IR 05000285/2013017

IR 05000285-13-017, July 8, 2013 Through March 13, 2014, Fort Calhoun Station - Manual Chapter 0350 Inspection Report and Final Significance Determination of White Finding and Notice of Violation

ML14115A411
Person / Time
Site:	Fort Calhoun
Issue date:	04/25/2014
From:	Vegel T Division of Nuclear Materials Safety IV
To:	Cortopassi L Omaha Public Power District
Hay M
References
EA-13-222 IR-13-017
Download: ML14115A411 (64)

Text

UNITED STATES ril 25, 2014

SUBJECT:

FORT CALHOUN STATION - MANUAL CHAPTER 0350 INSPECTION REPORT AND FINAL SIGNIFICANCE DETERMINATION OF WHITE FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT NO. 05000285/2013017

Dear Mr. Cortopassi:

On March 13, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a team inspection at the Fort Calhoun Station. The inspection focused on the stations actions involving the identification, evaluation, and corrective actions associated with providing adequate tornado missile protection for plant structures, systems, and components. The enclosed inspection report presents the results of this inspection. A final exit briefing was conducted with you and other members of your staff on March 14, 2014.

The enclosed inspection report discusses one finding that was preliminarily determined to be White, having low to moderate safety significance. This finding involved the failure to provide adequate tornado missile protection for equipment important to safety. The station implemented plant modifications correcting all identified deficiencies. These corrective actions were reviewed by the NRC and found acceptable prior to plant restart that occurred in December of 2013.

On March 18, 2014 you informed Mr. Anton Vegel and Mr. Michael Hay of NRC, Region IV, that the Fort Calhoun Station agreed with the low to moderate risk significance (White)

characterization of this finding and that you declined an opportunity to discuss this issue in a Regulatory Conference or provide a written response.

After considering all available information, the NRC has concluded that the finding is appropriately characterized as White, having low to moderate safety significance. The NRC has also concluded that the failure to adequately protect the facility from tornado generated missiles is a violation of NRC requirements, as cited in the attached Notice of Violation (Notice). The circumstances surrounding this violation are discussed in detail in the enclosed inspection report. In accordance with the NRC Enforcement Policy, the Notice is considered escalated enforcement action because it is associated with a White finding. The NRC has concluded that the information regarding the reason for the violation, the corrective actions implemented to correct the violation and prevent recurrence, and the date when full compliance was achieved was obtained by the NRC during our inspection activities.

Therefore, you are not required to respond to this letter unless the description contained in the enclosed report does not accurately reflect your corrective actions or your position. Additionally, since this issue was identified and resolved by the station during the extended shutdown, under increased NRC oversight of the Inspection Manual Chapter 0350 Process, this issue will not be used for future plant performance assessment inputs and is considered closed.

There were three NRC identified findings identified during this inspection that were determined to be of very low safety significance (Green), and involved violations of NRC requirements.

Additionally, the NRC determined that one traditional enforcement Severity Level IV violation of 10 CFR 50.59, Changes, tests, and experiments, occurred. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the NRC Enforcement Policy.

Although these findings were determined to be of very low safety significance, they are of concern to the NRC because they reflect a continuing pattern of station personnel failing to understand and use design and licensing basis information when evaluating degraded and non-conforming conditions and implementing changes to the facility. The NRC understands the station has long term corrective actions to address these areas and plans to review the effectiveness of the actions during future NRC inspections. Additionally, the NRC looks forward to having discussions on this topic during the next public meeting currently scheduled for May 13, 2014.

If you contest these violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN:

Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Fort Calhoun Station.

If you disagree with a cross-cutting aspects assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC Resident Inspector at the Fort Calhoun Station.

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice and Procedures, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's Agencywide Document Access and Management System (ADAMS).

ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Tony Vegel Director, Division of Nuclear Materials Safety Docket No.: 50-285 License No.: DPR-40 Enclosure:

1. Notice of Violation 2. Inspection Report 05000285/2013017 w/Attachments:

1. Supplemental Information 2. Task Interface Agreement 2013-07, Concurrence on Fort Calhoun Tornado Missile Protection Licensing Basis 3. Detailed Risk Assessment cc w/ encl: Electronic Distribution

SUMMARY OF FINDINGS

IR 05000285/2013017; 07/08/2013 - 03/13/2014; Fort Calhoun Station, Supplemental

Inspection for Repetitive Degraded Cornerstones, Multiple Degraded Cornerstones, Multiple Yellow Inputs or One Red Input.

The report covered an eight month period of inspection by an Inspection Manual Chapter 0350 inspection team. One White and three Green, non-cited violations were identified. Additionally, one traditional enforcement Severity Level IV violation was identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. The cross-cutting aspect is determined using Inspection Manual Chapter 0310, Components Within the Cross Cutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

White.

The team identified multiple examples of a violation of 10 CFR 50,

Appendix B, Criterion III, Design Control, involving the failure to establish applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition. Specific examples included the steam driven auxiliary feedwater pump exhaust stack, auxiliary feedwater components located in Room 81, raw water pump electrical pull boxes PB-128T and PB-129T, and diesel generator fuel oil storage tank fill and vent lines. The licensee implemented plant modifications to adequately protect all affected equipment from tornado generated missiles and entered the deficiencies into its corrective action program for resolution as Condition Reports CR 2013-03839, 2013-03842, 2013-14117, and 2013-14246.

The failure to ensure that station components were adequately protected from tornado missiles was a performance deficiency. In accordance with NRC Inspection Manual Chapter 0612, Appendix B, Issue Screening, the performance deficiency was determined to be more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the finding affected the reliability of required components following a postulated tornado-generated missile impact. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, Exhibit 4, External Events Screening Questions. The finding required a detailed risk evaluation because it involved the lack of equipment specifically designed to mitigate a severe weather initiating event (tornado) and could have degraded two or more trains of a multi-train system.

The Region IV senior reactor analyst performed a detailed risk evaluation in accordance with Appendix A, Section 6.0, Detailed Risk Evaluation. The NRC concluded the finding was characterized as having low to moderate safety significance (White). The calculated change in core damage frequency of 2.6 x 10-6 was dominated by a tornado-induced non-recoverable loss of offsite power with the failure of the emergency power supply system. The analyst determined that the finding did not affect the internal events initiator risk and would not involve a significant increase in the risk of a large early release of radiation.

The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c)(Section 4OA4.1).

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, Corrective Actions, involving the failure to promptly identify and correct a condition adverse to quality. Specifically, from August 2005 to July 15, 2013 the licensee failed to promptly identify and correct inadequate Class 1 structures wall thickness deficiencies to protect systems and components contained within from tornado generated missiles. The licensee resolved this issue by implementing changes to the facility through a licensing amendment that was reviewed and approved by the NRC. This issue has been entered into the corrective action program as Condition Report CR 2013-14363.

