IR 05000313/2014010: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(StriderTol Bot change)
 
(8 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Adams
{{Adams
| number = ML16041A383
| number = ML15023A076
| issue date = 02/10/2016
| issue date = 01/22/2015
| title = EA-14-088 Arkansas Nuclear One - Revised Notice of Violation; NRC Inspection Report 05000313/2014010 and 05000368/2014010
| title = (Redacted) Arkansas Nuclear One, Units 1 and 2 - Final Significance Determination of Yellow Finding and Notice of Violation: NRC Inspection Report 05000313/2014010 and 05000368/2014010
| author name = Dapas M L
| author name = Dapas M
| author affiliation = NRC/RGN-IV
| author affiliation = NRC/RGN-IV
| addressee name = Browning J
| addressee name = Browning J
Line 9: Line 9:
| docket = 05000313, 05000368
| docket = 05000313, 05000368
| license number = DPR-051, NPF-006
| license number = DPR-051, NPF-006
| contact person =  
| contact person = Lantz R
| case reference number = EA-14-088
| case reference number = IR 2014010
| document report number = IR 2014010
| document report number = EA-14-088
| package number = ML25056A142
| document type = Enforcement Action, Letter, Notice of Violation
| document type = Enforcement Action, Letter, Notice of Violation
| page count = 18
| page count = 22
}}
}}


Line 19: Line 20:


=Text=
=Text=
{{#Wiki_filter:
{{#Wiki_filter:January 22, 2015
[[Issue date::February 10, 2016]]


EA-14-088
==SUBJECT:==
ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION;


Jeremy Browning, Site Vice President Entergy Operations, Inc.
NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010


Arkansas Nuclear One
==Dear Mr. Browning:==
This letter provides you the final significance determination of the preliminary Yellow finding identified in NRC Inspection Report 05000313/2014009; 05000368/2014009 (ML14253A122),
dated September 9, 2014. A detailed description of the finding is contained in Section 1R01 of that report. The finding was associated with the failure to design, construct, and maintain the Unit 1 and Unit 2 auxiliary building and emergency diesel fuel storage building flood barriers so that they could protect safety-related equipment from flooding.


1448 SR 333 Russellville, AR 72802-0967
At your request, a Regulatory Conference was held on October 28, 2014, to further discuss your views on these findings. A copy of your presentation provided at this meeting is attached to the summary of the Regulatory Conference (ML14329B209), dated November 25, 2014. In your presentation on the risk significance of the finding, you discussed methodologies used by Entergy to develop a probable maximum precipitation and probable maximum flood for the Arkansas Nuclear One site, including development of an annual exceedance probability for the probable maximum flood. You also described mitigation strategies/recovery actions that could have been implemented prior to and in the event of flooding at the site to limit the consequences of the flooding performance deficiencies. Specifically, you presented mitigating strategies to protect site structures and equipment from flood waters, such as installation of an aqua-berm and sandbagging. You also discussed two methods for maintaining reactor core heat removal by providing feedwater to the steam generators from either the service water system or from a portable diesel-driven pump.


SUBJECT: ARKANSAS NUCLEAR ONE - REVISED NOTICE OF VIOLATION; NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010
Based on your staff's evaluation of the probability of success of implementing those mitigating strategies/recovery actions, as well as your staffs estimated initiating event frequencies for external flooding events that would result in flood water elevations above a site grade level of 354 feet Mean Sea Level (MSL) and 356 feet MSL, your staff concluded that the change in core damage frequency from external flooding would be 7.99 x 10-7/yr for Unit 1 and Unit 2. Your staff also determined that there would be additional risk for Unit 2 from an internal flooding event, and minimal additional risk for Unit 1 from internal flooding. With the implementation of


==Dear Mr. Browning:==
UNITED STATES NUCLEAR REGULATORY COMMISSION
On February 23, 2015, Entergy Operations, Inc. (Entergy), the licensee for Arkansas Nuclear One (ANO), provided a response to the U.S. Nuclear Regulatory Commission's (NRC's) Final Significance Determination of Yellow Finding and Notice of Violation report (ML15023A076)
 
issued on January 22, 2015. The response letter is docketed under ML15054A607. The documents can be found in the NRC's Public Document Room or from the NRC's Agencywide Documents Access and Management System (ADAMS), which is accessible from the NRC's Web site at http://www.nrc.gov/reading-rm/adams.html. Specifically, the response letter stated that the licensee agrees that a performance deficiency existed and concurs with both violations, with the exception of one example in the Notice of Violation (Notice) involving the classification of the Unit 1 decay heat vault drain valves. The NRC reviewed the basis for the exception to the example of a violation using Part I, Section 2.3.7, of the NRC Enforcement Manual.
==REGION IV==
1600 E LAMAR BLVD ARLINGTON, TX 76011-4511 similar mitigating strategies/recovery actions, your staff determined that the change in core damage frequency from external and internal flooding events would be 1.36 x 10-6/yr for Unit 2.


Separately, Dale James, ANO Recovery Director, provided comments regarding details described in the final significance determination in NRC Inspection Report 05000313/2014010 and 05000368/2014010 in an email dated February 11, 2015 (ML15079A381). On March 27, 2015, the NRC acknowledged the licensee's letter and email from your staff (ML15086A289). The NRC response to your staff's additional comments is contained in Enclosure 3.
As a result, you concluded that the inspection finding should be characterized as Green, or very low safety significance, for Unit 1, and White, or low-to-moderate safety significance, for Unit 2.


Entergy Position on Classification of Drain Valves
After thoroughly considering the information developed during our inspections and the information you provided at the Regulatory Conference, we have concluded that the significance of this finding is most appropriately determined using Inspection Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. We concluded that the safety significance for the finding involving flooding deficiencies for Unit 1 and Unit 2 is Yellow, a finding having substantial safety significance. This determination was based on qualitative factors due to the high degree of uncertainty that is associated with the estimation of the frequency of an external flooding event. In addition, following the Regulatory Conference, NRC inspectors identified that the mitigation strategies/recovery actions were more complicated or would not work as you presented. We have concluded that some recovery credit is warranted; however, the amount of recovery credit is less than you proposed during the Regulatory Conference. Details regarding our evaluation of the risk significance of the finding are provided in Enclosure 2 of this letter.


Unit 1 decay heat vault drain valves ABS-13 and ABS-14 are manual valves that the licensee classified as non-safety related with no safety-related function. They are maintained closed and are verified closed prior to initiating post-accident reactor building sump recirculation to limit the spread of contaminated liquid outside the decay heat vaults. These valves isolate the vaults from the auxiliary building general area, and are opened as needed to drain water from the decay heat vaults to the auxiliary building sump.
You have 30 calendar days from the date of this letter to appeal the staffs determination of significance for the identified Yellow findings. Such appeals will be considered to have merit only if they meet the criteria provided in Inspection Manual Chapter 0609, Significance Determination Process, Attachment 2. An appeal must be sent in writing to the Regional Administrator, Region IV, 1600 E. Lamar Blvd., Arlington, TX 76011-4511.


The licensee classified these valves with a preventative maintenance classification of Non-Critical - Essential, this ensures that the licensee's engineering staff evaluates and concurs with any proposed changes. Preventative maintenance activities for valves ABS-13 and ABS-14 include a periodic flush and leak rate test, which provides high confidence that the valves can prevent the backflow of water through the drain system. In addition, these valves are included in the licensee's augmented inspection program to manage aging effects.
The NRC has also determined that the failure to design, construct, and maintain the Unit 1 and Unit 2 auxiliary building and emergency diesel fuel storage building flood barriers so that they would protect safety-related equipment from flooding, is a violation of Title 10 of the Code of Federal Regulations (CFR) Part 50, Appendix B, Criterion III, Design Control, and Criterion V, Instructions, Procedures, and Drawings, as cited in the attached Notice of Violation (Notice).


Unit 1 was designed to meet the intent of the original General Design Criteria, which provided the basis for equipment classification. A significant portion of the Unit 1 construction was completed before additional classification guidance appeared in 1972 and 1973. The classification of structures, systems and components was documented in the Final Safety Analysis Report as the Q-List. The Q-List cl assified systems and major components rather than each individual component. At the time, the Atomic Energy Commission accepted this approach to the classification of Unit 1 equipment. The Safety Evaluation Report for the operating license restated the Unit 1 Final Safety Analysis Report definition of Class I. The Safety Evaluation Report concluded that "thi s method of classification meets our [NRC] requirements for the seismic and quality classification of safety-related structures, components
The circumstances surrounding the violations were described in detail in NRC Inspection Report 05000313/2014009; 05000368/2014009. In accordance with the NRCs Enforcement Policy, NRC issuance of this Notice is considered escalated enforcement action because it is associated with a Yellow finding.


and systems."
You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. If you have additional information that you believe the NRC should consider, you may provide it in your response to the Notice. The NRCs review of your response to the Notice will also determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.


In response to Generic Letter 83-28, "Required Actions Based on Generic Implications of Salem ATWS [Anticipated Transient Without Scram]
Because plant performance at the Arkansas Nuclear One facility has been determined to be beyond the "Licensee Response Column" of the NRCs Reactor Oversight Process Action Matrix, as a result of Yellow significance findings for Units 1 and 2, the NRC will use the Action Matrix to determine the most appropriate NRC response to the findings' significance. We will notify you, by separate correspondence, of that determination. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice and Procedure," a copy of this letter, its enclosures, and your response will be made available electronically for public inspection in the NRCs Public Document Room or from the NRCs Agencywide Documents Access and Management System (ADAMS), accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.
Events," the licensee implemented a Component Level Q-list which detailed classification at the component level. During this timeframe, Safety Related (Q) was defined as those systems, structures or components that are relied upon to remain functional during or following design basis events to ensure: (1) the integrity of the reactor coolant pressure boundary, (2) the capability to shut down the reactor and maintain it in a safe shutdown condition, or (3) the capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures comparable to the guideline exposures of 10 CFR Part 100, "Reactor Site Criteria." This definition is consistent with the definition of safety related identified in Generic Letter 83-28 and 10 CFR 50.2. The Unit 1 decay heat vault drain valves ABS-13 and ABS-14 were reviewed against this criterion and were classified as non-safety related by the licensee.


NRC Response
Sincerely,
/RA/


The NRC staff performed a detailed review of the licensee's comments concerning the Unit 1 decay heat vault drain valves documented in Violation 05000313/2014010-01 and 05000368/2014010-01. The violation stated that the licensee failed to design, implement, and maintain the features needed to implement the approved flood mitigation protection for the units.
Marc L. Dapas Regional Administrator


The Unit 1 decay heat vaults contain the low pressure injection pumps, containment spray pumps, shutdown cooling heat exchangers, and associated piping which are part of the engineering safety features (ESF). Because these components perform functions needed to ensure the integrity of the reactor coolant pressure boundary and the capability to shut down the reactor and maintain it in a safe shutdown condition, these ESF components are safety-related and are required to be protected from the effects of flooding. The NRC-approved design specified that the decay heat vault boundaries would prevent water from outside the vaults from entering. However, during the events of March 31, 2013, water from a broken fire main flooded the lower level of the auxiliary building in Unit 1 and entered the Unit 1 train B decay heat vault from a leak through valve ABS-13.
Dockets: 50-313; 50-368 Licenses: DPR-51; NPF-6


The NRC staff previously determined that citing Appendix B to 10 CFR Part 50 is acceptable for non-safety-related components whose failure would impact the safety-related function of structures, systems, and components during design basis accidents. This position is most recently documented in a letter from Scott Morris, Director, Division of Inspection and Regional Support, to a member of the public, Mr. Brady, dated August 29, 2014 (Enclosure 2, ML14175A887). It states:  
Enclosures:  


The requirements of Appendix B to 10 CFR Part 50 apply "to all activities affecting the safety-related functions" of structures , systems, and components (SSCs). The NRC does not treat all SSCs designed to mitigate flooding at a nuclear power plant as safety related. However, if a flood mitigation SSC is designed to protect a safety-related SSC's safety-related function during a design-basis flood, and the flood mitigation SSC would not have provided the required flood protection such that the safety-related function of the safety-related SSC would be affected during a design basis flood, then Appendix B would be applicable.
1. Notice of Violation 2. Final Significance Determination


The staff concluded that, for its flood protection function, the Unit 1 decay heat vault drain valves are important to safety. The staff determined that, in addition to providing flood protection for the ESF equipment, the decay heat vaults provided a radiological barrier function to mitigate the consequences of an accident. The NRC-approved design credited the decay heat vaults as sealed radiological barriers. By specifying the design in this manner, the licensee did not include any radiological leakage from the components in the decay heat vaults in the accident dose calculations or control room habitability calculations. Also, the licensee did not monitor ESF components that could leak (e.g., pump seals, bolted flanges, relief valves, etc.) in an ESF leakage monitoring program to ensure that the combined leakage remains within the accepted offsite and control room dose calculations under accident conditions.
ML15023A076


The NRC staff concluded that valves ABS-13 and ABS-14 mitigate the consequences of an accident that could result in offsite exposures and, therefore, meet the NRC's criteria for those components to be classified as safety-related. The staff noted that the decay heat vaults' ventilation dampers (supply dampers CV-
Letter to Jeremy Browning from Marc L. Dapas dated January 22, 2015
7621 and CV-7622, and exhaust dampers CV-7637 and CV-7638) were appropriately classified as safety-related, but the access doors (Doors 5 and 6) were not appropriately classified as safety-related, as these components also had this accident function.


While the staff has concluded that Unit 1 valves ABS-13 and ABS-14 are required to be classified and treated as safety-related, because they provide an accident dose mitigation function, the violation in question specifically focused on the flood protection design of the plant.
SUBJECT:
ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010


The staff has concluded that it would be appropriate to revise the Notice (violation A, example e)
Distribution RidsOpaMail Resource; RidsOeMailCenter Resource; OEWEB Resource; RidsSecyMailCenter Resource; RidsOcaMailCenter Resource; RidsOgcMailCenter Resource; RidsEdoMailCenter Resource; EDO_Managers;
involving the drain valves. Enclosure 1 re-characterizes the Unit 1 decay heat vault drain valve violation example to focus on the failure to protect the safety-related function of the low pressure injection and containment spray systems during design flood events.


The failure to ensure the design requirements for the decay heat vault drain valves and access doors to support the radiological barrier function to limit the dose consequences to control room operators and the public was determined to be a separate violation of 10 CFR Part 50, Appendix B, Criterion III, "Design Control," and to have very low significance because each component is subject to periodic testing. The final disposition of the radiological barrier function is addressed in NRC Inspection Report 05000313/2015004 and 05000368/2015004 (ML16028A146). As mentioned in Enclosure 1, you are NOT required to respond to the revised Notice. If you choose to respond, clearly mark your response as a "Reply to a Notice of Violation; EA-14-088" and send it to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with a copy to the Regional Administrator, Region IV, 1600 East Lamar Boulevard, Arlington, Texas 76011-4511; and a copy to the NRC resident inspector at Arkansas Nuclear One within 30 days of the date of this letter.
RidsOigMailCenter Resource; RidsOiMailCenter Resource; RidsRgn1MailCenter Resource; RidsOcfoMailCenter Resource; RidsRgn2MailCenter Resource; RidsRgn3MailCenter Resource; NRREnforcement.Resource; RidsNrrDirsEnforcement Resource; Marc.Dapas@nrc.gov; Karla.Fuller@nrc.gov; Roy.Zimmerman@nrc.gov; Anton.Vegel@nrc.gov; Bill.Maier@nrc.gov; Nick.Hilton@nrc.gov; Kriss.Kennedy@nrc.gov; Jeff.Clark@nrc.gov ;
John.Wray@nrc.gov; Troy.Pruett@nrc.gov; Geoffrey.Miller@nrc.gov; Vivian.Campbell@nrc.gov;;
Rachel.Browder@nrc.gov Gerald.Gulla@nrc.gov; Lauren.Casey@nrc.gov; Christi.Maier@nrc.gov; Victor.Dricks@nrc.gov; Robert.Carpenter@nrc.gov; Marisa.Herrera@nrc.gov; Lara.Uselding@nrc.gov; Robert.Fretz@nrc.gov; R4Enforcement; Jeffrey.Clark@nrc.gov; Brian.Tindell@nrc.gov; Jenny.Weil@nrc.gov; Matt.Young@nrc.gov; Fernando.Ferrante@nrc.gov; Greg.Werner@nrc.gov; Cale.Young@nrc.gov; Gloria.Hatfield@nrc.gov; Cayetano.Santos@nrc.gov; Jim.Melfi@nrc.gov; Andrea.George@nrc.gov; Lorretta.Williams@nrc.gov;


In accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding," of the NRC's "Rules of Practice and Procedures,"
Electronic Distribution via Listserv for Arkansas Nuclear One, Units 1 and 2
a copy of this letter will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's Agencywide Documents Access and Management System (ADAMS), accessible from the NRC web site at http://www.nrc.gov/reading-rm/adams.html.


