ML051050562
| ML051050562 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 04/15/2005 |
| From: | Mallett B NRC Region 4 |
| To: | Ridenoure R Omaha Public Power District |
| References | |
| EA-05-038 IR-05-010 | |
| Download: ML051050562 (35) | |
See also: IR 05000285/2005010
Text
UNITED STATES
NUCLEAR REGULATORY C O M M I S S I O N
REGION I V
611 RYAN PLAZA DRIVE, SUITE 400
ARLINGTON. TEXAS 76011-4005
April 15, 2005
R. T. Ridenoure
Vice President
Omaha Public Power District
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 550
Fort Calhoun, NE 68023-0550
SUBJECT: FINAL SIGNIFICANCE DETERMINATION FOR A WHITE FINDING AND
NOTICE OF VIOLATION - FORT CALHOUN STATION - NRC INSPECTION
REPORT 05000285/2005010
Dear Mr. Ridenoure:
On February 24, 2005, the U.S. Nuclear Regulatory Commission (NRC) completed an
inspection at your Fort Calhoun Station. The purpose of the inspection was to follow up on the
failure of Emergency Diesel Generator 2 during surveillance testing. The enclosed inspection
report documents an inspection finding which was discussed on March 2, 2005, with
Mr. R. Phelps, Division Manager of Nuclear Engineering, and other members of your staff.
As described in Section 1R15 of this report, a finding was identified involving the failure to
promptly identify and correct a condition adverse to quality resulting in Emergency Diesel
Generator 2 being inoperable for a period of approximately 29 days, a violation of plant
Technical Specifications. The inspection finding was assessed using the Significance
Determination Process and was characterized as White, a finding with low to moderate
increased importance to safety, which may require additional NRC inspection.
This finding does not present a current safety concern because Emergency Diesel Generator 2
was returned to an operable condition following repairs involving replacement of a failed
component.
During the exit meeting conducted on March 2, 2005, your staff acknowledged the finding and
indicated that Omaha Public Power District agreed with the safety significance of the finding
being characterized as White. In addition, on March 23, 2005, in a telephone conversation with
Dr. Bruce Mallett, Region IV Regional Administrator, you stated Omaha Public Power District's
intention to decline an opportunity to discuss this issue in a Regulatory Conference or provide a
written response.
You have 30 calendar days from the date of this letter to appeal the staff's determination of
significance for the identified White finding. Such appeals will be considered to have merit only
if they meet the criteria given in NRC Inspection Manual Chapter 0609. Attachment 2.
Omaha Public Power District -2-
The NRC also has determined that the finding involves a violation of 10 CFR Part 50,
Appendix B, Criterion XVI, Corrective Actions, which resulted in a violation of plant Technical
Specifications. The violation is cited in the enclosed Notice of Violation, and the circumstances
surrounding the violation are described in the subject inspection report. In accordance with the
NRC Enforcement Policy, the Notice of Violation is considered escalated enforcement action
because it is associated with a White finding.
You are required to respond to the violation and should follow the instructions specified in the
enclosed Notice of Violation when preparing your response.
Because plant performance for this issue has been determined to be in the regulatory response
band, we will use the NRC Action Matrix to determine the most appropriate NRC response for
this condition. We will notify you, by separate correspondence, of that determination.
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its
enclosure, and your response will be made available electronically for public inspection in the
NRC Public Document Room or from the Publicly Available Records (PARS) component of
NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.qov/readina-rm/adams.html (the Public Electronic Reading Room).
Should you have any questions concerning this inspection, w e will be pleased to discuss them
with you.
Regional Administrator I
Docket: 50-285
License: DPR-40
Enclosures:
1. Notice of Violation
2. NRC Inspection Report 05000285/2005010
cc w/enclosures:
John B.Herman, Manager
Nuclear Licensing
Omaha Public Power District
Fort Calhoun Station
FC-2-4 Adm.
P.O. Box 550
Fort Calhoun, NE 68023-0550
Omaha Public Power District -3-
Richard P. Clemens, Division Manager
Nuclear Assessments
Fort Calhoun Station
P.O. Box 550
Fort Calhoun, NE 68023-0550
David J. Bannister
Manager - Fort Calhoun Station
Omaha Public Power District
Fort Calhoun Station FC-I -1 Plant
P.O. Box 550
Fort Calhoun, NE 68023-0550
James R. Curtiss
Winston & Strawn
1400 L. Street, N.W.
Washington, DC 20005-3502
Chairman
Washington County Board of Supervisors
P.O. Box 466
Blair, NE 68008
Sue Semerena, Section Administrator
Nebraska Health and Human Services System
Division of Public Health Assurance
Consumer Services Section
301 Centennial Mall, South
P.O. Box 95007
Lincoln, NE 68509-5007
Daniel K. McGhee
Bureau of Radiological Health
Iowa Department of Public Health
401 SW 7th Street, Suite D
Des Moines, IA 50309
Chief Technological Services Branch
National Preparedness Division
Department of Homeland Security
Emergency Preparedness and Response Directorate
FEMA Region VI1
2323 Grand Boulevard, Suite 900
Kansas City, MO 64108-2670
Omaha Public Power District -4-
Electronic distribution by RIV:
Regional Administrator (BSMI)
DRP Director (ATH)
DRS Director (DDC)
DRS Deputy Director (SKW)
Senior Resident Inspector (JDHI)
Branch Chief, DRP/C (MCHZ)
Senior Project Engineer, DRP/C (WCW)
Team Leader, DRP/TSS (RLNI)
RlTS Coordinator (KEG)
RidsNrrDiprnLipb
J. Dixon-Herrity, OED0 RIV Coordinator (JDH)
FCS Site Secretary (BMM)
Dale Thatcher (DFT)
W. A. Maier, RSLO (WAM)
G. F. Sanborn, D:ACES (GFS)
K. S. Fuller, RC (KSF)
F. J. Congel, OE (FJC)
T. Gwynn (TPG) M. Vasquez (GMV)
D. Powers (DAP) A. Vegel (AXV)
D. Starkey (DRS) M. Tschiltz (MDT)
R. Franovich (RLFZ) S. Richards (SAR)
0E:EA File (RidsOeMailCenter) R4ALLEGE
RIDSSECYMAILCENTER RIDSOCAMAILCENTER
RIDSEDOMAILCENTER RIDSOGCMAILCENTER
RIDSNRROD RIDSNRRADIP
RIDSOPAMAIL RIDSOIMAILCENTER
RIDSOIGMAILCENTER RIDSOCFOMAILCENTER
RlDSRGNlMAILCENTER RIDSRGN2MAILCENTER
RIDSRGN3MAILCENTER RlDSNRRDlPMllPB
OEWEB OEMAIL
SlSP Review Completed: -yes- ADAMS: % Yes 0 No Initials: -mch
% Publicly Available 0 Non-Publicly Available 0 Sensitive X Non-Sensitive
S:\RAS\ACES\ENFORCEMENnEA CASES - OPEN\Fort Calhoun EDG\Final Action\EA-05-038
NOTICE OF VIOLATION
Omaha Public Power District Docket 50-285
Fort Calhoun Station License DPR-40
EA -05-038
During an NRC inspection conducted from August 20, 2004, through February 24, 2005, a
violation of NAC requirements was identified. In accordance with the General Statement of
Policy and Procedure for NRC Enforcement Actions, NUREG-I600, the violation is listed
below:
10 CFR Part 50, Appendix B, Criterion XVI, requires, in part, that measures shall be
established to ensure that conditions adverse to quality, such as failures, malfunctions,
etc., are promptly identified and corrected.
