ML101970547
| ML101970547 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 07/15/2010 |
| From: | Caniano R J Division of Reactor Safety IV |
| To: | Bannister D J Omaha Public Power District |
| References | |
| EA-10-084, FOIA/PA-2014-0210 IR-10-007 | |
| Download: ML101970547 (32) | |
See also: IR 05000285/2010007
Text
UNITED STATES NUCLEAR REGULATORY
COMMISSION
REGION IV 612 EAST LAMAR BLVD, SUITE 400 ARLINGTON, TEXAS 76011-4125
July 15, 2010 David J. Bannister, Vice President
and Chief Nuclear Officer Omaha Public Power District 9610 Power Lane Blair, NE 68008 SUBJECT: FORT CALHOUN STATION -NRC FOLLOWUP INSPECTION
-INSPECTION
REPORT 05000285/2010007;
PRELIMINARY
SUBSTANTIAL
FINDING Dear Mr. Bannister:
The U.S. Nuclear Regulatory
Commission (NRC) completed
an inspection
at the Fort Calhoun Station. The enclosed inspection
report documents
the inspection
findings, which were discussed, with Mr. J. Reinhart Site Vice President, and other members of your staff on June 21,2010. The attached report documents
the results of the inspection, which reviewed an unresolved
item from the 2009 Component
Design Basis Inspection
at the Fort Calhoun Station (URI 05000285/2009006-03).
The inspection
examined activities
conducted
under your license as they relate to safety and compliance
with the NRC's
rules and regulations
with respect to external flooding.
This report discusses
preliminary
results of the inspection
including
a finding, which involves a failure to establish
and maintain procedures
to protect the intake structure
and auxiliary
building during external flooding events. The inspectors
determined
that the protection
strategy discussed
in station operating
procedures, if implemented, would be insufficient
to protect vital station facilities
to an external flood level of 1014 feet mean sea level, as described
in the Fort Calhoun Station Updated Safety Analysis Report and station procedures.
This finding was assessed based on the best available
information, including
influential
assumptions, using the applicable
significance
determination
process. The preliminary
significance (Yellow) was based on the extrapolated
external flood frequencies
established
by the Fort Calhoun Station Individual
Plant Examination
for External Events and credit given for use of a portable gas powered pump system. Additional
details of the primary assumptions
associated
with the preliminary
significance
determination
process are documented
in Attachment
2 of the enclosure.
The finding is also an apparent violation
of NRC requirements
and is being considered
for escalated
enforcement
action in accordance
with the NRC Enforcement
Policy. The current Enforcement
Policy is included on the NRC's Web site at
Omaha Public Power District -2 -Before we make a final decision on this matter, we are providing
you an opportunity
(1) to present to the NRC your perspectives
on the facts and assumptions, used by the NRC to arrive at the finding and its significance, at a Regulatory
Conference
or (2) submit your
position on the finding to the NRC in writing. If you request a Regulatory
Conference, it should be held within 30 days of the receipt of this letter and we encourage
you to submit supporting
documentation
at least one week prior to the conference
in an effort to make the conference
more efficient
and effective.
If a Regulatory
Conference
is held, it will be open for public observation.
If you decide to submit only a written response, such submittal
should be sent to the NRC within 30 days of the receipt of this letter. In accordance
with NRC Inspection
Manual Chapter 0609, we intend to complete our evaluation
using the best available
information
and issue our final determination
of safety significance
within 90 calendar days of the date of this letter. The significance
determination
process encourages
an open dialogue between the NRC staff and the licensee.
However, the dialogue should not impact the timeliness
of the staff's final determination.
Since the NRC has not made a final determination
in this matter, a Notice of Violation
is not being issued for these inspection
findings at this time. In addition, please be advised that the number and characterization
of apparent violations
described
in the enclosed inspection
report may change as a result of further NRC review. If you have additional
questions
about NRC rules and processes, please contact Mr. Thomas Farnholtz
at (817) 860-8243.
In accordance
with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosures
will be available
electronically
for public inspection
in the NRC Public Document Room or from the Publicly Available
Records (PARS) component
of NRC's document system (ADAMS). ADAMS is accessible
from the NRC Web site at (the Public Electronic
Reading Room). Sincerely, Docket: 50-285 License: DPR-40 Enclosure:
NRC Inspection
Report 05000285/20010007
w/Attachments:
Attachment
1: Supplemental
Information
Attachment
2: Phase 3 Analysis Attachment
3: SPAR-H Worksheets
Attachment
4: Flooding Frequency
Sensitivity
Attachment
5: Significance
Determination
Processes
Combinations
Attachment
6: Additional
Fault Trees
Omaha Public Power District cc wiEnciosure:
Jeffrey A. Reinhart Site Vice President
Omaha Public Power District Fort Calhoun Station FC-2-4 Adm. P.O. Box 550 Fort Calhoun, NE 68023-0550
William Hansher Manager -Nuclear Licensing
Omaha Public Power District Fort Calhoun Station FC-2-4 Adm. P.O. Box 550 Fort Calhoun, NE 68023-0550
David A. Repka Winston & Strawn 1700 K Street, NW Washington, DC 20006-3817
Chairman Washington
County Board of Supervisors
P.O. Box 466 Blair, NE 68008 Ms. Julia Schmitt, Manager Radiation
Control Program Nebraska Health & Human Services Division of Public Health P.O. Box 95026 Lincoln, NE 68509-5026
Ms. Melanie Rasmussen
Radiation
Control Program Officer Bureau of Radiological
Health Iowa Department
of Public Health Lucas State Office Building, 5th Floor 321 East 12th Street Des Moines, IA 50319 Chief, Technological
Hazards Branch FEMA, Region VII 9221 Ward Parkway Suite 300 Kansas City, MO 64114-3372
-3-
Docket: License: Report Nos.: Licensee:
Facility:
Location:
Dates: Lead Inspector:
Inspectors:
Others: Approved By: 50-285 DPR-40 U.S. NUCLEAR REGULATORY
COMMISSION
REGION IV 05000285/2010007
Omaha Public Power District Fort Calhoun Station 9610 Power Lane Blair, NE 68008 February 9,2010 (Onsite) April 13, 2010 (Onsite) January 1, 2010 -June 14, 201 0 (In-Office)
G. George, Reactor Inspector, Engineering
Branch 1 J. Kirkland, Senior Resident Inspector, Fort Calhoun Station M. Williams, Reactor Inspector, Plant Support Branch 2 G. Replogle, Senior Reactor Analyst, Division of Reactor Safety D. Loveless, Senior Reactor Analyst, Division of Reactor Safety Thomas Farnholtz, Branch Chief, Engineering
Branch 1 -1 -Enclosure
SUMMARY OF FINDINGS IR 05000285/2010007;
01101/2010
-06/21/2010;
Fort Calhoun Station: Inspection
Procedure
92701, Followup.
The report covers a 6-month period of followup inspection
by regional based inspectors
from the NRC Region IV office. One apparent violation
of NRC requirements
with potential
substantial (Yellow) safety significance
was identified.
The significance
of most findings is indicated
by their color (Green, White, Yellow, or Red) using Inspection
Manual Chapter 0609, "Significance
Determination
Process." Findings for which the significance
determination
process does not apply may be Green or be assigned a severity level after NRC management
review. The NRC's program for overseeing
the safe operation
of commercial
nuclear power reactors is described
in NUREG-1649, "Reactor Oversight
Process," Revision 4, dated December 2006. A. NRC-Identified
Findings and Self-Revealing
Findings Cornerstone:
Mitigating
Systems * Yellow. The inspectors
identified
an apparent violation
of Technical
Specification
5.8.1.a, "Procedures," for failure to establish
and maintain procedures
that protect the intake structure
and auxiliary
building during external flooding events.
The inspectors
determined
that the procedural
guidance of RR-AE-1002, "Flood Control Preparedness
for Sandbagging," was inadequate
because stacking and draping sandbags at a height of four feet over the top of floodgates
would be insufficient
to protect the vital facilities
to 1014 feet mean sea level, as described
in the Updated Safety Analysis Report and station procedures.