Sincerely,/RA/ Marc Dapas, Regional Administrator
Enclosure 1


Dockets: 50-313; 50-368 Licenses: DPR-51; NPF-6
NOTICE OF VIOLATION


===Enclosures:===
Entergy Operations, Inc.
1 - Notice of Violation 2 - Response to Letter Regarding Citing Flood Protection Violations 3 - Response to Licensee Staff's Comments


ML16041A383 x SUNSI Review By: JLDJ ADAMS x Yes No x Publicly Available Non-Publicly Available x Non-Sensitive Sensitive OFFICE SPE:PBE PE:PBD SRI:PBE SRA:PSB2 ACES NAME JDixon JMelfi BTindell DLoveless JRollins SIGNATURE /RA/ /RA/ /RA/ /RA/ /RA/ DATE 1/19/16 1/20/16 1/20/16 12/2/15 1/20/16 OFFICE C:PBE RC:ORA DD:DRP D:DRP RA NAME NOKeefe KFuller RLantz TPruett MDapas SIGNATURE /RA/ /RA/ /RA/ /RA/ /RA/ DATE 1/20/16 1/21/16 12/9/15 1/22/16 2/10/16 Letter to Jeremy Browning from Marc Dapas dated February 10, 2016.
Dockets: 50-313, 50-368 Arkansas Nuclear One, Units 1 and 2  


SUBJECT: ARKANSAS NUCLEAR ONE - REVISED NOTICE OF VIOLATION; NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010
Licenses: DRP-51, NPF-6


DISTRIBUTION:
EA-14-088
Marc.Dapas@nrc.gov
; Kriss.Kennedy@nrc.gov
; Troy.Pruett@nrc.gov
; Anton.Vegel@nrc.gov ; Jeff.Clark@nrc.gov
; Ryan.Lantz@nrc.gov
; Brian.Tindell@nrc.gov
; Margaret.Tobin@nrc.gov
; Andy.Barrett@nrc.gov
; Neil.OKeefe@nrc.gov
; Geoffrey.Miller@nrc.gov
; Greg.Werner@nrc.gov
; John.Dixon@nrc.gov
; David.Loveless@nrc.gov
; Jim.Melfi@nrc.gov
; Victor.Dricks@nrc.gov
; Andrea.George@nrc.gov
; Marisa.Herrera@nrc.gov
; Karla.Fuller@nrc.gov
; Bill.Maier@nrc.gov; Patricia.Holahan@nrc.gov
; Nick.Hilton@nrc.gov
; Robert.Fretz@nrc.gov
; Gerald.Gulla@nrc.gov
; Robert.Carpenter@nrc.gov
; Fernando.Ferrante@nrc.gov
; Lauren.Casey@nrc.gov
; Jeff.Circle@nrc.gov; Jenny.Weil@nrc.gov
; Loretta.Williams@nrc.gov
; Cindy.Rosales-Cooper@nrc.gov; NRREnforcement Resource@nrc.gov
; R4Enforcement Resource@nrc.gov RIDS Secy Mail Center Resource; RIDS OCA Mail Center Resource; RIDS OGC Mail Center Resource; RIDS EDO Mail Center Resource; RIDS NRR DIRS Enforcement Resource;


Enclosure 1 NOTICE OF VIOLATION Entergy Operations, Inc. Dockets: 50-313, 50-368 Arkansas Nuclear One, Units 1 and 2 Licenses: DPR-51, NPF-6 EA-14-088
During an NRC inspection conducted between February 10, 2014, and August 1, 2014, two violations of NRC requirements were identified. In accordance with the NRC Enforcement Policy, the violations are listed below:  


During an NRC inspection conducted between February 10 and August 1, 2014, two violations of NRC requirements were identified. In accordance with the NRC Enforcement Policy, the violations are listed below:
A.
A. Title 10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in § 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Design changes shall be subject to design control measures commensurate with those applied to the


original design.
10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in § 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Design changes shall be subject to design control measures commensurate with those applied to the original design.


Unit 1, Safety Analysis Report (SAR), Amendment 26, Section 5.1.6, "Flooding," defined the design basis and stated, in part, that seismic class 1 structures are designed for the maximum probable flood level at elevation 361 feet above Mean Sea Level (MSL). The Unit 1 SAR further stated that all seismic class 1 systems and equipment are either located on floors above elevation 361 feet or protected. Sections 5.3.2 and 5.3.5.2 of the SAR indicated that the auxiliary building and emergency diesel fuel storage vault, both quality-related, are seismic Class 1 structures.
Unit 1, Safety Analysis Report (SAR), Amendment 26, Section 5.1.6, "Flooding," defined the design basis and stated, in part, that seismic class 1 structures are designed for the maximum probable flood level at elevation 361 feet above Mean Sea Level (MSL). The Unit 1 SAR further stated that all seismic class 1 systems and equipment are either located on floors above elevation 361 feet or protected. Sections 5.3.2 and 5.3.5.2 of the SAR indicated that the auxiliary building and emergency diesel fuel storage vault, both quality-related, are seismic class 1 structures.


Unit 2, Safety Analysis Report, Amendment 25, Section 3.4.4, "Flood Protection,"
Unit 2, Safety Analysis Report, Amendment 25, Section 3.4.4, "Flood Protection,"
defined the design basis and stated, in part, that seismic Category 1 structures were designed for the probable maximum flood. The Unit 2 SAR further stated that all Category 1 systems and equipment are either located on floors above elevation 369 feet, or protected. Table 3.2-2, "Seismic Categories of Systems, Components, and Structures," of the Unit 2 SAR indicated that the auxiliary building and emergency diesel fuel storage vault, both quality related, are seismic Class 1 structures.
defined the design basis and stated, in part, that seismic category 1 structures were designed for the probable maximum flood. The Unit 2 SAR further stated that all category 1 systems and equipment are either located on floors above elevation 369 feet, or protected. Table 3.2-2, "Seismic Categories of Systems, Components, and Structures," of the Unit 2 SAR indicated that the auxiliary building and emergency diesel fuel storage vault, both quality-related, are seismic class 1 structures.
 
Unit 1, Safety Analysis Report, Amendment 26, Section 5.3.2, "Auxiliary Building,"
stated, in part, that the floor area at elevation 317 feet containing engineered safeguards equipment, was partitioned into separate rooms to provide protection in the event of flooding due to a pipe rupture.
 
Contrary to the above, as of March 31, 2013, the licensee failed to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions and that design changes were subject to design control measures commensurate with those applied to the original design. Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:
 
a. The licensee failed to include a procedural step to install a blind flange in a ventilation duct that penetrated the Unit 1 auxiliary building below the design flood level.


Unit 1, Safety Analysis Report, Amendment 26, Section 5.3.2, "Auxiliary Building," stated, in part, that the floor area at elevation 317 feet containing engineered safeguards equipment, was partitioned into separate rooms to provide protection in the event of flooding due to a pipe rupture.
- 2 -


Contrary to the above, as of March 31, 2013, the licensee failed to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions and that design changes were subject to design control measures commensurate with those applied to the original design. Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:
b. The licensee failed to design the floor drain system with isolation capability so that the drain piping from the turbine building and radwaste storage building, which are non-flood protected structures, would not allow water to drain into the Unit 1 auxiliary building in the event of a flood.
a. The licensee failed to include a procedural step to install a blind flange in a ventilation duct that penetrated the Unit 1 auxiliary building below the design flood level. b. The licensee failed to design the floor drain system with isolation capability so that the drain piping from the turbine building and radwaste storage building, which are non-flood protected structures, would not allow water to drain into the Unit 1 auxiliary building in the event of a flood.


c. The licensee failed to design the Unit 1 Hatch 522 and Unit 2 Door 253, which allow access to the area between the auxiliary buildings and containment buildings, to prevent water intrusion during a design basis flood event.
c. The licensee failed to design the Unit 1 Hatch 522 and Unit 2 Door 253, which allow access to the area between the auxiliary buildings and containment buildings, to prevent water intrusion during a design basis flood event.
Line 139: Line 118:
d. The licensee failed to seal open penetrations into the Unit 1 auxiliary building below the design flood level that were created when the licensee abandoned portions of the waste solidification system.
d. The licensee failed to seal open penetrations into the Unit 1 auxiliary building below the design flood level that were created when the licensee abandoned portions of the waste solidification system.


e. The licensee failed to assure that the Unit 1 decay heat vault drain valves loss of function during a design flood would not impact the safety-related functions of the low pressure injection and containment spray systems.
e. The licensee failed to assure that the Unit 1 decay heat vault drain valves were specified as safety-related, as required to maintain the vaults watertight.
 
B.


B. Title 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," states, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings.
10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"
states, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings.


Unit 1 Quality Drawing A-304, Sheet 1, "Wall and Floor Penetrations Key Plan," Revision 1, and Unit 2, Quality Drawings A-2002, "Architectural Schematic, Fire and Flood Protection Plans and Sections," Revision 10, prescribed walls, ceilings, and floors as flood barriers that required seals.
Unit 1 Quality Drawing A-304, Sheet 1, "Wall and Floor Penetrations Key Plan,"
Revision 1, and Unit 2, Quality Drawings A-2002, "Architectural Schematic, Fire and Flood Protection Plans and Sections," Revision 10, prescribed walls, ceilings, and floors as flood barriers that required seals.


Unit 1, Quality Drawing A-337, "Wall and Floor Penetrations Enclosure Details," Revision 9, and Unit 2 Quality Drawing Series E-2073, "Electrical Penetration Sealing Details," Revision 3, prescribed conduit seal installation details that would act as a barrier to flood water. Unit 2 Quality Drawing Series A-2600, "Fire Barrier Penetration Seal Details," Revision 5, prescribed pipe penetration seal details that would act as a barrier to flood water.
Unit 1, Quality Drawing A-337, "Wall and Floor Penetrations Enclosure Details,"
Revision 9, and Unit 2 Quality Drawing Series E-2073, "Electrical Penetration Sealing Details," Revision 3, prescribed conduit seal installation details that would act as a barrier to flood water. Unit 2 Quality Drawing Series A-2600, "Fire Barrier Penetration Seal Details," Revision 5, prescribed pipe penetration seal details that would act as a barrier to flood water.


Contrary to the above, as of March 31, 2013, the licensee did not accomplish activities affecting quality in accordance with documented instructions, procedures, or drawings.
Contrary to the above, as of March 31, 2013, the licensee did not accomplish activities affecting quality in accordance with documented instructions, procedures, or drawings.


Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:
Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:  
 
a. The licensee failed to install seals in conduits that penetrated flood barriers for the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings.
a. The licensee failed to install seals in conduits that penetrated flood barriers for the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings.


b. The licensee failed to install seals in piping that penetrated flood barriers for the Unit 2 auxiliary building extension.
b. The licensee failed to install seals in piping that penetrated flood barriers for the Unit 2 auxiliary building extension.


c. For the Unit 1 and Unit 2 auxiliary building hatches and building expansion joints between the building and containment, the licensee failed to provide appropriate seal inspection criteria, establish a replacement frequency for the seals, and develop post-maintenance test procedures to verify the effectiveness of the seals after they were reinstalled.
c. For the Unit 1 and Unit 2 auxiliary building hatches and building expansion joints between the building and containment, the licensee failed to provide appropriate seal inspection criteria, establish a replacement frequency for the seals, and  
 
- 3 -
 
develop post-maintenance test procedures to verify the effectiveness of the seals after they were reinstalled.


These violations are associated with a Yellow Significance Determination Process finding for Units 1 and 2.
These violations are associated with a Yellow Significance Determination Process finding for Units 1 and 2.


The NRC has concluded that information regarding the reason for the violations, the corrective actions taken and planned to correct the violation and prevent recurrence and the date when full compliance was achieved is already adequately addressed on the docket in a letter from the licensee dated February 23, 2015, (ML15023A076). However, you are required to submit a written statement or explanation pursuant to 10 CFR 2.201 if the description therein does not accurately reflect your corrective actions or your position. In that case, or if you choose to respond, clearly mark your response as a "Reply to a Notice of Violation; EA-14-088" and send it to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with a copy to the Regional Administrator, Region IV, 1600 East Lamar Boulevard, Arlington, Texas 76011-4511; and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice, within 30 days of the date of the letter transmitting this  
Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Inc., is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN:
Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional Administrator, Region IV, and a copy to the NRC Resident Inspector at Arkansas Nuclear One, within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation; EA-14-088" and should include for each violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation or severity level; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be restored.
 
Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.
 
If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001.
 
Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html, to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the public without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information.
 
If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.
 
Dated this 22nd day of January 2015
 
Enclosure 2
 
ARKANSAS NUCLEAR ONE Final Significance Determination Unit 1 and Unit 2 Flooding Deficiencies
 
As described in NRC inspection report 05000313/2014009; 05000368/2014009 (ADAMS ML14253A122), the NRC used Inspection Manual Chapter (IMC) 0609, Appendix M, Significance Determination Process Using Qualitative Criteria, Table 4.1, Qualitative Decision-Making Attributes for NRC Management Review, to determine the preliminary risk significance for the finding associated with the flooding deficiencies at ANO, Units 1 and 2. The NRC concluded that the preliminary risk significance for the subject flooding deficiencies should be characterized as Yellow, meaning a finding of substantial risk. During the Regulatory Conference held on October 28, 2014, the licensee provided additional information concerning the frequency of significant flooding at ANO, and mitigating startegies/recovery actions that could be taken prior to, and during, a site flooding event. The licensee concluded, based on its extensive analysis, that the risk significance for Unit 1 should be characterized as Green (very low safety significance), and for Unit 2, it should be characterized as White (low to moderate safety significance).
 
The NRC thoroughly reviewed the information provided by the licensee during the Regulatory Conference and completed additional inspections to validate proposed mitigation strategies/recovery actions. The NRC concluded that a final significance determination of substantial risk (Yellow) for the flooding deficiencies on Unit 1 and Unit 2 is appropriate. The following sections of this enclosure discuss the NRCs evaluation of the information presented by the licensee and provide the basis for the NRCs final risk determination.
 
A. ANALYSIS OF LICENSEE INFORMATION USING IM 0609, APPENDIX M CRITERIA
 
1. Bounding Risk Evaluation
 
The current licensing bases for ANO is a Probable Maximum Flood (PMF) event coincident with a failure of the upstream Ozark Dam, requiring protection of the Seismic Category I structures from a flood elevation of 361 feet above Mean Sea Level (MSL), which is 7 feet above the site grade level of 354 feet MSL. Note that all elevations in this enclosure are referenced to MSL. As part of its analysis in developing a response to the NRCs 10 CFR 50.54(f) letter pertaining to the Fukushima Lessons-Learned Near-Term Task Force (NTTF)
Recommendation 2.1 for flooding reevaluation, the licensee derived preliminary results for site flood elevations for a PMF based on current approaches and state-of-the-art methodologies. During the Regulatory Conference, the licensee provided a number of different estimates to establish the likelihood of severe flooding at ANO. It is the NRCs understanding that these preliminary results and supporting calculations will be submitted to the NRC for full review as part of the licensees flooding reevaluation in connection with the 10 CFR 50.54(f) letter response. Consideration of the information presented by the licensee relative to the NRCs final significance determination should not be interpreted as acceptance or rejection of the flooding reevaluation associated with the licensees 10 CFR 50.54(f) response. But rather, this information has been evaluated in the context of making a risk-informed enforcement decision on flood protection related performance deficiencies at ANO. Subsequent evaluation of this information under the NRCs formal
 
- 2 -
 
review process for the licensee submitted flooding reevaluation may or may not result in changes to the ANO flood elevation estimates.
 
The licensee presented information to highlight perceived conservatisms associated with the current licensing basis. The licensee stated that the assumptions which provide a basis for the current licensing basis flood elevation of 361 feet could not be exactly reproduced; therefore, the impact on the Annual Exceedance Probability (AEP) with regard to those original assumptions was not explicitly factored into the NRCs final risk significance determination.
 
The licensees reevaluated flood modeling assumptions resulted in a PMF elevation of 353.8 feet. The NRCs final significance determination result of Yellow is not based on approval or rejection of the licensees reevaluated PMF elevation of 353.8 feet, but rather on the overall risk insights provided by the associated analyses. In making the final significance determination, the NRC recognized that precise estimates for extreme flooding events are not available, that there are limitations on the credibility of flood extrapolation approaches, and that there are significant ranges of uncertainty associated with the results in both the PMF elevations and AEP estimates.
 