The licensees failure to promptly identify and correct conditions adverse to quality was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings at Power, the finding was determined to have very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; (4) did not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significance in accordance with the licensees maintenance rule program; and (5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event.

The team determined this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component involving the failure to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action.

Specifically, in 2005 the licensee identified that wall thicknesses for areas of the auxiliary building and intake structure were less than design requirements. The licensee failed to enter this deficiency into the corrective action process and inappropriately used an alternate acceptance criteria that was not part of the facility licensing basis H.1(b)(Section 4OA4.2).

Green.

The inspectors identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, associated with the licensees failure to follow Station Procedure NOD-QP-31, Operability Determination Process, when evaluating deficiencies associated with inadequate tornado missile protection for required components. Specifically, Step 4.3.15 required, in part, that, A positive determination of operability must be justified, including a technical discussion of why the concern identified does not prevent the item from fulfilling its intended safety function. In each example, the team identified that the operability determination lacked adequate technical justification for why the item was operable with the degraded or nonconforming condition. The licensee addressed these issues by taking corrective actions that provided adequate tornado missile protection in accordance with design basis requirements. The licensee entered this deficiency into its corrective action program for resolution as Condition Reports CR 2013-15429 and 2013-14006.

The failure to properly assess and document the basis for operability when a degraded or nonconforming condition was identified was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involving inadequate operability determinations occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix G, Shutdown Operations Significance Determination Process, and determined the finding to have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system inventory, the finding did not degrade the licensees ability to terminate a leak path or add reactor coolant system inventory when needed, and the finding did not degrade the licensees ability to recover decay heat removal once it was lost. This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision making when performing operability determinations

H.1(b)(Section 4OA4.3).

Green.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B,

Criterion V, Instructions, Procedures, and Drawings, associated with the licensees failure to provide adequate instructions or procedures for the construction of temporary barriers to protect raw water pump electrical pull boxes PB-128T and PB-129T from tornado generated missiles in temporary modification EC 60183. The licensee addressed this issue by modifying the temporary barriers. This issue has been entered into the licensees corrective action program as Condition Report CR 2013-13955.

The failure to provide adequate instructions for construction of temporary barriers to protect the raw water pump electrical pull boxes from tornado generated missiles was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Since the finding involving inadequate operability determinations occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix G,

Shutdown Operations Significance Determination Process, and determined the finding to have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system inventory, the finding did not degrade the licensees ability to terminate a leak path or add reactor coolant system inventory when needed, and the finding did not degrade the licensees ability to recover decay heat removal once it was lost. This finding has a cross-cutting aspect in the area of human performance associated with the work practices component because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c)(Section 4OA4.4).

Other Findings

SL-IV. The team identified three examples of a non-cited violation of 10 CFR 50.59, Changes, Test, and Experiments, associated with the licensees failure to adequately evaluate changes to determine if prior NRC approval is required. Specifically, from April 19, 2011, through August 17, 2012, the licensee failed to obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in a departure from a method of evaluation described in the Updated Safety Analysis Report. The licensee addressed these issues by submitting a license amendment which was reviewed and approved by the NRC.

This issue has been entered into the licensees corrective action program as Condition Reports CR 2013-03839, 2013-04266, 2013-05210, 2013-14363, and 2013-14665.

The licensees failure to implement the requirements of 10 CFR 50.59 and adequately evaluate changes to requirements for tornado missile protection described in the Updated Safety Analysis Report was a performance deficiency.

Because this performance deficiency had the potential to impact the NRCs ability to perform its regulatory function, the team evaluated the performance deficiency using traditional enforcement. In accordance with Section 2.1.3.E.6 of the NRC Enforcement Manual, the team evaluated this finding using the significance determination process to assess its significance. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, the finding was determined to have very low safety significance (Green) because it: (1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; (4) did not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significance in accordance with the licensees maintenance rule program; and (5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. Therefore, in accordance with Section 6.1.d.2 of the NRC Enforcement Policy, the team characterized this performance deficiency as a Severity Level IV violation. The team determined that a cross-cutting aspect was not applicable to this performance deficiency because the failure to adequately evaluate changes in accordance with 10 CFR 50.59 was strictly associated with a traditional enforcement violation (Section 4OA4.5).

REPORT DETAILS

4OA4 IMC 0350 Inspection Activities

The inspection team continued the NRC Inspection Manual Chapter 0350 inspection activities, which included follow-up on the Restart Checklist contained in Confirmatory Action Letter (CAL) EA-13-020 issued February 26, 2013. The purpose of this inspection was to perform an assessment of the causes of the performance decline at the Fort Calhoun Station (FCS), to assess whether planned corrective actions are sufficient to address the root causes and contributing causes and to prevent their recurrence, and to verify that adequate qualitative or quantitative measures for determining the effectiveness of the corrective actions are in place. These assessments were used by the NRC to independently verify that plant personnel, equipment, and processes were ready to support the safe restart and continued safe operation of the Fort Calhoun Station that occurred in December of 2013.

The team used the criteria described in baseline and supplemental inspection procedures, various programmatic NRC inspection procedures, and Inspection Manual Chapter 0350 to assess Omaha Public Power Districts (the licensee) performance and progress in implementing its performance improvement initiatives. The team performed on-site and in-office activities, which are described in more detail in the following sections of this report. This report covers inspection activities from July 8, 2013, through March 14, 2014. Specific documents reviewed during this inspection are listed in the attachment.

The following inspection scope, observations and findings, and assessments, are documented by Confirmatory Action Letter restart checklist (CL) item number.

1. Assessment of NRC Inspection Procedure 95003 Key Attributes

Section 5 of the restart checklist assessed the key attributes of NRC Inspection Procedure 95003. The key attributes are listed as separate subsections below. In addition, the NRC reviewed the effectiveness of licensee short term and long term corrective actions associated with these areas to ensure they were adequate to support sustained plant performance improvement.

Item 5.a: Design

(1) Inspection Scope a. The team independently assessed the extent of risk significant design issues associated with the protection of multiple essential structures, systems, and components from tornado generated missiles. This review verified the capability of these structures, systems, and components to perform their intended functions with a sufficient margin of safety. The inspection focused on licensee controls for implementing changes to the facilities licensing and design basis. Information from this inspection was used to assess the licensees ability to maintain and operate the facility in accordance with the design basis. (CL Item 5.a.1)

The teams review included the following:

Assessment of effectiveness of corrective actions for deficiencies involving tornado missile protection design requirements.

