IR 05000260/2003007

Draft of IR 05000260-03-007 and IR 05000296-03-007 on 09/08/03 - 09/12/03 and 9/29/03 - 10/03/03 for Browns Ferry, Units 2 and 3; Triennial Fire Protection

ML050540218
Person / Time
Site:	Browns Ferry
Issue date:	02/28/2005
From:	Ogle C Division of Reactor Safety II
To:	Scalice J Tennessee Valley Authority
References
FOIA/PA-2004-0277 IR-03-007
Download: ML050540218 (31)

Text

,t RPEOI UNITED STATES 0 oNUCLEAR

SUBJECT:

BROWNS FERRY NUCLEAR PLANT - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000260/2003007 AND 05000296/2003007

Dear Mr. Scalice:

On October 3,2003, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Browns Ferry Nuclear Plant Units 2 and 3. The enclosed inspection report documents the inspection findings, which were discussed on that date with Mr. A. Bhatnagar and other members of your staff. Following completion of additional review in the Region II office, a final exit was held by telephone with W:r.-.

and other members of your staff on November 14, 2003.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents one finding concerning a failure to protect certain non-safety control circuit cables and instead using unapproved, local manual operator actions in the Unit 3 480 V Reactor Motor Operated Valve Board Room SA during a severe fire in that location. This finding has potential safety significance greater than very low significance. This finding did not present an immediate safety concern. In addition, the report documents one NRC-identified finding of very low safety significance (Green) involving a violation of NRC requirements.

However, because of the very low safety significance and because it is entered into your corrective action program, the NRC is treating this finding as a non-cited violation (NCV)

consistent with Section VL.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator Region 2; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Browns Ferry Nuclear Plant.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publically Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.pov/

readina-rm/adams.html (the Public Electronic Reading Room).

Sincerely, TVA

Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos.: 50-260, 50-296 License Nos.: DPR-52, DPR-68

Enclosure:

(See page 2)

Enclosure:

NRC Triennial Fire Protection Inspection Report 05000260/2003007 and 05000296/2003007 w/Attachment: Supplemental Information

REGION II==

Docket Nos.:

License Nos.:

Report No.:

Licensee:

Facility:

Location:

Dates:

Inspectors:

Accompanying Personnel:

Approved by:

50-260, 50-296 DPR-52, DPR-68 05000260/2003007 and 05000296/2003007 Tennessee Valley Authority Browns Ferry Nuclear Plant Corner of Shaw and Nuclear Plant Roads Athens, AL 35611 September 8-12, 2003 (Week 1)

September 29 - October 3, 2003 (Week 2)

C. Payne, Senior Reactor Inspector (Lead Inspector)

S. Walker, Reactor Inspector G. Wiseman, Fire Protection Inspector K. Sullivan, Consultant, Brookhaven National Laboratory N. Staples, Nuclear Safety Intern R. Rodriquez, Nuclear Safety Intern Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000260/2003-007, 05000296/2003-007; 9/8 - 12/2003 and 9/29 - 10/3/2003; Browns Ferry

Nuclear Plant, Units 2 and 3; Triennial Fire Protection.

The report covered an announced two-week period of inspection by three regional inspectors and a consultant from Brookhaven National Laboratory. One Green non-cited violation (NCV)and one unresolved item with potential safety significance greater than Green were identified.

The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1 649, "Reactor Oversight Process," Revision 3, dated July 2000.

A.

NRC-ldentified and Self-Revealinq Findings

Cornerstone: Mitigating Systems

TBD. The inspectors identified a violation having potential safety significance greater than very low significance because the licensee failed to protect the non-safety control circuit cables for the Unit 3 Reactor Recirculation Pumps (RRPs) in Fire Area 13 (Unit 3 480 V Reactor Motor Operated Valve Board Room 3A). In lieu of protecting these cables, the licensee used manual operator actions to locally trip the Unit 3 RRPs but failed to obtain prior NRC approval. Additionally, during a severe fire in Fire Area 13, these manual actions would be performed in Fire Area 13 and may not be successful because of the high temperatures, heavy smoke, low visibility and hazardous plant conditions that would likely be encountered by the operator while the actions are performed.

This finding is unresolved pending completion of a significance determination.

This finding is greater than minor because it adversely impacted the capability of systems, structures and components necessary to achieve and maintain the plant in a safe shutdown condition during a severe fire and affected the reactor safety mitigating system cornerstone objective. The finding was determined to have potential safety significance greater than very low significance because if the RRPs are not tripped, the RRP discharge head pressure could impede Residual Heat Removal (RHR) Low Pressure Coolant Injection (LPCI) flow.

RHR LPCI flow is the assured method for maintaining reactor water level in the safe range during severe plant fires. Inadequate RHR LPCI flow may cause reactor core uncovery and potential fuel damage. (Section 1 R05.01)

Green.

A Severity Level IV non-cited violation (NCV) of 10 CFR 50.48(a) and the Unit 2 and 3 Operating License Conditions was identified for the licensee making a change to the approved fire protection program (FPP) which removed the requirement to implement fire watches for impaired fire protection systems and features. On October 23, 2002, the licensee inappropriately used the fire protection license change process to revise the FPP to permit the removal of fire suppression systems and/or fire rated barrier assemblies, necessary to satisfy the separation and suppression requirements of 10 CFR 50, Appendix R,

Section III.G, from service without compensatory measures being implemented (i.e., fire watches being posted) in the affected plant areas. The change could adversely affect the ability to achieve and maintain safe shutdown (SSD) in the event of a severe fire in the affected area.