The challenges in extrapolating flood frequencies were discussed in a workshop on state-of-the-art probabilistic flood analyses (reference NUREG/CP-0302, Proceeding of the Workshop on Probabilistic Flood Hazard Assessment (PFHA): Held at the U.S. Nuclear Regulatory Commission Headquarters, Rockville, MD, January 29-31, 2013) for extreme events such as the PMF and were mentioned in the NRCs preliminary significance determination letter. The insights from this workshop reaffirmed the NRCs use of qualitative criteria as prescribed by IMC 0609, Appendix M, to conduct significance determination process (SDP) evaluations involving extreme flooding events.
 
At the Regulatory Conference and in documents provided to the NRC prior to the Conference, the licensee presented multiple flood evaluation methods, including flow-based and precipitation-based approaches, to estimate the ANO flood hazard. The licensee indicated that the AEP associated with a relevant Probable Maximum Precipitation (PMP)
depth of 6.93 inches producing a flood elevation of 354 feet (i.e., all floods exceeding site grade elevation) would have a 95 percent confidence level value of 1.44x10-5/year (or 69,444-year return period) with a best estimate median of 1.15x10-6/year (or 869,565-year return period). In addition, the licensee stated that the PMP precipitation depth of 7.27 inches associated with flooding events exceeding a flood elevation of 356 feet at ANO (i.e., exceeding site grade level by 2 feet) would have a 95 percent confidence level AEP of 1.05x10-5/year (or 95,238-year return period) with a best estimate median AEP of 7.94x10-7/year (or 1,259,445-year return period). The licensee indicated that the use of multiple methods provided additional justification for extrapolation of flood frequencies for use in the SDP. In addition, other assumptions and considerations from the hydrologic and hydraulic modeling used by the licensee were characterized as providing additional conservatism in the insights presented.
 
As noted above, the licensee used multiple evaluation methods in its analyses to determine the AEP or flood frequency for PMP events that would cause flooding at or above site grade level. Those analyses, as well as other methods that are equally applicable, led the NRC to conclude that flood frequencies greater than 1x10-4/year may be conservative for the ANO
 
- 3 -
 
site based on available information. By the same token, the NRC concluded that flood frequencies less than 1x10-5/year (100,000-year or greater return period) could not be established with sufficient confidence in best estimate results for the purposes of this SDP evaluation.
 
The NRC noted that the licensee made reference to aspects of each methodology presented by the licensee having been used by other Federal agencies as well as in published literature. As discussed in the workshop held at the NRC in January 2013, the NRC has not approved methods for extrapolating the frequency of extreme events such as the PMF. While some state-of-the-art approaches were discussed in this workshop and have been used in certain applications (e.g., such as the stochastic-based modeling of flooding phenomena for specific watersheds as opposed to more extrapolation-focused techniques), the NRC also noted that: (1) the methods presented by the licensee for ANO are extrapolation-based, and therefore still include significant uncertainty (whether accounted for explicitly or implicitly), and (2) the estimates provided are beyond the typical limits of extrapolation considered as credible in the current state-of-the-art methodologies.
 
For example, the licensees flow-based extrapolation uses an approach described in Bulletin 17-B, Guidelines for Determining Flood Flow Frequency published by the Department of Interior. The applicability of Bulletin 17-B was intended to be limited. This bulletin was designed for applications such as levee and floodplain management, and was not intended for extending estimates to 1-in-10,000 events. It is recognized that the applicability of this method is limited to AEPs in the ranges closer to the available historical record. As stated during the January 2013 workshop held at the NRC, the applicability of such a method was not intended for AEPs in the range of 1x10-4/year (or 10,000-year return period) or less likely events. Similarly, as discussed in the U.S. Department of Interior, Bureau of Reclamation Report DSO-04-08, Hydrologic Hazard Curve Estimating Procedures, there is a relationship between the quality and quantity of data available and the limit on credible extrapolation flood estimates. This includes some of the methods used in the licensees precipitation-based approaches (e.g., L-moments), as well as other methods not included in the ANO estimates (e.g., paleoflood information). Even when combined with optimal information, a limit of 1x10-4/year (or 10,000-year return period) for credible information is acknowledged. As stated in Bulletin 17-B, with regard to regional precipitation data, a similar limit [1x10-4/year] is imposed because of the difficulty in collecting sufficient station-years of clearly independent precipitation records While this bulletin focuses on areas in the Western U.S., the discussions in the workshop held at the NRC in 2013 indicated the challenges described above exist when dealing with limited information, as is the case at ANO. The analyses the licensee presented at the Regulatory Conference attempted to use as much of the available information as possible (e.g., over 3,000 years of equivalent record was added via the L-moments approach), however, without additional stochastic physical modeling or relevant at-site paleoflood data, extrapolation of flood frequencies beyond the level of confidence currently assessed by the community of expert practitioners (10,000 year return period) carries significant uncertainty.
 
While the consideration of multiple extrapolation approaches and the consistency in the results of each of the precipitation-based analysis methodologies do provide additional confidence that AEPs greater than 1x10-4/year (10,000 year or less return period) would be overly conservative for consideration in the final significance determination of these findings, the NRC concluded that AEPs of less than 1x10-5/year (100,000-year or greater return
 
- 4 -
 
period) could not be established with sufficient certainty for the purposes of this SDP evaluation. The NRC recognizes that additional uncertainty not captured by the extrapolated results could impact the bounding results in this assessment and that any extrapolated estimate may involve uncertainty bounds of several orders of magnitude.
 
For example, the flow-based extrapolations developed by the NRC and licensee indicated an upper bound closer to the 1x10-4/year threshold.
 
In summary, the analyses provided by the licensee indicates that, even with a preliminary reevaluated flood hazard analysis (i.e., PMP of 6.93 inches and PMF of 353.8 feet), the resulting 95 percent confidence level AEP does exceed the 1x10-5/year threshold, and that sufficient justification for reliance on a more precise value is not currently available, as these estimates include several orders of magnitude of uncertainty. The NRC concluded that the information provided supports an SDP approach that considers qualitative attributes to determine the significance of the finding in conjunction with the insights associated with the uncertainty and confidence limits provided by the licensee in the flow-based and precipitation-based analyses.
 
2. Defense in Depth
 
The licensees presentation categorized some of the recovery actions as defense-in-depth elements. However, the licensee agreed that normal plant equipment and system alignments for reactor coolant system inventory control, reactor core heat removal, and containment pressure control functions would not be available to mitigate flooding events.
 
The licensee did present proposed mitigating actions to recover safety functions for flood levels above plant grade level. Those recovery actions are discussed in Section B below.
 
3. Reduction in Safety Margin
 
As stated in the NRCs preliminary significance determination letter, the current design basis flood elevation is 361 feet. Flood water above plant grade level of 354 feet could result in the loss of all reactor makeup and cooling pumps, potentially leading to core damage without mitigating actions. The licensee stated that safety would be challenged with flood waters above plant grade level and that the revised PMF elevation of 353.8 feet was below the plant grade level. The licensee presented proposed actions to recover safety functions for flood levels above the plant grade level.
 
4. Effect on Other Equipment
 
The licensee acknowledged that failure of the subject flood barriers could result in failure of the emergency feedwater pumps, high pressure injection pumps, spent fuel pool cooling pumps, emergency diesel generators, decay heat removal pumps, and reactor building spray.
 
5. Degree of Degradation
 
The licensee acknowledged that equipment damaged due to submergence in water could not be recovered.
 
- 5 -  
 
6. Exposure Time; Previous Identification Opportunities
 
The licensee acknowledged that the performance deficiency has existed since construction.
 
The only exceptions were a plant modification in 2002 that resulted in unsealed abandoned equipment and inadequate preventive maintenance activities that caused degradation of flooding seals over time. All quantitative assessment considerations were performed using the one-year assessment period limit in the SDP. The licensee acknowledged that previous identification opportunities for the degraded flood barriers had existed.
 
7. Recovery Actions The NRCs preliminary significance determination did not credit alternative mitigating strategies. During the Regulatory Conference, the licensee provided information related to mitigation strategies to protect the turbine building from flooding by using a temporary flood barrier, and recovery actions to maintain or recover reactor core heat removal functions for both units by establishing water injection to the steam generators from either the service water system or portable pumps. The licensee did not provide long-term recovery actions for restoration of the reactor coolant inventory control function, nor the containment pressure control function. The NRCs evaluation of the licensees proposed mitigation strategies/recovery actions is provided below.
 
8. Additional Circumstances The licensee stated that its revised PMF is below plant grade level and that conservatisms exist in the PMP/PMF estimates to reduce the 95 percent confidence level risk by an order of magnitude. The NRC reviewed the licensees calculations and presentation related to the PMP/PMF as described in Section A.1, Bounding Risk Evaluation, above. The NRC also observed that the licensees risk estimates were based on extrapolations with limited consideration of modeling uncertainty. For estimates of extreme events, information available from the community of experts indicates that considerable modeling uncertainty would be involved. The NRC noted that inclusion of such uncertainty (consideration of which was limited in the licensees upper bound estimates) would increase the 95 percent confidence level value.
 
B. EVALUATION OF THE LICENSEES PROPOSED MITIGATION AND RECOVERY ACTIONS
 
During the Regulatory Conference, the licensee presented five mitigation strategies in the event of a postulated flood above plant grade level. The licensee proposed recovery credit based, in part, on human error probabilities derived from the SHARP1 human reliability analysis (HRA) methodology. The NRC noted that the licensees model reflected human error probabilities assuming typical plant conditions, which are different than plant conditions that may be encountered during a flooding event. The NRC noted that the SHARP1 method did not account for an evaluation of operator diagnostic actions in the absence of procedural guidance, when multiple, competing mitigation strategies/recovery actions are plausible.
 
Based on an evaluation of circumstances under which the operators may be prompted to implement recovery actions, the NRC concluded that failure to diagnose the need to implement recovery actions could be substantially high for a number of the recovery actions.
 
- 6 -
 
The NRC recognizes that human reliability analysis methods for evaluating actions under extreme conditions are limited. The NRC used the SPAR-H HRA method (NUREG/CR-6883) to estimate the human error probabilities associated with potential recovery actions.
 
The SPAR-H method provides an estimate that accounts for timeliness, ergonomics, quality of procedures, and stress while diagnosing and performing tasks. The NRC also included insights gained through direct inspection efforts following the Regulatory Conference.
 
The results of the licensees AEP analysis presented at the Regulatory Conference suggested that approximately 70 percent of flooding events with water level above site grade of 354 feet would also exceed 356 feet. Based on consideration of these estimates, in addition to corresponding information from the 100,000-year return PMP hazard curve developed by the NRCs analysts as part of the preliminary significance determination, the NRC determined that almost half of above-site-grade level flooding events at ANO would also exceed the 356-foot level. The licensee stated that the implementation of the temporary dam mitigation strategy discussed below would not provide mitigation for a flooding event above 356 feet, and that the implementation of the portable pump mitigating strategy discussed below could be more difficult to accomplish for a flood above 356 feet.
 
1. Site Preparation for Flooding
 
During the Regulatory Conference, the licensee presented mitigating actions that could be taken after notification of an impending flood, yet prior to the arrival of flood waters on site.
 
As stated in the NRCs preliminary significance determination letter, the Startup Transformer 02 would be modified before flood waters arrived to permit continued operation and availability of offsite power during the flooding event. In addition, procedural guidance required plant operators to consider moving portable pumps to a staging area in the training center parking lot prior to flood waters arriving onsite, to protect the pumps.
 
During the Regulatory Conference, the licensee stated that upon notification of an impending flood, actions could be taken to protect the turbine building up to a flood elevation of 356 feet. According to the licensee, those actions would be prompted by a corporate-level severe weather procedure that directs corporate assets to be protected from flooding.
 
The licensee proposed a 30 percent failure probability that the site emergency response organization would implement measures to protect the turbine building from postulated floods up to a flood elevation of 356 feet. For flood levels above 356 feet, the licensee agreed the failure probability would approach 100 percent for these site preparation actions.
 
The licensee presented pre-flood preparations that included a water-filled temporary dam, sandbagging, concrete barriers, welding steel barriers over doors, and sealing underground penetrations. The NRC determined that the licensee had not verified that the materials were physically available and could be installed before flood waters exceeded the plant grade level. In addition, the dam, sandbagging, and barriers are temporary equipment and subject to potential failure mechanisms. For example, experience at other sites shows the dam could be punctured during installation or use, or installed over permeable surfaces (gravel) and rendered ineffective. The NRC also concluded that a corporate-level procedure providing a checklist to indicate that temporary flood barriers should be considered does not provide clear planning guidance as described in the preliminary risk determination. Given the non-specific procedural guidance, likely operator mindset that the reactor plant was protected from flooding, and the number of unknown flood deficiencies at ANO, the NRC
 
- 7 -
 
assigned a high (90 percent) failure probability for the installation of temporary flood barriers. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 50 percent. The results of this sensitivity analysis are discussed in Section C. No mitigation credit was given for flood levels above 356 feet.
 
2. Decay Heat Removal Recovery Using Feed to Steam Generators
 
The licensee presented information that would indicate that decay heat removal could be maintained by initiating actions to feed the steam generators by either of two methods.
 
First, the service water system could be used to feed the steam generators through the submerged and idled emergency feedwater system pumps, which required opening of service water to emergency feedwater cross-connect valves. Second, an alternative mitigation strategy, portable diesel-driven pump (portable pump) could be used to supply water to the steam generators. Either of these strategies could be performed first, depending on the diagnosis and choices made by the plant operators. The licensee assumed a nominal combined failure probability of five percent for feeding the steam generators using these strategies. After the Regulatory Conference, NRC inspectors identified several problems with these strategies that were not identified by the licensee which complicated the actions and resulted in the NRCs determination that the failure probabilities assumed by the licensee for these strategies were unrealistic.
 
a. Unit 2 Service Water System Recovery
 
The success of this strategy would require operators to diagnose the need to open service water cross-connect valves to the suction of the emergency feedwater pumps, while the reactor continued to be cooled by the decay heat removal system. Following diagnosis that decay heat removal may be challenged, operators must open the service water supply to emergency feedwater pump suction valves before flooding in the auxiliary building caused a loss of remote operation capability. The NRC determined that adequate time existed for operators to diagnose and align the service water system.
 
Operators would not be able to verify decay heat vault flooding alarm accuracy nor actual water level in the decay heat removal vaults because access to the vaults would be blocked by flood waters. Additionally, there is a single annunciator for all three vaults in Unit 2, and therefore, given flooding in the auxiliary building, operators would be unable to confirm if one or multiple vaults were flooding. Though operators would likely recognize that a flood alarm would be associated with water intrusion from the site flooding event, the combination of the inability to validate the alarm, the lack of indications for individual vaults, and the likely belief by operators that the vaults would not flood since the vaults were thought to be watertight, supported the use of poor ergonomics in the SPAR-H model for human reliability analysis.
 
While emergency operating procedures address using service water as an alternative suction source for the emergency feedwater system, the entry conditions to use emergency operating procedures would not have been met at the time this action would have been required. In addition, pumping service water through an idle emergency feedwater system had not been proceduralized, and therefore the associated actions had not been demonstrated nor had operators been trained on these actions. The NRC
 
- 8 -


Notice of Violation (Notice).
determined that opening of the service water to emergency feedwater cross-tie valves is feasible; however, pre-existing procedures were not available to support diagnosis, the viability of this contingency strategy had not been demonstrated nor had operators trained on it, and the recovery had to be accomplished prior to flooding of the service water valves. Consequently, the NRC determined there was a high (83.5 percent)
failure probability to reposition service water valves prior to their submergence.


If you choose to respond, your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. Therefore, to the extent possible, the response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.
Furthermore, the operators had to initiate feed to the steam generators with service water via the emergency feedwater system with idle feedwater pumps. The licensees evaluation indicated that a service water system pressure of 76 psig was available to provide flow through the emergency feedwater system based on the results of a surveillance test conducted while the system was aligned to the emergency cooling pond. After the Regulatory Conference, NRC inspectors determined that the service water system pressure could be 60 psig based on a review of plant data that represented the conditions and system alignment that would exist for an external flooding event. In addition, the NRC identified that Valve 2CV-1460, a backpressure control valve, could fail open upon a loss of control power, which may reduce system pressure by as much as five psig. Valve 2CV-1460 is at 335 feet in the auxiliary building general area and would be submerged during a flooding event. With service water pressure at approximately 55 psig, the system pressure would be lower than that required to overcome the steam generator pressure and static head of the emergency feedwater system. The NRC determined that the proposed mitigation strategy/recovery action may not result in adequate flow to the steam generators without further operator diagnosis and action.


