IR 05000285/2013018
ML14329B361 | |
Person / Time | |
---|---|
Site: | Fort Calhoun |
Issue date: | 11/25/2014 |
From: | Vegel T Division of Reactor Safety IV |
To: | Cortopassi L Omaha Public Power District |
Hay M | |
References | |
EA-14-187 IR 2013018 | |
Download: ML14329B361 (84) | |
Text
November 25, 2014
SUBJECT:
FORT CALHOUN STATION - MANUAL CHAPTER 0350 INSPECTION REPORT AND FINAL SIGNIFICANCE DETERMINATION OF WHITE FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT NO. 05000285/2013018
Dear Mr. Cortopassi:
On October 15, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed a team inspection at the Fort Calhoun Station. The inspection focused on the stations high energy line break and environmental qualification programs and the design change and modification processes. The enclosed inspection report presents the results of this inspection. A final exit briefing was conducted with you and other members of your staff on October 16, 2014.
The enclosed inspection report discusses one finding that was preliminarily determined to be White, having low to moderate safety significance. The finding involved the failure to properly implement high energy line break and environmental qualification design requirements. The station reconstituted the applicable harsh environment analysis, ensured all equipment subject to a harsh environment was properly qualified to perform its safety function, and implemented plant modifications that corrected all the identified deficiencies. These corrective actions were reviewed by the NRC and found acceptable prior to plant restart that occurred in December of 2013. On October 21, 2014, you informed Mr. Anton Vegel and Mr. Michael Hay of NRC, Region IV, that the Fort Calhoun Station agreed with the low to moderate risk significance (White) characterization of this finding and that you declined an opportunity to discuss this issue in a Regulatory Conference or to provide a written response.
After considering all available information, the NRC has concluded that the finding is appropriately characterized as White, having low to moderate safety significance. The NRC has also concluded that the failure to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break is a violation of NRC requirements, as cited in the attached Notice of Violation (Notice). The circumstances surrounding this violation are discussed in detail in the enclosed inspection report. In accordance with the NRC Enforcement Policy, the Notice is considered an escalated enforcement action because it is associated with a White finding. The NRC has concluded that the information regarding the reason for the violation, the corrective actions implemented to correct the violation and prevent recurrence, and the date when full compliance was achieved was obtained by the NRC during our inspection activities and detailed in the enclosed inspection report. Therefore, you are not required to respond to this letter unless the description contained in the enclosed report does not accurately reflect your corrective actions or your position. Additionally, since this issue was identified and resolved by the station during the extended shutdown, under increased NRC oversight of the Inspection Manual Chapter 0350 Process, this issue will not be used for future plant performance assessment inputs and is considered closed.
There were six NRC identified findings identified during this inspection that were determined to be of very low safety significance (Green), and involved violations of NRC requirements. The NRC is treating these violations as non-cited violations (NCVs) consistent with Section 2.3.2.a of the NRC Enforcement Policy.
If you contest these violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Fort Calhoun Station.
If you disagree with a cross-cutting aspect assignment or a finding not associated with a regulatory requirement, in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Fort Calhoun Station.
In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response, if you choose to provide one, will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Tony Vegel Director, Division of Reactor Safety Docket: 50-285 License: DPR-40
Enclosure:
1. Notice of Violation 2. NRC Inspection Report 05000285/2013018 w/Attachments:
1. Supplemental Information 2. Detailed Risk Assessment
REGION IV==
Docket: 05000285 License: DPR-40 Report: 05000285/2013018 Licensee: Omaha Public Power District Facility: Fort Calhoun Station Location: 9610 Power Lane Blair, NE 68008 Dates: July 8, 2013 through October 15, 2014 Inspectors: J. Josey, Senior Resident Inspector, Region IV T. Lightly, Project Engineer, Region II C. Smith, Project Engineer, Region IV J. Wingebach, Resident Inspector, Region IV Accompanying N. Patel, Electrical Contractor, Beckman and Associates Personnel Approved By: Tony Vegel, Director Division of Reactor Safety-1- Enclosure 2
SUMMARY OF FINDINGS
IR 05000285/2013018; 07/08/2013 - 10/15/2014; Fort Calhoun Station,
Supplemental Inspection for Repetitive Degraded Cornerstones, Multiple Degraded Cornerstones, Multiple Yellow Inputs or One Red Input.
The report covered a fifteen month period of inspection by an Inspection Manual Chapter 0350 inspection team. One White and six Green, non-cited violations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. The cross-cutting aspect is determined using Inspection Manual Chapter 0310, Components Within the Cross Cutting Areas. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.
Cornerstone: Mitigating Systems
- White.
The team identified a violation of 10 CFR Part 50, Appendix B,
Criterion III, Design Control, associated with the licensees failure to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structure, systems and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions.
Specifically, from initial construction through October 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break. The licensee addressed this deficiency by reconstituting the design analysis associated with the high energy line break and environmental qualification programs, receiving a change to the facilities licensing basis, and implementing plant modifications. This issue was entered into the licensees corrective action program as Condition Report CR 2013-2857.
The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it is associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where structures, systems, and components necessary to mitigate the effects of a high energy line break may not have functioned as required. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because it was a deficiency affecting the design and qualification of a mitigating structure, system, or component that resulted in a loss of operability or functionality and represented a loss of system and/or function.
The Region IV senior reactor analyst performed a detailed risk evaluation in accordance with Appendix A, Section 6.0, Detailed Risk Evaluation. The detailed risk evaluation concluded the finding was best characterized as having low to moderate safety significance (White). The minimum calculated change in core damage frequency of 4.1 x 10-6 was dominated by a reactor coolant pump seal cooler loss of coolant accident followed by the failure of four containment isolation valves that were not properly qualified for a harsh environment. The upper bound was shown quantitatively and/or qualitatively to be less than 1.0 x 10-5. The analyst determined that the finding did not affect the external events initiator risk and would not involve a significant increase in the risk of a large early release of radiation.
The team determined that this finding does not have a cross-cutting aspect because the most significant contributor of this finding would have occurred more than three years ago, and therefore, does not reflect current licensee performance. (Section 4OA4.1)
- Green.
The team identified two examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with non-conservative errors identified in station calculations. Specifically, the licensee failed to use the yield strength for the most limiting type steel installed in the facility when evaluating changes to the chemical and volume control system, and failed to ensure that the acceptance criteria used for seismic anchors and supports verified that they were within the design requirements. The licensee performed an operability determination for the affected areas that established a reasonable expectation for operability pending final resolution of the problems.
This issue was entered into the licensees corrective action program as Condition Report CR 2013-2857.
The use of non-conservative values in station design analyses is a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it is associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees use of non-conservative yield strength to analyze the pipe break loads during a high energy line break resulted in a condition where structures, systems, and components necessary to mitigate the effects of a high energy pipe break may not have functioned as required. Additionally, the failure to use appropriate acceptance criteria resulted in a condition where structures, systems and components may not have functioned as designed during a seismic event. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, the inspectors determined that the finding was of very low safety significance (Green) because the finding: (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The finding has a cross-cutting aspect in the area of human performance associated with the resources component because the licensee failed to maintain long term plant safety by maintenance of design margins.
Specifically, Calculation FC 07885 failed to use the most limiting yield strength when determining potential pipe break loads which resulted in a reduction of design margin H.2(a). (Section 4OA4.2)
- Green.
The team identified three examples of a non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVII, Quality Assurance Records, associated with the licensees failure to furnish evidence of an activity affecting quality. Specifically, the licensee failed to maintain records demonstrating that:
the temperature limits for structural concrete in the Auxiliary building would not be exceeded during a high energy line break event, that the predicted flood level in Room 81 during a high energy line break event would not affect required equipment, and that electrical splices inside of the containment were installed in accordance with the plant and the vendor installation instructions. The licensee performed an operability determination for the deficiencies that established a reasonable expectation for operability pending final resolution of the problems.
The licensee entered these deficiencies into their corrective action program for resolution as Condition Reports CR 2013-22556, and CR 2013-12359.
The licensees failure to furnish evidence of completing analyses or maintaining records for the flood level in Room 81 during a high energy line break event, the structural concrete temperatures in the Auxiliary building, and electrical splice installations, is a performance deficiency. This performance deficiency was determined to be more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone, and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Inspection Manual Chapter 0609,
Appendix A, Initial Screening and Characterization of Findings, dated July 1, 2012, the inspectors determined that the finding was of very low safety significance (Green) because the finding: (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its technical specification allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The team determined that this finding does not have a cross-cutting aspect because the most significant contributor of this finding would have occurred more than three years ago, and therefore, does not reflect current licensee performance. (Section 4OA4.3)
- Green.
The team identified a non-cited violation of 10 CFR Part 50, Appendix B,
Criterion XVI, Corrective Actions, associated with the licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building. Specifically, the team could not locate the analyses for water level in Room 81 following a high energy line break in the room. This deficiency had previously been identified by the licensee and entered into its corrective action program, however, it was improperly closed without completing the analysis. The licensee performed operability assessments for the affected areas that established a reasonable expectation for operability pending final resolution of the problems. The licensee entered this deficiency into their corrective action program for resolution as Condition Report CR 2013-11831.
The licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the licensee failed to take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding: (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c).
(Section 4OA4.4)
- Green.
The team identified a non-cited violation of 10 CFR Part 50, Appendix B,
Criterion III, Design Control, involving the failure to use conservative inputs.
Specifically, the licensee failed to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition. The licensee performed an operability determination for the affected areas that established a reasonable expectation for operability pending resolution of the problems. The licensee entered this deficiency into their corrective action program for resolution as Condition Report CR 2013-14504, and CR 2013-14168.
The failure to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.
Specifically, the performance deficiency called into question the availability and reliability of components required to mitigate the effects of a high energy line break. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:
(1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality; (2) did not represent a loss of system and/or function; (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The team determined this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component involving the failure to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).
(Section 4OA4.5)
- Green.
The team identified a non-cited violation of 10 CFR Part 50, Appendix B,
Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system. Specifically, the licensee implemented a modification to the facility that placed vent holes in the steam supply line guard piping for the steam driven auxiliary feedwater pump which were located below the evaluated flood height in Room 81 and potentially rendered the pump inoperable. The licensee implemented a facility modification to protect the vent holes from water intrusion. The licensee entered this deficiency into their corrective action program for resolution as Condition Reports CR 2013-18308 and CR 2013-18605.
The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined this finding to be of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which remained functional for the vast majority of sequences.
This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).
(Section 4OA4.6)
- Green.
The team identified a non-cited violation of 10 CFR Part 50, Appendix B,
Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system. Specifically, the licensee implemented a modification to the facility that involved the installation of flood barriers surrounding the guard pipes and portions of the steam driven auxiliary feedwater pump steam supply lines that are below the evaluated flood height in Room 81. This modification would have acted like a catch basin and potentially caused the steam driven auxiliary feedwater pump (FW-10) to be inoperable during a high energy line break event. The licensee implemented a facility modification to protect the steam supply piping and vent holes from water intrusion. The licensee entered this deficiency into their corrective action program for resolution as Condition Report CR 2013-22770.
The failure to maintain design control of the auxiliary feedwater system was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the flood barrier installed only protected the FW-10 steam supply from flood waters rising from the floor; however, this water is postulated from a high energy line break, which would both spill onto the floor and spray into Room 81 without regard for direction. This resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A,
The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which remained functional for the vast majority of sequences.
The finding was determined to have a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action component because the licensee did not take appropriate corrective actions to address safety issues, in that, an additional modification was required to protect the FW-10 steam supply from the effects of a high energy line crack or break P.1(d). (Section 4OA4.7)
REPORT DETAILS
OTHER ACTIVITIES
4OA4 IMC 0350 Inspection Activities
The inspection team conducted NRC Inspection Manual Chapter 0350 inspection activities, which include follow-up on the Restart Checklist contained in Confirmatory Action Letter (CAL) EA-13-020 issued February 26, 2013. The purpose of this inspection was to perform an assessment of the causes of the performance decline at Fort Calhoun Station (FCS), to assess whether planned corrective actions are sufficient to address the root causes and contributing causes and to prevent their recurrence, and to verify that adequate qualitative or quantitative measures for determining the effectiveness of the corrective actions are in place. These assessments were used by the NRC to independently verify that plant personnel, equipment, and processes were ready to support the safe restart and continued safe operation of the Fort Calhoun Station that occurred in December 2013.
The team used the criteria described in baseline and supplemental inspection procedures, various programmatic NRC inspection procedures, and Inspection Manual Chapter 0350 to assess Omaha Public Power Districts (the licensee) performance and progress in implementing its performance improvement initiatives. The team performed on-site and in-office activities, which are described in more detail in the following sections of this report. This report covers inspection activities from July 8, 2013 through October 15, 2014. Specific documents reviewed during this inspection are listed in the attachment.
The following inspection scope, observations and findings, and assessments, are documented by Confirmatory Action Letter Restart Checklist (CL) item number.
1. Adequacy of Significant Programs and Processes
Section 3 of the Restart Checklist addressed major programs and processes in place at the Fort Calhoun Station. Section 3 reviews also included an assessment of how the licensee addressed the NRC Inspection Procedure 95003 key attributes as described in Section 5.
Item 3.b.2: High Energy Line Break Program and Equipment Qualifications
- (1) Inspection Scope a. The team independently assessed the licensees actions associated with reconstitution of the high energy line break and electrical equipment qualification programs. Specifically, the team reviewed the causal analyses, reconstituted calculations, and supporting documents to ensure the plant was within the license and design basis for high energy line break effects. (CL Items 3.b.2)b. Open items (Licensee Event Reports) related to the electrical equipment qualification and high energy line break programs were reviewed by the team. The team verified the adequacy of the licensees causal analyses and extent of condition evaluations.
In addition, the team verified that adequate corrective actions were identified
associated with the licensees root and contributing causes and extent of condition evaluations, and that, implementation of these corrective actions are either implemented or appropriately scheduled for implementation.
- (2) Observations and Findings a. High Energy Line Break Reconstitution A previous NRC team inspection, NRC Inspection Report 05000285/2013008, noted that while the analysis associated with the licensees high energy line break reconstitution program appeared to be adequate, and when all of the proposed modifications were completed should serve to demonstrate regulatory compliance, the licensee had not adequately determined the cause of the electrical equipment qualification and high energy line break programs deficiencies and implement corrective actions to prevent recurrence. The team also noted that the licensees equipment qualification program was not ready for inspection.
This NRC inspection performed an in-depth assessment of the facilities actions associated with reconstitution of the high energy line break and equipment qualification programs, and the associated design changes and modifications.
Determine that the problem was evaluated using a systematic methodology to identify the root and contributing causes.
The team determined that the licensee evaluated the identified issues using a systematic methodology to identify the root and contributing causes.
Root Cause Analysis 2013-01796 employed the use of event and causal factor charting, barrier analysis, and comparative timeline. The licensee identified the following as the root cause for why code requirements for CVCS piping were exceeded:
FCS construction project management failed to ensure that initial construction procedures for design and installation of small bore piping systems and supports specified analyses that put FCS in full compliance with USAS B31.7.
The licensees root cause analysis also identified the following contributing causes:
CC-1: Fort Calhoun Station did not recognize the value of detailed and comprehensive small bore piping and support analyses when the generic methodology was repeatedly challenged from initial construction to 1993.
CC-2: From 1993 to present, Fort Calhoun Station performed inadequate engineering analyses to demonstrate small bore piping and supports meet code compliance. These deficiencies were related to engineering judgments.
