Text

IR 05000259-09-009, 05000260-09-009, 05000296-09-009; 09/21/2009 - 09/25/2009; Browns Ferry Nuclear Plant, Units 1, 2, & 3; Triennial Fire Protection Inspection
	ML100201056
Person / Time
Site:	Browns Ferry
Issue date:	01/20/2010
From:	Kennedy K; Division of Reactor Safety II
To:	Swafford P; Tennessee Valley Authority
References
	IR-09-009
	Download: ML100201056 (61)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION II

ary 20, 2010

SUBJECT:

BROWNS FERRY NUCLEAR PLANT - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000259/2009009, 05000260/2009009 AND 05000296/2009009; PRELIMINARY GREATER THAN GREEN FINDINGS

Dear Mr. Swafford:

On October 9, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed the onsite portion of a triennial fire protection inspection at your Browns Ferry Nuclear Plant Units 1, 2, and 3. The enclosed inspection report documents the inspection findings, which were discussed on that date with Mr. J. Randich and other members of your staff. Additional in-office reviews were conducted subsequent to the inspection. The enclosed inspection report documents the final inspection results and preliminary significance determination which were discussed by telephone with Mr. R. Krich and members of your staff on January 19, 2010.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents three findings related to the Browns Ferry fire protection program which have preliminarily been determined to be Greater Than Green, that is, findings of greater than very low safety significance. The first finding involves multiple examples of the failure to ensure that one of the redundant trains of safe shutdown equipment and cables located in the same fire area was free of fire damage in accordance with 10 CFR Part 50, Appendix R, Section III.G.2.

Specifically, cables associated with equipment required for safe shutdown had not been protected by one of the methods specified in Appendix R,Section III.G.2 (i.e., use of spatial separation, passive barriers, and fire detection and an automatic suppression system). This finding resulted from the review of unresolved items identified during previous NRC inspections.

The second finding involves multiple examples of the failure to ensure that one train of equipment and systems necessary to achieve and maintain hot shutdown conditions was free of fire damage in accordance with 10 CFR Part 50, Appendix R, Section III.G.1. Furthermore, the cables had not been protected by one of the methods specified in Appendix R,Section III.G.2 (i.e., use of spatial separation, passive barriers, and fire detection and an automatic suppression TVA 2 system). This finding resulted from the review of unresolved items identified during previous NRC inspections.

For the first and second finding, the Browns Ferry fire protection program relied on operator manual actions to mitigate the potential adverse effects of fire damage to safe shutdown equipment and systems. The use of these actions for meeting Appendix R,Section III.G.1 or III.G.2 would require an exemption, which you did not have.

The third finding involves an inappropriate revision to the Browns Ferry post-fire safe shutdown instruction entry conditions, which resulted in the safe shutdown instruction not meeting the requirements of Technical Specification 5.4.1.a. As a result of this revision, the safe shutdown instruction may not have been entered for use which could have delayed proper operator response to a major disabling fire event. Furthermore, the revised entry condition was not consistent with initial plant conditions assumed in the Browns Ferry fire safe shutdown analysis.

This finding resulted from the review of an unresolved item identified during a previous NRC inspection.

Each finding was assessed based on the best available information, including influential assumptions, using the applicable Significance Determination Process. In performing the risk evaluation of the first two findings, we considered all fire areas affected, and screened out the fire scenarios that would not contribute significantly to the risk. The significance of each of these first two findings results from the sum of the risk of the fire scenarios not screened out.

The significance of the third finding was determined utilizing Inspection Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. These three findings also are apparent violations of NRC requirements and are being considered for escalated enforcement action in accordance with the NRC Enforcement Policy, which can be found on the NRCs web site at www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html The NRC determined that these apparent violations do not present an immediate safety concern, because the Browns Ferry staff has implemented compensatory measures while long-term corrective actions are being implemented. To address the first two apparent violations of 10 CFR Part 50, Appendix R, Sections III.G.2 and III.G.1, in addition to the existing compensatory measures (consisting of operator manual actions to mitigate or prevent damage to equipment necessary for safe shutdown in the event of a fire), the Browns Ferry staff has also implemented additional compensatory measures by establishing fire watches in all three units to mitigate the safety hazard. The NRC inspection team reviewed the critical operator manual actions, and concluded that they were feasible, based on inspection activity described in this and previous NRC inspection reports. Subsequent to the onsite inspection, the Browns Ferry staff evaluated the most critical operator manual actions, and revised selected safe shutdown instructions to include steps for independent confirmation of operator manual actions in order to improve the likelihood of success of these steps, and thus reduce the risk associated with the first two apparent violations. It is our understanding that your Browns Ferry staff will continue to evaluate and revise safe shutdown instructions as necessary for further risk reduction.

Additionally, on March 4, 2009, TVA informed the NRC of your plans to adopt National Fire Protection Association (NFPA) 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition, as an alternate, performance-based method to comply with NRC fire protection requirements. The third apparent violation was corrected in February 2009, when your Browns Ferry staff revised the entry conditions to the safe shutdown instructions. TVA 3 In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of the date of this letter. The Significance Determination Process encourages an open dialogue between NRC and licensee staff; however, the dialogue should not impact the timeliness of the NRCs final determination. Before we make a final decision on this matter, we are providing you an opportunity to: (1) present your perspectives on the facts and assumptions used by the NRC to arrive at the findings and their significance at a regulatory conference; or (2)

submit your position on the findings to the NRC in writing. In providing your perspectives on the risk significance of these findings, you should include information to address the following two areas: (1) the conditions under which operators would enter the safe shutdown instructions; and (2) the impact that these findings would have on changes to the Large Early Release Frequency and Core Damage Frequency. In addition, you should provide information regarding the actions you have taken and/or plan to take to further reduce the significance of these apparent violations. If you request a regulatory conference, it should be held within approximately 30 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a regulatory conference is held, it will be open for public observation. The NRC will also issue a press release to announce the conference. If you decide to submit only a written response, such submittal should be sent to the NRC within 30 days of the receipt of this letter.

If you decline to request a regulatory conference or submit a written response, you relinquish your right to appeal the final Significance Determination Process conclusion, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of Inspection Manual Chapter 0609.

Please contact Ms. Rebecca Nease at (404) 562-4530 within 10 days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberations on this matter.

Since the NRC has not made a final determination in this matter, no notices of violations are being issued for these inspection findings at this time. In addition, please be advised that the number and characterization of the apparent violations described in the enclosed inspection report may change as a result of further NRC review.

In addition to the above apparent violations, this report also documents two NRC-identified findings of very low safety significance (Green). These findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they have been entered into your corrective action program, the NRC is treating these findings as non-cited violations consistent with Section VI.A.1 of the NRC Enforcement Policy.

If you contest any non-cited violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the Browns Ferry Nuclear Plant.

In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region II, and the NRC Resident Inspector at the TVA 4 Browns Ferry Nuclear Plant. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and Enclosure 1 will be made available electronically for public inspection in the NRC Public Document Room or from the NRC=s document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. However, because of the security-related information contained in Enclosure 2, and in accordance with 10 CFR 2.390, a copy of Enclosure 2 will not be available for public inspection.

Sincerely,

/RA/

Kriss M. Kennedy, Director Division of Reactor Safety Docket Nos.: 50-259, 50-260, 50-296 License Nos.: DPR-33, DPR-52, DPR-68

Enclosures:

1. NRC Inspection Report 05000259/2009009, 05000260/2009009 and 05000296/2009009 w/Attachment: Supplemental Information 2. SDP Phase 3 Summary ( SECURITY-RELATED INFORMATION)

REGION II==

Docket Nos.: 50-259, 50-260, 50-296 License Nos.: DPR-33, DPR-52, DPR-68 Report No.: 05000259/2009009, 05000260/2009009 and 05000296/2009009 Licensee: Tennessee Valley Authority (TVA)

Facility: Browns Ferry Nuclear Plant, Units 1, 2, and 3 Location: Athens, AL 35611 Dates: September 21 - 25, 2009 (Week 1)

October 5 - 9, 2009 (Week 2)

Inspectors: M. Thomas, Senior Reactor Inspector (Lead Inspector)

P. Fillion, Senior Reactor Inspector K. Miller, Reactor Inspector G. Pick, Senior Reactor Inspector P. Qualls, Fire Protection Engineer, Office of Nuclear Reactor Regulation (NRR)/Fire Protection Branch (AFPB)

L. Suggs, Reactor Inspector Approved by: Rebecca L. Nease, Chief Engineering Branch 2 Division of Reactor Safety Enclosure 1

SUMMARY OF FINDINGS

IR 05000259/2009-009, 05000260/2009-009, 05000296/2009-009; 09/21 - 25/2009 and 10/05 -

09/2009; Browns Ferry Nuclear Plant, Units 1, 2, and 3; Triennial Fire Protection Inspection This report covers an announced two-week triennial fire protection inspection by a team of five regional inspectors and one NRR fire protection engineer. Two Green non-cited violations and three apparent violations with potential safety significance Greater Than Green were identified.

The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). The cross-cutting aspects were determined using IMC 0305, Operating Reactor Assessment Program. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Rev. 4, dated December 2006.

NRC Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of Browns Ferry Units 1, 2, and 3 Operating License Conditions 2.C(13), 2.C(14), and 2.C(7), respectively, for the licensees failure to maintain in effect all provisions of the NRC-approved fire protection program, as described in the Final Safety Analysis Report. The Fire Protection Report (referenced in the Final Safety Analysis Report) requires that measures be established to ensure that conditions adverse to fire protection, such as failures and deficiencies, are promptly identified and corrected. The licensee had not established measures to identify and correct an excessive number of Appendix R emergency lighting unit failures.

Specifically, emergency lighting unit failures were not being entered in the corrective action program as problem evaluation reports in order to evaluate and resolve why many of the emergency lighting failures occurred prior to reaching their 6-year replacement date. Additionally, the Fire Protection Report surveillance requirement to replace the Appendix R emergency lighting unit batteries and lamp heads every six years was not being adequately implemented, in that licensee data revealed that several installed emergency lighting units were beyond their 6-year replacement date. The licensee entered this finding into their corrective action program and initiated corrective actions to address these issues.

