ML070640155
| ML070640155 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 03/02/2007 |
| From: | Anton Vegel NRC/RGN-IV/DRP |
| To: | Ridenoure R Omaha Public Power District |
| References | |
| EA-07-047 IR-06-018 | |
| Download: ML070640155 (30) | |
See also: IR 05000285/2006018
Text
March 2, 2007
R. T. Ridenoure
Vice President
Omaha Public Power District
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 550
Fort Calhoun, NE 68023-0550
SUBJECT:
FORT CALHOUN STATION - NRC BASELINE INSPECTION
REPORT 05000285/2006018
Dear Mr. Ridenoure:
On February 13, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed an
inspection at your Fort Calhoun Station. A preliminary finding was discussed on December 21,
2006, with Mr. Jeff Reinhart, Site Director, and other members of your staff. After additional
in-office review, a final exit meeting was conducted on February 13, 2007, with Mr. Reinhart and
other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and
compliance with the Commissions rules and regulations and with the conditions of your license.
Specifically, the inspectors reviewed the circumstances surrounding a containment spray valve
that was incorrectly installed on May 11, 2005. The inspectors reviewed selected procedures
and records, observed activities, and interviewed personnel.
As described in Section 4OA5.5 of this report, inadequate Maintenance work instructions
contributed to the improper configuration of containment spray header isolation Valve HCV-345.
Specifically, the lack of detailed instructions or independent verifications, in steps for a
maintenance procedure performed during the Spring 2005 refueling outage, resulted in the
valve disk being installed improperly. This failure resulted in a condition where the actual
position of the valve was nearly opposite of the indicated position. Additionally, your staff failed
to identify the condition during postmaintenance testing. Consequently, this latent degraded
condition existed for an entire operating cycle, approximately 454 days, until the condition
revealed itself during the start of the Fall 2006 refueling outage. Based on review of
circumstance related to this abnormal condition the NRC identified an apparent violation of
10 CFR Part 50, Appendix B Criterion V, Instructions, Procedures, and Drawings for failure to
prescribe adequate procedures for maintenance and testing. The finding was characterized as
an apparent violation and was preliminarily determined to have low to moderate (White) safety
significance.
The condition did not represent an immediate safety concern at the time of discovery due to the
plant being in a shutdown condition where the containment spray system was not required.
The valve was reinstalled in a correct manner shortly after its condition was discovered, and
prior to restart of the unit.
Omaha Public Power District
- 2 -
Regarding the preliminary characterization of the finding as an issue of low to moderate (White)
safety significance, the NRC made this risk determination based upon review of the best
available information at the conclusion of inspection activities. The preliminary risk
determination is included as Attachment 2 to this report. We acknowledge that there are
differences between the NRC risk assessment and those performed by your staff. The final
resolution of this finding will convey the importance to safety by assigning the corresponding
color (i.e., Green - a finding of very low safety significance; White - a finding with some
increased importance to safety, which may require additional NRC inspection; Yellow - a finding
with substantial importance to safety that will result in additional NRC inspection and potentially
other NRC action; Red - a finding of high importance to safety that will result in increased NRC
inspection and other NRC action). This finding appears to have increased safety significance
because it represented a potential to create a flow diversion from the reactor coolant system
during accident conditions. This finding is being considered for escalated enforcement action in
accordance with the NRC Enforcement Policy. The current Enforcement Policy is included on
the NRCs Web site at www.nrc.gov/OE.
Before we make a final decision on this matter, we are providing you an opportunity to
(1) present to the NRC your perspectives on the facts and assumptions that were used by the
NRC to arrive at the finding and its significance at a Regulatory Conference or (2) submit your
position on the finding to the NRC in writing. In either case, to support our final significance
determination, please provide your assessment of the risk significance of this issue. The
assessment should include key assumptions and results of your estimates of changes to the
core damage frequency and large early release frequency. Additionally, your assessment
should include the following:
1)
Your evaluation of the frequency of initiating events that can result in flow
diversion from the reactor coolant system through Valve HCV-345 when the
shutdown cooling system is placed in service.
2)
Your evaluation of operator response to indications of a loss of reactor coolant
system inventory, success paths available to prevent core damage, and
perspectives on human reliability analysis for these scenarios.
3)
Your evaluation of any contribution to the risk significance of this issue from
external event initiators.
4)
Any other detailed technical information or analyses you believe are important to
support an overall risk assessment of the subject issue.
If you request a Regulatory Conference, it should be held within 30 days of your request, and
we encourage you to submit supporting documentation at least one week prior to the
conference in an effort to make the conference more efficient and effective. If a Regulatory
Conference is held, it will be open for public observation, and will require Public Notice. If you
decide to submit only a written response, your submittal should be sent to the NRC within
30 days of the receipt of this letter.
Please contact Jeffrey Clark at (817) 860-8147 within 10 business days of the date of the
receipt of this letter to notify the NRC of your intentions. If we have not heard from you within
Omaha Public Power District
- 3 -
10 days, we will continue with our significance determination and enforcement decision and you
will be advised by separate correspondence of the results of our deliberations on this matter.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for this inspection finding at this time. In addition, please be advised that the
characterization of the apparent violation described in the enclosed inspection report may
change as a result of further NRC review.
In accordance with Code of Federal Regulations, Title 10, Part 2.390 of the NRC's "Rules of
Practice," a copy of this letter and its enclosure will be available electronically for public
inspection in the NRC Public Document Room or from the Publicly Available Records (PARS)
component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web
site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
A. Vegel, Deputy Director
Division of Reactor Projects
Docket: 50-285
License: DPR-40
Enclosure:
NRC Inspection Report 05000285/2006018
w/attachments: Supplemental Information; Significance Determination Evaluation
cc w/enclosure:
Joe l. McManis, Manager - Licensing
Omaha Public Power District
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 550
Fort Calhoun, NE 68023-0550
David J. Bannister
Manager - Fort Calhoun Station
Omaha Public Power District
Fort Calhoun Station FC-1-1 Plant
P.O. Box 550
Fort Calhoun, NE 68023-0550
James R. Curtiss
Winston & Strawn
1700 K Street NW
Omaha Public Power District
- 4 -
Washington, DC 20006-3817
Chairman
Washington County Board of Supervisors
P.O. Box 466
Blair, NE 68008
Julia Schmitt, Manager
Radiation Control Program
Nebraska Health & Human Services
Dept. of Regulation & Licensing
Division of Public Health Assurance
301 Centennial Mall, South
P.O. Box 95007
Lincoln, NE 68509-5007
Daniel K. McGhee
Bureau of Radiological Health
Iowa Department of Public Health
Lucas State Office Building, 5th Floor
321 East 12th Street
Des Moines, IA 50319
Omaha Public Power District
- 5 -
Electronic distribution by RIV:
Regional Administrator (BSM1)
DRP Director (ATH)
DRS Director (DDC)
DRS Deputy Director (RJC1)
Senior Resident Inspector (JDH1)
Resident Inspector (LMW1)
Branch Chief, DRP/E (JAC)
Project Engineer, DRP/E (JCK3)
Team Leader, DRP/TSS (FLB2)
RITS Coordinator (MSH3)
D. Cullison, OEDO RIV Coordinator (DGC)
ROPreports
FCS Site Secretary (BMM)
SUNSI Review Completed: _JAC__ADAMS: T YesG No Initials: _JAC___
T Publicly Available G Non-Publicly Available G Sensitive
T Non-Sensitive
R:\\_REACTORS\\FCS\\2006\\FC2006-18RP JDH.wpd
RIV:RI:DRP/E
SRI:DRP/E
C:DRP/E
SRA:DRS
D:DRS
LMWilloughby
JDHanna
JAClark
RLBywater
DDChamberlain
/RA/
/RA/
/RA/
/RA/
/RA/
2/21/07
2/21/07
2/21/07
2/22/07
2/23/07
DD:DRP sign
ACES
AVegel
MHaire
/RA/
/RA/
03/02/07
02/28/07
OFFICIAL RECORD COPY
T=Telephone E=E-mail F=Fax
Enclosure
-1-
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket:
50-285
License:
Report:
Licensee:
Omaha Public Power District
Facility:
Fort Calhoun Station
Location:
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 399, Highway 75 - North of Fort Calhoun
Fort Calhoun, Nebraska
Dates:
October 10 through February 13, 2007
Inspectors:
J. Hanna, Senior Resident Inspector
L. Willoughby, Resident Inspector
Approved By:
A. Vegel, Deputy Director, Division of Reactor Projects
Enclosure
-2-
SUMMARY OF FINDINGS
IR 05000285/2006018; 10/10/2006 - 02/13/2007; Fort Calhoun Station; Other Activities.