CC-3: Fort Calhoun Station did not effectively use the corrective action program to resolve issues identified with the station small bore piping.
The team determined that these root and contributing causes reasonably explain why the code requirements for CVCS piping were exceeded. Specifically the team
determined that the corrective actions to replace all of the CVCS piping with butt welded piping and completing piping stress and thermal fatigue analysis would be adequate to address this problem.
Root Cause Analysis 2013-2857 stated that the analytical methods used during the investigation included event and causal factor charting and fault tree analysis. The licensee identified the following as the root causes and contributing cause for the electrical equipment qualification, and high energy line break programs deficiencies.
RC-1: Fort Calhoun Stations response to IE Bulletin 79-01B made inaccurate and simplifying assumptions, without supporting documentation, that compromised the validity and scope of the electrical equipment qualification program, ultimately resulting in the program being non-compliant with 10 CFR 50.49.
RC-2: The electrical equipment qualification program has unique processes that are not integrated into the engineering change process; creating an unnecessary burden on the electrical equipment qualification coordinator, and affecting the sustainability of the electrical equipment qualification program.
CC-1: Engineering has not effectively resolved items identified in the corrective action program.
The team determined that these root and contributing causes reasonably explain why the electrical equipment qualification and high energy line break programs were deficient. The team identified a finding, VIO 05000285/2013018-01, Failure to Correctly Translate Design Requirements into Installed Plant Configuration, which is further discussed in Section 5 of this report.
Root Cause Analysis 2012-07724 employed the use of event and causal factor charting, barrier analysis, cause and effect tree and comparative timeline. The licensee identified the following as the root and contributing causes for why code requirements for thermal fatigue for the chemical and volume control system piping were exceeded:
RC: OPPD Engineering Personnel did not understand the significance of thermal fatigue analysis requirements in draft USAS B31.7, overly relied on Architectural Engineer guidance, and did not have a process in place to prevent the original chemical and volume control system piping design from excluding the cyclical analysis requirements of USAS B31.7.
CC-1: Fort Calhoun Station Calculation FC06484, Resolution of Design Basis Open Items 122 and 145 prescribed that Class I pressurizer spray piping be a representative subsystem for the Class I chemical and volume control system piping.
CC-2: Fort Calhoun Station personnel adopted an approach to credit current calculations, whenever possible, to close design basis document (DBD) action items.
CC-3: PED-QP-3, Calculation Preparation, Review and Approval did not require verification of the vendor calculation assumptions, inputs and conclusions in Fort Calhouns Station Calculation FC06484.
The team determined that these root and contributing causes reasonably explain why the thermal fatigue code requirements for chemical and volume control system piping were exceeded. Specifically, the team determined that the corrective actions to replace all of the CVCS piping with butt welded piping and completing piping stress and thermal fatigue analysis would be adequate to address this problem.
Determine that the root cause evaluation was conducted to a level of detail commensurate with the significance of the problem.
The team determined that the root cause analyses were conducted to a level of detail commensurate with the significance of the problems. Specifically, as discussed above, the licensee conducted the evaluations not only by using event and causal factor charting, barrier analysis, and comparative timeline, but also by conducting interviews, and reviewing documents. The licensees root cause analyses techniques were generally thorough and identified the root and contributing causes of deficiencies.
Determine that the root cause evaluation included a consideration of prior occurrences of the problem and knowledge of prior operating experience.
The team determined that the root cause analyses included evaluations of both internal and industry operating experience. The team determined that the licensees evaluations of industry operating experience provided sufficient detail such that general conclusions could be established regarding any similarities.
Determine that the root cause evaluation addressed the extent of condition and the extent of cause of the problem.
For extent of condition, the licensee evaluated the extent to which the actual condition exists with other plant equipment. The licensees analyses used the same-same, same-similar, similar-same, and similar-similar evaluation method.
For Root Cause Analysis 2013-01796 the licensee concluded that an extent of condition does exist for small bore safety-related piping supports. However, the licensee did not include large bore piping in the extent of condition. The team questioned if elimination of large bore piping was appropriate given the non-conservative engineering judgment and assumptions documented in other piping stress calculations and thermal stress evaluations. The team identified a finding, NCV 05000285/2013018-02, Use of Non-conservative Values in Design Analyses, which is further discussed in Section 5 of this report.
For Root Cause Analysis 2013-02857 the licensee concluded that an extent of condition exists for programs that do not implement their individual requirements.
For Root Cause Analysis 2013-07724 the licensee concluded that an extent of condition does exist for the following Class I piping systems that do not have a thermal fatigue analysis of record:
- Primary Plant Sampling
- Reactor Coolant Gas Vent
- Reactor Coolant
- Safety Injection
- Waste Disposal For extent of cause, the licensee reviewed the root cause of an identified problem to determine where it may have impacted other plant processes, equipment, or human performance.
For Root Cause Analysis 2013-01796, the licensee determined that an extent of cause does exist related to structures, systems and components, and processes that could have been adversely affected by piping designs, and the licensee is not in full compliance to the code of record. Identified gaps between the licensing basis and full code compliance were one of the focus areas in the design basis root cause analysis. The following root cause analyses were completed to address licensing and design basis: CR 2012-08125, Engineering Design / Configuration Control (FPD), CR 2012-19723, Failure to Maintain Design Basis Documents, and CR 2013-05570, Engineering Design and Licensing.
For Root Cause Analysis 2013-02857, the licensee determined that an extent of cause did not exist for RC-1 or RC-2.
For Root Cause Analysis 2013-01796, the licensee determined that an extent of cause does exist related to structures, systems and components, and processes that could have been adversely affected by piping designs. The following root cause analyses were completed to address licensing and design basis: CR 2012-08125, Engineering Design / Configuration Control (FPD), CR 2012-19723, Failure to Maintain Design Basis Documents, and CR 2013-05570, Engineering Design and Licensing. The licensees evaluation determined a revision of PED-GEI-3 is recommended to incorporate thermal fatigue considerations for Class I piping, and the review of the code reconciliation between USAS B31.7 and ASME III (CA-6) for other areas if CVCS did not find any additional Class 1 piping that did not comply with USAS B31.7. The licensee determined that an operability determination was required for the following systems prior to plant heat up:
- Primary Plant Sampling
- Reactor Coolant Gas Vent
- Reactor Coolant
- Safety Injection
- Waste Disposal The team determined that open questions relating to the reclassification of safety related piping in the 1990s are currently being reviewed. The team determined that the licensees corrective actions would only be effective once verification of the Class I and II piping is completed.
Determine that the root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in IMC 0310.
The team determined that the licensees root cause, extent of condition, and extent of cause evaluations appropriately considered the safety culture components as described in Inspection Manual Chapter 0310. Specifically, the licensee documented their consideration of the Inspection Manual Chapter 0310 cross-cutting aspects in 6 of RCA 2013-01796, Attachment 12 of RCA 2013-02857, and 7 of RCA 2012-07724.
For Root Cause Analysis 2013-02857, the licensee identified several cross-cutting aspects in the areas of human performance, problem identification and resolution, and other components.
For Root Cause Analysis 2013-01796, the final evaluation concluded that the safety culture attributes were not applicable.
For Root Cause Analysis 2012-07724, the final evaluation concluded that the safety culture attributes were not applicable.
The team determined that the licensees assessment appropriately considered the safety culture components described in IMC 0310.
Determine that appropriate corrective actions are specified for each root and contributing cause.
The team reviewed the licensees corrective actions for each of the identified root and contributing causes. The team found that the corrective actions addressed the root and contributing causes.
For Root Cause Analyses 2013-01796 and 2012-07724, the team noted that the corrective actions focused primarily on engineering procedures, and updating the licensing basis to bring it into compliance with code requirements. The team noted that a lot of the corrective actions have been rescheduled. In addition, questions related to the reclassification of safety related piping in the 1990s are currently being reviewed. The team determined that the licensees corrective actions would only be effective once verification of the Class I and II piping is completed.
The team determined that the licensees efforts to reconstitute the high energy line break and electrical equipment qualification programs had missed opportunities to identify nonconformances and the use of non-conservative calculation inputs.
Specifically, during the inspection the team identified the following issues:
- NCV 05000285/2013018-03, Failure to Furnish Evidence of Activities Affecting Quality
- NCV 05000285/2013018-04, Failure to Promptly Identify and Correct Inadequate Internal Flooding Analysis
- NCV 05000285/2013018-05, Use of Non-Conservative Inputs in Thermal Lag Analyses
- NCV 05000285/2013018-06, Failure to Recognize Adverse Design Changes These findings are further discussed in Section 5 of this report.
Determine that a schedule has been established for implementing and completing the corrective actions.
The team determined that a schedule has been established for implementing and completing the corrective actions. The team found that corrective actions to prevent recurrence had been scheduled or implemented which included procedures changes and implementation of necessary training for engineers. Additionally, corrective actions to address the contributing causes had been scheduled. The team determined that that licensees schedule for implementing corrective actions appeared to be commensurate with the significance of the issues they are addressing.
Determine that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.
The team determined that quantitative or qualitative measures of success have been developed for determining the effectiveness of the corrective actions to prevent recurrence.
For Root Cause Analysis 2013-01796, the licensee established, in part, an effectiveness review consisting of modification reviews of design products completed after implementation of the corrective actions to prevent recurrence to determine if modification packages included pipe stress and piping support analysis.
For Root Cause Analysis 20132857, the licensee established, in part, self-assessment requirements for the electrical equipment qualification program, and completed work order reviews for environmentally qualified equipment to ensure that maintenance did not invalidate equipment qualification.
For Root Cause Analyses 2012-07724, the licensee established, in part, an effectiveness review consisting of modification reviews of design products completed after implementation of the corrective actions to prevent recurrence to determine if modification packages included thermal fatigue analysis and piping support analysis.
The licensee also implemented interim actions for the corrective actions to prevent recurrence that would not be completed until 2018. The interim actions will review design basis reconstitution milestones to ensure the licensee is on track for completing corrective actions to prevent recurrence. The interim effectiveness actions also will review the procedure and training changes to ensure they are in compliance with current guidelines.
The team determined that the licensees effectiveness criteria did meet the criteria established in Procedure FCSG 24-7, Effectiveness Review of Corrective Actions to
Prevent Recurrence (CAPRs), Revision 1, in that the effectiveness review specified specific success criteria.
b. The NRC reviewed the licensees causal analyses, corrective actions, and extent of condition associated with Licensee Event Reports 2012-017, Containment Valve Actuators Design Temperature Ratings Below those Required for Design Basis Accidents, 2013-011, Inadequate Design for High Energy Line Break in Rooms 13 and 19 of the Auxiliary building, 2013-015, Unqualified Coating used as a Water Tight Barrier in Rooms 81 and 82, and 2013-016, Reporting of Additional High Energy Line Break Concerns. In addition, the team verified that adequate corrective actions were identified associated with the causes and extent of condition evaluations and that implementation of these corrective actions were either implemented or appropriately scheduled for implementation.
- (3) Assessment a. The NRC performed an independent assessment of the licensees actions associated with reconstitution of the high energy line break and electrical equipment qualification programs. Based on these reviews, the team concluded that the licensees analyses, design changes, and modifications associated with the reconstituted programs were adequate and demonstrated regulatory compliance.
The team concluded that the licensee continues to demonstrate weaknesses with regard to identifying nonconforming conditions, and recognizing the use of non-conservative inputs into design calculations. The team noted that these areas are being addressed by the licensee under long term corrective actions that will be reviewed by the NRC during future inspections.
The following Restart Checklist Items were closed:
3.b.2.1 Licensee assessment of high energy line break program and equipment qualifications 3.b.2.2 Adequacy of extent of condition and extent of causes 3.b.2.3 Adequacy of corrective actions 4.5.1.8 Complete EEQ Harsh Environment analysis for Room 13 crack in Steam Generator Blowdown system 4.5.1.9 Develop plan to address Room 13 EEQ harsh environment qualification of electrical equipment 4.5.1.10 Initiate actions to resolve Room 13 EEQ harsh environment qualification of equipment which must be addressed prior to leaving cold shutdown 4.5.1.11 Resolve Room 13 EEQ harsh environment qualification of equipment which must be addressed prior to leaving cold shutdown 4.5.1.12 Perform analysis to address HCV-1385/1386 Main Steam Line Break/Feedwater isolation concern (CR 2011-6757)4.5.1.13 Implement resolution of HCV-1385/1386 Main Steam Line Break/Feedwater isolation concern
b. Licensee Event Reports 2012-017-2, Containment Valve Actuators Design Temperature Ratings Below those Required for Design Basis Accidents, 2013-011-0, Inadequate Design for High Energy Line Break in Rooms 13 and 19 of the Auxiliary building, 2013-015-1, Unqualified Coating used as a Water Tight Barrier in Rooms 81 and 82, and 2013-016-0, Reporting of Additional High Energy Line Break Concerns, are closed.
Item 3.c: Design Changes and Modifications
- (1) Inspection Scope A previous NRC team inspection, NRC Inspection Report 05000285/2013008, had performed a limited scope review of Modification EC 53202, Modify Piping and Supports for FW-10 MS Supply for HELB Concerns, Revision 0, looking only at the modification package, since the in-plant modification was not completed at the time of this inspection. The team determined that it appeared that the licensee had appropriately evaluated the modification package, but pending installation and acceptance of this modification and follow-up assessment by the NRC, Restart Checklist Item 3.c would remain open.
This NRC inspection team performed an in-depth assessment of the licensees actions that were taken to address design changes and modifications to the facility.
These items are listed in the Fort Calhoun Station Flooding and Recovery Action Plan, Revision 3, dated July 9, 2012. Specifically, the team assessed the effectiveness of the licensees implementation of changes to facility structures, systems, and components, evaluations required by 10 CFR 50.59, and the Updated Safety Analysis Report, to provide assurance that changes implemented by the licensee have been appropriately implemented. (CL Item 3.c)
- (2) Observations and Findings The team performed an independent review of the modifications implemented by the licensee to correct deficiencies identified during the reconstitution of the high energy line break and electrical equipment qualification programs. During this review, the team assessed the effectiveness of the licensees process for preparing the modifications; the associated evaluations required by 10 CFR 50.59, the implementation of the modifications, and how required updates to the Updated Safety Analysis Report were identified for incorporation.
The team determined that during the implementation of Modification EC 53202, the licensee failed to identify non-conformances and the use of non-conservative calculation inputs. Specifically, during the inspection the team identified the following issue:
- NCV 05000285/2013018-07, Failure to Maintain Design Control of the Auxiliary Feedwater System This finding is further discussed in Section 4 of this report.
- (3) Assessment Results The team concluded, based on their reviews of the licensees modifications, and actions taken to address the identified deficiencies, that this area had been adequately addressed by the licensee.
The following Restart Checklist Items were closed:
4.5.1.1 Review of EC 53202; FW-10 Steam Line HELB Modification 4.5.1.2 Final SMART Review of EC 53202; FW-10 Steam Line HELB Modification Plant Review Committee review of EC 53202; FW-10 Steam Line HELB 4.5.1.3 Modification Develop Construction Work Orders for EC 53202; FW-10 Steam Line 4.5.1.4 HELB Modification 4.5.1.5 Complete installation of EC 53202; FW-10 Steam Line HELB Modification Prepare EC 52662; Add a new Pipe Support on the SGBD vertical line 4.5.1.6 above FW-1020 Install EC 52662; Add a new Pipe Support on the SGBD vertical line 4.5.1.7 above FW-1020
5. Specific Issues Identified During This Inspection
1. Failure to Correctly Translate Design Requirements into Installed Plant Configuration
Introduction.
