IR 05000285/2011014

IR 05000285-11-014; on 09/12/2011 - 02/29/2012; Fort Calhoun Station; Special Inspection; Violations of 10 CFR Part 50, Appendix B, Criterion III and Criterion Xvi, and License Condition 3.D Were Identified

ML12072A128
Person / Time
Site:	Fort Calhoun
Issue date:	03/12/2012
From:	Anton Vegel Division of Reactor Safety IV
To:	Bannister D Omaha Public Power District
References
EA-12-023, FOIA/PA-2013-0250 IR-11-014
Download: ML12072A128 (90)

Text

UN IT E D S TA TE S NUC LEAR RE GULATOR Y C OM MI S SI ON R E G IO N I V 1600 EAST LAMAR BLVD AR L I NG TO N , TE X AS 7 60 1 1 - 4511 March 12, 2012 EA-12-023 David J. Bannister, Vice President and Chief Nuclear Officer Omaha Public Power District Fort Calhoun Station FC-2-4 P.O. Box 550 Fort Calhoun, NE 68023-0550 Subject: FORT CALHOUN STATION - NRC SPECIAL INSPECTION REPORT 05000285/2011014; FINDING OF PRELIMINARY HIGH SAFETY SIGNIFICANCE

Dear Mr. Bannister:

On February 29, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed a reactive inspection pursuant to Inspection Procedure 93812, Special Inspection, at your Fort Calhoun Station in response to a fire in the safety-related 480 Vac electrical distribution system. The enclosed inspection report documents the inspection results, which were discussed on February 29, 2012, with you and other members of your staff.

The special inspection commenced on September 12, 2011, in accordance with NRC Management Directive 8.3, NRC Incident Investigation Program, and Inspection Manual Chapter 0309, Reactive Inspection Decision Basis for Reactors, based on the initial risk and deterministic criteria evaluation made by the NRC on September 7, 2011. The special inspection reviewed the circumstances surrounding the fire that resulted in a loss of power to six of nine safety-related 480 Vac buses and the resulting declaration of an Alert which occurred on June 7, 2011. The inspection also examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. At the time of the fire, the plant was in cold shutdown and had declared a Notice of Unusual Event due to flooding along the Missouri River. When immediate response measures were taken for the fire, plant operators exited the Alert and returned to the Notice of Unusual Event condition. As a result of impacts to the site from the flood and because the plant remained safe and stable in cold shutdown, the NRC delayed conducting the special inspection to avoid diverting necessary resources from the ongoing flooding event and mitigation efforts. During the fire event discussed in this report the reactor remained in a safe and stable condition.

The enclosed inspection report documents the preliminary results of the inspection, including a finding involving deficient modification and maintenance of the safety-related 480 Vac electrical distribution system and a failure to maintain in effect all provisions of the approved fire protection program, each a contributor to the fire. The inspection team determined that prior to the fire, your staff failed to adequately investigate the source of an acrid odor in the west switchgear room that had been present for three days. A proper investigation may have prevented the fire. Following the fire, your staff appropriately performed a causal analysis to identify the potential contributors to the electrical distribution system failures, but failed to promptly collect plant data or assess the operator and fire brigade response which impeded your staffs understanding of the event significance.

The NRC determined that because your staff took compensatory measures to ensure that high resistance connections were corrected in the other affected load centers, and reactor shutdown cooling systems were not directly affected, this finding did not represent an immediate safety concern.

The fire event discussed in this inspection report occurred while the plant was in a cold shutdown condition. The preliminary risk assessment demonstrates that the majority of the risk relates to operating the plant at power. The NRC assessed this finding based on the best available information, including influential assumptions, using the applicable Significance Determination Process (SDP). The finding has preliminarily been determined to be of high safety significance (Red). The preliminary significance was based on the high fire frequency given the short period of time that the breaker cradles had been in service, the significant damage caused by a failure, and the inability of plant personnel to enter the switchgear rooms following a postulated fire in time to successfully minimize dc loads on the vital batteries. We understand that differences between the NRCs evaluation and that of your staff included:

(1) the impact of postulated seismic events on the 480 volt breaker cradles and bolted buswork; (2) the vulnerability time used to calculate the common cause potential of a second fire; and (3) credit for the turbine-driven auxiliary feedwater pump following battery depletion.

Additionally, while considered as a qualitative input, the NRC considered the shutdown risk following a postulated fire to be a significant risk factor. The details of all primary assumptions associated with the preliminary significance determination are documented in Attachment 3 of the enclosed report.

In summary, during the event on June 7, 2011, the plant remained in a safe and stable shutdown condition. The NRC found that deficient modification and maintenance of the safety-related 480 Vac electrical distribution system were the primary contributors to the fire and these latent conditions existed during periods when the plant was at power. The NRC used probabilistic assessment tools to evaluate the significance of this issue and determined that based on the best available information this was preliminarily a finding of high safety significance.

The finding is also associated with apparent violations of NRC requirements and is being considered for escalated enforcement action in accordance with the Enforcement Policy, which can be found on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

In accordance with NRC Inspection Manual Chapter (IMC) 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The significance determination process encourages an open dialogue between the NRC staff and the licensee; however, the dialogue should not impact the timeliness of the staffs final determination. Before we make a final decision on this matter, we are providing you with an opportunity to: (1) submit, in writing, either your acceptance of this preliminary significance determination or your position on the significance of this finding to the NRC in writing, or (2) attend a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance. If you request a Regulatory Conference, it should be held within 30 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, the Conference will be open for public observation, which will require a public meeting notice and a press release. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of your receipt of this letter. If you decline to request a Regulatory Conference or submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either you fail to meet the appeal requirements stated in the Prerequisite and Limitation Sections of Attachment 2 of IMC 0609.

Please contact Geoffrey Miller at 817-200-1137 and respond in writing within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.

The final resolution of this matter will be conveyed in separate correspondence.

Since the NRC has not made a final determination in this matter, a Notice of Violation is not being issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violations may change as a result of further NRC review.

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Anton Vegel, Director Division of Reactor Safety Docket: 50-285 License: DPR-40 Enclosure:

NRC Inspection Report 0500285/2011014 w/Attachments Attachment 1: Supplemental Information Attachment 2: Special Inspection Charter Attachment 3: Significance Determination Evaluation Attachment 4: Diagrams of Electrical Distribution System Attachment 5: Table of Digital Low Resistance Ohmmeter Readings Electronic Distribution for Fort Calhoun Station

SUMMARY OF FINDINGS

IR 05000285/2011014; 09/12/2011 - 02/29/2012; Fort Calhoun Station; Special Inspection;

Violations of 10 CFR Part 50, Appendix B, Criterion III and Criterion XVI, and License Condition 3.D were identified.

This report covered an 8-day period (September 12 - September 16, and December 12 -

December 14, 2011) of onsite inspection, with additional in-office review through February 29, 2012. One finding was identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. The crosscutting aspects were determined using IMC 0310,

Components within the Cross-Cutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Initiating Events

AV. The failure to ensure that the 480 Vac electrical power distribution system design requirements were properly implemented and maintained through proper maintenance, modification, and design activities led to a catastrophic fire in a switchgear impacting the required safe shutdown capability of the plant. Three self-revealing apparent violations were identified with this performance deficiency:

• A violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to ensure that design changes were subject to design control measures commensurate with those applied to the original design and that measures were established to assure that applicable regulatory requirements and the design basis for those safety-related structures, systems, and components were correctly translated into specifications, drawings, procedures, and instructions;

• A violation of 10 CFR Part 50, Appendix B, Criterion XVI Corrective Action, for the failure to establish measures to assure that a significant condition adverse to quality was promptly identified and corrected, and measures taken to preclude repetition;

• A violation of License Condition 3.D, Fire Protection Program, for the failure to ensure that the electrical protection and physical design of the 480 Vac electrical power distribution system provided the electrical bus separation required by the fire protection program.

Specifically: (1) design reviews and work planning for a modification to install twelve new 480 Vac load center breakers failed to ensure that the cradle adapter assemblies had a low-resistance connection with the switchgear bus bars by establishing a proper fit and requiring low resistance connections; (2) preventive maintenance activities were inadequate to ensure proper cleaning of conductors, proper torquing of bolted conductor and bus bar connections, or adequate inspection for abnormal connection temperatures; and (3) design reviews of the electrical protection and train separation of the 480 Vac electrical power distribution system were inadequate to ensure that a fire in load center 1B4A would not adversely impact operation of redundant safe shutdown equipment in load center 1B3A, as required by the fire protection program. The licensee entered these issues into their corrective action program under numerous condition report numbers, which are described in the body of this report.

The performance deficiency was determined to be more than minor because it affected the Initiating Events Cornerstone and was associated with both the protection against external events attribute (i.e., fire) and the design control attribute. The finding affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Manual Chapter 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a, directed the process to a Phase 3 analysis because the finding increased the likelihood of an external event (fire), and impacted mitigating systems needed to respond to that initiating event. A Phase 3 analysis was completed using the plant-specific Standardized Plant Analysis Risk Model for Fort Calhoun, Revision 8.15, the Individual Plant Evaluation of External Events (IPEEE), and hand calculations. The analysis covered the risk affected by the performance deficiency for postulated fires of any of the remaining nine continuously energized breakers including the potential for multiple fire initiators. Additionally, seismically-induced fires were postulated based on the characteristics of the performance deficiency. Based in the best available information the performance deficiency was preliminarily characterized as a finding of high safety significance (Red). This performance deficiency had a crosscutting aspect in the area of human performance associated with the resources component because the licensee did not ensure that personnel, equipment, procedures, and other resources were adequate to assure nuclear safety. Specifically, the licensee did not ensure that design documentation, procedures, and work packages were adequate to assure that design margins were maintained. H.2(c) (Section 3.10).

Licensee-Identified Violations

None.

REPORT DETAILS

1.0 Basis for Special Inspection On June 7, 2011, a switchgear fire occurred at the Fort Calhoun Station while the plant was shut down for a planned refueling outage. The fire resulted in a loss of power to six of nine safety-related 480 Vac electrical distribution buses and two of four safety-related 4160 Vac buses. This event met the following deterministic criteria of Management Directive 8.3 for a detailed follow up team inspection:

• The event resulted in the loss of the spent fuel pool cooling function and could have resulted in the loss of a safety function or multiple failures in systems used to mitigate an event had the event occurred at power.

• The event resulted in significant unexpected system interactions. Specifically, combustion products from the fire caused a fault across an open bus-tie breaker on island bus 1B3A-4A, and feeder breaker 1B3A tripped unexpectedly resulting in loss of power to the opposite train bus. Also, the event resulted in grounds on both trains of safety-related direct current power used for breaker operation and electrical protection.

• The event involved questions or concerns pertaining to licensee operational performance, since an acrid odor was reported in the area of the fire three days prior to the fire, but the licensee did not identify the source of the odor or prevent the fire.

The Maximum Conditional Core Damage Probability for the event was estimated to be 3.4 x 10-4, which is in the range for an Augmented Inspection Team. However, the NRC determined that the appropriate level of response was a Special Inspection because the plant would remain safe and stable in cold shutdown through the period of the inspection.