This issue was not assessed in accordance with the SDP but instead was assessed in accordance with guidance in Sections IV.A.1 through IV.A.4 and Section IV.B of the NRC's Enforcement Policy. The issue was significant because the licensee's change process for the FPP allowed this degraded condition to be accepted without prior NRC approval. The inspectors concluded that this issue had a credible impact on safety because the licensee's failure to properly evaluate the removal of fire watch posting requirements could adversely affect or degrade the ability for achieving and maintaining SSD from the main control room, local shutdown stations, or alternate shutdown stations. However, the inspectors determined that this finding was of very low significance because, based on an assessment of the impacts of the identified fire protection features removed from service, the licensee's overall SSD capabilities in the affected fire areas and related FPP features (fire brigade) remained adequate to achieve and maintain SSD conditions. Therefore, this finding is characterized as

Green.

(Section 1 R05.1 1)

B.

Licensee-identified Violations None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems and Barrier Integrity 1 R05 Fire Protection The purpose of this inspection was to review the Browns Ferry Nuclear Plant fire protection program (FPP) for selected risk-significant fire areas. Emphasis was placed on verification that the post-fire safe shutdown (SSD) capability and the fire protection features provided for ensuring that at least one redundant train of SSD systems is maintained free of fire damage. The inspection was performed in accordance with the U.S. Nuclear Regulatory Commission's (NRC) Reactor Oversight Process using a risk-informed approach for selecting the fire areas and attributes to be inspected. The inspectors used the licensee's Individual Plant Examination for External Events and in-plant tours to choose three risk-significant fire areas for detailed inspection and review.

The fire areas chosen for review during this inspection were:

• Fire Area 9, Unit 2 4 kilovolt (kV) Shutdown Board Room C and 250 volt (V)

Battery Room, Unit 2 Reactor Building, 621 foot (ft.) level.

• Fire Area 13, Unit 3 480 V Reactor Motor Operated Valve (RMOV) Board Room 3A, Unit 3 Reactor Building, 621 ft. level.

• Fire Area 3-4, Unit 3 Reactor Building, 621 ft. and 639 ft. level.

The inspectors evaluated the licensee's FPP against applicable requirements, including Operating License Conditions 2.C.(14) [Unit 2] and 2.C.(7) [Unit 3], FPP; Title 10 of the Code of Federal Regulations, Part 50 (10 CFR 50), Appendix R; 10 CFR 50.48; Branch Technical Position (BTP) Chemical and Material Engineering Branch (CMEB) 9.5-1; related NRC safety evaluation reports (SERs); the Browns Ferry Nuclear Plant Updated Final Safety Analysis Report (UFSAR); and plant Technical Specifications (TS). The inspectors evaluated all areas of this inspection, as documented below, against these requirements.

Documents reviewed by the inspectors are listed in the attachment.

.01 Systems Required to Achieve and Maintain Post-fire Safe Shutdown

a. Inspection Scope

The licensee's Safe Shutdown Analysis Report (SSAR) was reviewed to determine the components and systems necessary to achieve and maintain SSD conditions in the event of fire in each of the selected fire areas. The objectives of this evaluation were:

• Verify that the licensee's shutdown methodology has correctly identified the components and systems necessary to achieve and maintain an SSD condition.

• Confirm the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring and support system functions.

• Verify that an SSD can be achieved and maintained without off-site power, when it can be confirmed that a postulated fire in any of the selected fire areas could cause the loss of off-site power.

• Verify that local manual operator actions are consistent with the plant's fire protection licensing basis.

The main control room (remote) and in-plant manual operator actions (local) for controlling plant operation, fire response and achieving a SSD condition in response to a severe plant fire were reviewed and walked down by the inspectors. The inspectors evaluated the following plant procedures to accomplish this task.

• O-AOI-26-1, Fire Response

• 2-AOl-100-1, Reactor Scram

• 2/3-SSI-001, SSD Instructions

• 2/3-SSI-3-4, Unit 3 Reactor Building Fire Elevation 621 & Elevation 639 North of R-Line

• 2/3-SSI-9, Unit 2 Reactor Building Fire 4 kV Electric Board Room 2A

• 2/3-SSI-13, Unit 3 480 V Reactor Motor Operated Valve (RMOV) Board Room 3A

• EPIP-17, Fire Emergency Procedure-b.

Findinas

Introduction:

A finding was identified in that the licensee failed to protect the non-safety control circuit cables for the Unit 3 Reactor Recirculation Pumps (RRPs) in Fire Area 13 (Unit 3 480 V Reactor Motor Operated Valve Board Room 3A). In lieu of protecting these cables, the licensee used manual operator actions to locally trip the Unit 3 RRPs but failed to obtain prior NRC approval. Additionally, during a severe fire in Fire Area 13, these manual actions would be performed in Fire Area 13 and may not be successful because of the high temperatures, heavy smoke, low visibility and hazardous plant conditions that would likely be encountered by the operator while the actions are performed. This is an unresolved item (URI) pending completion of the significance determination process (SDP).