Evaluation of the interfaces between engineering, plant operations, maintenance, and plant support groups while resolving tornado missile protection design deficiencies.

b. Open items (Licensee Event Reports), specifically related to the tornado missile issue, were reviewed by the team. The team verified the adequacy of the licensees causal analysis and extent of condition evaluations. In addition, the team verified that adequate corrective actions were identified associated with the licensees root and contributing causes and extent of condition evaluations, and that, implementation of these corrective actions are either implemented or appropriately scheduled for implementation.

(2) Observations a. Tornado Missile Assessment A previous NRC Team inspection, NRC Inspection Report 05000285-2013, noted that the licensee had identified several components that were not adequately provided tornado missile protection and placed these conditions in the site corrective action process for review. Condition Report CR 2013-03839 documented concerns that the control room air conditioning condensers and the steam driven auxiliary feedwater (AFW) pump exhaust were not adequately protected from tornado generated missiles. Condition Report CR 2013-03842 documented concerns that the emergency feedwater storage tank was not adequately protected from tornado generated missiles. The NRC noted that the licensee had performed inappropriate operability determinations for these condition reports that incorrectly concluded the components were operable based on engineering judgment that the missile impact probability for the components was low. The team determined the use of probabilities of occurrence of accidents or external events is not consistent with the design assumption that the event occurs, and is not acceptable for making operability decisions. The licensee, recognizing that these components were not meeting facility design requirements for tornado missile protection, conducted an extent of condition review and identified that a total population of 37 components were not appropriately protected.

This NRC inspection performed an in depth assessment of the facilities actions in resolving the tornado missile protection deficiencies.

Root Cause Assessment The inspectors reviewed the licensees root cause analysis and determined it was adequately performed. The licensee determined the root cause stemmed from organizational work practices that lacked technical rigor resulting in personnel incorrectly concluding that a probability methodology for tornado missile protection could be applied without obtaining a license amendment.

Extent of Condition As previously discussed, following the licensee recognizing that multiple inadequately protected components existed they performed an extent of condition review. This review consisted of evaluating all systems, structures, and components at the facility and resulted in the licensee identifying a population of 37 inadequately missile protected components. The NRC determined the licensees extent of condition review was thorough.

Operating Experience Review The licensee identified multiple examples where both internal and external operating experiences were not effectively used to identify that equipment was not adequately being protected for tornado missile design requirements. These included similar examples identified at other facilities resulting in event reports being submitted to the NRC, and generic communications such as NRC Regulatory Issue Summary RIS 2008-14, Use of TORMIS computer code for assessment of tornado missile protection. The inspectors determined the licensee did a thorough review of operating experience and noted that the site currently has improvement initiatives established to more effectively implement operating experience reviews.

Corrective Actions to Prevent Recurrence The licensee developed a number of corrective actions to address the identified Root Cause that included:

Performing a design bases reconstitution to identify and define the licensing and design bases to assure documentation remains current, accurate, complete, and retrievable, Conduct training with engineering personnel to address proper use of design and licensing bases information, and Strengthen the function of the oversight group that reviews documentation of 50.59 reviews, modifications, operability evaluations, and other documents developed that utilize design bases information.

The inspectors determined the licensee had adequately addressed corrective actions for the identified Root

Cause.

Corrective Actions for Specific Components Not Adequately Protected from Missiles The inspectors reviewed the licensee actions to address the 37 identified components that were not adequately protected from tornado missiles.

The inspectors noted that the licensee elected to change the facilities design and licensing basis and adopt the requirements of Regulatory Guide 1.76 (RG 1.76),

Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, Revision 1, as the method for restoring compliance. The licensee also began implementing temporary modifications to the facility to provide the required protection to systems and components. The modifications were designed to the standards specified in Regulatory Guide 1.76.

The licensee performed two separate 10 CFR 50.59 evaluations to incorporate the use of Regulatory Guide 1.76 into the facilities current licensing basis. The team, in consultation with the Office of Nuclear Reactor Regulation, determined that both of these evaluations were inappropriate and therefore did not support the use of Regulatory Guide 1.76 without prior NRC approval. This issue is discussed in detail in Section 4, Findings of this report and is documented as:

NCV 05000285/2013017-05, Failure to Obtain Prior NRC Approval for a Change in Method of Evaluation Following the determination that the 10 CFR 50.59 evaluations did not establish a basis to change the facilities current licensing basis without prior NRC approval, the licensee generated an operability evaluation to allow the use of Regulatory Guide 1.76. The team, in consultation with the Office of Nuclear Reactor Regulation, determined that this operability evaluation was not adequate. This issue is discussed in detail in Section 4, Findings of this report and is documented as:

NCV 05000285/2013017-03, Failure to Follow Operability Procedure During the NRC reviews of the licensees 50.59 and operability evaluations the support from NRC headquarters experts was obtained. The NRCs determination that the licensees 10 CFR 50.59 evaluations and the subsequent operability determination did not support the use of Regulatory Guide 1.76 without prior NRC approval was documented as Task Interface Agreement 2013-07, Task Interface Agreement - Concurrence on Fort Calhoun Tornado Missile Protection Licensing Basis (TIA 2013-07). This document is provided as Attachment 2 of this report.

The licensee subsequently submitted an exigent amendment request to incorporate the use of Regulatory Guide 1.76 into the facilities design and licensing basis. This exigent amendment request was reviewed and approved by the NRC on July 26, 2013.

The team reviewed the temporary modifications being implemented by the licensee to protect the identified equipment pending final resolution of the identified vulnerabilities. During these reviews the team determined that one of the modifications did not provide the required protection. Additionally, the team determined that the subsequent operability determination for the temporary modification did not establish a technically sound basis for operability. These issues are discussed in detail in Section 4, Findings of this report and are documented as:

NCV 05000285/2013017-04, Inadequate Temporary Modification to Protect Against Tornado Generated Missiles NCV 05000285/2013017-03, Failure to Follow Operability Procedure b. The NRC reviewed the licensees causal analyses, corrective actions, and extent of condition associated with Licensee Event Reports 2013-005-1, Control Room HVAC Modification Not Properly Evaluated, and 2013-009, Tornado Missile Vulnerabilities. In addition, the team verified that adequate corrective actions were identified associated with the causes and extent of condition evaluations and that implementation of these corrective actions were either implemented or appropriately scheduled for implementation.

(3) Assessment a. The NRC reviewed the licensees extent of condition results and performed an independent assessment to validate that all potentially susceptible components had been identified. Based on these reviews, the team determined that the licensee had adequately identified all susceptible components in their extent of condition review.

The team also reviewed the modifications installed by the licensee and concluded that, for the most part, the modifications were adequate. However, the team identified that the temporary modification installed for the raw water pump pull boxes was inadequate. The licensee captured this in the corrective action program and redesigned the installed temporary modification so that it provided adequate protection.