At the time of the fire, Fort Calhoun Station was experiencing impacts from flooding of the Missouri River and had declared a Notice of Unusual Event on June 6, 2011. The NRC determined that licensee attention should focus on that ongoing situation while assessing the causes and impacts of the fire as resources permitted. When a preliminary cause of the fire was identified, the NRC began the Management Directive 8.3 evaluation process.

The NRC conducted the special inspection to better understand the circumstances surrounding the response of the electrical distribution system and plant personnel leading to and following the fire in the 1B4A switchgear, which adversely affected the safety function of multiple safety systems used for accident mitigation. The team used NRC Inspection Procedure 93812, Special Inspection Procedure, to conduct the inspection. The special inspection team performed field walkdowns, reviewed procedures, corrective action documents, operator logs, design documentation, and maintenance records for the electrical distribution system and personnel response. The team interviewed various station personnel regarding the events which occurred on June 7, 2011. The team reviewed the licensees root cause analysis report, past failure

records, extent of condition evaluations, immediate and long term corrective actions, and applicable industry operating experience. A list of documents reviewed is provided in 1 of this report, and the charter for the special inspection is included as

2. 2.0 Event Description

At approximately 9:30 a.m. on June 7, 2011, while the plant was in cold shutdown, the licensee declared an Alert due to a fire in the west switchgear room. The Halon system in the room automatically actuated and aided in extinguishing the fire. The fire brigade responded, as did off-site fire assistance. The plant was in a planned refueling outage, and was already in a Notice of Unusual Event condition due to flood levels on the Missouri River. For three days prior to the event, the licensee investigated an acrid odor in the switchgear room but was unable to identify the source.

The fire was caused by the catastrophic failure of the feeder breaker for 480 Vac load center 1B4A in the west switchgear room. A large quantity of soot and smoke was produced by the fire which migrated into the non-segregated bus duct (a metal enclosure containing the bus bars for all three electrical phases) connecting the 1B4A bus to island bus 1B3A-4A, even though the bus-tie breaker was open. The safety-related 480 Vac distribution system arrangement is illustrated in Figure 1 of Attachment 4. The smoke and soot were sufficiently conductive that arcing occurred between the bus bars such that island bus 1B3A-4A and the other connected train load center 1B3A were affected.

The load center supply breaker 1B3A and the bus-tie breaker tripped, resulting in 480 Vac buses 1B3A and 1B3A-4A being de-energized. Operators manually opened the 4160 Vac feeder breaker upstream of the faulted breaker to de-energize the 1B4A bus.

Some minutes later, in accordance with the applicable procedure, operators manually de-energized 4160 Vac buses 1A2 and 1A4, which resulted in de-energizing the remaining 480 Vac buses on the same train as the fire. This left only three of the nine safety-related 480 Vac buses energized.

During the early stages of the operators response to the fire, the electrical distribution system alignment was reconfigured to combat the effects of the fire. When bus 1B3A was de-energized, spent fuel pool cooling pump A (AC-5A) was de-energized. When 4160 Vac bus 1A4 was de-energized, the other spent fuel cooling pump (AC-5B) was also de-energized, resulting in a loss of spent fuel pool cooling. Shutdown cooling for the reactor coolant system continued to operate and was not affected by the event.

During the event, both trains of safety-related 125 Vdc power were affected by grounds caused by the effects of the fire in load center 1B4A.

The licensee issued Licensee Event Report (LER) 05000285/2011008-00, dated August 5, 2011, for this issue stating that the root cause was still being determined. The licensee supplemented this report on October 27, 2011 to provide the results of the root cause analysis and to update reportability criteria.

3.0 Inspection Results 3.1 Timeline (Charter Item 1)

a. Inspection Scope

The team developed and evaluated a timeline of significant events for the modification of 480 Vac breakers and subsequent June 7, 2011, fire. The team developed the timeline, in part, through a review of control room alarm logs, control room operator log entries, plant voltage plots, review of post-event statements from the on-shift operators, and interviews with plant fire brigade personnel, system engineers, and electrical maintenance personnel.

b. Findings and Observations

The team determined that the licensee did not have a formal process for evaluating plant events against the expected plant response, assessing operator response, or collecting plant response data for events of this type. The team reviewed licensee logs for the event and identified instances in which the logs did not document key actions or events. Examples included not logging entry into Abnormal Operating Procedures, and not logging the times offsite emergency response personnel arrived onsite. The failure to capture important information for complete event reconstruction hampered the licensees understanding of the event.

The licensee initiated Condition Report CR 2011-7698 to document that Fort Calhoun Station did not have and needed a procedure or process for collecting and assessing event-related information in a timely manner following an event, and that the station had failed to conduct a comprehensive review of the events of June 7, 2011.

Timeline of Events Identified by the Team Some of the entries in the timeline are approximate due to the lack of evidence preservation and lack of post-event data collection by the licensee. The team reviewed a period leading up to the event as well as the day of the event. A brief timeline of post-event actions is provided. This evaluation was performed to assess the effectiveness of licensees actions taken in response to the safety-related 480 Vac electrical distribution system deficiencies which caused a fire in the west switchgear room. The following timeline was developed:

PRIOR TO THE EVENT May 22, 2008 The licensee initiated Condition Report CR 2008-3548 in response to breaker BT-1B3A failing to close. During troubleshooting activities the licensee identified hardened grease on the secondary disconnects and dirty secondary contacts. The root cause analysis determined that Procedure EM-PM-EX-1200, Inspection and Maintenance of Model ADK-5 Low Voltage Switchgear, was less than adequate.

May 14, 2009 The licensee developed Condition Report CR 2009-2306 and established corrective actions in response to NRC-identified issues of concern with inadequate maintenance of Class 1E circuit breakers and switchgear. Corrective actions included revising maintenance procedures, including Procedure EM-PM-EX-1200.

July 14, 2009 The NRC opened Unresolved Item (URI)05000285/2009007-02 involving vendor and industry recommended testing on safety-related and risk significant 4160 Vac and 480 Vac circuit breakers.

November, The licensee performed modification EC 33464 to replace twelve 2009 General Electric AK-50 type 480 Vac breakers with Nuclear Logistics Incorporated/Square-D breakers which included the introduction of cradle assemblies to fit the new breakers into existing switchgear.

July 2, 2010 The NRC closed URI 05000285/2009007-02 by issuing non-cited violation 05000285/2010004-09 for failure to perform vendor and industry recommended testing on safety-related and risk significant 4160 Vac and 480 Vac circuit breakers.

March 2, 2011 The licensee revised procedure EM-PM-EX-1200, Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear, to add instructions for verifying the material condition of the silver-plated bus stab area for the new breakers installed in 2009.

June 4, 2011 An acrid odor was noticed by Operations and electrical maintenance personnel in the switchgear room containing safety-related 480 Vac buses. No condition report was written. The odor was investigated using only non-intrusive visual inspections and sense of smell. The licensee failed to find the source of the odor.

June 6, 2011 The licensee entered Notice of Unusual Event (HU 1, EAL 5) for a river level expected to exceed 1004 feet Mean Sea Level.

June 6, 2011 Condition Report CR 2011-5400 was initiated reporting the acrid odor in the switchgear room.

JUNE 7, 2011 BREAKER FIRE EVENT 09:27 A high impedance connection caused failure of 480 Vac feeder breaker 1B4A, creating a fire in the 1B4A safety-related switchgear. Breaker 1B4A was destroyed. Load Center 1B4A was heavily damaged.

09:27 Control room operators received numerous indications of electrical transients including dc system ground indications on both dc buses, and bus phase currents oscillating from 0 amps to 200 amps on bus 1B4A. Operators also noticed dimming/flickering indicating lights on control room control panels.

09:27 Soot and combustion products from the fire caused an unexpected phase-to-phase fault on non-segregated bus duct conductors between open bus-tie breaker BT-1B4A and island bus 1B3A-4A.

This second fault created electrical transients on buses 1B3A and 1B3A-4A, which were part of the redundant train.

09:28 Control room operators attempted to remotely open breaker 1B4A from control room, but the attempts failed.

09:28 Control room operators remotely opened 4160 Vac feeder breaker 1A4-10 which fed 4160/480 Vac transformer T1B-4A. Opening this breaker de-energized 480 Vac bus 1B4A.

09:28 Feeder breaker 1B3A unexpectedly tripped. Bus-tie breaker BT-1B3A tripped. These trips resulted in loss of power to bus 1B3A and island bus 1B3A-4A. Motor control center 3A2 powering the running spent fuel cooling pump was de-energized.

09:30 (Time Control room operators noticed fire alarm indications in the control approximate) room when they heard audible Halon discharge alarms from the west switchgear room. Operators entered Abnormal Operating Procedure (AOP)-6-2, Fire Emergency: Uncontrolled Areas of Auxiliary Building, for a fire in the switchgear room.

09:31 The control room received a report from security personnel that heavy smoke was coming out of the west switchgear room.

09:31 Control room operators attempted to close feeder breaker 1B3A remotely from the control room. The attempts failed.

09:32 Control room operators entered procedure AOP-32, Loss of 4160 Vac or 480 Vac Bus Power, for the loss of a safety-related 480 Vac bus.

09:35 (Time Control room operators sounded the site-wide fire alarm. Fire approximate) brigade assembled in designated area to dress out and created a plan of attack.

09:38 Offsite fire departments were contacted for assistance via 911.

09:40 The licensee declared an Alert for a fire affecting the operability of plant safety systems required to establish or maintain safe shutdown.

09:40 (Time Site fire brigade reported to the control room that smoke was too approximate) thick to enter the switchgear room.

10:00 Control room operators de-energized 4160 Vac buses 1A4 and 1A2 per procedure AOP-6, Fire Emergency. In addition to the other de-energized buses, this de-energized load centers 1B4B, 1B4C, and island bus 1B3B-4B.

10:01 City of Blair volunteer fire department personnel entered the protected area.

10:17 Control room operators entered procedure AOP-36, Loss of Spent Fuel Pool Cooling, for the loss of both trains of spent fuel pool cooling.

RECOVERY OF SPENT FUEL POOL COOLING AND SUBSEQUENT ACTIONS (June 7, 2011)10:19 Blair volunteer fire department personnel entered the switchgear room and reported the fire was out, but heavy smoke remained.

10:30 (Time Additional offsite assistance from the City of Fort Calhoun volunteer approximate) fire department entered the protected area.

11:44 The licensee recognized that they also met the Emergency Activation Level criteria for an Alert due to lack of access to a vital area from toxic gases in the switchgear room (Halon/smoke). The licensee remained in an Alert for both a fire affecting the operability of plant safety systems required to establish or maintain safe shutdown and the lack of access to a vital area.

11:44 Operators established a cross-tie configuration from 4160 Vac bus 1A3 through 480 Vac breaker 1B3C to island bus 1B3C-4C to restore power to 480 Vac bus 1B4C.

11:47 Control room operators restored spent fuel pool cooling by starting the train B spent fuel pool cooling pump on the restored 480 Vac bus.