The team identified a violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structure, systems and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from initial construction through October 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break.
Description.
The team reviewed the licensees efforts to reconstitute the stations design analyses for the high energy line break program. During this review, the team determined that the licensee had failed to ensure that design requirements were correctly translated into installed plant equipment.
On December 18, 1972, and January 22, 1973, the NRC sent letters to the licensee requesting a detailed design evaluation to substantiate that the design of the Fort Calhoun Station was adequate to withstand the effects of a postulated rupture in any high energy fluid piping systems outside the primary containment.
On March 14, 1973, the licensee submitted their response to the NRC letters referenced above. In their response, the licensee identified the essential structures and equipment required for a safe shutdown which could be damaged by a pipe rupture, and stated that
the main steam and main feedwater systems had been identified as the major high energy systems which had the greatest potential to inhibit safe shutdown in the event of a postulated pipe rupture. The licensee also stated that evaluations would continue to complete the analysis of the effects of a rupture in high energy fluid piping systems. On March 15, 1973, the licensee submitted their final response to the NRC letters. In this response, the licensee identified other piping systems as non-major high energy systems, and determined that they either had no effect on safe shutdown capability, or required deflector plates to be installed to prevent jet impingement on electrical cables.
On May 31, 1978, the NRC Office of Inspection and Enforcement (IE) issued IE Circular 78-08, "Environmental Qualification of Safety-Related Electrical Equipment at Nuclear Power Plants," which requested all licensees of operating plants to examine their installed safety-related electrical equipment that are required to function under postulated accident conditions. On February 8, 1979, the NRC issued IE Bulletin 79-01, which was intended to raise IE Circular 78-08 to the level of a Bulletin (i.e., action requiring a licensee response). This Bulletin required a complete re-review of the environmental qualification of safety-related electrical equipment as described in IE Circular 78-08. Subsequently, on January 14, 1980, the NRC issued IE Bulletin 79-01B which expanded the scope of IE Bulletin 79-01 and requested additional information on environmental qualification of safety-related electrical equipment at operating plants.
On March 3, 1980, the licensee submitted their response to IE Bulletin 79-01B. In this letter, the licensee stated that only the main steam and main feedwater line breaks could cause accident conditions that would challenge safety related electrical equipment. It stated that all other systems had been excluded from review because they did not affect the ability to bring the unit to safe shutdown. This response formed the licensees basis for the stations environmental qualifications, and superseded their high energy pipe rupture response letter dated March 15, 1973.
In August 2007, the licensee initiated Condition Reports CR 2007-02715 and CR 2008-01186, to document issues with the electrical equipment qualification and high energy line break programs. As a result, the licensee performed a focused self-assessment (FSA-07-47) to evaluate the stations environmental qualification program as it relates to the industries best practices. During this assessment, the licensee identified that the station did not meet industry best practices, and the stations response to IE Bulletin 79-01B had made inaccurate simplifying assumptions with regard to high energy piping systems failures.
The licensee ultimately determined that all regulatory requirements were currently being met by the program; the issue was a failure to meet industry best practices. The licensee subsequently performed a root cause analysis to determine why the stations electrical equipment qualification program (this includes the high energy line break program) did not meet industry standards. The licensee determined the root cause of this issue to be, organizational changes caused a loss of knowledge transfer and documentation which was exacerbated by; the historical design basis documents not always being retrievable and auditable, and there being no rigorous review of the environmental qualification program since the early 1990s. The licensees corrective actions focused on complying with industry best practices.
The team noted that the licensee continued to document programmatic weaknesses and documentation deficiencies associated with the electrical equipment qualification and high energy line break programs in the corrective action program. As these issues were resolved, the licensee discovered additional issues with the programs, including lack of design bases analyses, and equipment configuration qualification issues. Based on this, the licensee had recognized the need to reconstitute the electrical equipment qualification and high energy line break programs, and initiated the electrical equipment qualification program corrective action project in 2008. The team noted that this project was being performed outside of the stations corrective action program. As a result of this observation by the team, the licensee initiated Condition Report CR 2013-2857 to evaluate the cause of the programmatic breakdown and correct this issue.
The team reviewed the licensees root cause analyses and noted that the licensee had determined that the causes of the programmatic break downs to be:
RC-1: Fort Calhoun Stations response to IE Bulletin 79-01B made inaccurate and simplifying assumptions, without supporting documentation, that compromised the validity and scope of the electrical equipment qualification program, ultimately resulting in the program being non-compliant with 10 CFR 50.49.
RC-2: The electrical equipment qualification program has unique processes that are not integrated into the engineering change process; creating an unnecessary burden on the electrical equipment qualification coordinator, and affecting the sustainability of the electrical equipment qualification program.
The team determined that this issue had resulted in a condition where twenty four areas in the facility that contained high energy piping had not been evaluated for the effects of a rupture in this piping to ensure that the structures, systems, and components necessary to bring the reactor to safe shutdown following a high energy line break were qualified to be able to perform their specified safety function. Specifically, multiple system components affecting:
- charging
- containment isolation
- containment cooling; and
- shutdown cooling may not have functioned as designed following a high energy line break. A detailed listing of affected equipment is contained in Attachment 3 of this document.
The licensee addressed this deficiency by reconstituting the design analysis associated with the programs, receiving a change to the facilities licensing basis, and implementing plant modifications.
Analysis.
The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that
respond to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where structures, systems, and components necessary to mitigate the effects of a high energy pipe break may not have functioned as required.
The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because it was a deficiency affecting the design and qualification of a mitigating structure, system, or component that resulted in a loss of operability or functionality and represented a loss of system and/or function.
The Region IV senior reactor analyst performed a detailed risk evaluation in accordance with Appendix A, Section 6.0, Detailed Risk Evaluation. The evaluation concluded the finding was best characterized as having low to moderate safety significance (White).
The minimum calculated change in core damage frequency of 4.1 x 10-6 was dominated by a reactor coolant pump seal cooler loss of coolant accident followed by the failure of four isolation valves containing inappropriate elastomers. The upper bound was shown quantitatively and/or qualitatively to be less than 1.0 x 10-5. The analyst determined that the finding did not affect the external events initiator risk and that the finding would not involve a significant increase in the risk of a large early release of radiation.
The team determined that this finding does not have a cross-cutting aspect because the most significant contributor of this finding would have occurred more than three years ago, and therefore, does not reflect current licensee performance.
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from initial construction through October 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break.
The licensee addressed this deficiency by implementing plant modifications and receiving a change to the facilities licensing basis. This finding is associated with a Notice of Violation attached to this report: VIO 05000285/2013018-01, Failure to Correctly Translate Design Requirements into Installed Plant Configuration.
2. Use of Non-conservative Values in Design Analyses
Introduction.
The team identified two examples of a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with non-conservative errors identified in station calculations.
Description.
The team identified two examples where the licensee had non-conservative inputs used in station design analyses.
Example 1: The team reviewed Calculation FC07885, Stress Analysis for Small Bore Piping on Isometric CH4106 High Energy Line Break Assessment, which compared ASME Section III requirements to the requirements of USAS B31.7 for the chemical volume control system small bore piping and supports. This analysis was performed to ensure the piping was capable of withstanding a high energy line break event. During their review the team determined that the calculation did not use the most conservative yield strength between USAS B31.7 and ASME Section III. Specifically, Calculation FC07885 identified that steel type SA312 TP304 had a yield strength (Sy) of 18,900 lbs/in2 and type SA376 TP316 had a yield strength (Sy) of 20,900lbs/in2.
However, the licensee had used the less conservative yield strength of 20,900 lbs/in2 to calculate potential pipe break locations. The team determined that this was non-conservative and informed the licensee of their concerns.
The licensee initiated Condition Report CR 2013-13743 to capture this issue in the stations corrective action program. This does not represent an immediate safety concern because the licensee performed an operability determination for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issue.
Example 2: The team reviewed Calculation FC07234, Evaluation of Shutdown Cooling Mode Temperature and Pressure increase on the SI System Piping and Pipe Supports, Revision 0, which had been prepared to analyze the shutdown cooling system piping and supports because of changes to the entry conditions. During this review, the team determined that the calculation contained the following non-conservative errors:
- The analyses identified an instance where an analyzed piping node exceeded pipe allowable stresses. However, the licensee had instituted non-conservative acceptance criteria that allowed this node to be accepted. Specifically, a finite analysis was used to lower the stress intensification factor for a pipe tee in subsystem SI-191A. This was not fully bounded by the design specifications of the system.
- The calculation allowed the use of piping support displacement criteria which was contrary to the facilities current licensing basis. Specifically, the calculations criterion for additional evaluation for thermal and seismic anchor movements was 1/8 of an inch. However, the stations current licensing basis required that additional evaluation for seismic anchor or support movement be performed at 1/16 of an inch.
- The calculation determined that a pipe support, SIH-243, would experience uplift which would exceed the allowable stress for that support. However, this was determined to be acceptable because the load would distribute to other supports, SIH-8 and SIH-9, and would be within faulted capacities of these supports. The team determined that this was non-conservative because piping supports are required to meet stress allowables for all normal required loadings without crediting faulted load (accident) allowables.
The licensee initiated Condition Reports CR 2013-18639, CR 2013-18253, CR 2013-18086, CR 2013-14637, and CR 2013-18390 to capture these issues in the stations corrective action program. This does not represent an immediate safety concern because the licensee performed an operability determination for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issues.
The team determined the cause of these issues was that the licensee had failed to recognize the use of non-conservative inputs into design analyses, which resulted in a reduction in design margin for the systems.
Analysis.
The use of non-conservative values in station design analyses is a performance deficiency. This performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the licensees use of non-conservative yield strength to analyze the pipe break loads during a high energy line break resulted in a condition where structures, systems, and components, necessary to mitigate the effects of a high energy pipe break, may not have functioned as required, and the failure to use the correct acceptance criteria resulted in a condition where structures, systems, and components may not have functioned as designed during a seismic event. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:
- (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;
- (2) did not represent a loss of system and/or function;
- (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and
- (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program.
The finding has a cross-cutting aspect in the area of human performance associated with the resources component because the licensee failed to maintain long term plant safety by maintenance of design margins. Specifically, Calculation FC 07885 failed to use the most limiting yield strength when determining potential pipe break loads which resulted in a reduction of design margin H.2(a).
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculation methods, or by the performance of a suitable testing program.
Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from August 2007 through October 2013, Station
Calculations FC07234 and FC07885 contained non-conservative inputs which resulted in the analyses failing to demonstrate that design requirements were met. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-13743, CR 2013-18639, CR 2013-18253, CR 2013-18086, CR 2013-14637, and CR 2013-18390. (NCV 05000285/2013018-02, Use of Non-conservative Values in Design Analyses)
3. Failure to Furnish Evidence of Activities Affecting Quality
Introduction.
The team identified three examples of a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion XVII, Quality Assurance Records, associated with the licensees failure to furnish evidence of an activity affecting quality.
Description.
The team identified three examples of the licensees failure to maintain quality records.
Example 1: Guard pipes surround the steam driven auxiliary feedwater pumps (FW-10)steam supply lines and protect safety-related equipment in the event of a FW-10 steam supply line break. The guard pipes are embedded in the concrete floor of Room 81, and are therefore considered penetrations. The concrete has specific temperature limitations based upon normal operations and accident or short-term operations. The guard pipes have cooling fins to aid in dissipating heat from the steam supply lines to the environment to maintain the temperature of the concrete surrounding the guard pipes within limits.
While reviewing Engineering Change 62391, FW-10 Steam Supply Line A and B Flood Barriers, Revision 0, the team noted that the Engineering Review Group had identified that no calculation was found for the cooling fins for guard pipes AE-31 and AE-32, but the Engineering Review Group failed to enter this deficiency into the corrective action program.
The team questioned whether the fins were adequately sized due to other modifications regarding the guard pipes. The team informed the licensee of their concerns, and the licensee initiated Condition Report CR 2013-22556 to track formal documentation of the heat transfer capability of guard pipe AE-31 and AE-32's fins. The licensee subsequently measured the concrete temperatures surrounding the guard pipes and performed an evaluation to determine whether the concrete would remain below temperature limits during accident conditions. Both the temperature measurements and evaluation determined that the concrete would remain below limits.
The team determined that sufficient records had not been maintained to furnish evidence of activities affecting quality. Specifically:
- (1) the licensee could not furnish a calculation that demonstrated the guard pipe fin sizing was adequate;
- (2) a calculation would have been required to appropriately size the fins initially; and
- (3) the results of the calculation directly affected the auxiliary feedwater system and the structure of the Auxiliary building.
Example 2: While reviewing the stations Environmental Qualification records the team noted that there was no documented record that demonstrated that the Raychem
Splices inside containment were installed in accordance with the specified installation instructions. The team noted that the incorrect installation of these splices could result in the ingress of the moisture into the splice which could affect the ability of the equipment to perform its specified safety functions.
The team informed the licensee of their concerns and the licensee initiated Condition Report CR 2013-14585 to capture this issue in the stations corrective action program.
During subsequent reviews, the licensee determined that the these splices had been installed and inspected as part of the stations response to Information Notice 86-53, Improper Installation of Heat Shrinkable Tubing, and the NRC had reviewed the stations response and found it acceptable. This provided a reasonable basis for operability. However, the team determined that sufficient records had not been maintained to furnish evidence of activities affecting quality.
Example 3: While reviewing Calculations EA-FC-06-032, Environmental Parameters for Electrical Equipment Qualification, Revision 0, and FC 05291, Aux Building Room 81 Flooding Analysis, Revision 0, the team questioned the basis of the maximum flood height used for environmental qualification of equipment in Room 81. Specifically, FC 05291 evaluated the effect of a modification that added an additional potential source of flooding to Room 81, and used as an input of 1.36 feet for the maximum flood level in the room due to a high energy line break. This was cited as coming from USAR, Appendix M, Postulated High Energy Line Rupture Outside Containment, Revision 12, because the original analyses was unavailable. The team reviewed Appendix M and noted that there was not an analytical basis to support the determination of a flood depth of 1.36 feet. The team requested the analyses that supported this determination and the licensee was not able to locate it. The licensee initiated Condition Report CR 2013-12359 to capture this issue in the stations corrective action program.
The licensee subsequently determined that the analyses which established the flood depth in Room 81 following a high energy line break had not been maintained. The licensee performed an operability evaluation for this issue and implemented compensatory measures pending reconstitution of the analyses. The team determined that sufficient records had not been maintained to furnish evidence of activities affecting quality.
Analysis.
The licensees failure to furnish evidence of activities which affected quality was a performance deficiency. The performance deficiency is more-than-minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated cornerstone objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the lack of evidence of calculations for concrete temperatures in the Auxiliary building and the flood height in Room 81 following a high energy line break, and records which demonstrated that the Raychem Splices inside containment were installed in accordance with the specified installation instructions, represents instances where the licensee was not able to substantiate that the design of the facility was adequate following modifications. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, the team determined that the finding was of very low safety significance (Green) because the finding:
- (1) was not a deficiency affecting the design and qualification of a mitigating
structure, system, or component, and did not result in a loss of operability or functionality;
- (2) did not represent a loss of system and/or function;
- (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and
- (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. This finding does not have a cross-cutting aspect because the most significant contributor of this finding, which could not be determined, would have occurred prior to three years ago, and therefore, is not representative of current licensee performance.