The licensee has entered this condition
into their corrective
action program as Condition
Report 2010-2387.
As result of this violation, the licensee has implemented
a corrective
action plan to correct identified
deficiencies
and ensure site readiness.
This performance
deficiency
is more than minor because it adversely
affected the Mitigating
Systems Cornerstone
attribute
of external events and affected the
cornerstone
objective
of ensuring the availability
and reliability
of systems that respond to initiating
events to prevent undesirable
consequences.
The inspectors
determined
the finding resulted in the degradation
of equipment
and functions
specifically
designed to mitigate a flooding initiating
event. In addition, an external flood event would degrade two or more trains of a multi-train
safety system. Therefore, the finding was potentially
risk significant
to flood initiators
and a Phase 3 analysis was required.
The preliminary
change in core damage frequency
was calculated
to be 3.1 E-5/year indicating
that the finding was of substantial
safety significance (Yellow). The
finding was determined
to have a crosscutting
aspect in the area of problem identification
and resolution, corrective
action program, for failure to take appropriate
corrective
actions to address safety issues and adverse trends in a timely manner, commensurate
with their safety significance
and complexity.
Specifically, from 2003 to 2008, the licensee failed to initiate appropriate
corrective
actions to ensure reguiatory
compiiance
of the external flooding design basis was maintained.
[P.i (d)] (Section 40A5.i) -2 -Enclosure
REPORT DETAILS 40A5 Other Activities
.1 IP 92701, "Followup":
URI 05000285/2009006-03, "Failure to Update Flood Protection
for Safety Related Buildings" a. Inspection
Scope As documented
in NRC Inspection
Report 2009006, the NRC inspectors
identified
an unresolved
item concerning
external flood protection
for plant areas considered
vital to allow the reactor to achieve cold shutdown.
The unresolved
item concerned:
(1) the ability of the licensee to protect the Fort Calhoun Station auxiliary
building, intake structure, and turbine building basement from external floods up to flood elevation
1013 feet mean sea level* (MSL) as stated in the Updated Safety Analysis Report (USAR) and station procedures;
and, (2) upon receiving
new flooding information
in November 2003, if the licensee was required to update the USAR. Because further inspection
was necessary, the issue was considered
an unresolved
item pending further NRC Region IV review. The NRC Region IV review was to determine:
1. If the failure to meet the self-imposed
standard of flood protection
up to 1013 feet MSL * is a performance
deficiency
in accordance
with NRC Manual Chapter 0612. 2. If a violation
of NRC requirements
is associated
with the performance
deficiency
because the licensee did not update the external flood design basis when new information
was received in November 2003. *Note: During this inspection, the inspectors
determined
that the Fort Calhoun Station original USAR described
protection
of the facility up to 1014 feet MSL. This unresolved
item was identified
as URI 05000285/2009006-03, "Failure to Update Flood Protection
for Safety Related Buildings." Based on followup inspections
conducted
at the Fort Calhoun Station and the NRC Region IV office, the inspectors
determined
that no further inspection
is necessary.
Therefore, URI 05000285/2009006-03
will be closed. Findings are documented
in the following
section. b. Findings Failure to Maintain External Flood Procedures
Introduction.
The inspectors
identified
a Yellow, apparent violation
of Technical
Specification
5.8.1.a, "Procedures," for failure to establish
and maintain procedures
that protect the intake structure
and auxiliary
building during external flood events. Specifically, stacking and draping sandbags on floodgates
IS not a suffiCient
configuration
to protect the auxiliary
building and intake structure
to an external flood height of 1014 feet MSL as stated in station operating
procedures
and the USAR. -3 -Enclosure
Description.
The inspectors
determined
design basis flood elevations
at the Fort Calhoun Station by reviewing
USAR Chapter 2.7, "Hydrology," USAR Chapter 9.8, "Raw Water System," and Technical
Specification
2.16, "River LeveL" USAR Section 2.7.1.2 states, in part: "The design flood elevation
of 1,006 feet based on a 0.1 percent probability
flood is considered
conservative.
Without special provisions, the plant can accommodate
flood levels of up to 1,007 [feet mean sea level]. Steel flood gates are permanently
mounted above and adjacent to openings in structures
containing
equipment
required for a safe and orderly plant shutdown.
In the event of high water levels, these flood gates can be installed
to provide protection
to a level of 1,009.5 [feet mean sea level]. In the Intake Structure, protection
to 1009.5 [feet] MSL is accomplished
with flood gates and sandbagging.
The plant can be protected
by sandbags, temporary
earth levees and other methods to allow a safe shutdown with a flood elevation
of 1,013 [feet mean sea level]." USAR Section 9.8.6 states, in part: "Protection
for the raw water pumps and their drives against floods is provided at three elevations
as indicated
on Figure 9.8-1. The pumps are permanently
protected
against any water level up to elevation
1007.5 feet MSL by the Class I concrete substructure
of the intake building.
Protection
is provided to elevation
1009.5 [feet MSL] by sandbags around the traveling
screen areas and by gasketed steel closures at exterior doorway openings in the intake structure
reinforced
concrete perimeter
walls. Protection
to elevation
1014.5 feet [MSL] is provided by additional
sandbags around the traveling
screen areas, and by supplementing
the intake structure
perimeter
walls with sandbags.
The water level inside the intake cells can be controlled
by positioning
the exterior sluice gates to restrict the inflow into the cells." Technical
Specification
2.16, "Basis," dated November 1, 2007, states: "The maximum Missouri River level of 1009 feet MSL is the level at which the installed
flood gates will protect the plant. Any increase in river level will require sand bagging to repel the water to a maximum flood level of 1014 feet [MSL] or greater." When the licensee determines
it is necessary
to protect the plant at elevated flood levels, the licensee implements
Section I of procedure
AOP-1, "Acts of Nature." AOP-1 is a procedure
required by Technical
Specification
5.8.1.a and NRC Regulatory
Guide 1.33, Appendix A, Section 6.w. AOP-1 directs the licensee to implement
applicable
sections of procedures
PE-RR-AE-1
001, "F!oodgate
!nstallation
and Removal," and RR-AE-1002, "Flood Control Preparedness
for Sandbagging," when river levels reach specified
heights of 1002, 1004, 1007, and 1009 feet MSL. -4-Enclosure
GM-RR-AE-1002, step 7.4 states: "The primary focus for flood protection
should be directed to those facilities
which are considered
vital with respect to nuclear safety and credited with flood protection
in the Individual
Plant Examination
of External Events Flooding evaluation, Reference
2.3. These facilities
shall be protected
at the sacrifice
of the other facilities
if site conditions
warrant. The vital facilities
are: Auxiliary
Building, Intake Structure, and Turbine Building Basement." Reference
2.3 of procedure
GM-RR-AE-1002
is the Individual
Plant Examination
of External Events for Fort Calhoun Station, Section 5.2, "External
Flooding," Table 5.2.3. This table credited flood protection
by sandbagging
up to 1010.8 ft MSL for the turbine building and up to 1013.5 feet MSL for the auxiliary
building and intake structure.
Table 5.2.3, "Impact of Periodic Flood due to Rain and Snow," comments that "severe core damage results if either intake or auxiliary
building sandbagging
fails." The turbine building, which does not contain safety related equipment
necessary
for safe shutdown, was assumed lost at floods greater than 1010.8 feet MSL. Attachment
9.5 of procedure
GM-RR-AE-1002
contains specific instructions
that plant operators
would use to protect from flood crest above 1009 feet mean sea levei. The attachment
notes that sandbags would be tied and draped over the top of floodgates
to supplement
the protection
capability
to the projected
flood crest. Specifically, the attachment
stated, "Place additional
sandbags on top of the floodgates
to raise the protection
against the expected crest of the flood." Additionally, Attachment
9.8 of GM-RR-AE-1002
stated the intake structure
and auxiliary
building could be protected
to 1014.5 feet MSL with floodgates
and sandbags.