12:23 Chemistry personnel reported that air samples in the west switchgear room indicated that it was safe for personnel to enter.

12:28 Operators exited AOP-36, Loss of Spent Fuel Pool Cooling.

12:28 (Time Electrical Maintenance entered the west switchgear room to approximate) determine extent of damage and troubleshoot the failure of 1B3A to close remotely from the control room.

12:28 (Time Electrical Maintenance manually reset 480 Vac feeder breaker approximate) 1B3A and reported that the breaker had tripped on overcurrent.

12:44 Battery charger #3 was aligned to dc bus #2 to restore charging after battery charger #2 was de-energized as a result of the loss of bus 1B4A.

13:15 Licensee exited Alert after confirming that the fire was extinguished in the switchgear room and access had been restored.

EVENT REVIEW AND INSPECTION September 12 The NRC Special Inspection Team arrived on site and questioned the extent of condition of cradle finger engagement issues with load center bus stabs of other safety-related 480 Vac load centers.

September 13 The licensee declared the remaining eight 480 Vac load centers inoperable.

September 15 The licensee began additional causal analysis of the spurious trip of breaker 1B3A.

October 12 The licensee removed breaker 1B3A for transfer to vendor for failure analysis.

December 12 Senior Reactor Analyst and Team Lead arrived on site for procedure and additional field walkdowns, additional interviews with plant personnel and risk assessment discussions.

3.2 Operator Response (Charter Item 2)

a. Inspection Scope

The team interviewed Operations personnel who were on shift during the event to evaluate operator and plant responses to the initial indications of the electrical distribution system problems, including electrical grounds, fire, and loss of Class 1E buses. Also, the team reviewed written operator event statements. The team evaluated procedure use and the appropriateness of event classification and reporting. On December 12, 2011, the team observed operator activities in the licensees simulator which were conducted to improve the teams understanding of plant and operator responses to the event.

b. Findings and Observations

The team had the following observations regarding operator response to the event:

• The on-shift control room operators did not promptly recognize they were dealing with a fire. Multiple annunciator alarms and abnormal control board indications caused, in part by grounds on both trains of safety-related 125 Vdc control power and operator attention to the electrical transient indications delayed the recognition of the fire alarms.

• After the unexpected tripping of breaker 1B3A, operations personnel repeatedly attempted and failed to remotely re-close the breaker. The licensee did not perform an investigation to determine why the breaker had tripped prior to the attempts to reclose the breaker. The licensee later discovered that after tripping, the Nuclear Logistics Incorporated/Square-D breakers must be locally reset prior to being remotely operated. The licensee initiated Condition Report CR 2011-5569 to address deficient operator knowledge on the reset feature of the Nuclear Logistics Incorporated/Square-D breakers.

• Operations personnel de-energized 4160 Vac buses 1A2 and 1A4 per procedure, which also resulted in the loss of all respective downstream 480 Vac buses approximately 30 minutes after the fire. This resulted in the loss of spent fuel pool cooling for approximately 90 minutes, which caused an increase in spent fuel pool temperature of approximately 3 degrees Fahrenheit. The time to boil was approximately 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> in the reactor vessel and 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> in the spent fuel pool. The inspectors concluded that this action was appropriate in view of the possible damage to the electrical power distribution system.

• After the fire was confirmed to have been extinguished, operators placed the electrical distribution system in an abnormal alignment with 480 Vac load center 1B4C powered from bus 1A3, through the island bus 1B3C-1B4C, to provide power to spent fuel pool cooling pump B. Bus 1B4B was also cross-tied to the 1A3 bus. The inspectors concluded that this action was appropriate for the plant conditions, and was covered by procedures.

The team identified that the licensee did not have a process for reviewing events of this type, and as a result, failed to adequately collect data, assess the response, and identify conditions and significant conditions adverse to quality in a timely manner.

This resulted in the licensee failing to recognize the risk significance of the problems present during the event. Because the licensee did not have a process for review, no overall event assessment was performed. The actual cause of the fire was originally the only condition to receive a root cause assessment. The licensee failed to evaluate operator response, and as a result, did not recognize problems involving diagnosing the symptoms of the fire, control of the fire brigade, and operator lack of understanding of the reset requirements for the new breakers.

3.3 Fire Suppression Review (Charter Item 3)

a. Inspection Scope

The team walked down the west switchgear room (Fire Area 36B), which housed the 1B4A load center and the source of the fire, and the east switchgear room (Fire Area 36A) which contained the 1B3A load center and the 1B3A-1B4A island bus. The team held discussions with licensee staff about the event including operator and fire brigade responses. The team reviewed the licensee's fire protection program including the design, maintenance, testing, and operation of the fire detection and suppression systems in the switchgear rooms. The team performed a walkdown of the automatic detection and Halon suppression systems in the fire area to validate the installation met the design requirements, to evaluate the material condition, and to verify the suppression system design was appropriate for the hazards in the fire area. The team conducted interviews with the fire protection system engineer to determine that the detection system and Halon suppression system had functioned as designed and that the system had been properly returned to service.

The team assessed the fire brigade performance by reviewing training and qualification records, conducting interviews with the Operations crew that was on shift during the event, the fire brigade team members who responded to the event, and the Senior Instructional Technician who was responsible for fire brigade training.

The team reviewed pre-fire plans and smoke removal plans for the fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of the fire.

b. Findings and Observations

Fire Protection Program:

The licensees fire protection program was defined in the Updated Safety Analysis Report and NRC safety evaluation reports. Section 9.11.1 of the Updated Safety Analysis Report describes the fire protection system design basis and states, in part, that the design basis of the fire protection system includes commitments to 10 CFR Part 50, Appendix R, Sections III.G, III.J, and III.O.Section III.G, Fire protection of safe shutdown capability, requires, in part, that fire protection features be provided for structures, systems, and components important to safe shutdown, and that these features be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions is free of fire damage.

Section 9.11.4.5 of the Updated Safety Analysis Report documented that descriptions of plant design and construction features for the fire protection program were contained in Fort Calhoun Station Fire Hazards Analysis and Safe Shutdown

Analysis.

FHA-EA97-001, Fire Hazards Analysis (FHA) Manual, Revision 16, stated, in part, that a fire in fire area 36B (west switchgear room) might affect all switchgear associated with the west switchgear area, including panels powering one train of redundant components used to provide all safe shutdown requirements. The Fire Hazards Analysis also stated that a 3-hour rated barrier separated fire area 36B from fire area 36A (east switchgear room), and that fire area 36A contained the other redundant train which provided the necessary functions needed to perform safe shutdown. The Fire Hazards Analysis concluded that a fire in fire area 36B would not affect safe shutdown.

Section 9.11.5 of the Updated Safety Analysis Report discusses the safe shutdown analysis. This analysis was documented in EA-FC-89-055, 10 CFR 50 Appendix R Safe Shutdown Analysis, Revision 17, and provided the basis for compliance with Appendix R requirements. The analysis assumed that a fire in a switchgear room would cause a fault in the 480 Vac bus that connected load centers in one room to load centers in the redundant switchgear room, via the island buses. However, the safe shutdown analysis also assumed that the bus-tie breakers in the unaffected switchgear room would open in response to the fault condition, protecting the redundant train. During the fire event in load center 1B4A, the feeder breaker in the redundant train tripped open and de-energized the redundant train load center. The licensees root cause analysis identified that since the breaker protection scheme did not function as designed, load center 1B3A was de-energized and both trains were impacted from a single fire which was inconsistent with assumptions made in the fire protection program.

The team concluded that fire protection program requirements were not met because the licensee failed to assure that a fire in load center 1B4A would not adversely affect the safe shutdown circuits in the redundant train. This issue is discussed further in sections 3.7 and 3.10.

The team also concluded that the licensee had missed opportunities to prevent the fire. For approximately three days prior to the fire, an unusual acrid odor was detected in the west switchgear room, and investigations failed to determine the cause. The team determined that the licensee had used only non-intrusive visual inspections and sense of smell to investigate the unusual odor. Because the switchgear room is a highly ventilated area, the team concluded that the reliance on

the sense of smell would not be an effective means to identify the source of the acrid odor. Further, the team determined that the licensee had the capability of performing thermography scans of the switchgear but did not, and did not open any panels or switchgear as part of the investigation. Corrective action program entries discussed other events in which acrid odors were identified, but the source of the odors were never located. The team concluded that the licensee did not perform a thorough investigation of the abnormal odor. This issue was identified by the licensees root cause analysis as a contributing cause for the event.

Condition Report CR 2011-5400 was written to document that operators had identified a strong acrid odor originating in the west switchgear room. Condition Report CR 2011-5852 was written to document deficiencies in the problem identification process related to identifying incipient conditions.

Fire Brigade:

Plant fire brigade performance was governed, in part, by Standing Order SO-G-28, Station Fire Plan, Revision 81, which defines fire brigade responsibilities including the use of pre-fire plans and command and control functions. The pre-fire plan for the west switchgear room showed that the fire brigade staging area was in corridor 53, located on the north end of the room and secondary access was on the south end of the room. Responding to the event, the fire brigade backup team deployed to the secondary access without being directed to do so while the primary team deployed to the designated staging area. This divided the fire brigade team, affecting the team's mitigation capability.

Standing Order SO-G-28, section 4.8.4, stated, in part, that inside the protected area the fire brigade leader shall maintain the command role. Both the City of Fort Calhoun volunteer fire department and the City of Blair volunteer fire department responded to the event. The Blair fire department went to the staging area where the station fire brigade leader was located. The Fort Calhoun fire department went to the south access without being directed to do so by the station fire brigade. Also, contrary to the requirements of SO-G-28 and station fire brigade training, the fire brigade transferred command and control to the offsite fire department when they arrived. The team concluded that the fire brigade response did not demonstrate effective command and control and the stations fire brigade presence added limited value to the outcome of the event because the fire brigade:

• Did not use available tools to determine status of fire (thermography).

• Did not know that the fire brigade leader was responsible for requesting de-energization of electrical equipment.

• Did not declare the fire extinguished because they did not enter the space; this was accomplished by the offsite fire team after entering the space.

• Did not perform a search for victims in the fire area. Discussions with fire brigade members indicated that the station did not perform an accountability check after the fire, and that accountability checks were not typically done.

Condition Reports CR 2011-7356 and CR 2011-9219 documented the fire brigade deficiency in command and control. Condition Reports CR 2011-8275, CR 2011-8600, CR 2011-8672 and CR 2011-9219 document deficiencies in fire brigade training. Condition Reports CR 2011-7624 and CR 2011-8274 document that the station had not conducted a formal debriefing of the fire brigade response to the fire in load center 1B4A.

Station performance associated with fire brigade command and control will be further addressed during the triennial fire protection inspection in March 2012.

3.4 Modification Review (Charter Item 4)

a. Inspection Scope

The team reviewed modification EC 33464, Replace AK-50 480 V Main and Bus-Tie Breakers With Molded Case Type or Equivalent, Revision 0, which replaced 12 General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices in November 2009. The modification replaced six feeder circuit breakers and six bus-tie breakers. These breakers and their relation to the Fort Calhoun Station electrical distribution system are shown in Figure 1 of Attachment 4.