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion XVII, Quality Assurance Records states, in part, that, sufficient records shall be maintained to furnish evidence of activities affecting quality. Contrary to the above, the licensee failed to maintain sufficient records to furnish evidence of activities affecting quality. Specifically, prior to December 13, 2013, the licensee was unable to furnish evidence of calculations that demonstrated that the structural concrete temperatures would remain below limits, what the flood height in Room 81 following a high energy line break would be, and records which demonstrated that the Raychem Splices inside containment were installed in accordance with the specified installation instructions. Because this finding is of very low safety significance and has been entered into the corrective action program as Condition Report CR 2013-22556, the violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy:
NCV 05000285/2013018-03, Failure to Furnish Evidence of Activities Affecting Quality.
4. Failure to Promptly Identify and Correct Inadequate Internal Flooding Analysis
Introduction.
The team identified a Green, non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Actions, associated with the licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building.
Description.
While reviewing the stations high energy line break reconstitution efforts, the team noted an issue with Calculations EA-FC-06-032, Environmental Parameters for Electrical Equipment Qualification, Revision 0, and FC 05291, Aux Building Room 81 Flooding Analysis, Revision 0 (NCV 2013018-03). Specifically, the team could not locate the analyses for water level in Room 81 following a high energy line break in the room.
The team informed the licensee of their concern and during follow up discussions the team determined that the licensee had previously entered this issue in the stations corrective action program as Condition Report CR 2012-07534. Through subsequent review of this condition report the team determined that the action item associated with this issue, 2012-07534-002 RE, had been closed improperly without the issue being resolved. The team determined that the licensee had failed to promptly correct a condition adverse to quality.
The team informed the licensee of their concerns and the licensee initiated Condition Report CR 2013-12359 to capture this issue in the stations corrective action program.
This does not represent an immediate safety concern because the licensee performed
operability assessments for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issue.
Analysis.
The licensees failure to adequately evaluate and take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the licensee failed to take prompt corrective actions to address an identified condition adverse to quality related to the internal flooding analysis for Room 81 of the Auxiliary building. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:
- (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;
- (2) did not represent a loss of system and/or function;
- (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and
- (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The finding has a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action program component because the licensee failed to thoroughly evaluate problems such that the resolutions address the causes P.1(c).
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions, requires, in part, that measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Contrary to the above, the licensee failed to establish measures to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances were promptly identified and corrected. Specifically, from 1989 until present, the licensee failed to properly calculate the flood level in Room 81 following a high energy line break. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Report CR 2013-11831. (NCV 05000285/2013013-04, Failure to Promptly Identify and Correct Inadequate Internal Flooding Analysis)
5. Use of Non-Conservative Inputs in Thermal Lag Analyses
Introduction.
The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, involving the failure to use conservative inputs.
Description.
While reviewing Calculation FC 08060, Thermal Lag Analysis for Equipment in Room 81 at Fort Calhoun Station, Revision 0, the team identified four
instances where the licensee had failed to verify inputs used in the analysis.
Specifically:
1. Emissivity values for stainless steel ranges from 0.17-0.9. However, the emissivity
value used in the analysis was 0.8.
2. An assumption used in the analysis was that no equipment was within the zone of
influence of jet impingement of the High Energy Line Breaks. The team walked the area down and determined that this assumption was not correct.
3. During a walkdown of Room 81, the inspector identified that there is Rockbestos
cable Firewall III which was not evaluated in the thermal lag analysis.
4. The team identified that the process fluid temperature was not considered in the
thermal lag analysis.
The team determined that:
- (1) not all of the inputs were conservative;
- (2) not all the assumptions used were verified;
- (3) not all of the equipment and components were analyzed; and
- (4) not all of the process fluid temperatures were considered in the thermal lag analysis.
The team informed the licensee of their concerns and the licensee initiated Condition Reports CR 2013-14504 and CR 2013-14168 to capture these issues in the stations corrective action program. This does not represent an immediate safety concern because the licensee performed an operability determination for the affected areas, which established a reasonable expectation for operability pending resolution of the identified issue.
Analyses. The failure to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the performance deficiency called into question the availability and reliability of components required to mitigate the effects of a high energy line break. Using Inspection Manual Chapter 0609, Appendix A, The Significance Determination Process (SDP) for Findings At-Power, Exhibit 2, Mitigating Systems Screening Questions, dated July 1, 2012, inspectors determined that the finding was of very low safety significance (Green) because the finding:
- (1) was not a deficiency affecting the design and qualification of a mitigating structure, system, or component, and did not result in a loss of operability or functionality;
- (2) did not represent a loss of system and/or function;
- (3) did not represent an actual loss of function of at least a single train for longer than its allowed outage time, or two separate safety systems out-of-service for longer than their technical specification allowed outage time; and
- (4) does not represent an actual loss of function of one or more non-technical specification trains of equipment designated as high safety-significant for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in accordance with the licensees maintenance rule program. The team determined this finding has a cross-cutting aspect in the area of human performance associated with the decision-making component involving the failure to use conservative
assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, the licensee failed to establish measures which assured that applicable regulatory requirements and the design bases, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from June 12, 2012, through July 2013, the licensee failed to verify that all inputs used in the thermal lag analysis for the environmental qualification program were representative of the most limiting condition. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-14504 and CR 2013-14168.
(NCV 05000285/2013018-05, Use of Non-Conservative Inputs in Thermal Lag Analyses)
6. Failure to Recognize Adverse Design Changes
Introduction.
The team identified a non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system.
Description.
While reviewing Engineering Change 53202, Modify Piping and Supports for FW-10 MS Supply for HELB Concerns, Revision 0, the team identified that the licensee had added vent holes to the AE-31 and AE-32 guard pipes. The guard pipes encapsulate the steam supply lines to the turbine-driven auxiliary feedwater pump (FW-10), and were installed to contain steam in the event of a break in the supply lines.
The vent holes were added to provide a relief path for this steam. However, the vent holes were located below the evaluated flood height in Room 81. Flood water, which is postulated to occur from a high energy line break in piping, such as the main steam or main feedwater systems in Room 81, could condense steam within the supply lines to FW-10, resulting in slug flow or insufficient steam quality to the turbine, rendering FW-10 inoperable.
The team informed the licensee of their concern and the licensee initiated Condition Reports CR 2013-18308 and CR 2013-18605. During an extent of condition review, the licensee identified that a portion of the FW-10 steam supply line would be below the evaluated flood height in Room 81. To address the identified issues the licensee implemented Engineering Change 62391, FW-10 Steam Supply Line A and B Flood Barriers, Revision 0, in order to protect the AE-31 and AE-32 guard pipe vent holes and steam supply lines from flood water.
The team determined that the licensee had failed to fully evaluate all impacts of adding vent holes in the guard pipes when developing the modification.
Analysis.
The failure to ensure that design requirements were correctly translated into installed plant equipment was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that responds to initiating events to prevent undesirable consequences. Specifically, the licensees failure to translate the design requirements into installed plant equipment resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined this finding to be of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which would remain functional for the vast majority of sequences. This finding has a cross-cutting aspect in the area of human performance associated with the decision-making component because the licensee failed to use conservative assumptions in decision-making and adopt a requirement to demonstrate that the proposed action is safe in order to proceed rather than a requirement to demonstrate it is unsafe in order to disapprove the action H.1(b).
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from initial construction through September 26, 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-18308 and CR 2013-18605.
(NCV 05000285/2013018-06, Failure to Recognize Adverse Design Changes)
7. Failure to Maintain Design Control of the Auxiliary Feedwater System
Introduction.
The team identified a Green, non-cited violation of 10 CFR Part 50, Appendix B, Criterion III, Design Control, associated with the licensees failure to maintain design control of the auxiliary feedwater system.
Description.
While reviewing Engineering Change 53202, Modify Piping and Supports for FW-10 MS Supply for HELB Concerns, Revision 0, the inspectors identified that the AE-31 and AE-32 guard pipe vent holes were located below the evaluated flood height in Room 81 (05000285/2013018-06).
In order to protect the steam supply lines from flood waters resulting from a high energy line break the licensee prepared Engineering Change 62391, FW-10 Steam Supply Line A and B Flood Barriers, Revision 0. This modification involved the installation of flood barriers, rectangular boxes without lids, surrounding the guard pipes and portions of the FW-10 steam supply lines that are below the evaluated flood height in Room 81.
The team reviewed Engineering Change 62391 and determined that the licensee had not evaluated the effects of water spraying into the flood barriers from a crack or break in any of the high energy systems in Room 81, which is the same source of water in the flood analysis. Major high energy systems in Room 81 include main steam and main feedwater systems. Water spraying into the flood barrier from a high energy line break in Room 81 could have the same effect as with the flood barrier not in place.
The team informed the licensee of their concerns, and the licensee initiated Condition Report CR 2013-22770 to capture this issue in the stations corrective action program.
To address the identified issues the licensee issued a Field Design Change Request to Engineering Change 62965 to add a cover to the flood barriers.
Analysis.
The failure to maintain design control of the auxiliary feedwater system was a performance deficiency. The performance deficiency was more than minor, and therefore a finding, because it was associated with the design control attribute of the Mitigating Systems Cornerstone and affected the associated objective to ensure availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the flood barrier installed only protected the FW-10 steam supply from flood waters rising from the floor; however, this water is postulated from a high energy line break, which would both spill onto the floor and spray into Room 81 without regard for direction. This resulted in a condition where the steam driven auxiliary feedwater pump may not have been able to perform its specified safety function. The team evaluated the finding using Inspection Manual Chapter (IMC) 0609, Appendix A, The Significance Determination Process (SDP) for Findings at Power, dated June 19, 2012, and determined that this finding required a detailed risk evaluation because the turbine driven auxiliary feedwater pump was inoperable for longer than the technical specification allowed outage time. A regional senior reactor analyst performed a detailed risk evaluation and determined that the finding was of very low safety significance (Green) because the bounding change to the core damage frequency was approximately 1.2E-9/year. The dominant core damage sequences included feedwater and main steam line breaks with the consequential failure of the turbine driven auxiliary feedwater pump combined with other random failures of Train A and B equipment trains. Equipment that helped mitigate the risk included the diesel driven and motor-driven auxiliary feedwater pumps, which should remain functional for the vast majority of sequences. The finding was determined to have a cross-cutting aspect in the area of problem identification and resolution associated with the corrective action component because the licensee did not take appropriate corrective actions to address safety issues, in that, an additional modification was required to
protect the FW-10 steam supply from the effects of a high energy line crack or break P.1(d).
Enforcement.
Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, states, in part, that, measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, measures established by the licensee did not assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. Specifically, from November 24, 2013, until December 15, 2013, the licensee failed to fully incorporate applicable design requirements for components needed to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition following a high energy line break. This violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the Enforcement Policy. The violation was entered into the licensees corrective action program as Condition Reports CR 2013-18308 and CR 2013-18605.
(NCV 05000285/2013018-07, Failure to Maintain Design Control of the Auxiliary Feedwater System)
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
- S. Anderson, Manager, Design Engineering
- C. Cameron, Supervisor Regulatory Compliance
- L. Cortopassi, Site Vice President
- E. Dean, Plant Manager
- M. Ferm, Manager, System Engineering
- M. Frans, Manager, Engineering Programs
- H. Goodman, Site Engineering Director
- M. Greeno, NRC Inspection Readiness Team Contractor
- W. Hansher, Supervisor, Nuclear Licensing
- R. Haug, Senior Consultant
- K. Ihnen, Manager, Site Nuclear Oversight
- R. Hugenroth, Supervisor, Nuclear Assessments
- E. Matzke, Senior Licensing Engineer
- J. McManis, Manager Engineering Programs
- B. Obermeyer, Manager, Corrective Action Program
- T. Orth, Director, Site Work Management
- A. Pallas, Manager, Shift Operations
- M. Prospero, Division Manager, Plant Operations
- B. Rash, Recovery Lead
- R. Short, Manager, Recovery
- T. Simpkin, Manager, Site Regulatory Assurance
- M. Smith, Manager, Operations
- S. Swanson, Operations Director
- K. Wells, Nuclear Design Engineer Design Electrical/I&C
- J. Wiegand, Manager, Operations Support
- G. Wilhelmsen, Exelon Nuclear Partners
- J. Zagata, Reliability Engineer
A1 -1 Attachment 1
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened and Closed
05000285/2013018-01 VIO Failure to Correctly Translate Design Requirements into
Installed Plant Configuration (Section 4OA4)05000285/2013018-02 NCV Use of Non-conservative Values in Design Analyses
(Section 4OA4)05000285/2013018-03 NCV Failure to Furnish Evidence of Activities Affecting Quality
(Section 4OA4)05000285/2013018-04 NCV Failure to Promptly Identify and Correct Inadequate Internal
Flooding Analysis (Section 4OA4)05000285/2013018-05 NCV Use of Non-Conservative Inputs in Thermal Lag Analyses
(Section 4OA4)05000285/2013018-06 NCV Failure to Recognize Adverse Design Changes
(Section 4OA4)05000285/2013018-07 NCV Failure to Maintain Design Control of the Auxiliary Feedwater
System (Section 4OA4)
Closed
05000285/2012-017-2 LER Containment Valve Actuators Design Temperature Ratings
Below those Required for Design Basis Accidents
(Section 4OA4)
05000285/2013-011-0 LER Inadequate Design for High Energy Line Break in Rooms 13
and 19 of the Auxiliary Building (Section 4OA4)