The licensees failure to meet the Fire Protection Report requirements to establish measures to identify and correct a condition adverse to fire protection (excessive Appendix R emergency lighting unit failures); and, to implement the Appendix R emergency lighting system replacement program, is a performance deficiency. The finding is more than minor because it is associated with the reactor safety, mitigating systems cornerstone attribute of protection against external factors (i.e., fire). The excessive emergency lighting unit failures affected the objective of ensuring the reliability and capability of operator manual actions during response to initiating events. The team determined that this finding was of very low safety significance (Green) because the operators had a high likelihood of completing the tasks using flashlights. The cause of this finding has a cross-cutting aspect in the Work Control component of the Human 3 Performance area, in that it was directly related to the licensee not planning and coordinating work activities to support long-term equipment reliability, and their maintenance scheduling was more reactive than preventive (H.3 (b)). (Section 1R05.09)

Green.

The team identified a Green non-cited violation of Browns Ferry Units 1, 2, and 3 Operating License Conditions 2.C(13), 2.C(14), and 2.C(7), respectively, for the licensees failure to maintain in effect all provisions of the NRC-approved fire protection program as described in the Final Safety Analysis Report. The Fire Protection Report (referenced in the Final Safety Analysis Report) requires the licensee to establish adequate compensatory measures for degraded or inoperable fire protection equipment.

The licensee failed to establish adequate compensatory measures for an out-of-service hose station, in that the staged additional lengths of hose connected to the closest in-service hose station, established as a compensatory measure, did not provide equal or better protection than the out-of-service hose station that it was replacing. The licensee entered this finding into their corrective action program and took immediate action to review all existing fire protection impairment permits for similar problems. The licensee removed the compensatory measure and restored the out-of-service hose station to service.

The licensees failure to provide compensatory measures of equal or better protection for an out-of-service hose station is a performance deficiency because it did not meet the requirements of the approved fire protection program. The finding was more than minor because it affected the protection against external factors attribute of the mitigating systems cornerstone, in that it impacted manual fire suppression (i.e., fire brigade)capability; and, affected the cornerstone objective of ensuring the availability of systems that respond to initiating events. Since Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, does not provide guidance for assigning a degradation rating to manual fire suppression, this determination was made using qualitative methods which received NRC management review as provided for in Inspection Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. This finding was determined to be of very low safety significance (Green) because it represented a low degradation of the manual fire suppression function. Although the fire protection impairment permit had been implemented for an out-of-service hose station, the hose station was still functional at the time this issue was identified, because the water supply to the hose station had not been physically isolated. However, the team concluded the fire brigade would have experienced delays in initiating manual fire suppression for a fire in a fire area covered by the impairment. The cause of this finding has a cross-cutting aspect in the Work Control component of the Human Performance area, in that it was directly related to the licensee not planning and coordinating work activities, consistent with nuclear safety, to ensure that adequate compensatory actions were established for an out-of-service hose station (H.3 (a)). (Section 1R05.11)

TBD. The team identified an apparent violation of Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Appendix R,Section III.G.2, for the licensees failure to ensure one of the redundant trains of cables and equipment required for safe shutdown and located in the same fire area was free of fire damage. Specifically, cables associated with equipment required for safe shutdown had not been protected by one of the methods specified in 10 CFR Part 50, Appendix R, Section III.G.2 (i.e., use of spatial separation, passive barriers, and fire detection and an automatic fire suppression system). This apparent violation applies to Browns Ferry Units 1, 2, and 3, and resulted from review and closure of two unresolved items which were opened in previous inspections. The licensee entered this apparent violation into their corrective action program and posted additional compensatory measures while long term corrective actions are being implemented.

Failure to protect one train of cables and equipment necessary to achieve post-fire safe shutdown from fire damage, as required by 10 CFR Part 50, Appendix R, Section III.G.2, is a performance deficiency. This finding is more than minor because it is associated with the reactor safety mitigating system cornerstone attribute of protection against external events (i.e., fire). Failure to protect safe shutdown cables and equipment from fire damage affects the reactor safety mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team performed a significance determination process Phase 1 screening. Given the likely impact of the risk contribution arising from the assessment of multiple fire areas, Region II senior reactor analysts performed a Phase 3 significance determination, which resulted in a preliminary risk of Greater Than

Green.

The team determined that this apparent violation did not present an immediate safety concern because the licensee implemented compensatory measures while long-term corrective actions are being implemented. The compensatory measures included operator manual actions to mitigate or prevent damage to equipment necessary for safe shutdown in the event of a fire. The licensee also implemented fire watches as additional compensatory measures to mitigate the safety hazard.

Subsequent to the onsite inspection, the licensee evaluated the most critical operator manual actions, and revised selected safe shutdown instructions to include steps for independent confirmation of operator manual actions in order to improve the likelihood of success of these steps, and thus reduce the risk associated with this apparent violation.

The cause of this finding has a cross-cutting aspect in the Corrective Action Program component of the Problem Identification and Resolution area, in that the licensee did not take appropriate corrective actions to address the issue in a timely manner, commensurate with the safety significance (P.1 (d)). (Section 4OA5.02)

TBD. The team identified an apparent violation of Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Appendix R,Section III.G.1, for the licensees failure to ensure that one train of cables and equipment necessary to achieve and maintain hot shutdown conditions was free of fire damage in 20 fire areas. In addition, these cables had not been protected by one of the methods specified in Appendix R,Section III.G.2 (i.e., use of spatial separation, passive barriers, and fire detection and an automatic suppression system). This apparent violation applies to Browns Ferry Units 1, 2, and 3, and resulted from review and closure of two unresolved items which were opened in previous inspections. The licensee entered this finding into their corrective action program and posted additional compensatory measures while long term corrective actions are being completed.

5 Failure to meet the requirements of 10 CFR Part 50, Appendix R, Section III.G.1 is a performance deficiency. It is more than minor because it is associated with the reactor safety mitigating system cornerstone attribute of protection against external events (i.e.,

fire). Failure to ensure that one train of safe shutdown cables and equipment was free of fire damage affects the reactor safety mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events. This finding was evaluated in accordance with NRC Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process. The team performed a significance determination process Phase 1 screening. Given the likely impact of the risk contribution arising from the assessment of multiple fire areas,

Region II senior reactor analysts performed a Phase 3 significance determination, which resulted in a preliminary risk of Greater Than

Green.

The team determined that this apparent violation did not present an immediate safety concern because the licensee implemented compensatory measures while long-term corrective actions are being implemented. The compensatory measures included operator manual actions to mitigate or prevent damage to equipment necessary for safe shutdown in the event of a fire. The licensee also implemented fire watches as additional compensatory measures to mitigate the safety hazard. Subsequent to the onsite inspection, the licensee evaluated the most critical operator manual actions, and revised selected safe shutdown instructions to include steps for independent confirmation of operator manual actions in order to improve the likelihood of success of these steps, and thus reduce the risk associated with this apparent violation. The cause of this finding has a cross-cutting aspect in the Corrective Action Program component of the Problem Identification and Resolution area, in that the licensee did not identify and thoroughly evaluate the problem, and the resolution did not address causes and extent of condition (P.1 (c)).

(Section 4OA5.03)

TBD. The team identified an apparent violation of Technical Specification 5.4.1.a., in that, the licensees revision to the safe shutdown instruction entry conditions in December 2008 resulted in inadequate procedural guidance. Specifically, the revision to Procedure 0-SSI-001, Safe Shutdown Instructions, added an entry condition based on the operators ability to restore and maintain reactor water level above +2 inches on the narrow range scale, utilizing available equipment. This revision could have delayed or prevented entry into the safe shutdown instructions if reactor water level stayed at or above +2 inches on the narrow range scale. Furthermore, this entry condition was not consistent with the initial plant conditions assumed in the fire protection program safe shutdown analysis. The licensee entered this finding into the corrective action program and revised the entry conditions for the safe shutdown instructions on February 27, 2009, to eliminate the +2-inch reactor vessel water level entry condition.

Failure to meet Technical Specification requirements due to inadequate procedural guidance is a performance deficiency. This finding is more than minor because it is associated with the procedure quality attribute of the mitigating systems cornerstone and the inadequate procedure affected the cornerstone objective of protection against external events such as fire to prevent undesirable consequences. Given the number of fire areas involved, a significance determination process Phase 2 analysis was not performed. A regional senior reactor analyst determined that there were significant obstacles to quantifying the risk of this finding because the methods and tools are not adequate to determine the significance of this finding within the established timeliness goal of 90 days. Therefore, the safety significance of this finding was determined using the guidance and qualitative techniques contained in NRC Inspection Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. The preliminary significance of this finding was determined to be Greater Than Green, which was reviewed and approved by NRC management. The team determined that this finding did not present an immediate safety concern because the immediate safety hazard no longer existed after the licensee revised the safe shutdown instruction in February 2009. The cause of this finding had a cross-cutting aspect in the Decision Making component of the Human Performance area, in that it was related to the licensee not using conservative assumptions in decision making and not conducting reviews to verify the validity of underlying assumptions and identifying possible unintended consequences (H.1 (b)). (Section 4OA5.04)

Licensee-Identified Violations

None 1

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure (IP) 71111.05TTP Fire Protection - NFPA 805 (Triennial). The objective of the inspection was to review implementation of the Browns Ferry Nuclear Plant, Units 1, 2, and 3, fire protection program described in the Fire Protection Report (FPR). Three fire areas (FAs) were selected for detailed review.

