ML18047A661

Issuance of Amendment No. 298, Request to Modify License Condition 3.C to Delete Requirement for Commission-Approved Cyber Security Plan (CAC No. MF9850; EPID L-2017-LLA-0236)

ML18047A661
Person / Time
Site:	Fort Calhoun
Issue date:	03/28/2018
From:	James Kim Special Projects and Process Branch
To:	Fisher M Omaha Public Power District
Kim J, NRR/DORL/LSPB
References
CAC MF9850, EPID L-2017-LLA-0236
Download: ML18047A661 (11)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0.C. 20555-0001 March 28, 2018 Ms. Mary J. Fisher Vice President, Energy Production and Nuclear Decommissioning Omaha Public Power District Fort Calhoun Station 9610 Power Lane, Mail Stop FC-2-4 Blair, NE 68008

SUBJECT:

FORT CALHOUN STATION, UNIT 1 - ISSUANCE OF AMENDMENT TO RENEWED FACILITY LICENSE RE: REMOVE CYBER SECURITY PLAN LICENSE CONDITION (CAC NO. MF9850; EPID L-2017-LLA-0236)

Dear Ms. Fisher:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 298 to Renewed Facility License No. DPR-40 for the Fort Calhoun Station, Unit 1 (FCS), in response to your application dated June 16, 2017.

The amendment removes the FCS Cyber Security Plan from FCS License Condition 3.C.

A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely, James Kim, Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-285

Enclosures:

1. Amendment No. 298 to DPR-40

2. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 OMAHA PUBLIC POWER DISTRICT DOCKET NO. 50-285 FORT CALHOUN STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY LICENSE Amendment No. 298 Renewed License No. DPR-40

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Omaha Public Power District (the licensee), dated June 16, 2017, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will be maintained in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this license amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, Renewed Facility License No. DPR-40 is amended by changes as indicated in the attachment to this license amendment, and paragraph 3.B. of Renewed Facility License No. DPR-40 is hereby amended to read as follows:

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 298, are hereby replaced with the Permanently Defueled Technical Specifications (POTS). Omaha Public Power District shall maintain the facility in accordance with the Permanently Defueled Technical Specifications.

Further, paragraph 3.C. is hereby amended, in part, to delete the following:

OPPD shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The OPPD CSP was approved by License Amendment No. 266 and modified by License Amendment No. 284 and Amendment No. 294.

3. This license amendment is effective as of April 7, 2018, and shall be implemented by July 6, 2018.

FOR THE NUCLEAR REGULATORY COMMISSION Douglas A. Broaddus, Chief Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility License No. DPR-40 Dateoflssuance: March 28, 2018

ATTACHMENT TO LICENSE AMENDMENT NO. 298 RENEWED FACILITY LICENSE NO. DPR-40 FORT CALHOUN STATION, UNIT 1 DOCKET NO. 50-285 Replace the following page of the Renewed Facility License with the attached revised page.

The revised page is identified by amendment number and contains marginal lines indicating the areas of change.

Renewed Facility License No. DPR-40 Remove (4) Pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess, and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form for sample analysis or instrument calibration or when associated with radioactive apparatus or components; (5) Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by operation of the facility.

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR Chapter I: Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Section 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; and is, subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

A. DELETED B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 298, are hereby replaced with the Permanently Defueled Technical Specifications (POTS). Omaha Public Power District shall maintain the facility in accordance with the Permanently Defueled Technical Specifications.

C. Security and Safeguards Contingency Plans The Omaha Public Power District shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain Safeguards Information protected under 10 CFR 73.21, are entitled: "Fort Calhoun Station Security Plan, Training and Qualification Plan, Safeguards Contingency Plan," submitted by letter dated May 19, 2006.

DPR-40 Amendment No. 298

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 298 TO RENEWED FACILITY LICENSE NO. DPR-40 OMAHA PUBLIC POWER DISTRICT FORT CALHOUN STATION, UNIT 1 DOCKET NO. 50-285

1.0 INTRODUCTION

By letter dated June 16, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17167A057), Omaha Public Power District (OPPD, the licensee) requested a change to Renewed Facility License No. DPR-40 for the Fort Calhoun Station, Unit 1 (FCS).