The team interviewed the system engineers responsible for the 480 Vac distribution system and electrical maintenance technicians that maintained the system. The team interviewed Operations personnel and discussed procedures and training for the modification. The team reviewed the modification to determine if the requirements of 10 CFR 50.59, Changes, Tests and Experiments were met, including understanding the possible failure modes, and to assess the post-modification testing completeness for cradle and breaker positioning, electrical resistance, and other critical parameters.

b. Findings and Observations

The modification was developed to address obsolescence issues and long-standing maintenance problems with the original AK-50 circuit breakers. Fort Calhoun Station used General Electric AKD-5 Powermaster Low Voltage Drawout Switchgear with a welded aluminum bus bar structure that transitioned to copper bus stabs with silver-plated ends in each breaker cell. The AK-50 circuit breakers connected directly to the silver-plated areas on the line and load stabs. The new Nuclear Logistics Incorporated/Square-D circuit breaker design was an integrated unit consisting of a circuit breaker and cradle assembly. The cradle assembly converted the internal vertical breaker connectors to top and bottom spring-loaded horizontal finger assemblies which connected to the silver-plated bus stabs. The integrated assembly was designed as a retrofit for the existing AKD-5 switchgear.

The modification stated that the new breakers were designed to be one-for-one replacements for the existing breakers. The following differences existed between the original and modified design:

• The new Nuclear Logistics Incorporated/Square D breakers were physically smaller than the existing breakers and would not fit in the existing switchgear without the cradle assembly.

• The switchgear doors had to be replaced because the original doors would not accommodate the new breakers.

• The new cradle finger connector assemblies were not the same length as the connector assemblies on the original breakers, resulting in cradle to bus bar connections which were different than the original design.

• The new electronic trip devices on the breakers had features that the original trip unit did not, including a digital control unit with memory function for retention of current values, an instantaneous overcurrent trip function, and a time-current function. The trip unit had a lithium battery to power the indicators on the electronic trip unit.

The team determined that the licensees modification process failed to recognize the potential for high resistance connections to exist from inadequate cradle finger connector engagement with the switchgear bus bars, and did not recognize that additional failure modes were created by the addition of the cradle assemblies. The modification did not recognize and evaluate the following conditions that contributed to the fire:

• The cradle assembly silver fingers were too long to make contact on the silver-plated portion of the bus stabs without additional changes to the breaker position. By contacting the dissimilar metal (copper), oxidation could build up over time and increase electrical resistance and heating. Condition Report CR 2011-6319 was written, during the extent of condition reviews, for the licensees discovery of the improper engagement of cradle fingers to silver plating on the stabs.

• Electrical maintenance personnel regularly cleaned only the silver-plated parts of the bus stabs, so they failed to remove hardened grease that was present on the copper part of the stabs where the cradle assembly fingers actually made contact. The hardened grease increased the electrical resistance resulting in increased heating of the connections.

• The modification required verifying low resistance readings between the breaker and cradle, but did not require measuring resistance between the cradle and the bus stabs. Following the fire, the licensee determined that the undamaged breakers had elevated contact resistance between the cradle and the bus stabs. See Attachment 5 for tabulated resistance values.

• Maintenance personnel noted that the design change package did not contain adequate drawings or dimensions for cradle details.

During installation of the modification, the licensee determined that nine out of twelve cradle assemblies did not align with the drawout interlock pin holes. Personnel installing the breakers performed a field change to improve pin alignment, but no analysis or review was performed prior to the field change to ensure it would not adversely impact the new breakers. Condition Report CR 2011-6101 was written to capture this failure.

The team reviewed the implementation of 10 CFR 50.59, Changes, Tests and Experiments, for the modification by reviewing the licensees applicability and screening documents and the licensees implementation procedure, FCSG-23, 10 CFR 50.59 Resource Manual, Revision 7. Section 5.2.2 of FCSG-23 states, in part, that changes that have an adverse effect are required to be evaluated under 10 CFR 50.59 because they have the potential to increase the likelihood of malfunctions, increase consequences, create new accidents, or otherwise meet the 10 CFR 50.59 evaluation criteria. The licensees screening process concluded that the modification did not have an adverse effect on the design function of the 480 Vac electrical distribution system because the replacement breakers performed the same function as the original components. The team disagreed with this conclusion, in part, because the new breaker and cradle assemblies potentially introduced new failure mechanisms the licensee had not identified and the connections between the breaker to the switchgear bus bars had changed. The team determined additional inspection would be required to determine if the licensees implementation of the requirements in 10 CFR 50.59 were appropriate for this modification. This issue is documented in section 3.10 as Unresolved Item 05000285/2011014-02, Failure to Perform Adequate 10 CFR 50.59 Review.

The team concluded that the post modification testing failed to ensure that the modification met all 480 Vac electrical distribution system design requirements. The as-left condition of breaker 1B4A was unknown because the as-left resistance readings between the incoming line-side to the load-side of the switchgear following circuit breaker replacement were not confirmed and the engagement of the cradle fingers to the bus bars were not adequately verified. This issue was identified by the licensees root cause analysis as a contributing cause for the event. Post modification testing also entailed the use of hand held mirrors which offered limited viewing capability to provide the only visual verification of the finger to stab engagement after the installation of the new breakers.

Boroscope images taken after the fire determined that the finger clusters were over-extending the silver-plated sections of the stabs, raising questions about the seismic qualification of the breaker assemblies. The licensee provided a paper stating, in part, that qualification was maintained as long as the cradle finger engagement was greater than 3/4-inch on the bus bar stabs. The paper did not provide a basis for this conclusion. The licensee provided a letter from the vendor, dated August 26, 2011, which indicated that seismic qualification would be maintained as long as the cradle primary disconnect (finger clusters) connection was maintained between 3/4-inch and 1-inch on the bus bar stabs, and the positive (drawout) interlock pin was properly seated in the cubicle stop rail. The letter did not provide an analysis supporting this position. The vendors seismic qualification report for the new breakers stated that seismic qualification was performed, in part, by testing in accordance with IEEE 344-1975, IEEE Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations. This standard stated that the orientation of the equipment during the test shall be the only orientation for which the equipment is considered qualified, unless adequate justification can be made to extend the qualification to an untested orientation. No qualification testing was performed with nonstandard cradle to bus bar connections. The team concluded that

the breaker/cradle assemblies were not in the tested orientation for seismic qualification. The licensees analysis concluded that the fire was caused by high resistance connections between the cradle connectors and the switchgear bus bars, therefore the cradle connections were not in the tested orientation to meet seismic qualification requirements.

Condition Report CR 2011-7064 was written to document that the breakers might not meet the engagement criteria for seismic qualification. Condition Report CR 2011-7365 was written on September 13, 2011, to address the inoperability of the remaining breaker and cradle assemblies due to the incorrect finger to stab engagement.

The team concluded that the modification adversely affected the availability and reliability of the Class 1E 480 Vac electrical power distribution system, and failed to ensure that the design basis for the 480 Vac electrical power distribution system was maintained. A finding associated with this failure is described in section 3.10.

3.5 Maintenance Review (Charter Item 5)

a. Inspection Scope

The team reviewed the corrective actions developed by the licensee in response to Green noncited violation (NCV)05000285/2010004-09 of Technical Specification 5.8.1(a) for inadequate procedures for performing maintenance of 4160 Vac and 480 Vac safety-related breakers. The violation addressed, in part, the licensees maintenance program deficiencies for medium and low voltage switchgear. The team reviewed the corrective actions to assess whether they would identify and/or prevent high-resistance connections between breakers and switchgear, as well as problems involving inadequate inspection and cleaning of hardened grease or oxidation. The team reviewed maintenance procedures and work orders for 4160 Vac and 480 Vac breakers, switchgear, and motor control centers. The team also reviewed documents for the safety-related 125 Vdc distribution system components.

The team interviewed system engineers responsible for these systems, quality assurance staff, and electrical maintenance personnel responsible for maintaining the systems.

b. Findings and Observations

Condition Report CR 2009-2306 was written in May 2009 in response to NRC-identified issues with maintenance of Class 1E circuit breakers and switchgear.

The NRC issued noncited violation 05000285/2010004-09 for the failure to perform vendor and industry recommended maintenance and testing on safety-related and risk significant 4160 Vac and 480 Vac circuit breakers and switchgear. Condition Report CR 2009-2306 contained corrective action items to identify gaps between the licensees preventative maintenance program requirements, vendor recommended maintenance, and Electric Power Research Institute guidance which the licensee used as the basis for their maintenance program. Corrective action recommendations included revising Procedure EM-PM-EX-1200, Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear, to address the identified

gaps between preventative maintenance documents and vendor recommendations, and to develop a comparison review for the new breakers installed under modification EC 33464. The team determined that the licensee had identified differences between the maintenance program guidance and the vendor and Electric Power Research Institute guidance, but had not implemented all of the corrective action recommendations.

The team concluded that maintenance procedure EM-PM-EX-1200 failed to assure that conditions adverse to quality were identified and corrected because:

• The procedure failed to provide either quantitative or qualitative acceptance criteria for the torquing of bus compartment fasteners. The procedure specified that maintenance personnel check all accessible bus connections and mounting bolts for tightness, but it did not contain appropriate guidance to ensure that torque values were being properly applied to connections in the bus compartment, and did not contain specific guidance to document which fasteners were to be checked. The term accessible was not defined.

• The licensee identified that the procedure did not contain adequate instructions for electrical maintenance for the removal of internal divider plates in the switchgear. The bus compartment section was located between the front breaker enclosure and the rear cable compartment. The bus compartment contained all of the welded aluminum bus connections and bus support structures, which had bolted joints. Failure to remove the divider plates limited the inspection and cleaning of the switchgear to only areas that were considered easily accessible. The team concluded that the bus compartment was not considered accessible, and was therefore not included in the maintenance activities.

The licensees root cause analysis for the failure of bus 1B4A concluded that hardened grease on breaker stabs were a factor in the increased resistance of the connections, contributing to the breaker fire. The team concluded that maintenance personnel were only cleaning portions of the bus bar stabs where the original breaker fingers connected. Engineering, who owned the procedure, had expectations that the entire stab would be cleaned. Condition Report CR 2011-7449 was written to address that electricians understood the terminology in the procedure for the surfaces of the primary disconnect to mean the points on the bus bar that the cradle finger clusters engage, which differed from the interpretation by Engineering. Condition Report CR 2011-6253 was written, in part, to document that procedure EM-PM-EX-1200 did not contain sufficient instructions for electrical maintenance to adequately clean and inspect 480 Vac switchgear.

The team identified additional events in the licensees corrective action program involving failures in the 480 Vac electrical power distribution system. The team reviewed Condition Report CR 2008-3548, Root Cause Analysis Report: Failure of 480 Vac Breaker BT-1B3A to Close during Hot Bus Transfer of 1B3A, which was written in May, 2008, to document a significant condition adverse to quality. This failure resulted in the loss of bus 1B3A. This analysis concluded, in part, that preventative maintenance procedure EM-PM-EX-1200 was less than adequate and

was a contributing cause to the loss of bus 1B3A. The analysis identified the following weaknesses in the procedure:

• The procedure contained conditional procedure steps that allowed skipping the cleaning and inspection of 480 Vac breaker cubicles.