The inspectors concluded that the licensee continues to demonstrate weaknesses associated with implementation of 10 CFR 50.59, and with the application of the operability determination process. The team noted that these areas are being addressed by the licensee under long term corrective actions that will be reviewed by the NRC during future inspections.

b. Licensee Event Reports 2013-005-1, Control Room HVAC Modification Not Properly Evaluated, and 2013-009, Tornado Missile Vulnerabilities, is closed.

(4) Findings

(1) Failure to Ensure Tornado Missile Protection for Site Components

Introduction.

The team identified multiple examples of a White violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to fully incorporate applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition.

Description.

During the extended shutdown and associated recovery activities the licensee contracted a vendor to perform a design evaluation of the auxiliary feedwater system. The vendors assessment, as well as the licensees responses to the concerns identified by the assessment, was documented in Condition Report CR 2012-4470.

During the teams review of the vendors assessment they noted that the vendor had identified concerns with regard to tornado missile protection. Specifically, the vendor questioned whether the auxiliary feedwater components in Room 81 had been analyzed to show protection from tornado generated missiles with respect to plastic blowout panels in the roof, and whether the exhaust stack for the turbine driven auxiliary feedwater (AFW) Pump FW-10 was adequately protected for tornado missiles. The licensees responses to the vendors questions were documented in 3, Self-Assessment Findings and Observation Matrix, of the vendors report. For the auxiliary feedwater components in Room 81, the licensee described its basis for not requiring tornado missile protection to be the reliance upon probabilistic evaluations contained in the stations Individual Plant Examination of External Events (IPEEE), and for the exhaust stack for the turbine driven auxiliary feedwater pump, the licensee cited Station Calculation FC06081, Tornado Missile Hazard for FW-10 Auxiliary Feed Pump Turbine Exhaust. Both of these responses were based on the low probability of a missile impacting the components of interest.

The team questioned the licensees basis for not requiring tornado missile protection for the identified components. The team reviewed the facilities Updated Safety Analysis Report and noted that Appendix G specified that the licensee complied with Draft General Design Criteria GDC-2, published July 11, 1967. Draft General Design Criteria GDC-2 requires that the systems and components needed for accident mitigation remain fully functional before, during, and after a tornado event. The team reviewed Section 5.8.2 of the Updated Safety Analysis Report, which describes that design basis for tornado generated missiles was for protection of the facility during a severe accident and to ensure safe shutdown and isolation of the reactor. Finally, Section 5.11 of the Updated Safety Analysis Report describes that Class 1 structures were also designed to withstand the spectrum of tornado generated missiles, listed in Section 5.8.2.2. Based on this information the team determined that the Updated Safety Analysis Report did not incorporate probabilistic methodologies as part of the licensing basis for the Fort Calhoun Station.

The team reviewed the pertinent sections of the stations IPEEE and Calculation EA06-006. The team determined that the stations IPEEE had been performed in accordance with Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, Supplement 4. The IPEEE was a probabilistic evaluation with a stated purpose of:

developing an appreciation of severe accident behavior; understanding the most likely severe accident sequences that could occur at the plant under full power operating conditions; gaining a qualitative understanding of the overall likelihood of core damage and radioactive material release; and reducing, if necessary, the overall likelihood of core damage and radioactive material release by modifying hardware and procedures that would help prevent or mitigate severe accidents.

Based on the licensees stated purpose, the team determined that the IPEEE was to be used as a tool for systematically searching for and identifying vulnerabilities associated with external events. These vulnerabilities were to be reviewed to determine whether changes were needed to be made to the facility. Therefore, the team determined that the licensees use of the stations IPEEE as a basis for not protecting components in Room 81 was not appropriate. The team noted that a similar issue had been evaluated under Task Interface Agreement 2011-011, Final -

Task Interface Agreement (TIA) - Evaluation of Point Beach Nuclear Plant Tornado Missile Protection Licensing Basis (TIA 2011-011), dated August 16, 2011, (ML11228A257). It had been determined that non-licensing basis documentation, and judgments of low probability to demonstrate compliance with the licensing basis, are not acceptable without submitting the respective material for NRC staff review and inclusion in the Updated Safety Analysis Report.

With respect to Station Calculation FC06081, the team determined that this calculation had been developed using non-licensing basis information and used probabilistic methodologies. Specifically, the licensee used information from NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, and Regulatory Guide 1.76, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, Revision 1, to deviate from the stations licensing basis for tornado wind speed and postulated missiles. This information was then used to develop the probability of a missile striking the exhaust stack of the turbine driven auxiliary feedwater pump.

The team noted that Regulatory Issue Summary (RIS) 2008-14, Use of Tormis Computer Code for Assessment of Tornado Missile Protection, (ML080230578)contained information that was applicable to this issue. The team determined that while the main focus of this regulatory issue summary dealt with the use of TORMIS, the section titled, Other Ways of Addressing Tornado Missile Protection, was applicable to the turbine driven auxiliary feedwater pump issue. Specifically, this section specified that TORMIS was not a risk informed approach, but goes on to state:

A licensee may submit a license amendment application proposing other means for modifying the current licensing basis for tornado missile protection.

Such an application could utilize a risk-informed change process consistent with the guidelines of Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decision on Plant-Specific Changes to the Licensing Basis. Likewise, a licensee can submit a license amendment to revise plant technical specifications, associated with tornado missile features, in accordance with Regulatory Guide 1.177, An Approach for Plant-Specific Risk-Informed Decision Making: Technical Specifications, issued August 1998. If a risk-informed process was proposed, it would have to meet the five key principles of risk informed regulation called out in Regulatory Guide 1.174, including the need for possible exemptions to the regulations or GDC requirements. Sufficient probabilistic risk assessment quality with respect to modeling of tornado initiators would have to be demonstrated. A topical report consistent with the above guidelines could be submitted for NRC staff review.

Based on this, the team determined that the licensee had not received a license amendment to use the probabilistic methodology employed in Station Calculation FC06081. Therefore, the team concluded that the use of non-licensing basis documentation, and judgments of low probability to demonstrate compliance with the licensing basis, were not acceptable without submitting this material for NRC staff review and approval.

The team informed the licensee of its concerns and the licensee initiated Condition Reports CR 2013-03839, 2013-03842, 2013-14117, and 2013-14246 to address these issues.

Subsequent extent of condition reviews by the licensee identified additional components that were inadequately tornado missile protected. Specifically, 37-unprotected components were identified. They identified components included emergency diesel generator fuel oil supplies, auxiliary feedwater pumps, raw water system cabling and components, the intake structure sluice gates, the main steam relief valve stacks, control room HVAC condensers, the boric acid storage tank, and the emergency feedwater storage tank.

The licensee applied for an exigent license amendment and implemented facility modifications to protect the identified components.

Analysis.