The three FAs chosen for review were selected based on available risk information as analyzed onsite by a senior reactor analyst, data obtained in plant walkdowns regarding potential ignition sources, location and characteristics of combustibles, and location of equipment needed to achieve and maintain safe shutdown (SSD) of the reactor. Other considerations for selecting the FAs were the relative complexity of the post-fire safe shutdown instruction (SSI), information contained in FPR documents, and results of prior NRC triennial fire protection inspections. Section 71111.05-05 of the IP specifies a minimum sample size of three FAs. Detailed inspection of these three FAs fulfills the procedure completion criteria. The three areas chosen were:

FA 6, Unit 1 480V Shutdown Board Room 1A, Unit 1 Reactor Building 621 ft elevation

FA 16, Unit 3 Mechanical Equipment Room, Control Building 606 ft elevation

FA 18, Unit 2 Battery and Battery Board Room, Control Building 593 ft elevation The team evaluated the licensees fire protection program against applicable NRC requirements for each FA selected. The documents reviewed by the team are listed in the Attachment.

.01 Shutdown from the Main Control Room (MCR)

a. Inspection Scope

Methodology The team reviewed the licensees post-fire safe shutdown analysis (SSA) described in their FPR, plant procedures, piping and instrument drawings (P&IDs), electrical drawings, and other supporting documents. The team performed the reviews to verify that hot and cold shutdown could be achieved and maintained from the MCR for postulated fires in FAs 6 and 18.

The team performed plant walkdowns to verify that the licensee had maintained the plant configuration consistent with that described in the Fire Hazards Analysis and the SSA.

The inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring instrumentation, and support system functions. The team reviewed the Enclosure 1 systems and components credited for use during this shutdown method to verify that they would remain free from fire damage.

Operational Implementation The team reviewed the adequacy of procedures utilized for post-fire SSD and performed a walk-through of procedure steps to ensure the implementation and human factors adequacy of the procedures. The team also reviewed selected operator manual actions (OMAs) to verify that the operators could reasonably perform the specific actions within the time required to maintain plant parameters within specified limits.

The team reviewed cable routing data for a sample of SSI components to determine if the power and/or control circuits for the SSI components could be potentially damaged by a fire in any of the FAs selected. The team reviewed and walked down applicable sections of the following post-fire SSIs for FAs 6 and 18, respectively:

0-SSI-6, "Unit 1, 480V Shutdown Board Room 1A Room," Revision 4

0-SSI-18, "Unit 2 Battery and Battery Board Room," Revision 4 The team reviewed the SSI OMAs to verify that operators could implement the OMAs in accordance with the above SSIs in the times specified to support their post-fire SSD method.

b. Findings

Findings of significance are discussed in Sections 4OA5.02, 4OA5.03, and 4OA5.04 of this inspection report (IR).

.02 Protection of Safe Shutdown Capabilities

a. Inspection Scope

Through a combination of licensing basis information review and in-plant inspection, the team ascertained whether the plant layout and the fire prevention and protection features in place to protect the SSD capability satisfied the requirements of 10 CFR Part 50, Appendix R, Section III.G.

b. Findings

Findings of significance are discussed in Sections 4OA5.02 and 4OA5.03 of this IR.

.03 Passive Fire Protection

a. Inspection Scope

For the selected FAs, the team evaluated the adequacy of fire barrier walls, ceilings, floors, mechanical and electrical penetration seals, fire doors, and fire dampers. The team compared the installed configurations to the approved construction details, and supporting fire endurance test data, which established the ratings of fire barriers. In addition, the team reviewed licensing basis documentation, such as NRC Safety Enclosure 1 Evaluation Reports (SERs) and deviations from the FPR, to verify that passive fire protection features met license commitments.

The team walked down accessible portions of the selected FAs to observe material condition and the design adequacy of FA boundaries to assess if they were appropriate for the fire hazards in the area. The team reviewed the installation, repair, and qualification records for a sample of penetration seals to ensure the seal material was of the appropriate fire rating. Additionally, the team reviewed as-built configurations to verify they met the engineering design, standard industry practices, and were either properly evaluated or qualified by appropriate fire endurance tests. In addition, a sample of completed surveillance and maintenance procedures for selected fire doors, fire dampers, and penetration seals were reviewed to ensure that these passive fire barrier features were properly inspected and maintained. The fire protection features included in the review are listed in the Attachment.

b. Findings

No findings of significance were identified.

.04 Active Fire Protection

a. Inspection Scope

The team performed in-plant observations of fire detection and suppression systems protecting the FAs selected for review, reviewed design documents, and reviewed applicable National Fire Protection Association (NFPA) codes and standards, to assess the material condition and operational lineup of fire detection and suppression systems.

The appropriateness of detection and suppression methods for the category of fire hazards in the various areas was reviewed.

The team reviewed the fire detection and suppression surveillance instructions as well as the most recently completed surveillance tests for each of the three selected FAs. The team reviewed the fire protection water supply system and operational valve lineups associated with the three electric motor-driven fire pumps and the diesel engine-driven fire pump.

The team reviewed the fire detection system protecting the selected FAs to assess the adequacy of the design and installation. The team also reviewed license documentation, such as NRC SERs and deviations from the FPR, to verify that active fire protection features met license commitments. The inspectors walked down the fire detection and alarm systems in the selected FAs to evaluate the appropriateness of detection methods for the category of fire hazards in the areas relative to the location requirements specified in NFPA 72E, Standard on Automatic Fire Detectors, 1974 Edition.

The team evaluated fire hose and standpipe systems from source to discharge device, including code compliance calculations performed by the licensee, to verify adequate flow, pressure, and water distribution met NFPA 14, Standard for the Installation of Standpipe and Hose Systems. During plant tours, the team observed placement of the Enclosure 1 fire hoses and extinguishers to verify they were not blocked and were consistent with fire fighting pre-plan strategies and fire protection program documents.

The team reviewed the design, installation, and testing of the pre-action water sprinkler suppression systems in the selected FAs to evaluate compliance with NFPA 13, Installation of Sprinkler Systems.

The team reviewed the fire brigade staging and dress-out areas to assess the operational readiness of fire fighting and smoke control equipment. The fire brigade personal protective equipment, self-contained breathing apparatuses (SCBAs) and SCBA cylinder refill capability were reviewed for adequacy and functionality. The team also reviewed operator and fire brigade staffing, fire brigade response reports, offsite fire department communications and staging procedures, fire fighting pre-plan strategies, fire brigade qualification training, and the fire brigade drill program procedures. Fire brigade response-to-drill scenarios and associated brigade drill evaluations/critiques performed over the last 12 months for, or in the vicinity of, the selected FAs were reviewed.

The team reviewed the fire fighting pre-plan strategies for the selected FAs and fire response procedures to verify that pertinent information was provided to fire brigade members to identify potential effects to plant and personnel safety, and to facilitate suppression of an exposure fire that could impact SSD capability. The team walked down the selected FAs to compare the associated fire fighting pre-plan strategy drawings with as-built plant conditions and fire response procedures. This was done to verify that fire fighting pre-plan strategies and drawings were consistent with the fire protection features and potential fire conditions described in the fire hazards analysis. The team also evaluated whether the fire response procedures and fire fighting pre-plan strategies for the selected FAs could be implemented as intended. The documents included in the reviews are listed in the Attachment.

b. Findings

No findings of significance were identified.

.05 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed document reviews for heating, ventilation, and air conditioning system drawings, configuration drawings for electrical raceways and SSD components, building drain system drawings, and conducted in-plant walkdowns to verify that redundant trains of systems required for hot shutdown, where located in the same FA, were not subject to damage from fire suppression activities, or from the rupture or inadvertent operation of fire suppression systems. The team considered the effects of water, drainage, heat, hot gasses, and smoke that could potentially damage all redundant SSD trains, inhibit access to alternate shutdown equipment or inhibit performance of dedicated SSD operator actions.

b. Findings

No findings of significance were identified. Enclosure 1

.06 Alternative Shutdown Capability

a. Inspection Scope

Methodology The team reviewed the SSA, operating instructions, P&IDs, electrical drawings, the FPR, and other supporting documents to determine whether hot and cold shutdown could be achieved and maintained from outside the control room for fires that required evacuation of the MCR, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration remained consistent with the description contained in the post-fire SSD and fire hazards analyses.

The team focused on the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also reviewed selected SSIs to verify that the systems and components credited for post-fire SSD would remain free from fire damage. Additionally, the team verified that the transfer of control from the MCR to the alternative shutdown location would not be affected by fire-induced circuit faults. The team reviewed control circuit drawings to verify that control circuits for equipment credited for post-fire SSD outside the MCR incorporated transfer/isolation switches or otherwise had a design which made them independent from the MCR. A sample of various types of equipment control circuits reviewed to verify independence from the MCR included 4.16 kV circuit breakers, motor-operated valves, solenoid controlled valves, and instrumentation.

Operational Implementation The team verified that the licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform post-fire SSD actions were trained and available onsite at all times, exclusive of those assigned as fire brigade members.

The team performed a timed walk-through of the post-fire SSD procedure with licensed and non-licensed operators to determine the adequacy of the procedure and to evaluate their ability to implement the procedure. The team evaluated whether the operators could reasonably perform specific actions within the time required to maintain plant parameters within specified limits. Time-critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal. The licensee implemented their alternative shutdown in accordance with Procedure 0-SSI-16, Control Building Fire EL 593 Through EL 617, Revision 7.

The team reviewed the time-critical OMAs, identified by the licensee, needed to support alternative shutdown from outside the MCR, including the calculations and analyses that provided the bases for these critical times. The review compared the simulated completion times recorded during the procedure walk-through to the analytical values to verify that the operators could implement the procedure as intended. Enclosure 1 The team reviewed the results of the latest surveillance tests performed on transfer/isolation switches relied on to ensure that alternative shutdown systems were independent of the MCR. Equipment in this review included residual heat removal service water pumps, main steam relief valves and the backup control panel. The testing was performed to satisfy Technical Specification 3.3.3.2.1.

b. Findings

Findings of significance are discussed in Section 4OA5.04 of this IR.

