ML101970547
| ML101970547 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 07/15/2010 |
| From: | Caniano R Division of Reactor Safety IV |
| To: | Bannister D Omaha Public Power District |
| References | |
| EA-10-084, FOIA/PA-2014-0210 IR-10-007 | |
| Download: ML101970547 (32) | |
See also: IR 05000285/2010007
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
REGION IV
612 EAST LAMAR BLVD, SUITE 400
ARLINGTON, TEXAS 76011-4125
July 15, 2010
David J. Bannister, Vice President
and Chief Nuclear Officer
Omaha Public Power District
9610 Power Lane
Blair, NE 68008
SUBJECT: FORT CALHOUN STATION - NRC FOLLOWUP INSPECTION - INSPECTION
REPORT 05000285/2010007; PRELIMINARY SUBSTANTIAL FINDING
Dear Mr. Bannister:
The U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Fort Calhoun
Station. The enclosed inspection report documents the inspection findings, which were
discussed, with Mr. J. Reinhart Site Vice President, and other members of your staff on
June 21,2010.
The attached report documents the results of the inspection, which reviewed an unresolved item
from the 2009 Component Design Basis Inspection at the Fort Calhoun Station (URI
05000285/2009006-03). The inspection examined activities conducted under your license as
they relate to safety and compliance with the NRC's rules and regulations with respect to
external flooding.
This report discusses preliminary results of the inspection including a finding, which involves a
failure to establish and maintain procedures to protect the intake structure and auxiliary building
during external flooding events. The inspectors determined that the protection strategy
discussed in station operating procedures, if implemented, would be insufficient to protect vital
station facilities to an external flood level of 1014 feet mean sea level, as described in the Fort
Calhoun Station Updated Safety Analysis Report and station procedures. This finding was
assessed based on the best available information, including influential assumptions, using the
applicable significance determination process. The preliminary significance (Yellow) was based
on the extrapolated external flood frequencies established by the Fort Calhoun Station
Individual Plant Examination for External Events and credit given for use of a portable gas
powered pump system. Additional details of the primary assumptions associated with the
preliminary significance determination process are documented in Attachment 2 of the
enclosure.
The finding is also an apparent violation of NRC requirements and is being considered for
escalated enforcement action in accordance with the NRC Enforcement Policy. The current
Enforcement Policy is included on the NRC's Web site at
Omaha Public Power District -2-
Before we make a final decision on this matter, we are providing you an opportunity (1) to
present to the NRC your perspectives on the facts and assumptions, used by the NRC to arrive
at the finding and its significance, at a Regulatory Conference or (2) submit your position on the
finding to the NRC in writing. If you request a Regulatory Conference, it should be held within
30 days of the receipt of this letter and we encourage you to submit supporting documentation
at least one week prior to the conference in an effort to make the conference more efficient and
effective. If a Regulatory Conference is held, it will be open for public observation. If you
decide to submit only a written response, such submittal should be sent to the NRC within 30
days of the receipt of this letter.
In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation
using the best available information and issue our final determination of safety significance
within 90 calendar days of the date of this letter. The significance determination process
encourages an open dialogue between the NRC staff and the licensee. However, the dialogue
should not impact the timeliness of the staff's final determination.
Since the NRC has not made a final determination in this matter, a Notice of Violation is not
being issued for these inspection findings at this time. In addition, please be advised that the
number and characterization of apparent violations described in the enclosed inspection report
may change as a result of further NRC review.
If you have additional questions about NRC rules and processes, please contact Mr. Thomas
Farnholtz at (817) 860-8243.
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its
enclosures will be available electronically for public inspection in the NRC Public Document
Room or from the Publicly Available Records (PARS) component of NRC's document system
(ADAMS). ADAMS is accessible from the NRC Web site at ~:...:.::..c:..:.:..;::=:...:.::..c=~",
~.::::::;:::.=..:..:=.:..:= (the Public Electronic Reading Room).
Sincerely,
Docket: 50-285
License: DPR-40
Enclosure:
NRC Inspection Report 05000285/20010007
w/Attachments: Attachment 1: Supplemental Information
Attachment 2: Phase 3 Analysis
Attachment 3: SPAR-H Worksheets
Attachment 4: Flooding Frequency Sensitivity
Attachment 5: Significance Determination Processes Combinations
Attachment 6: Additional Fault Trees
Omaha Public Power District - 3-
cc wiEnciosure:
Jeffrey A. Reinhart
Site Vice President
Omaha Public Power District
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 550
Fort Calhoun, NE 68023-0550
William Hansher
Manager - Nuclear Licensing
Omaha Public Power District
Fort Calhoun Station FC-2-4 Adm.
P.O. Box 550
Fort Calhoun, NE 68023-0550
David A. Repka
Winston & Strawn
1700 K Street, NW
Washington, DC 20006-3817
Chairman
Washington County Board of Supervisors
P.O. Box 466
Blair, NE 68008
Ms. Julia Schmitt, Manager
Radiation Control Program
Nebraska Health & Human Services
Division of Public Health
P.O. Box 95026
Lincoln, NE 68509-5026
Ms. Melanie Rasmussen
Radiation Control Program Officer
Bureau of Radiological Health
Iowa Department of Public Health
Lucas State Office Building, 5th Floor
321 East 12th Street
Des Moines, IA 50319
Chief, Technological Hazards Branch
FEMA, Region VII
9221 Ward Parkway
Suite 300
Kansas City, MO 64114-3372
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket: 50-285
License: DPR-40
Report Nos.: 05000285/2010007
Licensee: Omaha Public Power District
Facility: Fort Calhoun Station
Location: 9610 Power Lane
Blair, NE 68008
Dates: February 9,2010 (Onsite)
April 13, 2010 (Onsite)
January 1, 2010 - June 14, 201 0 (In-Office)
Lead Inspector: G. George, Reactor Inspector, Engineering Branch 1
Inspectors: J. Kirkland, Senior Resident Inspector, Fort Calhoun Station
M. Williams, Reactor Inspector, Plant Support Branch 2
Others: G. Replogle, Senior Reactor Analyst, Division of Reactor Safety
D. Loveless, Senior Reactor Analyst, Division of Reactor Safety
Approved By: Thomas Farnholtz, Branch Chief, Engineering Branch 1
- 1- Enclosure
SUMMARY OF FINDINGS
IR 05000285/2010007; 01101/2010 - 06/21/2010; Fort Calhoun Station: Inspection Procedure 92701, Followup.
The report covers a 6-month period of followup inspection by regional based inspectors from the
NRC Region IV office. One apparent violation of NRC requirements with potential substantial
(Yellow) safety significance was identified. The significance of most findings is indicated by their
color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance
Determination Process." Findings for which the significance determination process does not
apply may be Green or be assigned a severity level after NRC management review. The NRC's
program for overseeing the safe operation of commercial nuclear power reactors is described in
NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.
A. NRC-Identified Findings and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Yellow. The inspectors identified an apparent violation of Technical
Specification 5.8.1.a, "Procedures," for failure to establish and maintain
procedures that protect the intake structure and auxiliary building during external
flooding events. The inspectors determined that the procedural guidance of GM-
RR-AE-1002, "Flood Control Preparedness for Sandbagging," was inadequate
because stacking and draping sandbags at a height of four feet over the top of
floodgates would be insufficient to protect the vital facilities to 1014 feet mean
sea level, as described in the Updated Safety Analysis Report and station
procedures. The licensee has entered this condition into their corrective action
program as Condition Report 2010-2387. As result of this violation, the licensee
has implemented a corrective action plan to correct identified deficiencies and
ensure site readiness.