This report documents the NRCs inspection of circumstances related to one train of
containment spray being inoperable for 454 days. The baseline inspection activities were
conducted by resident inspectors. The inspection identified one finding whose preliminary
safety significance was determined to be low to moderate (White). The final significance of
most findings is indicated by their color (Green, White, Yellow, or Red) using NRC Inspection
Manual Chapter 0609, Significance Determination Process. The NRC's program for
overseeing the safe operation of commercial nuclear power reactors is described in NUREG-
1649, Reactor Oversight Process, Revision 3, dated July 2000.
A.
NRC-Identified Findings and Self-Revealing Findings
Cornerstone: Mitigating Systems
TBD. The team identified an apparent violation of 10 CFR Part 50, Appendix B,
Criterion V, for the licensees failure to prescribe adequate procedures for
maintenance and testing on containment spray header isolation Valve HCV-345
which led to exceeding a Technical Specification allowed outage time. This
issue was self revealed on September 13, 2006, when reactor coolant water
issued from the containment spray header indicating that either Valve HCV-344
or Valve HCV-345 was not properly seated. The failure to perform adequate
maintenance and testing for this component resulted in one train of containment
spray being inoperable from May 11, 2005 to September 9, 2006, a period of
454-days. This exceeded the Technical Specification 2.4(2) allowed outage time
of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> when the reactor is critical.
The issue was more than minor because it affected the equipment performance
attribute of the Mitigating System Cornerstone due to the impact on availability
and reliability of the containment spray system. The finding was preliminarily
characterized under the significance determination process as having low to
moderate safety significance (White) because one train of containment spray
was left in a condition contrary to its design and may have represented a bypass
flow path from the reactor coolant system during an accident condition. This
condition was entered into the Omaha Public Power Districts corrective action
program as Condition Report 200604627. Valve HCV-345 was repaired by the
licensee and is no longer safety concern. The finding has a crosscutting aspect
in the area of human performance, specifically resources, in that complete and
accurate procedures and work packages were not provided (Section 4OA5.5).
B.
Licensee-Identified Violations
None.
Enclosure
-3-
REPORT DETAILS
4.
OTHER ACTIVITIES
4OA5 Other Activities
1.
Background of Maintenance History
During the Spring 2005 Refueling Outage, Omaha Public Power District (OPPD)
performed work on the containment spray header isolation Valves HCV-344(A Header)
and HCV-345 (B Header) to address inconsistent operation identified during previous
testing. On three separate occasions Valve HCV-345 was removed from the system,
disassembled, reassembled, and returned to the system.
The function of the containment spray system is to limit the containment pressure rise
and reduce the leakage of airborne radioactivity from the containment following a
loss-of-coolant accident (LOCA) by providing a means for cooling the containment. This
system reduces the leakage of airborne radioactivity by effectively removing radioactive
particulates from the containment atmosphere. Pressure reduction is accomplished by
spraying cool, borated water into the containment atmosphere, which provides a means
for cooling the containment atmosphere. Heat removal is accomplished by recirculating
and cooling the water through the shutdown cooling heat exchangers. The system is
independent and redundant to the containment air cooling and filtering system.
Removal of radioactive particulates is accomplished by spraying water into the
containment atmosphere. The particulates become attached to the water droplets,
which fall to the floor and are washed into the containment sump.
During the Fall 2006 Refueling Outage, the licensee inspected the valve seat rings, in
part, to determine why reactor coolant water had leaked past the valve and had filled the
spray headers inside containment. While performing this maintenance, the system
engineer determined that the valve disk for Valve HCV-345 was installed nearly
90 degrees out of alignment. Actual valve position, while the valve was in this condition,
was nearly opposite of the remotely indicated position. The resultant effect would be
that if the valve indicated shut (the normal position of the valve) it would in fact be
approximately 66 percent open. Conversely, if the valve received a valid demand signal
to open (the safety position of the valve), it would be approximately 80 percent shut.
The time line below describes the major events and the maintenance history that
resulted in Valve HCV-345 being installed incorrectly and not discovered until
October 2006.
February 26, 2005
Refueling Outage 22 started.
March 17, 2005
Valves HCV-344 and HCV-345 removed from service and
repacked per Work Order (WO) 178429-04 (1st occurrence).
March 25, 2005
Valves HCV-344 and HCV-345 reinstalled in the system.
Enclosure
-4-
May 3, 2005
Valves HCV-344 and HCV-345 removed from service and
repacked per WO 205692-01 (2nd occurrence).
May 6, 2005
Valves HCV-344 and HCV-345 are reinstalled in the system.
May 7, 2005
Postmaintenance test of Valve HCV-345 identified that the valve
did not stroke smoothly. Additionally, the drive shaft was
protruding due to an incorrectly installed split ring retainer from
the second installation, which prevented reinstallation of the cover
plate.
May 9, 2005
Valve HCV-345 removed from service per WO 205692-01
(3rd occurrence). Improperly installed split ring retainer corrected
and valve reinstalled in the system. During work the incorrect
orientation between the drive shaft and the ball was introduced.
May 11, 2005
Work Order 205692 is completed and Valve HCV-345 returned to
service.
May 30, 2005
Criticality achieved following Refueling Outage 22 and the unit
recommences power operation.
June 4, 2005
Outage is started to replace degraded seals on Reactor Coolant
Pumps A and B, which may have represented an opportunity to
identify the incorrectly installed valve.
June 13, 2005
Criticality achieved following reactor coolant pump seal
replacement outage and the unit recommences power operation.
April 29, 2006
Outage is started to replace a degraded seal on Reactor Coolant
Pump D, which may have represented an opportunity to identify
the incorrectly installed valve.
May 6, 2006
Criticality achieved following reactor coolant pump seal
replacement outage and the unit recommences power operation.
September 9, 2006
Refueling Outage 23 started.
September 13, 2006 Reactor coolant water issues from the containment spray
October 5, 2006
Work Order 234358-01 is processed to replace the seat ring on
Valve HCV-345.
October 6, 2006
Valve HCV-345 is removed from the system.
October 10, 2006
System Engineer identified Valve HCV-345 assembled incorrectly
and Condition Report 200604627 is written.
Enclosure
-5-
2.
Cause Determination
The inspectors reviewed the accuracy and thoroughness of the licensee cause
determination as represented in the lincesees Root Cause Analysis Report, Violation of
Technical Specification 2.4.(1)a.iv. The Reactor Was Made Critical without the
Minimum Required Operable Components.