.07 Circuit Analyses

a. Inspection Scope

In accordance with IP 71111.05TTP, this segment has been suspended for plants in transition to NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition. However, to support this inspection, a limited scope review of a select sample of SSD components credited in the SSIs was conducted to verify that the existing fire response procedures were adequate for a postulated fire in any of the selected FAs. The cables examined were based upon a list of SSD components selected by the team. The specific components reviewed are listed in the Attachment.

b. Findings

No findings of significance were identified.

.08 Communications

a. Inspection Scope

The team reviewed plant communication capabilities to evaluate the availability of the communication systems to support plant personnel in the performance of OMAs to achieve and maintain SSD conditions. During this review, the team considered the effects of ambient noise levels, clarity of reception, and reliability. The team also reviewed the communications available at different locations. Both fixed and portable communication systems were reviewed for the impact of fire damage in the selected FAs. The team performed a review to verify the availability of the portable radios for use during the SSD procedures. In addition, the team reviewed the radio battery usage ratings for the radios stored and maintained on charging stations for operator use while performing the SSD procedures. The team also reviewed preventative maintenance and surveillance test records to verify that the communication equipment was being properly maintained.

The team reviewed the plant communications systems that would be relied upon to support fire event notification and fire brigade fire fighting activities to verify their availability. The team also reviewed selected fire brigade drill evaluation/critique reports to assess proper operation and effectiveness of the fire brigade command post portable radio communications during fire drills and to identify any history of operational or performance problems with radio communications during fire drills. Enclosure 1

b. Findings

No findings of significance were identified.

.09 Emergency Lighting

a. Inspection Scope

The team performed plant walkdowns of selected FAs to observe the placement and coverage area of credited, fixed eight-hour battery pack emergency lighting units (ELUs).

The ELUs were evaluated to assess their adequacy for illuminating access and egress pathways and any equipment requiring local operation and/or instrumentation monitoring for post-fire SSD. The team also reviewed the battery power supplies to verify they were rated for at least an eight-hour capacity. The team reviewed maintenance and design aspects of the ELUs required by 10 CFR Part 50, Appendix R, Section III.J, Emergency Lighting. The team reviewed preventive maintenance procedures and completed surveillance tests to verify that adequate surveillance testing and periodic battery replacements were in place to ensure reliable ELU operation. The team reviewed vendor manuals to ensure that the emergency lights were being maintained consistent with the manufacturers recommendations. Based upon plant walkdowns, the team requested that the licensee perform ELU tests in 4 kV Electric Board Rooms 1A and 2A to demonstrate that sufficient illumination existed to manipulate plant components.

b. Findings

Introduction.

The team identified a Green non-cited violation (NCV) of Browns Ferry Units 1, 2, and 3, Operating License Conditions 2.C (13), 2.C (14), and 2.C (7),respectively, for the licensees failure to establish measures to identify and correct the excessive number of Appendix R ELU failures. Specifically, ELU failures were not being entered in the corrective action program (CAP) with problem evaluation reports (PERs)in order to evaluate and resolve why many of the ELU failures occurred prior to reaching their 6-year replacement date. Additionally, the FPR surveillance requirement to replace the Appendix R ELU batteries and lamp heads every six years was not being adequately implemented, in that, licensee data revealed that several installed ELUs were beyond their 6-year replacement date.

Description.

The licensees FPR credited the use of self-contained, eight-hour, battery powered ELUs during the performance of post-fire SSD procedures. The FPR Volume 1, Part 1, Section 9.3.11.I, described the limiting condition for operation and surveillance requirements for fire protection systems and listed ELUs as being subjected to periodic inspections and testing. All ELUs listed in the FPR were required to support unit shutdown in the event of a fire and a coincident loss of normal lighting. The surveillance requirements were as follows:

Check the ELUs operable status at least once per quarter

Perform an eight-hour discharge test to verify adequate battery condition at least once per refueling cycle (not to exceed 18 months)

Replace the batteries and lamp heads every six years (the licensee achieves compliance by replacing the entire ELU) Enclosure 1 The team reviewed maintenance, testing and replacement records for the Appendix R emergency lighting system. The licensee provided completed periodic surveillance records for the quarterly operability check and the 18 month eight-hour battery discharge test. These records showed that on average, the ELU failures were approximately 10-13 percent per surveillance cycle. The team noted that ELUs that failed surveillance tests were either replaced (by work order) or compensatory measures were initiated. The team inquired further into the condition of the emergency lighting system and found that ELU failures were not being entered in the CAP as problem evaluation reports (PERs) in order to evaluate and resolve why many of the ELU failures occurred prior to reaching their 6-year replacement date. Additionally, the team found that the FPR surveillance requirement to replace the emergency light batteries and lamp heads every six years was not being adequately implemented and did not occur on a consistent frequency.

The replacement program relied on a single individual to manually search through work orders and installation records for more than 400 ELUs to determine which lights were approaching the 6-year replacement due date. In response to the teams inquiry, the licensee initiated an investigation into the emergency lighting system programmatic weaknesses. The licensees preliminary results revealed that there were several ELUs currently installed that were beyond their 6-year replacement period and that many of the ELUs were failing prior to reaching the 6-year replacement date. These results called into question the adequacy of the 6-year replacement cycle. The licensee initiated PERs 203482, 204375, and 204435 to implement corrective actions to address these issues.

Subsequent to NRC onsite inspection efforts, the licensee notified the team that they had developed a comprehensive corrective action plan to address the emergency lighting concerns. The licensee performed a detailed analysis of failure data and history of the lighting system dating back to 2003, and identified numerous opportunities to improve the reliability of the ELUs. One example that the licensee identified was the use of initial battery voltage as an acceptable method of periodically checking the condition of the battery. The most significant action was the revision of the 6-year replacement interval with a 4.25 year replacement interval. The licensee anticipated that this revision would reduce the failures to one percent per replacement cycle. In addition to changing the replacement interval, a condition check of the population of lighting units that were near term or past the new replacement interval was performed. The licensee was in the process of replacing all units that had exceeded the 4.25 year replacement interval.

Analysis.

The licensees failure to establish measures to ensure that conditions adverse to fire protection were promptly corrected, as required by the FPR, was a performance deficiency which was within the licensees ability to foresee and correct. The finding was more than minor because it is associated with the reactor safety, mitigating systems, cornerstone attribute of protection against external factors (i.e., fire); and, the ELU failures affect the objective of ensuring the reliability and capability of OMAs during response to initiating events. Using IMC 0609, Appendix F, Fire Protection Significance Determination Process, Attachment 1, Phase 1 Worksheets, the team determined that this finding was in the Post-fire SSD category. The team determined that this finding was of very low safety significance (Green) because the operators had a high likelihood of completing the SSD tasks using flashlights. The cause of this finding had a cross-cutting aspect in the Work Control component of the Human Performance area, in that it was directly related to the licensee not planning and coordinating work activities to Enclosure 1 support long-term equipment reliability and their maintenance scheduling was more reactive than preventive (H.3 (b)).

Enforcement.

Browns Ferry Operating License Conditions 2.C

(13) 2.C (14), and 2.C (7)for Units 1, 2, and 3, respectively, state that the licensee shall implement and maintain in effect all provisions of the approved Fire Protection Program, as described in the FSAR for Browns Ferry, and as approved in the safety evaluations dated December 8, 1988; March 31, 1993; April 1, 1993; November 2, 1995; April 25, 2007; and Supplement dated November 3, 1989. The FSAR Section 10.11, Fire Protection Systems, states that the FPR Volume 1 is the licensing basis for the Browns Ferry fire protection program. The FPR Volume 1, Part 1, Fire Protection Plan, Section 3.8.h, requires that measures be established to ensure that conditions adverse to fire protection, such as failures and deficiencies, are promptly identified, reported, and corrected. Additionally, the fire protection program surveillance requirements for ELUs (FPR Volume 1, Part 1, Section 9.3.11.I/9.4.11.I), requires replacement of the batteries and lamp heads every six years.

Contrary to the above, as of October 9, 2009, the licensee had not established measures to identify and correct the excessive number of Appendix R ELU failures. Specifically, ELU failures were not being entered in the CAP with PERs in order to evaluate and resolve why many of the ELU failures occurred prior to reaching their 6-year replacement date. Additionally, the FPR surveillance requirement to replace the Appendix R ELU batteries and lamp heads every six years was not being adequately implemented, in that, licensee data revealed that several ELUs installed at the time of this inspection were beyond their 6-year replacement date. Because this violation was of very low safety significance (Green) and it was entered into the licensees CAP (PERs 203482, 204375, and 204435), this violation is being treated as an NCV, consistent with the NRC Enforcement Policy. This finding is identified as NCV 05000259, 260, 296/2009009-01, Deficiencies with Emergency Lighting Units.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed the need for cold shutdown repairs, and determined that the licensee did not take credit for any cold shutdown repairs.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

Out-of-Service Equipment The team verified that compensatory measures were in place for out-of-service, degraded or inoperable fire protection and post-fire SSD equipment, systems, or features (e.g. detection and suppression systems and equipment, passive fire barriers, or pumps, valves or electrical devices providing SSD functions or capabilities). The Enclosure 1 team also verified that the short-term compensatory measures adequately compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

Manual ActionsSection III.G.2 of Appendix R to Part 50 establishes a combination of physical barriers, spatial separation, fire detection and automatic suppression systems to ensure that redundant trains of post-fire SSD equipment located within the same FA is free of fire damage. The Browns Ferry post-fire SSD methodology included the use of OMAs in lieu of complying with the requirements of 10 CFR Part 50, Appendix R, Section III.G.2.

These OMAs are considered by the licensee to be compensatory measures until they can restore compliance with NRC regulations. On March 4, 2009, the licensee committed by letter to transition their fire protection licensing basis to NFPA 805, in accordance with 10 CFR 50.48(c). The NRC published guidance in the Federal Register (71 FR 11169), dated March 6, 2006, which stated that OMAs are acceptable as compensatory measures (as long as the OMAs are feasible) during the period of reanalysis and transition to NFPA 805.