Fort Calhoun Technical Specification 2.7(1), Minimum Requirements, states, in part, that
the reactor shall not be heated up or maintained at temperatures above 300°F unless
the following electrical systems are operable: two emergency diesel generators (DG-I
and DG-2). Technical Specification 2.7(2), Modification of Minimum Requirements,
states, in part, that the minimum requirements may be modified under certain
conditions. Item 2.7(2)(i) states that either one of the emergency diesel generators may
be inoperable for up to 7 days (total for both) during any month, provided certain
conditions are met.
Contrary to the above, on July 21, 2004, during surveillance testing of an emergency
diesel generator, DG-2, the licensee failed to promptly identify and correct a condition
adverse to quality. Specifically, the licensee failed to identify the failure of Fuse 2FU in
the emergency diesel generator excitation circuit. The failure to promptly identify this
failure and correct it resulted in DG-2 being inoperable from July 21 to August 19, 2004,
a period of 10 days in July and 19 days in August. This exceeded the total allowed time
in Technical Specification 2.7 for either emergency diesel generator to be inoperable
during any month.
This violation is associated with a White significance determination process finding.
Pursuant to the provisions of 10 CFR 2.201, Omaha Public Power District is hereby reauired to
submit a written statement or explanation to the U.S. Nuclear Regulatory Commission,
ATTN: Document Control Desk, Washington, DC 20555, with a copy to the Regional
Administrator, U.S. Nuclear Regulatory Commission, Region IV, 61 1 Ryan Plaza Drive,
Suite 400, Arlington, Texas 76011, and a copy to the NRC Resident Inspector at the facility that
is the subject of this Notice, within 30 days of the date of the letter transmitting this Notice of
Violation (Notice). This reply should be clearly marked as a Reply to a Notice of Violation;
EA-05-038 and should include: (1) the reason for the violation or, if contested, the basis for
disputing the violation or severity level, (2) the corrective steps that have been taken and the
results achieved, (3) the corrective steps that will be taken to avoid further violations, and
(4) the date when full compliance will be achieved. Your response may reference or include
previous docketed correspondence, if the correspondence adequately addresses the required
Enclosure 1
-2-
response. If an adequate reply is not received within the time specified in this Notice, an Order
or a Demand for Information may be issued as to why the license should not be modified,
suspended, or revoked, or why such other action as may be proper should not be taken.
Where good cause is shown, consideration will be given to extending the response time.
If you contest this enforcement action, you should also provide a copy of your response, with
the basis for your denial, to the Director, Office of Enforcement, U.S. Nuclear Regulatory
Commission, Washington, DC 20555-0001.
Because your response will be made available electronically for public inspection in the NRC
Public Document Room or from the NRCs document system (ADAMS), accessible from the
NRC Web site at http://w.nrc.aov/readina-rm/adams.html, to the extent possible, it should
not include any personal privacy, proprietary, or safeguards information so that it can be made
available to the public without redaction. If personal privacy or proprietary information is
necessary to provide an acceptable response, then please provide a bracketed copy of your
response that identifies the information that should be protected and a redacted copy of your
response that deletes such information. If you request withholding of such material, you must
specifically identify the portions of your response that you seek to have withheld and provide in
detail the bases for your claim of withholding (e.g., explain why the disclosure of information will
create an unwarranted invasion of personal privacy or provide the information required by
10 CFR 2.390(b) to support a request for withholding confidential commercial or financial
information). If safeguards information is necessary to provide an acceptable response, please
provide the level of protection described in 10 CFR 73.21.
Dated this 15Ihday of April 2005
Enclosure 1
US. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket.: 50-285
License: DPR-40
Report: 05000285/2005010
Licensee: Omaha Public Power District
Facility: Fort Calhoun Station
Location: Fort Calhoun Station FC-2-4 Adm.
P.O. Box 399, Highway 75 - North of Fort Calhoun
Fort Calhoun, Nebraska
Dates: August 20, 2004, through February 24, 2005
Inspectors: J. Hanna, Senior Resident Inspector
L. Willoughby, Resident Inspector
D. Loveless, Senior Reactor Analyst
Approved By: A. Howell 111, Director, Division of Reactor Projects
Enclosure 2
SUMMARY OF FINDINGS
lR05000285/2005010; 08/20/04 - 02/24/05; Fort Calhoun Station; Operability Evaluation.
The report documents the NRCs inspection for Emergency Diesel Generator 2 being
inoperable for 29 days. The inspection identified one finding whose safety significance has
been determined to be White. The significance of most findings is indicated by their color
(Green, White, Yellow, Red) using Inspection Manual Chapter 0609, Significance
Determination Process. The NRCs program for overseeing the safe operation of commercial
nuclear power reactors is described in NUREG-I649, Reactor Oversight Process, Revision 3,
dated July 2000.
A. NRC-identified and Self-Revealincj Findinas
Cornerstone: Mitigating Systems
. White. A violation of 10 CFR Part 50, Appendix 6,Criterion XVI, was identified
for the failure to ensure that conditions adverse to quality, such as failures,
malfunctions, etc., are promptly identified and corrected. Specifically, on July 21,
2004, during surveillance testing of Emergency Diesel Generator 2, the licensee
failed to promptly identify and correct a failure of Fuse 2FU in the emergency
diesel generator excitation circuit. The failure to identify and correct this
condition resulted in Emergency Diesel Generator 2 being inoperable from
July 21 to August 19, 2004, a period of 29 days, exceeding Technical
Specification 2.7 allowed outage time of 7 days during any month when the
reactor coolant system temperature was greater than 300°F.
This finding was considered more than minor because it was associated with the
equipment performance attribute of the mitigating systems cornerstone in that
the licensee failed to promptly identify and correct a failed fuse in the Emergency
Diesel Generator 2 excitation circuit that left the emergency diesel generator
inoperable for a period of 29 days. The finding was characterized under the
significance determination process as having low to moderate safety significance
because Emergency Diesel Generator 2 was unavailable to respond upon
demand for a loss of off-site power and would have been unable to perform its
mitigating system function (Section 1R15).
Enclosure 2
REPORT DETAILS
1. REACTOR SAFETY
Cornerstones: Mitigating Systems
1R15 Operabilitv Evaluations
a. Inspection Scope
The inspectors reviewed the events and the root cause analysis regarding Emergency
Diesel Generator 2 being inoperable for 29 days.
b. Findinas
Introduction. A violation of 10 CFR Part 50, Appendix B, Criterion XVI, was identified for
the failure to ensure that conditions adverse to quality, such as failures, malfunctions,
etc., are promptly identified and corrected. On July 21, 2004, during surveillance testing
of Emergency Diesel Generator 2, the licensee failed to promptly identify and correct a
failure of Fuse 2FU in the emergency diesel generator excitation circuit. The failure to
identify and correct this condition resulted in Emergency Diesel Generator 2 being
inoperable from July 21 to August 19, 2004, a period of 29 days, exceeding Technical
Specification 2.7 allowed outage time of 7 days when the reactor coolant system
temperature was greater than 300°F.
Description. On July 21, 2004, at 8:30 a.m., Emergency Diesel Generator 2 was
declared inoperable and Technical Specification 2.7(2)j was entered to support
conducting the monthly diesel generator surveillance in accordance with Operating
Procedure OP-ST-DG-0002. Emergency Diesel Generator 2 was started to idle speed
and allowed to warm up. Following warmup, the Emergency Diesel Generator 2 speed
was increased to normal operating speed.
Emergency Diesel Generator 2 ran fully loaded for over an hour as required by the
surveillance test. Following the loaded run, Emergency Diesel Generator 2 was
unloaded and the output breaker opened. Within a minute of opening the diesel
generator output breaker, the diesel generator output voltage decreased to
approximately 2200 volts and the Emergency Response Facility Computer (Plant
Computer) annunciated an urgent low alarm for low voltage on Emergency Diesel
Generator 2. The inspectors noted this alarm was acknowledged by a licensed operator
who failed to recognize that this was an indication for an abnormal low voltage condition.