The inspectors
requested
a demonstration
of flood protection
for vital facilities
against flood levels above the probable maximum flood level of 1009 feet MSL. As a result of this demonstration, the inspectors
determined
that the procedural
guidance of AE-1 002 was inadequate
because stacking and draping sandbags at a height of five feet over the top of floodgates
would be insufficient
to protect the vital facilities
to 1014 feet MSL, as described
in the USAR and station procedures.
The sandbagging
activity would be insufficient
because the %-inch cross section on the top of the floodgates
was too small to support a stacked sandbag configuration
that would retain five feet of moving water. Therefore, the inspectors
determined
that a failure of the sandbags would cause potential
damage to the auxiliary
building, intake structure, and turbine building and their equipment
at external flood levels above 1009.5 feet MSL. The inspectors
also identified
plant personnel
would need to take additional
action to prevent flooding through the traveling
screen discharge
trench in the intake structure
or the intake structure
would be potentially
lost at a flood level of 1008 feet MSL. Furthermore, the inspectors
determined
that any actions taken per AOP-1 could be difficult
because of the risk to personnel
safety when flood waters are within the protected
area. While reviewing
the Fort Calhoun Station design basis, the inspectors
discovered
the licensee missed several opportunities
to implement appropriate
corrective
actions when new external flood information
was available.
The failure to implement
appropriate
corrective
actions directly contributed
to the licensee's
failure to identify inadequacies
in their external flood procedures
and strategy. -5 -Enclosure
As documented
in Condition
Report 2002-1296, the licensee obtained external flood information
from the Federal Emergency
Management
Administration
and an Army Corps of Engineers
letter to Omaha Public Power District (OPPD), dated January 14, 1993. The information
estimated
projected
flood elevations
to be three feet greater than the flood elevations
described
in the original USAR. The corrective
actions were to evaluate the information
to determine
if the design basis and procedures
would need to be updated. The licensee determined
that the design basis would remain the same; however, a USAR change would reflect that an evaluation
of the new information's
impact on the design basis was completed.
A USAR change was submitted
to the NRC in January 2008, but no change to operating
procedures
was initiated.
During the evaluation
associated
with Condition
Report 2002-1296, the licensee identified
that more recent external flood information
was available
from the Army Corps of Engineers.
In July 2003, the licensee identified
that external flood frequencies
and associated
Missouri River levels evaluated
in the 2003 draft version of Army Corps of Engineers
report, "Upper Mississippi
River System Flow Frequency
Study (final version January 2004)," had increased
since last evaluated
the Army Corps of Engineers
letter to OPPD, dated January 14, 1993. This condition
was entered into the corrective
action program as Condition
Report 2003-2664.
The licensee's
corrective
action tasked the licensee's
probabilistic
risk assessment
group to evaluate the new 2003 external flood data, update the existing external flood analysis, and develop a set of recommended
strategies
to mitigate high risk external flood scenarios.
This external flood analysis was completed
in August 2005. The licensee realized the new flood elevations
were approximately
three feet higher for each flooding frequency.
Additionally, when the 2003 data was extrapolated
to a 1000-year
flood frequency, the licensee found the 1 OOO-year flood elevation
to be 1010.5 feet MSL. Following
this discovery, the licensee updated the external flood analysis in 2005; however, no corrective
action was written to evaluate the potential
change to the plants design basis or operating
procedures.
Consequently, the 2005 external flood analysis was not mentioned
in the USAR change initiated
in January 2008. Furthermore, the licensee did not develop a corrective
action plan to ensure the design basis and regulatory
compliance
was maintained, as required by corrective
action program. Analysis.
The inspectors
determined
the failure to establish
and maintain adequate procedures
to protect the auxiliary
building and intake structure
to external flood heights between 1008 and 1014 feet MSL is a performance
deficiency.
Specifically, the licensee failed to maintain procedures for
combating
a significant
flood as recommended
by NRC Regulatory
Guide 1.33, Appendix A, Section 6.w, "Acts of Nature." This performance
deficiency
is more than minor because it adversely
affected the Mitigating
Systems Cornerstone
attribute
of external events and affected the
cornerstone
objective
of ensuring the availability
and reliability
of systems that respond to initiating
events to prevent undesirable
consequences.
The inspectors
determined
the finding resulted in the degradation
of equipment
and functions
specifically
designed to mitigate a flooding i_i-f*i,.,,+i
___ ,It' ... _... 1 __ ,..Irli+i
__ ",, __ V'+_ ... __ I +1 __ ......1 __ ... ,.,_III,J -I __ ... _,.l_ oh .. , __ ... --.. ___ ... __ :_ ..... _.t:
CiVCilll.
III aUUILIVII, CUI vAlvfltOI
ItVVU eVC;lll VVVUfU
l,VVV VI IIIUIIf;;J
lIeUlf.::;)
VI a multi-train
safety system. Therefore, the finding was potentially
risk significant
to flood initiators
and a Phase 3 analysis of the significance
determination
process was required. -6 -Enciosure
A Region IV senior reactor analyst performed
the Phase 3 significance
determination.
The preliminary
change in core damage frequency
was calculated
to be 3.1 E-5/year indicating
that the finding was of substantial
safety significance (Yellow).
The risk important
sequence included a station blackout, loss of all dc power, failure of the turbine-driven
auxiliary
pump, and failure of the diesel-driven
auxiliary
pump. Remaining
mitigation
equipment
that helped to limit the significance
included the licensee's
temporary
gasoline powered pump system that can provide makeup water to the steam generators.
The inspectors
determined
the finding has a crosscutting
aspect in the area of problem identification
and resolution, corrective
action program, for failure to take appropriate
corrective
actions to address safety issues and adverse trends in a timely manner, commensurate
with their safety significance
and complexity.
Specifically, from 2003 to 2008, the licensee failed to initiate appropriate
corrective
actions to ensure regulatory
compliance
of the external flood design basis was maintained.
[P.1 (d)] Enforcement.
Technical
Specification
5.8.1.a, "Procedures," states, "Written procedures
and administrative
policies shall be established, implemented, and maintained
covering the following
activities: (a) The applicable
procedures
recommended
in Regulatory
Guide 1.33, Revision 2, Appendix A, 1978." From 1976 to 1978, Fort Calhoun Station established
written procedures
recommended
by NRC Regulatory
Guide 1.33, Appendix A, Revision 1. NRC Regulatory
Guide 1.33, Appendix A, Section 6 recommends
procedures
for combating
emergencies
and other significant
events. Section 6.w, "Acts of Nature" recommends
procedures
for combating
tornado, dam failure, flood, and earthquakes.
Contrary to Technical
Specification
5.8.1.a and NRC Regulatory
Guide 1.33, since 1976, the licensee failed to maintain written procedures
for combating
a significant
flood as recommended
by NRC Regulatory
Guide 1.33, Appendix A, Section 6.w, "Acts of Nature." Specifically, the licensee failed to establish
and maintain station procedures
that adequately
prescribe
steps to mitigate external flooding conditions
in the auxiliary
building and intake structure
between 1008 and 1014 feet mean sea level. The licensee has entered this condition
into their corrective
action program as Condition
Report 2010-2387.
Pending completion
of a final significance
determination, the performance
deficiency
will be considered
an apparent violation, AV 05000285/2010007-
01, "Failure to Maintain External Flood Procedures." 40A6 Meetings Exit Meeting Summary On June 21, 2010, the inspectors
presented
the inspection
results to Mr. J. Reinhart, and other members of the licensee staff. The licensee acknowledged
the issues presented.
The inspectors
asked the licensee whether any materials
examined during the inspection
should be considered
proprietary.
No proprietary
information was identified.