The team used the guidance in IP 71111.05TTP, Enclosure 2, to assess whether the licensee had established feasible OMAs as compensatory measures. The team reviewed the following procedures for FAs 6, 16 and 18, respectively:

0-SSI-6, "Unit 1, 480V Shutdown Board Room 1A Room," Revision 4

0-SSI-16, "Control Building Fire EL 593 Through EL 617," Revisions 6 and 7

0-SSI-18, "Unit 2 Battery and Battery Board Room," Revision 4 The team conducted walkthroughs of the OMAs associated with the above FAs with qualified plant operators to verify that the operators could perform all actions using the current plant procedures. The team also conducted a tabletop walkthrough of the above-listed procedures with operators to review the interaction between the fire emergency procedures and the other procedures, which they would use during a plant shutdown following a fire.

b. Findings

Introduction.

The team identified a Green NCV of Browns Ferry Operating License Conditions 2.C (13), 2.C

(14) and 2.C (7), for Units 1, 2, and 3, respectively, for the licensees failure to establish adequate compensatory measures for an out-of-service hose station in accordance with the approved fire protection program. Specifically, the staged additional lengths of hose connected to the closest in-service hose station, established as a compensatory measure, did not provide equal or better protection than the out-of-service hose station it was replacing.

Description.

The licensee implemented Fire Protection Impairment Permit (FPIP) 09-2167 for out-of-service Hose Station 2-26-1076 in the Unit 2 control bay on Elevation 593 ft. The compensatory measure consisted of an adjustable fire hose nozzle and 200 feet of 1 1/2-inch diameter rubber-lined hose attached with a gated wye to in-service Hose Station 3-26-1076 supply valve in the Unit 3 control bay on the common hallway for all Enclosure 1 three units. During a plant walkdown, the team observed this compensatory measure in place several days after it had been implemented. The team determined from analysis that the 200 feet of fire hose provided for this FPIP was not long enough to cover the area of the out-of-service hose station, specifically FA 18 (one of the selected FAs). The FPR Volume 1, Part 1, Section 9.2, Fire Protection Systems/Bases, requires that the compensatory actions provide equal or better protection. The FPR Volume 1, Section 9.3.11.E, Fire Hose Stations, stated that the second outlet of the gated wye shall be connected to a maximum of 300 feet of hose to provide coverage for the area left unprotected by the inoperable hose station. A pressure loss calculation using the flow data from the most recently performed hose station surveillance test, 0-SI-4.11.E.1.b(1),

Fire Hose Station Operability/Flow Test, Revision 8, completed September 28, 2007, indicated that Hose Station 3-26-1076 had insufficient flow capacity to support the staged 200 feet of 1 1/2-inch diameter hose with an effective fire fighting hose stream.

The team noted that there was no fire protection impairment program requirement to document the length or diameter of fire hose staged for individual compensatory measures. The team also determined that the methodology used to determine the guidance for the maximum compensatory hose length in the FPR was not correct.

Calculation MDQ002620080029 (RIMS R14 081121 102), Revision 0, Determine Maximum Compensatory Hose Length for Inoperable Hose Station, dated November 21, 2008, used static pressure instead of residual pressure at the supply valve to determine maximum hose length, resulting in a non-conservative maximum allowable hose length in the FPR. The calculation permitted up to 300 feet of 1 1/2-inch diameter rubber-lined fire hose for a compensatory measure. However, in this particular case the water supply was not sufficient to support even 200 feet of 1 1/2-inch diameter hose. The team determined that the staged additional lengths of hose connected to the closest in-service hose station, established as a compensatory measure, did not provide equal or better protection than the out-of-service hose station it was replacing.

During further review of this issue, the team determined that although FPIP 09-2167 had been implemented for Hose Station 2-26-1076, the hose station was still functional at the time this issue was identified because the water supply to the hose station had not been physically isolated. However, the team concluded the fire brigade would have experienced delays in initiating manual fire suppression for a fire in FA 18 because of:

1) the inadequate compensatory Hose Station 3-26-1076; and 2) the likely fire brigade delay in using Hose Station 2-26-1076 due to the out-of-service placard attached to it.

The team determined that FA 18 had a manual sprinkler system which could have been actuated to control the fire until the fire brigade could take appropriate actions to initiate manual fire suppression to extinguish the fire. In response to this finding, the licensee initiated PER 204014, removed FPIP 09-2167 on October 7, 2009, and restored Hose Station 2-26-1076 to service. The licensee initiated corrective actions on October 8, 2009, to review all existing FPIPs for similar problems.

Analysis.

The licensees failure to provide compensatory measures of equal or better protection for an out-of-service hose station is a performance deficiency because it did not meet the requirements of the approved fire protection program, and was within the licensees ability to foresee and correct. The finding was more than minor because it affected the protection against external factors attribute of the mitigating systems cornerstone, in that it impacted manual fire suppression (i.e., fire brigade) capability and affected the cornerstone objective of ensuring the availability of systems that respond to initiating events. Since IMC 0609, Appendix F, Fire Protection Significance Enclosure 1 Determination Process, does not provide guidance for assigning a degradation rating to manual fire suppression, this determination was made using qualitative methods which received NRC management review as provided for in IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. This finding was determined to be of very low safety significance (Green) because the team concluded that it represented a low degradation of the manual fire suppression function. Although the FPIP 09-2167 had been implemented for out-of-service Hose Station 2-26-1076, the hose station was still functional at the time this issue was identified, because the water supply to the hose station had not been physically isolated. However, the team concluded that the fire brigade would have experienced delays in initiating manual fire suppression for a fire in FA 18 because of: 1) the inadequate compensatory hose station 3-26-1076; and 2) the likely fire brigade delay in using the out-of-service hose station 2-26-1076 due to an out-of-service placard attached to it. The team determined that FA 18 had a manual sprinkler system which could have been actuated to control the fire until the fire brigade could take appropriate actions to initiate manual fire suppression to extinguish the fire. The cause of this finding has a cross-cutting aspect in the Work Control component of the Human Performance area, in that it was directly related to the licensee not planning and coordinating work activities to ensure that adequate compensatory actions were established for the out-of-service hose station (H.3 (a)).

Enforcement.

Browns Ferry Units 1, 2, and 3 Operating License Condition 2.C (13), 2.C (14), and 2.C (7), respectively, requires that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the FSAR for Browns Ferry as approved in the safety evaluations dated December 8, 1988; March 31, 1993; April 1, 1993; November 2, 1995; April 25, 2007, and Supplement dated November 3, 1989. The FSAR Section 10.11, Fire Protection Systems, states that Volume 1 of the FPR is the licensing basis for the Browns Ferry fire protection program.

The FPR, Volume 1, Part 1, Section 9.2, Fire Protection Systems/Bases, and Section 9.3.11.E, Fire Hose Stations, states that the compensatory measures for an out-of-service hose station were required to provide equal or better protection.

Contrary to the above, the licensee failed to provide compensatory measures of equal or better protection for out-of-service Hose Station 2-26-1076, beginning on September 19, 2009, in accordance with the Fire Protection Report, Volume 1, Part 1, Section 9.2 and Section 9.3.11.E. Specifically, the 200 feet of fire hose provided for FPIP 09-2167 was not long enough to cover the area of the out-of-service hose station (FA 18).

Furthermore, the hose station had insufficient flow capacity to support the staged 200 feet of 1 1/2-inch diameter hose with an effective fire fighting hose stream. Fire Protection Impairment Permit 09-2167 was removed on October 7, 2009, and Hose Station 2-26-1076 was restored to service. The licensee took immediate corrective action on October 8, 2009, to review all existing FPIPs for similar problems. Because this finding was of very low safety significance (Green), and was entered into the licensees CAP as PER 204014, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy and is identified as NCV 05000259, 260, 296/2009009-02, Failure to Establish Adequate Compensatory Measures for an Out-of-Service Hose Station. Enclosure

OTHER ACTIVITIES

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The team verified that the licensee identified fire protection and post-fire SSD issues at an appropriate threshold and entered them into the corrective action program. The team also reviewed a sample of selected issues to verify that the licensee had taken or planned appropriate corrective actions. The team selected the corrective action documents by sampling the items that the licensee had issued since the last triennial fire protection inspection.

b. Findings

Findings of significance are discussed in Section 1R05.09.b of this IR. Additionally, the apparent violations (AVs) discussed in Sections 4OA5.02 and 4OA5.03 involve cross-cutting aspects related to corrective action.

4OA3 Event Follow-up

(Discussed) Licensee Event Report (LER) 50-259/2009-005, Common Accident Logic Not Evaluated for Appendix R Event, Rev. 0 and Rev. 1 The licensee described a condition in Revision 0 of the subject LER (dated October 20, 2009) where reactor vessel water level would reach Level 1 during SSD evolutions which involved rapid depressurization of the reactor vessel. During an operator training exercise on July 23, 2009, for FA 9 (Procedure 0-SSI-9), Unit 2, Reactor Building Fire 4 kV Electric Board Room 2A, electrical alignments were established in the simulator.

Reactor vessel water level reached Level 1 during the simulator exercise and initiated a common accident signal which resulted in the tripping of certain 4.16 kV circuit breakers.