The licensees failure to ensure that station components were adequately protected from tornado missiles was a performance deficiency. In accordance with NRC Inspection Manual Chapter 0612, Appendix B, Issue Screening, the performance deficiency was determined to be more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the performance deficiency affected the reliability of multiple systems following a postulated tornado-generated missile impact. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) For Findings at Power, Exhibit 4, External Events Screening Questions. The finding required a detailed risk evaluation because it involved the lack of equipment specifically designed to mitigate a severe weather initiating event (tornado), and could have degraded two or more trains of a multi-train system.

The Region IV senior reactor analyst made the following influential assumptions in assessing the risk of the subject performance deficiency:

Selection of Tornado Hazard Use of Missile Impact Parameter Method Population of Potential Missiles Selection of Tornado Intensity Loss of Offsite Power Failure of Condensate Storage Tank Selection of Relative Target Size There were three dominant accident sequence cutsets associated with this performance deficiency. All involved a non-recoverable loss of offsite power. In order of significance, these sequences are:

1. Loss of all auxiliary feedwater and failure of once-through cooling; 2. Loss of the emergency power system with failure to recover a diesel generator prior to battery depletion; and 3. Loss of Diesel Generator 1 from tornado missile impact and random loss of Diesel Generator 2 with failure to recover prior to battery depletion.

The total change in core damage frequency is 2.6 x 10-6 (WHITE).

This finding did not involve a significant increase in the risk of a large, early release of radiation, because Fort Calhoun Station has a large, dry containment. The significance of this finding is considered to be core damage frequency-dominant.

The detailed risk evaluation is documented in Attachment 3 to this inspection report.

The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c).

Enforcement.

Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, from initial construction through July 2013, measures established by the licensee failed to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions.

Specifically, the licensee failed to fully incorporate applicable tornado missile protection design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition. The licensee addressed this deficiency by implementing plant modifications that protected the affected equipment from tornado generated missiles. This finding is associated with a Notice of Violation attached to this report: VIO 05000285/2013017-01, Failure to Ensure Tornado Missile Protection for Site Components.

(2) Failure to Promptly Identify and Correct a Condition Adverse to Quality

Introduction.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions, associated with the licensees failure to promptly identify and correct a condition adverse to quality associated with Class I structures.

Description.

During the teams review of the stations USAR, they determined that USAR, Section 5.11, required that the facilities Class I structures be designed to withstand the spectrum of tornado generated missiles, the most critical of which, is a pipe, 3 inches in diameter and 10 feet long, moving at a velocity of 640 feet per second. The team determined that the licensing basis approved methodology for determining the required concrete wall thickness of Class I structures to show protection for tornado generated missiles was NavDocs P-51, Design of Protective Structures, dated August 1950.

Station Calculation FC07012, External Missiles Due to Tornado Winds and Turbine Generator Overspeed, Revision 0, dated August 2005, was generated to evaluate Class I structures ability to withstand missiles. The team reviewed Station Calculation FC07012 and noted that the analysis established that the Class I structure wall thickness was required to be 2.42 feet thick to show protection from a projectile moving at 640 feet per second based on the licensing basis methodology.

However, the analysis went on to state that the wall thickness of the Auxiliary Building ranges from 1.5 feet to 2 feet thick, and the wall thickness of the Intake Structure below 1007 feet 6 inches is 2 feet to 2 feet 10 inches (some of the Intake Structural wall below 1007 feet 6 inches is exposed above grade and subject to tornado missiles). The calculation identified that this was a nonconformance and was in conflict with the requirements derived from the licensing basis detailed in the facilities Updated Safety Analysis Report. However, the calculation went on to state that the auxiliary building walls were sufficient at 1.5 feet thick when evaluated against other acceptance criteria, an example of which was NUREG CR-4461, Tornado Climatology of the Contiguous United States Pacific Northwest National Laboratory, Revision 1.

The team determined that the licensee had identified a condition adverse to quality, in that, the facility was not adequately protected from tornado generated missiles as described in the Updated Safety Analysis Report, Section 5.11. However, the licensee did not enter this issue into the corrective action program for evaluation and resolution. Instead, the licensee used alternate acceptance criteria that were not part of the licensing basis. Based on this, the team determined that the licensee had failed to promptly identify and correct a condition adverse to quality.

The team informed the licensee of their concerns and the licensee initiated Condition Report CR 2013-14363 to capture this issue in its corrective action program.

Analysis.

The licensees failure to promptly identify and correct conditions adverse to quality was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings at Power, the finding is determined to have very low safety significance (Green)because it:

(1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time;

(4) did not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significance in accordance with the licensees maintenance rule program; and

(5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. The team determined that although this finding occurred more than three years ago, this finding is representative of current plant performance. Therefore, this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component, because the licensee failed to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).

Enforcement.

10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Contrary to the above, from August 2005 to July 15, 2013, measures established by the licensee failed to assure that an identified condition adverse to quality was corrected. Specifically, the licensee failed to promptly identify and correct inadequate Class 1 structures wall thickness deficiencies to protect systems and components contained within from tornado generated missiles. The licensee resolved this issue through the licensing amendment process. Because the finding was of very low safety significance (Green) and has been entered into the corrective action program as Condition Report CR 2013-14363, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000285/2013017-02, Failure to Promptly Identify and Correct a Condition Adverse to Quality.

(3) Failure to Follow Operability Procedure

Introduction.

The inspectors identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, associated with the licensees failure to follow Station Procedure NOD-QP-31, Operability Determination Process, for evaluating tornado missile protection deficiencies.

Description.

In each of the following examples, the team identified that the operability determination lacked adequate technical justification for why the item was operable with the degraded or nonconforming condition.

Example 1:

Condition Report CR 2013-13955 documented that the temporary barriers installed to protect raw water pump pull boxes PB-128T and PB-129T from tornado generated missiles was not adequate. Specifically, a gap at the top of the barrier could allow a missile to damage the pull boxes which could prevent the pumps from performing their specified safety function. The immediate operability determination for this condition report did not provide an adequate technical basis for concluding that these pull boxes would remain operable for the identified condition. The licensees operability determination failed to adequately address the lack of protection from tornado generated missiles.

This issue was entered into the corrective action program as Condition Report CR 2013-14006.

Example 2:

The operability evaluation NOD-QP-31.1-2013-14363, documented in Condition Report CR 2013-14363, did not demonstrate compliance with the current licensing basis. Specifically, the licensee evaluated the stations systems and components that were needed to support Mode 4 and Mode 5 operations with respect to tornado generated missiles against the requirements contained in Regulatory Guide (RG 1.76) 1.76, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, Revision 1. This standard was not part of the facilities current licensing basis and relaxed current licensing basis requirements contained in the Updated Safety Analysis Report with respect to tornado generated missiles. After consultation with the Office of Nuclear Reactor Regulation, the team determined that this operability determination did not provide an adequate technical basis for concluding that these structures would remain operable following a tornado generated missile impact. The NRCs review of this evaluation is contained in Attachment 2 of this letter. This issue was entered into the corrective action program as Condition Report CR 2013-15429.