Description:

The licensee's SSAR assumes that both RRPs are tripped following a reactor scram. Normally, these actions are accomplished by operators in the main control room. However, in certain fire areas, RRP control power circuits were not protected from potential fire damage. As a result, the licensee developed manual operator actions to locally trip the RRP recirculation pump trip (RPT) breakers.

During a plant walk down of Procedure 2/3-SSI-13, the inspectors noted that two steps in Attachment 6 directed the' operator to enter the room where the fire was located and locally open an electrical circuit breaker. Specifically, Steps 1.1 and 1.2 of Attachment 6 to 2/3-SSI-1 3 directed the operator to enter Fire Area 13, go to the 250 V DC Reactor Motor Operated Valve (RMOV) Board 3A (located in Fire Area 13), and place the 4160 V RPT Board 3-Il normal control power breaker to off. The operator was then to proceed to the reactor building and open the associated RPT breakers (causing the RRPs to trip, if operating). These actions were required to be completed within 20 minutes of initiating procedure 2/3-SSI-13, and likely would be performed while the fire was fully involved and fire brigade response was in progress. Additionally, no alternative operator guidance was provided in 2/3-SSI-1 3 for the situation where the above actions could not be accomplished.

The inspectors concluded that the high temperatures, heavy smoke, low visibility and hazardous plant conditions during a severe fire would make it unlikely that the operator could successfully accomplish these actions. The inspectors also concluded that the RRP control power circuits were associated non-safety circuits as defined in 10 CFR 50, Appendix R, Section III.G.2. A review of the Browns Ferry SERs found that these manual operator actions had not been approved by the NRC for use in lieu of protecting the cables.

Following a self assessment documented in report BFN-OPS-03-009, on July 25, 2003, the licensee identified that its SSD fire instructions utilized local manual operator actions that had not been evaluated to the performance criteria listed in NRC Inspection Procedure 71111.05, Enclosure 2. The licensee initiated PER 03-013882-000 to generically review all manual operator actions once final guidance was available from NRC rulemaking as discussed in NRC letter SECY-03-1 00. This finding is captured in the licensee's corrective action program (CAP) by this PER.

Analysis:

The finding adversely impacted the capability of systems, structures and components necessary to achieve and maintain the plant in a safe shutdown condition during a severe fire. Because the finding affected the reactor safety mitigating system cornerstone objective, the finding is greater than minor. The inspectors determined the finding had potential safety significance greater than very low significance because if the RRPs are not tripped, the RRP discharge head pressure could impede Residual Heat Removal (RHR) Low Pressure Coolant Injection (LPCI) flow. RHR LPCI flow is the assured method for maintaining reactor water level in the safe range during severe plant fires. Inadequate RHR LPCI flow may cause reactor core uncovery and potential fuel damage. However, this finding remains unresolved pending completion of a significance determination.

Enforcement:

The NRC-approved FPP for Browns Ferry Units 2 and 3 commits to 10 CFR 50, Appendix R, Section III.G.Section III.G.2 states, in part, "where cables and equipment including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, one of the following means of ensuring that one of the redundant trains is free of fire damage shall be provided: (1)physical protection by a three-hour rated fire barrier;

(2) physical protection by a separation of more than 20 feet with no intervening combustibles or fire hazards plus fire detection and an automatic fire suppression system; or

(3) physical protection by a one-hour rated fire barrier plus fire detection and an automatic fire suppression system."

Manual operator action to respond to maloperations is not listed as an acceptable method for satisfying this requirement.

Contrary to the above, the licensee failed to protect the non-safety control circuit cables for the Unit 3 RRPs whose maloperation during a severe fire could prevent the redundant train of safe shutdown systems from successfully achieving and maintaining hot shutdown conditions. In lieu of providing adequate physical protection, the licensee used manual operator actions outside the main control room without obtaining prior NRC approval. In addition, these manual operator actions would be performed in the area of the fire and may not be successfully accomplished. Pending determination of the finding's safety significance, this finding is identified as URI 05000296/2003007-01, Failure To Protect Unit 3 Reactor Recirculation Pump Control Circuitry From Fire Damage And Unapproved Manual Operator Actions Performed In Location of Fire.

.02 Fire Protection of Safe Shutdown Capability

a.

Inspection Scone For the selected fire areas, the inspectors evaluated the frequency of fires or the potential for fires, the combustible fire load characteristics and potential fire severity, the separation of systems necessary to achieve SSD, and the separation of electrical components and circuits to ensure that at least one SSD path was free of fire damage.

The inspectors also reviewed the Fire Hazards Analysis (FHA) to verify the fire loading used by the licensee to determine the fire-resistive rating of the fire protection barriers and features. The inspectors also inspected the fire protection barriers and features to confirm they were installed in accordance with the codes of record to satisfy the applicable separation and design requirements of 10 CFR 50, Appendix R, Section III.G, and commitments to BTP CMEB 9.5-1. The inspectors reviewed the following documents, which established the controls and practices to prevent fires and to control the storage of permanent and transient combustible materials and ignition sources, to verify that the objectives established by the NRC-approved FPP were satisfied.