The HCV 345 containment spray header isolation valve has a Fisher Type 657-8
diaphragm actuator and a Fisher Type U-1009 internal component including a Vee-Ball
disk within the valve. The disk is a wedge-shaped cross-section spanning an arc of 101
degrees. Along the disks axis of rotation is a drive shaft that extends through the valve
packing. On one end of the drive shaft are 16 splines that connect the drive shaft to a
lever arm. The arm is pinned to a rod that is driven by the air-operator. In this manner,
the vertical motion of the air diaphragm and valve shaft are converted to rotational
motion of the ball disk, which should either allow or block flow. Proper operation of the
valve depends upon two critical orientations: (1) the position of the Vee-Ball disk
relative to the splined drive shaft, and (2) the position of the drive shaft to the lever arm.
During the Spring 2005 refueling outage, maintenance was performed on Valve
HCV-345 three times in accordance with Procedure PE-RR-VX-0401S, Inspection and
Repair of Fisher 300U/300UR Control Valves, Revision 2. The procedure directed
maintenance personnel to mark the valve shaft to ensure proper alignment when
reassembled. The first activity repacked the valve, and while it initially passed its
pressure test, the packing started leaking the following day. The licensee then decided
to install a different style of packing material. On the second disassembly to install the
new packing, the split ring retainer was installed incorrectly. This prevented the drive
shaft from being fully inserted into the Vee-Ball disk and necessitated a third
disassemble of the valve. During the third and final disassembly/reassembly, the drive
shaft was inserted into the Vee-Ball disk without ensuring that the orientation matched
that found during disassembly. This resulted in the actual position of the valve being
nearly opposite of the indicated position. Following reassembly and completion of the
work package, Valve HCV-345 was returned to service.
The licensee identified that two failures had occurred. The first was that Valve HCV-345
was installed incorrectly. The licensee identified that the maintenance
Procedure PE-RR-VX-0401S, Inspection and Repair of Fisher 300U/300UR Control
Valves, Revision 2 allowed flexibility of performing selected portions of the procedure
and did not specify risk important steps that could impact final valve alignment. This
was the root cause of the incorrect assembly. A contributing cause was that the
maintenance personnel who annotated the step as not applicable, did not recognize
the importance of proper alignment between the drive shaft and disk, or believed
(incorrectly) that installing the drive shaft with the packing box achieved the same result.
The second failure that was identified by the licensee was that postmaintenance testing
failed to identify the incorrect assembly. The licensee determined that maintenance
personnel had relied on an inadequate procedure without detailed acceptance criteria or
verifications to ensure proper valve operation. This was the root cause as to why the
postmaintenance test failed to identify the incorrect assembly. A contributing cause was
Enclosure
-6-
that misleading markings may have been used to assess the valve position, as opposed
to direct observation of the ball disk. Specifically, the many numerous match marks on
the valve may have been confusing to the maintenance personnel.
The inspectors concluded that the causes identified by the licensee appeared correct
and were achieved through a rigorous review of the circumstances surrounding the
event.
3.
Corrective Actions Taken Following Discovery of Condition
Following discovery of the misaligned valve condition, the licensee instituted or had
planned a number of corrective actions including:
Revised Procedure PE-RR-VX-0401S, Inspection and Repair of
Fisher 300U/300UR Control Valves, to reference manufacturers index marks
and remove direction to add additional match marks during disassembly.
Revised Procedure PE-RR-VX-0401S, Inspection and Repair of
Fisher 300U/300UR Control Valves, to provide acceptance criteria on verifying
the valve open or closed as part of final reassembly and explicitly identify these
steps as postmaintenance testing.
Revised Procedure PE-RR-VX-0401S, Inspection and Repair of
Fisher 300U/300UR Control Valves, to change the format of the procedure to
allow partial performance such as during a packing replacement.
Revised Procedure PE-RR-VX-0401S, Inspection and Repair of
Fisher 300U/300UR Control Valves, to annotate risk-important steps (such as
verification of valve position, i.e., postmaintenance test) and include a second
verifier for these steps.
Identification of all safety related air operated ball and butterfly valves,
determination if any risk-important steps in the associated procedures required
annotation and second verification, and/or verified that adequate post-
maintenance testing existed with appropriate acceptance criteria. Inadequate
procedures were to be revised.
These corrective actions were scheduled to be completed on/before February 28, 2007.
The licensee also identified a number of enhancements that would not necessarily
correct the condition or prevent recurrence, but would improve the maintenance
program for these components. The inspectors noted that the following additional
actions related to the misaligned valve condition had been taken or were planned:
Evaluated the need for acquiring a mock-up of the HCV-345 valve for use in
training personnel.
Enclosure
-7-
Revised the Steamfitter Mechanic Training Program Master Plan to require Just-
In-Time Training prior to outages where shutdown cooling heat exchanger outlet
temperature control Valves HCV-341, HCV-344 or HCV-345 were going to be
disassembled. (Please refer to Section 4OA5.4 below for a discussion of extent
of condition and why these specific valves were identified).
Evaluated whether work on valves similar to Valve HCV-345 should be treated
as a separate training qualification.
Included lessons learned from this event in the applicable training lesson plan for
this model valve.
The inspectors found that the aforementioned corrective actions and enhancements
appeared to be technically acceptable and appropriate. Though the inspectors were
unable to predict with certainty the effectiveness of the corrective actions, the inspectors
verified that the specified actions were planned or had been performed by the licensee
at the completion of the inspection.
4.
Extent of Condition Review
The inspectors evaluated the licensees extent of condition review, specifically as it
related to maintenance of other similar valves. This evaluation was performed to ensure
that valves, or other components, that might have been subject to the same failure
mechanism, were identified and corrected. The licensee identified three factors or
precursors that contributed to the incorrect assembly of the valve. These included:
Procedures that allowed performing certain steps for flexibility and to support
differing work scopes.
Risk important steps were not annotated in the procedures to provide a barrier
when selecting steps to support a specific task.
Equipment allowing alternate orientations for assembly (e.g., multiple splines on
a shaft rather than a keyway, which would permit only one configuration).
The licensee reviewed maintenance procedures and components where all of the
aforementioned elements might exist and lead to a similar failure. The licensee
concluded that there was a low probability of these elements existing with respect to
other components. Further, only three valves were identified as having a similarly
designed shaft with multiple splines: Valves HCV-341, HCV-344, or HCV-345.
Maintenance similar to that performed on Valve HCV-345 had been performed on
Valve HCV-344 during the Spring 2005 refueling outage. On October 12, 2006, the
licensee verified by direct visual inspection that Valve HCV-344 was installed correctly.
A review of maintenance history records showed that Valve HCV-341 had never been
removed from the system. Additional proof that Valve HCV-341 was correctly aligned
was that this component was used to align the shutdown cooling system for continuous
cooling of the core during the most recent refueling outage.
Enclosure
-8-
The licensee also reviewed the extent of condition for the failure of the post-
maintenance test to identify the incorrect assembly. Specifically, maintenance practices
were reviewed to determine if a successful postmaintenance test could be challenged by
the failure of a single individual performing a risk important step. The licensee
concluded that a concern existed, which was limited to the three valves mentioned
above, nonsafety related pumps, and air operated ball and butterfly valves that are not
containment isolation valves. The licensee developed corrective actions to address the
extent of condition concern. (Please refer to Section 4OA5.3 of this report for a full
description).
The inspectors reviewed the completed work orders on Valves HCV-344 and HCV-341
to ensure that during the most recent work on the components that the same failure
mechanism was not introduced. The inspectors concluded that the licensees extent of
condition reviews were adequate to ensure that similar conditions did not exist
elsewhere in the plant.