This performance deficiency is more than minor because it adversely affected the
Mitigating Systems Cornerstone attribute of external events and affected the
cornerstone objective of ensuring the availability and reliability of systems that
respond to initiating events to prevent undesirable consequences. The
inspectors determined the finding resulted in the degradation of equipment and
functions specifically designed to mitigate a flooding initiating event. In addition,
an external flood event would degrade two or more trains of a multi-train safety
system. Therefore, the finding was potentially risk significant to flood initiators
and a Phase 3 analysis was required. The preliminary change in core damage
frequency was calculated to be 3.1 E-5/year indicating that the finding was of
substantial safety significance (Yellow). The finding was determined to have a
crosscutting aspect in the area of problem identification and resolution, corrective
action program, for failure to take appropriate corrective actions to address safety
issues and adverse trends in a timely manner, commensurate with their safety
significance and complexity. Specifically, from 2003 to 2008, the licensee failed
to initiate appropriate corrective actions to ensure reguiatory compiiance of the
external flooding design basis was maintained. [P.i (d)] (Section 40A5.i)
-2- Enclosure
REPORT DETAILS
40A5 Other Activities
.1 IP 92701, "Followup": URI 05000285/2009006-03, "Failure to Update Flood Protection
for Safety Related Buildings"
a. Inspection Scope
As documented in NRC Inspection Report 2009006, the NRC inspectors identified an
unresolved item concerning external flood protection for plant areas considered vital to
allow the reactor to achieve cold shutdown. The unresolved item concerned: (1) the
ability of the licensee to protect the Fort Calhoun Station auxiliary building, intake
structure, and turbine building basement from external floods up to flood elevation 1013
feet mean sea level* (MSL) as stated in the Updated Safety Analysis Report (USAR) and
station procedures; and, (2) upon receiving new flooding information in November 2003,
if the licensee was required to update the USAR.
Because further inspection was necessary, the issue was considered an unresolved item
pending further NRC Region IV review. The NRC Region IV review was to determine:
1. If the failure to meet the self-imposed standard of flood protection up to 1013 feet
MSL * is a performance deficiency in accordance with NRC Manual Chapter 0612.
2. If a violation of NRC requirements is associated with the performance deficiency
because the licensee did not update the external flood design basis when new
information was received in November 2003.
- Note: During this inspection, the inspectors determined that the Fort Calhoun
Station original USAR described protection of the facility up to 1014 feet MSL.
This unresolved item was identified as URI 05000285/2009006-03, "Failure to Update
Flood Protection for Safety Related Buildings." Based on followup inspections
conducted at the Fort Calhoun Station and the NRC Region IV office, the inspectors
determined that no further inspection is necessary. Therefore, URI
05000285/2009006-03 will be closed. Findings are documented in the following section.
b. Findings
Failure to Maintain External Flood Procedures
Introduction. The inspectors identified a Yellow, apparent violation of Technical
Specification 5.8.1.a, "Procedures," for failure to establish and maintain procedures that
protect the intake structure and auxiliary building during external flood events.
Specifically, stacking and draping sandbags on floodgates IS not a suffiCient
configuration to protect the auxiliary building and intake structure to an external flood
height of 1014 feet MSL as stated in station operating procedures and the USAR.
-3- Enclosure
Description. The inspectors determined design basis flood elevations at the Fort
Calhoun Station by reviewing USAR Chapter 2.7, "Hydrology," USAR Chapter 9.8, "Raw
Water System," and Technical Specification 2.16, "River LeveL"
USAR Section 2.7.1.2 states, in part:
"The design flood elevation of 1,006 feet based on a 0.1 percent probability
flood is considered conservative. Without special provisions, the plant can
accommodate flood levels of up to 1,007 [feet mean sea level]. Steel flood
gates are permanently mounted above and adjacent to openings in structures
containing equipment required for a safe and orderly plant shutdown. In the
event of high water levels, these flood gates can be installed to provide
protection to a level of 1,009.5 [feet mean sea level]. In the Intake Structure,
protection to 1009.5 [feet] MSL is accomplished with flood gates and
sandbagging. The plant can be protected by sandbags, temporary earth
levees and other methods to allow a safe shutdown with a flood elevation of
1,013 [feet mean sea level]."
USAR Section 9.8.6 states, in part:
"Protection for the raw water pumps and their drives against floods is
provided at three elevations as indicated on Figure 9.8-1. The pumps are
permanently protected against any water level up to elevation 1007.5 feet
MSL by the Class I concrete substructure of the intake building. Protection is
provided to elevation 1009.5 [feet MSL] by sandbags around the traveling
screen areas and by gasketed steel closures at exterior doorway openings in
the intake structure reinforced concrete perimeter walls. Protection to
elevation 1014.5 feet [MSL] is provided by additional sandbags around the
traveling screen areas, and by supplementing the intake structure perimeter
walls with sandbags. The water level inside the intake cells can be controlled
by positioning the exterior sluice gates to restrict the inflow into the cells."
Technical Specification 2.16, "Basis," dated November 1, 2007, states:
"The maximum Missouri River level of 1009 feet MSL is the level at which the
installed flood gates will protect the plant. Any increase in river level will
require sand bagging to repel the water to a maximum flood level of 1014 feet
[MSL] or greater."
When the licensee determines it is necessary to protect the plant at elevated flood
levels, the licensee implementsSection I of procedure AOP-1, "Acts of Nature." AOP-1
is a procedure required by Technical Specification 5.8.1.a and NRC Regulatory Guide 1.33, Appendix A, Section 6.w. AOP-1 directs the licensee to implement applicable
sections of procedures PE-RR-AE-1 001, "F!oodgate !nstallation and Removal," and GM-
RR-AE-1002, "Flood Control Preparedness for Sandbagging," when river levels reach
specified heights of 1002, 1004, 1007, and 1009 feet MSL.
- 4- Enclosure
GM-RR-AE-1002, step 7.4 states:
"The primary focus for flood protection should be directed to those facilities
which are considered vital with respect to nuclear safety and credited with
flood protection in the Individual Plant Examination of External Events
Flooding evaluation, Reference 2.3. These facilities shall be protected at the
sacrifice of the other facilities if site conditions warrant. The vital facilities are:
Auxiliary Building, Intake Structure, and Turbine Building Basement."
Reference 2.3 of procedure GM-RR-AE-1002 is the Individual Plant Examination of
External Events for Fort Calhoun Station, Section 5.2, "External Flooding," Table 5.2.3.
This table credited flood protection by sandbagging up to 1010.8 ft MSL for the turbine
building and up to 1013.5 feet MSL for the auxiliary building and intake structure. Table
5.2.3, "Impact of Periodic Flood due to Rain and Snow," comments that "severe core
damage results if either intake or auxiliary building sandbagging fails." The turbine
building, which does not contain safety related equipment necessary for safe shutdown,
was assumed lost at floods greater than 1010.8 feet MSL.
Attachment 9.5 of procedure GM-RR-AE-1002 contains specific instructions that plant
operators would use to protect from flood crest above 1009 feet mean sea levei. The
attachment notes that sandbags would be tied and draped over the top of floodgates to
supplement the protection capability to the projected flood crest. Specifically, the
attachment stated, "Place additional sandbags on top of the floodgates to raise the
protection against the expected crest of the flood." Additionally, Attachment 9.8 of
GM-RR-AE-1002 stated the intake structure and auxiliary building could be protected to
1014.5 feet MSL with floodgates and sandbags.
The inspectors requested a demonstration of flood protection for vital facilities against
flood levels above the probable maximum flood level of 1009 feet MSL. As a result of
this demonstration, the inspectors determined that the procedural guidance of GM-RR-
AE-1 002 was inadequate because stacking and draping sandbags at a height of five feet
over the top of floodgates would be insufficient to protect the vital facilities to 1014 feet
MSL, as described in the USAR and station procedures. The sandbagging activity
would be insufficient because the %-inch cross section on the top of the floodgates was
too small to support a stacked sandbag configuration that would retain five feet of
moving water. Therefore, the inspectors determined that a failure of the sandbags would
cause potential damage to the auxiliary building, intake structure, and turbine building
and their equipment at external flood levels above 1009.5 feet MSL.
