiency are protected on at least one side by structures some distance from a source of credible penetrating missiles. For example, one significant target is a buried fuel oil storage tank with A3-14 structures on two sides, making the likelihood of a penetrating missile reaching the target very low. The licensee contended that missiles with the potential to cause damage to the tank were sufficiently remote from the target and unlikely to reach the target area. The licensee asserted that the NUREG does not differentiate between horizontal and vertical impact velocities and the stochastic nature of the missile orientation. They also noted that some postulated missiles would be limited in the angle of impact to hit their respective targets, and it is particularly improbable that heavy missiles could achieve impact angles. The NRC analyst determined that the NUREG/CR-2944 method developed the missile impact parameter representing 2 per tornado strike frequency. Adjustment of such a parameter using a z-axis angle, or for surrounding structures, would provide results that were beyond the capabilities and limitations of the method. The existence of such structures may actually focus the impact of postulated missiles. (10) Summary of Results and Impact the "White" region. This represents a preliminary finding of low to moderate safety significance (White based on external event initiated change in core damage frequency). (d) Peer Review: The analyst requested that two analysts from NRC Region III perform a peer check on this analysis. As a result of this review, the analyst performed additional sensitivity studies to assess the variation of the results based on varying assumptions in the selection of the normalized tornado missile impact parameter shown in Table 7. Table 7 Tornado Missile Impact Parameter Sensitivities Sensitivity Number Changes New Value Results 1 No Changes 2.57E-06 2 Use FCS IPEEE value for EFWST 4.02E-10 1.38E-06 3 Use FCS IPEEE value for BlowOuts 3.21E-09 6.11E-06 2 & 3 4.92E-06 4 Medium - 8.64E-11 1.55E-06 2 & 4 3.64E-07 A3-15 (e) References: The analysts used the following generic references in preparing the risk assessment: NUREG/CR- NUREG/CR- NUREG/CR-4710, Combustion Engineering 2- Appendix G NUREG/CR-- NUREG-April 2005 NUREG/CR-An Approach for Estimating the Frequencies INL/EXT-10--H Step-by- Internal E Risk Assessment of Operational Events, Volume 2 Revision 1.01, January 2008 NUREG/CR- UCRL-CR-135687, -Borne Missile Criteria for DOE Facilities The analysts used the following plant specific references: Standardized Plant Analysis Risk model for Fort Calhoun Station, Version 8.21 2, 3, & 4 3.90E-06 5 Conservative Distribution 2.84E-10 1.64E-06 6 All Medium Targets 4.02E-10 1.36E-06 5 & 6 4.36E-07 2, 3, 5 & 6 3.97E-06 A3-15 LTR-RAM-II-10-EPU Risk from Fire, Flood, Other Revision 0 National Severe Storms Forecast Center Tornado Database (1950 1990) Tornado History Project (1950 2013) United States geologic survey SeverePlot (1957 2006) Fort Calhoun Station Unit No. 1, Updated Safety Analysis Report Phase II Response to Generic Letter 88-Examination of External EventTransportation and Nearby Facilities Accidents, and Others Including