-7 -Enclosure
SUPPLEMENTAL
!NFORMATION
KEY POINTS OF CONTACT Licensee Personnel
H. Faulhaber, Manager, Nuclear Engineering
M. Frans, Manager, System Engineering
J. Gasper, Manager, Design Engineering
D. Guinn, Supervisor, Regulatory
Compliance
A. Hackerott, Supervisor, Risk Engineering
J. Herman, Manager, Engineering
Programs K. Hyde, Supervisor, Design Engineering
T. Mathews, Manager, Nuclear Licensing
E. Matzke, Regulatory
Compliance
T. Nellenbach, Plant Manager J. Reinhart, Site Vice President
D. Trausch, Assistant
Plant Manager NRC Personnel
R. Azua, Senior Project Engineer, Projects Branch E M. Markley, Chief, Plant Licensing
Branch IV-1 J. Wingebach, Resident Inspector, Fort Calhoun Station L. Wilkins, Project Manager, Plant Licensing
Branch IV-1 W. Schaup, Project Engineer, Projects Branch E LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened 05000285/2010007
-01 AV Failure to Maintain External Flood Procedures
(40A5.1) Closed 05000285/2009006-03
URI Failure to Update Flood Protection
of Safety Related Buildings
DOCUMENTS
REVIEWED Section 40A5: Other Activities
PROCEDURES
NUMBER AOP-1 AOP-30 EPIP-TSC-2
Acts of Nature Emergency
Fill of Emergency
Storage Tank Emergency
Plan Implementing
Procedure:
Catastrophic
Flooding Preparations
A1-1 REVISION 23 9 7 Attachment
1
PROCEDURES
NUMBER TITLE REVISION FCSG-24 Corrective
Action Program Guideline
22 GM-RR-AE-1002
Repair-Rework:
Flood Control Preparedness
for Sandbagging
8 OCAG-1 Operation
Contingency
Action Guideline
12 PE-RR-AE-1001
Floodgate
Installation
and Removal 3 TBD-AOP-18
Loss of Raw Water 7 TBD-AOP-19
Loss of Shutdown Cooling 14 TBD-AOP-38
Blair Water Main Trouble 3 CALCULATIONS
NUMBER TITLE CCF-103-048-RPT
External Flooding Analysis CORRECTIVE
ACTION DOCUMENT NAME 200201296
201002387
200302664
MISCELLANEOUS
DOCUMENTS
TITLE Fort Calhoun External Action Plan 200904166
A1-2 August 12,2005 201000225
201002101
DATE April 8, 2010 Attachment
1
PHASE 3 ANALYSIS FAILURE TO PROTECT SAFE SHUTDOWN EQUIPMENT
FROM EXTERNAL FLOODING A senior reactor analyst conducted
a Phase 3 significance
determination
process (SOP) analysis in accordance
with Manual Chapter 0609, Appendix A, "Determining
the Significance
of Reactor Inspection
Findings for At-Power Situations." This Phase 3 SOP represents
a estimate risk evaluation
of the performance
deficiency.
1. SOP Assumptions
a. NRC Manual Chapter 0609, Appendix G, "Shutdown
Operations
Significance
Determination
Process," was not used for this SOP. The appendix stated, in part: "Appendix
G is applicable
during refueling
outages, forced outages, and maintenance
outages starting when the licensee has met the entry conditions
for RHR [residual
heat removal] and RHR cooling has been initiated, and ending when the licensee is heating up and RHR has been secured." [Emphasis
added] Since the initiating
event would occur after RHR was secured by procedure (to prevent a containment
bypass pathway) and the reactor coolant system heated up to Mode 3 conditions, the at-power SOP was used for this case. Further, the finding would have required a quantitative
assessment (Phase 3) irrespective
of which significance
determination
procedure
was used. b. The analyst considered
the increase in risk from flooding for the: * Intake structure:
1008 to 1014 feet mean sea level (MSL). The intake structure
housed raw water pumps (service water pumps). * Auxiliary
building:
1010 to 1014 feet MSL. The auxiliary
building was the primary risk driver. Most of the equipment
that was negatively
impacted by the performance
deficiency
was located in the auxiliary
building -emergency
diesel generators, safety related switchgear, auxiliary
pumps (basement), safety injection
pumps, etc. c. The performance
deficiency
did not impact flooding of the turbine building.
The licensee did not protect the turbine building above 1009.5 feet MSL by procedure.
The safety related diesel-driven
auxiliary
pump was located in the basement.
d. Dam failures were not a factor in the performance
deficiency, but could flood the site to well above 1014 feet MSL. Flooding frequencies
above 1014 feet MSL (Technical
Specification
Bases 2.16 specified
elevation)
were not considered.
e. The performance
deficiency
existed for many years. Therefore, in accordance
with Manuai Chapter 0609, Appendix A, Attachment
oj, Usage Ruie i:i, "Exposure
Time," the analyst determined
that the exposure period was one year. f. When the auxiliary
building, turbine building and intake structure
were assumed lost, the conditional
core damage probability (CCDP) was 1.0. This was expected because all A2-1 Attachment
2
normal plant equipment
was assumed failed by the floodwaters.
This did not include credit for the portable gasoline powered pumps to refill the steam generators.
A correction
to account for gasoline-powered
pump failure was addressed
separately.
Consequently, the SOP reduced to: (1) the flooding frequencies;
(2) the gasoline powered pump system failure probability;
and (3) comparison
to the baseline risk assuming a 10 percent probability
that the sandbagging
protection
failed. g. A fault tree to estimate the failure probability
for the gasoline-powered
pumps was constructed
and solved using the simplified
plant analysis risk (SPAR) model. After flooding greater than 1010 feet MSL, the gasoline powered pumps would be the only equipment
available
to provide makeup water to the steam generators.
The fault tree assumed: III Both pumps must function for the action to be successful.
III Human error probabilities
associated
with installing
the gasoline powered pump system were evaluated
using NUREG/CR 6883, "The SPAR-H Human Reliability
Analysis Method," August 2005 (Attachment
3). From this evaluation, the
analyst inserted a human error probability
basic event into the system fault tree. The SPAR-H worksheets
were broken up into two sections, a "diagnosis" section and an "action" section. The diagnosis
section evaluated
the probability
that operators
would fail to diagnose the problem, such that mitigating
actions would not be taken. The action section estimated
the probability
that operators (or craftsmen)
would fail to successfully
install and operate the system.
II The analyst assumed that operators
would properly diagnose the flood.
- The "action" portion of the SPAR-H worksheet
was much more difficult
to perform and the probability
of failure was over-riding (when compared to the diagnosis
portion).
III The analyst used the licensee's
estimates
for gasoline pump failure probability.
- Other basic components
that would have very low failure probabilities, such as manual isolation
valves, were not included in the fault tree. III The action to obtain sufficient
fuel for long-term
pump operation
was not modeled. While the licensee had a procedural
step that instructed
personnel
to obtain gasoline, no other specifics
were provided.
The pumps' gasoline consumption
was not readily known and the exact methods that might be used to obtain gasoline were unclear. Gasoline was on-site, located in an above ground tank at the 1 004-foot elevation;
however, flooding may make the tank inaccessible (it could float away). Nonetheless, the analyst assumed that plant personnel
could obtain sufficient
gasoline without undue difficulty.
A2-2 Attachment
2
h. The licensee's
Individual
Plant Examination
of External Events (page 5-23) contained
the following
assumptions.
The second, third and fourth table columns specified
the assumed failure probabilities
for equipment
located in the buildings:
Elevation
Intake Turbine bldg Aux bldg (ft MSL) 1007.5-1009.5
0 0 0 1009.5-1010.8
.01 .05 0 1010.8-1012.3
.1 Lost .1 1012.3-1013.5
.9 Lost f"\ .::3 Notes: i. The licensee had assumed a sandbagging
failure probability
of 0.9 for flood elevations
between 1012.3 and 1013.5 feet MSL. The analyst considered
this assumption
unreasonable
for use in a base case evaluation.
A base case evaluation
is an assessment
of the baseline risk, assuming that no performance
deficiency
occurred.
If the performance
deficiency
did not exist, the licensee should have had a high level of assurance
that mitigating
actions (sandbagging)
would be successful.
For the purpose of this analysis, the sandbagging
base case failure probability
was assumed to be 0.1 when flood waters were above 1010.8 feet MSL. ii. A current case evaluation
is a risk estimate that includes the performance
deficiency.