• Fire Protection Report (FPR) Volume 1, Fire Protection Plan e

FPR Volume 2, Section l-D, Smoking Restrictions

• TVAN Standard Programs and Processes Procedure SPP-1 0.10, Control of Transient Combustibles

• TVAN Standard Programs and Processes Procedure SPP-1 0.1 1, Control of Ignition Sources (Hot Work)

• Electrical Preventive Instruction EPI-0-000-MCCO01, Maintenance and Inspection of 480 V AC and 250 V DC Motor Control Centers The inspectors toured the selected fire areas to observe whether the licensee had properly evaluated in-situ combustible fire loads and limited transient fire hazards in a manner consistent with the fire prevention and combustible hazards control procedures.

In addition, the inspectors reviewed selected weekly fire safety inspection reports and fire brigade response and emergency/incident reports for 2002 and 2003 to assess the effectiveness of the fire prevention program.

The fire brigade is a dedicated group which is independent of the control room staff.

The inspectors reviewed fire brigade response, fire brigade qualification training, and drill program procedures; fire brigade drill critiques; and drill records for the brigade shifts from January 2001 to May 2003. The reviews were performed to determine whether fire brigade drills had been conducted in high fire risk plant areas and whether fire brigade personnel qualifications, drill response, and performance met the requirements of the licensee's approved FPP.

The inspectors walked down the fire brigade house and examined the response vehicle to assess the condition of fire fighting and smoke control equipment. Fire brigade personal protective equipment was examined to evaluate equipment accessibility and functionality. Additionally, the inspectors observed whether emergency exit lighting was provided for personnel evacuation pathways to the outside exits as identified in the National Fire Protection Association (NFPA) 101, Life Safety Code, and Occupational Safety and Health Administration (OSHA) Part 1910, Occupational Safety and Health Standards. This review also included examination of whether backup emergency lighting was provided for access pathways to and within the fire brigade house and equipment storage areas in support of fire brigade operations should power fail during a fire emergency. The fire brigade self-contained breathing apparatuses were evaluated for adequacy as well as the availability, and refill capability, of supplemental breathing air tanks.

The inspectors reviewed fire fighting pre-f ire plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to facilitate suppression of a fire. Team members also walked down the selected fire areas to compare the associated pre-fire plans and drawings with as-built plant conditions. This was done to verify that fire fighting pre-fire plans and drawings were consistent with the fire protection features and potential fire conditions described in the plant FHA.

The inspectors analyzed flow diagrams, circuit wiring diagrams and engineering calculations associated with the heating, ventilation, and air conditioning (HVAC)systems of the 2A and 2B Emergency Battery and Shutdown Board Rooms. This review was done to verify that systems used to place the plant in a SSD condition would not be impaired by a battery room fire started as a result of hydrogen gas buildup (from ventilation system problems). The inspectors also reviewed the annunciator response procedure for loss of ventilation in the battery rooms to affirm that actions were specified that would ensure hydrogen gas concentrations generated by the station batteries would be maintained below explosive limits.

The inspectors reviewed the licensee's methodology for meeting the requirements of 10 CFR 50.48 and the bases for the NRC's acceptance of this methodology as documented in NRC SERs. In addition, the inspectors reviewed plant documentation, such as the UFSAR, submittals made to the NRC by the licensee in support of the NRC's review of their FPP, and deviations from NRC regulations to verify that the licensee met license commitments. Additionally, design control procedures were reviewed to verify that plant changes were adequately reviewed for the potential impact on the FPP, SSD equipment, and procedures as required by the Browns Ferry Unit 2 and Unit 3 operating license conditions. The inspectors reviewed the criteria in plant procedures SPP-7.1, On Line Work Management, and SPP-9.3, Plant Modifications and Engineering Change Control, to determine if risk significant plant modifications were developed, reviewed, and approved per the procedure requirements.

6.

b. Findings

No findings of significance were identified.

.03 Post-fire Safe Shutdown Circuit Analysis

a.

Inspection Scone The inspectors reviewed how systems would be used to achieve and maintain reactivity control, over-pressure protection, inventory control with high or low pressure injection systems, and residual heat removal during and following a postulated fire in the areas selected for inspection. The inspection specifically focused on the minimum required systems and equipment necessary to achieve and maintain hot shutdown conditions because damage to these systems could pose a significantly greater risk than damage to systems required to achieve cold shutdown conditions. In addition, the inspectors reviewed a sample of the HVAC system for the selected fire areas.

Portions of the licensee's Appendix R Report which described the methodology and corresponding system flow diagrams were reviewed. Control circuit schematics were analyzed to identify and evaluate cables important for achieving a SSD. The inspectors traced the routing of cables through fire areas selected for review by using cable schedules and separation calculations and analyses. The inspectors walked down these fire areas to compare the actual plant configuration to the layout indicated on the drawings. The inspectors also utilized this information to determine if the requirements of Section III.G to 10 CFR 50, Appendix R (for protection of control and power cables)were met. The components and equipment included in the review are listed in the attachment.

b. Findings

No findings of significance were identified.

.04 Alternative Shutdown Capability

a. Inspection Scope

The selected fire areas that were the focus of this inspection all involved a reactor shutdown from the main control room. None involved abandoning the main control room and using an alternative method for achieving SSD from outside of the main control room. The previous NRC triennial inspection reviewed this area with no findings of significance (NRC Inspection Report 259,260,296/2000-008). No changes were made to the alternative shutdown methodology in the intervening period. Thus, alternative shutdown capability was not reviewed during this inspection.

b. Findings

No findings of significance were identified.

.05 Operational Implementation of Alternative Shutdown Capabilitv

a.