Additionally, at this time, WH/D2 Power Distribution Indicator D-2, a watt-hour meter,
stopped indicating.
Emergency Diesel Generator 2 was operated at normal speed, unloaded, for
approximately 12 minutes to cool down the turbo charger. During this time operators
discussed the loss of indication on the watt-hour meter and decided to write a condition
report on the discrepancy. The inspectors noted that the unexpected low voltage
Enclosure 2
-2-
condition was not identified and entered into the corrective action process. Following
cooldown, Emergency Diesel Generator 2 was then shut down. Operators determined
the surveillance test was successfully completed and declared Emergency Diesel
Generator 2 operable at 11:l8 a.m., exiting Technical Specification 2.7(2)].
No other Emergency Diesel Generator 2 operations occurred until August 18, 2004. On
August 18, 2004, at 10:30 a.m., Emergency Diesel Generator 2 was declared inoperable
and Technical Specification 2.7(2)j was entered to support conducting the monthly
diesel generator surveillance test per Procedure OP-ST-DG-0002. Emergency Diesel
Generator 2 was started to idle speed at 10:51 a.m. and allowed to warm up. Following
warmup, the Emergency Diesel Generator 2 speed was increased to normal operating
speed.
At 11:06 a.m. Emergency Diesel Generator 2 was secured because Emergency Diesel
Generator 2 output voltage had only increased to approximately 2200 volts following
field flash vice its normal value of approximately 4200 volts. Trouble shooting of the
problem commenced at 12:35 p.m. and was completed at 4:55 p.m. A failed fuse, 2FU,
was found in the generator excitation circuit and was replaced. Following successful
testing, Emergency Diesel Generator 2 was declared operable at 5:25 p.m. and
Technical Specification 2.7(2)j was exited. Diesel Generator 1 was also tested to
ensure no common cause failure existed.
On August 19, 2004, Emergency Diesel Generator 2 successfully passed its monthly
surveillance test. The licensee believed Fuse 2FU failed when Emergency Diesel
Generator 2 was started on August 18 when the generator field was flashed.
On October 19, 2004, the licensee notified the NRC that Fuse 2FU failed on
July 21,2004, when the Emergency Diesel Generator 2 output breaker was opened.
This signified that Emergency Diesel Generator 2 was inoperable from July 21 to
August 19,2004.
After a review of this event, the inspectors noted that the licensee had several
opportunities to promptly identify the degraded voltage condition that affected the safety
function of Emergency Diesel Generator 2. These opportunities included:
. The failure to recognize the alarm for low emergency diesel generator output
voltage was indicative of a degraded voltage condition.
. The failure to recognize that the watt-hour meter turns off when emergency
diesel generator output voltage goes below the watt-hour trigger setpoint,
indicative of a degraded voltage condition.
. The failure to recognize that the emergency diesel generator output voltage
meter indications were reading approximately half their normal value, indicative
of a degraded voltage condition.
Enclosure 2
. The failure to recognize that data obtained during surveillance Operating
Procedure OP-ST-DG-0002, performed on July 21,2004, showed the
emergency diesel generator output voltage decreasing to approximately
2200 volts, indicative of a degraded voltage condition. This surveillance
procedure was reviewed and determined satisfactory by three operations
personnel and the system engineer.
Analvsis. The licensee failed to promptly identify and correct a condition adverse to
quality. Specifically, on July 21, 2004, during surveillance testing of Emergency Diesel
Generator 2, the licensee failed to promptly identify and correct a failure of Fuse 2FU in
the emergency diesel generator excitation circuit. The failure to promptly identify and
correct this condition resulted in Emergency Diesel Generator 2 being inoperable from
July 21 to August 19, 2004, a period of 29 days.
The issue was more than minor because it is similar to Example 4.f in NRC Inspection
Manual Chapter 0612, Appendix E, "Examples of Minor Issues," and met the "not minor
if" statement because the failed fuse affected the operability of the diesel generator.
The finding was determined to be of low to moderate safety significance based on a
Phase 1 screening analysis, Phase 2 evaluation, and Phase 2 confirmation analysis.
Siclnificance determination Drocess Phase 1:
In accordance with NRC Inspection Manual Chapter 0609, Appendix A,
"Significance Determination of Reactor Inspection Findings for At-Power
Situations," the inspectors conducted a significance determination process
Phase 1 screening and determined that the finding resulted in loss of the safety
function of Emergency Diesel Generator 2 for greater than the Technical
Specification allowed outage time. Therefore, a significance determination
process Phase 2 evaluation was required.
Siqnificance determination Drocess Phase 2:
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, "User
Guidance for Significance Determination of Reactor Inspection Findings for At-
Power Situations," the inspectors evaluated the subject finding using the Risk-
Informed Inspection Notebook for Fort Calhoun Station, Revision 1. The
following assumptions were made:
. Emergency Diesel Generator 2 was not functional upon the Fuse 2FU
failure and would not have responded upon demand.
. Emergency Diesel Generator 2 was out of service for 28 days 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
Therefore, the exposure window used was 3 to 30 days.
Enclosure 2
-4-
. The failure of Emergency Diesel Generator 2 only affected the risk
associated with a loss of offsite power (LOOP) initiating event, as
provided in Table 2 of the risk-informed notebook.
. While Fuse 2FU was failed, Emergency Diesel Generator 2 could not
have been recovered prior to postulated core damage because of the
following:
- No direct indication existed that Fuse 2FU had failed
- Required use of multimeter to identify that the fuse had failed
- Fuse 2FU was of unique design and replacements were not
immediately available to the operators
Table 2 of the risk-informed notebook requires that only the LOOP worksheet be
evaluated when a performance deficiency affects the diesel generators. All core-
damage sequences requiring emergency power were evaluated. The sequences
from the notebook are as follows:
lnitiatina Event Seauence Mitiaatina Functions Results
Loss of Offsite Power 5 EAC-REC8 6
Loss of Offsite Power I6 I EAC-RECI-TDAFW 1 7 I
Using the counting rule worksheet, this finding was estimated to be WHITE for
internal initiators. In accordance with Inspection Manual Chapter 0609,
Attachment 1, Significance and Enforcement Review Process, the NRC
conducted an independent confirmation of this Phase 2 result.
Phase 2 confirmation analysis:
The NRC compared the results from the modified notebook estimation with an
evaluation developed using a Standardized Plant Analysis Risk (SPAR) model
simulation of the failed Emergency Diesel Generator 2, as well as an
assessment of the licensees evaluation provided by the licensees probabilistic
risk assessment staff. The SPAR runs were based on the following NRC
assumptions:
. The Fort Calhoun SPAR, Revision 3.1 1, model represents an appropriate
tool for evaluation of the subject finding.
. Draft NUREG/CR-XXXX (INEEUEXT-04-02326), Evaluation of Loss of
Offsite Power Events at Nuclear Power Plants: 1986 - 2003, contains the
Enclosure 2
-5-
NRC's current best estimate of both the likelihood of each of the LOOP
classes (i.e., plant-centered,switchyard-centered, grid-related, severe
weather-related, and extreme weather-related) and their recovery
probabilities.
. Emergency Diesel Generator 2 was unavailable to respond upon demand
for the entire time that Fuse 2FU was failed.
. The condition existed for 29 days. The diesel generator was removed
from service at 8:30 a.m. on July 21, 2004, and Fuse 2FU failed prior to
the machine being restored to an operable condition. Repairs were
completed on August 18, 2004, at 5 2 5 p.m. Additionally, the diesel
generator had to be removed from service again on August 19, 2004, to
repeat the required surveillance. The actual outage time was 28 days,
10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
. Operators would have been unable to recover Emergency Diesel
Generator 2 prior to postulated core damage.