The inspectors also identified plant personnel would need to take additional action to
prevent flooding through the traveling screen discharge trench in the intake structure or
the intake structure would be potentially lost at a flood level of 1008 feet MSL.
Furthermore, the inspectors determined that any actions taken per AOP-1 could be
difficult because of the risk to personnel safety when flood waters are within the
protected area.
While reviewing the Fort Calhoun Station design basis, the inspectors discovered the
licensee missed several opportunities to implement appropriate corrective actions when
new external flood information was available. The failure to implement appropriate
corrective actions directly contributed to the licensee's failure to identify inadequacies in
their external flood procedures and strategy.
-5- Enclosure
As documented in Condition Report 2002-1296, the licensee obtained external flood
information from the Federal Emergency Management Administration and an Army
Corps of Engineers letter to Omaha Public Power District (OPPD), dated January 14,
1993. The information estimated projected flood elevations to be three feet greater than
the flood elevations described in the original USAR. The corrective actions were to
evaluate the information to determine if the design basis and procedures would need to
be updated. The licensee determined that the design basis would remain the same;
however, a USAR change would reflect that an evaluation of the new information's
impact on the design basis was completed. A USAR change was submitted to the NRC
in January 2008, but no change to operating procedures was initiated.
During the evaluation associated with Condition Report 2002-1296, the licensee
identified that more recent external flood information was available from the Army Corps
of Engineers. In July 2003, the licensee identified that external flood frequencies and
associated Missouri River levels evaluated in the 2003 draft version of Army Corps of
Engineers report, "Upper Mississippi River System Flow Frequency Study (final version
January 2004)," had increased since last evaluated the Army Corps of Engineers letter
to OPPD, dated January 14, 1993. This condition was entered into the corrective action
program as Condition Report 2003-2664.
The licensee's corrective action tasked the licensee's probabilistic risk assessment
group to evaluate the new 2003 external flood data, update the existing external flood
analysis, and develop a set of recommended strategies to mitigate high risk external
flood scenarios. This external flood analysis was completed in August 2005. The
licensee realized the new flood elevations were approximately three feet higher for each
flooding frequency. Additionally, when the 2003 data was extrapolated to a 1000-year
flood frequency, the licensee found the 1OOO-year flood elevation to be 1010.5 feet MSL.
Following this discovery, the licensee updated the external flood analysis in 2005;
however, no corrective action was written to evaluate the potential change to the plants
design basis or operating procedures. Consequently, the 2005 external flood analysis
was not mentioned in the USAR change initiated in January 2008. Furthermore, the
licensee did not develop a corrective action plan to ensure the design basis and
regulatory compliance was maintained, as required by corrective action program.
Analysis. The inspectors determined the failure to establish and maintain adequate
procedures to protect the auxiliary building and intake structure to external flood heights
between 1008 and 1014 feet MSL is a performance deficiency. Specifically, the licensee
failed to maintain procedures for combating a significant flood as recommended by NRC
Regulatory Guide 1.33, Appendix A, Section 6.w, "Acts of Nature." This performance
deficiency is more than minor because it adversely affected the Mitigating Systems
Cornerstone attribute of external events and affected the cornerstone objective of
ensuring the availability and reliability of systems that respond to initiating events to
prevent undesirable consequences. The inspectors determined the finding resulted in
the degradation of equipment and functions specifically designed to mitigate a flooding
i_i-f*i,.,,+i __ _ ,It'... _... 1_ _ ,..Irli+i __ ",, _ _ V'+_ ... __ I +1 __ ......1 _~, _ _ ... ,.,_III,J -I __ ... _,.l_ oh .. , _ _ ... --.. ___ ... __ :_ ..... _.t:
IIlI1.Io.llIl~ CiVCilll. III aUUILIVII, CUI v A l v f l t O I ItVVU eVC;lll VVVUfU Uv~lauv l,VVV VI IIIUIIf;;J lIeUlf.::;) VI
a multi-train safety system. Therefore, the finding was potentially risk significant to flood
initiators and a Phase 3 analysis of the significance determination process was required.
-6- Enciosure
A Region IV senior reactor analyst performed the Phase 3 significance determination.
The preliminary change in core damage frequency was calculated to be 3.1 E-5/year
indicating that the finding was of substantial safety significance (Yellow). The risk
important sequence included a station blackout, loss of all dc power, failure of the
turbine-driven auxiliary feedwater pump, and failure of the diesel-driven auxiliary
feedwater pump. Remaining mitigation equipment that helped to limit the significance
included the licensee's temporary gasoline powered pump system that can provide
makeup water to the steam generators.
The inspectors determined the finding has a crosscutting aspect in the area of problem
identification and resolution, corrective action program, for failure to take appropriate
corrective actions to address safety issues and adverse trends in a timely manner,
commensurate with their safety significance and complexity. Specifically, from 2003 to
2008, the licensee failed to initiate appropriate corrective actions to ensure regulatory
compliance of the external flood design basis was maintained. [P.1 (d)]
Enforcement. Technical Specification 5.8.1.a, "Procedures," states, "Written procedures
and administrative policies shall be established, implemented, and maintained covering
the following activities: (a) The applicable procedures recommended in Regulatory
Guide 1.33, Revision 2, Appendix A, 1978." From 1976 to 1978, Fort Calhoun Station
established written procedures recommended by NRC Regulatory Guide 1.33, Appendix
A, Revision 1. NRC Regulatory Guide 1.33, Appendix A, Section 6 recommends
procedures for combating emergencies and other significant events. Section 6.w, "Acts
of Nature" recommends procedures for combating tornado, dam failure, flood, and
earthquakes. Contrary to Technical Specification 5.8.1.a and NRC Regulatory Guide
1.33, since 1976, the licensee failed to maintain written procedures for combating a
significant flood as recommended by NRC Regulatory Guide 1.33, Appendix A, Section
6.w, "Acts of Nature." Specifically, the licensee failed to establish and maintain station
procedures that adequately prescribe steps to mitigate external flooding conditions in the
auxiliary building and intake structure between 1008 and 1014 feet mean sea level. The
licensee has entered this condition into their corrective action program as Condition
Report 2010-2387. Pending completion of a final significance determination, the
performance deficiency will be considered an apparent violation, AV 05000285/2010007-
01, "Failure to Maintain External Flood Procedures."
40A6 Meetings
Exit Meeting Summary
On June 21, 2010, the inspectors presented the inspection results to Mr. J. Reinhart, and
other members of the licensee staff. The licensee acknowledged the issues presented.
The inspectors asked the licensee whether any materials examined during the
inspection should be considered proprietary. No proprietary information was identified.