Inspection Scone The selected fire areas that were the focus of this inspection all involved a reactor shutdown from the main control room. None involved abandoning the main control room and using an alternative method for achieving SSD from outside of the main control room. The previous NRC triennial inspection reviewed this area with no findings of significance (NRC Inspection Report 259,260,296/2000-008). No changes were made to the alternative shutdown methodology in the intervening period. Thus, alternative shutdown capability was not reviewed during this inspection.

b. Findings

No findings of significance were identified.

.06 Communications

a. Inspection Scope

The inspectors reviewed plant communication capabilities to evaluate the availability of the communication systems to support plant personnel in the performance of manual operator actions for shutdown, fire event notification, and fire brigade fire fighting duties.

The inspectors reviewed the licensee's communications systems' separation analysis to verify that site portable radio and sound-powered phone systems were designed consistent with the licensing basis and would be available during fire response activities.

The inspectors also reviewed the fire brigade drill critiques to assess proper operation and effectiveness of the fire brigade command post radio communications. In addition, the inspectors reviewed the fire brigade radio communications systems to assess whether the radio channel features would continue to operate if the radio repeaters for the primary communications system became unavailable.

b. Findings

No findings of significance were identified.

.07 Emergency Lighting

a.

Inspection Scone The inspectors reviewed the design, operation, and manufacturer's data sheets for, the direct current (DC) self-contained battery powered emergency lighting units (ELUs).

The inspectors evaluated the capability of the ELUs to support plant personnel in the performance of SSD functions, including local manual operator actions, and for illuminating access and egress routes to the areas where those manual actions would be performed. The inspectors checked that these battery power supplies were rated with at least an 8-hour capacity, as required by Section II.J of 10 CFR 50, Appendix R.

During inspector walk downs of the plant areas where operators performed local manual actions, the inspectors inspected area ELUs for proper operation and checked the aiming of lamp heads to determine if sufficient illumination would be available to adequately illuminate the SSD equipment, the equipment identification tags, and the access and egress routes thereto, so that operators would be able to perform the actions without needing to use flashlights. The inspectors also reviewed completed surveillance and maintenance procedures and test records to ensure that the licensee properly maintained the lighting equipment.

b. Findings

No findings of significance were identified.

.08 Cold Shutdown Repairs

.a Inspection Scope The licensee had identified no need for cold shutdown repairs. The inspectors reviewed the licensee's Appendix R emergency ventilation procedure for smoke removal

[Abnormal Operating Instruction (AOI) 0-AOI-26-1, Fire Response] and inspected the portable equipment and ventilation ducts stored at a special Appendix R storage area and other locations onsite used for cooling components in electrical equipment rooms that were required for achieving a cold shutdown condition.

.b Findings No findings of significance were identified.

.09 Fire Barriers and Fire Area/Zone/Room Penetration Seals

a.

Inspection Scone The inspectors reviewed the selected fire areas to evaluate the adequacy of the fire resistance of fire area barrier enclosure walls, ceilings, floors, fire barrier mechanical and electrical penetration seals, fire doors, and fire dampers to ensure that at least one train of SSD equipment would be maintained free of fire damage. The inspectors selected several fire barrier features listed in the attachment for detailed evaluation and inspection to verify proper installation and qualification. The inspectors walked down the selected fire areas to observe the material condition and configuration of the installed fire barrier features, as well as, reviewed construction details and supporting fire endurance tests for the installed fire barrier features to verify the as-built configurations were qualified by appropriate fire endurance tests. The inspectors also reviewed the FHA to verify the fire loading used by the licensee to determine the fire resistance rating of the fire barrier enclosures. The inspectors also compared the penetration seal ratings with the ratings of the barrier enclosures in which they were installed. The inspectors reviewed the installation instructions for fire doors, the design details for mechanical and electrical penetrations, the penetration seal database, generic letter (GL) 86-10 evaluations, and the fire protection penetration seal deviation analysis for the technical basis of fire barrier penetration seals to verify that the fire barrier installations met design requirements and license commitments. In addition, the inspectors reviewed completed surveillance and maintenance procedures for selected fire barrier features to verify the fire barriers were adequately maintained.

The inspectors reviewed abnormal operating fire procedures, fire fighting pre-plans, fire damper location and detail drawings, and HVAC system drawings for a selected sample of equipment listed in the attachment, to confirm that access to SSD equipment and selected operator manual actions would not be inhibited by smoke migration from one area to adjacent plant areas used to accomplish SSD. Additionally, the inspectors reviewed licensee documentation, such as the UFSAR, submittals made to the NRC by the licensee in support of the NRC's review of their FPP, and deviations from NRC regulations to verify that the licensee met license commitments.

b. Findings

No findings of significance were identified.

.10 Fire Protection Systems. Features and Equipment

a.

Inspection Scone The inspectors reviewed flow diagrams, cable routing information, operational valve lineup procedures, and system availability studies, associated with the fire pumps and fire protection water supply system. The inspectors evaluated the common fire protection water delivery and supply components to determine if they could be damaged or inhibited by fire-induced failures of electrical power supplies or control circuits. Using operating and test procedures, the inspectors toured the electric motor-driven fire pumps and diesel-driven fire pump to observe the system material condition, consistency of as-built configurations with engineering drawings, and determine correct system controls and valve lineups. Additionally, the inspectors reviewed periodic test procedures for the fire pumps to assess whether the surveillance test program was sufficient to verify proper operation of the fire protection water supply system in accordance with the system operating requirements specified in Sections 9.3 and 9.4 of the FPR.