Revised this 10th day of February 2016
Following the NRCs identification of the possible failure of this proposed mitigation strategy, the licensee provided additional information suggesting that operators could diagnose the system condition and raise service water pressure by starting a third service water pump and isolating the non-safety related, auxiliary cooling water portion of the service water system.


Enclosure 2 RESPONSE TO LETTER REGARDING CITING FLOOD PROTECTION VIOLATIONS August 29, 2014 Mr. Joseph Brady 7726 Turnberry Lane Stanley, NC 28164
The NRC determined that this recovery action would require a moderately complex diagnosis. Multiple variables would need to be evaluated including service water system alignment, unique system configurations, and pump failures in order to diagnose the lack of adequate flow to the steam generators. The ability to evaluate the service water system configuration could be impacted by flood waters throughout the buildings. No procedures existed to diagnose the need to realign valves to increase system pressure.


SUBJECT: U.S. NUCLEAR REGULATORY COMMISSION RESPONSE TO LETTER REGARDING CITING FLOOD PROTECTION VIOLATIONS
In addition, the diagnosis would also involve re-evaluation of operator actions that were taken to align service water to emergency feedwater, since those actions did not result in feed to the steam generators as expected.


==Dear Mr. Brady:==
Restoration of service water pressure to provide for service water flow to the steam generators is feasible, however, the NRC noted that procedures governing this evolution were not available to support diagnosis, the viability of the actions to restore service water system pressure had not been demonstrated or trained on, and the mitigation strategy/recovery actions had to be accomplished before the loss of natural recirculation in the reactor coolant system. Consequently, the NRC determined that there was a 29 percent failure probability for restoring service water pressure such that service water flow to the steam generators could be established. This failure probability also
On behalf of the U.S. Nuclear Regulatory Commission (NRC), I am responding to your correspondence to Chairman Macfarlane dated October 26, 2013 (A gencywide Documents Access and Management System (ADAMS) Accession No. ML14100A257). You questioned the NRC staff's regulatory basis for citing flood protection violations against Title 10 of the Code of Federal Regulations, Part 50 (10 CFR Part 50), Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," and whether these issues should have received an evaluation under 10 CFR 50.109, "Backfitting." You further provided specific examples to demonstrate your concerns.


We appreciate your perspectives. The staff recognizes the importance of flood protection, and we have increased our regulatory focus in this area following the 2011 Fukushima Dai-ichi accident in Japan and the 2011 Missouri River flooding at the Fort Calhoun Station. The NRC continues to look for opportunities to improve our programs to achieve the Principles of Good Regulation (Independence, Openness, Efficiency, Clarity, and Reliability) and the goals of the Reactor Oversight Process (Objective, Risk-informed, Predictable, and Understandable). Based on your concerns, we reviewed the basis for each citation for the specific examples you provided, the associated regulations, applicable Inspection Manual guidance, and associated generic communications.
- 9 -  


The NRC's inspection and enforcement programs are designed to encourage licensees' prompt identification and comprehensive correction of violations of NRC requirements. The NRC recognizes that in some instances multiple applicable violations are associated with a given performance deficiency, and the inspectors and their management determine the most applicable requirement to cite in a notice of violation. Inspection reports and violations are documented in accordance with Inspection Manual Chapter (IMC) 0612, "Power Reactor Inspection Reports," (ADAMS Accession No. ML12244A483) and each report is reviewed by regional management prior to issuance. The NRC uses IMC 0609, "Significance Determination Process [SDP]," (ADAMS Accession No. ML101400479) to determine the safety or security significance of the inspection finding (i.e., performance deficiency). For those violations associated with inspection findings that could be greater than very low safety significance, the NRC convenes a Significance and Enforcement Review Panel (SERP) to review the preliminary significance and basis. The SERP decision-makers comprise management from the applicable regional office, the Office of Nuclear Reactor Regulation, the Office of Enforcement, and others as applicable. The SERP members review the licensee's deficient performance, the safety significance of the finding, and any applicable regulatory requirements that should be cited.
accounted for the dependency of the recovery diagnosis and actions on the preceding initial failure to establish sufficient service water pressure.


J. Brady - 2 -
In summary, the NRC determined that the use of service water to feed the Unit 2 steam generators to provide for decay heat removal, had a very high failure probability (approaching 100 percent), due to the multiple diagnosis efforts and actions involved, including the diagnosis and recovery from the initial failure to establish service water flow; as well as the lack of, or limited, procedural guidance, and time constraints that would exist. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 50 percent. The results of this sensitivity analysis are discussed in Section C.
The staff reviewed each of the examples you provided, as well as several other recent flood-related findings, and determined that although the details varied based on specific circumstances at each site, the bases for citing the violations against Appendix B to 10 CFR Part 50 were justified and adequately documented, as further discussed below. Each of the noted examples underwent a review and approval process, and those of greater significance were evaluated and dispositioned by the SERP process. The staff also noted that the licensees accepted these findings and associated violations, and initiated appropriate corrective actions to address the associated performance deficiencies.


The requirements of Appendix B to 10 CFR Part 50 apply "to all activities affecting the safety-related functions" of structures, systems, and components (SSCs). The NRC does not treat all SSCs designed to mitigate flooding at a nuclear power plant as safety-related. However, if a flood mitigation SSC is designed to protect a safety-related SSC's safety-related function during a design-basis flood, and the flood mitigation SSC would not have provided the required flood protection such that the safety-related function of the safety-related SSC would be affected during a design basis flood, then Appendix B would be applicable. Based on our review of issued flooding findings, there has been no change in a regulatory position or interpretation, so the flooding examples that you cited do not meet the definition of "backfitting" found in 10 CFR 50.109.
b. Unit 1 Service Water System Recovery


Thank you for your interest in this issue. The NRC will continue to make enhancements to our guidance and/or training based on feedback from all stakeholders to ensure a consistent and predictable application of our regulations. We take our safety mission and regulatory responsibilities seriously, and will continue to do so within the bounds of our lawful authority.
The licensee presented information during the Regulatory Conference that the service water system could be used to feed the Unit 1 steam generators through the submerged and idled emergency feedwater system pumps, similar to the alignment described for Unit 2 above.


If you have any further questions or concerns regarding this matter, please contact Mr. Ronald Frahm at (301) 415-2986, or at ronald.frahm@nrc.gov.
The licensee stated that Unit 1 operators would have two hours to diagnose and take action between the time of the first control room alarm notifying operators of water in the decay heat removal vaults, and the time when the service water recovery action would not be available due to submergence of the motor-operated service water to emergency feedwater cross-connect valves. The licensee stated that a second vault alarm would annunciate 1.5 hours before service water valve submergence, providing a second cue.


Sincerely,/RA AHowe for/
The licensee noted that operators would require approximately one hour to diagnose and take the action to open the service water valves.
Scott Morris, Director Division of Inspection and Regional Support Office of Nuclear Reactor Regulation Nuclear Regulatory Commission Enclosure 3 RESPONSE TO LICENSEE STAFF'S COMMENTS In addition to providing the exception to the Notice of Violation, the licensee also provided clarifying questions/comments via email. The NRC docketed this correspondence in ADAMS as ML15079A381 to make the information publically available. The questions/comments and the NRC responses are discussed below:


Comment 1 Comment 1 stated that the classification of the Unit 1 decay heat vault drain valves ABS-13 and ABS-14 as non-safety related is consistent with the licensing basis. These valves are maintained closed and are in the preventative maintenance program, which provides inspection on a periodic frequency. This ensures component reliability is maintained.
Following the Regulatory Conference, NRC inspectors determined that the licensee used assumptions in its decay heat vault flooding analysis that were non-conservative.


NRC Evaluation of Comment 1 This comment reiterated the licensee's position that the decay heat vault drain valves should not be safety-related. The NRC concluded that the non-safety-related classification of the decay heat vault drain valves is not consistent with the licensing basis function for those valves since the licensee did not address all of the required functions. The NRC determined that the flooding protection function would require the drain valves to be considered important to safety, but since the valves failed to perform their flood design function to protect the safety-related functions of the safety-related low pressure injection and containment spray systems, Appendix B to 10 CFR Part 50 is applicable. Example A.e in the Notice of Violation was re-characterized to reflect this change. However, the accident dose mitigation function to preclude any potential to impact offsite and control room operator dose from leakage inside those rooms necessitated that they should be classified as safety-related. The radiological barrier function of the valves will be addressed in NRC Inspection Report 05000313/2015004 and 05000368/2015004.
Specifically, the licensee calculated flows into the vaults assuming empty electrical conduits even though the conduits could be up to 20 percent full of wires. The licensee assumed up to 10 outlets per conduit even though it could be as few as two. The licensee assumed that the conduit high points were at the observed junction boxes even though construction photographs indicated they could be as much as one foot higher than the connection at the junction boxes. The NRC inspectors recalculated the time available between receipt of the decay heat vault alarm and submergence of the service water valves using more realistic assumptions, and determined that the operators would have approximately one hour to diagnose and take action to implement this recovery strategy between the first vault alarm and submergence of the valves. The inspectors determined that the second vaults alarm would annunciate at approximately the same time the service water valves would become submerged, so the operators would have to diagnose the condition with only one vault in an alarm condition. The NRC determined that not enough time existed to diagnose and initiate this service water recovery strategy because with a single vault alarm, operators would have to anticipate both vaults flooding and anticipate that pumping service water through an idled emergency feedwater system would be necessary before decay heat removal failed.


Comment 2
- 10 -


Comment 2 concerned the credit that the NRC used for the human reliability associated with identification of which vault would be flooding. The NRC incorrectly stated that there is a single annunciator for all three vaults in Unit 2 and, therefore, given flooding in the auxiliary building, operators would be unable to confirm if one or multiple vaults were flooding. As a result, the NRC used an assumption of poor ergonomics in the SPAR-H model for human reliability analysis. Annunciator response Procedure 2203.012L, "Annunciator 2K12 Corrective Actions," provides instructions to determine which individual room is affected. The procedure directs the operator to check the back of panel 2C-14 to determine which individual vault is impacted and to dispatch an operator to the affected room to determine the cause.
Therefore, due to the time constraints and lack of cues to indicate the challenge to decay heat removal, the NRC assigned a high failure probability (approaching 100 percent) for the use of service water to feed the Unit 1 steam generators to provide for decay heat removal. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 50 percent. The results of this sensitivity analysis are discussed in Section C.


NRC Evaluation of Comment 2 The ability to identify which decay heat vault room is subject to flooding is one aspect of the human reliability analysis for recovery of decay heat removal using feed to steam generators, specifically service water system recovery. The dominant inputs for the failure probability involved the ability to align the service water supply to the emergency feedwater pump suction valves before flooding in the auxiliary building caused a loss of remote operation capability. The inspectors determined that adequate time existed for operators to diagnose and align the service water system. However, a "Poor" ergonomics factor was assigned because the diagnosis and execution would be performed without previous training and operators would be required to use sections of several procedures to accomplish the lineup, and considering the likely belief by operators that the vaults would not flood since the vaults were thought to be watertight.
c. Alternative Mitigation Pump Recovery Strategy


The inspectors reviewed the annunciator response procedure and walked down the control room indications. The inspectors agree that there are individual vault flooding alarms inside the back of panel 2C-14 in the control room, with reflash capability. However, as stated in the report, operators would not be able to be dispatched to the affected room due to auxiliary building flooding.
The licensee presented information that an alternative mitigation strategy, portable diesel-driven pump (portable pump) could be used to supply water to the steam generators in Unit 1 and Unit 2. Although operators are trained on using the pump in restoring steam generator levels upon loss of a wide range of plant equipment, the alternative mitigating strategies procedure was not intended for a flooding event.


Comment 3
The licensees external flooding procedure directed personnel to consider moving the portable pump to higher ground (training center off-site parking lot) prior to flooding onsite to protect the portable pump from flood water. Although contrary to the guidance in this procedure, the NRC considered as a potential action that operators could anticipate the potential for a loss of all core cooling due to flooding and decide to move the pump onto the site, on an elevated platform, such that it was staged and ready if needed as a potential decay heat removal recovery strategy, before significant flood waters arrived onsite. The NRC concluded that it was much more likely the pump would be moved off-site and protected from flooding, until some other plant indication of potential loss of decay heat removal prompted a diagnosis that the portable pump should be deployed, at which point the pump would need to be moved to the site through existing flood waters.


Comment 3 questioned why the NRC believes se rvice water system pressures would be significantly lower than what was presented duri ng the regulatory conference, or why elevating service water system pressure would be considered a complex scenario. The licensee believed that the NRC did not provide appropriate mitigation strategy/recovery action for establishing adequate service water flow to the steam generators.
The licensee presented a one-hour timeline for this recovery strategy based on a walkthrough of required actions on dry ground. The NRC determined this did not account for challenges that could be imposed from flooding onsite. The road between the training center and the plant is one foot lower than plant grade level. The NRC noted that electrical equipment on the pump skid could be submerged at flood levels of 355 feet or higher during transportation on the normal trailer. Therefore, the NRC determined that the licensee could likely take several hours to load the pump onto another trailer in order to avoid submerging the pump during transport. The NRC also noted that when the road is covered by flood water, the edges of the road will be obscured to the driver, and the driver may need to use spotters at a slow walking speed.


Valve 2CV-1460 (known as the squeeze valve) is not required for service water system operation, but exists only to provide a slight backpressure on the service water system in order to force makeup flow to the cooling tower (main condenser cooling medium). The inspectors were provided information comparing previous service water system pressure/flow testing against simulator alignments. This information assumed normal non-vital service water system loads remained aligned, which results in greater flow and less pressure than would be available if the service water system were aligned to the accident response mode. With valve 2CV-1460 failing to open it was estimated that the service water system pressure at the emergency feedwater pump suction would be approximately 69 psig, sufficient to provide adequate flow to the steam generator to maintain level (margin of approximately 3 gpm). NRC Inspection Report 05000313/2014010 and 05000368/2014010, however, states that service water system pressure at the emergency feedwater pump suction would be on the order of 55-60 psig. The basis for this assumption is unclear.
Once the portable pump was at the proper location, several actions would need to be accomplished to align the portable pump to supply water to the steam generators.


Although the information provided indicated sufficient service water flow and pressure to maintain steam generator level, it was recognized that the estimation was based on simulator modeling and not verified via an actual hydraulic calculation. However, such a calculation was deemed not warranted based on proceduralized simplistic action available to raise service water system pressure significantly.
These would potentially be performed in flood waters and include:


NRC Evaluation of Comment 3 As stated in NRC Inspection Report 05000313/2014010 and 05000368/2014010, the inspectors used actual plant data to determine the possible service water system pressures. The data used was from actual plant events where the service water system alignment was similar to that expected during a potential flood. The inspectors also gave credit for increased service water pump discharge pressure due to flooding in Lake Dardanelle. The licensee used simulator and testing data from the service water system aligned to the emergency cooling pond, which is not representative of flooding conditions. The inspectors concluded that the data used in the inspection report was more realistic than the simulator and testing data. The licensee commented that it was unclear why elevating the service water system pressure would be considered a complex scenario. NRC Inspection Report 05000313/2014010 and 05000368/2014010 provides a detailed explanation of the factors that resulted in the NRC's decision to consider this a complex scenario. Some of these factors include:
Connecting the suction of the pump to a fire hydrant while working in flood water  
* The NRC determined that this recovery action would require a moderately complex diagnosis. Multiple variables would need to be evaluated including service water system alignment, unique system configurations, and pump failures in order to diagnose the lack of adequate flow to the steam generators. The ability to evaluate the service water system configuration could be impacted by flood waters throughout the buildings. No procedures existed to diagnose the need to realign valves to increase system pressure. In addition, the diagnosis would also involve re-evaluation of operator actions that were taken to align service water to emergency feedwater, since those actions did not result in feed to the steam generators as expected.