The U.S. Nuclear Regulatory Commission (NRC, the Commission) staff initially reviewed and approved the licensee's original Cyber Security Plan (CSP) implementation schedule by Amendment No. 266 dated July 27, 2011 (ADAMS Accession No. ML111801094), to Renewed Facility Operating License DPR-40 concurrent with the incorporation of the CSP into the facility's current licensing basis. The NRC staff then reviewed and approved the licensee's current CSP implementation schedule by Amendment No. 284 dated November 19, 2015 (ADAMS Accession No. ML15294A279). This schedule required FCS to fully implement and maintain all provisions of the CSP no later than December 31, 2017. Additionally, NRC issued Amendment No. 294 dated November 22, 2017 (ADAMS Accession No. ML17289A060), to extend the full implementation date of the FCS CSP Implementation Schedule Milestone 8 from December 31, 2017, to December 28, 2018.

The proposed change would remove reference to the CSP and update the associated License Condition 3.C in the renewed facility license. This will allow OPPD to terminate the FCS CSP and associated activities at the site. The proposed change is based on the lowered risk profile of FCS due to the permanently defueled status of the plant and the continued radioactive decay of the remaining spent fuel.

Enclosure 2

2.0 REGULATORY EVALUATION

The NRC staff considered the following regulatory requirements and guidance during its review of the June 16, 2017, application to eliminate the existing FCS CSP license condition:

• The regulation under Title 10 of the Code of Federal Regulations ( 10 CFR)

Section 73.54, "Protection of digital computer and communication systems and networks," which requires that as of November 23, 2009, each licensee currently licensed to operate a nuclear power plant under 10 CFR Part 50 submit a cyber security plan for Commission review and approval.

• SECY-12-0088, "The Nuclear Regulatory Commission Cyber Security Roadmap," dated June 25, 2012 (ADAMS Accession No. ML12135A050), which states, in part, that "[b]y regulation, dry cask storage in [independent spent fuel storage installations] allows spent fuel that has already been cooled in the spent fuel pool for 1 year to be surrounded by inert gas inside a storage cask. Licensees that are subject to 10 CFR 72.212,

'Conditions of General License Issued Under§ 72.210,' (i.e., licenses limited to storage of spent fuel in casks) must also comply with specific portions of 10 CFR 73.55,

['Requirements for Physical Protection of Licensed Activities in Nuclear Power Reactors against Radiological Sabotage'] requirements for physical security and the ASM

[additional security measure] Orders, but are not subject to the provisions of 10 CFR 73.54, which specifically applies to operating reactors and COL (combined operating license) applicants."

3.0 TECHNICAL EVALUATION

3.1 Licensee's Requested Change By License Amendment No. 294, the NRC staff approved the licensee's extension of the full implementation date of the FCS CSP Implementation Schedule Milestone 8 from December 31, 2017, to December 28, 2018. In its subsequent request, dated June 16, 2017, the licensee requested the removal of the existing cyber security license condition from the FCS renewed facility license.

In its letter dated June 16, 2017, the licensee stated that following permanent shutdown of FCS and removal of spent fuel from the reactor, the spectrum of possible accidents are significantly fewer and the risk of an offsite radiological release is significantly lower for a permanently defueled reactor. The licensee asserted that post zirconium fire, there are no applicable design-basis events at FCS that could result in a radiological release exceeding the limits established by the U.S. Environmental Protection Agency (EPA) early-phase Protective Action Guides (PAGs) of 1 man-rem at the exclusion area boundary. The licensee noted that sufficient time would exist to take prompt mitigative actions in response to a postulated zirconium fire accident scenario in the spent fuel pool. Post zirconium fire, the fuel in the spent fuel pool cannot reasonably heat up to clad ignition temperature within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, which is sufficient time for plant staff to reliably implement required mitigation strategies to prevent spent fuel heat-up damage.

The licensee further noted that this rationale is similar to the rationale used to justify a reduction of emergency preparedness requirements during decommissioning, as detailed in NUREG-1738, "Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants," February 2001 (ADAMS Accession No. ML010430066), and documented in safety evaluations associated with decommissioning plant emergency preparedness exemption

requests. The licensee also referenced the "Draft Regulatory Basis Document for Regulatory Improvements for Power Reactors Transitioning to Decommissioning," March 2017 (ADAMS Accession No. ML17047A413). The draft regulatory basis states that once spent fuel at a site has sufficiently decayed such that there are no applicable design-basis events that could result in an offsite radiological release exceeding the limits established by the EPA PAGs of 1 rem at the exclusion area boundary. In addition, sufficient time would exist to take prompt mitigative actions in response to a postulated zirconium fire beyond-design basis accident scenario in the spent fuel pool.