The current case evaluation
assumed that the sandbagging
failed at 1008 feet MSL at the intake structure
and at 1010 feet MSL at the auxiliary
building.
The delta-core
damage frequency (CD F) was the difference
between the base case and current case risk evaluations.
2. Calculation
of Increase in CDF a. Equipment
lost because of the performance
deficiency:
The analyst identified
the risk important
pieces of equipment
and when they would fail. This was accomplished
by reviewing
site procedures
and interviewing
licensee personnel.
Elevation
{feet MSL} Performance
ImQact 1007.5 -Intake Structure
Floor Some water leaks into intake structure.
Sandbag berms within the building should limit the affect of short duration crests. The analyst assumed that significant
flooding would occur at 1008 feet MSL. 1008 -Loss of offsite power (LOOP) and Loss of all four raw water pumps. loss of intake structure
due to flooding (The LOOP was unrelated
to the I performance
deficiency).
A2-3 Attachment
2
Elevation ,feet MSL} Performance
Im12act 1009.5 -Top of auxiliary
building floodgates
Flooding starts in auxiliary
building, and turbine building sandbags.
The diesel-turbine building and technical
support driven auxiliary
pump was located center above 1009.5 feet MSL. The in turbine building basement.
All other analyst assumed that small crests remaining
equipment (other than the above 1009.5 feet MSL would not gasoline-powered
pumps) was located in the result in substantial
flooding in the auxiliary
building (pumps in the basement).
buildings.
1010 -0.5 feet above floodgate
All remaining
normal plant equipment
lost because of the performance
deficiency.
1011 -Level when procedures
estimate that floodwaters
spill into emergency
diesel generator
rooms (assuming
drains are appropriately
plugged).
The building structure
prevents water from entering at lower elevations.
However, switchgear
is already lost. b. Base case and current case CCOPs: The analyst calculated
the base and current case CCOPs using the Fort Calhoun SPAR model, Revision 3.45, assuming a truncation
limit of 1 E-13. This portion of the analysis did not credit the gasoline-powered
pumps, as the SPAR model did not include the pumps. The gasoline-powered pumps were
factored into the final SOP by use of a separate fault tree (Attachment
6). * Base case CCOP for each flood elevation:
Assuming no performance
deficiency
and no credit for gasoline-powered
pumps. Credit for the gasoline powered system was provided later in this SOP: Elevation{ft
MSL} CCDP Egui(;!ment
Lost l Increased
1008-1009.5
1.017E-3 Non-recoverable
LOOP initiating
event 1009.5-1010.8
1.046E-3 Non-recoverable
LOOP initiating
event Probability
of raw water pump failure (.01), Probability
of diesel driven auxiliary
pump failure (.05) 1010.8-1014
1.1 E-1 Non-recoverable
LOOP initiating
event; Probability
of raw pump failure (0.1), Probability
of diesel driven auxiliary
pump failure (1.0), Probability
of emeraencv
diesel aenerator
failure (0 1) _ J _ '-" Probability
of auxiliary
pump failure (0.1) A2-4 Attachment
2
3 Current case CCOP for performance
deficiency
elevations:
No gasoline pumps were provided in this step. Increased
failure rates because of the performance
deficiency
are in bold: Elevation{ft
MSL} CCDP
Lost z Increased
Probabilit1!
1008 -1010 1.25E-3 Non-recoverable
LOOP, Probability
of diesel driven auxiliary
pump failure (.05). Probability
of raw water pump failure (1.0) 1010 -1014 1.0 Non-recoverable
LOOP; Probability
of diesel driven auxiliary
pump failure (1.0), Probability
of 4kV switchgear
failure (1.0), Probability
of all auxiliary
pumps failing (1.0) c. Calculation
of Increase in COF: To obtain consistent
elevation
bins for analysis, the above bins must be broken up further. The frequency
for a given elevation
bin (A) was the difference
in the frequency
of exceedance
between the upper and lower bin elevation
limits. Delta CDF = 2:: Abin * (CCDP current -CCDP base) * P gas pump fail Elevation
{ft A CCDP CCDP base P gas HumH fail Delta Time After MSL) current CDF/bin 1004 ft MSL* 1008-1009.5
3.2E-3/yr
1.25E-3 1.017E-3 2.56E-2 1.9E-8/yr
30 hrs 1009.5-1010
4E-4/yr 1.25E-3 1.046E-3 2.56E-2 2.1 E-9/yr 41.25 hrs 1010-1010.8
8E-4/yr 1.0 1.04E-3 2.56E-2 2E-5/yr 45 hrs 1010.8-1014
5E-4/yr 1.0 1.1 E-1 2.56E-2 1.1 E-5/yr 51 hrs to 75 hrs Total 3.1E-5/yr
- Based on licensee's
flood level increase rate of 4ft/30 hours 3. Sensitivit1!
Cases a. Operator can prevent intake structure
flooding until 1010 feet MSL. This would assume that an operator could successfully
maintain intake structure
level, using raw water pumps and sluice gates, to prevent water from flooding through the traveling
screen discharge
trench. This had little impact on the SOP results. The first two delta-COF
A2-5 Attachment
2
elevation
bins capture this aspect of the assumed event. Setting both to zero would reduce the de!ta-CDF
by about 2E-B/yr. b. Flooding freguencies
differ by significant
amounts. The uncertainty
with the flooding frequencies
was high. The licensee used the shape of the flooding frequency
curve at another station (Cooper Nuclear Station) and applied it to the Fort Calhoun Station flooding frequencies
that were provided by the United States Army Corps of Engineers.
The Army Corps of Engineers
only provided information
out to the 500-year flood (2E-3/year).
The licensee extrapolated
the remainder
of the information.
Almost all of the calculated
risk was in the extrapolated
region. To address this uncertainty, the analyst assumed that the Army Corps of Engineers
data was correct but the extrapolated
information
could vary significantly, either higher or lower. For the sensitivity
cases, the analyst targeted the flooding
elevation
at the 1 E-5/year point for comparison.
At the 1 E-5/year point on the Fort Calhoun flood hazard curve, the flood level was 1013.5 feet MSL. The analyst then constructed
alternate
curves, two above and two below this base curve. The curves are shown in Attachment
4. The curves were numbered Case 1 through Case 5. Case 3 was the licensee's
estimate and was considered
the best available
information
for this assessment.
Using data from the 5 curves, the analyst generated
a delta-CDF
for each case. The analyst summarized
the results below: Delta-CDF
by Sensitivity
Case Case 2 Case 5 2.5E-5/year
3.5E-5/year
- Licensee
assumptions
It's important
to note that Case 1 may be unrealistically
low. After almost 100,000 years of additional
exposure, the flood elevation
at the1 E-5/year point was a little over 1 foot above that predicted
by the Army Corps of Engineers
at the 1/500 year point. Likewise, Case 5 may be unrealistically
high. The plotted line deviates from the Army Corps of Engineers'
estimates
at a sharper angle. c. Alternate
Method of Refilling
Essential
Tank (SPAR-H 2, Attachment
3): The licensee proposed an alternate
method for refilling
the essential
tank. The offsite fire water tank (at a higher elevation
across the highway) could be used to refill the essential
tank. The advantage
of using this tank was that the reliance on the gasoline-powered
pumps would be reduced. Instead of requiring
that both gasoline powered pumps remain functional (one to fill the steam generators
and one to refill the essential
storage tank), the licensee could have one pump fail and still satisfy the steam generator
makeup function.
The alternate
fill method required operators
to attach a fire hose between fittings that could be used to connect the two tanks. It also required that the licensee have water trucks periodically
refill the firewater
tank. The procedure
that drove these actions was normally performed
following
a loss of the Blair water supply. The procedural
steps to use the firewater
tank to refill the essential
storage tank would be implemented
after other sources of water became unavailable (it was the last option on the list). The floodwater
was expected to eliminate
the following
water sources, as A2-6 Attachment
2
specified:
(1) demineralized
water system (1008 feet MSL); (2) condensate
storage tank (1008 feet MSL); (3) Blair water (1007 feet MSL); (4) the diesel-driven
auxiliary
pump (1009.5 MSL); and (5) the on-site plant fire water system (1008 feet MSL). Therefore, operators
would not likely initiate these actions until the 1009.5-foot
elevation.