* Restoration of service water pressure to provide for service water flow to the steam generators is feasible, however, the NRC noted that procedures governing this evolution were not available to support diagnosis, the viability of the actions to restore service water system pressure had not been demonstrated or trained on, and the mitigation strategy/recovery actions had to be accomplished before the loss of natural recirculation in the reactor coolant system. Consequently, the NRC determined that there was a 29 percent failure probability for restoring service water pressure such that service water flow to the steam generators could be established. This failure probability also accounted for the dependency of the recovery diagnosis and actions on the preceding initial failure to establish sufficient service water pressure.
Standing in flood waters to cut piping (Unit 2)


Comment 4
Refueling the pump every 12 to 24 hours in flowing flood waters, and


Comment 4 concerned the timing the NRC used in determining the flooding of the decay heat vaults. The amount of ingress required to initiate the decay heat vault A/B flooding alarm is approximately 1200/850 gallons, respectively. In order to obtain the timing as described in NRC Inspection Report 05000313/2014010 and 05000368/2014010 the flow-rate would have to be reduced considerably. Any reduction in flow-rate that would delay the alarms would also delay the loss of decay heat pumps P-35A/B. The increased time the components will be available directly relates to the additional analyses as it would reduce the decay heat load, the required steam generator makeup flow rate, etc. The method of recovery options would also increase
- 11 -  


and would extend the time that the decay heat pumps would be available.
Potentially isolating transformer fire deluge valves that actuate due to submergence, to maintain fire protection system pressure


Additionally, the assumptions used in the licensee's analyses were consistent. In applying modifications to the proposed inflow rates based on system resistance for the decay heat vaults and not applying the same assumptions to the general auxiliary building ingress rates, as was done in the referenced report, the allotted time before alarm and the time to achieve a water level of 335 feet in the auxiliary building general area is not conservative and would provide questionable results.
While the licensee presented a one-hour time to transport and align the portable pump, the NRC determined that the transport and system alignment time could be greater than seven hours. Although operators are trained on using the pump in restoring steam generator levels upon loss of a wide range of plant equipment, the implementation of these actions is not contained in a procedure used for a flooding event.


NRC Evaluation of Comment 4 As stated in NRC Inspection Report 05000313/2014010 and 05000368/2014010, the assumed inflow rate was reduced to account for conduit fill and conduit height. This would increase the time the components would be available before submergence. For external flooding, the reactor would likely be shut down for several days bef ore floodwater could impact safety equipment resulting in a lower decay heat load, and therefore a decreased steam generator makeup rate. However, this has no impact on the probability of success for the service water system recovery scenario. As documented in the report, the inspectors concluded that there may not be forward flow of service water through the emergency feedwater system until operators took action to raise service water system pressure. If operators took action, it was assumed that adequate flow was established. Therefore, the decay heat load was not a factor in the conclusion.
Unit 2 Specific Information


The inspectors also adjusted the assumed inflow rate to the auxiliary building based on conduit fill to ensure consistent results. The conduit height assumption was not applicable to the auxiliary building inflow because the turbine building was assumed to quickly flood and, therefore, any high point in the turbine building would not delay inflow to the auxiliary building. Therefore, the inspectors applied consistent fill rate assumptions to the decay heat vaults and  
In Unit 2, the recovery strategy presented by the licensee would involve pressurizing a startup and blowdown demineralizer header and then using the pressurized header to backfeed into the main feedwater header. Following the Regulatory Conference, NRC inspectors identified that pressure control valves on this demineralizer header could fail open during a flooding scenario due to loss of instrument air pressure. NRC inspectors determined that portable pump flow would be diverted away from the steam generators through the open pressure control valves unless the licensee had closed the valves during demineralizer realignment for full flow secondary cleanup during plant cooldown prior to the arrival of flood water onsite. The decision to perform the demineralizer alignment depended upon available operations resources, the recommendations from chemistry personnel, and the availability of a fresh demineralizer resin load. The NRC assigned a failure probability of 50 percent for the demineralizer realignment. This demineralizer realignment would need to be accomplished in addition to successful portable pump transport and fire protection system alignment for the alternative mitigation pump recovery strategy to be effective. In addition to the factors discussed above, the Unit 2 procedures for implementing this mitigation strategy were incomplete because isolation valves would need to be opened that were not listed, relief valves requiring gags would be under water, and alternate methods to throttle flow were not included.


the auxiliary building. For all analyzed timelines, the NRC used the inspectors' vault inflow analysis, which increased the amount of time available for recovery credit.
The NRC determined that use of the alternative mitigation pump recovery strategy for Unit 2 appeared to be feasible, if the shutdown activities resulted in the secondary system being placed in the cleanup configuration. The recovery strategy could be impacted by incomplete procedures and environmental conditions related to flood waters onsite. The NRC assigned a high (85 percent) failure probability for use of the portable pump on Unit 2. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 37 percent. The results of this sensitivity analysis are discussed in Section C.


NRC Inspection Report 2014010 documented that there was adequate time for Unit 2 operators to diagnose and align the service water system to emergency feedwater for recovery credit. However, the potential Unit 2 flow diversion, incomplete procedures, and environmental
Unit 1 Specific Information


conditions were a more significant contributor to the NRC's conclusion than the timing analysis. The report also documents that there was insufficient time for Unit 1 operators to diagnose and align the service water system to emergency feedwater for recovery credit. For Unit 1, the timing analysis was not as significant to the conclusion as the environmental condition.
With respect to Unit 1, similar challenges existed for the success of the alternative mitigation pump recovery strategy as compared to Unit 2, with two significant exceptions: (1) the flow diversion issues described above were not applicable to Unit 1; and (2) Unit 1 procedures included the necessary valve alignments. The NRC assigned a 37 percent failure probability for use of the portable pump with respect to Unit 1. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be


Consequently, the proposed Unit 1 recovery received a lower failure probability and further sensitivity analysis was performed that bounded the range of assumptions.
- 12 -


Comment 5 Comment 5 discussed the time delay the NRC used for the availability of the alternative mitigation pump to provide water to feed both Units 1 and 2 steam generators, and the potential unavailability as a result of submerging electrical components during transportation. Procedure OP-1203.48, "Security Event," Attachment J, Section 10, prescribes how to transport and use the alternative mitigation pump to supply water to feed both Units 1 and 2 steam generators.
with an assumed lower failure probability of 25 percent. The results of this sensitivity analysis are discussed in Section C.


Using the procedure, the alternative mitigation pump and equipment trailer were timed from the secondary operations support center parking lot to the protected area (sally port), as documented in Condition Report CR-ANO-C-2014-02804. The secondary operations support center was used as a starting point due to procedural guidance that directs locating the equipment to higher elevations, and the secondary operations support center would be manned due to site flooding. The travel time required for all normal security checks was included to account for any slower travel that would occur due to postulated flood waters. The time validation to greater than 200 gpm feed to the steam generators was validated to be less than one hour for each unit and included an additional 15 minutes added for pump starting, charging fire water hoses, and manipulating plant valves to send water to the steam generators.
3. Additional Qualitative Factors Influencing the Risk Assessment As documented in the NRCs preliminary risk determination letter, the NRC concluded that internal flooding events pose additional risk significance for the flooding-related performance deficiencies. Failure of expansion boots in the Unit 1 and Unit 2 circulating water system is the highest contributor to risk for internal flooding in both Units. The licensee agreed that internal flooding was an important contributor to the overall risk of flooding. The licensee stated that the initiating event frequency for internal flooding for Unit 1 was minimal, and for Unit 2 was 9.03x10-5/year. With respect to internal flooding, the NRC assigned the same recovery credit for mitigation strategies as described in Section B.2 for external flooding, except that the Unit 2 portable pump recovery strategy would not work because the secondary system would not be aligned in the cleanup configuration. The Unit 2 high initiating event frequency for internal flooding coupled with reduced recovery credit was a significant contributor to the final significance determination for Unit 2, in that the risk contribution from internal flooding events alone was Yellow for Unit 2. The NRC agreed that the failure frequency of the circulating water system was lower for Unit 1 than for Unit 2; however, because the circulating water expansion joints in Unit 1 had a metallic component and were not all hard piping as assumed in the licensees failure probability model, the NRC determined that a more appropriate model of the Unit 1 expansion joints would provide a higher failure frequency for the circulating water system than provided by the licensee. As documented in the NRCs preliminary significance determination letter, the contribution to risk for Unit 1 from internal flooding was qualitatively assessed as Greater-than-Green. This risk contribution would be added to the significance determination results from external flooding events to determine an overall flooding SDP result for Unit 1.


In addition, follow-up information was provided to the NRC regarding transportation of the normal trailer through flood waters. Movement of the alternative mitigation pump was judged to be practical using normal means (towing) up to a water level of 356 feet. Specific components that would be wetted or submerged during the fording event were evaluated and no impact due to submergence would be expected. NRC Evaluation of Comment 5 The inspectors observed the time validation of the alternative mitigation pump strategy and reviewed Condition Report CR-ANO-C-2014-02804. The inspectors noted that the condition report, as well as the text of Comment 5, state that "the travel time required for all normal security checks was included to account for any slower travel that would occur due to postulated flood waters." The inspectors concluded that the time required to perform normal security checks does not directly correspond to the time needed to transport this equipment during the postulated flood conditions. Therefore, the inspectors evaluated the effects specific to flooding.
The licensee stated at the Regulatory Conference that it would have enough time to perform an orderly shutdown and cooldown in the event of a flood. The licensee stated that both units steam generators would be placed in wet layup, which would provide for additional time to respond to, and recover from, a subsequent loss of decay heat removal. However, according to the operations managers for both units, if the licensee anticipates a short outage and chooses to maintain condenser vacuum, the steam generators would not be placed in wet layup. Therefore, Unit 1 operators would have approximately 1.5 hours from a loss of decay heat removal to a loss of natural circulation cooling for the reactor, and Unit 2 operators would have several hours. This is different than the information in the timeline presented by the licensee in the Regulatory Conference. Although the NRC did not explicitly use the shorter timeline associated with the steam generators not being in a wet layup condition, if the NRC had included that assumption in the SDP analysis it would result in additional risk to the qualitative assessment.


The inspectors concluded that, based on the water level expected to be covering the road (several feet), the probability of successfully transporting the pump on a trailer without a conveyer system of some sort anchored at each end would be low due to the forces of the water acting on the trailer.
The NRC identified that the need to establish and maintain a method of long-term reactor coolant system inventory makeup and control is an important risk consideration that could represent additional risk significance for a flooding event in light of the performance deficiencies. The preliminary significance determination stated that all


NRC Inspection Report 05000313/2014010 and 05000368/2014010 documents that the NRC concluded that the licensee could likely take several hours to load the alternative mitigation pump onto another trailer in order to avoid submerging the pump during transport. Whether the licensee chose to test and evaluate the fording strategy, or load the pump onto a taller trailer, the result would be a several hour delay. Therefore, the licensee's comment would not change the conclusion.
- 13 -


Comment 6
reactor coolant system makeup pumps were below the postulated flood levels of concern and would fail given a flood at or above the site grade of 354 feet. The licensee presented a strategy of using manual control of the core flood tanks (Unit 1) or safety injection tanks (Unit 2) to maintain sufficient inventory in the reactor coolant system to support adequate core cooling capability for a short period of time (up to 72 hours). The licensee did not present a strategy beyond 72 hours for long-term reactor coolant system inventory control.


Comment 6 stated that the NRC used incorrect failure frequencies for Units 1 and 2 circulating water system expansion joints. Unit 1 has rubb er expansion joints which have a higher rupture frequency than Unit 2, which has metal expansion joints, based on EPRI data on pipe rupture frequencies. The initiating event frequency for internal flooding for Unit 1 was not provided since the consequence was insignificant, which was based on determination of flood water hydraulics. The frequency and consequence are the basis for change in risk, and since the consequence is minimal, the risk is minimal. The circulating water drains to the lake for Unit 1.
C. CONCLUSIONS


NRC Evaluation of Comment 6
Based on its extensive evaluation, including careful consideration of the information provided by the licensee, the NRC determined that no change to the preliminary risk significance determination result of Yellow for both Unit 1 and Unit 2 is warranted.


NRC Inspection Report 05000313/2014010 and 05000368/2014010 documents that the licensee's evaluation of the frequency of internal flooding due to a circulating water system failure did not account for expansion joints, which are more likely to fail than piping. It was the NRC's understanding that Unit 1 contained metallic circulating water expansion joints. The NRC agrees that rubber expansion joints are expected to have a higher failure rate than metal joints. This information changes the NRC's understanding of which unit contains metallic and which unit contains rubber expansion joints. However, in NRC Inspection Report 05000313/2014009 and 05000368/2014009 (ML14253A122), the NRC considered the correct failure frequency for each unit as provided by the licensee, Unit 1 was minimal and
The licensee used a range of evaluation methods, including flow-based and precipitation-based approaches, to determine the AEP or flood frequency for PMP events that would cause flooding at or above site grade level. These methods are extrapolation-based, and therefore include significant uncertainty, and the resulting estimates provided by the licensee are beyond the typical limits of extrapolation considered credible in the current state-of-the-art methodologies for determining the frequency of extreme events. While the consideration of multiple extrapolation approaches and the consistency in the results of each of the precipitation-based analysis methodologies do provide additional confidence that AEPs greater than 1x10-4/year (10,000 year or less return period) would be overly conservative for consideration in the final significance determination of these findings, the NRC concluded that AEPs of less than 1x10-5/year (100,000-year or greater return period) could not be established with sufficient certainty for the purposes of this SDP evaluation.


Unit 2 was 9.03x10
The NRC concluded that several of the mitigation and recovery strategies proposed by the licensee would likely not have succeeded due to unrecognized system alignment issues that were identified by NRC inspectors. In addition, the NRC concluded that the licensee underestimated the complexity and environmental challenges that would be faced by the operators in diagnosing and implementing these strategies. Consequently, the NRCs final risk determination reflects significantly less mitigation credit than proposed by the licensee.
-5/year, respectively. Therefore, this is an administrative error as the correct failure frequency for each unit was used. As a result, there is no change to the Significance Determination Process conclusions or the color of the findings. Comment 7 Comment 7 concerned the NRC credit given for placing both units' steam generators to be in a wet layup condition during an external flooding event.


The basis for the Unit 1 steam generators to be in a wet layup condition during an external flooding event was provided in a position paper to the NRC. First, Steps 12 and 13 of Procedure 1203.025, "Natural Emergencies" requires the removal of equipment from service AND de-energizing power supplies to below-grade equipment prior to flooding, and securing of nonessential loads prior to flood waters exceeding elevation 354 feet. Second, the completion of these steps will require securing the condensate pumps and condenser vacuum pumps located below grade in the turbine building basement. Lastly, for chemistry control with the secondary system secured, steam generators will be placed in a wet layup condition in accordance with Procedures OP-1102.010, "Plant Shutdown and Cooldown," Step 11.9.3 and OP-1106.008, "OTSG Secondary Fill, Drain, and Layup."
While the NRC concluded that reliance on a more precise value between the thresholds of 1x10-5/year to 1x10-4/year for the AEP or flood frequency of PMP/PMF events cannot be justified, given the credible limits of extrapolation in the current state-of-the-art methodologies for determining the frequency of extreme events, the NRC performed a quantitative analysis using the licensees 95 percent confidence level AEP of 1.44x10-5/year as an initiating event frequency. As discussed above, the NRC did not consider AEPs of less than 1x10-5/year to be credible. Consequently, the NRC concluded that use of the licensees best estimate value for AEP of 1.15x10-6/year would not provide meaningful risk insights. Using the AEP value of 1.44x10-5/year, the NRC then applied what it considered to be appropriate credit for the mitigation and recovery strategies as described in Sections A and B of Enclosure 2. The results for Unit 1 and Unit 2 were as follows:


NRC Evaluation of Comment 7
For Unit 1, after application of the failure probabilities for external flooding mitigation strategies as described in Sections B.1, B.2.b, and B.2.c, the SDP result for Unit 1 was White. In the context of a sensitivity analysis, the NRC applied overly optimistic failure


The licensee did not provide a formal position paper that was reviewed, approved, or entered into a formal records system to the inspectors. The licensee provided the inspectors with expected secondary conditions for a flood based on existing plant procedures. The discussion with the inspectors focused on the same procedures and steps that are outlined in Comment 7.
- 14 -


No new information was provided.
probabilities for external flooding mitigation strategies as described in Sections B.1, B.2.b, and B.2.c, and the SDP result remained White.


As documented in NRC Inspection Report 05000313/2014010 and 05000368/2014010, the inspectors interviewed the operations managers for both units regarding the implementation of the stated procedures. The managers stated that there was some probability that the units may not be placed in wet layup given the amount of temporary flood protections, the amount of pre-planning and notice given, and the potential desire to shorten the forced outage.
For Unit 2, as stated in Section B.3, the risk from internal flooding alone resulted in an SDP result of Yellow. In the context of a sensitivity analysis, the NRC applied an overly optimistic failure probability of 10 percent for the service water mitigation strategy for internal flooding, as well as overly optimistic failure probabilities for external flooding mitigation strategies as described in Sections B.1, B.2.a, and B.2.c. The SDP result for this Unit 2 sensitivity analysis remained Yellow.