. The nominal likelihoodfor a LOOP was unaffected by the subject finding.
Initial SPAR Evaluation:
The Fort Calhoun Station SPAR Revision 3.11 model, with the associated LOOP
curves from the draft NUREG, was used for the evaluation of this finding. The
resulting baseline core damage frequency, CDF,. was 1.44 x 10-5/yr.
The NRC developed a change set, to adjust Basic Event EPS-DGN-FS-IB,
"Emergency Diesel Generator 2 Fails to Start, to the House Event "TRUE,"
indicating failure of the component. The SPAR model was requantified with the
resulting current case conditional core damage frequency, CDF ,, of 2.28 x 10
4/yr.
The change in core damage frequency (ACDF) from the model was:
= 2.28 x I O 4 - 1.44 x I O 5 = 2.14 x 104/yr.
Therefore, the total change in core damage frequency over the exposure time
that was related to this finding was calculated as:
ACDF = 2.14 x 104/yr + 365 dayslyr * 29 days = 1.70 x over the period.
Enclosure 2
-6-
This result indicated that the significance of the finding was inconsistent with the
Phase 2 result. Therefore, the finding was further evaluated.
Adiustments to SPAR:
The NRC noted that the results of the initial SPAR evaluation were more
significant than both the licensee's evaluation and the risk-informed notebook. In
reviewing these differences, it was noted that the licensee's model provided for
recovery of auxiliary feedwater during a station blackout, following battery
depletion. The licensee stated that Fort Calhoun Station had a unique
arrangement for auxiliary feedwater. Auxiliary Feedwater Pump FW-54 is diesel
driven and does not rely on vital ac or dc power. The pump is supplied with fuel
from Diesel Fuel Oil Storage System Tank FO-10. Tank FO-10 has a minimum
volume of 10,000 gallons of diesel fuel as required by Technical Specification 2.7. Eight thousand gallons of the tank's inventory are readily available for use
by Pump FW-54. Therefore, the pump could run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without fuel
addition. The NRC noted that the condensate storage tank would provide about
30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> of water based on licensee calculated steam generator steaming rates.
Therefore, makeup water sources were not assessed.
Traditionally, SPAR methodology assumes that auxiliary feedwater fails upon
loss of vital batteries. This failure assumes that instrumentation is lost and
operators overfill the steam generators. Once the steam generators fill to the
main steam lines, water flowing into the steam lines suppresses the steam
supply to the turbine-driven pump. Given the postulated failure of the turbine-
driven pump, the steam generators boil dry and the scenario leads to core
damage. Providing a reliable diesel-driven pump resolves this problem, and the
pump could theoretically continue to feed the steam generators for the 24-hour
To give credit for Pump FW-54, the failure mechanisms of the system, including
the operator actions required to continue to feed the steam generators for
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> were evaluated. These included the following:
. Pump FW-54 must continue to run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, including fuel supply,
suction source, and the operator attention necessary.
. Operators must transfer the discharge of the system to the auxiliary
feedwater nozzles and manually throttle discharge Valves HCV-I 1078
and HCV-11088 prior to battery depletion.
. Operators must ensure that there is sufficient auxiliary feedwater flow to
prevent core damage.
Enclosure 2
-7-
. The reactor coolant pump seals must remain intact for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without
vital ac or dc power. The NRC determined that the reactor coolant pump
seals at Fort Calhoun Station were of the upgraded seal design.
Therefore, the NRC utilized the value for the probability of seal failure
during an extended loss of power, documented in the SPAR model. This
value was 8.9 x lo3.
. Operators must isolate the condensate storage tank prior to loss of
pressure in the associated nitrogen bottle. This action requires manual
isolation of the hotwell supply line before the air-operated valve fails open
and the condensate storage tank inventory is vacuum dragged to the
condenser.
. Operators have a varying amount of time to perform these actions,
depending on the success or failure of two operator actions: (1) operators
minimize dc loads on the battery quickly following a station blackout and;
(2) operators flood the steam generators to 94 percent wide-range level
prior to battery depletion using either Pump W - 5 4 or the turbine-driven
auxiliary feedwater pump.
The NRC used generic steam generator data and certain plant-specific
information from the Final Safety Analysis Report to calculate the
approximate time that operators would have to successfully operate
Pump FW-54 following battery depletion conditional upon the success or
failure of these two actions. The following table documents those times:
Table 3.a
The NRC quantified the probability that the operators fail to minimize dc loads in
a short period of time using the SPAR-H method described in draft NUREG/CR-
XXXX (INEEUEXT-02-01307), The SPAR-H Human Reliability Analysis
Method. The procedural requirements in Emergency Operating Procedure
EOP-00, Standard Post Trip Actions, and Emergency Operating Procedure
Enciosure 2
-8-
Attachment 6, Minimizing DC Loads, were evaluated. The NRC assumed that
this particular action did not require a significant amount of diagnosis because
the EOP-00 has a step and multiple notes reminding the operators to take the
action when necessary. The NRC adjusted the nominal human error
probabilities using the following performance shaping factors:
. Available time was 15 minutes. The NRC assumed that this was just
enough time to coordinate with two plant operators and to open breakers
in the turbine building and the auxiliary building. Therefore, a factor of 10
was used.
. The stress was assumed to be high because of an ongoing station
blackout. Therefore, a factor of 2 was used.
. The complexity was assumed to be moderate because of the
coordination needed with plant operators at two different locations and
the low lighting during the station blackout conditions. Therefore, a factor
of 2 was used.
In addition to these three shaping factors, the NRC adjusted the final result using
the Odds ratio as documented in the draft NUREG, Section 2.5. The probability
that operators would fail to minimize dc loads within 15 minutes of a station
blackout was calculated to be 3.8 x
Using a similar approach, the NRC calculated probabilities of human error for
each of the required operator actions listed above. The times available
documented in Table 3.a. were used to modify the performance shaping factors
based on the time operators had to respond to the particular action. The HRA
values calculated are documented in Table 3.b.
Odds ratio is a method of accounting for the number of successes as well as failures
when calculating a conditional human error probability. This method of accounting for
uncertainties associated with individual performance shaping factors is described in draft
NUCREG-CR-XXXXX (INEEUEXT-02-10309), SPAR-H METHOD, and tends to provide a
less conservative result.
Enciosure 2
-9-
Table 3.b
Operator Failure Probabilities
I Performance Shaping Factors
Operator Action
Isolate CST' 1 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> I l.O/O.l' I 2.0 I 0.5/1.0b I 1.0 I1.2~103
Notes:
' Nominal time was available for diagnosis, but there was barely adequate time to take the action.
Nominal stress was used for diagnosis because of control room environment and verbatim emergency
operating procedure compliance. High stress in the field because actions would affect plant safety.
The following items also had the Complexity PSF changed to 0.1 for an obvious diagnosis, and 2.0 for a
moderately complex action: minimize dc loads and swap to AFW nozzles.
Complexity values adjusted to indicate an obvious diagnosis based on emergency operating procedure
review.
The procedures for diagnosing the need for this step were symptom based, but the procedures foi
implementationwere considered by the NRC to be poor.
The procedures for diagnosing the need for this step were symptom based, but the procedures for
implementationwere considered by the NRC to be nominal.
' The experience of operators is nominal for diagnosing this need, but they do not routinely operate the valve
gags in this situation.
The ergonomics were considered poor for swapping the AFW nozzle because an unfamiliar task would have
to be done without normal lighting.