• System Engineers were not aware that 480 Vac breaker cubicles were not being cleaned as required by the Preventative Maintenance program requirements.

• Breaker BT-1B3A had high resistance connections, which occurred as a result of procedural deficiencies that failed to remove dirt and hardened grease, contributing to a significant condition adverse to quality.

The licensee implemented corrective actions to address the deficiencies, which included revising procedure EM-PM-EX-1200 to add steps to inspect the engagement of electrical contacts. The procedure had existing steps to clean primary and secondary connections, but they were not appropriately followed due to different interpretations of the requirements. Condition Report CR 2008-3548 also noted that other breakers had been inspected and additional problems identified including grease buildup on bus-tie breakers BT-1B3B, BT-1B4B, BT-1B3C, and BT-1B4C. The analysis discussed previous instances of high resistance connections, including a previous significant condition adverse to quality in the failure of the field flash circuit for an emergency diesel generator. The analysis concluded that the preventative maintenance program was ineffective at identifying and correcting high resistance electrical connections before equipment failure. The team noted that Condition Report CR 2008-3548, Root Cause Analysis Report: Failure of 480 Vac Breaker BT-1B3A to Close during Hot Bus Transfer of 1B3A, was identified in the licensees root cause analysis for the fire in breaker 1B4A as part of their internal operating experience review, and concluded that the described event was a missed opportunity to prevent the fire.

Condition Report CR 2011-6363 was written to report that during the extent of condition inspections for the fire in load center 1B4A hardened grease was found between the bolted connections of the bus work in load center 1B4B. The team concluded that this hardened grease condition was another example related to inadequate maintenance of the 480 Vac distribution system.

The teams review of corrective actions associated with the issues leading to NCV 05000285/2010004-09 and issues involving previous failures of electrical distribution components led the team to conclude that inadequate maintenance practices contributed to the fire in load center 1B4A. The team concluded that the failure to prevent high resistance electrical connections was a direct contributor to the fire in load center 1B4A on June 7, 2011 and that the licensee had failed to prevent recurrence of this significant condition adverse to quality. The team concluded the inadequate maintenance procedures also failed to ensure that seismic qualification was maintained. A finding associated with this failure is described in section 3.10.

3.6 Root Cause Evaluation and Event Review (Charter Item 6)

a. Inspection Scope

The inspection team evaluated the licensees root cause analysis Fort Calhoun Station Corrective Action Program Root Cause Analysis Report, Breaker Cubicle 1B4A Fire, Condition Report 2011-5414, Revision 0, and associated analysis tools including Event and Causal Factors Analysis, Gap Analysis, and Hazard-Barrier-Target

Analysis.

The team reviewed corrective actions and extent of condition reviews associated with the fire in switchgear 1B4A and events leading up to the fire.

The team interviewed licensee personnel involved with the modification, installation and testing of the 480 Vac Nuclear Logistics Incorporated/Square-D circuit breakers and personnel assigned to the licensees root cause investigation team. The team evaluated the licensee's investigation and corrective actions to determine whether the licensee appropriately assessed all possible impacts from the fault currents, heat, and combustion products. The team also assessed whether the corrective actions were appropriate to correct the root and contributing causes. The team inspected the remaining quarantined equipment and parts.

b. Findings and Observations

The licensee provided the inspection team with the results of the root cause analysis as described in Fort Calhoun Station Corrective Action Program Root Cause Analysis Report, Breaker Cubicle 1B4A Fire, Condition Report 2011-5414, Revision 0, dated September 12, 2011, when the team arrived onsite. The licensees analysis identified two root causes for the event; a programmatic root cause and a probable physical root cause. The analysis also identified nine contributing causes for the fire. The programmatic root cause was identified as a design process failure to identify the silver plating on the bus bars as a critical interface when specifying replacements for the AK-50 circuit breakers. The physical root cause was identified as high resistance connections due to breaker cradle fingers engaging the bus stabs in a contact area of hardened grease and copper oxide buildup. This cause was derived from empirical data obtained from the extent of condition inspections of the undamaged 480 Vac breakers because limited physical data remained after the catastrophic failure of the 1B4A breaker and load center for a definitive analysis. The extent of condition inspections included photographs and boroscope imagery of the in-situ cradle finger engagement with the copper/silver-plated bus bars in the remaining ten load center breakers. The images showed varying degrees of finger engagement with the bus stabs. Digital Low Resistance Ohmmeter readings were taken on the remaining load center breakers and the as-found readings are tabulated in Attachment 5 and ranged from 61.9 micro-ohms to 835 micro-ohms. The licensee established 100 micro-ohms as an acceptable value. The licensee attributed the higher values to a combination of finger over-travel and buildup of copper oxide in combination with hardened grease residue that had not been cleaned from the stabs prior to installation of the new breakers.

The breaker vendors disagreed with the licensee's conclusion about the physical cause of the fire. Vendor reports concluded that a fault in the bus compartment

section from a foreign object or other cause was a credible failure mechanism.

Forensic experts were contracted by the licensee to review the event. Initial contractor forensic inspections concluded that a high resistance connection on the line side of the bus had caused the failure; however, due to extensive damage from the event, little physical evidence remained to conclusively determine the root cause.

On September 7, 2011, one of the forensics contractors submitted an assessment report to Fort Calhoun Station describing three possible failure scenarios:

1. Failure of a copper to aluminum bus bolted connection leading to in-line arcing and phase-to-phase-to-ground faulting.

2. Failure at the finger contacts between cradle and bus stabs.

3. Phase-to-ground fault at a load leading to phase-to-phase-to-ground faulting at a breaker.

The licensees root cause analysis discredited failure in the bus compartment section and discounted scenarios one and three based, in part, on results of the extent of condition reviews. The team concluded that the failure of a copper to aluminum bus bolted connection or fault in the bus compartment from a foreign object or other cause were credible failure scenarios.

Contributing causes identified included the following:

• Engineering had limited knowledge of the GE-AKD-5 switchgear resulting in an overreliance on vendor knowledge and skill. Station personnel relied on vendors to the point that a dependent, rather than an interdependent, relationship existed between vendors and station personnel.

• Access to the bus compartment of the GE-AKD-5 switchgear was difficult, limiting the selection of inspection/testing methods.

• Pre-installation procedure prerequisites require the performance of EM-PM-EX-1200, Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear, which directed maintenance personnel to wipe the cubicle disconnects. This cleaning method was insufficient to remove hardened grease. Additionally, there was no independent verification that the stabs were clean.

• Failure to confirm as-left resistance readings on the line side to load side connections following the modification.

The root cause analysis identified the following additional performance issues:

• The root cause of CR 2008-3548 concluded that breaker cubicle preventative maintenance activities had not been conducted to clean and inspect the 480 Vac switchgear breaker cubicles.

• EM-PM-EX-1200, Inspection and Maintenance of Model GE-AKD-5 Low Voltage Switchgear, did not contain sufficient instructions to remove load center bus compartment divider plates.

The licensees analysis also identified that circuit breaker 1B3A tripped due to overcurrent. This was originally classified as a lower level condition in the corrective

action program. The inspectors questioned this condition level classification, in part, because the licensee had a limited understanding of the cause of the 1B3A trip and the determination that the issue was a nuclear safety concern because it adversely impacted the fire protection program basis assumptions for train separation. This issue was elevated by the licensee to a condition level A and categorized as a significant condition adverse to quality, requiring a root cause analysis. The root cause analysis for the tripping of breaker 1B3A was in progress when the team left the site. This item is addressed in section 3.10 as an unresolved item requiring further review.

The inspectors determined that the root cause analysis for the fault and fire in load center 1B4A was narrowly focused in that it rejected credible failure scenarios which had been identified and reported by contracted forensic experts and vendors; the analysis did not address the potential seismic implications of the installed breakers or bus compartment connections; and the identified programmatic root cause failed to include several underlying organizational and programmatic factors identified in the analysis, including errors in the development and review of engineering analyses and plant configuration changes, inconsistent supervisory oversight and reinforcement of design engineering activities, and lack of senior management oversight and critical reviews.

The team concluded that the extent of the fire damage obliterated evidence needed to identify the precise cause of the fire. While all parties agreed the cause involved a high resistance connection and resultant heating, arcing and eventual high-energy faulting, disagreement on the exact location existed. The location of the worst damage made it plausible that the high resistance connection could have been a bolted bus bar connection or the bus stab-to-cradle connections. Further, the poor maintenance procedures and records and incomplete maintenance completion history support failure at a bus bar connection, while poor modification fit up, testing, and the presence of hardened grease support failure at the stab-to-cradle connection. Therefore, the team concluded both failure mechanisms must be considered and corrected since either one alone could have been enough to cause the fire.

The team noted that the root cause analysis appropriately addressed the impact of the event on the stations fire protection program.

3.7 Electrical Protection and Separation (Charter Item 7)

a. Inspection Scope

The team reviewed the response of the electrical power distribution system to the electrical fault and subsequent fire to determine if problems existed in electrical protection, separation and coordination. The team analyzed the responses of the 480 Vac breakers and switchgear and the 125 Vdc control power system, and the impact of dc control power on the ability to operate breakers remotely. The team reviewed technical material for Nuclear Logistics Incorporated/Square-D cradle and circuit breaker assembly, the Micrologic 5.0A electronic trip unit, AKD-5 switchgear, electrical design calculations, voltage transient plots, and the Updated Safety

Analysis Report. Also, the team used the developed timeline, interviews with Operations personnel, system engineering and electrical maintenance personnel to determine whether the electrical distribution system responded as designed and as expected to the individual events and actuations associated with the fire.

The team reviewed the licensees conclusions about the response of the electrical power distribution system, reviewed the technical material and time-current characteristics curves for the trip units on breakers 1B3A and BT-1B3A to determine what coordination existed between the breakers, and reviewed the system design criteria to determine what protection was required. The team also reviewed time-voltage plots for the 4160 Vac buses for the period of the event to provide insight into the response of the 480 Vac distribution system. Fort Calhoun Station did not plot electrical parameters for the 480 Vac distribution system.

b. Findings and Observations

The team concluded that the licensee failed to maintain the electrical power distribution system design and licensing bases. The system was designed to provide two redundant, electrically and physically independent distribution trains of electrical power to safety-related loads during anticipated operational occurrences, design basis accidents, and external events. The design basis included provisions to limit fire damage to one train of the electrical distribution system, as described in Section 8.1.1 of the Updated Safety Analysis Report.

Omaha Public Power District was licensed in accordance with the draft design criteria published in the Federal Register (32FR10213) on July 11, 1967. These criteria were different than the final general design criteria published by the Atomic Energy Commission in 10 CFR Part 50, Appendix A, on February 20, 1971.

Appendix G of the Updated Safety Analysis Report, Responses to 70 Criteria, described the draft general design criteria to which Omaha Public Power District was required to adhere. Design Criterion 3, Fire Protection, stated, in part, that the reactor facility shall be designed to minimize the probability of events such as fires and explosions, and to minimize the potential effects of such events to safety.