05000285/2013-015-1 LER Unqualified Coating used as a Water Tight Barrier in Rooms
and 82 (Section 4OA4)
05000285/2013-016-0 LER Reporting of Additional High Energy Line Break Concerns
(Section 4OA4)
Attachment 1
CONDITION REPORTS
NUMBER
2013-12245 2013-02857 2013-12249 2013-05570
2013-11502 2013-11532 2013-08675 2012-07724
2013-05206 2013-22784 2013-15555 199600523
2011-3198 200500704 200501568 200002402
200700120 200601796 200601606 200601755
200502333 200501568 200500704 200402691
200402145 200304519 200002147 2013-21877
2013-21820 2013-20453 2013-18633 2013-18162
2013-18343 2013-18158 2013-16341 2013-14793
2013-12672 2012-00549 2011-5759 2011-4297
2011-3965 2011-3198 2009-4958 2009-3598
2009-0409 2008-2495 2008-1716 2008-1710
2007-2692 199801227 2013-01796 920184
200700702 920468 2013-21285 2013-18639
2013-18390 2013-18253 2013-18252 2013-18086
2013-14706 2013-14703 2013-14637 2013-11287
2013-09422 2013-07551 2013-06943 2012-05244
2012-05202 2012-04847 2011-4979 200101822
199802045 2008-5517 2010-5603 2013-15223
2013-04590 2013-14637 199500039 199500437
199600082 199600137 199600331 199600340
199600353 199600400 199600639 199600786
199600791 199600858 199601225 199601226
199601321 199601368 199601403 199601405
199601491 199601624 199700008 199700177
199700198 199700205 199700422 199700426
199700472 199700475 199700473 199700495
199700782 199701020 199701073 199701160
199701261 199701532 199701566 199701623
199701679 199701710 199800072 199800376
199800828 199800855 199800888 199800889
199800915 199800918 199800938 199801153
Attachment 1
199801225 199801227 199801822 199801826
199801877 198802168 199900484 199901002
199901103 199901198 199901492 199901677
199901953 199902001 199902028 199902047
199902321 199902307 200000377 200000699
200002018 200002147 200100051 200100391
200100690 200101212 200101367 200001921
200002145 200002525 200100374 200100606
200101093 200101352 199902276 200000133
200001844 200002079 200002402 200100372
200100577 200100959 201101332 200101300
200100909 200100536 200100368 200002401
200002079 200001511 199902515 199902183
199902129 199902485 200001495 200002065
200002345 200100317 200100507 200100894
200101288 199902123 199902417 200001078
20002050 200002252 200100290 200100476
200100827 200101255 200101382 200101581
200101597 200101873 200102142 200102204
200102283 200102386 200102440 200102482
200102491 200102306 200120470 200102598
200102654 200102873 200102985 200103118
200103278 200103285 200103316 200103369
200103499 200103499 200103565 200103573
200103831 200200898 200200906 200201000
200200720 200200970 200200973 200201112
200201144 200201140 200201368 200201564
200201851 200201563 200201557 200201319
200202320 200201237 200201840 200201705
200201619 200301841 200201612 200201593
200203684 200201924 200201860 200203079
200201950 200201923 200302036 200301129
200300403 200204171 200202827 200301044
200300772 200301590 200303065 200303438
Attachment 1
200300251 200301628 200303165 200302959
200501758 200501809 200502284 200502286
200502281 200502242 2010-2250 2012-08621
2013-02857 2011-7463 2012-15687 2013-10907
2013-05217 2013-04395 2012-07901 2012-19124
2012-10165 2012-18937 2013-14168 2013-14477
2008-1176 2011-7462 2011-7496 2011-7494
2012-01655 200302881 200302324 200303503
200303510 200303549 200303555 200303662
200303665 200304010 200303990 2007-2452
200304189 2007-0591 2007-1969 2007-3312
2007-00613 2007-00662 2007-3435 2007-0494
2007-4815 2007-4772 2007-0354 2007-2596
2007-4787 2008-0811 2007-2540 2008-2481
2008-0990 2008-1628 2007-4352 2008-2495
2008-1630 2008-1716 2008-0195 2008-2567
2008-2253 2008-2484 2008-1602 2008-2609
2008-2491 2007-2692 2008-1707 2008-2660
2008-2489 2007-4758 2008-2482 2008-2900
2008-1813 2008-0649 2007-4007 2008-3002
2008-1629 2008-1605 2007-4967 2008-3092
2008-0930 2008-1715 2008-1569 2008-3905
2007-2925 2008-2483 2008-1706 2008-4172
2011-05242 2011-05243 2013-22770 2013-22556
2013-04544 2013-02711 2007-02715 2013-20253
2011-07496 2012-08520 2012-02498 2013-13217
2012-02115 2013-02857 2013-13217 2013-19500
PROCEDURES
NUMBER TITLE REVISION
PED-QP-15 Electrical Equipment Qualification Program 13
SO-G-56 Qualified Life Program 26
PED-GEI-5 Electrical Equipment Qualification Evaluation 12
EEQ Electrical Equipment Qualification Manual -Enclosure 1
Attachment 1
PROCEDURES
NUMBER TITLE REVISION
PED-QP-2 Configuration Change Control 61
PED-GEI-60 Preparation Substitute Replacement Items 48
CALCULATIONS
FC08060 FC07885 FC08027 FC07234
FC08145 FC08025 FC06421 FC07283
EA-FC-12-205 FC04276 FC06740 FC07096
EA11-023 FC08255 FC08303 FC08302
FC08304 EA90-031 EA-FC-93-003 FC 08124
FC 05361 FC 07890 FC 08038 EA-FC-02-004
ENGINEERING CHANGES 202 54173 54335 54246
2391 57139
DRAWINGS
NUMBER TITLE REVISION
C-4113 Subsystem #MS-4099A Aux. Feedwater Pump FW-10 Pipe A
Routing From MS-383A Penetrations & Restraint Details
C-4114 Subsystem #MS-4099A Aux. Feedwater Pump FW-10 Pipe 0
Routing from MS-381A, Penetrations, & Restraints Details
D-4318 CQE Piping Isometrics - Seismic Sub. System - # MS- 5
4099A
MISCELLANOUS
NUMBER TITLE REVISION/
DATE
Technical Report 13- Metallurgical Evaluation of Small Bore Socket Welds Rev. 0
0376-TR-001
LIC-88-0873 NRC Bulletin 88-08, Thermal Stresses in Piping
Connected to Reactor Coolant Systems
AREVA Doc No 32- Exemption from Fatigue for RCS attached Class 1 piping
9146950-000 for Fort Calhoun Station
AREVA Doc No 51- Fort Calhoun Code Reconciliation for Class 1 Attached
9148493-000 Piping Reanalysis
LIC-13-0187 Fort Calhoun Station (FCS) License Amendment December 13,
Attachment 1
MISCELLANOUS
NUMBER TITLE REVISION/
DATE
Commitment - Piping Code Discrepancies 2013
EEQ-H-01 ASCO Solenoid NP Series Valves 21
EEQ-H-02 Namco Limit switches 23
EEQ-H-05 Conax Electrical Penetrations 9
EEQ-H-21 Rockbestos Pyrotrol Cables 9
EEQ-H-24 Victoreen Radiation Monitor 8
LER 2012-015 Electrical Equipment Impacted by HELB outside 0
Containment
EEQ-H-31 Graboot Connectors 8
EEQ-H-03 ITT Conoflow 11
NED-11-0098 DEN SMART Assignment Approval for EC 53202, Modifying August 15, 2011
Piping and Supports for FW-10 MS Supply for HELB
Concerns
WORK ORDERS
00492949-01 00199528-01 411399-01 395469-03
232 54039 54110 57732
2965 00455673 00455680 00455678
ACTION REQUEST
00060099 00060100
Attachment 1
Detailed Risk Evaluation
Failure to Ensure Equipment Qualified for Harsh Enviroment
(1) The Model Revision and Other Probabilistic Risk Assessment Tools Used
The analyst utilized the Standardized Plant Analysis Risk Model for Fort Calhoun
Station, Versions 8.20 and 8.21, and hand calculation methods to quantify the risk of the
subject performance deficiency.
(2) Assumptions
1. The risk impact of the subject performance deficiency was limited to high-energy
line breaks in the rooms or areas of concern.
2. The subject performance deficiency impacted plant risk from initial reactor startup
through October 2013. Therefore, in accordance with the Risk Assessment of
Operational Events Handbook, Volume 1, Internal Events, Revision 2, Section
2.6, Exposure Time Greater than 1 Year, the maximum exposure time was set
to the 1 year assessment period.
3. The best available model for quantifying the risk for high-energy line breaks is the
Standardized Plant Analysis Risk (SPAR) model for Fort Calhoun Station, Unit 1,
Versions 8.20 and 8.21.
4. The analyst noted that neither version of the SPAR model provided for evaluation
of conditions affecting a reactor coolant pump seal cooler loss of coolant
accident. Therefore, the best available evaluation method was to create a model
specifically designed for this initiator, using the SPAR Version 8.20.
5. The best available source of information related to pipe failure rates for Fort
Calhoun Site is the EPRI Technical Report 3002000079.
6. The best available source of information related to failures of auxiliary steam
system and their potential impacts for the Fort Calhoun Station is Combustion
Engineering Nuclear Power LLC Report ST-2000-0627.
7. The failure of the diaphragms in HCV-438A and HCV-438C would be unlikely to
very unlikely upon successful cooldown by operators following a reactor coolant
pump seal cooler failure as described in the licensees white paper entitled,
Overview of RCP Seal Cooler Containment Isolation Valve Elastomer
Significance.
8. The change in core damage probability for all air-operated valves that fail upon
loss of air to their risk-significant position would be negligible given inadequate
elastomers.
9. The CDF for inadequate elastomers would be negligible for all valves that fail in
the direction that supports system function for the high-energy line break that
causes the failure.
10. The failure of hot leg injection at the Fort Calhoun Station would only impact the
plant response to a large-break loss of coolant accident.
A2 -1 Attachment 2
11. The inability of operators to sample the containment environment following an
accident would not significantly impact the core damage frequency.
2. Components that exceeded their harsh environment qualification limits during a
postulated event would fail.
13. Upon failure of the elastomers in an air-operated valve, the valve would move to
the position it was designed for upon loss of instrument air.
14. Overfilling of the steam generators results in failure of Pump FW-10, Turbine-
Driven Auxiliary Feedwater Pump, via flooding of the steam supply line.
15. A break in the auxiliary steam system piping in either diesel generator room
would not result in a direct transient.
16. Following a postulated break in the auxiliary steam system piping in either diesel
generator room, the associated diesel generator would be restored to operable
status within the Technical Specification allowed outage time or the plant would
be shut down and cooled down.
17. A failure frequency of 1 x 10-3/year provides a clear upper bound for the
frequency of an auxiliary steam system pipe break in any room in the plant.
18. Upon a postulated auxiliary steam line break on the Intake Structure operating
deck the rotating screens would fail causing a loss of raw water.
19. The change in failure frequency of socket welded pipe caused by the lack of
ability to perform nondestructive examination can be bounded by increasing the
failure frequency by a factor of approximately 100.
20. Given the as-found condition of the turbine-driven auxiliary feedwater pump
steam supply piping guard pipe, a postulated failure of the supply piping would
supply steam to Room 56E in sufficient quantities to fail the 1A3 side electrical
busses in the room.
21. The licensees initiating event frequencies for main-steam line break and main
feedwater line break outside containment include a wide range of pipe break
sizes.
2. Given Assumption 21, the use of the licensees initiating event frequencies for an
evaluation of post-break flooding in Room 81 provides an upper bound.
(3) Calculation discussion
The licensee failed to correctly translate the design requirements associated with high-
energy line breaks into structures, systems, and components necessary to bring the
reactor to safe shutdown. The analyst determined that this performance deficiency
affected plant risk in three ways. Specifically:
Attachment 2
(1) Fifty-eight air-operated valves had diaphragms and/or other elastomers that
were not qualified for the harsh environment they would be subjected to
following a postulated accident and/or high-energy line break. The
characterization of each of these valves is documented in Table 1.
(2) Nineteen areas in the plant contained auxiliary steam system piping. The
licensee had not evaluated these areas for breaks in the auxiliary steam
system piping, resulting in some components not being capable of
withstanding such an environment. The plant areas and the functional
groups identified for these areas are documented in Table 4.
(3) Five areas in the plant contained high-energy piping that had not been
evaluated for breaks. As a result, multiple risk-significant components were
not properly protected or qualified for the resulting harsh environment. The
characterization of these areas is documented in Table 5.
Evaluation 1: Air-Operated Valves with Inappropriate Elastomers
The licensee identified 58 air-operated valves had diaphragms and/or other
elastomers that were not qualified for the harsh environment they would be
subjected to following a postulated accident and/or high-energy line break. The
analyst identified similarities among various valves and grouped them into nine
functional groups to simplify the analysis. The functional groups and
characterization of these valves are documented in Table 1.
Attachment 2
Table 1
Air-Operated Valves Containing Inappropriate Elastomers
Group Frequency Bounding CDF
Valve Description Location (per year) CCDF
Total Change in Core Damage Frequency for Inappropriate Elastomers: 4.10 x 10-6
NOTES:
NOTE 1: All Group 4 valves were analyzed together. The total risk is documented as the risk for Valve HCV-238 in Table 1.
NOTE 2: The various failure modes and combinations for the valves in Group 9 were analyzed in a single model. The total
risk evaluated for all four valves is documented as the risk for Valve HCV-438B in Table 1.
Group 1: Valves fail in the safety/risk-significant direction.
Group 2: For the harsh environment of concern, the valves would fail in the risk-significant direction.
Group 3: Valves would fail open and increase the likelihood of over filling the steam generators.
Group 4: Valve failures affect hot leg injection and are only of concern during large-break loss of coolant accidents.
Group 5: These valves fail in the risk-significant direction (open), but are required to isolate a failure of line.
Group 6: These valves do not have a risk-significant function for high-energy line break.
Group 7: Valve is normally open and fails as is. Open is dominant risk function. Valve must close for hot leg injection.
Group 8: Valve fails closed effecting containment isolation, but sampling function is lost.
Group 9: Component cooling water isolation valves affect plant response to reactor coolant pump heat exchanger
intersystem loss of coolant accident.
Attachment 2
For the 58 valves in Table 1, the licensee had determined that each of these valves
contained the elastomer Nitrile which would be exposed to elevated temperatures
beyond its nominal design range following postulated high-energy line break
scenarios. While the Nitrile elastomers are not rated for operation in harsh
environments, the licensee noted that manufacturers literature indicates that operation
of elastomers for restricted time periods in these environments may be acceptable.
The analyst evaluated each of the valve groups from Table 1 as follows:
Group 1: All Group 1 valves were determined to fail in the risk-significant direction.
Should the elastomers in any of these valve actuators fail, springs would drive the
valve in the appropriate direction. Therefore, the change in risk, given the
performance deficiency was negligible for these valves.
Group 2: The analyst noted that Group 2 valves had risk-significant functions that
required the valve to open or close depending on the system function demanded.
The analyst reviewed the initiating events that would result in a harsh environment
surrounding each valve. In each case, the risk-significant function of the valve
following the initiator causing the harsh environment was to go to the failed
position. Should the elastomers in the valve actuator fail, springs would drive the
valve in the appropriate direction. Therefore, the change in risk, given the
performance deficiency was negligible for these valves.
Group 3: The analyst determined that all Group 3 valves would fail open and increase
the likelihood of over filling the steam generators. Over filling the steam generators,
while providing additional short-term cooling, results in the failure of the turbine-driven
auxiliary feedwater pump by flooding the steam supply line. The analyst used the
Standardized Plant Analysis Risk (SPAR) Model for Fort Calhoun Station, Version 8.20
to quantify a bounding conditional core damage probability (CCDPFW-10) for the loss of
Feedwater Pump FW-10 following a high-energy line break. The baseline (CCDPBase)
for each scenario was also quantified. In accordance with Assumption 2, the exposure
period (EXP) used was one year. The frequency (Containment) of a high-energy line
break for containment was determined to be approximately the sum of the frequencies
of the following initiators:
From plant-specific SPAR model:
- Large-break loss of coolant accident (2.50 x 10-6 /year)
- Medium-break loss of coolant accident (1.50 x 10-4 /year)
- Small-break loss of coolant accident (3.67 x 10-4 /year)
- Reactor vessel rupture (1.00 x 10-7 /year)
From licensees probabilistic risk assessment:
- Main steam line break inside containment (2.10 x 10-4 /year)
- Main feedwater line break inside containment (7.70 x 10-5 /year)
- Main feedwater line break upstream of check valve (3.90 x 10-5 /year)
The resulting high-energy line break frequency for containment was 8.46 x 10-4 /year.
A2 -9 Attachment 2
The frequency (Room 81) of a high-energy line break in auxiliary building Room 81 was
determined to be approximately the sum of the frequencies of the following initiators:
- Main Steam Line Break (1.80 x 10-4 /year)
- Main Feedwater Line Break (3.00 x 10-4 /year)
The resulting high-energy line break frequency for Room 81 was 4.80 x 10-4/year.
The analyst noted that for each high-energy line break initiator; there was an alternate
valve in another area that was not impacted directly by the harsh environment. Should
the alternate valve close, the steam generators would not overfill. Therefore, the
analyst used a single train failure rate (PRandom) of 1.0 x 10-2 to account for the random
failure of the opposite train valve.