5.
Maintenance Program
a.
Inspection Scope
The inspectors reviewed the licensees program for maintenance and inspection of
pneumatically operated ball or butterfly valves, particularly as it related to the
misalignment of Valve HCV-345 internals. The inspectors also examined the
inspection/assessment techniques, scope, periodicity, and a sample of past inspection
results. These reviews were conducted in order to assess the appropriateness of
assigned postmaintenance testing for the scope of work performed.
b.
Findings
Introduction. An apparent violation of 10 CFR Part 50, Appendix B, Criterion V,
Instructions, Procedures, and Drawings, was identified for the licensees failure to
prescribe adequate procedures for maintenance and testing on containment spray
header isolation Valve HCV-345, which led to exceeding a Technical Specification
allowed outage time. This issue was self-revealed on September 13, 2006, when
reactor coolant water issued from the containment spray headers indicating that either
Valve HCV-344 or HCV-345 was not properly seated. The failure to prescribe adequate
procedures for maintenance and testing for this component resulted in one train of
containment spray being inoperable from May 11, 2005 to September 9, 2006, a period
of 454-days. This exceeded the Technical Specification 2.4(2) allowed outage time of
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> when the reactor is critical.
Description. On September 9, 2006, the licensee shutdown the plant in order to
commence Refueling Outage 23. On September 11, 2006, the licensee placed the
shutdown cooling system in service to maintain cooling to the core. With this system in
service, the two header isolation valves should prevent reactor coolant system water
from entering the containment spray headers. On September 13, 2006, reactor coolant
water issued from the containment spray headers indicating that either Valves HCV-344
or HCV-345 were leaking. The licensee initiated work requests to evaluate the seat
Enclosure
-9-
rings of Valve HCV-345. On October 10, 2006, a system engineer identified that the
valve was assembled incorrectly and Condition Report 200604627 was written.
The inspectors identified several weaknesses in the maintenance and testing of
Valves HCV-344 and HCV-345. Specifically, (1) though it was impractical to flow
borated water to the containment spray headers following maintenance, these valves
could have been tested using alternate means, (2) no independent verifications were
performed during either the maintenance or subsequent testing, (3) the maintenance
procedure allowed the flexibility to mark steps as Not Applicable, and (4) the procedure
did not explicitly state which steps were de facto required postmaintenance testing and
the importance of performing them correctly.
The inspectors determined that the postmaintenance testing performed following valve
disassembly, packing adjustment and reassembly was inadequate to identify the
misalignment of the valve internals. The postmaintenance testing requirements in
Procedure PE-RR-VX-0401S, Inspection and Repair of Fisher 300U/300UR Control
Valves, Revision 2, specified actions such as calibration of the valve actuator and
performance of a valve actuator test. However, these steps would not have detected
the condition that was present (i.e., valve internals installed backwards). The licensee
relied on the aforementioned procedure to perform both the maintenance and
postmaintenance testing without detailed acceptance criteria or independent
verifications. The inspectors determined that the failure to have an adequate
postmaintenance test constituted an apparent violation of NRC requirements.
Analysis. The inspectors assessed this issue using the Significance Determination
Process (SDP). The inspectors concluded that the licensees failure to prescribe
adequate proceures for maintenance and postmaintenance testing was reasonably
within the licensees ability to foresee and correct, should have been prevented and thus
constituted a performance deficiency. The failure to prescribe an adequate procedure
for a postmaintenance test on Valve HCV-345 resulted in Containment Spray Train B
being inoperable from May 11, 2005, to September 9, 2006, a period of 454-days. The
issue was more than minor because it affected the equipment performance attribute of
the Mitigating System Cornerstone due to the impact on availability and reliability of the
containment spray system. This finding has a crosscutting aspect in the area of human
performance, specifically resources, in that complete and accurate procedures and work
packages were not provided.
Though this condition was introduced while the plant was shutdown and likewise was
discovered during a shutdown condition, the inspectors concluded that the condition
should be reviewed using Inspection Manual Chapter 0609, Appendix A, Determining
the Significance of Reactor Inspection Findings for At-Power Situations. This decision
was based on the condition existing during and having safety significance (i.e., an
adverse affect on systems responding to an accident) while at power.
Details of the Phase 2 evaluation and a Phase 3 SDP analysis are documented in
Attachment 2. The preliminary results were that the finding was of low to moderate
safety significance. The most significant contribution to the increase in risk involved
accident scenarios where shutdown cooling was placed in service when containment
Enclosure
-10-
sump recirculation was not required. This would result in a flow diversion from the
reactor coolant system through the containment spray header that required operators to
diagnose and act upon.
Enforcement:
10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings,
states, in part, that activities affecting quality shall be prescribed by documented
instructions, procedures, or drawings of a type appropriate to the circumstances and
shall be accomplished in accordance with these instructions, procedures, or drawings.
Contrary to this, the licensee failed to develop appropriate instructions or procedures for
maintenance activities, and post maintenance testing, on Valve HCV-345. This failure
resulted in one train of containment spray being inoperable from May 11, 2005 to
September 9, 2006, a period of 454 days. This item has been entered into the
licensees corrective action program as Condition Report 20064627. Pending
determination of final safety significance, this finding is identified as an apparent
violation (AV)05000285/2006018-01, Violation of 10 CFR 50, Appendix B Criterions for
Failure to Prescribe Adequate Procedures for Maintenance and Testing.
(Section 40A5.5)
6.
Operability of Valve HCV-345 Following Repair Activities
The inspectors reviewed the documented test data, including photographs of the as-left
condition of the valve, to verify that the testing was complete and that the equipment
was able to perform the intended safety function. No issues or concerns were identified.
7.
Potential Common Failure Modes and Generic Safety Issues
The inspectors performed searches of operating experience (OE) databases and other
sources. The intent was to identify OE reports of similar problems, both within and
outside of the nuclear industry. Through a review of the licensees condition reporting
system, the inspectors identified one instance of relevant information that was not
discovered by the licensee prior to the time that the condition was introduced in the
Spring 2005 outage. This involved a Fisher Information Notice 2002-01, Fisher Type
SS-84 Vee-Ball Seat Leakage Information, which described a possible misalignment
of the internal components. Specifically it stated, If the connections between the lever
and valve shaft or the valve shaft and Vee-Ball are not correctly aligned, there is a
possibility that the Vee-Ball will not be correctly positioned to provide shutoff when the
actuator strokes to the closed position. This OE had been reviewed by the licensee
and deemed not applicable because it was a slightly different valve model. The
inspectors considered that the design of the components were similar to the U model
Fisher valves installed at Fort Calhoun Station. The inspectors found no other examples
of internal OE.
With respect to external OE, the inspectors identified three instances where Fisher
Vee-Ball valves were incorrectly assembled at other nuclear facilities. Two of these
occurrences, which happened during the 2004/2005 time frame, had also been
Enclosure
-11-
identified by the licensee through the reviews performed by the Root Cause Analysis
team responding to this event. For these two items, the licensee had entered the
information into their OE tracking system and assigned review of those items to
engineering personnel. In reviewing both OE items, the engineering staff incorrectly
concluded that the information was not relevant to the Fort Calhoun Station.