This required the operators to reestablish some of the Appendix R system alignments specified in Procedure 0-SSI-9. The actions necessary to reestablish the Appendix R alignments were not included in Procedure 0-SSI-9. The licensee concluded on August 21, 2009, that a condition of non-compliance with the Appendix R program existed, which was applicable to multiple FAs and had an adverse effect on SSD. The licensee initiated compensatory measures in September 2009 until procedure revisions and a permanent resolution for this issue could be implemented. The compensatory measures included establishing additional OMAs to inhibit accident logic after SSI entry. The licensee added one additional auxiliary unit operator to the minimum shift manning to support the additional OMAs. The team reviewed the OMAs to verify that they met the feasibility criteria described in Enclosure 2 of IP 71111.05TTP. Revision 1 of the LER (dated November 3, 2009) stated that, upon further evaluation, Level 1 would not be reached during SSD evolutions. The licensee performed plant simulator demonstrations, described in Revision 1 of the LER, which showed that the condensate system would provide enough makeup water to the reactor vessel to prevent reaching Level 1 after depressurization. This LER remains open pending further NRC review of all aspects related to this LER. Enclosure 1

4OA5 Other Activities

.01 (Closed) Unresolved Item 05000260, 296/2006004-03, Incomplete and Unfeasible

Compensatory Measures for Ensuring RHR Pump NPSH During Appendix R Events

a. Inspection Scope

In July of 2006, as a result of a re-evaluation of an Appendix R postulated event, the licensee identified that in order to have sufficient net positive suction head (NPSH) to the residual heat removal (RHR) pumps, all ten drywell coolers must be secured and de-energized within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after the start of the event. The licensee initiated PER 107105 and implemented operator work-arounds (OWAs) as compensatory measures to address this issue. The NRC resident inspectors noted that the OWAs directed 8 of 10 drywell coolers to be secured and de-energized within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months versus all ten drywell coolers to be secured and de-energized within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , as stated in the Appendix R re-evaluation. The inspectors concluded that the OWAs did not adequately implement the Appendix R re-evaluation. Furthermore, the inspectors questioned the licensees ability to secure and de-energize all drywell coolers within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , as these actions would require the auxiliary operator to open ten 480V AC breakers, located in five different fire areas within two hours. Although two hours was more than sufficient time under normal circumstances to locate and open these breakers, the operators path could require him to traverse through fire-affected areas or even require operating breakers in a fire-affected area. Upon identification by the NRC, the licensee entered this item into their corrective action program as PER 109516. In August of 2006, the licensee revised the OWAs to secure cooling water to all drywell coolers within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of the start of the event. The licensee revised all applicable SSIs in October of 2006, to incorporate OMAs to secure cooling water to the drywell coolers, thus eliminating the need for the OWAs.

The NRC opened a URI to obtain additional information from the licensee to fully assess the enforcement implications and safety significance of this issue. The triennial fire protection inspection team reviewed additional information provided by the licensee in order to close this URI.

b. Findings

During this triennial fire protection inspection, the team reviewed the licensees submittal to the NRC dated May 9, 2009, Browns Ferry Nuclear Plant (BFN) - Units 1, 2, and 3 -

Technical Specifications (TS) Changes TS-431 and TS-418 - Extended Power Uprate (EPU) - Results of Revised Containment Overpressure (COP) Analyses for Appendix R

- Drywell Coolers Operating (TAC Nos. MD5262, MD5263, and MD5264). This submittal provided the results of an additional Appendix R licensing basis calculation for a condition in which drywell cooling remained in service throughout the Appendix R fire event. The licensees revised analysis showed that with drywell cooling in service, the minimum containment pressure met that needed to support NPSH requirements for RHR pump operation. The submittal further stated that although drywell cooling did not need to be secured to ensure adequate COP, TVA planned to continue to secure drywell cooling in the Browns Ferry Appendix R SSIs to provide additional COP margin. The team noted that a revision to the SSIs was in progress at the time of this triennial fire protection inspection, to move the actions to secure drywell cooling from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from the start of an Appendix R fire event. No new findings were identified during the teams review. Enclosure 1 This finding constitutes a violation of Browns Ferry Units 2 and 3 Operating License Conditions 2.C

(14) and 2.C (7), respectively, for the licensee's failure to implement and maintain in effect all provisions of their NRC-approved fire protection program. The NRC-approved fire protection program requires that the licensee promptly identify and correct conditions adverse to fire protection. In 2006, the licensee failed to implement adequate compensatory measures (OWAs) to address a condition adverse to fire protection, in that the OWAs did not implement the requirements of the Appendix R re-evaluation. Upon identification by the NRC, the licensee revised the OWAs and later (October 2006) revised the SSIs to incorporate OMAs, thus eliminating the OWAs. In 2009, the licensee performed an Appendix R licensing basis calculation in which they concluded that OMAs to secure cooling water to the drywell coolers in the SSIs were not required. This violation is of minor significance, which is not subject to enforcement action in accordance with Section IV of the NRC Enforcement Policy. Unresolved Item 05000260, 296/2006004-03 is closed.

.02 (Closed) URI 05000259/2006012-01, Feasibility and Reliability of Local Manual Operator

Actions to Achieve Safe Shutdown (Closed) URI 05000260, 296/2006014-03, Unapproved Local Manual Operator Actions in Lieu of Cable Protection for a FA Subject to the Requirements of Appendix R Section III.G.2

a. Inspection Scope

During inspections in 2006 (IR 05000259/2006012 and IR 05000259/2006016 for Unit 1; and, triennial fire protection IR 05000260, 296/2006014 for Units 2 and 3), the NRC documented that cables and equipment of redundant SSD trains located in the same FAs/fire zones (FZs) had not been protected from potential fire damage by one of the methods specified in 10 CFR Part 50, Appendix R, Section III.G.2. Examples of this issue applied to FAs/FZs 1-1, 1-4, 1-5, 2-5, and 25. The NRC concluded that the lack of cable protection could result in de-energizing or losing remote control over SSD equipment such as emergency diesel generators, shutdown board feeder breakers, RHR pumps, RHR service water pumps, battery chargers, ventilation equipment and valves important to achieving and/or maintaining hot shutdown conditions. In lieu of meeting Appendix R,Section III.G.2, the licensee relied on OMAs outside the MCR to recover from these potential adverse effects. Federal Register Notice dated March 6, 2006 (71 FR 11169) withdrew proposed rulemaking related to OMAs, and stated that, for cases involving feasible manual actions, licensees would be eligible for enforcement discretion if they initiated corrective actions within six months of the issue date of the notice and completed all corrective actions within three years (i.e., by March 6, 2009). The licensee initiated PER 101631 in April 2006 to enter the OMAs used in lieu of meeting Appendix R,Section III.G.2 into their CAP. Inspection Report 05000260, 296/2006014 stated that the licensee planned to either submit exemption requests to 10 CFR Part 50, Appendix R, for any unapproved OMAs or implement modifications to eliminate the need for the OMAs. The IR further stated that existing URI 05000259/2006012-001 was opened to monitor OMA resolution for Unit 1, and URI 05000260, 296/2006014-03 was opened to monitor resolution of the OMA issue and determine whether enforcement discretion could be applied for Units 2 and 3. During this 2009 triennial fire protection inspection, the team reviewed the corrective actions taken by the licensee and other related information to assess the adequacy of the actions to address these URIs. Enclosure 1

b. Findings

Introduction.

The team identified an AV of 10 CFR Part 50, Appendix R, Section III.G.2, for the licensees failure to protect one of the redundant trains of cables and equipment, located in the same FA, needed to achieve post-fire SSD from fire damage for multiple fire areas on each unit. The licensee had not protected the cables by one of the methods specified in Appendix R,Section III.G.2 (i.e., use of spatial separation, passive fire barriers, and fire detection and an automatic fire suppression system). Instead, the licensee relied on OMAs outside the MCRs, in lieu of protecting the cables and equipment, to achieve post-fire SSD. The licensee had not received prior NRC approval in the form of an exemption from the applicable requirements of Appendix R for use of OMAs. This AV resulted from review and closure of the two URIs which were opened in 2006 to monitor the licensees resolution of the OMA issue.

Description.

On January 27, 2009, TVA submitted a request to exempt Browns Ferry from the requirements of 10 CFR 50, Appendix R, Section III.G.2, to allow the use of numerous OMAs in lieu of protecting the cables and equipment by one of the methods described in Appendix R,Section III.G.2. This exemption request was submitted for existing identified non-compliances. The NRC Office of Nuclear Reactor Regulation (NRR) staff determined that the information in the exemption request was not sufficient to begin the review. The application did not provide sufficient information to demonstrate that the special circumstances in 10 CFR 50.12, Specific Exemptions, existed for the exemption request in that 1) the underlying purpose of the rule to ensure defense in depth for fire areas important to safety was not met, and 2) compliance with the rule did not constitute undue hardship because the rulemaking considered the burden of compliance when it was backfit upon the pre-1979 plants. The staff discussed the results of its acceptance review in a phone call with TVA management on February 26, 2009, with subsequent calls on February 27, and March 3, 2009. In separate letters dated March 4, 2009, TVA withdrew the exemption request and submitted a letter of intent to transition the Browns Ferry fire protection licensing basis to the NFPA 805 in accordance with 10 CFR, Part 50.48(c). The team concluded that the licensee did not complete corrective actions to restore compliance with the requirements of 10 CFR Part 50, Appendix R, Section III.G.2 by March 6, 2009.

The team noted that the licensee had implemented additional corrective actions in March 2009, following the withdrawal of their exemption request. The licensee re-reviewed some of the time-critical OMAs (60 minutes or less) and entered them in the CAP as a nonconformance to 10 CFR Part 50, Appendix R, Section III.G.2, (PER 165288). The licensee performed an operability evaluation of these time-critical OMAs in accordance with the guidance in NRC Regulatory Issue Summary (RIS) 2005-20, Rev.1, Operability Determinations & Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety. The licensee posted hourly roving fire watches (which were in addition to the OMAs being credited as compensatory measures) to address the existing non-compliances. Subsequent to the onsite inspection, the licensee evaluated the most critical OMAs, and revised selected SSIs to include steps for independent confirmation of the OMAs in order to improve the likelihood of success of these steps, and reduce the risk associated with this finding. Enclosure 1 The team reviewed this finding against NRC enforcement guidance documents to determine if enforcement discretion was applicable. The team determined that enforcement discretion was not applicable to this finding based on the following reasons:

Browns Ferry did not meet the criteria published in the Federal Register (71 FR 11169), which withdrew OMA rulemaking March 6, 2006. This notice provided enforcement discretion for three years, ending March 6, 2009, to allow completion of corrective actions.