The analyst determined that a high-energy line break in Room 81 was best
represented by a loss of main feedwater initiator in the site-specific SPAR model. The
analyst quantified the conditional core damage probability for a loss of main feedwater
(CCDPBaseMF81) as the baseline for breaks in Room 81 (4.75 x 10-6). Given the
performance deficiency, over filling of steam generators is possible and would fail
Pump FW-10. The analyst quantified the conditional core damage probability for this
scenario (CCDPMF-FW-10) providing a probability of 2.96 x 10-5. For each of the six
valves in Room 81, the analyst hand calculated the CDF as follows:
CDF = Room 81 * EXP * (CCDPMF-FW-10 - CCDPBaseMF81) * PRandom
= 4.80 x 10-4 /year * 1 year * (2.96 x 10-5 - 4.75 x 10-6) * 1.0 x 10-2
= 1.19 x 10-10
The analyst determined that a high-energy line break in Containment was best
represented by a large-break loss of coolant accident in the site-specific SPAR model.
The analyst quantified the conditional core damage probability for this initiator
(CCDPBaseLL) as the baseline for breaks in Containment (1.90 x 10-3). Given the
performance deficiency, over filling of steam generators is possible and would fail
Pump FW-10. The analyst quantified the conditional core damage probability for this
scenario (CCDPLL-FW-10) providing a probability of 2.75 x 10-3. For each of the four
valves in Containment, the analyst hand calculated the CDF as follows:
CDF = Containment * EXP * (CCDPLL-FW-10 - CCDPBaseLL) * PRandom
= 8.46 x 10-4 /year * 1 year * (2.75 x 10-3 - 1.90 x 10-3) * 1.0 x 10-2
= 7.19 x 10-9
The analyst noted that the total CDF for Group 3 valves was the sum of the change
for each individual valve: 3.70 x 10-8.
Group 4: The analyst noted that all Group 4 valves would affect the reliability of hot
leg injection upon failure. Hot leg injection is a necessary function to ensure that there
will not be unacceptably high concentrations of boric acid in the core region (resulting
in precipitation of a solid phase) during the long-term cooling phase following a
postulated large-break loss of coolant accident. The analyst noted that failure of the
Group 4 valves would not cause a complete loss of hot-leg injection capability.
Attachment 2
Alternate hot-leg injection would be available through motor-operated valves, and
solenoid-operated valves, in series provided redundancy to isolate the lines affected.
Using the SPAR model, the analyst noted that the frequency of a large-break loss of
coolant accident (LLOCA) was 2.5 x 10-6 /year. The analyst quantified the model to
determine the conditional core damage probability for a large-break loss of coolant
accident and failure of all Group 4 valves. The analyst used Basic Event LPI-XHE-XM-
HTLEG, Operator Fails to Initiate LPR Hot Leg Recirculation, as a surrogate for the
failure of the valves. Substituting the baseline failure of this basic event for an
estimated 4.0 x 10-3 probability that alternate methods of hot leg injection would fail
resulted in a conditional core damage probability (CCDPGroup4) of 4.92 x 10-3. The
baseline conditional core damage probability (CCDPBase) was 1.9 x 10-3 for a large-
break loss of coolant accident. The analyst hand calculated the CDF as follows:
CDF = LLOCA * EXP * (CCDPGroup4 - CCDPBase)
= 2.5 x 10-6 /year * 1 year * (4.92 x 10-3 - 1.90 x 10-3)
= 7.55 x 10-9
Group 5: Given a high-energy line break, valves in Group 5 would fail open. To
maintain the steam supply to the turbine-driven auxiliary feedwater pump, Group 5
valves failing open supports the risk-significant function. However, these valves are
also required to isolate a line break in the steam supply line. The analyst reviewed
Drawing 11405-M-252, Sheet 1, Flow Diagram Steam P & ID. The analyst did not
identify any line break in Room 81 that would degrade the function of Pump FW-10
because of the failure to isolate the break. Therefore, the change in risk, given the
performance deficiency was negligible for these valves.
Group 6: The analyst reviewed the function for each of the eight valves in Group 6.
The postulated failure of these valves would only occur with a high-energy line break in
auxiliary building Room 81. Given this line break, the valves in Group 6 would fail
closed when the risk-significant function is open. However, the analyst determined
that the risk-significant function for Group 6 valves would not be needed in response to
a high-energy line break in auxiliary building Room 81. Therefore, the change in risk,
given the performance deficiency was negligible for these valves.
Group 7: Valve HCV-2987, HPSI Alternate Header Isolation Valve, is the only valve
in Group 7. The valve is maintained open during normal plant operations and would
fail as-is given a high-energy line break. The analyst noted that open is the dominant
risk function for this valve. However, the valve is required to close for hot leg injection.
Hot leg injection is a necessary function to ensure that there will not be unacceptably
high concentrations of boric acid in the core region (resulting in precipitation of a solid
phase) during the long-term cooling phase following a postulated large-break loss of
coolant accident. Using the SPAR model, the analyst noted that the frequency of a
large-break loss of coolant accident (LLOCA) was 2.5 x 10-6 /year. The analyst
quantified the model to determine that the conditional core damage probability for a
large-break loss of coolant accident and failure of all hot leg injection was 1.0
(CCDPHLI). The analyst determined that there would be sufficient time following a
large-break loss of coolant accident for operators to safely enter Room 13 and
manually reposition Valve HCV-2987. Therefore, the analyst provided a screening
value (Pscreen) of 0.1 for the probability that operators failed to reposition the valve prior
Attachment 2
to the need for hot leg injection. The baseline conditional core damage probability
(CCDPBase) was 1.9 x 10-3 for a large-break loss of coolant accident. The analyst hand
calculated the CDF as follows:
CDF = LLOCA * EXP * (CCDPHLI - CCDPBase) * Pscreen
= 2.5 x 10-6 /year * 1 year * (1.0 - 1.90 x 10-3) * 1.0 x 10-1
= 2.50 x 10-7
Group 8: Valve PCV-742G, Radiation Monitoring Cabinet; Inlet Inboard Isolation
Valve, is the only valve in Group 8. The risk-significant function for the valve is to
close, supporting containment isolation. Given a high-energy line break,
Valve PCV-742G would fail closed. The primary operational function of the valve is to
open following an accident to sample the containment environment. The analyst
determined that, while the inability to sample would cause difficulties in understanding
the condition of the containment environment, it would not have an impact on the core
damage frequency. Therefore, the change in risk, given the performance deficiency
was negligible for this valve.
Group 9: Group 9 consists of Valves HCV-428A, HCV-438B, HCV-438C, and
HCV-438D. These valves are the inlet and outlet containment isolation valves for
component cooling water going to the reactor coolant pump seal coolers. The valves
have two primary functions:
1) To close for containment isolation, and
2) To close to isolate a postulated intersystem loss of coolant accident
following a break of one of four reactor coolant pump seal cooler helix coils.
A one-line diagram of the seal coolers and the Group 9 valves is provided as Figure 1.
Attachment 2
4. Top Event HPI, provided from the SPAR, models various failure modes of the
high pressure injection system.
5. Top Event SSC, provided from the SPAR, models various failures of the
secondary plant systems that would prevent normal cool down of the plant.
6. Top Event OTC, provided from the SPAR, models failures of the high pressure
injection system and the primary power-operated relief valves, failures of which
would prevent the feed and bleed function described in the emergency operating
procedures.
7. Top Event CSR, provided from the SPAR, models various failure modes of the
containment spray system assuming that containment coolers are unavailable
because of failure of the component cooling water system.
8. Figure 5 shows the top event, Inboard-Iso-Holds. This fault tree was created by
the analyst and added to the event tree to account for the potential that Valves
HCV-438A and HCV-438C operators fail to remain closed in the containment
environment created by a small-break loss of coolant accident. The failure of the
valves as a result of the performance deficiency were modeled differently at high
reactor coolant system pressures and following a reactor depressurization directed
by the emergency operating procedures. The failure probabilities used were
developed by the analyst using qualitative information provided by the licensee in a
white paper entitled, Overview of RCP Seal Cooler Containment Isolation Valve
Elastomer Significance. The analyst noted that these valves would remain closed
with a differential pressure of approximately 300 psig based on the design of the
plug (See Figure 2).
The licensee performed an assessment to provide background information
regarding the high temperature behavior of Nitrile, the substance used as the
primary elastomer in the 58 subject valves. The Parker O-ring handbook
(Reference 1) indicated that Nitrile materials can be used for limited periods when
exposed to temperatures in the 200-300 degrees Fahrenheit range. However, that
handbook does not specify a relationship between Nitrile lifetime and exposure
temperature. Other references, including earlier versions of the Parker handbook
have provided time/temperature relationships for various elastomers. The licensee
extrapolated this information to estimate the lifetime-exposure temperature
relations for Nitrile for the purposes of gaining insight with regard to risks of loss of
function for selected valves with Nitrile components. Specifically, this information
was used to support the licensees judgments regarding the failure probability of
Nitrile when subjected to limited duration exposures to elevated temperatures
beyond their nominal design ranges.
Valves HCV-438A, HCV-438B, HCV-438C, and HCV-438D use Nitrile based
elastomers for the air filter regulator and actuator. Valves HCV-438A and HCV-
438C, located in containment, perform a function in the closed position to establish
containment isolation upon receipt of a Containment Isolation Actuation Signal
coincident with Component Cooling Water low pressure. These valves fail open.
Attachment 2
Figure 2
CCW Isolation Valve Design
9. Figure 6 shows the top event, Out-Iso-Holds. This fault tree was created by the
analyst and added to the event tree to account for the potential that Valve
Operators for HCV-438B and HCV-438D fail to remain closed against the
differential pressure created when Valves HCV-438A and HCV-438C fail open
following a break of one of four reactor coolant pump seal cooler helix coils. The
analyst noted that the valves would fail open under differential pressures near 180
psig, indicating that the valves would most likely always fail open. However,
Emergency Operating Procedure EOP-20, Functional Recovery Procedure, Step
14.c.2 directs operators to manually close these valves with a hand jack. The
analyst used a screening value of 0.1 as the human error probability for operators
failing to close the outboard valves. This action requires depressurization of the
reactor coolant system; an environment in Room 13 that would permit operator
access; and access to necessary equipment.
10. Top Event SDC, provided from the SPAR, models various failures of the
shutdown cooling system that would prevent placing the plant in cold shutdown.
11. Top Event HPR, provided from the SPAR, models various failures of the high
pressure injection system and other components that would prevent establishing
recirculation by successfully transferring the system suction source from the
refueling water storage tank to the containment sump.
Attachment 2
2. Top Event LSHR, provided from the SPAR, models the failure of operators to
refill the emergency feedwater storage tank so that long-term secondary heat
removal can continue if depressurization of the reactor is not successful.
The analyst quantified the event tree shown in Figure 3 using the SAPHIRE
software and quantification engine with a truncation value of 1 x 10-13. For the
readers benefit, the approximate split fractions for each top event are provided in
Table 2. The sequence results for the baseline and case evaluations are
documented in Table 3. The total CDF for the Group 9 valves was determined to
be 3.8 x 10-6.
Attachment 2
Figure 6
Failure of Inboard Group 6 Valves to Remain Closed
Event Tree
Attachment 2
Table 2
Split Fractions for Reactor Coolant Pump Seal Cooler Loss of Coolant Accident Event Tree
Top Event Definition Probability
Initiator Reactor Coolant Pump Seal Cooler Failure ( /year) 5.00E-04
RPS Failure of the Reactor Protection System 2.04E-06
Inboard-Isol Failure to Isolate Component Cooling Water to the Seal
Cooler 4.91E-04
FW Failure of the Main and Auxiliary Feedwater Systems 4.77E-04
HPI Failure of High Pressure Injection 6.11E-02
SSC Failure to Cool Down the Reactor using Secondary
Systems 1.05E-03
OTC Failure of Once Through Cooling 8.71E-02
CSR Failure of the Containment Cooling Systems 8.37E-05
Inboard-Iso- Valves 438A and C fail from Inappropriate Elastomers
Holds 7.58E-02
Out-Iso-Holds Valves 438B and D Reopen and Operators Fail to
Manually Close 1.00E-01
SDC Failure of Shutdown Cooling 7.42E-03
HPR Failure of High Pressure Recirculation 6.13E-02
LSHR Failure of Long-Term Secondary Heat Removal 1.00E-04
Table 3
Sequence Results for Seal Cooler Failure Event Tree
Sequence: Sequence Frequency Baseline Frequency
(per year) (per year)
3.22E-08 3.22E-08
2.20E-09 2.20E-09
3.79E-06
3.22E-12 3.22E-12
2.20E-13 2.20E-13
3.98E-09
4.39E-11 4.39E-11
3.06E-05 3.06E-05
1.46E-08 1.46E-08
9.97E-10 9.97E-10
1.81E-09
2.00E-11 2.00E-11
2.08E-08 2.08E-08
1.46E-08 1.46E-08
2.46E-07 2.46E-07
1.02E-09 1.02E-09
Total 3.47E-05 3.09E-05
Total CDF 3.80E-06
Attachment 2
Results for Section 1, Air-Operated Valve Elastomers
The analyst determined that the total best estimate CDF for all air-operated
valves with inappropriate elastomers was the sum of the independent CDF for
each valve. Therefore, the best estimate CDF for this portion of the risk related
to the performance deficiency was 4.1 x 10-6 as documented in Table 1.
Evaluation 2: Auxiliary Steam System Piping Breaks
The licensee identified 19 areas in the plant that contained auxiliary steam
system piping. The licensee had not evaluated these areas for breaks in the
auxiliary steam system piping, resulting in some components not being capable
of withstanding such an environment. The analyst identified similarities among
various valves and grouped them into four functional groups to simplify the
analysis. The functional groups identified, and the grouping of each of these
valves, are documented in Table 4.
TABLE 4
Auxiliary Steam System Area Groups
Room Description Location Group
Open Corridor: Contains several Motor- Auxiliary Building Not Harsh
Control Centers that support HCV-347 and
HCV-348, Shutdown Cooling Suction
Valves, and HCV-383-3 and HCV-383-4,
Sump Suction Valves
Spent Fuel Pool Heat Exchanger Room Auxiliary Building No PRA
Changing Pumps Room Auxiliary Building Not Harsh
Compressor Room: Includes Steam-Driven Auxiliary Building Not Harsh
and Motor-Driven Auxiliary Feedwater
Pumps
Open Corridor: Boric Acid Pumps and Auxiliary Building Not Harsh
Tanks
Waste Evaporator Room Auxiliary Building No PRA
Storage Room Auxiliary Building No PRA
Switchgear Room (Vital and Nonvital) Auxiliary Building Not Harsh
Electrical Penetration Area Auxiliary Building Not Harsh
Diesel Generator Room 1 Auxiliary Building Harsh
Diesel Generator Room 2 Auxiliary Building Harsh
Diesel Ventilation Enclosure Auxiliary Building Not Harsh
Equipment Hatch Enclosure Auxiliary Building Not Harsh
Ventilation Equipment Area: Includes Auxiliary Building Not Harsh
component cooling water and spent fuel pool
Main Steam Vault: Supports Main Steam, Auxiliary Building Bounded
Main Feedwater, and Auxiliary Feedwater.
Mechanical Equipment Room Auxiliary Building No PRA
Lower Primarily Circulating Water Pumps Auxiliary Building Not Harsh
Level
Operating Fire Pumps (1 Diesel, 1 Electric) and Intake Structure Harsh
Deck Rotating Screens
Attachment 2
TABLE 4
Auxiliary Steam System Area Groups
Room Description Location Group
Raw Water Safety-Related Raw Water Pumps and Intake Structure Not Harsh
Vault Associated Equipment
Group Definitions:
Not Harsh: Calculations indicate that breaks of the auxiliary steam system in these areas would
not result in a harsh environment as defined by the licensees design basis.