The safety-related 480 Vac distribution system arrangement is illustrated in Figure 1 of Attachment 4. The nine 480 Vac load centers were comprised of AKD-5 low voltage switchgear. The load centers were single-ended units with a delta-delta connected power transformer on one end providing the step down function from 4160 Vac to 480 Vac. The system consisted of six main buses and three island buses. The island bus sections were connected to one of the adjacent bus sections by a normally closed bus-tie circuit breaker. The other bus-tie breaker was kept open and electrically interlocked to prevent cross-connecting the 4160 Vac buses.

Three load centers were supplied by the 1A3 bus; three load centers were supplied by the 1A4 bus.

The licensee's root cause investigation concluded that the fire in load center 1B4A was the result of high resistance connections on the line side of the 1B4A feeder breaker cubicle, which caused overheating and failure of the cradle finger clusters, resulting in bus grounding and phase-to-phase shorting. The investigation also

determined that combustion products from the fire caused a fault on the island bus side of bus-tie breaker BT-1B4A, which resulted in an overcurrent condition through breakers 1B3A and BT-1B3A. The design of the overcurrent protection scheme for these breakers was such that breaker BT-1B3A should have opened before breaker 1B3A to isolate the fault without tripping breaker 1B3A. The licensees initial investigation determined that breaker 1B3A tripped on a short-time overcurrent fault and concluded that since the breaker protection scheme did not operate as designed, bus 1B3A was de-energized which resulted in the loss of multiple electrical power distribution system trains from a single fire. Appropriate breaker coordination was required by the licensees fire protection program to ensure that the plant could achieve and maintain safe shutdown conditions following a fire.

Because Fort Calhoun Station utilized an ungrounded-delta electrical distribution system with no means for ground fault tripping of load centers and did not use instantaneous overcurrent trip protection, the only electrical fault protection on the 480 Vac bus feeders and bus-tie breakers was long-time and short-time overcurrent protection. The team requested trip data for the breakers because the new electronic trip units had onboard memory which provided the capability to store and retrieve values of sensed current; however the team was informed that this data was not available, as it had been inadvertently deleted. This failure resulted in the loss of important data for the event. The team could not substantiate the licensees conclusion that breaker 1B3A tripped on overcurrent.

Additional NRC inspection and licensee investigation prompted the licensee to initiate another root cause analysis to investigate the tripping of breaker 1B3A as a separate event. Condition Report CR 2011-5613 was written to document the unexpected tripping of breaker 1B3A. Condition Report CR 2011-6621 was written to determine if train separation design basis assumptions were still valid, and was elevated to a category A condition level (significant condition adverse to quality) to investigate the breaker 1B3A spurious trip. Condition Report CR 2011-7654 was written to document that no guidance existed for maintenance personnel to identify the fault data for the trip of breaker 1B3A. Condition Report CR 2011-7655 was written to document that the fault data for the trip of breaker 1B3A had not been recovered.

The licensee removed breaker 1B3A from service and on October 12, 2011 sent it to the vendor for additional testing and analysis. The licensees analysis for breaker 1B3A had not been completed when the team left the site. This issue is being addressed as part of unresolved item 05000285/2011014-03, Cause of Breaker 1B3A Trip Not Understood.

The team reviewed boroscope images of the remaining cradle to bus bar connections in the unaffected switchgear, condition reports, and resistance measurements for the cradle finger to bus bar engagement. Based on these reviews, the team questioned the operability of the remaining load centers. The licensee subsequently declared the remaining 480 Vac load centers inoperable, and began the long-term implementation of corrective actions which included electroplating the load center bus bars to ensure adequate silver-plating on all the 480 Vac bus bar stabs, and modifying the cradle fit in the breaker cubicles to achieve

appropriate cradle finger to bus bar engagement. This concern was entered in to the licensee's corrective action program as Condition Report CR 2011-7365.

The ungrounded 125 Vdc distribution system, illustrated in Figure 2 of Attachment 4, consisted of three battery chargers, two storage batteries, two main distribution panels, manual transfer switches and other distribution equipment necessary for operation of the plant. The dc control power for each 4160 Vac and 480 Vac load center was fed via manual transfer switches, which allowed manual selection of either dc train as the source of control power to the buses. The manual transfer switches were designed with both trains of dc power in a common enclosure, with the normal and emergency supplies to the manual transfer switches fed from their respective dc buses via independent circuit breakers that were designed to provide selective fault protection and train separation.

During the event, ground alarms were received in the control room for both dc buses due to extensive damage inside load center 1B4A. Battery charger #2 was de-energized, and battery charger #3 had to be manually aligned to power dc bus #2.

The team questioned the cause for the grounds, what affect the grounds had on the operability of the dc system, and what separation criteria the design was required to meet.

The ground on dc bus #1 was caused by the failure of a conductor in the close permissive interlock circuitry between bus-tie breaker BT-1B3A and breaker 1B4A.

The interlock was designed to prevent the cross-connection of 4160 Vac buses by preventing both bus-tie breakers and feeder breakers from being closed at the same time. The grounds on dc bus #2 were attributed to damage in control circuits associated with component cooling water pump AC-3B and condenser evacuation pump FW-8B. Control circuits for these pumps had auxiliary switches associated with the pumps on the opposite train that permitted an auto-start feature when the breaker for the running pump opened. Similar to the bus-tie breaker interlock, the cable connecting the auto-start feature to the control circuit was grounded by the fire in the opposite train. The team concluded that dc control power remained available to the safety-related 4160 Vac buses throughout the event, and the grounds on the dc buses would not have prevented the dc system from performing its safety function. Because the system was normally ungrounded, a single ground on either the positive or negative bus of the system did not result in the loss of a circuit, but did indicate a degraded condition.

Condition Report CR 2011-5428 was written to document that after the fire in bus 1B4A, both dc trains had grounds. Condition Report CR 2011-7484 was written to document that further investigation of the independence of the dc distribution systems was needed to address the identification of grounds on both dc buses during the fire. This condition report was subsequently downgraded and closed after an operability assessment determined that the dc distribution system had remained operable throughout the event. The licensee developed and performed temporary modification EC 53288, DC Bus 1 and 2 Lifted Leads due to 1B4A Fire, Revision 0 to remove the grounds on the dc buses and allow bus 1B3A-4A to be returned to service.

Omaha Public Power District committed to meeting the criteria in IEEE 384-1981, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits. This standard describes independence requirements for Class 1E equipment, including those required for safe shutdown. Section 5.10.1 stated that an electrically generated fire in one Class 1E division shall not cause a loss of function in its redundant Class 1E division. Omaha Public Power District also committed to the design criteria in IEEE 308-1974, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations. Criterion 5.2.2(3),

Independence, stated that distribution circuits to redundant equipment shall be physically and electrically independent of each other. Criterion 4.6, Equipment Protection, stated that Class 1E power equipment shall be physically separated from its redundant counterpart or mechanically protected as required to prevent the occurrence of common failure modes due to design basis events. The standard defines design basis events to include postulated phenomena such as fire. This issue is being addressed in Section 3.10 as part of unresolved item 05000285/2011014-03, Cause of Breaker 1B3A Trip Not Identified.

The team concluded that the provisions of License Condition 3.D, Fire Protection Program, were not maintained because the design basis provisions discussed in IEEE 384-1981, IEEE 308-1974, and the Updated Safety Analysis Report to limit fire damage to one train of the equipment necessary for safe shutdown were not maintained. A finding associated with this failure is described in section 3.10.

3.8 Planned Repairs (Charter Item 8)

a. Inspection Scope

The team observed the in-progress repair work on modification EC 53257, 480V 1B4A Repair/Replacement, which was written to rebuild the switchgear and replace circuit breakers. The rebuild of the 1B4A load center was being performed by the breaker vendor and included redesign of the switchgear internal structure to change the cradle to bus bar connections to bolted connections, replacement of all the original General Electric circuit breakers with Nuclear Logistics Incorporated/Square-D breaker/cradle assemblies, restoration of the bus duct from bus 1B4A to island bus 1B3A-4A, replacement of the control components, and replacement of internal wiring. Because the licensee had contracted with the vendor to rebuild the damaged load center, the team also reviewed the licensees and vendor quality assurance process for the repair, the licensees oversight of the vendor, the scheduled acceptance testing methods, and the in-progress work orders. The team reviewed the repair methods for heat sensitive components including cable jackets and insulation, connections, and instrumentation. The team interviewed vendor technicians involved in the rebuild, and licensee personnel responsible for oversight of the project. The team also reviewed the effectiveness of the licensees inspections and efforts to clean and remove combustion products.

b. Findings and Observations

The team concluded that licensee oversight of the work process was limited in scope. The team observed that:

• Vendor technicians performing the repairs did not have work instructions at the work location.

• The technician performing the installation was also performing the quality assurance function.

• Controls were not in place to ensure material was being adequately inventoried and accounted for while being used in the safety-related switchgear.

• Licensee staff stated that the station had turned the repair process over to the vendor as a turn-key operation and the vendor was responsible for the quality assurance oversight of the repair; the licensee would perform acceptance testing only after the vendor had completed the repairs.

The team identified that the in-progress repair activities were not in accordance with the licensees quality control process for safety-related equipment, and as a result the licensee staff halted the repair work. The licensee performed an investigation and identified that Omaha Public Power District Construction Management personnel had not followed the requirements of Procedure SO-M-100, Conduct of Maintenance, Revision 54, for control of contracted personnel prior to allowing the vendor to begin work.

The team considered the failure to follow the requirements of Procedure SO-M-100, Conduct of Maintenance, Revision 54, to be a violation of NRC requirements.

Specifically, Fort Calhoun Stations Technical Specification 5.8.1, requires, in part, that the licensee establish and implement the written procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978, which includes procedures governing maintenance of safety-related equipment. Using Inspection Manual Chapter 0612, the inspectors determined the safety significance of this violation to be minor since the equipment was not restored to service. Minor violations represent items of low safety significance and are not typically subject to formal enforcement action or documentation by the NRC; however, the violations must still be corrected by the licensee.

The licensee initiated Condition Report CR 2011-7367 to address that the in-progress repair activity was not in accordance with the licensees quality control process for safety-related equipment and to document the limited oversight being provided for the repair of the safety-related 1B4A load center. Condition Report CR 2011-7565 was written to address oversight of contractors performing work on the switchgear and to document that the investigation had required considerable management resources to resolve the issue, resulting in the bus work being shut down for seven days. The team concluded that this was a conservative decision by the licensee.