'These actions did not include a significant amount of diagnosis. Therefore, only the action failure probability
was calctilateri
The NRC created an event tree to model the actions required to successfully use Pump
FW-54 following battery depletion. This event tree, provided as Attachment 2 to this
analysis, covered each of the functions required to achieve success, as well as the
Enclosure 2
-1 0-
probability that actions affecting the time available (Le., minimizing dc loads) would be
completed. The NRC used the SPAR to quantify Fault Tree AFW-FW54, "Fort Calhoun
PWR G AFW FW-54," and provide a probability that the Pump FW-54 train would fail
from nominal reasons at any time during the accident sequence. The probability of
failure was determined to be 3.14 x 10'. The NRC then quantified the event tree using
the human reliability values listed in Table 3.b and the solution from the SPAR fault tree
for Pump FW-54 as split fractions. This quantification provided the total failure
probability of the Pump FW-54 train during an unrecovered station blackout, upon
depletion of the station vital batteries. The probability was quantified as 1.08 x 10-1.
The failure probability was a factor of 2, lower than that calculated by the licensee, using
the EPRl Human Reliability Calculator, Revision 2.01. However, given that all human
reliability analysis values used in the SPAR were developed using similar methods, it
was determined that this was a valid best estimate. The sensitivity evaluation
documented below, indicates that the final risk value is very sensitive to this assumption.
Results of Adiusted Analvsis:
The NRC evaluated cutsets from the initial SPAR model evaluation ascertained that
90.4 percent (P(Dep,e,sJ of the risk involved cutsets with auxiliary feedwater failing upon
battery depletion. The NRC determined that these cutsets should be adjusted by the
new failure probability of Pump FW-54, P(54).Therefore, the best estimate change in
core damage frequency was calculated as follows:
ACDF = (Initial ACDF) * ((P(54) * P<Dep,te))+ (1 - Ppep$teJ)
= (1.70 X IO5) * ((1.08 X lo" * 90.4%) + (1 - 90.4%))
= 3.3 x
This best estimate value was in line with the licensee's internal evaluation and
appropriately accounted for the unique design of the Fort Calhoun Station auxiliary
feedwater system. Therefore, it was concluded that the Phase 2 estimation was valid
and should stand as the agency's preliminary risk significance for internal events. This
resulted in determining that the finding was of low to moderate risk significance
(WHITE).
External lnitiatins Events:
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, step 2.5,
"Screening for the Potential Risk Contribution Due to External Initiating Events," the
NRC assessed the impact of external initiators because the Phase 2 significance
determination process result provided a Risk Significance Estimation of 7 or greater.
The methodology used to assess the impact of external events evaluated each initiator
for the Dotential to:
Enclosure 2
-11-
Increase the likelihood of a LOOP.
Impact the reliability or availability of mitigating systems used during a LOOP.
Hiah Winds, Floods. and Other External Events:
The NRC reviewed the licensees Phase I report on the Individual Plant Examination for
External Events (IPEEE) for Fort Calhoun, dated December 29, 1993. The licensee
evaluated these external events in the following categories:
During the IPEEE development, the licensee had quantified the risk related to
high winds at 5.3 x 1OE/yr. The NRC assumed that high wind events happen
frequently enough that the impact of these severe weather events are already
incorporated into the LOOP frequency. Therefore, only events with winds high
enough to damage safety-related structures (and thus mitigating systems) could
affect the subject finding.
Most of the calculated risk, presented in the IPEEE, was from tornados of
Categories F4 and F5. The frequency of these events hitting the Fort Calhoun
site was estimated as 4.3 x 106/yr. This results in a probability of 3.4 x 10 that
a tornado would hit during any 29-day period. Given the very low probability of
event initiation, it was determined that the change in core damage frequency
caused by the subject finding would be very low.
0 External Floods
As documented in the IPEEE, the licensee evaluated two types of external
floods: those that result from above normal precipitation andfor snow melt
(periodic flooding), and those that result from failure of upstream earthen dams.
Both events could cause a LOOP while affecting mitigating systems.
The NRC reviewed Table 5.2.1, Flood Frequency and Equipment Impact, to
assess the impact of periodic flooding on the risk related to the subject finding. It
was noted that flooding below 1007.5 feet mean sea level (MSL) had no major
impact on plant operations, and flooding above 1013.5 was assumed to fail the
diesel generators as a baseline assumption. Therefore, the NRC evaluated the
change in risk from periodic flooding that resulted in water levels between 1007.5
and 1013.5. The following table, Table 4.a, shows the calculated flooding
frequencies for these events and the equipment expected to be lost at each
level. This information was extracted from Table 5.2.1 of the licensees IPEEE.
Additionally, the conditional core damage probabilities (CCDPs) were developed
using the SPAR model and are also documented in Table 4.a.
Enclosure 2
-1 2-
Table 4.a
Risk Affects to External Flooding
Flood Elevation
II Equipment Lost 1 CCDP IACDF
I
1007.5- 1009.5 3.3x LOOP onlv I 7.8x I 3.8x IO-*
I
1009.5- 1010.8 6.0x 1 Intake I 8.0 x I O 4 I 8.3x I O 9
I
1010.8- 1012.3 9.0x IO- I Intake (10%),3,7I 1 . 5 IO-
~ I 8.4~
1012.3- 1013.5 1.Ox I O 6 Intake (90%),4,79.0x IO- 3.2x IO-
Attachment 3 of this analysis is a spreadsheet showing the calculations used to
determine the ACDF values shown in Table 4.a. The assumptions and
adjustments used are documented in the notes section of the table. Because
each of the flood elevations are statistically independent, the sum of the four
flood scenarios obtained the result of 8.8x IO over the exposure period.
0 Other External Events
Finally, the licensee used the NUREG 1407, Procedural and Submittal
Guidance for the Individual Plant Examination of External Events (IPEEE) for
Severe Accident Vulnerabilities, dated April 1991,to screen out aircraft
accidents and other external initiators from further review. Therefore, the NRC
assumed that the subject finding would have no significant change in the risk
associated with these events.
Internal Fire:
Within the Individual Plant Examination for External Events - Fort Calhoun Station. the
Enclosure 2
-13-
licensee used a screening criteria of 1 x 10 as the threshold for determining that the
fire risk in a given area was negligible. The NRC determined that this screening was
low enough to identify those areas important to the subject finding. The IPEEE
documents 14 fire areas, with 59 fire zones that yielded a nCDF greater than the
screening criteria.
In the internal events evaluation, it was determined that over 99 percent of the internal
risk was related to station blackouts with failures of the auxiliary feedwater system.
Therefore, the NRC reviewed the unscreened fire areas at Fort Calhoun Station to
identify any fires that could result in a LOOP andfor affect the auxiliary feedwater
system. The NRC documented those areas, as potentially significant, in Table 4.b, and
conducted further analyses of these areas.
Table 4.b
The NRC reviewed each of these areas as follows:
0 Transformer Yard Area
It was assumed that internal fire events happen frequently enough and that the
rate of event initiation from these fires is already incorporated into the initiating
event frequencies. To validate this assumption, the NRC took the highest fire
ignition frequency for a fire zone that could cause a LOOP, 8.29 x and
multiplied it by the nonsuppression probability for the area, 5 x This
resulted in a fire mitigation frequency of 4.1 x l o 4 , which is two orders of
magnitude below the LOOP likelihood (3.3 x 10.). Therefore, it was determined
that the fire effects on the subject finding were negligible in the Transformer Yard
Area and screened this area from further review.