Browns Ferry did not meet the criteria published in the Federal Register 70 FR 2662, which provides interim enforcement discretion to licensees for certain fire protection issues. Specifically, licensees who submitted their letter of intent by December 31, 2005, to transition their fire protection licensing bases to NFPA 805 may receive enforcement discretion for existing identified non-compliances. Browns Ferry submitted its letter of intent on March 4, 2009.

Analysis.

Failure to protect one train of cables and equipment necessary to achieve post-fire SSD from fire damage for fire areas designated in the FPR as meeting Appendix R,Section III.G.2, is a performance deficiency. This finding is more than minor because it is associated with the reactor safety mitigating system cornerstone attribute of protection against external events (i.e., fire). Failure to protect safe shutdown cables and equipment from fire damage affects the reactor safety mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The NRC evaluated this finding in accordance with NRC Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected multiple fire areas for each Browns Ferry unit. The NRC performed a significance determination process (SDP)

Phase 1 screening. Given the likely impact of the risk contribution arising from the assessment of multiple fire areas, the SDP Phase 3 analysis was performed in lieu of the SDP Phase 2 analysis. The results of the Phase 3 analysis indicated that the preliminary significance of this finding is Greater Than Green.

The risk analysis was performed utilizing NRC IMC 0609, Appendix F, as the framework.

Alterations of specific values in IMC 0609 were made using information from NUREG 6850 and approved frequently asked questions (FAQs) from the NFPA 805 process.

Human reliability analysis (HRA) values were calculated using SPAR-H methodology. A significant factor which influenced the results of the risk analysis was the selection and evaluation of those fires that met the entry conditions for using an SSI. Specifically, the analysts determined that entry into the SSIs was determined by the operations shift manager based on the procedure entry conditions that were subject to an individuals judgment. The risk analysis of this performance deficiency was only applicable to fires that warrant entry into the SSIs. In addition, the ramifications of OMA failures on Large Early Release Frequency (LERF) need to be fully understood.

Through a combination of plant walk downs and review of the SSIs, those compartments that contain the ignition sources that could meet the SSI entry conditions were identified.

Within each of the compartments that remained, measurements were taken from the top of the ignition source to the first cable tray to establish whether the cable tray was in the zone of influence (ZOI). These ignition sources were cataloged and given a unique identification number (Fire Number). Using the Plume_Temperature_Calcuations.xls Enclosure 1 spreadsheet from NUREG-1805, and the Temperature/Time to Damage Tables in IMC 0609, Appendix F, Attachment 7, the analysts established the time to cable damage.

Using appropriate consideration associated with solid bottom cable trays and Flammastic cable coating, the analysts determined a final time to cable damage. Based upon the time to cable damage, one minute was subtracted for time for detection, and the manual suppression tables were applied to account for the possibility of manual suppression prior to cable damage. An initiating event frequency for entrance into the SSIs was derived by multiplying (ignition source frequency) x (number of ignition sources) x (severity factor - 1.0 applicable to 75th & 98th percentile fire, 0.9 applicable to 75th percentile fires or 0.1 applicable only to 98th percentile fires) x (probability of automatic non suppression) x (probability of manual non suppression before cable damage or at 10 minutes).

The analysts derived the conditional core damage probability (CCDP) by reviewing the applicable SSI for a particular compartment and assigning a cumulative OMA failure probability for each unit. For each SSI, the OMAs were partitioned into critical and non-critical actions and assigned to the affected unit(s). Failure to perform a critical action would result in a failure of the mitigation strategy. The analysts also considered hot short probability, where appropriate, in designating OMAs as critical for use in calculating the CCDP. A failure probability was assigned to each critical action, using as inputs the actual procedure, plant walk downs by the analysts, and the licensees verification and validation packages for each SSI. The analyst also determined whether there was a dependency between/among the OMAs within a given SSI. Using this information, the analysts generated a table for each SSI that showed each OMA, whether it was critical or non-critical, what unit was applicable to that OMA, whether dependency was used in the human error failure probability derivation, the independent human error failure probability of the OMA, whether failure was provisional upon a hot short and a final human error failure probability. The analysts then summed the OMA failure probabilities in the table on a per unit basis. By multiplying the individual SSI entrance frequency by the CCDP for that SSI for a particular unit, the analyst generated a non-conforming CDF for each unit. For the complete analysis, see Enclosure 2 to this IR.

The team determined that this finding did not present an immediate safety concern because the licensee implemented compensatory measures while long-term corrective actions are being implemented. The compensatory measures included operator manual actions to mitigate or prevent damage to equipment necessary for safe shutdown in the event of a fire. The licensee also implemented fire watches as additional compensatory measures to mitigate the safety hazard. The team reviewed the critical operator manual actions, and concluded that they were feasible, based on inspection activity described in this and previous NRC inspection reports. Subsequent to this onsite inspection, the licensee evaluated the most critical OMAs, and revised selected SSIs to include steps for independent confirmation of operator manual actions in order to improve the likelihood of success of these steps, and reduce the risk associated with this finding.

The cause of this finding has a cross-cutting aspect in the Corrective Action Program component of the Problem Identification and Resolution area, in that the licensee did not take appropriate corrective actions to address the issue in a timely manner, commensurate with the safety significance (P.1.(d)). Enclosure 1

Enforcement.

10 CFR Part 50.48(b)(1) requires that all nuclear power plants licensed to operate prior to January 1, 1979, must satisfy the applicable requirements of 10 CFR Part 50, Appendix R, Section III.G. Appendix R,Section III.G.2, applies to the ability to achieve and maintain hot shutdown from the MCR during a fire. It states, in part, that where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, one of three means of protecting cables to ensure that one of the redundant trains is free of fire damage shall be provided. The three acceptable methods described in Appendix R,Section III.G.2 for maintaining one of the redundant trains in the same fire area free of fire damage are based on the use of physical barriers, spatial separation, and fire detection and an automatic fire suppression system. Appendix R,Section III.G.2, does not allow the use of OMAs in lieu of protection.

Contrary to the above, as of October 9, 2009, the licensee did not meet the requirements of 10 CFR Part 50, Appendix R, Section III.G.2. Specifically, the licensee did not protect the cables of redundant systems or equipment necessary to achieve and/or maintain hot shutdown conditions from the MCR from fire damage by one of the means described in 10 CFR Part 50 Appendix R, Section III.G.2 (i.e., use of spatial separation, passive fire barriers, and fire detection and an automatic fire suppression system). Lack of cable protection could result in de-energizing or losing remote control over post-fire SSD equipment and systems such as emergency diesel generators, electrical distribution system breakers, RHR pumps, RHR service water pumps, battery chargers, ventilation equipment and valves important to achieving and/or maintaining post-fire SSD conditions. Examples of potential fire damage to cables associated with redundant SSD equipment include, but are not limited to, the RHRSW Pump A1, RHR Pump 1A, and LPCI injection valve 1-FCV-74-53 in Fire Area 1/Fire Zone 1-4. Fire Area 1/Fire Zone 1-4 is an Appendix R Section III.G.2 fire area requiring the ability to achieve and maintain hot SSD from the MCR during a fire. This condition applies to Browns Ferry Units 1, 2, and 3, and has existed since the restart of each unit (Unit 2-1991, Unit 3-1995, Unit 1-2007). The licensee entered this finding into their CAP as PER 101631. This finding is identified as Apparent Violation 05000259, 260, 296/2009009-03, Failure to Protect Cables of Systems Necessary to Achieve and/or Maintain Post-Fire Safe Shutdown Conditions for Fire Areas Subject to the Requirements of 10 CFR Part 50, Appendix R Section III.G.2. The URIs 05000259/2006012-01 and 05000260, 296/2006014-03 are closed.

.03 (Closed) URI 05000260/2006014-01, Postulated Fire-Induced Circuit Failures Could

Prevent the Operator from Opening LPCI Injection Valve 2-FCV-074-053 from the Main Control Room and Result in Failure to Establish LPCI Flow Into the Reactor Vessel (Closed) URI 05000259, 260, 296/2009007-04, Categorization of Operator Manual Actions as Meeting Appendix R Section III.G.1 Versus III.G.2

a. Inspection Scope

Unresolved Item 05000260/2006014-01 described an issue involving control cables associated with a train of systems necessary to achieve and/or maintain hot shutdown conditions, which were not protected from fire damage. Safe Shutdown Instruction 2/3- Enclosure 1 SSI-8 credited operator action to open LPCI Valve 2-FCV-74-53 from the MCR to establish LPCI flow into the reactor vessel during hot shutdown for a fire in FA 8. The inspectors concluded that fire-induced failure of two control power circuits could result in a loss of power to the relay logic that provided the interlock bypass for LPCI Valve 2-FCV-74-53. If this occurred, the operator would not be able to open LPCI Valve 2-FCV-74-53 from the MCR. The operator would have to open the valve locally at the valve or at the 480 volt reactor motor operated valve (MOV) board in the reactor building.

However, the SSI did not address this potential failure to open LPCI Valve 2-FCV-74-53 from the MCR in the event of fire damage to the control cables. The inspectors concluded that FA 8 did not meet the requirements of Appendix R,Section III.G.1, which requires that one train of cables and equipment necessary to achieve and/or maintain hot shutdown conditions be free of fire damage.

During the NRC focused fire protection baseline inspection in April 2009 (IR 05000259, 260, 296/2009007), the NRC team questioned the basis for designating certain FAs as meeting Appendix R,Section III.G.1, given that the fire areas had numerous OMAs which appeared to be required for the credited SSD train to ensure post-fire SSD conditions. The licensees January 27, 2009, exemption request included OMAs for Appendix R,Section III.G.2 FAs. The team discussed this with licensee personnel during the April 2009 inspection and the licensee initiated PER 169491 to perform an extent of condition review of the other FAs designated in the FPR as meeting the separation criteria of Appendix R,Section III.G.1. This issue was identified as URI 05000259, 260, 296/2009007-04 pending licensee review of the FAs in the FPR to determine if the Appendix R,Section III.G.1 FAs were classified correctly.

The team reviewed the subject URIs and assessed the adequacy of the licensees actions to address this issue.

b. Findings

Introduction.