Bounded: Calculations indicate that breaks of the auxiliary steam system in these areas are
bounded by more energetic failures. Therefore, all equipment in the area was
previously qualified.
No PRA: No risk-significant equipment, as defined in the probabilistic risk assessment, is
contained in these rooms. Therefore, regardless of qualification status, change in
risk would be negligible.
Harsh: Calculations indicated that breaks of the auxiliary steam system in these areas
would cause a harsh environment. Evaluation of the change in risk was quantified.
Auxiliary steam piping and components were installed in each of the 19 plant
areas listed in Table 4. The licensee had failed to analyze these areas, and
other equipment in the vicinity, for the environmental conditions that would result
from a high-energy break of the auxiliary steam system. The analyst evaluated
each of the four area groups from Table 4 as follows:
Not Harsh: The eleven areas listed in this group were evaluated by the
licensee to assess the impact of a break of the auxiliary steam system.
None of the areas in this group were determined to result in a harsh
environment as described by the licensees equipment qualification
program. By definition, equipment design criteria at Fort Calhoun Station
should result in plant components being able to continue to function
normally provided the environment is not harsh. Therefore, the CDF,
given the performance deficiency, was negligible for components in areas
in the Not Harsh group.
Bounded: Room 81 was the only area listed in this group. The licensee
evaluated the impact of a break of the auxiliary steam system in this
room. The harsh environment quantified in this analysis was determined
to be bounded for temperature and humidity by the main steam and main
feedwater line breaks previously analyzed. All equipment in Room 81
was properly qualified for harsh environments except for flooding, as
discussed later and documented in Table 5. The analyst determined
qualitatively that a break of the auxiliary steam system piping in Room 81
would not provide sufficient flooding to affect components not previously
analyzed for submersion. Therefore, the CDF, given the performance
deficiency, related to auxiliary steam piping, was negligible for
components in Room 81, the Bounded group.
No PRA: The four areas listed in this group were evaluated by the
licensee to assess the impact of a break of the auxiliary steam system.
Attachment 2
These areas were determined to result in a harsh environment following
an auxiliary steam system piping break, as described by the licensees
equipment qualification program. However, the analyst noted that there
was no equipment modeled in the licensees probabilistic risk assessment
in any of these areas. By definition, equipment that is not included in a
properly developed probabilistic risk assessment is of low risk
significance. As such, regardless of qualification status, the failure of
equipment in these areas following a postulated break of the auxiliary
steam system would not be risk-significant. Therefore, the CDF, given
the performance deficiency, was negligible for components in areas in the
No PRA group.
Harsh: The three areas listed in this group were evaluated by the
licensee to assess the impact of a break of the auxiliary steam system.
All of the areas in this group were determined to result in a harsh
environment, following a postulated break in the auxiliary steam system
piping, as described by the licensees equipment qualification program.
The analyst provided an upper bound risk assessment for each of these
areas as follows:
Room AB063: The analyst assessed the risk of an auxiliary steam line
break in Auxiliary Building Room AB063, Diesel Generator Room 1.
The analyst noted that a high-energy line break in this room would not
cause an initiator. According to Combustion Engineering Nuclear Power
LLC, ST-2000-0627, the plant-wide frequency of a break of the auxiliary
steam system would be approximately 6.44 x 10-4/year for various rooms
in the facility. As a bounding assumption, the analyst assumed that the
failure frequency of the auxiliary steam system in Room AB063 (63)
would be no higher than 1 x 10-3/year.
The analyst assumed that, given a postulated high-energy break of the
auxiliary steam system, Diesel Generator 1 would be inoperable and the
Technical Specification allowed outage time would be entered. Following
the Technical Specification requirements, plant operators would shut
down the reactor in 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> and cool down the reactor coolant system in
another 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. In order for the diesel generator to be demanded
during these 108 hours0.00125 days <br />0.03 hours <br />1.785714e-4 weeks <br />4.1094e-5 months <br />, a loss of power would need to occur on the
associated vital bus. The probability of a loss of offsite power occurring
during the period (PLOOP-108) was calculated to be 3.51 x 10-4.
In accordance with Assumption 2, the exposure period (EXP) was the
1-year assessment period. The analyst then calculated the bounding
CDF (CDFAB063), by assuming a conditional core damage probability
(CCDP) of 1.0 as follows:
CDFAB063 = 63 * PLOOP-108 * CCDP * EXP
= 1 x 10-3/year * 3.51 x 10-4 * 1.0 * 1.0 year
= 3.5 x 10-7
Attachment 2
Room AB064: The analyst assessed the risk of an auxiliary steam line
break in Auxiliary Building Room AB064, Diesel Generator Room 2.
The analyst noted that a high-energy line break in this room would not
cause an initiator. According to Combustion Engineering Nuclear Power
LLC, ST-2000-0627, the plant-wide frequency of a break of the auxiliary
steam system would be approximately 6.44 x 10-4/year for various rooms
in the facility. As a bounding assumption, the analyst assumed that the
failure frequency of the auxiliary steam system in Room AB064 (64)
would be no higher than 1 x 10-3/year.
The analyst assumed that, given a postulated high-energy break of the
auxiliary steam system, Diesel Generator 2 would be inoperable and the
Technical Specification allowed outage time would be entered. Following
the Technical Specification requirements, plant operators would shut
down the reactor in 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> and cool down the reactor coolant system in
another 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. In order for the diesel generator to be demanded
during these 108 hours0.00125 days <br />0.03 hours <br />1.785714e-4 weeks <br />4.1094e-5 months <br />, a loss of power would need to occur on the
associated vital bus. The probability of a loss of offsite power occurring
during the period (PLOOP-108) was calculated to be 3.51 x 10-4.
In accordance with Assumption 2, the exposure period (EXP) was the 1
year assessment period. The analyst then calculated the bounding CDF
(CDFAB064), by assuming a conditional core damage probability (CCDP)
of 1.0 as follows:
CDFAB064 = 64 * PLOOP-108 * CCDP * EXP
= 1 x 10-3/year * 3.51 x 10-4 * 1.0 * 1.0 year
= 3.5 x 10-7
Intake Operating Floor: The analyst assessed the risk of an auxiliary
steam line break in the Intake Structure operating floor. The analyst
noted that a high-energy line break in this room would potentially cause a
reactor trip, loss of functional screens, and loss of the fire pumps.
According to Combustion Engineering Nuclear Power
LLC, ST-2000-0627, the plant-wide frequency of a break of the auxiliary
steam system would be approximately 44 x 10-4/year for various rooms in
the facility.
As a bounding assumption, the analyst assumed that the failure
frequency of the auxiliary steam system on the Intake Structure Operating
Deck (Intake) would be no higher than 1 x 10-3/year. The analyst assumed
that, given a postulated high-energy break of the auxiliary steam system,
the rotating screens would fail causing a loss of raw water. The analyst
quantified the conditional core damage probability using the SPAR model,
Version 8.20.
In accordance with Assumption 2, the exposure period (EXP) was the
1-year assessment period. The analyst then calculated the bounding
CDF (CDFIntake) as follows:
Attachment 2
CDFIntake = Intake * CCDP * EXP
= 1 x 10-3/year * 7.09 x 10-4 * 1.0 year
= 7.1 x 10-7
Results for Section 2, Auxiliary Steam System Piping Breaks
The analyst determined that, because each of the area failure
probabilities were selected to be independent of each other, the total
bounding CDF from the postulated failure of auxiliary steam system
piping was the sum of the area frequencies. Therefore, the highest that
the CDF could be for this portion of the risk related to the performance
deficiency was 1.4 x 10-6.
Evaluation 3: High-Energy Line Break Area
The licensee identified five areas in the plant that contained high-energy
piping that had not been properly evaluated for breaks. As a result,
multiple risk-significant components were not properly protected or
designed for the resulting harsh environment. The analyst reviewed each
of the areas to identify equipment affected, initiating events of concern,
initiating event frequencies and the conditional core damage probabilities.
The evaluation of these areas and the risk characterization for each, are
documented in Table 5.
Table 5
Harsh Environment Rooms
Bounding Risk Assessment Results
Location Area Name Scenario Total CDF
(Affected Equipment) Risk
Auxiliary Building Letdown Heat Exchanger 5.36 x 10-7
Room 12 Room
Main Feedwater 1.43 x 10-9
Intersystem LOCA 5.35 x 10-7
Auxiliary Building Lower Mechanical 5.41 x 10-7
Room 13 Penetration Room
Valves 438B and 438D 1.35 x 10-10
Sump Recirculation 5.78 x 10-9
Intersystem LOCA 5.35 x 10-7
Auxiliary Building Compressor Room 5.39 x 10-7
Room 19
SPAR Run:
- Loss of all 3-side
Switchgear
- Failure of Pump FW-10
- Failure of Pump FW-6
Attachment 2
Auxiliary Building Ventilation Equipment Area 5.58 x 10-9
Room 69
SPAR Run:
- Loss of Component
Cooling Water
- Bounding Frequency
Auxiliary Building Main Steam Vault 1.82 x 10-6
Room 81
- Main Feedwater Break 1.26 x 10-6
Loss of all Auxiliary
- Main Steam Line Break 5.63 x 10-7
Loss of Pumps FW-10
and FW-6
Total Upper Bound CDF: 3.4 x 10-6
Initiating Event Frequency for High-Energy Line Break Areas
The licensee identified plant areas that had not been completely evaluated for
the impacts of postulated high-energy line breaks. The five areas documented in
Table 5 are those areas identified by the inspectors that had potentially
significant equipment that was not properly qualified for the harsh environment
that would occur following a postulated high-energy line break in the area.
The analyst determined the initiating event frequency for multiple scenarios
involving high-energy line breaks. For each plant area of interest, the analyst
used best available information to quantify the total frequency of a high-energy
line break and/or identify a clear upper bound frequency.
Conditional Core Damage Probability for High-Energy Line Break Areas
For each scenario, the analyst quantified a bounding baseline and case
conditional core damage probability using the site-specific SPAR model,
Version 8.21. Each scenario documented in Table 5 is designated by the initiator
used in the model, the component failures of interest, or the entire sequence
used to quantify the scenario.
Upper Bound Results for High-Energy Line Break Areas
The analyst used a spreadsheet to maintain the detailed scenario specific inputs
and results. The final, bounding results for each scenario and the total upper
bound CDF for each room are documented in Table 5.
Room 13:
The high-energy lines of interest in the Lower Mechanical Penetration Room
were steam generator blowdown piping and the low-pressure portion of the
Attachment 2
letdown piping as shown in Figure 7. The analyst noted that the risk-significant
equipment in the room included:
- Component Cooling Water Valves HCV-438B and HCV-438D
- Letdown Stop Valve HCV-204
- Effects from Impact to Motor-Control Centers in Corridor 4
Shutdown Cooling Isolation Valves HCV-347 and HCV-348
Sump Recirculation Valves HCV-383-3 and HCV-383-4
Figure 7
One-Line Diagram of Letdown System
The analyst evaluated three scenarios encompassing the change in risk from the
performance deficiency in Room 13:
(1) Failure of Containment Sump Recirculation:
The analyst estimated the baseline high-energy line break frequency in
Room 13 to be 2.77 x 10-6/year from a breach of the blowdown system.
However, the analyst noted that the licensee had determined they had been
unable to inspect the socket welds in this area of the plant. As corrective
action, the licensee replaced all applicable socket welds with butt welds. In
order to account for the lack of ability to inspect the previous welds, the
analyst increased the failure probability of the lines and used an initiating
event frequency (13) of 3.0 x 10-4/year as a bounding assumption
(Assumption 19).
Using this initiating event frequency, the analyst performed an assessment of
the failure of the blowdown system piping in the room, assuming that the
conditional core damage probability was bounded by a loss of main
feedwater initiator. The resulting baseline (CCDPBase4) was 4.75 x 10-6.
Attachment 2
Given the performance deficiency, a harsh environment would be created in
Corridor 4 resulting in the loss of sump recirculation. The analyst quantified
the case by analyzing a loss of main feedwater with the failure of
Valves HCV-347, HCV 348, HCV-383-3, and HCV-383-4. The conditional
core damage probability (CCDPCorridor4) was 2.40 x 10-5. The CDF
(CDFCorridor4) was calculated as follows:
CDFCorridor4 = 13 * (CCDPCorridor4 - CCDPBase4) * EXP
= 3 x 10-4/year * (2.4 x 10-5 - 4.75 x 10-6) * 1.0 year
= 5.8 x 10-9
(2) Failure of Valves 438B and 438D
Using the model developed to analyze the loss of reactor coolant pump seal
heat exchanger pipe, the analyst calculated the potential effect of a blowdown
system pipe break in Room 13 on Valves HCV-438B and HCV-438D. The
change in conditional core damage probability, assuming random initiators,
was 4.5 x 10-7. The analyst then multiplied this times the bounding frequency
for a blowdown system piping break to obtain a CDF of 1.4 x 10-10.
(3) Letdown System Intersystem Loss of Coolant Accident
In addition to a random pipe failure, the analyst noted that a random failure of
the operating letdown system control valve could result in overpressurization
of the low pressure system piping and cause an intersystem loss of coolant
accident. Such a sequence would occur as follows:
a) The operating letdown control valve (either Valve HCV-101-1 or
HCV-101-2) randomly transfers open. The annual frequency of this
event was about 2.1 x 10-2/year from the licensees probabilistic risk
assessment;
b) Valve HCV-204, the letdown stop valve, fails to close on high flow
(Probability about 9.5 x 10-4 per demand);
c) Temperature Control Valve TCV-202, a letdown stop valve, fails to
close on high system temperature (Probability about 9.5 x 10-4 per
demand plus common cause failure of TCV-202 and HCV-204
estimated at 2.5 x 10-5 per demand); and
d) Low pressure system piping, designed for 600 psig, fails when
pressurized to near 2000 psig.
Upon failure of the system piping in Room 13, the analyst assumed that,
given the performance deficiency, the harsh environment would fail Valve
HCV-204, preventing operator intervention. The bounding CDF for this
postulated intersystem loss of coolant accident was 5.4 x 10-7.
Attachment 2
The total CDF for Room 13 was the sum of the independent analyses
above (5.4 x 10 7).
Room 12:
The Letdown Heat Exchanger Room contains letdown piping downstream of
HCV-204 in Room 13, plus additional high-energy piping. The analyst noted
that the affect that the performance deficiency would have on equipment in
Room 12 could be bounded by the evaluation of the blowdown and letdown
systems piping in Room 13. Therefore the total CDF for Room 12 was
5.4 x 10-7.
Room 19:
The primary high-energy line of concern in the Compressor Room is
approximately 150 feet of steam supply piping to the Pump FW-10 turbine.
The analyst noted that the risk-significant equipment in the room included:
- Auxiliary Feedwater Pump FW-10
- Auxiliary Feedwater Pump FW-6
- Instrument Air System Compressors
- Guard Pipe protecting Room 56 (See Figure 8)
The analyst noted that the primary effect of the performance deficiency was
that the guard pipe, designed to protect Room 56E, East Switchgear Room,
from a line break in Room 19 was degraded. The analyst assumed that
steam in the guard pipe would inundate Room 56E in sufficient quantities to
fail the 1A3 side electrical buses in the room.
The analyst reviewed simple calculations that indicated the air conditioning
unit in Room 19 was large enough to remove the moisture from a steam line
break in the room. Room 19 is a very large room and the air handling unit is
positioned between the steam line and the instrument air compressors. As a
result, the analyst assumed that the steam line break would not result in a
loss of all instrument air to the plant.