Enclosure 2
-14-
0 Compressor, West Switchgear, and Turbine Building Areas
It was assumed that areas that only affected auxiliary feedwater and did not
result in a LOOP would not have a major impact on risk. To validate this
assumption, the NRC evaluated Fire Zone FA46F containing the diesel-driven
auxiliary feedwater pump, Pump FW-54. The ignition frequency was 6.27 x I O 3
and the nonsuppression probability was 5 x IO-*. Multiplying these resulted in a
conservative fire mitigation frequency of 2.1 x IO5. The fire mitigation frequency
for 29 days was then calculated as follows:
FMF=2.1 X I O . ~- 3 6 5 ' 2 9 = 1 . 6 7 X 1 0 ~ 6
It was noted that, for these areas, a LOOP would have to occur following or
coincident with the fire, but prior to the licensee placing the plant in a safe
condition. Assuming that the licensee took 3 days to shut down and cool the
reactor to shutdown cooling pressures, the NRC calculated the probability that a
LOOP occurred during this time, E IL
,,, as follows:
EIL ,, = 3.31 x 10' f 365 * 3 = 2.72 x I O 4
Therefore, the likelihood that a large fire would occur and a LOOP occurred
while the reactor was being shut down and cooled,,,,,E ,I,,L,, was calculated as
follows:
IELF,,E.Loo, = 1.67 x * 2.72 x I O 4 = 4.54 x 10.
This value is low enough to support the assumption that areas where fires would
only affect auxiliary feedwater had a negligible risk increase related to the
subject performance deficiency. Therefore, the NRC screened the compressor,
west switchgear, and turbine building areas from further review.
e East Switchgear Area
In the paragraph regarding the transformer yard above, the NRC calculated a fire
mitigation frequency of 4.1 x 10-4/yrfor this area. This represents the probability
that a fire ignites and the Halon system is unsuccessful. This scenario is the
only one deemed credible that could result in both a LOOP and a loss of the
motor-driven auxiliary feedwater pump. The likelihood that this event is initiated
within the 29 days exposure time, IELFIRE.LOOP, can be calculated as follows:
,E
I,,L, = 4.1 x 104/yr/ 365 * 29 = 3.25 x
Enclosure 2
-1 5-
The area has cabling that feeds offsite power to Switchgear 1A4 in addition to
Switchgear 1A3 itself. Therefore, a large fire without suppression is assumed to
cause a Station Blackout instead of a LOOP, because of the failure of
Given the failure of Emergency Diesel Generator 2, it was determined that this
event would go to core damage without Auxiliary Feedwater Pump FW-54.
Therefore, the NRC set the conditional core damage probability for a fire in the
east switchgear area, with the failure of Emergency Diesel Generator 2,,,,,P , to
the failure probability of the diesel-driven auxiliary feedwater pump upon battery
depletion, calculated previously to be 1.08 x IO'.
To determine the baseline risk for an unsuppressedfire in this area, the NRC
quantified an unrecoverable (extreme weather) LOOP with a failure of
Switchgear 1A3. The resulting CCDP was 1.8 x 10'. It was determined that the
actual CCDP was that quantified multiplied by the failure probability of the diesel-
driven auxiliary feedwater pump upon battery depletion, calculated previously to
be 1.08 x IO-'. Therefore the final baseline CCDP, , , ,P
, was 1.94 x IO3.
The NRC then calculated the change in risk for this area as follows:
ACDF = (3.25 x 1.08 x 10.') - (3.25 x * 1.94 x I O 3 )
= 3.45 x 1 0 - 6
0 Cable Spreading Room
In their IPEEE, the licensee concluded that there were essentially no installed
ignition sources in the cable spreading room. However, hot work and transient
combustibles were considered credible sources of fire in this area. The fire
ignition frequency for hot work was set as 6.7 x 10-4/yrand the frequency for
transient ignition sources was set at 1.I x IO-'/yr by reviewing the Fire Events
Database. This fire area is protected by an automatic Halon system. The
assumed success rate for the Halon system was 95 percent, leading to a
nonsuppression probability of 5 x Therefore, the probability that a large fire
would occur in this area,,,,,P
,, is:
pLARGE = (6.7 x 10-~/yr+ 1.1 x 10-~/yr)* 5 x io2
= 3.9 x I 0-5/yr
The licensee used the same procedures for a large fire in the cable spreading
room as for a main control room evacuation. Therefore, the NRC used the
accepted screening value of 0.1 for the probability of failure to shut down the
reactor from outside the main control room. The NRC also assumed that the
Enclosure 2
-16-
total conditional core damage probability,,,,P ,, would be the failure of remote
shutdown plus the probability of failure of Pump FW-54.
PBAS, = 3.9x105/yr (1.08x10-' 0.1)
= 4.21 x 107/yr
,,,P
, = 3.9 x 105/yr * I .OB x io-'
= 4.21 x 106/yr
The NRC calculated the following ACDF over the 29-day exposure time:
ACDF = (4.21 x 10-6/yr - 4.21 x 107/yr) ) 365 days/yr * 29 days
= 3.0 x
It was determined, based on the lPEEE data, that fires in the cable spreading
room, not requiring control room evacuation, were likely not of importance to this
risk evaluation.
0 Main Control Room
The NRC reviewed a series of main control room fire scenarios documented in
the IPEEE - Fort Calhoun Station. Two major categories of fire were of interest:
(1) fires leading to evacuation, and (2) fires leading to a LOOP and/or auxiliary
feedwater system failures.
Main Control Room Evacuation:
There are 66 electrical cabinets in the Fort Calhoun Station main control room.
Seven cabinets contain automatic Halon suppression systems, while 59 cabinets
would require manual suppression. The basic fire initiation frequency was
1.44 x 10-4/cabinetlyr.Therefore, the total fire ignition frequency for those
cabinets with automatic suppression, ,,F ,I, and for those requiring manual
suppression,,,,F
,F
,I,, can be calculated as follows:
FIFAuT0= 1 . 4 4 10-4/cabinet/yr
~ * 7 = 1.01 x I O 3
FIFMANVAL = 1.44 x 10-4/cabinet/yr * 59 = 8.50 x
The assumed success rate for the Halon system was 95 percent, leading to a
nonsuppression probability of 5 x IO-*.The IPEEE provides that control room
evacuation would be required if a fire was unsuppressedfor 20 minutes.
Assuming that a fire takes 2 minutes to be detected by automatic detection
Enclosure 2
-17-
and/or by the operators, there are 18 minutes remaining in which to suppress the
fire prior to control room evacuation being required. NRC Inspection Manual
Chapter 0609, Appendix F, Attachment 6, Table 48.1, Non-suppression
Probability Values for Manual Fire Fighting Based on Fire Duration (Time to
Damage after Detection) and Fire Type Category, provides a manual
nonsuppression probability for the control room of 1.3 x 1O-*, given 18 minutes
from time to detection until time to damage. Using these values for suppression,
the fire mitigation frequency can be calculated as follows:
FM,F ,, = I .OI x 10-3 * 5 x 10-2 = 5.04 x 10-5/yr
FM,,,,F
,, = 8 . 5 0 ~ 1 0 . ~ i . 3 ~ 1 0 = ~
I . I I x1O4/yr
The NRC reviewed the licensees control room evacuation procedure contained
in Abnormal Operating Procedure AOP-07, Evacuation of Control Room. The
licensees strategy required isolating the vital switchgear from offsite power, then
reenergizing Switchgear 1A3 using Emergency Diesel Generator 2. Given the
failure of Emergency Diesel Generator 2, the NRC determined that this event
would proceed to core damage without Auxiliary Feedwater Pump FW-54.
Therefore, the NRC set the CCDP for a control room evacuation with a loss of
Emergency Diesel Generator 2, PcAsE, to the failure probability of the diesel-
driven auxiliary feedwater pump upon battery depletion, calculated previously to
be 1.08 x 10..
In the IPEEE, the licensee had used the accepted screening value of 0.1 for the
probability of failure to shutdown the reactor from outside the main control room.