Additionally, NRC Inspection Report 05000313/2014010 and 05000368/2014010 documents that the NRC did not explicitly use the shorter timeline associated with the steam generators not being in a wet layup condition. If the NRC had included that assumption, it would result in
Given the current lack of confidence in a definitive approach to establish initiating event frequency best estimates for consideration in extreme flooding events, IMC 0609 Appendix M provides the appropriate method for determining the final significance. Notwithstanding, the quantitative analysis described above was conducted to provide risk insights to the Appendix M qualitative assessment. As described in the NRCs preliminary risk determination letter, Appendix M specifies that a bounding, i.e., worst case, analysis should be conducted using the best available information, followed by the consideration of appropriate qualitative factors in determining the significance of the associated finding. With respect to the bounding analysis, the NRC determined that the upper bound AEP was less than 1x10-4/year, therefore, the upper bound risk assessment per Appendix M is Yellow.


additional risk to the qualitative assessment. The NRC assumed the units would be in wet layup, and this was considered to be a qualitative factor only.
With respect to the consideration of appropriate qualitative factors in determining the significance of the associated finding, the NRCs assessment of those qualitative factors and corresponding results, are described in Section A.1-8. In summary, for Unit 2, the significant additional risk contribution due to internal flooding and limited credit for external flooding mitigation and recovery strategies, results in a final significance determination of Yellow. For Unit 1, the risk profile is less severe than for Unit 2, both in the failure probability of the portable pump mitigation strategy and the contribution from internal flooding. However, based primarily on flood frequency uncertainties and the lack of long-term recovery actions for restoration of the reactor coolant inventory control function and the containment pressure control function, the NRC determined that a final significance determination of Yellow was appropriate for Unit 1.
}}
}}

Latest revision as of 22:06, 25 March 2025

(Redacted) Arkansas Nuclear One, Units 1 and 2 - Final Significance Determination of Yellow Finding and Notice of Violation: NRC Inspection Report 05000313/2014010 and 05000368/2014010
ML15023A076
Person / Time
Site: Arkansas Nuclear  Entergy icon.png
Issue date: 01/22/2015
From: Dapas M
NRC Region 4
To: Jeremy G. Browning
Entergy Operations
Lantz R
Shared Package
ML25056A142 List:
References
IR 2014010 EA-14-088
Download: ML15023A076 (22)
v • d • e


Text

January 22, 2015

SUBJECT:

ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION;

NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010

Dear Mr. Browning:

This letter provides you the final significance determination of the preliminary Yellow finding identified in NRC Inspection Report 05000313/2014009; 05000368/2014009 (ML14253A122),

dated September 9, 2014. A detailed description of the finding is contained in Section 1R01 of that report. The finding was associated with the failure to design, construct, and maintain the Unit 1 and Unit 2 auxiliary building and emergency diesel fuel storage building flood barriers so that they could protect safety-related equipment from flooding.

At your request, a Regulatory Conference was held on October 28, 2014, to further discuss your views on these findings. A copy of your presentation provided at this meeting is attached to the summary of the Regulatory Conference (ML14329B209), dated November 25, 2014. In your presentation on the risk significance of the finding, you discussed methodologies used by Entergy to develop a probable maximum precipitation and probable maximum flood for the Arkansas Nuclear One site, including development of an annual exceedance probability for the probable maximum flood. You also described mitigation strategies/recovery actions that could have been implemented prior to and in the event of flooding at the site to limit the consequences of the flooding performance deficiencies. Specifically, you presented mitigating strategies to protect site structures and equipment from flood waters, such as installation of an aqua-berm and sandbagging. You also discussed two methods for maintaining reactor core heat removal by providing feedwater to the steam generators from either the service water system or from a portable diesel-driven pump.

Based on your staff's evaluation of the probability of success of implementing those mitigating strategies/recovery actions, as well as your staffs estimated initiating event frequencies for external flooding events that would result in flood water elevations above a site grade level of 354 feet Mean Sea Level (MSL) and 356 feet MSL, your staff concluded that the change in core damage frequency from external flooding would be 7.99 x 10-7/yr for Unit 1 and Unit 2. Your staff also determined that there would be additional risk for Unit 2 from an internal flooding event, and minimal additional risk for Unit 1 from internal flooding. With the implementation of

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION IV

1600 E LAMAR BLVD ARLINGTON, TX 76011-4511 similar mitigating strategies/recovery actions, your staff determined that the change in core damage frequency from external and internal flooding events would be 1.36 x 10-6/yr for Unit 2.

As a result, you concluded that the inspection finding should be characterized as Green, or very low safety significance, for Unit 1, and White, or low-to-moderate safety significance, for Unit 2.

After thoroughly considering the information developed during our inspections and the information you provided at the Regulatory Conference, we have concluded that the significance of this finding is most appropriately determined using Inspection Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. We concluded that the safety significance for the finding involving flooding deficiencies for Unit 1 and Unit 2 is Yellow, a finding having substantial safety significance. This determination was based on qualitative factors due to the high degree of uncertainty that is associated with the estimation of the frequency of an external flooding event. In addition, following the Regulatory Conference, NRC inspectors identified that the mitigation strategies/recovery actions were more complicated or would not work as you presented. We have concluded that some recovery credit is warranted; however, the amount of recovery credit is less than you proposed during the Regulatory Conference. Details regarding our evaluation of the risk significance of the finding are provided in Enclosure 2 of this letter.

You have 30 calendar days from the date of this letter to appeal the staffs determination of significance for the identified Yellow findings. Such appeals will be considered to have merit only if they meet the criteria provided in Inspection Manual Chapter 0609, Significance Determination Process, Attachment 2. An appeal must be sent in writing to the Regional Administrator, Region IV, 1600 E. Lamar Blvd., Arlington, TX 76011-4511.

The NRC has also determined that the failure to design, construct, and maintain the Unit 1 and Unit 2 auxiliary building and emergency diesel fuel storage building flood barriers so that they would protect safety-related equipment from flooding, is a violation of Title 10 of the Code of Federal Regulations (CFR) Part 50, Appendix B, Criterion III, Design Control, and Criterion V, Instructions, Procedures, and Drawings, as cited in the attached Notice of Violation (Notice).

The circumstances surrounding the violations were described in detail in NRC Inspection Report 05000313/2014009; 05000368/2014009. In accordance with the NRCs Enforcement Policy, NRC issuance of this Notice is considered escalated enforcement action because it is associated with a Yellow finding.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice when preparing your response. If you have additional information that you believe the NRC should consider, you may provide it in your response to the Notice. The NRCs review of your response to the Notice will also determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

Because plant performance at the Arkansas Nuclear One facility has been determined to be beyond the "Licensee Response Column" of the NRCs Reactor Oversight Process Action Matrix, as a result of Yellow significance findings for Units 1 and 2, the NRC will use the Action Matrix to determine the most appropriate NRC response to the findings' significance. We will notify you, by separate correspondence, of that determination. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice and Procedure," a copy of this letter, its enclosures, and your response will be made available electronically for public inspection in the NRCs Public Document Room or from the NRCs Agencywide Documents Access and Management System (ADAMS), accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.

Sincerely,

/RA/

Marc L. Dapas Regional Administrator

Dockets: 50-313; 50-368 Licenses: DPR-51; NPF-6

Enclosures:

1. Notice of Violation 2. Final Significance Determination

ML15023A076

Letter to Jeremy Browning from Marc L. Dapas dated January 22, 2015

SUBJECT:

ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION; NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010

Distribution RidsOpaMail Resource; RidsOeMailCenter Resource; OEWEB Resource; RidsSecyMailCenter Resource; RidsOcaMailCenter Resource; RidsOgcMailCenter Resource; RidsEdoMailCenter Resource; EDO_Managers;

RidsOigMailCenter Resource; RidsOiMailCenter Resource; RidsRgn1MailCenter Resource; RidsOcfoMailCenter Resource; RidsRgn2MailCenter Resource; RidsRgn3MailCenter Resource; NRREnforcement.Resource; RidsNrrDirsEnforcement Resource; Marc.Dapas@nrc.gov; Karla.Fuller@nrc.gov; Roy.Zimmerman@nrc.gov; Anton.Vegel@nrc.gov; Bill.Maier@nrc.gov; Nick.Hilton@nrc.gov; Kriss.Kennedy@nrc.gov; Jeff.Clark@nrc.gov ;

John.Wray@nrc.gov; Troy.Pruett@nrc.gov; Geoffrey.Miller@nrc.gov; Vivian.Campbell@nrc.gov;;

Rachel.Browder@nrc.gov Gerald.Gulla@nrc.gov; Lauren.Casey@nrc.gov; Christi.Maier@nrc.gov; Victor.Dricks@nrc.gov; Robert.Carpenter@nrc.gov; Marisa.Herrera@nrc.gov; Lara.Uselding@nrc.gov; Robert.Fretz@nrc.gov; R4Enforcement; Jeffrey.Clark@nrc.gov; Brian.Tindell@nrc.gov; Jenny.Weil@nrc.gov; Matt.Young@nrc.gov; Fernando.Ferrante@nrc.gov; Greg.Werner@nrc.gov; Cale.Young@nrc.gov; Gloria.Hatfield@nrc.gov; Cayetano.Santos@nrc.gov; Jim.Melfi@nrc.gov; Andrea.George@nrc.gov; Lorretta.Williams@nrc.gov;

Electronic Distribution via Listserv for Arkansas Nuclear One, Units 1 and 2

Enclosure 1

NOTICE OF VIOLATION

Entergy Operations, Inc.

Dockets: 50-313, 50-368 Arkansas Nuclear One, Units 1 and 2

Licenses: DRP-51, NPF-6

EA-14-088

During an NRC inspection conducted between February 10, 2014, and August 1, 2014, two violations of NRC requirements were identified. In accordance with the NRC Enforcement Policy, the violations are listed below:

A.

10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in § 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions. Design changes shall be subject to design control measures commensurate with those applied to the original design.

Unit 1, Safety Analysis Report (SAR), Amendment 26, Section 5.1.6, "Flooding," defined the design basis and stated, in part, that seismic class 1 structures are designed for the maximum probable flood level at elevation 361 feet above Mean Sea Level (MSL). The Unit 1 SAR further stated that all seismic class 1 systems and equipment are either located on floors above elevation 361 feet or protected. Sections 5.3.2 and 5.3.5.2 of the SAR indicated that the auxiliary building and emergency diesel fuel storage vault, both quality-related, are seismic class 1 structures.

Unit 2, Safety Analysis Report, Amendment 25, Section 3.4.4, "Flood Protection,"

defined the design basis and stated, in part, that seismic category 1 structures were designed for the probable maximum flood. The Unit 2 SAR further stated that all category 1 systems and equipment are either located on floors above elevation 369 feet, or protected. Table 3.2-2, "Seismic Categories of Systems, Components, and Structures," of the Unit 2 SAR indicated that the auxiliary building and emergency diesel fuel storage vault, both quality-related, are seismic class 1 structures.

Unit 1, Safety Analysis Report, Amendment 26, Section 5.3.2, "Auxiliary Building,"

stated, in part, that the floor area at elevation 317 feet containing engineered safeguards equipment, was partitioned into separate rooms to provide protection in the event of flooding due to a pipe rupture.

Contrary to the above, as of March 31, 2013, the licensee failed to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions and that design changes were subject to design control measures commensurate with those applied to the original design. Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:

a. The licensee failed to include a procedural step to install a blind flange in a ventilation duct that penetrated the Unit 1 auxiliary building below the design flood level.

- 2 -

b. The licensee failed to design the floor drain system with isolation capability so that the drain piping from the turbine building and radwaste storage building, which are non-flood protected structures, would not allow water to drain into the Unit 1 auxiliary building in the event of a flood.

c. The licensee failed to design the Unit 1 Hatch 522 and Unit 2 Door 253, which allow access to the area between the auxiliary buildings and containment buildings, to prevent water intrusion during a design basis flood event.

d. The licensee failed to seal open penetrations into the Unit 1 auxiliary building below the design flood level that were created when the licensee abandoned portions of the waste solidification system.

e. The licensee failed to assure that the Unit 1 decay heat vault drain valves were specified as safety-related, as required to maintain the vaults watertight.

B.

10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"

states, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings.

Unit 1 Quality Drawing A-304, Sheet 1, "Wall and Floor Penetrations Key Plan,"

Revision 1, and Unit 2, Quality Drawings A-2002, "Architectural Schematic, Fire and Flood Protection Plans and Sections," Revision 10, prescribed walls, ceilings, and floors as flood barriers that required seals.

Unit 1, Quality Drawing A-337, "Wall and Floor Penetrations Enclosure Details,"

Revision 9, and Unit 2 Quality Drawing Series E-2073, "Electrical Penetration Sealing Details," Revision 3, prescribed conduit seal installation details that would act as a barrier to flood water. Unit 2 Quality Drawing Series A-2600, "Fire Barrier Penetration Seal Details," Revision 5, prescribed pipe penetration seal details that would act as a barrier to flood water.

Contrary to the above, as of March 31, 2013, the licensee did not accomplish activities affecting quality in accordance with documented instructions, procedures, or drawings.

Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:

a. The licensee failed to install seals in conduits that penetrated flood barriers for the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings.

b. The licensee failed to install seals in piping that penetrated flood barriers for the Unit 2 auxiliary building extension.

c. For the Unit 1 and Unit 2 auxiliary building hatches and building expansion joints between the building and containment, the licensee failed to provide appropriate seal inspection criteria, establish a replacement frequency for the seals, and

- 3 -

develop post-maintenance test procedures to verify the effectiveness of the seals after they were reinstalled.

These violations are associated with a Yellow Significance Determination Process finding for Units 1 and 2.

Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Inc., is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN:

Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional Administrator, Region IV, and a copy to the NRC Resident Inspector at Arkansas Nuclear One, within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation; EA-14-088" and should include for each violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation or severity level; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be restored.

Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.

If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001.

Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html, to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the public without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information.

If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated this 22nd day of January 2015

Enclosure 2

ARKANSAS NUCLEAR ONE Final Significance Determination Unit 1 and Unit 2 Flooding Deficiencies

As described in NRC inspection report 05000313/2014009; 05000368/2014009 (ADAMS ML14253A122), the NRC used Inspection Manual Chapter (IMC) 0609, Appendix M, Significance Determination Process Using Qualitative Criteria, Table 4.1, Qualitative Decision-Making Attributes for NRC Management Review, to determine the preliminary risk significance for the finding associated with the flooding deficiencies at ANO, Units 1 and 2. The NRC concluded that the preliminary risk significance for the subject flooding deficiencies should be characterized as Yellow, meaning a finding of substantial risk. During the Regulatory Conference held on October 28, 2014, the licensee provided additional information concerning the frequency of significant flooding at ANO, and mitigating startegies/recovery actions that could be taken prior to, and during, a site flooding event. The licensee concluded, based on its extensive analysis, that the risk significance for Unit 1 should be characterized as Green (very low safety significance), and for Unit 2, it should be characterized as White (low to moderate safety significance).

The NRC thoroughly reviewed the information provided by the licensee during the Regulatory Conference and completed additional inspections to validate proposed mitigation strategies/recovery actions. The NRC concluded that a final significance determination of substantial risk (Yellow) for the flooding deficiencies on Unit 1 and Unit 2 is appropriate. The following sections of this enclosure discuss the NRCs evaluation of the information presented by the licensee and provide the basis for the NRCs final risk determination.

A. ANALYSIS OF LICENSEE INFORMATION USING IM 0609, APPENDIX M CRITERIA

1. Bounding Risk Evaluation

The current licensing bases for ANO is a Probable Maximum Flood (PMF) event coincident with a failure of the upstream Ozark Dam, requiring protection of the Seismic Category I structures from a flood elevation of 361 feet above Mean Sea Level (MSL), which is 7 feet above the site grade level of 354 feet MSL. Note that all elevations in this enclosure are referenced to MSL. As part of its analysis in developing a response to the NRCs 10 CFR 50.54(f) letter pertaining to the Fukushima Lessons-Learned Near-Term Task Force (NTTF)

Recommendation 2.1 for flooding reevaluation, the licensee derived preliminary results for site flood elevations for a PMF based on current approaches and state-of-the-art methodologies. During the Regulatory Conference, the licensee provided a number of different estimates to establish the likelihood of severe flooding at ANO. It is the NRCs understanding that these preliminary results and supporting calculations will be submitted to the NRC for full review as part of the licensees flooding reevaluation in connection with the 10 CFR 50.54(f) letter response. Consideration of the information presented by the licensee relative to the NRCs final significance determination should not be interpreted as acceptance or rejection of the flooding reevaluation associated with the licensees 10 CFR 50.54(f) response. But rather, this information has been evaluated in the context of making a risk-informed enforcement decision on flood protection related performance deficiencies at ANO. Subsequent evaluation of this information under the NRCs formal

- 2 -

review process for the licensee submitted flooding reevaluation may or may not result in changes to the ANO flood elevation estimates.