-7- Enclosure
SUPPLEMENTAL !NFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
H. Faulhaber, Manager, Nuclear Engineering
M. Frans, Manager, System Engineering
J. Gasper, Manager, Design Engineering
D. Guinn, Supervisor, Regulatory Compliance
A. Hackerott, Supervisor, Risk Engineering
J. Herman, Manager, Engineering Programs
K. Hyde, Supervisor, Design Engineering
T. Mathews, Manager, Nuclear Licensing
E. Matzke, Regulatory Compliance
T. Nellenbach, Plant Manager
J. Reinhart, Site Vice President
D. Trausch, Assistant Plant Manager
NRC Personnel
R. Azua, Senior Project Engineer, Projects Branch E
M. Markley, Chief, Plant Licensing Branch IV-1
J. Wingebach, Resident Inspector, Fort Calhoun Station
L. Wilkins, Project Manager, Plant Licensing Branch IV-1
W. Schaup, Project Engineer, Projects Branch E
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
05000285/2010007 -01 AV Failure to Maintain External Flood Procedures (40A5.1)
Closed
05000285/2009006-03 URI Failure to Update Flood Protection of Safety Related Buildings
DOCUMENTS REVIEWED
Section 40A5: Other Activities
PROCEDURES
NUMBER REVISION
AOP-1 Acts of Nature 23
AOP-30 Emergency Fill of Emergency Feedwater Storage Tank 9
EPIP-TSC-2 Emergency Plan Implementing Procedure: Catastrophic 7
Flooding Preparations
A1-1 Attachment 1
PROCEDURES
NUMBER TITLE REVISION
FCSG-24 Corrective Action Program Guideline 22
GM-RR-AE-1002 Repair-Rework: Flood Control Preparedness for Sandbagging 8
OCAG-1 Operation Contingency Action Guideline 12
PE-RR-AE-1001 Floodgate Installation and Removal 3
TBD-AOP-18 Loss of Raw Water 7
TBD-AOP-19 Loss of Shutdown Cooling 14
TBD-AOP-38 Blair Water Main Trouble 3
CALCULATIONS
NUMBER TITLE
CCF-103-048-RPT External Flooding Analysis August 12,2005
CORRECTIVE ACTION DOCUMENT NAME
200201296 200302664 200904166 201000225 201002101
201002387
MISCELLANEOUS DOCUMENTS
TITLE DATE
Fort Calhoun External Action Plan April 8, 2010
A1-2 Attachment 1
PHASE 3 ANALYSIS
FAILURE TO PROTECT SAFE SHUTDOWN EQUIPMENT FROM EXTERNAL FLOODING
A senior reactor analyst conducted a Phase 3 significance determination process (SOP)
analysis in accordance with Manual Chapter 0609, Appendix A, "Determining the Significance of
Reactor Inspection Findings for At-Power Situations." This Phase 3 SOP represents a best-
estimate risk evaluation of the performance deficiency.
1. SOP Assumptions
a. NRC Manual Chapter 0609, Appendix G, "Shutdown Operations Significance
Determination Process," was not used for this SOP. The appendix stated, in part:
"Appendix G is applicable during refueling outages, forced outages, and
maintenance outages starting when the licensee has met the entry
conditions for RHR [residual heat removal] and RHR cooling has been
initiated, and ending when the licensee is heating up and RHR has been
secured." [Emphasis added]
Since the initiating event would occur after RHR was secured by procedure (to prevent
a containment bypass pathway) and the reactor coolant system heated up to Mode 3
conditions, the at-power SOP was used for this case. Further, the finding would have
required a quantitative assessment (Phase 3) irrespective of which significance
determination procedure was used.
b. The analyst considered the increase in risk from flooding for the:
- Intake structure: 1008 to 1014 feet mean sea level (MSL). The intake structure
housed raw water pumps (service water pumps).
- Auxiliary building: 1010 to 1014 feet MSL. The auxiliary building was the
primary risk driver. Most of the equipment that was negatively impacted by the
performance deficiency was located in the auxiliary building - emergency diesel
generators, safety related switchgear, auxiliary feedwater pumps (basement),
safety injection pumps, etc.
c. The performance deficiency did not impact flooding of the turbine building. The licensee
did not protect the turbine building above 1009.5 feet MSL by procedure. The non-
safety related diesel-driven auxiliary feedwater pump was located in the basement.
d. Dam failures were not a factor in the performance deficiency, but could flood the site to
well above 1014 feet MSL. Flooding frequencies above 1014 feet MSL (Technical
Specification Bases 2.16 specified elevation) were not considered.
e. The performance deficiency existed for many years. Therefore, in accordance with
Manuai Chapter 0609, Appendix A, Attachment oj, Usage Ruie i:i, "Exposure Time," the
analyst determined that the exposure period was one year.
f. When the auxiliary building, turbine building and intake structure were assumed lost, the
conditional core damage probability (CCDP) was 1.0. This was expected because all
A2-1 Attachment 2
normal plant equipment was assumed failed by the floodwaters. This did not include
credit for the portable gasoline powered pumps to refill the steam generators. A
correction to account for gasoline-powered pump failure was addressed separately.
Consequently, the SOP reduced to: (1) the flooding frequencies; (2) the gasoline
powered pump system failure probability; and (3) comparison to the baseline risk
assuming a 10 percent probability that the sandbagging protection failed.
g. A fault tree to estimate the failure probability for the gasoline-powered pumps was
constructed and solved using the simplified plant analysis risk (SPAR) model. After
flooding greater than 1010 feet MSL, the gasoline powered pumps would be the only
equipment available to provide makeup water to the steam generators. The fault tree
assumed:
III Both pumps must function for the action to be successful.
III Human error probabilities associated with installing the gasoline powered pump
system were evaluated using NUREG/CR 6883, "The SPAR-H Human Reliability
Analysis Method," August 2005 (Attachment 3). From this evaluation, the analyst
inserted a human error probability basic event into the system fault tree. The
SPAR-H worksheets were broken up into two sections, a "diagnosis" section and
an "action" section. The diagnosis section evaluated the probability that
operators would fail to diagnose the problem, such that mitigating actions would
not be taken. The action section estimated the probability that operators (or
craftsmen) would fail to successfully install and operate the system.
II The analyst assumed that operators would properly diagnose the flood.
- The "action" portion of the SPAR-H worksheet was much more difficult to
perform and the probability of failure was over-riding (when compared to
the diagnosis portion).
III The analyst used the licensee's estimates for gasoline pump failure probability.
- Other basic components that would have very low failure probabilities, such as
manual isolation valves, were not included in the fault tree.
III The action to obtain sufficient fuel for long-term pump operation was not
modeled. While the licensee had a procedural step that instructed personnel to
obtain gasoline, no other specifics were provided. The pumps' gasoline
consumption was not readily known and the exact methods that might be used to
obtain gasoline were unclear. Gasoline was on-site, located in an above ground
tank at the 1004-foot elevation; however, flooding may make the tank
inaccessible (it could float away). Nonetheless, the analyst assumed that plant
personnel could obtain sufficient gasoline without undue difficulty.
A2-2 Attachment 2
h. The licensee's Individual Plant Examination of External Events (page 5-23) contained
the following assumptions. The second, third and fourth table columns specified the
assumed failure probabilities for equipment located in the buildings:
Elevation Intake Turbine bldg Aux bldg
(ft MSL)
1007.5-1009.5 0 0 0
1009.5-1010.8 .01 .05 0
1010.8-1012.3 .1 Lost .1
1012.3-1013.5 .9 Lost f"\
.::3
Notes:
i. The licensee had assumed a sandbagging failure probability of 0.9 for flood
elevations between 1012.3 and 1013.5 feet MSL. The analyst considered this
assumption unreasonable for use in a base case evaluation. A base case
evaluation is an assessment of the baseline risk, assuming that no performance
deficiency occurred. If the performance deficiency did not exist, the licensee
should have had a high level of assurance that mitigating actions (sandbagging)
would be successful. For the purpose of this analysis, the sandbagging base
case failure probability was assumed to be 0.1 when flood waters were above
1010.8 feet MSL.
ii. A current case evaluation is a risk estimate that includes the performance
deficiency. The current case evaluation assumed that the sandbagging failed at
1008 feet MSL at the intake structure and at 1010 feet MSL at the auxiliary
building. The delta-core damage frequency (CD F) was the difference between the
base case and current case risk evaluations.
2. Calculation of Increase in CDF
a. Equipment lost because of the performance deficiency: The analyst identified the risk
important pieces of equipment and when they would fail. This was accomplished by
reviewing site procedures and interviewing licensee personnel.
Elevation {feet MSL} Performance Deficienc~ ImQact
1007.5 - Intake Structure Floor Some water leaks into intake
structure. Sandbag berms within the
building should limit the affect of
short duration crests. The analyst
assumed that significant flooding
would occur at 1008 feet MSL.
1008 - Loss of offsite power (LOOP) and Loss of all four raw water pumps.
loss of intake structure due to flooding (The LOOP was unrelated to the
I performance deficiency).