The inspectors reviewed the adequacy of the design, installation, and operation of the automatic detection and alarm system for the selected fire areas to actuate in the early stage of a fire. This was accomplished by reviewing engineering drawings for fire detector types, spacing, locations, the licensee's technical evaluation of the detector locations and the ceiling reinforcing plans and beam schedule drawings to determine the location of ceiling bays. After the ceiling bay locations were identified, the inspectors conducted field tours of the accessible portions of the fire detection systems in Fire Areas 9 and 13 to confirm that detector locations were consistent with the licensee's engineering drawings, FHA, engineering evaluations, and each bay was protected by a fire detector in accordance with the code of record requirements - NFPA 72E, 1990. In addition, the inspectors reviewed surveillance procedures and the detection system operating requirements specified in Sections 9.3 and 9.4 of the FPR to determine the adequacy of fire detection component testing and to ensure that the detection systems could function when needed.

The inspectors reviewed the adequacy of the design and installation of the automatic pre-action sprinkler system and water curtains surrounding unsealed vertical openings and the stairwells of the Unit 3 reactor building elevation 621 ft. (Fire Area 3-4). The inspectors walked down the system to evaluate proper type, placement, spacing of the sprinkler heads, and the extent of the sprinkler head obstructions for effectiveness to prevent a fire from spreading to adjacent fire zones. In addition, the inspectors examined the sprinkler system hydraulic design calculations to verify that the system could be supplied sufficient pressure and flow volume to produce the required water density for the protected area. Selected engineering evaluations for NFPA code deviations were reviewed and compared with the physical configuration of the system.

Additionally, the inspectors reviewed the physical configuration of electrical raceways and SSD components in the selected fire areas to determine whether water from a pipe rupture, actuation of the automatic suppression system, or manual fire suppression activities in this area could cause damage that could inhibit the plant's ability to SSD.

The inspectors reviewed the manual suppression standpipe and fire hose system to verify adequate design, installation, and operation in the selected fire areas. The inspectors examined design flow calculations and flow measurement/pressure test data to verify that the required fire hose water flow for each protected area was available.

The inspectors performed in-plant walk-downs and observed placement of the fire hoses and extinguishers to confirm consistency with the fire fighting pre-plan drawings.

Additionally, the inspectors checked a sample of manual fire hose lengths to determine whether they would reach the SSD equipment in the selected fire areas. This was done to ensure that manual fire fighting efforts could be accomplished in the selected areas.

b.

Findinas No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The inspectors reviewed the administrative controls for out-of-service, degraded, and/or inoperable fire protection features, ventilation systems, and post-fire SSD systems and components. The review was performed to verify that the risk associated with removing fire protection and/or post-fire systems or components from service were properly assessed and adequate compensatory measures were implemented in accordance with TS and the approved FPP. The inspectors also reviewed the adequacy of short-term compensatory measures to compensate for a degraded function or feature until appropriate corrective actions were taken.

b. Findings

Introduction.

A Green NCV was identified in that the licensee made changes to the approved FPP which decreased the effectiveness of the program without prior Commission approval. The licensee inappropriately used the License Condition Impact Evaluation (LCIE) change process to revise the FPP to allow the removal of fire suppression systems and/or fire rated barrier assemblies, necessary to satisfy the separation and suppression requirements of 10 CFR 50, Appendix R, Sections II.G.2 and Il.G.3, from service without compensatory measures (i.e., fire watches) being implemented.

Description.

The approved Browns Ferry FPP is documented in the FPR (and incorporated into the UFSAR by reference). The inspectors reviewed the operating requirements of selected fire protection features specified in Sections 9.3 and 9.4 of the FPR, in SPP-10.9 (Control of Fire Protection Impairments,) and from the licensee's Fire Protection Impairment Program (FPIP) report logs dated September 29, 2003. During review of the FPIP report log, the inspectors found that the licensee had removed the following fire protection features from service:

• The pre-action fire suppression sprinkler systems for the Unit 2 and 3 high pressure core injection areas (FPIP No.03-287).

• Penetration seals in a fire barrier wall separating the Unit 1 reactor building from the control building (FPIP No.03-303).

The inspectors noted that the licensee had removed these fire protection features from service without compensatory measures being implemented (i.e., without fire watches being posted in the affected plant areas). Upon investigation, the inspectors found that the licensee had changed the FPP requirements for implementing compensatory measures under certain plant conditions.

The Browns Ferry FPP is based on following defense-in-depth (DID) elements (FPR, Volume 1, Section 4.2):

• Prevent fires from starting;

• Detect fires quickly and rapidly suppress those fires that occur to limit damage; and

• Design plant safety systems so that a fire which starts in spite of the fire prevention efforts and burns for a significant period of time in spite of fire suppression activities will not prevent essential plant safety functions from being performed.

Defense-in-depth holds that a weakness in one of the above elements can be offset by enhancing the other elements. Fire watches are the most common industry compensatory measure used to help prevent fires. Fire watches strengthen the fire prevention DID element by looking for uncontrolled ignition sources, fire hazards, and combustible materials, and by providing prompt notification of such hazards. In addition, fire watches can strengthen the fire detection and suppression DID element because they are either continuously present within or regularly survey an area for fire. In this case, the fire watch would notify the main control room to call out the fire brigade, give the fire brigade exact information about the location and nature of the fire, and may initiate fire suppression activities if trained to do so.