The team determined that for each of the above examples, the operability determination lacked adequate technical justification for why the structure, system, or component was operable with respect to the identified degraded or nonconforming condition. The team noted that Station Procedure NOD-QP-31, Operability Determination Process, Step 4.3.15, required, in part, that, A positive determination of operability must be justified, includinga technical discussion of why the concern identified does not prevent the item from fulfilling its intended safety function(s). This should demonstrate that the item is not exceeding its design basis specified in the reference documents.

Analysis.

The failure to properly assess and document the basis for operability when a degraded or nonconforming condition was identified was a performance deficiency.

This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involving inadequate operability determinations occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix G, Shutdown Operations Significance Determination Process, and determined the finding to have very low safety significance (Green)because the finding did not increase the likelihood of a loss of reactor coolant system inventory, the finding did not degrade the licensees ability to terminate a leak path or add reactor coolant system inventory when needed, and the finding did not degrade the licensees ability to recover decay heat removal once it was lost. This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision making when performing operability determinations H.1(b).

Enforcement.

10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Station Procedure NOD-QP-31, Operability Determination Process, a procedure that is appropriate to the circumstances of evaluating the operability of safety-related components, Step 4.3.15, required the licensee to properly assess and document the basis for operability when a degraded or nonconforming condition is identified. Contrary to the above, on July 8, and July 15, 2013, the licensee failed to complete activities affecting quality in accordance with prescribed procedures. The licensee addressed these issues by taking corrective actions that provided adequate tornado missile protection in accordance with design basis requirements. Because the finding was of very low safety significance (Green) and has been entered into the corrective action program as Condition Reports CR 2013-15429 and 2013-14006, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000285/2013017-03, Failure to Follow Operability Procedure.

(4) Inadequate Temporary Modification to Protect Against Tornado Generated Missiles

Introduction.

The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, associated with the licensees failure provide adequate instructions or procedures for the construction of temporary barriers to protect raw water pump electrical pull boxes PB-128T and PB-129T from tornado generated missiles associated with temporary modification EC 60183.

Description.

While performing walk downs of the facility to inspect modifications being implemented to address issues identified with tornado missile protection, the team inspected the temporary barriers constructed to protect raw water pump electrical pull boxes PB-128T and PB-129T. During this inspection, the team noted that a gap existed at the top of the barrier which could allow a tornado generated missile to damage the pull boxes.

The team subsequently reviewed temporary modification package EC 60183 and determined that it did not provide sufficient guidance to ensure that there were no gaps/openings which would allow missiles to impact the pull boxes. The team informed the licensee of this concern. The licensee reviewed this issue, and stated that the cabling in the pull box was located at the bottom and if a missile were to impact the box it would not damage the cabling and the pumps would not be affected.

The team questioned the licensees response and asked the licensee to verify this configuration. Subsequently, the licensee determined that the cables were not configured as previously stated, and therefore, the barriers would not protect the pull boxes as intended. The licensee initiated Condition Report CR 2013-13955 to capture this issue in the stations corrective action program for resolution.

Analysis.

The failure to provide adequate instructions for construction of temporary barriers to protect the raw water pump electrical pull boxes from tornado generated missiles was a performance deficiency. This performance deficiency is more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding occurred while in a shutdown condition, the team used Manual Chapter 0609, Appendix G, Shutdown Operations Significance Determination Process, and determined the finding to have very low safety significance (Green) because the finding did not increase the likelihood of a loss of reactor coolant system inventory, the finding did not degrade the licensees ability to terminate a leak path or add reactor coolant system inventory when needed, and the finding did not degrade the licensees ability to recover decay heat removal once it was lost. This finding has a cross-cutting aspect in the area of human performance associated with the work practices component because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c).

Enforcement.

10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Contrary to the above, from April 27 through July 8, 2013, the licensee failed to adequately prescribe documented instructions or procedures for activities affecting quality. Specifically, the licensee failed to provide adequate instructions or procedures to ensure proper construction of temporary barriers to protect the raw water pump electrical pull boxes from tornado generated missiles.

The licensee addressed this issue by modifying the temporary barriers. Because the finding was of very low safety significance (Green) and has been entered into the corrective action program as Condition Report CR 2013-13955, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000285/2013017-04, Inadequate Temporary Modification to Protect Against Tornado Generated Missiles.

(5) Failure to Obtain Prior NRC Approval for a Change in Method of Evaluation

Introduction.

The team identified a Severity Level IV, non-cited violation of 10 CFR 50.59, Changes, Test, and Experiments, associated with the licensees failure to adequately evaluate changes to determine if prior NRC approval is required.

Description.

The team identified the following examples of inadequate 10 CFR 50.59 evaluations performed by the licensee.

Example 1: While reviewing the Updated Safety Analysis Report, the team noted that Updated Safety Analysis Report, Section 5.8.2, described the specific requirements for tornado missile protection for the facility. While reviewing Sections 5.8.2, External Missiles, the team noted that this section had incorporated probabilistic requirements for tornado missile protection. Specifically, it stated:

5.8.2.2, Tornado Generated Missiles, states, in part, no tornado missile protection is provided for the control room air conditioning condensers (Section 9.10) and the AFW pump turbine exhaust, due to the low probability of tornado missile damage.

Upon review of Section 9.10, Heating, Ventilating and Air Conditioning Systems, the team noted it too incorporated probabilistic requirements for tornado missile protection. Specifically, it stated:

Section 9.10.1, Design Bases, states, in part, the air cooled condensers located on the auxiliary building roof for the refrigeration units are protected from 360 mph tornado winds. Standard Review Plan (SRP), Section 2.2.3, was used to design the air cooled condensers windscreen. The SRP criteria was met, therefore, no tornado missile shielding for the air cooled condensers is required. (Reference Station Calculation FC06375)

The team questioned the licensees use of probabilistic methodologies and the reference to the use of the Standard Review Plan.

The team reviewed the licensees original licensing basis documented in the Safety Evaluation Report, dated August 9, 1972. Through this review, the team determined that Fort Calhoun Station was designed and licensed using a deterministic methodology associated with tornado missile protection. Based on this, the team questioned by what method the licensee had incorporated these changes into the current licensing basis.

During discussions with the licensee, the team determined that the licensee had used NUREG 0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, as the basis for using a probabilistic approach for determining if tornado missile protection was required based on impact probabilities. The licensee indicated that they understood that NUREG 0800 constituted guidance from the NRC, which allowed the option for a licensee to choose which methodology was to be used for assessing tornado missile protection requirements.