The NRC assumed that the total CCDP,,,,P ,, would be the failure of remote
shutdown plus the probability of failure of Auxiliary Feedwater Pump W - 5 4 .
,,,P, = ( 5 . 0 4 ~10-~/yr+ 1.11 x 10-~/yr)* ( 1 . 0 8 ~O I - * 0.1)
= 1.74 x 1WG/yr
,,,P, = (5.04~10-5+i.ii XIO-4) - (I.o~xIO-~)
= I .74 x I 0-5iyr
The NRC calculated the following ACDF over the 29-day exposure time:
ACDF = (1.74 x 105/yr - 1.74 x IO-/yr) + 365 days/yr * 29 days
=1.2x10-6
Enclosure 2
-18-
e Main Control Room Cabinets:
The NRC reviewed each of the control room cabinet fire scenarios presented in
the licensee's IPEEE. Only four scenarios involved fires leading to a LOOP
and/or auxiliary feedwater system failures. These scenarios were:
. Fire in Cabinet CB-4
The NRC determined that this fire scenario affected main feedwater and
Auxiliary Feedwater Pump MI-54. As stated above, it was assumed that
fires affecting auxiliary feedwater but not resulting in a direct LOOP would
not have a major impact on risk. Therefore, this scenario screened from
further analysis.
. Fire in Cabinets CB-IO, CB-I 1, and part of CB-20
This fire scenario could result in a total LOOP. However, it would not
directly cause the failure of auxiliary feedwater system components. As
stated previously, it was assumed that internal fire events happen
frequently enough and that the rate of event initiation from these fires is
already incorporated into the initiating event frequencies. In the case of
this fire scenario, the fire ignition frequency was 4.32 x 10-4/yr. This value
is two orders of magnitude below the LOOP likelihood. Therefore, it was
determined that the fire effects on the subject finding were negligible in
these cabinets and screened this scenario from further review.
. Fire in Cabinet CB-20
This fire scenario could result in a total LOOP. However, it would not
directly cause the failure of auxiliary feedwater system components. As
stated previously, it was assumed that internal fire events happen
frequently enough and that the rate of event initiation from these fires is
already incorporated into the initiating event frequencies. In the case of
this fire scenario, the fire ignition frequency was 1.44 x 104/yr. This value
is two orders of magnitude below the LOOP likelihood. Therefore, it was
determined that the fire effects on the subject finding were negligible in
these cabinets and screened this scenario from further review.
. Fire in Cabinet AI-30A
This fire scenario could result in a reactor trip with the loss of all ac power
to Switchgear 1A3. The NRC determined that for Emergency Diesel
Generator 2 to be required following this fire scenario, offsite power
would have to be lost to Switchgear 1A4. In the case of this fire scenario,
the fire ignition frequency was 5.76 x 10-4/yr. The frequency of a LOOP
Enclosure 2
-19-
to Switchgear 1A4 is assumed to be (3.31 x 10Z/yr 1.75) = 4.8 x
over the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, assuming that it would take 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to stabilize and
cool the reactor. Therefore, the likelihood that a fire initiates sometime
over a 29-day period followed within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> by a LOOP to
Switchgear 1A4 is:
,I, = 5.76 x 1O-4/yr/ 365 days/yr * 29 days * 4.8 x 1O 4
= 2.2 x lo-@
Therefore, it was determined that the fire effects on the subject finding
were negligible in these cabinets and screened this scenario from further
review.
Main Control Room Internal Fire ACDF:
The NRC determined that all main control room fires, not requiring evacuation,
were either screened out or it was determined quantitatively that the risk
increase from the subject finding was negligible with respect to those fire
scenarios. Therefore, the total internal fire ACDF quantified was the change in
risk from fires requiring main control room evacuation.
External Events Summary:
As documented above, the NRC determined that the external events important to the
risk associated with the subject finding were external flooding and internal fire. The
four flood scenarios evaluated resulted in a ACDF of 8.8 x I O over the exposure
period. The seven fire areas evaluated resulted in a ACDF of 5.0 x I O 6 over the
exposure period. Therefore the risk of the subject finding related to external events was
the sum of the two, 5.9 x The Phase 2 estimation resulted in a single sequence
with a result of six and another with a result of seven. Using the counting rule, this can
be estimated as a ACDF of 3.6 x Therefore total ACDF for the subject finding can
be calculated as the sum of the internal and external risk:
ACDF = 3.6 x I O 6 + 5.9 x IO-@ = 9.5 x
This result indicates that the change in risk from external initiators caused by this finding
does not cause the significance to increase above the next threshold. Therefore the
finding is of low to moderate risk significance (WHITE).
Enclosure 2
-20-
Potential Risk Contribution from Larqe Earlv Release Frequency:
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, step 2.6,
"Screening for the Potential Risk Contribution Due to LERF," the NRC assessed the
impact of large early release frequency because the Phase 2 significance determination
process result provided a risk significance estimation of seven.
In pressurized water reactors, only a subset of core damage accidents can lead to large,
unmitigated releases from containment that have the potential to cause prompt fatalities
prior to population evacuation. Core damage sequences of particular concern for this
type of reactor are intersystem loss of coolant accidents, steam generator tube ruptures,
and station blackouts.
In accordance with Manual Chapter 0609, Appendix H, "Containment Integrity SDP," it
was determined that this was a Type A finding, because the finding affected the plant
core damage frequency. The NRC evaluated the risk-informed notebook results and
determined that Sequences 2 and 3 were both induced by a LOOP that did not proceed
to a station blackout. In accordance with Appendix H, Section 5.1, step 2, "Accident
Sequence Screening," LOOP sequences with successful emergency ac power operation
will not generally contribute to the large-early release frequency and therefore are
screened out. Additionally, station blackout sequences (Sequences 5 and 6) are
screened from further analysis for large dry containments as described in Appendix H,
Table 5.1, "Phase 1 Screening - Type A Findings at Full Power." Therefore, it was
determined that the subject performance deficiency was not significant to the large-early
release frequency.
Licensee's Risk Assessment:
The licensee evaluated the failure of Emergency Diesel Generator 2 using their
probabilistic risk assessment model. The result of their internal events evaluation was
approximately 3.6 x 1O-6. As stated above, the licensee's model provided for recovery of
auxiliary feedwater during a station blackout, following battery depletion. The licensee
stated that Fort Calhoun Station had a unique arrangement for auxiliary feedwater.
Auxiliary feedwater Pump FW-54 is diesel-driven and does not rely on vital ac or dc
power. The pump is supplied with fuel from Diesel Fuel Oil Storage System
Tank FO-IO. Tank FO-10 has a minimum volume of 10,000 gallons of diesel fuel as
required by Technical Specification 2.7. Eight thousand gallons of the tank's inventory
are readily available for use by Pump FW-54. Therefore, the pump could run for 24
hours without fuel addition. To address this unique design, the licensee used Basic
Event XSB08DC to address the probability that operators would fail to properly run
Pump FW-54 following battery depletion. The licensee had used the EPRl Human
Reliability Calculator, Revision 2.01, to quantify this value. The failure probability used,
2.02 x IO-', was a factor of 2 higher than that calculated by the NRC. However, given
that all human reliability analyses values used in the SPAR were developed using similar
methods, the NRC determined that this was a valid best estimate.
Enclosure 2
-21-
Sensitivitv Studies:
The NRC performed sensitivity studies on major assumptions using the internal events
model. Table 6 summarizes the assumptions and the results. It was determined that
the analysis is very sensitive to the probability of failure selected for running Auxiliary
Feedwater Pump FW-54 during a station blackout following battery depletion.
Additionally, the NRC assessed diesel generator recovery times and the total exposure.