The inspectors found additional OE in the form of an Event Report from Vogtle Electric
Generating Plant - Unit 2. As described in Licensee Event Report 05000425/1989-031-
00, Heater Drain Tank Valve Reassembly Error Leads to Turbine/Reactor Trip, an
error involving reassembly of the valve led to the transient. The cause was described as
follows:
Since the valve was not to be removed from the line, the maintenance crew that
removed the actuator had match-marked the valve in the open position. A
second maintenance crew had rebuilt the actuator and reinstalled it using the
maintenance match marks. A third crew had tested the valve operation and
reinstalled the position indication to match the actuator piston position. After the
reactor trip, the maintenance match marks were checked and were found to
disagree with the valve position indication by 90º. It was then realized that a
reassembly error had occurred in that the actuator piston had been in the closed
position when the actuator was reinstalled . . .
The inspectors did not identify any documents that had evaluated this condition at the
Fort Calhoun Station. Though the inspectors noted that it would not have been
reasonable to expect a licensee to review all Licensee Event Reports issued from other
facilities for potential applicability, this event represented another example of improper
assembly of Fisher valves that had safety consequences.
The inspectors concluded that the licensee had missed multiple opportunities, some of
which were both recent and relevant, to identify the vulnerability to the possible
misalignment of Fisher valve internals.
4OA6 Meetings, Including Exit
A preliminary finding was discussed on December 21, 2006, with Mr. Jeff Reinhart, Site
Director, and other members of your staff. After additional in-office review, a final exit
meeting was conducted on February 13, 2007, with Mr. Reinhart and other members of
your staff. The inspectors confirmed that proprietary information was not provided
during the inspection.
Attachment
A1-1
ATTACHMENT 1: SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
D. Bannister, Plant Manager
B. Blome, Planning Manager
G. Cavanaugh, Supervisor, Regulatory Compliance
T. Dukarski, Manager, Alternate Chemistry
T. Giebelhausen, Probablistic Risk Analysis Tech
A. Hackerott, Supervisor, Probablistic Risk Analysis
A. Hansen, Operating Experience Coordinator
R. Haug, Manager, Radiation Protectio
J. Herman, Manager, Engineering Programs
R. Hohansen, Acting Division Manager, Nuclear Support
J. Kellams, Acting Corrective Action Program
J. McManis, Manager, Licensing
K. Melstad, Supervisor, maintenance
T. Nellenbach, Manager Operations
J. Reinhart, Site Director
C. Schaffer, Nuclear Safety Review Group
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
Violation of 10 CFR part 50, Appendix B, Criterion V
Instructions Procedures, and Drawings for failure to
Prescribe Adequate Procedures Maintenance and Testing.
(Section 4OA5.5)
LIST OF DOCUMENTS REVIEWED
USAR Section 6.0, Engineered Safeguards
USAR Section 9.3, Shutdown Cooling
Preventative Maintenance records for Valves HCV-344 and HCV-345
Procedure PE-RR-VX-0401S, Inspection and Repair of Fisher 300U/300UR Control Valves,
Revision 2
Procedure OP-ST-SI-3002, Safety Injection System Category A, B, and C Valve Exercise
Test, Revision 24
Attachment
A1-2
Procedure OP-ST-VX-3019, Safety Injection System Remote Position Indicator Verification
Surveillance Test, Revision 15
Work Order 00205692-01, Rebuild/Replace Packing - HCV-345"
Work Order 00229974-01, Replace IA-HCV-341-B1 Tie-Wraps with Tube Clamps
Work Order 00200552-01, HCV-341: Clean Boric Acid from Affected Areas
Work Order 00206035-01, Rebuild/Replace Packing - HCV-344"
Root Cause Analysis Report, Violation of Technical Specification 2.4.(1)a.iv The Reactor Was
Made Critical without the Minimum Required Operable Components
Reactor Plant Event Notification Worksheet for Event #42512, dated April 19, 2006
Reactor Plant Event Notification Worksheet for Event #42896, dated October 10, 2006
Licensee Event Report 05000285/2006-005, Faulty Maintenance Renders One Train of
Condition Reports:
CR 200604627
CR 200604695
CR 200605311
CR 200605315
CR 200605348
CR 200605350
CR 200605352
Maintenance Rule Cause Determination 08190610 for Condition Report 200604695
System Training Manual, Volume 15, Emergency Core Cooling System, Revision 35
LIST OF ACRONYMS
CFR
Code of Federal Regulations
CR
Condition Report
Loss-of-Coolant Accident
operational experience
NRC
Nuclear Regulatory Commission
Significance Determination Process
Updated Safety Analysis Report
work order
Attachment
A2-1
ATTACHMENT 2:
SIGNIFICANCE DETERMINATION EVALUATION
Significance Determination Process Phase 2 Risk Estimation:
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, User Guidance
for Determining the Significance of Reactor Inspection Findings for At-Power
Situations, the inspectors evaluated the subject finding using the Risk-Informed
Inspection Notebook for Fort Calhoun Station, Revision 2 (The Phase 2 Notebook).
The inspectors and a senior reactor analyst discussed the applicability of worksheets in
the Phase 2 Notebook. Modifications were required. In particular, the licensee's risk
analysis staff identified a potentially significant initiating event involving an interfacing
system LOCA (ISLOCA) from failure of a reactor coolant pump (RCP) seal cooler. The
senior reactor analyst determined that this initiator could be modeled by using the
ISLOCA worksheet of the Phase 2 Notebook with a transfer to the SLOCA worksheet.
Therefore, a "Modified" Phase 2 SDP risk estimation was performed as described
below.
Modified Significance Determination Process Phase 2 Risk Estimation:
Risk Estimation with Containment Spray (CS) Train B Not Functional
The following assumptions were made:
Containment Spray (CS) Train B was not functional with the internals of
Valve HCV-345 installed incorrectly. The licensee's Root Cause investigation
determined that with closed indication, the valve was approximately 66 percent
open; and, with open indication, the valve was only about 20 percent open. For
this analysis, no containment temperature or pressure control credit was given
for any reduced flow through the partially-open valve. The licensee
subsequently performed a thermal-hydraulic analysis to demonstrate success of
the Train B CS system with degraded flow from a 20-percent open valve. This
will be addressed later.
The exposure time was determined by identifying the length of time the CS
system was required to be operable from May 11, 2005, when Valve HCV-345
was assembled incorrectly, to October 10, 2006, when the condition was
discovered. The resulting exposure time was 454 days. Therefore, the greater
than 30 days exposure window was used in Table 1 of the SDP Notebook to
determine the Initiating Event Likelihood (IEL).
Table 2, "Initiators and System Dependency," of the Phase 2 Notebook required
that all Initiating Event Scenarios be evaluated except for Steam Generator Tube
Rupture (SGTR), Anticipated Transient Without Scram (ATWS), and Loss of
Raw Water (LRW). The inspectors and analyst determined that exclusion of
SGTR was a typographical error in the Phase 2 Notebook because CS was a
credited safety function for mitigating a SGTR. Therefore, the SGTR worksheet
was solved.
Attachment
A2-2
Train B of CS was associated with 125 VDC Bus 2. Therefore, when the Loss of
125 VDC Bus 1 (LCDBUS1) worksheet was solved, the remaining mitigation
capability for the CS function was zero. When the Loss of 125 VDC Bus 2
(LDCBUS2) worksheet was solved, the sequence involving the CS function was
included at its base-case value to reflect the reduction in system reliability.
The Component Cooling Water (CCW) system provides cooling water to the
Containment Air Cooling and Filtering System. This CCW flow is divided among
four cooling units in two trains. CCW is supplied to the VA-1A and VA-1B
cooling coils of the Containment Cooling and Filtering Units (VA-3A and VA-3B)
and the VA-8A and VA-8B cooling coils of the Containment Cooling Units
(VA-7C and VA-7D). The containment pressure and temperature control safety
function provided by the Containment Air Cooling and Filtering System is
redundant to the CS system.