A2-3 Attachment 2
Elevation ,feet MSL} Performance Deficienc~ Im12act
1009.5 - Top of auxiliary building floodgates Flooding starts in auxiliary building,
and turbine building sandbags. The diesel- turbine building and technical support
driven auxiliary feedwater pump was located center above 1009.5 feet MSL. The
in turbine building basement. All other analyst assumed that small crests
remaining equipment (other than the above 1009.5 feet MSL would not
gasoline-powered pumps) was located in the result in substantial flooding in the
auxiliary building (pumps in the basement). buildings.
1010 - 0.5 feet above floodgate All remaining normal plant equipment
lost because of the performance
deficiency.
1011 - Level when procedures estimate that
floodwaters spill into emergency diesel
generator rooms (assuming drains are
appropriately plugged). The building
structure prevents water from entering at
lower elevations. However, switchgear is
already lost.
b. Base case and current case CCOPs: The analyst calculated the base and current case
CCOPs using the Fort Calhoun SPAR model, Revision 3.45, assuming a truncation limit
of 1E-13. This portion of the analysis did not credit the gasoline-powered pumps, as the
SPAR model did not include the pumps. The gasoline-powered pumps were factored
into the final SOP by use of a separate fault tree (Attachment 6).
- Base case CCOP for each flood elevation: Assuming no performance deficiency and
no credit for gasoline-powered pumps. Credit for the gasoline powered system was
provided later in this SOP:
Elevation{ft MSL} CCDP Egui(;!ment Lost l Increased Probabilit~
1008-1009.5 1.017E-3 Non-recoverable LOOP initiating event
1009.5-1010.8 1.046E-3 Non-recoverable LOOP initiating event
Probability of raw water pump failure (.01),
Probability of diesel driven auxiliary
feedwater pump failure (.05)
1010.8-1014 1.1 E-1 Non-recoverable LOOP initiating event;
Probability of raw pump failure (0.1),
Probability of diesel driven auxiliary
feedwater pump failure (1.0), Probability of
emeraencv diesel aenerator failure (0 1)
_ J _ '- "
Probability of auxiliary feedwater pump
failure (0.1)
A2-4 Attachment 2
3 Current case CCOP for performance deficiency elevations: No gasoline pumps were
provided in this step. Increased failure rates because of the performance deficiency
are in bold:
Elevation{ft MSL} CCDP Egui~ment Lostz Increased Probabilit1!
1008 -1010 1.25E-3 Non-recoverable LOOP, Probability of
diesel driven auxiliary feedwater pump
failure (.05). Probability of raw water
pump failure (1.0)
1010 -1014 1.0 Non-recoverable LOOP; Probability of
diesel driven auxiliary feedwater pump
failure (1.0), Probability of 4kV
switchgear failure (1.0), Probability of
all auxiliary feedwater pumps failing
(1.0)
c. Calculation of Increase in COF: To obtain consistent elevation bins for analysis, the
above bins must be broken up further. The frequency for a given elevation bin (A) was
the difference in the frequency of exceedance between the upper and lower bin
elevation limits.
Delta CDF = 2:: Abin * (CCDP current - CCDP base) * Pgas pump fail
Elevation {ft A CCDP CCDP base Pgas HumH fail Delta Time After
MSL) current CDF/bin 1004 ft
MSL*
1008-1009.5 3.2E-3/yr 1.25E-3 1.017E-3 2.56E-2 1.9E-8/yr 30 hrs
1009.5-1010 4E-4/yr 1.25E-3 1.046E-3 2.56E-2 2.1 E-9/yr 41.25 hrs
1010-1010.8 8E-4/yr 1.0 1.04E-3 2.56E-2 2E-5/yr 45 hrs
1010.8-1014 5E-4/yr 1.0 1.1 E-1 2.56E-2 1.1 E-5/yr 51 hrs to
75 hrs
Total 3.1E-5/yr
- Based on licensee's flood level increase rate of 4ft/30 hours
3. Sensitivit1! Cases
a. Operator can prevent intake structure flooding until 1010 feet MSL. This would assume
that an operator could successfully maintain intake structure level, using raw water
pumps and sluice gates, to prevent water from flooding through the traveling screen
discharge trench. This had little impact on the SOP results. The first two delta-COF
A2-5 Attachment 2
elevation bins capture this aspect of the assumed event. Setting both to zero would
reduce the de!ta-CDF by about 2E-B/yr.
b. Flooding freguencies differ by significant amounts. The uncertainty with the flooding
frequencies was high. The licensee used the shape of the flooding frequency curve at
another station (Cooper Nuclear Station) and applied it to the Fort Calhoun Station
flooding frequencies that were provided by the United States Army Corps of Engineers.
The Army Corps of Engineers only provided information out to the 500-year flood
(2E-3/year). The licensee extrapolated the remainder of the information. Almost all of
the calculated risk was in the extrapolated region. To address this uncertainty, the
analyst assumed that the Army Corps of Engineers data was correct but the
extrapolated information could vary significantly, either higher or lower.
For the sensitivity cases, the analyst targeted the flooding elevation at the 1E-5/year
point for comparison. At the 1E-5/year point on the Fort Calhoun flood hazard curve, the
flood level was 1013.5 feet MSL. The analyst then constructed alternate curves, two
above and two below this base curve. The curves are shown in Attachment 4. The
curves were numbered Case 1 through Case 5. Case 3 was the licensee's estimate and
was considered the best available information for this assessment.
Using data from the 5 curves, the analyst generated a delta-CDF for each case. The
analyst summarized the results below:
Delta-CDF by Sensitivity Case
Case 2 Case 5
2.5E-5/year 3.5E-5/year
- Licensee assumptions
It's important to note that Case 1 may be unrealistically low. After almost 100,000 years
of additional exposure, the flood elevation at the1 E-5/year point was a little over 1 foot
above that predicted by the Army Corps of Engineers at the 1/500 year point. Likewise,
Case 5 may be unrealistically high. The plotted line deviates from the Army Corps of
Engineers' estimates at a sharper angle.
c. Alternate Method of Refilling Essential Feedwater Tank (SPAR-H 2, Attachment 3): The
licensee proposed an alternate method for refilling the essential feedwater tank. The
offsite fire water tank (at a higher elevation across the highway) could be used to refill
the essential feedwater tank. The advantage of using this tank was that the reliance on
the gasoline-powered pumps would be reduced. Instead of requiring that both gasoline
powered pumps remain functional (one to fill the steam generators and one to refill the
essential feedwater storage tank), the licensee could have one pump fail and still satisfy
the steam generator makeup function.
The alternate fill method required operators to attach a fire hose between fittings that
could be used to connect the two tanks. It also required that the licensee have water
trucks periodically refill the firewater tank. The procedure that drove these actions was
normally performed following a loss of the Blair water supply. The procedural steps to
use the firewater tank to refill the essential feedwater storage tank would be
implemented after other sources of water became unavailable (it was the last option on
the list). The floodwater was expected to eliminate the following water sources, as
A2-6 Attachment 2
specified: (1) demineralized water system (1008 feet MSL); (2) condensate storage tank
(1008 feet MSL); (3) Blair water (1007 feet MSL); (4) the diesel-driven auxiliary
feedwater pump (1009.5 MSL); and (5) the on-site plant fire water system (1008 feet
MSL). Therefore, operators would not likely initiate these actions until the 1009.5-foot
elevation. At this flood level, two of the components that would require connection (with
a fire hose) would be under water.
To evaluate the scenario, the analyst adjusted the gasoline power pumps system fault
tree so that a failure of both fire pumps would be needed to fail the system (not just one
pump). The analyst added a new basic event to account for the human error probability
for the new manual actions. The analyst also made other adjustments to model use of
the firewater tank. The adjusted fault tree is shown in Attachment 6, second fault tree.