At this flood level, two of the components
that would require connection (with a fire hose) would be under water. To evaluate the scenario, the analyst adjusted the gasoline power pumps system fault tree so that a failure of both fire pumps would be needed to fail the system (not just one pump). The analyst added a new basic event to account for the human error probability
for the new manual actions. The analyst also made other adjustments
to model use of the firewater
tank. The adjusted fault tree is shown in Attachment
6, second fault tree. As shown in the SPAR-H worksheet (Attachment
3, SPAR-H-2)
the assumptions
for the new human error probability
included nominal available
time, high stress (fittings
hard to find and work under water), moderate complexity, low experience (connecting
fittings under water), nominal procedures, missing/misleading
ergonomics (location
of fittings under water), nominal fitness for duty, and nominal work processes.
Instead of a failure probability
of 2.56E-2 for
the failure of the gas pump system, a failure probability
of 1.3E-2 was generated.
This would reduce the overall delta-COF
by a factor of two. The resultant
delta-COF
was 1.5E-5/year.
However, since the challenge
of locating and manipulating
components
under water invoked large uncertainties, this action was not credited in the SOP. d. Use of Tabletop Generated, Non-Procedural
Actions: The licensee asked the NRC to credit non-proceduralized
actions that were identified
during a tabletop exercise (installing
metal plates over auxiliary
building doorways).
The licensee's
probabilistic
risk assessment
team had not credited this action in an analysis themselves.
In response to the finding, the licensee conducted
a tabletop exercise to determine
what actions might be specified
by the technical
support center during a simulated
flood. The tabletop team determined
that metal plates could be installed
over auxiliary
building doors (on the water side). They specified
that thick metal plates would be needed (3/4" to 1" thick), that craftsmen
would weld supporting
structures
to the plates and that the plates would be secured, but not welded, to the outside of the doorways.
The analyst noted that it was unclear if the actions would work, and they could cause failure of existing flood barriers before
1 009.5 feet MSL (the leak tight floodgates
and sandbag berms would have to be removed).
The NRC's "Risk Assessment
of Operational
Events Handbook," Revision 1.03, Section 6.3.2 stated, in part: In general, no recovery or repair actions should be credited where ... there is no procedure
or training.
It may be possible to justify exceptions
in unique situations, such as a procedure
is not needed because the recovery is skill of the craft. .. Still, the analyst used the SPAR-H method to evaluate the action. The SPAR-H worksheet (see Attachment
3, SPAR-H-3)
documented
that the failure probability
was very close to 1.0. To implement
the proposed actions, craftsmen
would need to construct
and erect about 10 covers for doors, including
some double doors and at least one rollup door. The licensee did not have an adequate supply of the thick plates on site to cover all of the doors. However, an abundant supply of thinner plates, some 3/8-inch A2-7 Attachment
2
thick and other rough deck plate material, were available.
The yard that housed the plates was outdoors and the ground was covered with gravel, not asphalt (1005 feet MSL). The technical
support center was not manned until floodwaters
were near the yard elevation
(1004 feet MSL); therefore, floodwaters
may already be in the yard before meaningful
recommendations
could be made. If floodwaters
entered the yard, getting the plates to a location to support cutting and welding may be difficult.
There were experienced
welders onsite, but only three welding machines were available
that could be operated on the three available
portable electric generators.
A loss of offsite power was expected at 1008 feet MSL. Cutting the
plates to size would require a cutting machine that may not be available
after a loss of offsite power. No method was specified
for installing
the plates, but the team determined
it was necessary
to install them on the water side of the doors (to let the water pressure help keep them in place). To do this, at least some floodgates
would likely need to be removed. The tabletop team specified
that they would not weld the plates to the doorways.
The current floodgates
had rubber seals (some inflatable)
to help prevent leakage, while the new plates would not have this feature. This would introduce
a new failure mechanism
not previously
considered (substantial
leakage past a plate at an elevation
below 1009.5 feet MSL). Flood projections
often change and are rarely accurate.
If the flood projections
started out below 1009.5 feet MSL and then increased, floodwaters
may be upon the floodgates (and sandbag berms) already, making removing them unmanageable.
The bottoms of some auxiliary
building floodgates
sat at approximately
1007 feet MSL. Large sandbag berms would need to be removed from several doors. Alternate
Evaluation:
The analyst also performed
an alternate
evaluation (Attachment
3, SPAR-H-3, Method 2), assuming that the licensee could be successful
installing
plates over auxiliary
building doors 50 percent of the time. Assuming this chance of success, however, the delta-COF
would be reduced by a factor of two. No formal credit was provided in the SOP. 4. Large Early Release Frequency (LERF): Nominally, for large dry containments, the delta-LERF
was less than 0.1 times the COF. However, the loss of all control room indications
would make it more difficult
to obtain the information
needed to insure a timely public evacuation.
The NRC processes
to evaluate delta-LERF
were not well suited for this finding. The analyst consulted
with a LERF expert in the Office of Nuclear Reactor Regulation.
The expert indicated
that because of the large dry containment, and the relatively
large pressure failure rating of containment, that a large amount of time would be available
to evacuate the public. The analyst then spoke with regional emergency
preparedness
experts and found that the licensee had alternate
means to identify core damage (radiation
levels outside of containment).
Further, the analyst reviewed Fort Calhoun Emergency
Classification
levels and noted that a general area emergency
would be declared if -"conditions
exist which in the judgment of the command and control position warrant declaration
of a General Emergency." In conclusion, the analyst qualitatively
determined
that the color of the delta-LERF
would not exceed that associated
with the estimated
delta-COF.
A2-8 Attachment
2
SPAR-H WORKSHEETS
1. SPAR-H-1 Refill Steam Generators
Using Gasoline Puml2s
Performance
Shal2ing Diagnosis
Action Factor PSF Level Mult i l2 li er PSF Level Mult i l2lier Time Expansive
0.01 >5 times required 0.1 Stress Nominal 1.0 High 2.0 Complexity
Nominal 1.0 Moderate 2.0 Experience
Nominal 1.0 Nominal 1.0 Procedures
Nominal 1.0 Nominal 1.0 Ergonomics
Nominal 1.0 Poor 10.0 Fitness for Duty Nominal 1.0 Nominal 1.0 1W0rk Processes
Nominal 1.0 Nominal 1.0 Nominal Base 1.0E-2 PSFs 1.0E-2 4.0 frotal 1.0E-4 4E-3 Failure Probability
4E-3 Justifications
for Action (over-riding), only items that del2arted
from nominal: Time: Greater than 5 times necessary.
The river was expected to rise at a rate of four feet in 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The licensee would expect an approximate
two-day notice of a river crest at 1009 feet MSL or higher, assuming that the licensee started taking actions at 1000 feet MSL and received early warning of the coming flood. The analyst assumed that the turbine building would be flooded at approximately
1009.5 feet MSL. Plant personnel
should start installing
the gasoline powered pump system when the Army Corps of Engineers
projects flooding at or above 1009 feet MSL. The procedure
for installing
the system was detailed, all of the equipment
was staged, and plant personnel
should be able to assemble the equipment
in less than one shift without much difficulty.
Testing of one pump could only be accomplished
after the floodwaters
enter the turbine building.
While this would occur after the loss of offsite power, the operators
should have substantial
time before the essential
storage tank emptied. Stress: High. Once installed, operation
of the gasoline pump system would rely on alternate
methods of measuring
water level. Operators
could either use a portable instrument
to determine
water level or overfill the steam generators
and wait a given amount of time before the next filling evolution.
The turbine building would be dark and uncomfortable.
Tho
\hI{"\1 II'; nt=>t=>,;
t() ht=> rt=>fillt=>,;
- Ie: \J\It=>1I
Thp nllmn t() *** -----..... -** __ .........
_ .. _ *............
-::::1 ...... _ .....