The Raw Water (RW) system is a backup for most of the components supported
by the CCW system, including the containment cooling coils. However, the
licensee does not credit RW for success of containment cooling. The lower
pressure of the RW system when supplied to the containment coolers may result
in two-phase flow and inadequate heat removal capabilities. Therefore, RW
backup to the containment cooling coils was not credited for success of
containment temperature and pressure control but it was credited for successful
cooling of the ECCS pumps and the SDC heat exchangers.
The CCW system provides cooling to the reactor coolant pump (RCP) thermal
barrier and integral heat exchanger for controlled bleedoff flow seal cooling. The
licensee's system training manuals state that on an RCP seal cooler heat
exchanger tube rupture, an ISLOCA can occur in the auxiliary building due to
transfer of reactor coolant to the CCW system. This high-pressure fluid was
expected to rupture the CCW surge tank and cause loss of CCW function. In
this event, operators are instructed to close the CCW containment supply and
return isolation valves to the RCP seal coolers (HCV-438A/B/C/D). Closure of
these valves would terminate the ISLOCA outside of containment but was
expected to result in a SLOCA inside of containment because of failure of the
150 psig (design pressure) CCW system piping. The licensee's PRA estimated
that the frequency of an RCP seal cooler tube failure was 3E-4/yr. Therefore,
the analyst modeled this event as equivalent to a SLOCA with IEL = 4. The
remaining mitigation capability credit for containment temperature and pressure
control was estimated as a single train system, represented by the remaining
functional CS Train A' (CNT = 2).
No credit was given for operator recovery of the failed CS Train B. Recovery of
the failed train required repair of HCV-345, which did not meet the acceptance
criteria for operator recovery credit.
An interface exists between the CS and low-pressure safety injection (LPSI)
systems because both systems can use the SDC heat exchangers. During a
normal shutdown and transition to SDC, operators enter containment and close
Attachment
A2-3
CS manual isolation Valves SI-177 and SI-178 to preclude SDC flow from
entering the CS headers and spraying the containment if leakage existed
through Valves HCV-344 or HCV-345. However, if an accident occurred that
involved operators initiating SDC prior to a recirculation actuation signal (RAS) in
accordance with Emergency Operating Procedure (EOP) Attachment 4, "SDC
Without RAS," the finding had the potential to create a flow diversion from the
RCS. The manual valves are not closed during implementation of Attachment 4.
Remotely-operated Valves HCV-344 and HCV-345 would be closed and relied
upon for providing isolation of SDC from the CS headers. When operators
initiated SDC, flow would be diverted from the RCS through the CS header and
unavailable for core cooling even though Valves HCV-344 and HCV-345 had
been closed. This flow diversion to the CS header is assumed to fail the SDC
function. However, the Phase 2 Notebook does not credit the SDC safety
function for mitigating any initiating events and is not evaluated further in
this Modified Phase 2 analysis. It will be addressed later.
Modified Phase 2 Analysis Results Internal Events:
Using the above assumptions, the Modified Phase 2 Analysis results for the non-
ISLOCA initiator worksheets are shown below.
SEQUENCE
REMAINING MITIGATION
CAPABILITY RATING
RECOVERY
CREDIT
RESULTS
TRANS-PCS-AFW-CNT
1
3+5+5
0
14
TPCS-AFW-CNT
1
3+5
0
9
SLOCA-CNT
3
5
0
8
SORV-BLK-CNT
4
2+5
0
11
MLOCA-CNT
4
4
0
8
LLOCA-CNT
5
4
0
9
LOOP-AIAFW-MDAFW-
CNT
2
3+2+5
0
12
SGTR-SHR-CNT
3
7+5
0
15
MSLB-MSIV2-AFW-CNT
3
2+5+5
0
15
SEQUENCE
REMAINING MITIGATION
CAPABILITY RATING
RECOVERY
CREDIT
RESULTS
LDCBUS1-AFW-CNT
3
2+2
0
7
LDCBUS2-AFW-CNT
3
5+4
0
12
LCCW-AFW-CNT
3
3+5
0
11
LCCW-SEAL-CNT
3
4+5
0
12
LCCW-RCPTRIP-CNT
3
3+5
0
11
Attachment
A2-4
LIA-AFW-CNT
2
3+5
0
10
The Modified Phase 2 analysis results for the RCP seal cooler ISLOCA initiator are
shown below.
SEQUENCE
REMAINING MITIGATION
CAPABILITY RATING
RECOVERY
CREDIT
RESULTS
SLOCA-CNT
4
2
0
6
Using IMC 0609, Appendix A, Attachment 1, Table 5, Counting Rule Worksheet, the
summation of the non-ISLOCA and the ISLOCA sequences is equivalent to one
sequence with a risk significance equal to 6. Therefore, the Modified Phase 2 SDP
Analysis result of the risk significance of this finding due to internal events is of low-to-
moderate safety significance (White).
Modified Phase 2 Analysis - Large Early Release Frequency (LERF)
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, Step 2.6,
"Screening for the Potential Risk Contribution Due to LERF," the analyst reviewed the
core damage sequences to determine an estimate of the change in LERF caused by the
finding.
The analyst considered the RCP seal cooler failure with ISLOCA outside of containment
initiator to be part of the plant's baseline risk, up to the point of when the ISLOCA was
isolated to the containment. From that point, the event transferred to the SLOCA event
tree, which did not result in a sequence causing a change in LERF. The only other
sequence considered applicable for LERF was one SGTR sequence, but it was a
negligible contributor. Therefore, for the Modified Phase 2 SDP risk estimation this
finding was considered not significant with respect to an increase in LERF.
Modified Phase 2 Analysis - External Events
In accordance with Inspection Manual Chapter 0609, Appendix A, Attachment 1,
Step 2.5, "Screen for the Potential Risk Contribution Due to External Initiating Events,"
experience with using the Site Specific Risk-Informed Inspection Notebooks has
indicated that accounting for external initiators (fire, flooding, severe weather, seismic,
or others) could result in increasing the risk significance attributed to an inspection
finding by as much as one order of magnitude.
The Modified Phase 2 Analysis result met the criterion for consideration of risk
contribution due to external events (risk estimation increase greater than or equal to
1E-7 per year). Although the Phase 2 Notebook for Fort Calhoun Station does not
currently include external events, the analyst and inspectors qualitatively reviewed
external event applicability. The results of this review were that fire events may be
applicable. However, the fire events were limited to affecting the SDC function, which
was not evaluated in the Modified Phase 2 analysis. Therefore, the contribution due to
external events for the Modified Phase 2 analysis was assumed to be negligible and the
Attachment
A2-5
preliminary significance determination could be represented solely by the contribution
from internal events.
Consideration of Reduced CS Flow vs. Zero CS Flow on Success of CNT Function
(Modified Phase 2 Analysis with CS Train B Functional)
The licensee informed the analyst that the MAAP accident analysis code was used to
evaluate plant response to a severe accident using the as-found configuration (20-
percent open) of Valve HCV-345 with reduced CS flow. The results of these analyses
were documented in PRA Modeling Position White Paper CCF 107-001, Impact of the
HCV-345 Mis-Installation on Containment Performance During Severe Accidents. The
licensee concluded the as-found condition of Valve HCV-345 would provide sufficient
CS flow to mitigate a LLOCA, even with no containment coolers or CS flow from the
unaffected CS Train A. This analysis was not reviewed by NRC staff. However,
HCV-345 is a ball valve, and qualitatively would be expected to allow a significant
fraction of its fully-open flow even if it were only 20-percent open.