The team determined that the licensee had not appropriately considered electrical separation for Class 1E and non-Class 1E cabling in the modification repairing the switchgear. The team determined that:

(1) inspections of the wiring in 1B4A had discovered deficiencies in separating Class 1E and non-Class 1E cabling; and (2)the licensee followed different industry standards for existing panel wiring and new panel wiring. The guidance in IEEE 384-1974, IEEE Trial-Use Standard Criteria for

Separation of Class 1E Equipment and Circuits was used for existing panels and the guidance in IEEE 384-1981, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits was used for new panels. The licensee initiated Condition Report CR 2011-7485 to determine if the proper requirements for electrical separation were being applied to the new 1B4A load center wiring. Condition Report CR 2011-7759 was initiated to document that the inspection of the wiring in 1B4A found deficiencies which required rework. Condition Report CR 2011-7887 was initiated to document the need for Design Engineering guidance on how to maintain proper cable separation and internal panel wiring separation for 1B4A. The 1B4A load center rebuild and associated corrective actions were not finished when the team left the site.

For modification EC 53517, the licensee had contracted with the Electric Power Research Institute to perform Indenter testing of cable jackets to determine jacket conditions. Indenter testing is a nondestructive method of evaluating the degradation of cable insulation and jacket material. The technique uses a device that presses an instrumented anvil against the cable surface under a controlled rate and measures displacement and force. The response is compared to known good samples, and provides an indication of the jacket condition. The licensee also contracted with Analysis and Measurement Services Corporation to perform additional cable characterization testing. Characterization testing performed a series of dc resistance measurements, ac impedance measurements, time-domain reflectometry testing, and insulation resistance measurements. The team reviewed the vendor reports and results and identified no concerns with the tests, results or repairs.

The team also reviewed the following modifications written for corrective actions:

• EC 53517, Repair 1B4A Fire Damaged Cables, Revision 0, which repaired cables damaged by the fire, including cables in cable trays above the 1B4A load center.

• EC 53751, Adjust Rail Stops for Masterpact NW Breakers, Revision 0, which was written to apply additional silver plating to the bus stabs, and adjust the internal rail stops in the main and bus-tie breaker cubicles on 480 Vac load centers 1B3A, 1B3B, 1B4B, 1B3C, and 1B4C to facilitate better connections between the finger clusters on the cradle and the switchgear bus stabs.

• EC 53347, Modify Back Panels on 480 Volt Buses, Revision 1, which was written to modify the divider plates inside the 480 Vac load centers to facilitate removal and allow internal inspections and maintenance of the bus compartment.

The team identified no concerns with the planned corrective actions. Because the 1B4A switchgear was being replaced and all damaged cables had been repaired or replaced, no combustion products should remain in the switchgear or cabling.

Condition Report CR 2011-5454 was written to address the need to de-energize battery chargers and inverters in the west switchgear room and to clean the interiors, which had been completed.

3.9 Risk Assessment Information (Charter Item 9)

a. Inspection Scope

The team gathered information needed to assess the risk impact of the performance deficiency identified in this report. The team identified the total population of impacted equipment which included all nine safety-related 480 Vac switchgear and both safety-related 125 Vdc electrical distribution trains. The team identified the length of time the equipment was susceptible to failure and additional potential failure mechanisms for the cause of the fire. During the week of December 12, 2011, the team observed simulator runs of the fire scenario to improve their understanding of licensee and plant responses to the event.

b. Findings and Observations

3 to this report describes the risk assessment methods and results.

3.10 Findings

.1 Failure to Ensure that the 480 Vac Electrical Power Distribution System Design

Requirements were Implemented and Maintained

Introduction.

The team identified a finding of preliminarily high safety significance (Red) for the failure to ensure that the 480 Vac electrical power distribution system design requirements and fire protection program requirements were properly implemented and maintained through proper modification, maintenance, and design activities. Three self-revealing violations were associated with this performance deficiency:

• A violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, for the failure to ensure that design changes were subject to design control measures commensurate with those applied to the original design and that measures were established to assure that applicable regulatory requirements and the design basis for those safety-related structures, systems, and components were correctly translated into specifications, drawings, procedures, and instructions;

• A violation of 10 CFR Part 50, Appendix B, Criterion XVI Corrective Action, for the failure to establish measure to assure that a significant condition adverse to quality was promptly identified and corrected, and measures taken to preclude repetition;

• A violation of License Condition 3.D, Fire Protection Program, for the failure to ensure that the electrical protection and physical design of the 480 Vac electrical power distribution system provided the electrical bus separation required by the fire protection program.

Description.

On June 7, 2011, while the plant was in cold shutdown, the licensee declared an Alert due to a catastrophic fire in the west switchgear room. The Halon

system in the room automatically actuated and aided in extinguishing the fire. The fire brigade responded, as did off-site fire assistance. The plant was in a planned refueling outage, and was already in a Notice of Unusual Event condition due to flood levels on the Missouri River. The fire was caused by the failure of a feeder breaker for 480 Vac load center 1B4A. A large quantity of soot and smoke was produced by the fire which migrated into a non-segregated bus duct (a metal enclosure containing the bus bars for all three electrical phases) connecting the 1B4A bus to island bus 1B3A-4A, even though the bus-tie breaker was open. The smoke and soot was sufficiently conductive that three phase shorting occurred between the bus bars such that island bus 1B3A-4A and the other connected train load center 1B3A were adversely affected. The load center supply breaker 1B3A tripped, resulting in 480 Vac buses 1B3A and 1B3A-4A being de-energized.

Operators manually opened the 4160 Vac feeder breaker upstream of the faulted breaker to de-energize the 1B4A bus. Some minutes later, in accordance with the applicable procedure, operators manually de-energized 4160 Vac buses 1A2 and 1A4, which resulted in de-energizing the remaining 480 Vac buses on the same train as the fire. This left only three of the nine safety-related 480 Vac buses energized.

The event resulted in the loss of spent fuel pool cooling, loss of safety-related load center 1B4A, unexpected tripping of the opposite train load center 1B3A, and grounds on both trains of safety-related 125 Vdc power. These failures adversely impacted the required safe shutdown capability as required by the licensees fire protection program.

The licensee attributed the breaker failure and subsequent fire, in part, to a permanent plant modification, EC 33464, Replace AK-50 480 V Main and Bus-Tie Breakers With Molded Case Type or Equivalent, Revision 0, which replaced 12 General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices. The modification replaced six feeder circuit breakers and six bus-tie breakers, including breaker 1B4A. The licensee also attributed the breaker failure and subsequent fire to inadequate maintenance effectiveness which contributed to conditions that resulted in failure of the modification to maintain the 480 Vac electrical power system design basis.

The team concluded that deficiencies in the modification and maintenance process were the most probable cause of the fire event.

A. Design Modification As discussed in section 3.4, the licensee installed permanent plant modification, EC 33464 in November 2009. The modification replaced six 480 Vac safety-related feeder circuit breakers and six 480 Vac safety-related bus-tie breakers. The new circuit breaker design differed from the original breakers due, in part, to the introduction of a cradle assembly. The cradle assembly converted the internal vertical breaker connectors to top and bottom spring-loaded horizontal finger assemblies which connected to the silver-plated bus stabs. The modification failed to account for differences in the new breaker assemblies, including the differences in length of the cradle finger assemblies. When the new breakers were installed, the cradle fingers did not mate with the switchgear bus bars on the silver-plated area as

designed but over-travelled to rest on the copper portion of the bus bar. Because the modification process failed to ensure the cradle fingers were properly engaged with the switchgear bus bars, high resistance connections developed resulting in a catastrophic fire which destroyed load center 1B4A and adversely impacted the redundant train of safe shutdown equipment.

The team concluded that the modification adversely affected the availability and reliability of the Class 1E 480 Vac electrical power distribution system, and failed to ensure that the design basis for the 480 Vac electrical power distribution system was maintained.

B. Maintenance Effectiveness As discussed in section 3.5, inadequate maintenance practices contributed to the fire event. The licensee had previously identified significant conditions adverse to quality in the preventative maintenance program for the 480 Vac breakers and switchgear, concluding that the program was ineffective at identifying and correcting high resistance electrical connections before equipment failure. The licensees failure to ensure that the 480 Vac switchgear was properly maintained, including cleaning bus bars of hardened grease and oxidation and inspecting the bus compartment sections contributed to the high resistance connections in the switchgear, which resulted in equipment failure.

The team concluded that the failure to prevent high resistance electrical connections through adequate maintenance was a direct contributor to the fire in load center 1B4A, and that the licensee had failed to prevent recurrence of this significant condition adverse to quality.

C. Train Separation As discussed in sections 3.3 and 3.7, the 480 Vac electrical power distribution system responded to the fire event in an unexpected manner. The fire in load center 1B4A adversely impacted the redundant train of equipment used to safely shut down the reactor, which the licensees fire protection program concluded would not happen. The team concluded that the provisions of License Condition 3.D, Fire Protection Program, were not maintained because the design basis provisions to limit fire damage to one train of the equipment necessary for safe shutdown were not maintained.

Analysis.

The failure to ensure that the 480 Vac electrical power distribution system design requirements were properly implemented and maintained through proper modification, maintenance, and design activities contributed to create a catastrophic fire in a switchgear that adversely impacted the required safe shutdown capability of the plant. This was a performance deficiency. Specifically:

(1) Design reviews and work planning and instructions for a modification to install new 480 Vac load center breakers failed to ensure that the cradle adapter assemblies had low-resistance connections with the bus bars and had a proper fit;

(2) Preventive maintenance activities were inadequate to ensure low-resistance bus bar connections; and

(3) Design reviews of the electrical protection and train separation of the 480 Vac electrical power distribution system were inadequate to ensure that a fire in load center 1B4A would not prevent operation of equipment needed for safe shutdown in load center 1B3A, as required by the fire protection program.

The licensee entered these issues into their corrective action program under numerous condition reports described in the body of this report.

In accordance with NRC Inspection Manual Chapter 0612, Appendix B, Issue Screening, the issue was more than minor because it affected the Initiating Events Cornerstone and was associated with both the protection against external events attribute (i.e., fire) and the design control attribute. The finding affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Manual Chapter 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 4a, directed the process to a Phase 3 analysis because the finding increased the likelihood of a fire. The NRC completed a Phase 3 analysis using the plant-specific Standardized Plant Analysis Risk Model for Fort Calhoun, Revision 8.15, the Individual Plant Evaluation of External Events (IPEEE),and hand calculations. The exposure period of 1 year represented the maximum exposure time allowable in the significance determination process. The analysis estimated the initiating event likelihood for a single fire of 7.0 X 10-2/yr. The analysis covered the risk affected by the performance deficiency for postulated fires of any of the nine continuously energized breakers including the potential for multiple fire initiators. Additionally, seismically-induced fires were postulated based on the characteristics of the performance deficiency. Finally the analysis determined that the finding did not involve a significant increase in the risk of a large, early release of radiation. The final result was calculated to be 4.0 x 10-4 indicating that the finding was of high safety significance (Red). This performance deficiency had a crosscutting aspect in the area of human performance associated with the resources component because the licensee did not ensure that personnel, equipment, procedures, and other resources were adequate to assure nuclear safety.

Specifically, the licensee did not ensure that design documentation, procedures, and work packages were adequate to assure that design margins were maintained.

H.2(c)

Enforcement.

Three self-revealing violations were associated with this performance deficiency. Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part that:

(1) design changes, including field changes, be subject to design control measures commensurate with those applied to the original design;

(2) measures be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions; and

(3) these measures assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled.