The licensee also asserted there is a reduced cyber security risk due, in part, to the fact there are fewer critical digital assets at a decommissioning reactor in comparison to the number of critical digital assets at an operating reactor. The licensee stated that once spent fuel is moved from the reactor vessel and placed in the spent fuel pool, the digital computers and communication systems and networks that require cyber protection are primarily those associated with security and emergency preparedness functions, and those safety systems that support operation of the spent fuel pool.

3.2 NRC Staff Evaluation of Requested Change The NRC staff evaluated the licensee's application using the regulatory requirements and guidance cited in Section 2.0 of this safety evaluation. The Cyber Security Rule, as contained in 10 CFR 73.54, applies to licensees currently licensed to operate a nuclear power plant. The NRC staff has determined that 10 CFR 73.54 does not apply to reactor licensees that have submitted certifications of permanent cessation of operations and permanent removal of fuel under 10 CFR 50.82(a)(1) or 10 CFR 52.11 O(a)(1 ), and whose certifications have been docketed by the NRC. Once the NRC has docketed these certifications, the licensee is no longer authorized to operate the nuclear power reactor, and the requirements of 10 CFR 73.54 no longer apply.

The licensee certified to the NRC, pursuant to 10 CFR 50.82(a)(1 )(i), that as of October 24, 2016, operations had ceased at FCS. On November 13, 2016, the licensee also certified, pursuant to 10 CFR 50.82(a)(1 )(ii), that all fuel had been removed from the reactor vessel.

Therefore, pursuant to 10 CFR 50.82(a)(2), FCS's 10 CFR Part 50 license does not authorize operation of the FCS reactor or emplacement or retention of fuel into the reactor vessels, and the NRC staff has determined that the Cyber Security Rule at 10 CFR 73.54 no longer applies to FCS.

The licensee further determined that the fuel has cooled in the spent fuel pool for a sufficient amount of time such that no design-basis accident could have radiological consequences that exceed the EPA PAGs. The licensee completed analyses supporting the conclusion that a zirconium fire would be highly unlikely. The NRC verified the licensee's analyses and its calculations and concluded that sufficient time exists to mitigate a spent fuel pool drain down in the adiabatic case. The NRC staff's review of the licensee's analyses and the associated results are included in a letter to the licensee dated December 11, 2017 (ADAMS Accession No. ML172638198).

The NRC staff previously verified analysis and calculations provided by OPPD that once the spent fuel at FCS had been in the spent fuel pool for 530 days (1 year, 165 days) after shutdown (April 7, 2018), the fuel will have experienced a sufficient cooling period to mitigate the risk of heatup to clad ignition temperature (ADAMS Accession No. ML17278A178). After April 7, 2018, there will be well over 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> available before an offsite release might occur,

which means that there would be at least 1O hours to initiate appropriate mitigating actions to restore a means of heat removal to the spent fuel. Therefore, consequences of a cyber attack are much lower now than while the plant was operating.

Based on its review of the licensee's submissions, the NRG staff concludes that OPPD's request to remove the existing cyber security license condition from the FCS Renewed Facility License DPR-40 is acceptable and consistent with maintaining adequate protection of the public health and safety and the common defense and security.

3.3 Revision to License Condition Paragraph 3.C By letter dated June 16, 2017, the licensee proposed to modify Paragraph 3.C of Renewed Facility License No. DPR-40 to remove the license condition requiring the licensee to fully implement and maintain in effect all provisions of the NRG-approved CSP.

The license condition in Paragraph 3.C of Renewed Facility License No. DPR-40, for FCS is modified to delete the following statement:

OPPD shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p ). The OPPD CSP was approved by License Amendment No. 266 and modified by License Amendment No. 284 and Amendment No. 294.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, on March 7, 2018, the Nebraska State official was notified of the proposed issuance of the amendment. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

This amendment relates solely to safeguards matters and does not involve any significant construction impacts. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on August 15, 2017 (82 FR 38718).

Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22( c )( 12). Pursuant to 10 CFR 51.22(b ), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: S. Coker, NSIR/DPCP/CSB Date: March 28, 2018

ML18047A661 *SE memo dated OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA NSI R/DPCP/CSB/BC*

NAME JKim JBurkhardt JBeardsley DATE 2/23/18 2/22/18 2/12/18 OFFICE OGC-NLO NRR/DORL/LSPB/BC NRR/DORL/LSPB/PM NAME MWoods DBroaddus JKim DATE 3/23/18 3/28/18 3/28/18