The inspectors reviewed the licensee's LCIE associated with Revision 20 of the FPR.

This LCIE evaluated changes to the FPR that removed fire watches as a compensatory measure for impairments of the water spray, water sprinkler, or gaseous C02 fire suppression systems and/or fire rated assemblies (i.e., fire barriers). Prior to this change, the Browns Ferry NRC-approved FPP required that, whenever a required fire suppression system and/or fire rated barrier assembly was inoperable, either a continuous or a one-hour compensatory fire watch patrol (with backup suppression equipment) be stationed. The LCIE concluded that the assignment and presence of fire watch personnel for the purpose of detecting and reporting fires with operable fire detection equipment was unnecessary and provided minimal additional fire protection safety margins. The evaluation also stated that, with the detection system functioning and the alternate suppression equipment available, the response was comparable with the fire watch in place and that the ability to safely shut down the plant was not adversely affected. The inspectors'noted, however, that the licensee's change evaluation did not provide a technical basis for these conclusions.

Based on this evaluation, the licensee revised the FPR, Volume 1, Section 9.3.11.C, Spray and/or Sprinkler Systems, Section 9.3.11.D, C02 Systems, and Section' 9.3.11.a.3, Fire Rated Assemblies, to delete the requirements for fire watches due to inoperable fire protection systems and features if the associated fire detection is operable. In addition, FPR Section 7.5 was revised to delete the requirement for a fire watch for areas in which the fire suppression equipment was inoperable.

The inspectors concluded that the licensee inappropriately used the fire protection program change process to revise the FPP on October 23, 2002, to permit removing fire suppression systems and/or fire rated barrier assemblies from service without enhancing the other DID elements as a compensatory measure. Specifically, the revised FPP allowed degraded or inoperable fire suppression systems and fire barriers necessary to satisfy the separation and suppression requirements of 10 CFR 50, Appendix R, Sections III.G.2 and III.G.3, without compensatory fire watches being established in the affected plant areas if fire detection systems were functioning. The change adversely affected the ability to achieve and maintain safe shutdown in the event of a fire, in that, the licensee went from full compliance with the fire protection safe shutdown system separation and suppression criteria to less than full compliance without implementing compensatory measures to compensate for weakness in this DID element. This was contrary to the safety objectives of the FPP and constituted a change from the approved program that required NRC approval prior to implementation.

However, no NRC approval was obtained by the licensee.

Analysis.

Because issues related to the fire protection change process are considered to be findings that could potentially impede or impact the regulatory process, they are dispositioned using the traditional enforcement process instead of the SDP. In this case, the issue was significant because the licensee's change process for the fire protection program allowed a decrease in the effectiveness of the fire protection program to be accepted without prior NRC approval. Furthermore, this issue had a credible impact on safety because the licensee's failure to properly evaluate the removal of fire watch posting requirements could adversely affect or degrade the ability for achieving and maintaining SSD from the main control room, local shutdown stations, or alternate shutdown stations. However, the inspectors determined that this finding was of very low significance because, based on an assessment of the impacts of the identified fire protection features removed from service, the licensee's overall SSD capabilities in the affected fire areas and related FPP features (fire brigade) remained adequate to achieve and maintain SSD conditions.

Enforcement.

10 CFR 50.48(a) states, in part, that each operating nuclear power plant must have a fire protection program. Browns Ferry Unit 2 Operating License Condition 2.C.(14) and Browns Ferry Unit 3 Operating License Condition 2.C.(7) state, in part, that Browns Ferry Nuclear Plant may make changes to the approved FPP without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain SSD in the event of a fire."

Contrary to the above, the licensee changed the Browns Ferry FPP to remove the requirement to implement fire watches for impaired fire protection systems and features which were a compensatory measure necessary to assure the ability to achieve and maintain safe shutdown in the event of fire. This violation was not evaluated under the SDP because it impacted the NRC's ability to perform its regulatory function and, as such, was evaluated in accordance with guidance in Sections IV.A.1 through IV.A.4 and Section IV.B of the NRC's Enforcement Policy. Based on this guidance, this violation of 10 CFR 50.48 and the Unit 2 and Unit 3 Operating License Conditions is classified as a Severity Level IV violation because it resulted in conditions that were evaluated as having very low safety significance. Because this change to the FPP is of very low safety significance and has been entered the finding into the CAP (PER 03-018593-000), this violation was being treated as an NCV in accordance with Section VL.A.1 of the NRC's Enforcement Policy: NCV 05000260,296/2003007-02, Changes Made to the Fire Protection Program Regarding Compensatory Fire Watch Implementation Without NRC Approval.

.12 Fire Protection Licensing Basis

a.

Inspection Scone The inspectors reviewed licensing basis documents, including but not limited to SERs and Appendix R exemptions, to ascertain if the Browns Ferry FPP was consistent, and in compliance, with 10 CFR 50.48 and 10 CFR 50, Appendix R. The inspectors evaluated and compared the licensee's SSD procedures, the FPR, and various calculations of record against the licensing basis to measure the adequacy and consistency of the program documentation.

b. Findings

No findings of significance were identified.