1 and 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />
NOTES:
1) Three evaluations were run for Pump FW-54: a) using the licensee's value; b) assuming no
credit beyond battery depletion; and c) giving the system single train credit.
2) Diesel Generator recovery is based on one machine. However, for certain conditions, it may be
appropriate to increase the failure probability for recovery if one machine is unrecoverable.
3) The exposure time assumed that the licensee's performance deficiency started when they failed
to recoanize the blown fuse. Had there been reason to know the circuit would have failed. the
I machine was not functional for its mission time for longer than 29 days.
I
All Other Inspection Findings (Not IE, MS, BI Cornerstones)
Not Applicable.
Enforcement. Title 10 of CFR Part 50, Appendix B,Criterion XVI, requires, in part, that
measures shall be established to ensure that conditions adverse to quality, such as
failures, malfunctions, etc., are promptly identified and corrected.
Fort Calhoun Station Technical Specification 2.7(1), Minimum Requirements, states, in
part, that the reactor shall not be heated up or maintained at temperatures above 300°F
unless the following electrical systems are operable: two emergency diesel generators
(DG-I and DG-2). Technical Specification2.7(2), Modification of Minimum
Requirements, states, in part, that the minimum requirements may be modified under
certain conditions. Item 2.7(2)j states that either one of the emergency diesel
generators may be inoperable for up to 7 days (total for both) during any month,
provided certain conditions are met.
Contrary to the above, on July 21, 2004, during surveillance testing of DG-2, the
Enclosure 2
-22-
licensee failed to promptly identify that Fuse 2FU in the emergency diesel generator
excitation circuit had failed. The failure to promptly identify and correct this condition
resulted in DG-2 being inoperable from July 21 to August 19, 2004, a period of 29 days,
violating Technical Specification 2.7(1). This violation of 10 CFR Part 50, Appendix B,
Criterion XVI, is being treated as a violation, consistent with the Enforcement Policy
(VI0 05000285/2005010-01). This violation is in the licensees corrective action
program as Condition Report 200403634.
40A6 Meetinas. lncludina Exit
On March 2, 2005, the inspectors presented the results of the resident inspector
activities to Mr. R. Phelps, Division Manager of Nuclear Engineering, and other
members of his staff who acknowledged the finding.
The inspectors confirmed that proprietary information was not provided by the licensee
during this inspection.
ATTACHMENT 1: SUPPLEMENTAL INFORMATION
ATTACHMENT 2: EVENT TREE
ATTACHMENT 3: SPREADSHEET
Enclosure 2
ATTACHMENT 1
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
G. Cavanaugh, Supervisor, Nuclear Licensing
M. Core, Manager, System Engineering
P. Cronin, Manager, Shift Operations
M. Frans, Assistant Plant Manager
A. Hackerott, Supervisor, Probabilistic Risk Assessment
R. Haug, Manager, Chemistry
J. Herman, Manager, Nuclear Licensing
R. Kellogg, Senior Nuclear Design Engineer
K. Naser, System Engineering Supervisor
R. Phelps, Division Manager, Nuclear Engineering
C. Sterba, Supervisor, Design Engineering
D. Trausch, Manager, Quality
NRC
M. Hay, Branch Chief
T. Vegel, Deputy Director, Division of Reactor Projects
J. Hanna, Senior Resident Inspector
L. Willoughby, Resident Inspector
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
05000285/2005010-01 VI0 Emergency Diesel Generator 2 Inoperable in Excess of
Technical Specifications due to Failed Fuse
(Section 1R15)
A-1 Attachment 1
LIST OF DOCUMENTS REVIEWED
Part 21 Report, Interim Report Concerning Failures of Gould-Shawmut Fuses, May 8, 1995
Computer plots of Diesel Generator Frequency and Voltage for surveillance testing performed
on August 18,2004
Evaluation of Plant Risk (CDF & LERF) of Diesel Generator Unavailable for 29 days, performed
on November 24,2004
Plant Review Committee Agenda for November 17,2004, Meeting
Memorandum from Peter Graffy (Exelon) to Richard Ronning (OPPD), Ongoing Failure
Anatysis/Special Test Shawmut Amptrap Fuse A25X100 Type 4, dated November 11,2004
Control Room Operator Logs for July 21, 2004
LER 05000296/1993-002-00, An Emergency Diesel Generator Auto-Started as a Result of
Degraded Voltage Condition on 4KV Shutdown Caused by a Blown Fuse, January 3, 1994
LER 05000346/2004-002-00, Reactor Trip During Reactor Trip Breaker Testing Due to Fuse
Failure, October 4, 2004
LER 05000424/2000-002-00, Manual Reactor Trip Following Main Steam Isolation Valve
Closure, June 27,2000
LER 05000457/1991-006-00, Generator Trip Caused by Spurious Actuation of Neutral Ground
Relay, December 23, 1991
LER 05000483/1996-001-00, Licensed Operators initiated a Manual Reactor Trip,
April 25, 1996
LER 05000457/2000-002-00, Automatic Reactor Trip on Power Range Neutron Flux High
Negative Rate Due to Stationary Gripper Fuse FU15 Failure for Control Rod P I 0 Causing the
Rod to Drop into the Core, May 12, 2000
Level ARoot Cause Analysis Report, lnoperability of DG-2 Diesel Generator During Engine
Shutdown, Revision 0
Emergency Response Facility Computer (Plant Computer) alarm printout for July 21, 2004
Surveillance Test Procedures:
OP-ST-DG-0002, Diesel Generator 2 Check, Revision 41 performed on July 21, 2004
OP-ST-DG-0002, Diesel Generator 2 Check, Revision 41 performed on August 18, 2004
OP-ST-DG-0002, Diesel Generator 2 Check, Revision 41 performed on August 19,2004
OP-ST-DG-0002, Diesel Generator 2 Check, Revision 41 performed on September 15, 2004
OP-ST-DG-0001, Diesel Generator 2 Check, Revision 42 performed on July 7,2004
A-2
OP-ST-DG-0001, Diesel Generator 2 Check, Revision 42 performed on August 4, 2004
OP-ST-DG-0001, Diesel Generator 2 Check, Revision 42 performed on September 1,2004
Standing Orders:
SO-G-23, Surveillance Test Program, Revision 51
SO-G-96, Planned LCO Entry Criteria and Equipment Reliability Control, Revision 11
SO-G-7, Operating Manual, Revision 52
SO-0-30, Testing Safety Related Equipment, Revision 8
SO-0-1, Conduct of Operations, Revision 56
SO-G-26, Training and Qualification Programs, Revision 46
SO-G-56, Qualified Life Program, Revision 24
Drawings and Schematics:
File No. 57227, DG-2 Diesel Generator One Line Diagram P&ID, Revision 5
File No. 17397, Schematic Engine Control, Revision 16
File No. 9808, Elementary Diagram AI-30A, Revision 17
File No. 9809, Elementary Diagram AI-30A, Revision 15
File No. 9819, Elementary Diagram AI-306, Revision 16
File No. 9818, Elementary Diagram AI-30B, Revision 15
File No. 6623, 1 Phase Full Static Exciter, Revision 7
File No. 17396, Schematic Engine Control, Revision 6
File No. 17398, Schematic Engine Control, Revision 8
File No. 56795, Component List for Static Exciters AI-l33a-28 & AI-1336-28, Revision 3
Condition Reports:
200402518
200403634
200403662
200404060
A-3 Attachment 1
ATTACHI4EIJT 2
Y)
w
u
2 2 y1
9 2 W
Y
w
Y
Y)
9
W
e:
W
e:
u 2 2 U
U
3
d 24 3
2
U
u 2 2
2- 2 2 LJ
2 2 2
=2
y1 L 4
~ L
TI d Ih c F et 3 I:
-l
r' T
L T I
i
I