The licensee indicated that based on this understanding they had generated Calculations FC06375, Calculation of Tornado Strike for FCS Control Room HVAC Air Condensers, Revision 0, and EA06-006, Tornado Design/Licensing Basis, Revision 1, to establish the probabilistic basis for the control room air conditioning condensers and the auxiliary feedwater pump turbine exhaust to not require tornado missile protection. Subsequently, the licensee used 10 CFR 50.59 to change the licensing basis to incorporate this probabilistic methodology. The licensees evaluations determined that the use of a probabilistic evaluation did not require prior NRC approval. The NRC has stated by memorandum dated November 7, 1983, (ML080870278) and in Task Interface Agreement (TIA) Response dated August 16, 2011, (ML11228A257) that licensee's may use probabilistic analysis for tornado missile evaluations. However, these documents further state that the use of this methodology requires prior NRC approval.

The team questioned the licensees determination that this modification did not require prior NRC approval. Specifically, the team determined that the licensee had inappropriately interpreted the information contained in NUREG 0800 as being generically applicable to Fort Calhoun Station without prior approval. Specifically, the original licensing basis had used a deterministic methodology and the change incorporated by the licensee was to use probabilistic methodology.

Based on this, the team determined that the licensees use of a probabilistic evaluation methodology constituted a departure from a method of evaluation described in the Updated Safety Analysis Report used in establishing the design bases or in the safety analyses.

The licensee entered this issue into the corrective action program as Condition Reports CR 2013-03839, 2013-04266, and 2013-05210.

Example 2: The stations Updated Safety Analysis Report states that the Fort Calhoun Station is committed to complying with Draft General Design Criteria (GDC) 2, published July 11, 1967, which required that the systems and components needed for accident mitigation remain fully functional before, during, and after a tornado event. Updated Safety Analysis Report, Section 5.8.2.2, Tornado Generated Missiles, identified that the design basis tornado wind speed was 500 miles per hour which resulted in the most critical projectile being a 3 inch diameter, 10 feet long pipe moving at a velocity of 640 feet per second.

Following identification of the inadequately protected equipment identified in VIO 2013017-01, Failure to Ensure Tornado Missile Protection for Site Components, the licensee elected to change the facilities design and licensing basis and adopt the requirements of Regulatory Guide 1.76 (RG 1.76), Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, Revision 1, as the method for restoring compliance with Draft General Design Criteria (GDC) 2 relative to tornado generated missiles.

On June 27, 2013, the licensee approved a 10 CFR 50.59 evaluation as part of EC 60974, Tornado Missile Protection Methodology Change, Revision 0, as the means of adopting Regulatory Guide 1.76. In this evaluation, the licensee determined that the information contained in Regulatory Guide 1.76 constituted a new method of evaluation, and went on to identify that this method had been previously reviewed and approved for use at another facility via a safety evaluation report. Based on this, the licensee determined that Regulatory Guide 1.76 could be implemented without prior NRC approval.

The team, in consultation with the Office of Nuclear Reactor Regulation, reviewed the licensees evaluation. Through this review it was concluded that Regulatory Guide 1.76 was not a method of evaluation, rather it was an element of a method of evaluation. Therefore, the information contained in Regulatory Guide 1.76, when used in an NRC approved method of evaluation, should demonstrate that the facilities design basis requirements would be met. Based on this, the staff determined that the licensees evaluation failed to properly address the requirements of 10 CFR 50.59(a)(2)(i) and the guidance contained in NEI 96-07, Guidelines For 10 CFR 50.59 Implementation, dated November 2000, Sections 3.8 and 4.3.8.1. In general, licensees can make changes to elements of a methodology without first obtaining a license amendment if the results are essentially the same as, or more conservative than, previous results. In this example the licensee proposed to use a tornado wind speed, referenced in Regulatory Guide 1.76, as a design input that was less than the wind speed described in the CLB. Based on this, the NRC cannot determine whether or not the change results are essentially the same, or more conservative than, previous results using the CLB wind speed. The licensee entered this issue into the corrective action program as Condition Report CR 2013-14363.

The NRCs review of this evaluation is contained in Attachment 2 of this letter.

Example 3: On July 12, 2013, the licensee approved a 10 CFR 50.59 evaluation as part of EC 61354, VA-71A & B Battery Room Ventilation Tornado Missile Protection, Revision 0. In this evaluation, the licensee took the position that while Draft GDC 2 stated that licensees would protect systems and components, the stations response documented in both Appendix G to the USAR, and to NRC questions, stated that only structures would resist the forces of tornados and tornado missiles. Therefore, the licensee concluded that the adoption of the requirement to protect systems and components constituted a new method of evaluation, and in adopting this method, the station did not require prior NRC approval. The licensee also concluded that with the adoption of this new method of evaluation and the modifications being made to the facility they included:

Creation of Calculation EA 130-014, Tornado Safe Shutdown Analysis, Revision 0, to provide mode specific target selection criteria to support the expansion of design and performance requirements to additional structures, systems, and components Adoption of RG 1.76, to provide the methodology to select the tornado winds and tornado missiles and their velocities, and in what directions to apply them, in a manner that is approved by the NRC Adoption of Bechtel Topical Report BC-TOP-9A, Design of Structures for Missile Impacts, Revision 2, to provide an approved methodology for evaluating the effect of missiles on concrete and steel barriers Use of NUREG 800, Section 3.5.3, Revision 3, to provide the acceptance criteria necessary to meet the relevant requirements of GDC 2, which have been shown by review to be similar enough to the Draft GDC 2 to be acceptable The team, in consultation with the Office of Nuclear Reactor Regulation, reviewed the licensees evaluation. Through this review the staff concluded the following:

The licensees determination that Draft GDC 2 does not apply to the facilities systems and components was not correct and was unsupported by the criterions wording. Specifically, Draft GDC 2 required the protection of systems and components, and the licensees Final Safety Analysis Report/Update Safety Analysis Report stated that Draft GDC 2 is met, and then described some of the structures used to protect systems and components. Based on this, the staff concluded that the means of protecting many of the systems and components essential to the prevention of accidents was the use of structures, but the protection of such systems and components is still a requirement of the criterion and was not limited to the structures. Therefore, the staff determined that the facilities current licensing basis required the protection of systems and components and the licensees position that this was a new method of evaluation was incorrect.

The staff determined that calculation EA 13-014 constituted a method of evaluation, and this method was not included in the Final Safety Analysis Report/Updated Safety Analysis Report. Therefore, this method was required to be evaluated using 10 CFR 50.59.