Contrary to the above requirement, from November 2009 to June 7, 2011, the licensee failed to ensure that design changes were subject to design control measures commensurate with those applied to the original design; failed to assure that applicable regulatory requirements and the design basis for those safety-related structures, systems, and components were correctly translated into drawings, procedures, and instructions; and failed to ensure that these measures assured that appropriate quality standards were specified and included in the design documents.

Specifically, design reviews, work planning and instructions for a modification to install new 480 Vac load center breakers failed to ensure that the cradle adapter assemblies had low resistance connections with the switchgear bus bars by establishing a proper fit and requiring low resistance connections to assure that design basis requirements were maintained.

Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that measures be established to assure that conditions adverse to quality such as failures, defective material and equipment, and nonconformances are promptly identified and corrected. For significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.

Contrary to the above requirement, from May 22, 2008, to June 7, 2011, the licensee failed to correct a significant condition adverse to quality and take corrective actions to preclude repetition. Specifically, the licensee failed to ensure that their preventative maintenance program for the safety-related 480 Vac electrical power distribution system was adequate to ensure proper cleaning of conductors, proper torquing of bolted conductor or bus bar connections, and adequate inspection for abnormal connection temperatures. In 2008, the licensee identified that preventative maintenance procedure EM-PM-EX-1200, Inspection and Maintenance of Model AKD-5 Low Voltage Switchgear, was less than adequate as a result of a root cause analysis for the failure of bus-tie breaker BT-1B3A to close on demand and loss of bus 1B3A. The licensee categorized this failure as a significant condition adverse to quality. The analysis concluded that breaker BT-1B3A had high resistance connections which occurred as a result of both procedure deficiencies and inadequate implementation resulting in the failure to remove dirt and hardened grease from electrical connections. The licensee implemented corrective actions to address these procedural deficiencies; however the corrective actions were inadequate to prevent high resistance connections in load center 1B4A due to the presence of hardened grease and oxidation. The procedure did not contain adequate guidance for torquing bolted connections or measuring abnormal connection temperatures due to loose electrical connections in the bus compartment of the switchgear.

License Condition 3.D, Fire Protection Program, requires, in part, that the licensee implement and maintain in effect all provisions of the approved Fire Protection Program as described in the Updated Safety Analysis Report and as approved in NRC safety evaluation reports. Section 9.11.1 of the Updated Safety Analysis Report describes the fire protection system design basis and states, in part, that the design basis of the fire protection systems includes commitments to 10 CFR Part 50, Appendix R, Section III.G.Section III.G, Fire protection of safe shutdown

capability, requires, in part, that fire protection features be provided for structures, systems, and components important to safe shutdown, and that these features be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions is free of fire damage.

Contrary to the above requirement, from November 2009 to June 7, 2011, the licensee failed to implement and maintain in effect all provisions of the approved Fire Protection Program. Specifically, the licensee failed to ensure that design reviews for electrical protection and train separation of the 480 Vac electrical power distribution system were adequate to ensure that a fire in load center 1B4A would not adversely affect operation of redundant safe shutdown equipment in load center 1B3A, such that one train of systems necessary to achieve and maintain hot shutdown conditions were free of fire damage. Combustion products from the fire in load center 1B4A migrated across normally open bus-tie breaker BT-1B4A into the non-segregated bus duct, shorting all three electrical phases. The non-segregated bus ducting electrically connected load center 1B4A with the Island Bus 1B3A-4A and, through normally closed bus-tie breaker BT-1B3A, to the redundant safe shutdown train.

The licensee has entered these issues into their corrective action program under numerous Condition Report numbers as described in this report. Pending completion of a final significance determination, the performance deficiency will be considered an apparent violation AV 05000285/2011014-01, Failure to Ensure that the 480 Vac Electrical Power Distribution System Design Requirements were Implemented and Maintained.

.2 Unresolved Item 05000285/2011014-02, Failure to Perform Adequate 10 CFR 50.59

Review.

Introduction.

The team identified an unresolved item related to the licensees implementation of the requirements in 10 CFR 50.59 for modification EC 33464, Replace AK-50 480 V Main and Bus-Tie Breakers With Molded Case Type or Equivalent, Revision 0, and the adequacy of the design review and screening performed to support the modification.

Description.

In November 2009, the licensee implemented a modification to replace 12 General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices. This modification was developed to address obsolescence issues and maintenance problems with the older AK-50 circuit breakers.

Fort Calhoun Station used General Electric AKD-5 Powermaster Low Voltage Drawout Switchgear, with a welded aluminum bus bar structure that transitioned to copper bus stabs in each breaker cell. The original AK-50 circuit breakers connected directly to the silver-plated areas on the line and load stabs. The new Nuclear Logistics Incorporated /Square-D circuit breaker design was an integrated unit consisting of a circuit breaker and cradle assembly. The cradle assembly converted the internal vertical breaker connectors to top and bottom spring-loaded horizontal finger assemblies which connected to the switchgear bus stabs.

The team reviewed the licensees implementation of the requirements in 10 CFR 50.59, Changes, Tests and Experiments, for the modification. The team noted that the screening process did not recognize the potential for adverse effects on the design basis function of the 480 Vac electrical distribution system because of the introduction of a cradle assembly that had different connections to the switchgear bus bars. The original breakers did not require the cradle adapter and had connector assemblies which mounted to the silver-plated portion of the bus bars. The new assembly introduced the cradle as an adapter between the breaker and switchgear, and introduced additional resistances in the circuits. The licensees screening documents stated that the electrical connections on the cradle matched the existing switchgear General Electric breakers; however, the licensees root cause analysis showed that the cradle finger assemblies were not the same size as the original breaker connections. The team also noted that the licensees screening process did not recognize the potential for high resistance connections to exist, and did not analyze additional failure mechanisms that may have been created by the addition of the cradle assemblies.

Condition Report CR 2011-6319 was written, after the fire, for the discovery of the improper engagement of cradle fingers to silver plating on the stabs.

Further inspection is required to determine if the licensees implementation of the requirements of 10 CFR 50.59 were appropriate.

.3 Unresolved Item 05000285/2011014-03, Cause of Breaker 1B3A Trip Not

Identified.

Introduction.

The team identified an unresolved item related to an apparent lack of 480 Vac electrical bus protection and coordination associated with the unexpected tripping of feeder breaker 1B3A as a result of a fire in the 1B4A switchgear.

Description.

During the fire event in the 1B4A switchgear on June 7, 2011, the feeder breaker to the 1B3A switchgear tripped unexpectedly, de-energizing a redundant train of safe shutdown equipment. The licensee performed a root cause analysis of the events associated with the fire in switchgear 1B4A and originally concluded that breaker 1B3A tripped on overcurrent based on inspection of the breaker following the event; however, additional investigations could not confirm this conclusion.

Six safety-related feeder breakers and six safety-related bus-tie breakers had been replaced in November, 2009 under permanent plant modification EC 33464. The modification replaced General Electric AK-50 low voltage power circuit breakers with Nuclear Logistics Incorporated/Square-D Masterpact circuit breaker/cradle assemblies and digital trip devices. The 480 Vac electrical distribution system is illustrated in Figure 1 of Attachment 4 of this report, and is comprised of nine load centers; three load centers are fed from the 4160 Vac bus 1A3 and three load centers are fed from 4160 Vac bus 1A4. There are three island buses which can be energized from either 480 Vac bus via bus-tie breakers.

The 480 Vac electrical distribution system design was such that an electrical fault in the 1B4A load center should trip the normally-closed bus-tie breaker BT-1B3A, isolating the fault from the 1B3A bus. The bus-tie breakers had electronic trip settings with time-overcurrent trip values coordinated with those of the bus feeder breakers. The team reviewed Calculation EC-91-084, Breaker and Fuse Coordination Study, Revision 8, which was developed to show that adequate overcurrent protection and coordination existed on the safety-related buses. The team reviewed the time-current characteristic curves, breaker vendor materials, licensee breaker calibration data and time-voltage plots of the 4160 Vac bus voltages but was unable to confirm the licensees original conclusions that breaker 1B3A tripped on overcurrent. The licensee elevated Condition Report CR 2011-6621 to condition level A, requiring a root cause analysis to investigate the breaker 1B3A spurious trip. Condition Report CR 2011-5613 was written to document the unexpected tripping of breaker 1B3A.

The licensee removed breaker 1B3A from service and on October 12, 2011 and sent it to the vendor for additional testing and analysis. The licensees analysis of breaker 1B3A had not been completed during the inspection period. Further inspection is required to determine whether performance deficiencies exist and if they are more than minor.

4OA3 Event Follow-up

(Closed) LER 05000285/2011008-00/01, Fire in Safety Related 480 V Electrical Bus.

On August 5, 2011, the licensee identified a failure of a safety related 480 Vac load center supply breaker in the switchgear room (Bus 1B4A). The licensee identified a failure of a safety related 480 Vac load center supply breaker in the switchgear room (Bus 1B4A). On October 27, 2011, the licensee submitted revision 1 to this LER. This revision included additional information about the root cause of the event and planned corrective actions. The details and findings associated with this event are described in this inspection report. This LER is closed.

4OA6 Meetings

Exit Meeting Summary

The inspection team briefed members of Fort Calhoun Station staff on September 15, 2011, following completion of the first onsite portion of the inspection. An exit meeting was performed on February 29, 2012, with Mr. D. Bannister, Vice President and Chief Nuclear Officer, and other members of Fort Calhoun Station staff.

The inspectors verified whether the licensee considered any materials provided to or reviewed by the inspectors to be proprietary. None were identified.

ATTACHMENT 1:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

C. Cameron Supervisor - Regulatory Compliance

C. Sterba Digital Design Engineering - Supervisor

D. Bannister Vice President and Chief Nuclear Officer

D. Digiacinto System Engineer - Electrical

E. Matzke Compliance

G. Barna Electrical Maintenance Superintendent

J. Adams Design Electrical Engineering

J. Geschwender Probabilistic Risk Assessment

J. Herman Division Manager - Nuclear Engineering

J. Niedermeyer Lead RCA Investigator

M. Cooper Licensing Engineer

M. Prospero Plant Manager

M. Riva Fire Protection System Engineer

P. Delizza Senior Instructional Technician

S. Miller Manager - Design Engineering

W. Goodell Division Manager - Nuclear Performance Improvement and Support

NRC Personnel

J. Kirkland Senior Resident Inspector

J. Wingebach Resident Inspector

LIST OF ITEMS

Opened

05000285/2011014-01 AV Failure to Ensure that the 480 Vac Electrical Power Distribution System Design Requirements were Implemented and Maintained (Section 3.10.1)

05000285/2011014-02 URI Failure to Perform Adequate 10 CFR 50.59 Review (Section 3.10.2)

05000285/2011014-03 URI Cause of Breaker 1B3A Trip Not Identified (Section 3.10.3)

Opened and Closed

None.

Closed

05000285/2011008-00/01 LER Failure of Safety Related 480 volt AC Load Center Supply Breaker in Switchgear Room (Bus 1B4A)

(Section 4OA3)

Attachment 1