Attachment 2
Figure 8
One-Line Diagram of Steam Supply to Pump FW-10
Guard Pipes Indicated
The analyst reviewed a spreadsheet developed by the licensee, in
accordance with the EPRI Technical Report 3002000079 method, for the 150
feet of steam piping. The calculated initiating event frequency (19) was 8.43
x 10-5/year.
Attachment 2
Using the plant-specific SPAR model, the analyst quantified the conditional
core damage probability for a failure of the Pump FW-10 steam supply line.
The analyst assumed that a failure of the subject line would result in a
transient and a failure of Auxiliary Feedwater Pump FW-10 from loss of its
steam supply. The resulting baseline (CCDPBase19) was 7.74 x 10-6. The
analyst then quantified the case, assuming that steam in Room 19
caused the failure of Auxiliary Feedwater Pump FW-6 and steam in the guard
pipe inundated Room 56E in sufficient quantities to fail the 1A3 side electrical
buses in the room. The resulting case value (CCDPRoom19) was 6.39 x 10-2.
As a mitigating factor, the analyst noted that the pipe had an installed
pressure transmitter that would alarm in the main control room following the
low pressure from a line break. Abnormal Operating Procedure AOP-28
directed operators to isolate the line. As a bounding assumption, the analyst
assumed that the operators would fail to isolate the line in accordance with
plant procedures (PISO) with a probability of 1 x 10-1.
The analyst calculated the CDF (CDFRoom19) as follows:
CDFRoom19 = 19 * (CCDPRoom19 - CCDPBase19) * EXP * PISO
= 8.43 x 10-5/year * (6.39 x 10-2 - 7.74 x 10-6) * 1.0 year * 0.1
= 5.4 x 10-7
Room 69:
The Ventilation Equipment Area contains the component cooling water
pumps, the system surge tank, and the spent fuel pool. The analyst
determined that the worst case response to a high-energy line break in the
area would be a loss of component cooling water. Using a bounding initiating
event frequency of 3 x 10-4/year (equivalent to a main steam line break
outside containment), the analyst assumed that such a break would cause
one additional loss of component cooling water initiator that would not have
occurred without the performance deficiency. The analyst quantified the
conditional core damage probability for a loss of component cooling water
using the site-specific SPAR model. The result was 1.86 x 10-5. This result
was dominated by failure of the operators to provide backup component
cooling water via the raw water system. The analyst then calculated the
upper bound CDF (5.58 x 10-9) using a 1-year exposure period.
Room 81:
The major high-energy lines in the Main Steam Vault are system piping from
main feedwater, main steam, auxiliary steam, and the steam supply to
Auxiliary Feedwater Pump FW-10. The licensee had previously evaluated
Room 81 for the effects of temperature, pressure, humidity, and radiation. All
equipment in the room was qualified for these parameters. The licensee
determined that large line breaks in the room could result in excessive
flooding of the room beyond the design/qualified levels. The analyst
determined that flooding could impact the function of the auxiliary feedwater
Attachment 2
supply Valves HCV-1107B and HCV-1108B, as well as the auxiliary
feedwater crossover line isolation Valve HCV-1384 shown in Figure 9.
The analyst estimated the initiating event frequency for a large flood in Room
by assuming that any main steam line break or main feedwater line break
could result in major flooding in the room. Using the frequencies of line
breaks from the licensees probabilistic risk assessment, the analyst
calculated a total frequency (Break) of 4.8 x 10-4/year. The analyst noted that
this was a bounding frequency, considering that these break frequencies
included a wide range of break sizes, the smaller (and more frequent of
which) would not cause a significant flood. This frequency was the sum of
the frequency of a main steam line break (BreakMS = 3.0 x 10-4/year)
and (BreakMF = 1.8 x 10-4/year).
Attachment 2
The analyst used the plant-specific SPAR model to quantify conditional core
damage probabilities for use in the evaluation. The following values were
quantified:
- Loss of Main Feedwater (CCDPBase) 4.75 x 10-6
- Loss of Main and Auxiliary Feedwater (CCDPAFW) 2.79 x 10-2
- Loss of Main Feedwater and Pumps (CCDP6&10)1.88 x 10-3
FW-10, Turbine Driven
FW-6, Motor Driven
The analyst noted that, given the performance deficiency, a main steam line
break with the failure of Valves HCV-1107B, HCV-1108B, and HCV-1384 in
the closed direction would result in a loss of Pumps FW-10, Turbine-Driven
Auxiliary Feedwater Pump and FW-6, Motor-Driven Auxiliary Feedwater
Pump. The CDF for a main steam line break induced flood in Room 81
(CDFMainSteam) over the 1-year exposure period (EXP) was bounded by the
following:
CDFMainSteam = BreakMS * (CCDP6&10 - CCDPBase) * EXP
= 3.0 x 10-4/year * (1.88 x 10-3 - 4.75 x 10-6) * 1 year
= 5.63 x 10-7
The analyst noted that, given the performance deficiency, a main feedwater
line break with the failure of Valves HCV-1107B, HCV-1108B, and HCV-1384
in the closed direction would result in a loss of Pumps FW-10, Turbine-Driven
Auxiliary Feedwater Pump and FW-6, Motor-Driven Auxiliary Feedwater
Pump. Additionally, the failure of the main feedwater line piping would fail
Pump FW-54, Diesel-Driven Auxiliary Feedwater Pump for many scenarios.
Given that Valves HCV-1107B and HCV-1108B fail open upon loss of air, to
fail the valve closed would require a smart short of the valve terminal blocks.
To fail the auxiliary feedwater system, both valves would have to fail closed.
As a bounding assumption, the analyst assumed that the highest likelihood of
a valve failing closed would be 50 percent of the flooding scenarios.
Therefore, the probability of both Valves HCV-1107B and HCV-1108B failing
closed following a flood of Room 81 (PClosed) was calculated to be no higher
than 2.5 x 10-1.
The CDF for a main feedwater line break induced flood in Room 81
(CDFMainFeed) over the 1-year exposure period (EXP) was bounded by the
following:
CDFMainFeed = BreakMF * (CCDPAFW - CCDPBase) * PClosed * EXP
= 1.8 x 10-4/year * (2.79 x 10-2 - 4.75 x 10-6) * 0.25 * 1 year
= 1.26 x 10-6
The total CDF for Room 81 was the sum of the independent analyses above
(1.82 x 10-6).
Attachment 2
Results for Section 3, High-Energy Line Break Area Evaluation
The analyst determined that, because each of the five area failure
probabilities were selected to be independent of one another, the total
bounding CDF from postulated pipe breaks in the subject areas was the
sum of the area frequencies. Therefore, the highest that the CDF could be
for this portion of the risk related to the performance deficiency (as
documented in Table 5) was 3.4 x 10-6.
Conclusions
As discussed in Section 1, the best-estimate evaluation indicates that the
CDF from the air-operated valves with inappropriate elastomers was
4.1 x 10-6. As discussed in Section 2, the upper bound risk resulting from
auxiliary steam system piping failures was 1.4 x 10-6. Finally, in Section 3,
the analyst documented the upper bound risk from five previously unanalyzed
areas in the plant as 3.4 x 10-6. This results in a best-estimate CDF of 4.1 x
10-6 and an upper bound of no higher than 8.9 x 10-6. Therefore, the subject
finding is of low to moderate safety significance (White).
(4) Sensitivity Analysis
The SRA performed a variety of uncertainty and sensitivity analyses on the
results and modeling as shown below. The results confirm the recommended
White finding.
Sensitivity Analysis 1 - Isolation of Intersystem Loss of Coolant Accident.
The analyst determined the sensitivity of the results to a range of operator
failure probabilities. The analyst used the range of 5 x 10-2 to 2 x 10-1 for the
basic event Out-Iso-Holds111. This provided a factor of 2 above and below
the assumed value. Using this range, the analyst calculated the sensitivity of
the evaluation to the selection of this human error probability. The CDF
range was 1.9 x 10-6 - 7.6 x 10-6 (White).
Sensitivity Analysis 2 - Initiation of Auxiliary Steam Line Break.
The analyst evaluated the effects of varying auxiliary steam line break
frequencies to determine the sensitivity of the analysis to this assumption.
The analyst reviewed the bounding assumptions applied and determined that
the frequency of a steam line break could not be substantially higher than the
x 10-3/year estimated. Auxiliary steam system operates at a pressure of
150 psig or less. Therefore, the likelihood of a steam line break causing a
harsh environment is conditional. For the lower end of the range, the analyst
used the Combustion Engineering Nuclear Power LLC, ST-2000-0627 plant-
wide frequency of 6.44 x 10-4/year for various areas throughout the plant.
The range of CDF was 4.6 x 10-7 - 1.4 x 10-6 (As an upper bound result,
and combined with the best estimate risk, this supports the White finding).
Attachment 2
Sensitivity Analysis 3 - Failure of Auxiliary Feedwater Injection Valves.
The analyst determined the sensitivity of the results to the selection of the
failure probability for Valves HCV-1107B and HCV-1108B. To establish a
range, the analyst first noted that the upper bound of the range was that the
valves fail closed under all conditions. This is severely limiting, given the
valves fail open on loss of air requiring a smart short to fail the valves closed.
As a lower bound of the sensitivity, the analyst assumed the valves would fail
open 1 time in 10 and that this conditional probability is independent for each
valve. The range of CDF was 6.1 x 10-7 - 5.6 x 10-6 (As an upper bound
result, this supports the White finding).
(5) Contributions from External Events (Fire, Flooding, and Seismic)
This performance deficiency only impacts the risk of the plant to high-energy
line breaks. No external event is postulated to cause a high-energy line
break.
(6) Potential Risk Contribution from Large, Early Release Frequency
In accordance with the guidance in NRC Inspection Manual Chapter 0609,
Appendix H, Containment Integrity Significance Determination Process,
most of the scenarios evaluated related to this finding would not involve a
significant increase in risk of a large, early release of radiation because Fort
Calhoun Station has a large, dry containment and the dominant sequences
contributing to the CDF did not involve either a steam generator tube
rupture or an intersystem loss of coolant accident. However, two scenarios
involved the effects of the performance deficiency on the risk of an
intersystem loss of coolant accident.
The analyst noted that the scenarios reviewed that related to intersystem loss
of coolant accidents took a long time to develop. For the dominant core
damage sequences, core uncovery was predicted between 12 and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />
after transient initiation. This would have provided for effective evacuation of
the close-in population prior to release. Therefore, while these ruptures
would result in potentially large releases, the releases would not be early.
The analyst determined that the significance of this finding was considered to
be core damage frequency-dominant, and the impact to large, early release
frequency was negligible.
(7) Total Estimated CDF
The total best estimate CDF caused by this performance deficiency is the
sum of the internal and external events CDFs. This value was 4.1 x 10-6.
Additional scenarios impacting risk were evaluated using bounding analyses.
The analyst determined that the total CDF could be no higher than
8.9 x 10-6. Therefore, this finding is of low to moderate safety significance
(WHITE).
Attachment 2
(8) Licensees Risk Evaluation
The licensee did not have an independent evaluation of the overall risk
associated with this performance deficiency. However, the licensee provided
significant input to assist with determination of the high-energy line break
(including environmental qualifications of air-operated valve elastomers) risk
significance. Input included descriptions of high-energy line break scenarios
and associated operator actions, detailed lists of components potentially
subject to a harsh environment, and the baseline probabilistic risk
assessment model results for auxiliary steam ruptures. Lengths of piping for
high-energy systems were provided to assist with calculating initiating event
frequencies.
The licensee provided a position paper on the performance of nitrile
elastomers at high temperature, because some nitrile elastomers could be
exposed to conditions beyond their design service conditions. The position
paper included postulated failure probabilities for harsh environments.
Input provided by the licensee was both quantitative and qualitative.
However, it was not integrated in such a way that it presented a conditional
core damage probability or a conditional large, early release frequency
representing the overall impact of high-energy line break issues.
The analysts took exception with some of the licensees conclusions
regarding nitrile elastomer performance under harsh conditions. The analyst
also assigned higher failure probabilities to selected operator actions
associated with high-energy line break accident scenarios. This was partially
based on the judgment of the uncertainties in material fragilities and event
durations.
(9) Summary of Results and Impact
The NRCs quantitative risk assessment was determined to represent a risk
estimate in the "White" region. The White Finding is based on internal event
initiated CDF.
(c) Peer Review:
The analyst requested a peer review of this analysis from the Office of Nuclear
Reactor Regulation, Division of Risk Assessment, PRA Operations and Human
Factors Branch. As a result of this review, all peer reviewer comments were
addressed and/or incorporated into the final detailed risk evaluation.
(d) References:
The analysts used the following generic references in preparing the risk
assessment:
- NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power
Plants in the United States
Attachment 2
- NUREG/CR-6883, The SPAR-H Human Analysis Method. August 2005
- NUREG-1842, Good Practices for Implementing Human Reliability
Analysis. April 2005
- NUREG/CR-6595 Revision 1, An Approach for Estimating the
Frequencies of Various Containment Failure Modes and Bypass Events.
October 2004
- INL/EXT-10-18533 Revision 2, SPAR-H Step-by-Step Guidance.
May 2011
- RASP Manual Volume 1 - Internal Events, Revision 2.0 dated
January 2013
- Risk Assessment of Operational Events, Volume 2 - External Events,
Revision 1.01, January 2008
- NUREG/CR-1278, Handbook of HRA with Emphasis on Nuclear Power
Plant Applications, August 1983
- NRC Inspection Manual Chapter 0609, Significance Determination
Process
The analysts used the following plant specific references:
- Standardized Plant Analysis Risk model for Fort Calhoun Station,
Versions 8.20 and 8.21
- EPRI Technical Report 3002000079, Pipe Rupture Frequencies for
Internal Flooding Probabilistic Risk Assessments, Revision 3
- Licensee White Paper, Performance of Nitrile Valve Elastomers at High
Temperatures
- Abnormal Operating Procedure AOP-28, Auxiliary Feedwater System
Malfunctions, Revisions 15 and 18
- Emergency Operating Procedure EOP-03, Loss of Coolant Accident
- Emergency Operating Procedure EOP-20, Functional Recovery
Procedure
- Figure 8.1-1, Simplified One Line Diagram, Plant Electrical System,
P & ID
- Fort Calhoun Station Unit No. 1, Updated Safety Analysis Report
- Licensee Design Evaluation Elastomers A-155, Temperature Ratings for
Elastomers in Air Operated Valves
- Licensees Event Tree, I3Q Elastomer Event Tree 10-01-2013
- Probabilistic Risk Assessment Fault Tree @ISLCVCS, CVCS Letdown
Line Outside Containment Overpressurizes, dated August 20, 2014
- Drawing 11405-M-252, Sheet 1, Flow Diagram Steam, P & ID,
Revision 113
- Drawing 11405-M-253, Sheet 1, Flow Diagram Steam Generator
Feedwater and Blowdown, P & ID, Revision 98
- Drawing 11405-M-253, Sheet Cov., Composite Flow Diagram Steam
Generator Feedwater and Blowdown, P & ID, Revision 52
- Drawing CHDR 11405-A-5, Primary Plant Ground Floor Plan, P & ID,
Revision 45
- Drawing 11405-A-7, Primary Plant Intermediate & Operating Floor Plans,
P & ID, Revision 31
Attachment 2
- Drawing 11405-A-8, Primary Plant Operating Floor Plan, P & ID,
Revision 51
- Combustion Engineering Nuclear Power LLC, ST-2000-0627, Fort
Calhoun Station Unit 1, Recommendation for Closure of PRA Concern
CCF 099-002, Revision 001
Attachment 2