As shown in the SPAR-H worksheet (Attachment 3, SPAR-H-2) the assumptions for the
new human error probability included nominal available time, high stress (fittings hard to
find and work under water), moderate complexity, low experience (connecting fittings
under water), nominal procedures, missing/misleading ergonomics (location of fittings
under water), nominal fitness for duty, and nominal work processes. Instead of a failure
probability of 2.56E-2 for the failure of the gas pump system, a failure probability of
1.3E-2 was generated. This would reduce the overall delta-COF by a factor of two. The
resultant delta-COF was 1.5E-5/year. However, since the challenge of locating and
manipulating components under water invoked large uncertainties, this action was not
credited in the SOP.
d. Use of Tabletop Generated, Non-Procedural Actions: The licensee asked the NRC to
credit non-proceduralized actions that were identified during a tabletop exercise
(installing metal plates over auxiliary building doorways). The licensee's probabilistic
risk assessment team had not credited this action in an analysis themselves.
In response to the finding, the licensee conducted a tabletop exercise to determine what
actions might be specified by the technical support center during a simulated flood. The
tabletop team determined that metal plates could be installed over auxiliary building
doors (on the water side). They specified that thick metal plates would be needed (3/4"
to 1" thick), that craftsmen would weld supporting structures to the plates and that the
plates would be secured, but not welded, to the outside of the doorways. The analyst
noted that it was unclear if the actions would work, and they could cause failure of
existing flood barriers before 1009.5 feet MSL (the leak tight floodgates and sandbag
berms would have to be removed). The NRC's "Risk Assessment of Operational Events
Handbook," Revision 1.03, Section 6.3.2 stated, in part:
In general, no recovery or repair actions should be credited where ... there is no
procedure or training. It may be possible to justify exceptions in unique
situations, such as a procedure is not needed because the recovery is skill of the
craft. ..
Still, the analyst used the SPAR-H method to evaluate the action. The SPAR-H
worksheet (see Attachment 3, SPAR-H-3) documented that the failure probability was
very close to 1.0. To implement the proposed actions, craftsmen would need to
construct and erect about 10 covers for doors, including some double doors and at least
one rollup door. The licensee did not have an adequate supply of the thick plates on site
to cover all of the doors. However, an abundant supply of thinner plates, some 3/8-inch
A2-7 Attachment 2
thick and other rough deck plate material, were available. The yard that housed the
plates was outdoors and the ground was covered with gravel, not asphalt
(1005 feet MSL). The technical support center was not manned until floodwaters were
near the yard elevation (1004 feet MSL); therefore, floodwaters may already be in the
yard before meaningful recommendations could be made. If floodwaters entered the
yard, getting the plates to a location to support cutting and welding may be difficult.
There were experienced welders onsite, but only three welding machines were available
that could be operated on the three available portable electric generators. A loss of
offsite power was expected at 1008 feet MSL. Cutting the plates to size would require a
cutting machine that may not be available after a loss of offsite power.
No method was specified for installing the plates, but the team determined it was
necessary to install them on the water side of the doors (to let the water pressure help
keep them in place). To do this, at least some floodgates would likely need to be
removed. The tabletop team specified that they would not weld the plates to the
doorways. The current floodgates had rubber seals (some inflatable) to help prevent in-
leakage, while the new plates would not have this feature. This would introduce a new
failure mechanism not previously considered (substantial leakage past a plate at an
elevation below 1009.5 feet MSL).
Flood projections often change and are rarely accurate. If the flood projections started
out below 1009.5 feet MSL and then increased, floodwaters may be upon the floodgates
(and sandbag berms) already, making removing them unmanageable. The bottoms of
some auxiliary building floodgates sat at approximately 1007 feet MSL. Large sandbag
berms would need to be removed from several doors.
Alternate Evaluation: The analyst also performed an alternate evaluation (Attachment 3,
SPAR-H-3, Method 2), assuming that the licensee could be successful installing plates
over auxiliary building doors 50 percent of the time. Assuming this chance of success,
however, the delta-COF would be reduced by a factor of two. No formal credit was
provided in the SOP.
4. Large Early Release Frequency (LERF):
Nominally, for large dry containments, the delta-LERF was less than 0.1 times the delta-
COF. However, the loss of all control room indications would make it more difficult to
obtain the information needed to insure a timely public evacuation. The NRC processes
to evaluate delta-LERF were not well suited for this finding. The analyst consulted with a
LERF expert in the Office of Nuclear Reactor Regulation. The expert indicated that
because of the large dry containment, and the relatively large pressure failure rating of
containment, that a large amount of time would be available to evacuate the public. The
analyst then spoke with regional emergency preparedness experts and found that the
licensee had alternate means to identify core damage (radiation levels outside of
containment). Further, the analyst reviewed Fort Calhoun Emergency Classification
levels and noted that a general area emergency would be declared if - "conditions exist
which in the judgment of the command and control position warrant declaration of a
General Emergency." In conclusion, the analyst qualitatively determined that the color of
the delta-LERF would not exceed that associated with the estimated delta-COF.
A2-8 Attachment 2
SPAR-H WORKSHEETS
1. SPAR-H-1
Refill Steam Generators Using Gasoline Puml2s {Onl~}
Performance Shal2ing Diagnosis Action
Factor
PSF Level Multil2lier PSF Level Multil2lier
Time Expansive 0.01 >5 times required 0.1
Stress Nominal 1.0 High 2.0
Complexity Nominal 1.0 Moderate 2.0
Experience Nominal 1.0 Nominal 1.0
Procedures Nominal 1.0 Nominal 1.0
Ergonomics Nominal 1.0 Poor 10.0
Fitness for Duty Nominal 1.0 Nominal 1.0
1W0rk Processes Nominal 1.0 Nominal 1.0
Nominal Base 1.0E-2
PSFs 1.0E-2 4.0
frotal 1.0E-4 4E-3
Failure Probability 4E-3
Justifications for Action (over-riding), only items that del2arted from nominal:
Time: Greater than 5 times necessary. The river was expected to rise at a rate of four
feet in 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The licensee would expect an approximate two-day notice of a river
crest at 1009 feet MSL or higher, assuming that the licensee started taking actions at
1000 feet MSL and received early warning of the coming flood. The analyst assumed
that the turbine building would be flooded at approximately 1009.5 feet MSL. Plant
personnel should start installing the gasoline powered pump system when the Army
Corps of Engineers projects flooding at or above 1009 feet MSL. The procedure for
installing the system was detailed, all of the equipment was staged, and plant personnel
should be able to assemble the equipment in less than one shift without much difficulty.
Testing of one pump could only be accomplished after the floodwaters enter the turbine
building. While this would occur after the loss of offsite power, the operators should
have substantial time before the essential feedwater storage tank emptied.
Stress: High. Once installed, operation of the gasoline pump system would rely on
alternate methods of measuring steam generator water level. Operators could either
use a portable instrument to determine steam generator water level or overfill the steam
generators and wait a given amount of time before the next filling evolution. The turbine
building would be dark and uncomfortable.
Tho
- -
occonti~1 fot=>';IAI~tt=>r ct{"\r~nt=> t~nk \hI{"\1
- - - - ..... - * * __ ......... _ .. _ * ............ -::::1 ...... _ .....
II'; .*
~,,--.-
nt=>t=>,; t() ht=> rt=>fillt=>,;
_ - - "'- - - . - *..* _ -
- Ie: \J\It=>1I Thp nllmn
- - --_ * * . * * . - r--****I
t()
~-
refill this tank must be located close to the floodwaters. When floodwaters increase, the
pump would need to be moved to a higher elevation. Failure to do so could cause the
gasoline engine to fail. The reliance on this temporary system to prevent core damage,
A3-1 Attachment 3
with minimal indications of reactor coolant system or containment conditions, would
contribute to the stress level.