The licensee presented information to highlight perceived conservatisms associated with the current licensing basis. The licensee stated that the assumptions which provide a basis for the current licensing basis flood elevation of 361 feet could not be exactly reproduced; therefore, the impact on the Annual Exceedance Probability (AEP) with regard to those original assumptions was not explicitly factored into the NRCs final risk significance determination.

The licensees reevaluated flood modeling assumptions resulted in a PMF elevation of 353.8 feet. The NRCs final significance determination result of Yellow is not based on approval or rejection of the licensees reevaluated PMF elevation of 353.8 feet, but rather on the overall risk insights provided by the associated analyses. In making the final significance determination, the NRC recognized that precise estimates for extreme flooding events are not available, that there are limitations on the credibility of flood extrapolation approaches, and that there are significant ranges of uncertainty associated with the results in both the PMF elevations and AEP estimates.

The challenges in extrapolating flood frequencies were discussed in a workshop on state-of-the-art probabilistic flood analyses (reference NUREG/CP-0302, Proceeding of the Workshop on Probabilistic Flood Hazard Assessment (PFHA): Held at the U.S. Nuclear Regulatory Commission Headquarters, Rockville, MD, January 29-31, 2013) for extreme events such as the PMF and were mentioned in the NRCs preliminary significance determination letter. The insights from this workshop reaffirmed the NRCs use of qualitative criteria as prescribed by IMC 0609, Appendix M, to conduct significance determination process (SDP) evaluations involving extreme flooding events.

At the Regulatory Conference and in documents provided to the NRC prior to the Conference, the licensee presented multiple flood evaluation methods, including flow-based and precipitation-based approaches, to estimate the ANO flood hazard. The licensee indicated that the AEP associated with a relevant Probable Maximum Precipitation (PMP)

depth of 6.93 inches producing a flood elevation of 354 feet (i.e., all floods exceeding site grade elevation) would have a 95 percent confidence level value of 1.44x10-5/year (or 69,444-year return period) with a best estimate median of 1.15x10-6/year (or 869,565-year return period). In addition, the licensee stated that the PMP precipitation depth of 7.27 inches associated with flooding events exceeding a flood elevation of 356 feet at ANO (i.e., exceeding site grade level by 2 feet) would have a 95 percent confidence level AEP of 1.05x10-5/year (or 95,238-year return period) with a best estimate median AEP of 7.94x10-7/year (or 1,259,445-year return period). The licensee indicated that the use of multiple methods provided additional justification for extrapolation of flood frequencies for use in the SDP. In addition, other assumptions and considerations from the hydrologic and hydraulic modeling used by the licensee were characterized as providing additional conservatism in the insights presented.

As noted above, the licensee used multiple evaluation methods in its analyses to determine the AEP or flood frequency for PMP events that would cause flooding at or above site grade level. Those analyses, as well as other methods that are equally applicable, led the NRC to conclude that flood frequencies greater than 1x10-4/year may be conservative for the ANO

- 3 -

site based on available information. By the same token, the NRC concluded that flood frequencies less than 1x10-5/year (100,000-year or greater return period) could not be established with sufficient confidence in best estimate results for the purposes of this SDP evaluation.

The NRC noted that the licensee made reference to aspects of each methodology presented by the licensee having been used by other Federal agencies as well as in published literature. As discussed in the workshop held at the NRC in January 2013, the NRC has not approved methods for extrapolating the frequency of extreme events such as the PMF. While some state-of-the-art approaches were discussed in this workshop and have been used in certain applications (e.g., such as the stochastic-based modeling of flooding phenomena for specific watersheds as opposed to more extrapolation-focused techniques), the NRC also noted that: (1) the methods presented by the licensee for ANO are extrapolation-based, and therefore still include significant uncertainty (whether accounted for explicitly or implicitly), and (2) the estimates provided are beyond the typical limits of extrapolation considered as credible in the current state-of-the-art methodologies.

For example, the licensees flow-based extrapolation uses an approach described in Bulletin 17-B, Guidelines for Determining Flood Flow Frequency published by the Department of Interior. The applicability of Bulletin 17-B was intended to be limited. This bulletin was designed for applications such as levee and floodplain management, and was not intended for extending estimates to 1-in-10,000 events. It is recognized that the applicability of this method is limited to AEPs in the ranges closer to the available historical record. As stated during the January 2013 workshop held at the NRC, the applicability of such a method was not intended for AEPs in the range of 1x10-4/year (or 10,000-year return period) or less likely events. Similarly, as discussed in the U.S. Department of Interior, Bureau of Reclamation Report DSO-04-08, Hydrologic Hazard Curve Estimating Procedures, there is a relationship between the quality and quantity of data available and the limit on credible extrapolation flood estimates. This includes some of the methods used in the licensees precipitation-based approaches (e.g., L-moments), as well as other methods not included in the ANO estimates (e.g., paleoflood information). Even when combined with optimal information, a limit of 1x10-4/year (or 10,000-year return period) for credible information is acknowledged. As stated in Bulletin 17-B, with regard to regional precipitation data, a similar limit [1x10-4/year] is imposed because of the difficulty in collecting sufficient station-years of clearly independent precipitation records While this bulletin focuses on areas in the Western U.S., the discussions in the workshop held at the NRC in 2013 indicated the challenges described above exist when dealing with limited information, as is the case at ANO. The analyses the licensee presented at the Regulatory Conference attempted to use as much of the available information as possible (e.g., over 3,000 years of equivalent record was added via the L-moments approach), however, without additional stochastic physical modeling or relevant at-site paleoflood data, extrapolation of flood frequencies beyond the level of confidence currently assessed by the community of expert practitioners (10,000 year return period) carries significant uncertainty.

While the consideration of multiple extrapolation approaches and the consistency in the results of each of the precipitation-based analysis methodologies do provide additional confidence that AEPs greater than 1x10-4/year (10,000 year or less return period) would be overly conservative for consideration in the final significance determination of these findings, the NRC concluded that AEPs of less than 1x10-5/year (100,000-year or greater return

- 4 -

period) could not be established with sufficient certainty for the purposes of this SDP evaluation. The NRC recognizes that additional uncertainty not captured by the extrapolated results could impact the bounding results in this assessment and that any extrapolated estimate may involve uncertainty bounds of several orders of magnitude.

For example, the flow-based extrapolations developed by the NRC and licensee indicated an upper bound closer to the 1x10-4/year threshold.

In summary, the analyses provided by the licensee indicates that, even with a preliminary reevaluated flood hazard analysis (i.e., PMP of 6.93 inches and PMF of 353.8 feet), the resulting 95 percent confidence level AEP does exceed the 1x10-5/year threshold, and that sufficient justification for reliance on a more precise value is not currently available, as these estimates include several orders of magnitude of uncertainty. The NRC concluded that the information provided supports an SDP approach that considers qualitative attributes to determine the significance of the finding in conjunction with the insights associated with the uncertainty and confidence limits provided by the licensee in the flow-based and precipitation-based analyses.

2. Defense in Depth

The licensees presentation categorized some of the recovery actions as defense-in-depth elements. However, the licensee agreed that normal plant equipment and system alignments for reactor coolant system inventory control, reactor core heat removal, and containment pressure control functions would not be available to mitigate flooding events.

The licensee did present proposed mitigating actions to recover safety functions for flood levels above plant grade level. Those recovery actions are discussed in Section B below.

3. Reduction in Safety Margin

As stated in the NRCs preliminary significance determination letter, the current design basis flood elevation is 361 feet. Flood water above plant grade level of 354 feet could result in the loss of all reactor makeup and cooling pumps, potentially leading to core damage without mitigating actions. The licensee stated that safety would be challenged with flood waters above plant grade level and that the revised PMF elevation of 353.8 feet was below the plant grade level. The licensee presented proposed actions to recover safety functions for flood levels above the plant grade level.

4. Effect on Other Equipment

The licensee acknowledged that failure of the subject flood barriers could result in failure of the emergency feedwater pumps, high pressure injection pumps, spent fuel pool cooling pumps, emergency diesel generators, decay heat removal pumps, and reactor building spray.

5. Degree of Degradation

The licensee acknowledged that equipment damaged due to submergence in water could not be recovered.

- 5 -

6. Exposure Time; Previous Identification Opportunities

The licensee acknowledged that the performance deficiency has existed since construction.

The only exceptions were a plant modification in 2002 that resulted in unsealed abandoned equipment and inadequate preventive maintenance activities that caused degradation of flooding seals over time. All quantitative assessment considerations were performed using the one-year assessment period limit in the SDP. The licensee acknowledged that previous identification opportunities for the degraded flood barriers had existed.

7. Recovery Actions The NRCs preliminary significance determination did not credit alternative mitigating strategies. During the Regulatory Conference, the licensee provided information related to mitigation strategies to protect the turbine building from flooding by using a temporary flood barrier, and recovery actions to maintain or recover reactor core heat removal functions for both units by establishing water injection to the steam generators from either the service water system or portable pumps. The licensee did not provide long-term recovery actions for restoration of the reactor coolant inventory control function, nor the containment pressure control function. The NRCs evaluation of the licensees proposed mitigation strategies/recovery actions is provided below.

8. Additional Circumstances The licensee stated that its revised PMF is below plant grade level and that conservatisms exist in the PMP/PMF estimates to reduce the 95 percent confidence level risk by an order of magnitude. The NRC reviewed the licensees calculations and presentation related to the PMP/PMF as described in Section A.1, Bounding Risk Evaluation, above. The NRC also observed that the licensees risk estimates were based on extrapolations with limited consideration of modeling uncertainty. For estimates of extreme events, information available from the community of experts indicates that considerable modeling uncertainty would be involved. The NRC noted that inclusion of such uncertainty (consideration of which was limited in the licensees upper bound estimates) would increase the 95 percent confidence level value.

B. EVALUATION OF THE LICENSEES PROPOSED MITIGATION AND RECOVERY ACTIONS

During the Regulatory Conference, the licensee presented five mitigation strategies in the event of a postulated flood above plant grade level. The licensee proposed recovery credit based, in part, on human error probabilities derived from the SHARP1 human reliability analysis (HRA) methodology. The NRC noted that the licensees model reflected human error probabilities assuming typical plant conditions, which are different than plant conditions that may be encountered during a flooding event. The NRC noted that the SHARP1 method did not account for an evaluation of operator diagnostic actions in the absence of procedural guidance, when multiple, competing mitigation strategies/recovery actions are plausible.

Based on an evaluation of circumstances under which the operators may be prompted to implement recovery actions, the NRC concluded that failure to diagnose the need to implement recovery actions could be substantially high for a number of the recovery actions.

- 6 -

The NRC recognizes that human reliability analysis methods for evaluating actions under extreme conditions are limited. The NRC used the SPAR-H HRA method (NUREG/CR-6883) to estimate the human error probabilities associated with potential recovery actions.

The SPAR-H method provides an estimate that accounts for timeliness, ergonomics, quality of procedures, and stress while diagnosing and performing tasks. The NRC also included insights gained through direct inspection efforts following the Regulatory Conference.

The results of the licensees AEP analysis presented at the Regulatory Conference suggested that approximately 70 percent of flooding events with water level above site grade of 354 feet would also exceed 356 feet. Based on consideration of these estimates, in addition to corresponding information from the 100,000-year return PMP hazard curve developed by the NRCs analysts as part of the preliminary significance determination, the NRC determined that almost half of above-site-grade level flooding events at ANO would also exceed the 356-foot level. The licensee stated that the implementation of the temporary dam mitigation strategy discussed below would not provide mitigation for a flooding event above 356 feet, and that the implementation of the portable pump mitigating strategy discussed below could be more difficult to accomplish for a flood above 356 feet.

1. Site Preparation for Flooding

During the Regulatory Conference, the licensee presented mitigating actions that could be taken after notification of an impending flood, yet prior to the arrival of flood waters on site.

As stated in the NRCs preliminary significance determination letter, the Startup Transformer 02 would be modified before flood waters arrived to permit continued operation and availability of offsite power during the flooding event. In addition, procedural guidance required plant operators to consider moving portable pumps to a staging area in the training center parking lot prior to flood waters arriving onsite, to protect the pumps.

During the Regulatory Conference, the licensee stated that upon notification of an impending flood, actions could be taken to protect the turbine building up to a flood elevation of 356 feet. According to the licensee, those actions would be prompted by a corporate-level severe weather procedure that directs corporate assets to be protected from flooding.

The licensee proposed a 30 percent failure probability that the site emergency response organization would implement measures to protect the turbine building from postulated floods up to a flood elevation of 356 feet. For flood levels above 356 feet, the licensee agreed the failure probability would approach 100 percent for these site preparation actions.

The licensee presented pre-flood preparations that included a water-filled temporary dam, sandbagging, concrete barriers, welding steel barriers over doors, and sealing underground penetrations. The NRC determined that the licensee had not verified that the materials were physically available and could be installed before flood waters exceeded the plant grade level. In addition, the dam, sandbagging, and barriers are temporary equipment and subject to potential failure mechanisms. For example, experience at other sites shows the dam could be punctured during installation or use, or installed over permeable surfaces (gravel) and rendered ineffective. The NRC also concluded that a corporate-level procedure providing a checklist to indicate that temporary flood barriers should be considered does not provide clear planning guidance as described in the preliminary risk determination. Given the non-specific procedural guidance, likely operator mindset that the reactor plant was protected from flooding, and the number of unknown flood deficiencies at ANO, the NRC

- 7 -

assigned a high (90 percent) failure probability for the installation of temporary flood barriers. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 50 percent. The results of this sensitivity analysis are discussed in Section C. No mitigation credit was given for flood levels above 356 feet.

2. Decay Heat Removal Recovery Using Feed to Steam Generators

The licensee presented information that would indicate that decay heat removal could be maintained by initiating actions to feed the steam generators by either of two methods.

First, the service water system could be used to feed the steam generators through the submerged and idled emergency feedwater system pumps, which required opening of service water to emergency feedwater cross-connect valves. Second, an alternative mitigation strategy, portable diesel-driven pump (portable pump) could be used to supply water to the steam generators. Either of these strategies could be performed first, depending on the diagnosis and choices made by the plant operators. The licensee assumed a nominal combined failure probability of five percent for feeding the steam generators using these strategies. After the Regulatory Conference, NRC inspectors identified several problems with these strategies that were not identified by the licensee which complicated the actions and resulted in the NRCs determination that the failure probabilities assumed by the licensee for these strategies were unrealistic.

a. Unit 2 Service Water System Recovery

The success of this strategy would require operators to diagnose the need to open service water cross-connect valves to the suction of the emergency feedwater pumps, while the reactor continued to be cooled by the decay heat removal system. Following diagnosis that decay heat removal may be challenged, operators must open the service water supply to emergency feedwater pump suction valves before flooding in the auxiliary building caused a loss of remote operation capability. The NRC determined that adequate time existed for operators to diagnose and align the service water system.

Operators would not be able to verify decay heat vault flooding alarm accuracy nor actual water level in the decay heat removal vaults because access to the vaults would be blocked by flood waters. Additionally, there is a single annunciator for all three vaults in Unit 2, and therefore, given flooding in the auxiliary building, operators would be unable to confirm if one or multiple vaults were flooding. Though operators would likely recognize that a flood alarm would be associated with water intrusion from the site flooding event, the combination of the inability to validate the alarm, the lack of indications for individual vaults, and the likely belief by operators that the vaults would not flood since the vaults were thought to be watertight, supported the use of poor ergonomics in the SPAR-H model for human reliability analysis.

While emergency operating procedures address using service water as an alternative suction source for the emergency feedwater system, the entry conditions to use emergency operating procedures would not have been met at the time this action would have been required. In addition, pumping service water through an idle emergency feedwater system had not been proceduralized, and therefore the associated actions had not been demonstrated nor had operators been trained on these actions. The NRC

- 8 -

determined that opening of the service water to emergency feedwater cross-tie valves is feasible; however, pre-existing procedures were not available to support diagnosis, the viability of this contingency strategy had not been demonstrated nor had operators trained on it, and the recovery had to be accomplished prior to flooding of the service water valves. Consequently, the NRC determined there was a high (83.5 percent)

failure probability to reposition service water valves prior to their submergence.