Assuming the licensees analysis was correct, the CS system would receive multi-train
credit when determining remaining mitigation capability credit for the CNT safety
function. This additional credit added a 1" to each of the sequence results obtained
above. Therefore, the Modified Phase 2 Analysis result for internal events was
equivalent to one sequence with a risk significance equal to 7, which is a Green result.
As described previously, the SDP Phase 2 Notebook did not include a means to assess
findings affecting the SDC safety function. This finding was determined to not only
affect the performance of CS, but also the performance of SDC if it was initiated in an
accident without a RAS. Therefore, a Phase 3 SDP Analysis was required to address
this impact.
Phase 3 SDP Analysis: Consideration of Additional Severe Accident Scenarios Involving
Initiation of SDC When a RAS Has Not Occurred
The licensee identified that a flow diversion path would be created from the RCS to the
CS header if SDC were placed in service without having closed the inside-containment
manual isolation valves. When Valve HCV-345 was closed by the control room
operator, it would have indicated closed but have remained 66 percent open. For
events that required the operators to initiate SDC when a RAS had not occurred, a flow
diversion from the RCS through the CS header would fail the SDC function. The
licensee's analysis is documented in a white paper, Severe Accident (PRA) Perspective
Regarding Improper Positioning of Containment Spray Header Isolation
Valve HCV-345."
The licensee performed a screening review to determine what initiating events were
likely to progress to SDC initiation without having previously resulted in a RAS. For
those events, the operators would be directed to implement EOP/AOP Attachment 4,
SDC Without RAS. The results of the screening review were:
For LLOCAs and MLOCAs, SDC will not be initiated prior to a RAS. Therefore,
Attachment
A2-6
they were excluded.
For SLOCAs with HPSI flow greater than 220 gpm, the licensees analysis
concluded that at the time the SDC suction valves were opened, HPSI flow was
already sufficient to prevent core damage with no additional operator actions.
For SLOCAs with HPSI flow < 220 gpm and for SGTR and MSLB/FWLB events,
the licensees analysis concluded that at the time the SDC suction valves were
opened, core damage would occur in 90 minutes if operators did not diagnose
the loss of inventory and take action to isolate the leak path. The licensee
determined that the frequency of these initiating events was 1.4E-2/year.
The licensee qualitatively screened out other initiating events from consideration.
They concluded it was improbable for other events to proceed to SDC without
RAS.
The analyst noted that EOPs to address other initiators (such as EOP-02, Loss of Off-
Site Power/Loss of Forced Circulation, and EOP-06, Loss of All Feedwater) contained
provisions to initiate SDC using EOP/AOP Attachment 4. Therefore, other initiators not
included in the licensee's assessment could add to the total risk. The analyst was not
able to verify the licensee's qualitative determination that the other initiators were not
probable.
The licensees analysis described the following evaluation for the severe accident
scenarios under consideration:
Once the operators had successfully achieved plant conditions to support
initiating SDC, they would begin to implement EOP/AOP Attachment 4. When
both SDC valves were opened from the RCS, the operators would be presented
with audible and visible cues that a loss of RCS inventory was occurring. Among
them were: pressurizer low level alarms and containment sump level alarms.
The crew would then diagnose that a loss of RCS inventory was taking place and
take action to terminate the inventory loss by closing a SDC suction valve.
Failure of both SDC suction valves to close due to common cause was
qualitatively considered in the licensees assessment but discounted. The
licensee concluded that should this occur, sufficient time was available to identify
and close another isolation valve, including manual valves. After terminating the
RCS inventory loss, heat removal could continue for an indefinite amount of time
using the steam generators. HPSI flow could be established if necessary.
The licensee performed a human reliability assessment to estimate the total human
error probability (HEP) for failing to diagnose the loss of inventory and act to stop it.
The licensees estimation used the NRCs SPAR-H Human Reliability Analysis Method
and is summarized as follows:
The licensee estimated that once the loss of inventory began, a maximum of
1 minute of delay time would exist prior to the visual and audible cues that a loss
of inventory was occurring. Then the licensee estimated that 1 minute would be
Attachment
A2-7
required to diagnose the problem and decide upon an action. Another 1 minute
was estimated for an operator to complete the required action to terminate the
loss of inventory. The total time available before core damage was 90 minutes.
The licensee assessed the SPAR-H performance shaping factors (PSF) for the
diagnosis and action components of this task, selected PSF multipliers, and
determined the task HEP without formal dependence as follows:
PSF
Diagnosis Multiplier
(Base = 0.01)
Action Multiplier
(Base = 0.001)
Available Time
Extra Time (0.1)
>=50x time required (0.01)
Stress
Nominal (1.0)
Nominal (1.0)
Complexity
Obvious Diagnosis (0.1)
Nominal (1.0)
Experience/Training
Nominal (1.0)
Nominal (1.0)
Procedures
Diagnostic/symptom oriented (0.5)
Nominal (1.0)
Ergonomics
Nominal (1.0)
Nominal (1.0)
Nominal (1.0)
Nominal (1.0)
Work Processes
Nominal (1.0)
Nominal (1.0)
SUBTOTAL
5.0E-5
1.0E-5
TOTAL
6.0E-5
Based on additional discussions the analyst had with the licensee regarding the HRA,
the licensee confirmed that HPSI would be available as a mitigation option if the SDC
flow diversion path was not terminated. HPSI would likely have been operating, and
throttled at the time SDC was initiated. The licensee considered the above HRA for
diagnosis/action to terminate the diversion path to be a simplification. Additional
diagnoses/actions would have further complicated the HRA. However, the licensee
stated that during this scenario, Safety Function Status Checks would have been
performed. One of the checks includes monitoring pressurizer level and restoring as
necessary. Monitoring HPSI stop and throttle criteria is a floating step in the EOPs. The
licensee stated that this is why they considered a "Nominal (1.0)" multiplier appropriate
for the Procedures - Action PSF.
The senior reactor analyst reviewed the licensees assessment and concluded that
some changes to the PSF multipliers selected by the licensee were needed. Using
NUREG/CR-6883 as a reference, the following changes were made:
Changed the Available Time PSF multiplier for Diagnosis to Expansive Time
because the average time for diagnosis was 1 minute, the time available was
greater than twice the average time, and was greater than 30 minutes.
Changed the Stress PSF multipliers for Diagnosis and Action to High. The
Attachment
A2-8
analyst assumed that the task would be performed in a condition of higher-than-
nominal stress, with multiple unexpected alarms at the same time, and that the
consequences of the task represent a threat to plant safety.
Changed the Procedures PSF multiplier for Action to Incomplete. EOP/AOP
Attachment 4 did not contain instructions for what response action the operator
should take to complete the task. Therefore, no credit for procedures could be
given for this task.
The analysts revised HEP assessment was as follows:
PSF
Diagnosis Multiplier
(Base = 0.01)
Action Multiplier
(Base = 0.001)
Available Time
Expansive Time (0.01)
>=50x time required (0.01)
Stress
High (2.0)
High (2.0)
Complexity
Obvious Diagnosis (0.1)
Nominal (1.0)
Experience/Training
Nominal (1.0)
Nominal (1.0)
Procedures
Diagnostic/symptom oriented (0.5)
Incomplete (20.0)
Ergonomics/HMI
Nominal (1.0)
Nominal (1.0)
Nominal (1.0)
Nominal (1.0)
Work Processes
Nominal (1.0)
Nominal (1.0)
SUBTOTAL
1.0E-5
4.0E-4
TOTAL
4.1E-4
The analyst requested peer review of the analysis by staff from the Office of
Nuclear Reactor Regulation. Some changes were proffered, particularly
involving the Procedures PSF multiplier for Action. The staff believed some
credit may be warranted for the Procedures PSF by crediting use of other
procedures (e.g., functional restoration procedures and initiation of emergency
core cooling). Although some reduction in the HEP would result from this
change, the operator actions would involve and require a diagnosis and action
approach different than the one explicitly analyzed here. This approach would
involve additional PSF multiplier changes for diagnosis and action that may
decrease available time, increase complexity, etc. Therefore, the staff
concluded the analyst's HEP assessment result was a reasonable estimate given
available information.