Complexity: Moderately complex. Craftsmen would need to remove piping flanges and
install new components that were manufactured to fit into the piping locations, which
may be difficult. Some of the pieces were heavy. At approximately 1008 feet MSL, the
plant would experience a loss of offsite power and the turbine building would lose
artificial lighting and normal electrical power. While the system could be installed into
position earlier, the system would need to be filled and tested to ensure that the pumps
were not vapor-locked. The pump that was to refill the essential feedwater storage tank
would take suction from the floodwaters, which would not enter the turbine building prior
to the loss of offsite power. Operators would need to ensure that the pump was
sufficiently close to the water level to allow for proper suction and filling.
Ergonomics: Poor. The analyst determined that the ergonomics for implementing
Procedure PE-RR-AE-1002, "Installation of Portable Steam Generator Makeup Pumps,"
Revision 2, were "Poor." For system startup and subsequent operation, operators and
maintenance personnel would be working under emergency lighting conditions or
possibly in the dark. Workers would complete their tasks around and in flood waters.
Operations would involve routine handling of gasoline. No procedural steps were
provided to instruct the operators how to obtain or where to store the gasoline, so these
actions would need to be developed. Operators would periodically need to tend the
system to start and stop it, depending on the level in the steam generators. No steam
generator indication was available at the location. Steam generator level indication was
available at another location using a portable instrument.
2. SPAR-H-2
Connecting Fire Hose Between Firewater Tank and Essential Feedwater
Tank
Performance Diagnosis Action
Shaeing Factor
PSF Level Multielier PSF Level Multielier
rnme Nominal 1.0 Nominal 1.0
Stress Nominal 1.0 High 2.0
Complexity Nominal 1.0 Moderate 2.0
Experience Nominal 1.0 Low 3.0
Procedures Nominal 1.0 Nominal 1.0
Ergonomics Nominal 1.0 Missing/Misleading 50.0
Fitness for Duty Nominal 1.0 Nominal 1.0
~ork. Processes Nominal 1.0 Nominal 1.0
Nominal Base 1.0E-2 1.0E-3
[i-'::it-s [ 1.0[ 600
~otal 1.0E-2 3.7E-1
Failure Probability 3.7E-1
A3-2 Attachment 3
Justifications for Action (over-riding), only items that departed from nominal:
Stress: High. This action was expected to occur after floodwaters had entered portions
of the site. The procedure that drove the action was used after other water sources
were depleted, after floodwaters reached 1009.5 feet MSL. The floodwater was
expected to fail the demineralized water system at 1008 feet MSL, condensate storage
tank at 1008 feet MSL, the Blair water system at 1007 feet MSL, the diesel-driven
auxiliary feedwater pump at 1009.5 feet MSL, and the plant fire water system at
1008 feet MSL. The action would align an outbuilding fire water tank up to the essential
feedwater storage tank via a fire hose and a connection point on each system. Both
connection points would likely be submerged and could be difficult to locate. Concerns
about personal safety would also contribute to the stress level.
Complexity: Moderately complex. Under normal plant conditions, the action would not
be complex. Having floodwaters cover needed connection points makes the task much
more difficult.
Experience: Low. This action was not normally performed by plant personnel on a
routine basis. The action of finding connection points below the water level and then
connecting the fire hoses was not practiced. Even very experienced craftsmen may
have difficulty accomplishing this task.
Ergonomics: Missing/Misleading. Needed information, labeling and location of the
valves and connections, would be difficult to obtain for components under water.
3. SPAR-H-3
Construct and Install Steel Plates to Cover Auxilia!y Building Doors
Performance Diagnosis Action
Sha!;!ing Factor
PSF Level Multil2lier PSF Level Multi!;!lier
Time Not evaluated If= time required 10
(actually may not have
sufficient time)
Stress Not evaluated High 2.0
Complexity Not evaluated High 2.0
Experience Not evaluated Low 3.0
Procedures Not evaluated Not Available 50.0
Ergonomics Not evaluated Missing/Misleading 50.0
Fitness for Duty Not evaluated Nominal 1.0
lWork Processes Not evaluated Nominal 1.0
INominal Base 1.0E-~ 1.0E-3 1
PSFs I I 300,000'
I ~otal .991
9.9E-1
A3-3 Attachment 3
Justifications for Action (over-riding), only items that departed from nominal:
Time: Equals time required. This action was determined by a tabletop exercise after the
issue was identified. The licensee wanted to demonstrate that the emergency response
organization could develop an acceptable method to protect safe shutdown equipment
under extreme flooding conditions. The analyst interviewed the tabletop team members.
The members had varying levels of knowledge regarding NRC identified flooding
concerns; most knew about a flooding seal issue (not part of this performance
deficiency). A few were aware that the NRC had concerns with the plant's ability to cope
with more significant floods. The exercise lasted about 90 minutes,
During the initial portions of the exercise, flooding projections were within those
addressed by plant procedures. No additional actions were developed by the team
during this phase. Then the scenario changed such that the projected flooding level was
1017 feet MSL. This was outside of the existing procedural guidance for a flood (other
than the action to stack sandbags on top of the floodgates). The team determined that
stacking sandbags on top of the floodgates would not work because the narrow ledge of
the floodgates did not allow construction of a leak tight barrier to 1017 feet MSL. The
team identified the following additional mitigation strategy:
Fabricate and install steel plates in front of all of the auxiliary building doors.
The team specified that they would not weld the plates over the door openings but would
fasten the plates in place. They were not confident that the doorframes would support
welding. The team would have plant personnel weld supporting structures to the plates
themselves for stability. The plates would be cut to size for all of the auxiliary building
doorways and some plates would be welded together to cover rollup doors. They
believed that they needed %-inch to 1-inch thick steel plate for the task. They did not
take the simulation further.
Analyst Assessment: These actions were modeled using SPAR-H and the calculated
failure probability was close to 1.0. However, no credit was provided in the SOP
because it was not clear that the actions would work and the NRC's "Risk Assessment of
Operational Events Handbook," Revision 1.03, Section 6.3.2 stated, in part:
In general, no recovery or repair actions should be credited where ... there is no
procedure or training. It may be possible to justify exceptions in unique
situations, such as a procedure is not needed because the recovery is skill of the
craft. ..
In addition, a different group of individuals in the technical support center at the time of
an actual flood might specify different recommendations.
Craftsmen 'Nould need to construct and erect about 10 covers for doors, including some
double doors and at least one rollup door. The licensee did not have an adequate
supply of the thick plates on site to cover all of the doors. However, an abundant supply
of thinner piates, some 3i8 inch thick and other rough deck piate materiai, were
available. The yard that housed the plates was outdoors and the ground was covered
with gravel, not asphalt (1005 feet MSL). The technical support center was not manned
until floodwaters were near the yard elevation (1004 feet MSL); therefore, floodwaters
could be in the yard before meaningful recommendations could be made. If floodwaters
A3-4 Attachment 3
entered the yard, getting the plates to a location to support cutting and welding may be
difficult.
Experienced welders were onsite, but only three welding machines were available that
could be operated on the three available portable electric generators. A loss of offsite
power was expected at 1008 feet MSL; cutting the plates to size would require a cutting
machine that would not likely be available after a loss of offsite power.
No method was specified for installing the plates, but the tabletop team determined it
was necessary to install them on the water side of the doors, to utilize the water
pressure to keep them in place. To do this, some floodgates would likely need to be
removed. The floodgates had rubber seals, some inflatable, to help prevent in-leakage.
The new plates would not have this feature. This could introduce a new failure
mechanism not previously considered (substantial leakage past a plate at an elevation
below 1009.5 feet MSL).
Flood projections often change and are rarely accurate. If the flood projections started
out below 1009.5 feet MSL and then increased, floodwaters may be upon the floodgates
and sandbag berms, making removal of floodgates and berms unmanageable. The
bottoms of some auxiliary building floodgates sat at approximately 1007 feet MSL.