As previously expressed, RG 1.76 is an element of a method of evaluation, and the licensees current evaluation does not address the requirements of 10 CFR 50.59(a)(2)(i) and the guidance contained in NEI 96-07, Sections 3.8 and 4.3.8.1, with respect to determining whether this change yields results that are conservative or essentially the same as the current licensing basis.

The staff noted that Topical Report BC-TOP-9A, Revision 2, is an approved methodology by the AEC that provides general procedures and criteria for the design of structures and components against the effects of missiles.

However, the staffs noted that in approving the Topical Report methodology, the AEC stated that this methodology could be used in future instances provided that input parameters to the methodology are reviewed and approved by the staff, and are included in the facilities Safety Analysis Report. Therefore, the staff determined that the licensees evaluation did not meet the requirements of 10 CFR 50.59(a)(2)(ii) and the guidance in NEI 96-07, Section 4.3.8.2, which requires licensees to evaluate new methodologies and document in the 10 CFR 50.59 evaluation the basis for determining that a method is appropriate and approved for the intended application.

NUREG 0800, Section 3.5.3, Revision 3, does not provide an approved methodology for licensees to reference or use in the context of 10 CFR 50.59 (NUREG 0800 does not have a Safety Evaluation Report associated with it).

Therefore, the staff determined that the use of NUREG 0800 to substitute acceptance criteria other than that documented in the Updated Safety Analysis Report was not appropriate.

Based on the above the team determined that this was an inadequate evaluation and the changes proposed by the licensee required prior NRC approval. The NRCs review of this evaluation is contained in Attachment 2 of this letter. The licensee entered this issue into the corrective action program as Condition Report CR 2013-14665.

Analysis.

The licensees failure to implement the requirements of 10 CFR 50.59 and adequately evaluate changes to requirements for tornado missile protection described in the USAR was a performance deficiency. Because this performance deficiency had the potential to impact the NRCs ability to perform its regulatory function, the team evaluated the performance deficiency using traditional enforcement. In accordance with Section 2.1.3.E.6 of the NRC Enforcement Manual the team evaluated this finding using the significance determination process to assess its significance. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process for Findings At-Power, the finding is determined to have very low safety significance (Green) because it:

(1) was not a deficiency affecting the design or qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;

(2) did not represent a loss of system and/or function;

(3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time;

(4) did not represent an actual loss of function of one or more nontechnical specification trains of equipment designated as high safety-significance in accordance with the licensees maintenance rule program; and

(5) did not involve the loss or degradation of equipment or function specifically designed to mitigate a seismic, flooding, or severe weather event. Therefore, in accordance with Section 6.1.d.2 of the NRC Enforcement Policy, the team characterized this performance deficiency as a Severity Level IV violation. The team determined that a cross-cutting aspect was not applicable to this performance deficiency because the failure to adequately evaluate changes in accordance with 10 CFR 50.59 was strictly associated with a traditional enforcement violation.

Enforcement.

Title 10 CFR 50.59, Changes, Tests, and Experiments, Section (c)(1) states, in part, that a licensee may make changes in the facility as described in the Updated Safety Analysis Report without obtaining a license amendment pursuant to 10 CFR 50.90 only if:

(i) a change to the technical specifications incorporated in the license is not required, and

(ii) the change, test, or experiment does not meet any of the criteria in paragraph (c)(2). Title 10 CFR 50.59, Section (c)(2) states, in part, that a licensee shall obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would have resulted in a departure from a method of evaluation described in the USAR used in establishing the design bases or in the safety analyses. Contrary to the above, from April 19, 2011, through August 17, 2013, on June 27, 2013, and July 12, 2013, the licensee failed to obtain a license amendment pursuant to Section 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would result in a departure from a method of evaluation described in the Updated Safety Analysis Report. The licensee addressed these issues by submitting a license amendment which was reviewed and approved by the NRC. Because this violation was entered into the corrective action program as Condition Reports CR 2013-03839, 2013-04266, 2013-05210, 2013-14363, and 2013-14665, to ensure compliance was restored in a reasonable amount of time, and the violation was not repetitive or willful, this Severity Level IV violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy:

NCV 05000285/2013017-05, Failure to Obtain Prior NRC Approval for a Change in Method of Evaluation.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On September 5, 2013, the team conducted an inspection debrief with Mr. Louis P. Cortopassi, Vice President and Chief Nuclear Officer, and other members of the licensee staff. The licensee acknowledged the issues presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary.

On October 25, 2013, the team conducted an inspection debrief with Mr. Louis P. Cortopassi, Vice President and Chief Nuclear Officer, and other members of the licensee staff. The licensee acknowledged the issues presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary.

On March 13, 2014, the team presented the inspection results to Mr. Louis P. Cortopassi, Site Vice President and Chief Nuclear Officer, and other members of the licensee staff. The licensee acknowledged the issues presented. The team asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Adams, Principle Engineer Design Engineering (Retired Supplemental Worker)

L. Cortopassi, Site Vice President

M. Frans, Manager, Engineering Programs

M. Greeno, NRC Inspection Readiness Team Contractor

W. Hansher, Supervisor, Nuclear Licensing

R. Haug, Senior Consultant

K. Ihnen, Manager, Manager, Site Nuclear Oversight

R. Hugenroth, Supervisor, Nuclear Assessments

E. Matzke, Senior Licensing Engineer

J. McManis, Manager, Projects

S. Miller, Manager, Design Engineering

V. Naschansy, Director, Site Engineering

B. Obermeyer, Manager, CAP

T. Orth, Director, Site Work Management

A. Pallas, Manager, Shift Operations

M. Prospero, Division Manager, Plant Operations

B. Rash, Recovery Lead

K. Root, Regulatory

R. Short, Manager, Recovery

T. Simpkin, Manager, Site Regulatory Assurance

M. Smith, Manager, Operations

S. Swanson, Operations Director

K. Wells, Nuclear Design Engineer Design Electrical/I&C

J. Wiegand, Manager, Operations Support

G. Wilhelmsen, Exelon Nuclear Partners

J. Zagata, Reliability Engineer

Attachment 1

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000285/2013017-01 VIO Failure to Ensure Tornado Missile Protection for Site Components (Section 4OA4)

05000285/2013017-02 NCV Failure to Promptly Identify and Correct a Condition Adverse to Quality (Section 4OA4)

05000285/2013017-03 NCV Failure to Follow Operability Procedure (Section 4OA4)

05000285/2013017-04 NCV Inadequate Temporary Modification to Protect Against Tornado Generated Missiles (Section 4OA4)

05000285/2013017-05 NCV Failure to Obtain Prior NRC Approval for a Change in Method of Evaluation (Section 4OA4)

Closed

05000285/2013-005-1 LER Control Room HVAC Modification Not Properly Evaluated

05000285/2013-009 LER Tornado Missile Vulnerabilities