.* _--"'---.-*..* _-----_ **.**. -r--****I refill this tank must be located close to the floodwaters.
When floodwaters
increase, the pump would need to be moved to a higher elevation.
Failure to do so could cause the gasoline engine to fail. The reliance on this temporary
system to prevent core damage, A3-1 Attachment
3
with minimal indications
of reactor coolant system or containment
conditions, would contribute
to the stress level. Complexity:
Moderately
complex. Craftsmen
would need to remove piping flanges and install new components
that were manufactured
to fit into the piping locations, which may be difficult.
Some of the pieces were heavy. At approximately
1008 feet MSL, the plant would experience
a loss of offsite power and the turbine building would lose artificial
lighting and normal electrical
power. While the system could be installed
into position earlier, the system would need to be filled and tested to ensure that the pumps were not vapor-locked.
The pump that was to refill the essential
storage tank would take suction from the floodwaters, which would not enter the turbine building prior to the loss of offsite power. Operators
would need to ensure that the pump was sufficiently
close to the water level to allow for proper suction and filling. Ergonomics:
Poor. The analyst determined
that the ergonomics
for implementing
Procedure
PE-RR-AE-1002, "Installation
of Portable Steam Generator
Makeup Pumps," Revision 2, were "Poor." For system startup and subsequent
operation, operators
and maintenance
personnel
would be working under emergency
lighting conditions
or possibly in the dark. Workers would complete their tasks around and in flood waters. Operations
would involve routine handling of gasoline.
No procedural
steps were provided to instruct the operators
how to obtain or where to store the gasoline, so these actions would need to be developed.
Operators
would periodically
need to tend the system to start and stop it, depending
on the level in the steam generators.
indication
was available
at the location.
level indication
was available
at another location using a portable instrument.
2. SPAR-H-2 Connecting
Fire Hose Between Firewater
Tank and Essential
Tank Performance
Diagnosis
Action Shaeing Factor PSF Level Multielier
PSF Level Multielier
rnme Nominal 1.0 Nominal 1.0 Stress Nominal 1.0 High 2.0 Complexity
Nominal 1.0 Moderate 2.0 Experience
Nominal 1.0 Low 3.0 Procedures
Nominal 1.0 Nominal 1.0 Ergonomics
Nominal 1.0 Missing/Misleading
50.0 Fitness for Duty Nominal 1.0 Nominal 1.0
Processes
Nominal 1.0 Nominal 1.0 Nominal Base 1.0E-2 1.0E-3 [i-'::it-s
[ 1.0[ 600
1.0E-2 3.7E-1 Failure Probability
3.7E-1 A3-2 Attachment
3
Justifications
for Action (over-riding), only items that departed from nominal:
Stress: High. This action was expected to occur after floodwaters
had entered portions of the site. The procedure
that drove the action was used after other water sources were depleted, after floodwaters
reached 1009.5 feet MSL. The floodwater
was expected to fail the demineralized
water system at 1008 feet MSL, condensate
storage tank at 1008 feet MSL, the Blair water system at 1007 feet MSL, the diesel-driven
auxiliary
pump at 1009.5 feet MSL, and the plant fire water system at 1008 feet MSL. The action would align an outbuilding
fire water tank up to the essential
storage tank via a fire hose and a connection
point on each system. Both connection
points would likely be submerged
and could be difficult
to locate. Concerns about personal safety would also contribute
to the stress level. Complexity:
Moderately
complex. Under normal plant conditions, the action would not be complex. Having floodwaters
cover needed connection
points makes the task much more difficult.
Experience:
Low. This action was not normally performed
by plant personnel
on a routine basis. The action of finding connection
points below the water level and then connecting
the fire hoses was not practiced.
Even very experienced
craftsmen
may have difficulty
accomplishing
this task. Ergonomics:
Missing/Misleading.
Needed information, labeling and location of the valves and connections, would be difficult
to obtain for components
under water. 3. SPAR-H-3 Construct
and Install Steel Plates to Cover Auxilia!y
Building Doors Performance
Diagnosis
Action Sha!;!ing
Factor PSF Level Multil2lier
PSF Level Multi!;!lier
Time Not evaluated
If= time required 10 (actually
may not have sufficient
time) Stress Not evaluated
High 2.0 Complexity
Not evaluated
High 2.0 Experience
Not evaluated
Low 3.0 Procedures
Not evaluated
Not Available
50.0 Ergonomics
Not evaluated
Missing/Misleading
50.0 Fitness for Duty Not evaluated
Nominal 1.0 lWork Processes
Not evaluated
Nominal 1.0 INominal Base I
I 1.0E-3 1 PSFs 300,000' I
9.9E-1 .991 A3-3 Attachment
3
Justifications
for Action (over-riding), only items that departed from nominal: Time: Equals time required.
This action was determined
by a tabletop exercise after the issue was identified.
The licensee wanted to demonstrate
that the emergency
response organization
could develop an acceptable
method to protect safe shutdown equipment
under extreme flooding conditions.
The analyst interviewed
the tabletop team members. The members had varying levels of knowledge
regarding
NRC identified
flooding concerns;
most knew about a flooding seal issue (not part of this performance
deficiency).
A few were aware that the NRC had concerns with the plant's ability to cope with more significant
floods. The exercise lasted about 90 minutes, During the initial portions of the exercise, flooding projections
were within those addressed
by plant procedures.
No additional actions
were developed
by the team during this phase. Then the scenario changed such that the projected
flooding level was 1017 feet MSL. This was outside of the existing procedural guidance
for a flood (other than the action to stack sandbags on top of the floodgates).
The team determined
that stacking sandbags on top of the floodgates
would not work because the narrow ledge of the floodgates
did not allow construction
of a leak tight barrier to 1017 feet MSL. The team identified
the following
additional
mitigation
strategy:
Fabricate
and install steel plates in front of all of the auxiliary
building doors. The team specified
that they would not weld the plates over the door openings but would fasten the plates in place. They were not confident
that the doorframes
would support welding. The team would have plant personnel
weld supporting
structures
to the plates themselves
for stability.
The plates would be cut to size for all of the auxiliary
building doorways and some plates would be welded together to cover rollup doors. They believed that they needed %-inch to 1-inch thick steel plate
for the task. They did not take the simulation
further. Analyst Assessment:
These actions were modeled using SPAR-H and the calculated
failure probability
was close to 1.0. However, no credit was provided in the SOP because it was not clear that the actions would work and the NRC's "Risk Assessment
of Operational
Events Handbook," Revision 1.03, Section 6.3.2 stated, in part: In general, no recovery or repair actions should be credited where ... there is no procedure
or training.
It may be possible to justify exceptions
in unique situations, such as a procedure
is not needed because the recovery is skill of the craft. .. In addition, a different
group of individuals
in the technical
support center at the time of an actual flood might specify different
recommendations.
Craftsmen
'Nould need to construct
and erect about 10 covers for doors, including
some double doors and at least one rollup door. The licensee did not have an adequate supply of the thick plates on site to cover all of the doors. However, an abundant supply of thinner piates, some 3i8 inch thick and other rough deck piate materiai, were available.
The yard that housed the plates was outdoors and the ground was covered with gravel, not asphalt (1005 feet MSL). The technical
support center was not manned until floodwaters
were near the yard elevation
(1004 feet MSL); therefore, floodwaters
could be in the yard before meaningful
recommendations
could be made. If floodwaters
A3-4 Attachment
3
entered the yard, getting the plates to a location to support cutting and welding may be difficult.
Experienced
welders were onsite, but only three welding machines were available
that could be operated on the three available
portable electric generators.
A loss of offsite power was expected at 1008 feet MSL; cutting the plates to size would require a cutting machine that would not likely be available
after a loss of offsite power. No method was specified
for installing
the plates, but the tabletop team determined
it was necessary
to install them on the water side of the doors, to utilize the water pressure to keep them in place. To do this, some floodgates
would likely need to be removed. The floodgates
had rubber seals, some inflatable, to help prevent in-leakage.