Large sandbag berms would need to be removed from several doors.
The analyst had asked the licensee to demonstrate the site's capability to erect and
install a steel panel over a representative door, preferably the rollup door. However, at
the time the significance determination was issued, the licensee had not performed a
demonstration. Based on the above, the analyst determined that the time required for
the action was the same as that available.
Stress: High. The stress encountered by the workforce would be high. The welders
and other craftsmen would not likely know that core damage could be imminent if they
did not succeed. Nonetheless, the time pressure on the staff would be significant. In
addition, struggling to complete the task with floodwaters already on site and with limited
resources would add to the pressure.
Complexity: High. With no procedural guidance, the craftsmen would have to devise
strategies on their own to fabricate and install the plates. Interference with floodgates
and sandbag berms would also create obstacles.
Experience: Low. No personnel on site would have sufficient experience with this task.
Welders would be experienced at welding, but the overall task was much more complex.
Procedures: Not available. No procedures were available.
Ergonomics: Missing/Misleading. Craftsmen would likely have to install the new plates
over the doorways while the site was at least partially flooded. At night, it would be dark,
if offsite power was lost, and floodwaters would present a hazardous condition.
Obtaining the construction materials under flooded conditions couid be difficuii. and iarge
heavy machinery may not work in the steel plate storage area.
A3-5 Attachment 3
4. Method 2
Alternate Evaluation: This method was not part of the NRC's normal processes for
evaluating the success of operator actions. The analyst assumed that the licensee could
protect the auxiliary building from floods between 1009.5 and 1014 feet MSL by the
alternate means described above 50 percent of the time. This assumption would reduce
the delta-COF associated with the performance deficiency by a factor of 2.0. Since this
method was outside the NRC processes, no formal credit was provided in the SOP.
A3-6 Attachment 3
FLOODING FREQUENCY SENSITIVITY
1. Flooding frequencies differ by significant amounts.
The uncertainty with the flooding frequencies was high. The licensee used the shape of
the flooding frequency curve at another station (Cooper Nuclear Station) and applied it to
the Fort Calhoun Station flooding frequencies that were provided by the United States
Army Corps of Engineers. The Army Corps of Engineers only provided information out
to the 500-year flood (2E-3/year). The licensee extrapolated the remainder of the
information. A!most a!! of the ca!culated risk was in the extrapolated region. To address
this uncertainty. the analyst assumed that the Army Corps of Engineers data was correct
but the extrapolated information could vary significantly. either higher or lower.
For the sensitivity cases, the analyst targeted the flooding elevation at the 1E-5/year
point for comparison. At the 1E-5/year point on the Fort Calhoun flood hazard curve, the
flood level was 1013.5 feet MSL. The analyst then constructed alternate curves, two
above and two below this base curve. The Curves are shown on the following page.
The curves were numbered Case 1 through Case 5. Case 3 was the licensee's estimate
and was considered the best available information for this assessment.
Using data from the 5 curves, the analyst generated a delta-CDF for each case. The
analyst summarized the results below:
Delta-CDF by Sensitivity Case
Case 2 Case 3*
2.5E-5/year 3.1 E-5/year
- Licensee assumptions
It's important to note that Case 1 may be unrealistically low. After almost 100,000 years
of additional exposure, the flood elevation at the1 E-5/year point was a little over 1 foot
above that predicted by the Army Corps of Engineers at the 1/500 year point. Likewise,
Case 5 may be unrealistically high. The plotted line deviated from the Army Corps of
Engineers' estimates at a sharper angle.
A4-1 Attachment 4
Frequency Extrapolations - Height versus Logarithm of Flood Frequency
Excedance
1019
1018
1017
1016
1015
1014
1013
1012
1011
1010
1009
............ Corp Data
1008
lie Extrap
1007
2
1006~C;)sc3
1005~Casc4
C;)SC S
1004
1003
1002
1001
1000
999
7
996
995
1.00E-06 1.00E-OS LOOE-04 LOOE-03 1.00E-02 LOOE-Ol LOOE+OO
Case 3 was the best estimate case specified by the licensee.
Cases 1 and 2 were sensitivity cases that assumed that the licensee's best estimate was overly
conservative.
Cases 4 and 5 were sensitivity cases that assumed that the licensee's best estimate was non-
_ _ "_ _ _ _ "_J..! ** _
IjUII:::.tl VCllIVt.
A4-2 Attachment 4
SIGNIFICANCE DETERMINATION PROCESS COMBINATIONS
Target Case (Best Estimate)
Licensee's extrapolated flood frequencies
No credit for alternate essential feedwater tank filling method (components under water)
No credit for placing panels over doors (in accordance with SPAR-H)
Credit for gasoline powered pump system (without alternate filling method)
De!ta-CDF = 3.1 E-5 - Yellow
Best Case Assumptions
Best Case: flood frequency
Best Case: alternate essential feedwater tank fill (Attachment 3, SPAR H)
Best Case: alternate actions to place panels over doors (Failure probability = 50 percent, Not
Using SPAR-H)
I Delta-CDF =4E-6 * 0.5 * 0.5 = 1E-6 - White
Worst Case Assumptions
Worst Case Flood Frequency
No Credit for alternate essential feedwater tank filling method
No Credit for placing alternate panels over doors
Credit for gasoline powered pump system (without alternate filling method)
Delta-CDF = 3.5E-5 - Yellow
Target Case + 50 percent Credit for Placing Panels on Doors
Delta-CDF = 1.5E-5 - Yellow
Target Case + Credit for Alternate Essential Feedwater Tank Fill
Licensee's extrapolated flood frequency
Credit for alternate feedwater tank filling procedure
No credit for placing panels over doors
Delta-CDF = 1.5E-5 - Yellow
Target Case + Credit for Alternate Essential Feedwater Tank Fill + 50 percent Credit for
Placing Panels on Doors
A5-1 Attachment 5
Licensee's extrapolated flood frequency
Credit for alternate feedwater tank filling procedure
50 percent credit for placing panels over doors
Delta-CDF =7.5E-6 - White
AS-2 Attachment 5
ADDITIONAL FAULT TREES
Fault Tree 1
Gasoline Powered Pump System
o ~
PORTABLE
D D
o
EFW*XHE*PORTABLE
~
EFW *GDp*IylECH
[ ~J o
a ~
['~
~
EFW*CDp*CCF*RUN*1*4 EFW*GDp*CCF*START PUMp*1 A*FA1lS PL Mp*1 B*FA1LS
o-b o 0
D~ o o 0 t 0- --- 0
EFW*GDP*SSFS*BF EFW*GDp*FS*1A EFW*GDp*CCFR*BF EFW*GDp*FR*IA EFW*GDp*FR*1 A EFW*GDP*FS*1A EFW*GDp*FR*1B EFW*GDp*FS*JB
A6-1 Attachment 6
Fault Tree 2
Gasoline Powered Pump System
with Essential Feedwater Storage Tank Refill from Firewater Tank
9 POR1ABU,
I
[~ 9-9 9 9
g--9
H~-XHE*PORTAB!E EFW-GOP-MECH EIW-GOP-CtT-START
9~(ru'M¢
TANK-AND-PUNI'S-FAIL
g- 9
EFW-XIJE.FIREWfUER
I
GAS-PUMPS-FAIL EFW-GCP.sSFS-J3F EFW-GCP-FS-I A EFW-Gll'-CCTR-BF
I
EFW(;CP-FR-l A
--~
PUMP-IJ3..FAILS
I
D'~'9
9 9 9cw", ~rn~'" 9"w"np~"'lH
I'FWGCP-FR-l J3
Tr
I
HWGCP-FS-lB
EFW-GCP-FR-IA E1W-GDP-FS-1A
99
EFW-GCP-FR-IA EFW-GCP-IOS-IA
A6-2 Attachment 6