OTHER ACTIVITIES

40A2 Identification and Resolution of Problems

a. Inspection Scope

The inspectors reviewed a sample of licensee audits, self-assessments and PERs to verify that items related to the Browns Ferry FPP, and the capability to successfully achieve and maintain the plant in a SSD condition following a plant fire, were appropriately entered into the licensee's CAP in accordance with the Browns Ferry quality assurance program and procedural requirements. The items selected were reviewed for classification and appropriateness of the corrective actions taken, or initiated, to resolve the issues. In addition, the inspectors reviewed the licensee's evaluations of and corrective actions for selected industry experience issues related to the fire protection area. The operating experience reports were reviewed to verify that the licensee's review and actions were appropriate. Additionally, the inspectors reviewed audits and self-assessments of the Browns Ferry FPP to assess the types of findings that were generated and that the findings were appropriately entered into the licensee's CAP.

b. Findings

No findings of significance were identified.

40A6 Meetings. Including Exit On October 3, 2003, the lead inspector presented the inspection results to Mr. A. Bhatnagar and other members of his staff who acknowledged the findings. The licensee confirmed that proprietary information was not provided or examined during the inspection.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

R. Abbas, Site Engineer Mechanical

A. Bhatnagar, Site Vice-President

T. Golden, Operations

M. Heatherly, Corporate Engineering

P. Heck, Site Licensing Engineer

J. Lewis, Operations Manager

R. Marks, Site Support Manager

R. Rogers, Maintenance Modifications Manager

R. Sampson, Site Engineer Electrical

M. Skaggs, Plant Manager

T. Trask, Design Engineering Manager

J. Wallace, Site Licensing Engineer

D. White, Nuclear Assurance

R. White, Fire Operations Supervisor

NRC personnel

B. Holbrook, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000296/2003007-01 URI Failure To Protect Unit 3 Reactor Recirculation Pump Control Circuitry From Fire Damage And Unapproved Manual Operator Actions Performed In Location of Fire (Section 1 R05.01)

Opened and Closed

05000260,296/2003007-02 NCV Changes Made to the Fire Protection Program Regarding Compensatory Fire Watch Implementation Without NRC Approval (Section 1 R05.1 1)

Discussed

None ATTACHMENT

LIST OF COMPONENTS INSPECTED Section 1 R05.03: Post-Fire Safe Shutdown Capability Component Identification Description O-PMP-026-0001 O-PMP-026-0002 0-PMP-026-0003 O-PMP-026-0118 2-45N2711-4 2-FCV-023-0052 2-FCV-067-0021 2-FCV-074-0035 2-FCV-074-0057 2-FCV-074-0058 2-FCV-074-0059 2-FCV-074-0067 2-FCV-074-0071 2-FCV-074-0072 2-FCV-074-0073 2-FCV-074-0106 2-PCV-001 -0019 2-PCV-001 -0031 2-PCV-001 -0179 2-PMP-074-0039 2-PNL-9-33 PS-3-204AA PS-3-204CB PS-3-204BA PS-3-204CA PS-3-204DA PS-3-204DB

'A' Electric Fire Pump

'B' Electric Fire Pump

'C' Electric Fire Pump Diesel Fire Pump ECCS Div. ll ATU Inverter RHR Heat Exchanger D Service Water Outlet Valve EECW Sectionalizing Valve RHR Pump 2D Suction Valve RHR System I Isolation Valve RHR System I Containment Spray Isolation Valve RHR System I Suppression Pool Isolation Valve RHR System Il Inboard Injection Valve RHR System Il Isolation Valve RHR System II Containment Spray Isolation Valve RHR System II Containment Spray Isolation Valve RHR Flush Pump Suction Valve Main Steam Relief Valve Main Steam Relief Valve Main Steam Relief Valve RHR Pump2D RHR System II Logic Panel Main Steam Pressure Switch Div. I Main Steam Pressure Switch Div. ll Main Steam Pressure Switch Div. I Main Steam Pressure Switch Div. ll Main Steam Pressure Switch Div. ll Main Steam Pressure Switch Div. ll Section 1 R05.09: Fire Barriers and Fire Area/Zone/Room Penetration Seals Fire Protection Feature Description Fire Barrier Concrete Block Walls Fire Doors Fire Dampers Fire Barrier Penetration Seals Component Identification North walls of Fire Areas 14 and 15 adjacent to Fire Area 13 Nos. 640, 642, 643, 648, and 654 Nos. FD-2008, FD-2009, FD-2010, FD-2577, and FD-2641 Nos. S2 6211853, S2 6215071, S2 6215805, S3 6213408, S3 6213467, S3 6215024 Description ATTACHMENT

2-AHU-031-2320 Electric Board Room Air Handling Unit 2A 2-AHU-031-2330 Electric Board Room Air Handling Unit 2B 2-FAN-31-163A 250 V Battery Room Exhaust Fan 2A 2-FAN-31-163B 250 V Battery Room Exhaust Fan 2B 2-FAN-31-164A 250 V Battery Room Supply Fan 2A 2-FAN-31-164B 250 V Battery Room Supply Fan 2B 3-FAN-31-119 Emergency Battery and Shutdown Board Room Exhaust Fan 3A 0-FCO-031-0093 Emergency Battery and Shutdown Board Room Flow Control Damper