The new plates would not have this feature. This could introduce
a new failure mechanism
not previously
considered (substantial
leakage past a plate at an elevation
below 1009.5 feet MSL). Flood projections
often change and are rarely accurate.
If the flood projections
started out below 1009.5 feet MSL and then increased, floodwaters
may be upon the floodgates
and sandbag berms, making removal of floodgates
and berms unmanageable.
The bottoms of some auxiliary
building floodgates
sat at approximately
1007 feet MSL. Large sandbag berms would need to be removed from several doors. The analyst had asked the licensee to demonstrate
the site's capability
to erect and install a steel panel over a representative
door, preferably
the rollup door. However, at the time the significance
determination
was issued, the licensee had not performed
a demonstration.
Based on the above, the analyst determined
that the time required for the action was the same as that available.
Stress: High. The stress encountered
by the workforce
would be high. The welders and other craftsmen
would not likely know that core damage could be imminent if they did not succeed. Nonetheless, the time pressure on the staff would be significant.
In addition, struggling
to complete the task with floodwaters
already on site and with limited resources
would add to the pressure.
Complexity:
High. With no procedural
guidance, the craftsmen
would have to devise strategies
on their own to fabricate
and install the plates. Interference
with floodgates
and sandbag berms would also create obstacles.
Experience:
Low. No personnel
on site would have sufficient
experience
with this task. Welders would be experienced
at welding, but the overall task was much more complex. Procedures:
Not available.
No procedures
were available.
Ergonomics:
Missing/Misleading.
Craftsmen
would likely have to install the new plates over the doorways while the site was at least partially
flooded. At night, it would be dark, if offsite power was lost, and floodwaters
would present a hazardous
condition.
Obtaining
the construction
materials
under flooded conditions
couid be difficuii.
and iarge heavy machinery
may not work in the steel plate storage area. A3-5 Attachment
3
4. Method 2 Alternate
Evaluation:
This method was not part of the NRC's normal processes
for evaluating
the success of operator actions. The analyst assumed that the licensee could protect the auxiliary
building from floods between 1009.5 and 1014 feet MSL by the alternate
means described
above 50 percent of the time. This assumption
would reduce the delta-COF
associated
with the performance
deficiency
by a factor of 2.0. Since this method was outside the NRC processes, no formal credit was provided in the SOP. A3-6 Attachment
3
FLOODING FREQUENCY
SENSITIVITY
1. Flooding frequencies
differ by significant
amounts. The uncertainty
with the flooding frequencies
was high. The licensee used the shape of the flooding frequency
curve at another station (Cooper Nuclear Station) and applied it to the Fort Calhoun Station flooding frequencies
that were provided by the United States Army Corps of Engineers.
The Army Corps of Engineers
only provided information
out to the 500-year flood (2E-3/year).
The licensee extrapolated
the remainder
of the information.
A!most a!! of the ca!culated
risk was in the extrapolated
region. To address this uncertainty.
the analyst assumed that the Army Corps of Engineers
data was correct but the extrapolated
information
could vary significantly.
either higher or lower. For the sensitivity
cases, the analyst targeted the flooding elevation
at the 1 E-5/year point for comparison.
At the 1 E-5/year point on the Fort Calhoun flood hazard curve, the flood level was 1013.5 feet MSL. The analyst then constructed
alternate
curves, two above and two below this base curve. The Curves are shown on the following
page. The curves were numbered Case 1 through Case 5. Case 3 was the licensee's
estimate and was considered
the best available
information
for this assessment.
Using data from the 5 curves, the analyst generated
a delta-CDF
for each case. The analyst summarized
the results below: Delta-CDF
by Sensitivity
Case Case 2 Case 3* 2.5E-5/year
3.1 E-5/year *Licensee
assumptions
It's important
to note that Case 1 may be unrealistically
low. After almost 100,000 years of additional
exposure, the flood elevation
at the1 E-5/year point was a little over 1 foot above that predicted
by the Army Corps of Engineers
at the 1/500 year point. Likewise, Case 5 may be unrealistically
high. The plotted line deviated from the Army Corps of Engineers'
estimates
at a sharper angle. A4-1 Attachment
4
Frequency
Extrapolations
-Height versus Logarithm
of Flood Frequency
Excedance
1.00E-06 1.00E-OS LOOE-04 LOOE-03 1.00E-02 LOOE-Ol Case 3 was the best estimate case specified
by the licensee.
1019 1018 1017 1016 1015 1014 1013 1012 1011 1010 1009 ............
Corp Data 1008 lie Extrap 1007 2
C;)SC S 1004 1003 1002 1001 1000 999 7 996 995 LOOE+OO Cases 1 and 2 were sensitivity
cases that assumed that the licensee's
best estimate was overly conservative.
Cases 4 and 5 were sensitivity
cases that assumed that the licensee's
best estimate was non-__ " ____ "_J..! ** _ IjUII:::.tl
VCllIVt. A4-2 Attachment
4
SIGNIFICANCE
DETERMINATION
PROCESS COMBINATIONS
Target Case (Best Estimate)
Licensee's
extrapolated
flood frequencies
No credit for alternate
essential
tank filling method (components
under water) No credit for placing panels over doors (in accordance
with SPAR-H) Credit for gasoline powered pump system (without alternate
filling method) De!ta-CDF
= 3.1 E-5 -Yellow Best Case Assumptions
Best Case: flood frequency
Best Case: alternate
essential
tank fill (Attachment
3, SPAR H) Best Case: alternate
actions to place panels over doors (Failure probability
= 50 percent, Not Using SPAR-H) I Delta-CDF
= 4E-6 * 0.5 * 0.5 = 1 E-6 -White Worst Case Assumptions
Worst Case Flood Frequency
No Credit for alternate
essential
tank filling method No Credit for placing alternate
panels over doors Credit for gasoline powered pump system (without alternate
filling method) Delta-CDF
= 3.5E-5 -Yellow Target Case + 50 percent Credit for Placing Panels on Doors Delta-CDF
= 1.5E-5 -Yellow Target Case + Credit for Alternate
Essential
Tank Fill Licensee's
extrapolated
flood frequency
Credit for alternate
tank filling procedure
No credit for placing panels over doors Delta-CDF
= 1.5E-5 -Yellow Target Case + Credit for Alternate
Essential
Tank Fill + 50 percent Credit for Placing Panels on Doors A5-1 Attachment
5
Licensee's
extrapolated
flood frequency
Credit for alternate
tank filling procedure
50 percent credit for placing panels over doors Delta-CDF
= 7.5E-6 -White AS-2 Attachment
5
[ EFW*CDp*CCF*RUN*1*4
o-b o 0 EFW*GDP*SSFS*BF
EFW*GDp*FS*1A
ADDITIONAL
FAULT TREES Fault Tree 1 Gasoline Powered Pump System o PORTABLE D D o EFW*XHE*PORTABLE
EFW *GDp*IylECH
o EFW*GDp*CCF*START EFW*GDp*CCFR*BF
EFW*GDp*FR*IA
A6-1 a PUMp*1 A*FA1lS ot o 0 EFW*GDp*FR*1
A EFW*GDP*FS*1A PL Mp*1 B*FA1LS 0----0 EFW*GDp*FR*1B
EFW*GDp*FS*JB
Attachment
6
Fault Tree 2 Gasoline Powered Pump System with Essential
Storage Tank Refill from Firewater
Tank 9 POR1ABU, I 9-9 TANK-AND-PUNI'S-FAIL
EFW-GOP-MECH
I g-9 EFW-XIJE.FIREW
fUER GAS-PUMPS-FAIL
PUMP-IJ3..FAILS
I 9 Tr 9 9 I 9
I'FWGCP-FR-l
J3 HWGCP-FS-lB
99 EFW-GCP-FR-IA
EFW-GCP-IOS-IA
A6-2 9 EIW-GOP-CtT-START
I 9
g--9 EFW-GCP.sSFS-J3F
EFW-GCP-FS-I
A EFW-Gll'-CCTR-BF
EFW-GCP-FR-IA
EFW(;CP-FR-l
A Attachment
6