Furthermore, the operators had to initiate feed to the steam generators with service water via the emergency feedwater system with idle feedwater pumps. The licensees evaluation indicated that a service water system pressure of 76 psig was available to provide flow through the emergency feedwater system based on the results of a surveillance test conducted while the system was aligned to the emergency cooling pond. After the Regulatory Conference, NRC inspectors determined that the service water system pressure could be 60 psig based on a review of plant data that represented the conditions and system alignment that would exist for an external flooding event. In addition, the NRC identified that Valve 2CV-1460, a backpressure control valve, could fail open upon a loss of control power, which may reduce system pressure by as much as five psig. Valve 2CV-1460 is at 335 feet in the auxiliary building general area and would be submerged during a flooding event. With service water pressure at approximately 55 psig, the system pressure would be lower than that required to overcome the steam generator pressure and static head of the emergency feedwater system. The NRC determined that the proposed mitigation strategy/recovery action may not result in adequate flow to the steam generators without further operator diagnosis and action.

Following the NRCs identification of the possible failure of this proposed mitigation strategy, the licensee provided additional information suggesting that operators could diagnose the system condition and raise service water pressure by starting a third service water pump and isolating the non-safety related, auxiliary cooling water portion of the service water system.

The NRC determined that this recovery action would require a moderately complex diagnosis. Multiple variables would need to be evaluated including service water system alignment, unique system configurations, and pump failures in order to diagnose the lack of adequate flow to the steam generators. The ability to evaluate the service water system configuration could be impacted by flood waters throughout the buildings. No procedures existed to diagnose the need to realign valves to increase system pressure.

In addition, the diagnosis would also involve re-evaluation of operator actions that were taken to align service water to emergency feedwater, since those actions did not result in feed to the steam generators as expected.

Restoration of service water pressure to provide for service water flow to the steam generators is feasible, however, the NRC noted that procedures governing this evolution were not available to support diagnosis, the viability of the actions to restore service water system pressure had not been demonstrated or trained on, and the mitigation strategy/recovery actions had to be accomplished before the loss of natural recirculation in the reactor coolant system. Consequently, the NRC determined that there was a 29 percent failure probability for restoring service water pressure such that service water flow to the steam generators could be established. This failure probability also

- 9 -

accounted for the dependency of the recovery diagnosis and actions on the preceding initial failure to establish sufficient service water pressure.

In summary, the NRC determined that the use of service water to feed the Unit 2 steam generators to provide for decay heat removal, had a very high failure probability (approaching 100 percent), due to the multiple diagnosis efforts and actions involved, including the diagnosis and recovery from the initial failure to establish service water flow; as well as the lack of, or limited, procedural guidance, and time constraints that would exist. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 50 percent. The results of this sensitivity analysis are discussed in Section C.

b. Unit 1 Service Water System Recovery

The licensee presented information during the Regulatory Conference that the service water system could be used to feed the Unit 1 steam generators through the submerged and idled emergency feedwater system pumps, similar to the alignment described for Unit 2 above.

The licensee stated that Unit 1 operators would have two hours to diagnose and take action between the time of the first control room alarm notifying operators of water in the decay heat removal vaults, and the time when the service water recovery action would not be available due to submergence of the motor-operated service water to emergency feedwater cross-connect valves. The licensee stated that a second vault alarm would annunciate 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> before service water valve submergence, providing a second cue.

The licensee noted that operators would require approximately one hour to diagnose and take the action to open the service water valves.

Following the Regulatory Conference, NRC inspectors determined that the licensee used assumptions in its decay heat vault flooding analysis that were non-conservative.

Specifically, the licensee calculated flows into the vaults assuming empty electrical conduits even though the conduits could be up to 20 percent full of wires. The licensee assumed up to 10 outlets per conduit even though it could be as few as two. The licensee assumed that the conduit high points were at the observed junction boxes even though construction photographs indicated they could be as much as one foot higher than the connection at the junction boxes. The NRC inspectors recalculated the time available between receipt of the decay heat vault alarm and submergence of the service water valves using more realistic assumptions, and determined that the operators would have approximately one hour to diagnose and take action to implement this recovery strategy between the first vault alarm and submergence of the valves. The inspectors determined that the second vaults alarm would annunciate at approximately the same time the service water valves would become submerged, so the operators would have to diagnose the condition with only one vault in an alarm condition. The NRC determined that not enough time existed to diagnose and initiate this service water recovery strategy because with a single vault alarm, operators would have to anticipate both vaults flooding and anticipate that pumping service water through an idled emergency feedwater system would be necessary before decay heat removal failed.

- 10 -

Therefore, due to the time constraints and lack of cues to indicate the challenge to decay heat removal, the NRC assigned a high failure probability (approaching 100 percent) for the use of service water to feed the Unit 1 steam generators to provide for decay heat removal. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 50 percent. The results of this sensitivity analysis are discussed in Section C.

c. Alternative Mitigation Pump Recovery Strategy

The licensee presented information that an alternative mitigation strategy, portable diesel-driven pump (portable pump) could be used to supply water to the steam generators in Unit 1 and Unit 2. Although operators are trained on using the pump in restoring steam generator levels upon loss of a wide range of plant equipment, the alternative mitigating strategies procedure was not intended for a flooding event.

The licensees external flooding procedure directed personnel to consider moving the portable pump to higher ground (training center off-site parking lot) prior to flooding onsite to protect the portable pump from flood water. Although contrary to the guidance in this procedure, the NRC considered as a potential action that operators could anticipate the potential for a loss of all core cooling due to flooding and decide to move the pump onto the site, on an elevated platform, such that it was staged and ready if needed as a potential decay heat removal recovery strategy, before significant flood waters arrived onsite. The NRC concluded that it was much more likely the pump would be moved off-site and protected from flooding, until some other plant indication of potential loss of decay heat removal prompted a diagnosis that the portable pump should be deployed, at which point the pump would need to be moved to the site through existing flood waters.

The licensee presented a one-hour timeline for this recovery strategy based on a walkthrough of required actions on dry ground. The NRC determined this did not account for challenges that could be imposed from flooding onsite. The road between the training center and the plant is one foot lower than plant grade level. The NRC noted that electrical equipment on the pump skid could be submerged at flood levels of 355 feet or higher during transportation on the normal trailer. Therefore, the NRC determined that the licensee could likely take several hours to load the pump onto another trailer in order to avoid submerging the pump during transport. The NRC also noted that when the road is covered by flood water, the edges of the road will be obscured to the driver, and the driver may need to use spotters at a slow walking speed.

Once the portable pump was at the proper location, several actions would need to be accomplished to align the portable pump to supply water to the steam generators.

These would potentially be performed in flood waters and include:

Connecting the suction of the pump to a fire hydrant while working in flood water

Standing in flood waters to cut piping (Unit 2)

Refueling the pump every 12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in flowing flood waters, and

- 11 -

Potentially isolating transformer fire deluge valves that actuate due to submergence, to maintain fire protection system pressure

While the licensee presented a one-hour time to transport and align the portable pump, the NRC determined that the transport and system alignment time could be greater than seven hours. Although operators are trained on using the pump in restoring steam generator levels upon loss of a wide range of plant equipment, the implementation of these actions is not contained in a procedure used for a flooding event.

Unit 2 Specific Information

In Unit 2, the recovery strategy presented by the licensee would involve pressurizing a startup and blowdown demineralizer header and then using the pressurized header to backfeed into the main feedwater header. Following the Regulatory Conference, NRC inspectors identified that pressure control valves on this demineralizer header could fail open during a flooding scenario due to loss of instrument air pressure. NRC inspectors determined that portable pump flow would be diverted away from the steam generators through the open pressure control valves unless the licensee had closed the valves during demineralizer realignment for full flow secondary cleanup during plant cooldown prior to the arrival of flood water onsite. The decision to perform the demineralizer alignment depended upon available operations resources, the recommendations from chemistry personnel, and the availability of a fresh demineralizer resin load. The NRC assigned a failure probability of 50 percent for the demineralizer realignment. This demineralizer realignment would need to be accomplished in addition to successful portable pump transport and fire protection system alignment for the alternative mitigation pump recovery strategy to be effective. In addition to the factors discussed above, the Unit 2 procedures for implementing this mitigation strategy were incomplete because isolation valves would need to be opened that were not listed, relief valves requiring gags would be under water, and alternate methods to throttle flow were not included.

The NRC determined that use of the alternative mitigation pump recovery strategy for Unit 2 appeared to be feasible, if the shutdown activities resulted in the secondary system being placed in the cleanup configuration. The recovery strategy could be impacted by incomplete procedures and environmental conditions related to flood waters onsite. The NRC assigned a high (85 percent) failure probability for use of the portable pump on Unit 2. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be with an assumed lower failure probability of 37 percent. The results of this sensitivity analysis are discussed in Section C.

Unit 1 Specific Information

With respect to Unit 1, similar challenges existed for the success of the alternative mitigation pump recovery strategy as compared to Unit 2, with two significant exceptions: (1) the flow diversion issues described above were not applicable to Unit 1; and (2) Unit 1 procedures included the necessary valve alignments. The NRC assigned a 37 percent failure probability for use of the portable pump with respect to Unit 1. In the context of a sensitivity analysis, the NRC also determined what the SDP result would be

- 12 -

with an assumed lower failure probability of 25 percent. The results of this sensitivity analysis are discussed in Section C.

3. Additional Qualitative Factors Influencing the Risk Assessment As documented in the NRCs preliminary risk determination letter, the NRC concluded that internal flooding events pose additional risk significance for the flooding-related performance deficiencies. Failure of expansion boots in the Unit 1 and Unit 2 circulating water system is the highest contributor to risk for internal flooding in both Units. The licensee agreed that internal flooding was an important contributor to the overall risk of flooding. The licensee stated that the initiating event frequency for internal flooding for Unit 1 was minimal, and for Unit 2 was 9.03x10-5/year. With respect to internal flooding, the NRC assigned the same recovery credit for mitigation strategies as described in Section B.2 for external flooding, except that the Unit 2 portable pump recovery strategy would not work because the secondary system would not be aligned in the cleanup configuration. The Unit 2 high initiating event frequency for internal flooding coupled with reduced recovery credit was a significant contributor to the final significance determination for Unit 2, in that the risk contribution from internal flooding events alone was Yellow for Unit 2. The NRC agreed that the failure frequency of the circulating water system was lower for Unit 1 than for Unit 2; however, because the circulating water expansion joints in Unit 1 had a metallic component and were not all hard piping as assumed in the licensees failure probability model, the NRC determined that a more appropriate model of the Unit 1 expansion joints would provide a higher failure frequency for the circulating water system than provided by the licensee. As documented in the NRCs preliminary significance determination letter, the contribution to risk for Unit 1 from internal flooding was qualitatively assessed as Greater-than-Green. This risk contribution would be added to the significance determination results from external flooding events to determine an overall flooding SDP result for Unit 1.

The licensee stated at the Regulatory Conference that it would have enough time to perform an orderly shutdown and cooldown in the event of a flood. The licensee stated that both units steam generators would be placed in wet layup, which would provide for additional time to respond to, and recover from, a subsequent loss of decay heat removal. However, according to the operations managers for both units, if the licensee anticipates a short outage and chooses to maintain condenser vacuum, the steam generators would not be placed in wet layup. Therefore, Unit 1 operators would have approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> from a loss of decay heat removal to a loss of natural circulation cooling for the reactor, and Unit 2 operators would have several hours. This is different than the information in the timeline presented by the licensee in the Regulatory Conference. Although the NRC did not explicitly use the shorter timeline associated with the steam generators not being in a wet layup condition, if the NRC had included that assumption in the SDP analysis it would result in additional risk to the qualitative assessment.

The NRC identified that the need to establish and maintain a method of long-term reactor coolant system inventory makeup and control is an important risk consideration that could represent additional risk significance for a flooding event in light of the performance deficiencies. The preliminary significance determination stated that all

- 13 -

reactor coolant system makeup pumps were below the postulated flood levels of concern and would fail given a flood at or above the site grade of 354 feet. The licensee presented a strategy of using manual control of the core flood tanks (Unit 1) or safety injection tanks (Unit 2) to maintain sufficient inventory in the reactor coolant system to support adequate core cooling capability for a short period of time (up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />). The licensee did not present a strategy beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for long-term reactor coolant system inventory control.

C. CONCLUSIONS

Based on its extensive evaluation, including careful consideration of the information provided by the licensee, the NRC determined that no change to the preliminary risk significance determination result of Yellow for both Unit 1 and Unit 2 is warranted.

The licensee used a range of evaluation methods, including flow-based and precipitation-based approaches, to determine the AEP or flood frequency for PMP events that would cause flooding at or above site grade level. These methods are extrapolation-based, and therefore include significant uncertainty, and the resulting estimates provided by the licensee are beyond the typical limits of extrapolation considered credible in the current state-of-the-art methodologies for determining the frequency of extreme events. While the consideration of multiple extrapolation approaches and the consistency in the results of each of the precipitation-based analysis methodologies do provide additional confidence that AEPs greater than 1x10-4/year (10,000 year or less return period) would be overly conservative for consideration in the final significance determination of these findings, the NRC concluded that AEPs of less than 1x10-5/year (100,000-year or greater return period) could not be established with sufficient certainty for the purposes of this SDP evaluation.

The NRC concluded that several of the mitigation and recovery strategies proposed by the licensee would likely not have succeeded due to unrecognized system alignment issues that were identified by NRC inspectors. In addition, the NRC concluded that the licensee underestimated the complexity and environmental challenges that would be faced by the operators in diagnosing and implementing these strategies. Consequently, the NRCs final risk determination reflects significantly less mitigation credit than proposed by the licensee.

While the NRC concluded that reliance on a more precise value between the thresholds of 1x10-5/year to 1x10-4/year for the AEP or flood frequency of PMP/PMF events cannot be justified, given the credible limits of extrapolation in the current state-of-the-art methodologies for determining the frequency of extreme events, the NRC performed a quantitative analysis using the licensees 95 percent confidence level AEP of 1.44x10-5/year as an initiating event frequency. As discussed above, the NRC did not consider AEPs of less than 1x10-5/year to be credible. Consequently, the NRC concluded that use of the licensees best estimate value for AEP of 1.15x10-6/year would not provide meaningful risk insights. Using the AEP value of 1.44x10-5/year, the NRC then applied what it considered to be appropriate credit for the mitigation and recovery strategies as described in Sections A and B of Enclosure 2. The results for Unit 1 and Unit 2 were as follows:

For Unit 1, after application of the failure probabilities for external flooding mitigation strategies as described in Sections B.1, B.2.b, and B.2.c, the SDP result for Unit 1 was White. In the context of a sensitivity analysis, the NRC applied overly optimistic failure

- 14 -

probabilities for external flooding mitigation strategies as described in Sections B.1, B.2.b, and B.2.c, and the SDP result remained White.

For Unit 2, as stated in Section B.3, the risk from internal flooding alone resulted in an SDP result of Yellow. In the context of a sensitivity analysis, the NRC applied an overly optimistic failure probability of 10 percent for the service water mitigation strategy for internal flooding, as well as overly optimistic failure probabilities for external flooding mitigation strategies as described in Sections B.1, B.2.a, and B.2.c. The SDP result for this Unit 2 sensitivity analysis remained Yellow.

Given the current lack of confidence in a definitive approach to establish initiating event frequency best estimates for consideration in extreme flooding events, IMC 0609 Appendix M provides the appropriate method for determining the final significance. Notwithstanding, the quantitative analysis described above was conducted to provide risk insights to the Appendix M qualitative assessment. As described in the NRCs preliminary risk determination letter, Appendix M specifies that a bounding, i.e., worst case, analysis should be conducted using the best available information, followed by the consideration of appropriate qualitative factors in determining the significance of the associated finding. With respect to the bounding analysis, the NRC determined that the upper bound AEP was less than 1x10-4/year, therefore, the upper bound risk assessment per Appendix M is Yellow.

With respect to the consideration of appropriate qualitative factors in determining the significance of the associated finding, the NRCs assessment of those qualitative factors and corresponding results, are described in Section A.1-8. In summary, for Unit 2, the significant additional risk contribution due to internal flooding and limited credit for external flooding mitigation and recovery strategies, results in a final significance determination of Yellow. For Unit 1, the risk profile is less severe than for Unit 2, both in the failure probability of the portable pump mitigation strategy and the contribution from internal flooding. However, based primarily on flood frequency uncertainties and the lack of long-term recovery actions for restoration of the reactor coolant inventory control function and the containment pressure control function, the NRC determined that a final significance determination of Yellow was appropriate for Unit 1.

Retrieved from "https://kanterella.com/w/index.php?title=IR_05000313/2014010&oldid=5464739"