Phase 3 Analysis Conclusion for Severe Accident Scenarios Involving SDC to CS Flow
Diversion (Internal Events)
The increase in core damage frequency due to internal events associated with the
finding is estimated as the product of the initiating event frequency for events that result
in an RCS flow diversion when SDC is placed in service, times the HEP for the task of
Attachment
A2-9
diagnosing and terminating the loss of inventory.
The result using the licensees HEP estimate is:
1.4E-2/year * 6.0E-5 = 8.4E-7/year
The result using the analysts HEP estimate is:
1.4E-2/year * 4.1E-4 = 5.7E-6/year
Therefore, the preliminary significance of this finding due to the increase in core
damage frequency associated with internal events was determined to be of low to
moderate safety significance (White).
Phase 3 Analysis - External Events Assessment
The inspectors and senior reactor analyst qualitatively assessed the contribution due to
external initiators. The only contributor considered to potentially be significant was fire
scenarios. Valves HCV-344 and HCV-345 are on the licensee's safe shutdown
components list in the Fire Hazards Analysis. The valves are identified as having a
necessary function to close to prevent diversion of SDC flow through the CS headers.
The safe shutdown time line indicated that SDC would be established 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after a
fire event and therefore was not considered a time critical activity. The inspectors
determined that in a control room fire scenario, the licensee would be implementing
AOP-6, "Fire Emergency." AOP-6 identified the potential for spurious operation of
Valves HCV-344 and HCV-345 and proceduralized containment entry to close SI-177
and SI-178 prior to initiating SDC. In other fire scenarios, SDC would also be initiated
using normal system operating procedures which would specify containment entry to
close the manual isolation valves. Based on this discussion, the analyst considered that
fire events did not contribute to the risk significance of this finding. Other external
initiators were considered by the analyst to be negligible.
The licensee had not performed an assessment of external initiators at the time of this
analysis.
Phase 3 Analysis - LERF Assessment for Severe Accident Scenarios Involving SDC to
CS Flow Diversion
The increase in risk associated with LERF is considered if the increase in core damage
frequency is greater than 1E-7/year. Core damage sequences involving a SGTR
initiating event are important with respect to LERF and have a LERF multiplier of 1.
However, use of a LERF multiplier of 1 does not address that the SGTR sequences of
interest here would only include those where the SGTR was successfully mitigated to
the point of initiation of SDC. Therefore, the analyst believed the LERF multiplier would
be much less than 1. Following discussion with staff in the Office of Nuclear Reactor
Regulation, the analyst used a 0.1 LERF multiplier to estimate the significance of
Attachment
A2-10
sequences contributing to LERF.
To determine the contribution in risk due to LERF, the analyst used the frequency of
SGTR events from the licensee's PRA, multiplied times the HEP for SDC failure. Then,
this CDF for SGTR events was multiplied times the LERF multiplier to obtain the LERF
estimate.
For the licensees HEP estimate:
SGTR CDF = 5.91E-3/year * 6.0E-5 = 3.6E-7/year
With a LERF multiplier of 0.1, the increase in LERF is 3.6E-7/year * 0.1 =
3.6E-8/year
For the analysts HEP estimate:
SGTR CDF = 5.91E-3/year * 4.1E-4 = 2.4E-6/year
With a LERF multiplier of 0.1, the increase in LERF is 2.4E-6/year * 0.1 =
2.4E-7/year
Therefore, using the analyst's estimate, the risk significance of this finding with
respect to LERF is White because the result is greater than 1E-7/year.
Confirmatory Phase 3 Analysis Using the SPAR Model
Using the Fort Calhoun Station SPAR Model, Revision 3.31, the senior reactor analyst
attempted to independently model and quantify an increase in core damage frequency
due to the finding.
For simplicity, the analyst accepted the licensees assertion that degraded CS flow
through HCV-345 was sufficient for successful CS function. The ISLOCA initiator,
although it failed CCW and its containment cooling function, did not affect the
functionality of CS. The resulting LOCA inside of containment was assumed large
enough to require a RAS. Therefore, the RCP seal cooler failure and ISLOCA scenario
was eliminated from consideration.
Several of the initiating event trees in the SPAR model contained a top event for the
SDC function. The containment spray header isolation Valves HCV-344 and HCV-345
were included in the SPAR model for success of the CS function (required to open).
However, these valves were not included in the SPAR model for the SDC function
(required to close). Therefore, the SDC flow diversion path was not modeled in the
SPAR model. The analyst chose a SPAR model basic event that would fail the SDC
function as a surrogate for the need to model the flow diversion path. By inspection of
the initiating event trees and fault trees, the analyst determined failing the SDC heat
exchanger outlet valve HCV-341 closed would provide an acceptable surrogate for
modeling the SDC flow diversion scenario while allowing credit for high-pressure
injection and sump recirculation.
Attachment
A2-11
Basic Event SDC-AOV-CC-CLI, SDC Discharge AOV HCV-341, was set equal to
TRUE (failed closed). For a 1-year exposure time, the calculated importance was
1.0E-6. The top three core damage sequences all involved SGTR and represented
almost all of the total increase in risk. The next two sequences involved a transient and
a loss of all feedwater, but they were much lower in significance.
In conclusion, this confirmatory Phase 3 analysis using the SPAR model demonstrated
that the risk significance of this finding due to internal events was an increase in core
damage frequency of 1.0E-6/year. This met the threshold for a finding of low-to-
moderate safety significance (White). With respect to LERF, most of the contribution to
risk associated with this finding was the result of SGTR sequences. Therefore, the
analyst concluded that the significance of this finding with respect to LERF was also
White (increase in LERF greater than 1E-7/year).
References
Risk-Informed Inspection Notebook for Fort Calhoun Station, Revision 2, September 30,
2005
Fort Calhoun SPAR model, Revision 3.31, April 10, 2006
NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method"
Fort Calhoun White Paper, "Severe Accident (PRA) Perspective Regarding Improper
Positioning of Containment Spray Header Isolation Valve HCV-345"
USAR Section 4.3, Reactor Coolant System, Component and System Design and
Operation
USAR Section 6.3, Engineered Safeguards, Containment Spray System
USAR Section 6.4, Engineered Safeguards, Containment Air Cooling and Filtering
System
USAR Section 7.3, Instrumentation and Control, Engineered Safeguards Controls and
Instrumentation
USAR Section 9.3, Auxiliary Systems, Shutdown Cooling System
USAR Section 9.7, Auxiliary Systems, Component Cooling Water System
System Training Manual Volume 8, Component Cooling Water System
System Training Manual Volume 10, Containment Structure and Ventilation System
System Training Manual Volume 15, Emergency Core Cooling System
Attachment
A2-12
AOP-6, "Fire Emergency"
EOP-00, "Standard Post Trip Actions"
EOP-02, "Loss of Off-site Power, Loss of Forced Circulation"
EOP-03, "Loss of Coolant Accident"
EOP-04, "Steam Generator Tube Rupture"
EOP-05, "Uncontrolled Heat Extraction"
EOP-06, "Loss of all Feedwater"
EOP-20, "Functional Recovery Procedure"