The team identified an AV of 10 CFR Part 50, Appendix R, Section III.G.1, for the licensees failure to ensure that one train of equipment and systems necessary to achieve and maintain hot shutdown conditions was free of fire damage for FA 8 and 19 other FAs designated in the FPR as meeting 10 CFR Part 50, Appendix R, Section III.G.1. In addition, the cables had not been protected by one of the methods specified in Appendix R,Section III.G.2 (i.e., use of spatial separation, passive barriers, and fire detection and an automatic fire suppression system). The licensee relied on OMAs to mitigate the potential adverse effects of fire damage to safe shutdown equipment and systems; however, the licensee had not received prior NRC approval in the form of an exemption from the requirements of Appendix R for use of OMAs. This AV resulted from review and closure of two URIs and it applies to Browns Ferry Units 1, 2, and 3. The finding was entered into the licensees corrective action program and compensatory measures were established while long term corrective actions are being implemented.

Description.

The team followed up on URI 05000260/2006014-01 and determined that the licensees analysis recommended that valve 2-FCV-74-53 be opened using a switch located at the 480 volt reactor MOV board in the reactor building in the event of a fire in FA 8. The licensees 2006 corrective actions, taken in response to this URI, included revising Procedure 2/3-SSI-8 to add an OMA to open valve 2-FCV-74-53 locally at the reactor MOV board. The team determined that FA 8 is a Unit 2 electrical board room Enclosure 1 that the licensee designated in the FPR as meeting Appendix R,Section III.G.1 requirements. The team concluded that the licensees corrective actions did not include an extent of condition review of other FAs designated as Appendix R,Section III.G.1, to determine if similar cable protection issues existed. The team concluded that the designation of FA 8 in the FPR as meeting Appendix R,Section III.G.1 requirements was not valid because one train of cables and equipment necessary to achieve and/or maintain hot shutdown conditions was not free of fire damage. Additionally, the use of local OMAs for a fire in FA 8 did not meet Appendix R,Section III.G.1 requirements.

The team followed up on URI 05000259, 260, 296/2009007-04 and found that the licensees FPR incorrectly designated a combined total of 20 FAs for Units 1, 2, and 3, as meeting 10 CFR Part 50, Appendix R, Section III.G.1. The 20 areas were FAs 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 17, 18, 19, 20, 21, 22, 23, and 24. The team concluded that the licensee failed to identify that other FAs did not meet Appendix R,Section III.G.1 as part of their resolution of URI 05000260/2006014-01. Problem Evaluation Report 169491, generated from previous NRC inspection questions, stated that these 20 FAs should have been designated as Appendix R,Section III.G.2 FAs in the SSA because redundant trains of SSD equipment were located in the same FA and alignment of the credited SSD train required OMAs outside the MCRs for a postulated fire in any of these FAs. As such, the licensee concluded that the OMAs used to mitigate the effects of fire damage in lieu of meeting Appendix R,Section III.G.1 were not identified and entered in the licensees corrective action program as compensatory measures until 2009. The team noted that although the OMAs for these 20 FAs had not been entered in the licensees corrective action program as compensatory measures by the dates specified in the Federal Register 71 FR 11169 (and extended by EGM 07-004), the licensee had verified the feasibility of the OMAs in these 20 FAs and all of the other FAs during Unit 1 restart efforts. Additionally, the team determined that the additional compensatory action implementing hourly roving fire watches, which were established in March 2009 for the Appendix R,Section III.G.2 FAs, included the 20 Appendix R,Section III.G.1 FAs.

The team reviewed this finding against NRC enforcement guidance documents to determine if enforcement discretion was applicable. The team determined that enforcement discretion was not applicable to this finding based on the following reasons:

Browns Ferry did not meet the criteria published in the Federal Register 71 FR 11169 (which withdrew OMA rulemaking March 6, 2006). This notice specified that the OMAs be entered into the licensees CAP as compensatory measures by September 6, 2006. This notice also provided enforcement discretion for three years, ending March 6, 2009, to allow completion of corrective actions for non-compliant OMAs.

Browns Ferry did not meet the time requirements specified in NRC EGM 07-004 (which extended the date to September 6, 2007, for licensees to identify and enter the OMAs into their CAP as compensatory measures), and corrective actions were not completed by March 6, 2009.

Analysis.

Failure to ensure that one train of SSD cables and equipment was free of fire damage, as required by 10 CFR Part 50, Appendix R, Section III.G.1, is a performance deficiency. It is more than minor because it is associated with the reactor safety mitigating system cornerstone attribute of protection against external events (i.e., fire).

Failure to ensure that one train of SSD cables and equipment was free of fire damage Enclosure 1 affects the reactor safety mitigating systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The NRC evaluated the significance of this finding in accordance with NRC Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected multiple fire areas for each Browns Ferry unit. An SDP Phase 1 screening was performed. Given the likely impact of the risk contribution arising from the assessment of multiple fire areas, the SDP Phase 3 analysis was performed in lieu of the SDP Phase 2 analysis. The results of the Phase 3 analysis indicated that the preliminary significance of this finding is Greater Than Green.

The risk analysis was performed utilizing NRC IMC 0609, Appendix F, as the framework.

Alterations of specific values in IMC 0609 were made using information from NUREG 6850 and approved FAQs from the NFPA 805 process. The HRA values were calculated using the SPAR-H methodology. A significant factor which influenced the results of the risk analysis was the selection and evaluation of those fires that met the entry conditions for using an SSIs. Specifically, the analysts determined that entry into the SSIs was determined by the operations shift manager based on procedure entry conditions that was subject to an individuals judgment. To account for this decision, the analysts assumed that fires would generally last at least 10 minutes. The risk analysis of this performance deficiency was only applicable to fires that warrant entry into the SSIs.

In addition, the ramifications of OMA failures on LERF need to be fully understood.

Through a combination of plant walk downs and review of the SSIs, those compartments that contain the ignition sources that could meet the SSI entry conditions were identified.

Those compartments that met the criteria of mis-classification and having a credible ignition source were carried forward in the analysis. Within each of the compartments that remained, measurements were taken from the top of the ignition source to the first cable tray to establish whether the cable tray was in the ZOI. Then, these ignition sources were cataloged and given a unique identification number (Fire Number). Using the Plume_Temperature_Calcuations.xls spreadsheet from NUREG 1805, and the Temperature/Time to Damage Tables in IMC 0609, Appendix F, Attachment 7, the analysts established the time to cable damage. Using appropriate consideration associated with solid bottom cable trays and Flammastic cable coating, the analysts determined a final time to cable damage. Based upon the time to cable damage, one minute was subtracted for time for detection, and the manual suppression tables were applied to account for the possibility of manual suppression prior to cable damage. An initiating event frequency for entrance into the SSIs was derived by multiplying (ignition source frequency) x (number of ignition sources) x (severity factor - 1.0 applicable to 75th

& 98th percentile fire, 0.9 applicable to 75th percentile fires or 0.1 applicable only to 98th percentile fires) x (probability of automatic non suppression) x (probability of manual non suppression before cable damage or at 10 minutes).

The analysts derived the conditional core damage probability (CCDP) by reviewing the applicable SSI for a particular compartment and assigning a cumulative OMA failure probability for each unit. For each SSI, the OMAs were partitioned into critical and non-critical actions and assigned to the affected unit(s). A critical action indicated that, if it failed, the mitigation strategy also failed. The analysts also considered hot short probability, where appropriate, in designating OMAs as critical for use in calculating the CCDP. A failure probability was assigned to each critical action, using as inputs the Enclosure 1 actual procedure, plant walk downs by the analysts, and the licensees verification and validation packages for each SSI. Also, the analyst determined whether there was a dependency between/among the OMAs within a given SSI. From this information, the analysts generated a table for each SSI that showed each OMA, whether it was critical or non-critical, what unit was applicable to that OMA, whether dependency was used in the human error failure probability derivation, the independent human error failure probability of the OMA, whether failure was provisional upon a hot short and a final human error failure probability. The analysts then summed the OMA failure probabilities in the table on a per unit basis. By multiplying the individual SSI entrance frequency by the CCDP for that SSI for a particular unit, the analyst generated a non-conforming CDF for each unit. For the complete analysis, see Enclosure 2 to this IR.

The team determined that this finding did not present an immediate safety concern because the licensee implemented compensatory measures while long-term corrective actions are being implemented. The compensatory measures included operator manual actions to mitigate or prevent damage to equipment necessary for safe shutdown in the event of a fire. The licensee also implemented fire watches as additional compensatory measures to mitigate the safety hazard. The team reviewed the critical operator manual actions, and concluded that they were feasible, based on inspection activity described in this and previous NRC inspection reports. Subsequent to the onsite inspection, the licensee evaluated the most critical operator manual actions, and revised selected safe shutdown instructions to include steps for independent confirmation of operator manual actions in order to improve the likelihood of success of these steps, and thus reduce the risk associated with this finding.

The cause of this finding has a cross-cutting aspect in the Corrective Action Program component of the Problem Identification and Resolution area, in that the licensee did not thoroughly evaluate the problem and the resolution did not address extent of condition (P.1 (c)).

Enforcement.

10 CFR 50.48(b)(1) requires that all nuclear power plants licensed to operate prior to January 1, 1979, must satisfy the applicable requirements of Appendix R,Section III.G.Section III.G.1 specifies that fire protection features shall be provided for systems and components important to SSD, and these features shall be capable of limiting fire damage such that one train of systems necessary to achieve and maintain hot shutdown conditions is free of fire damage.

Contrary to the above, as of October 9, 2009, the licensee did not meet the requirements of 10 CFR 50, Appendix R, Section III.G.1. Specifically, the licensee did not ensure that one train of systems necessary to achieve and maintain hot shutdown conditions was free of fire damage in 20 fire areas classified as Appendix R,Section III.G.1, in that cables of redundant trains of post-fire SSD equipment located in the same fire area were subject to fire damage from a single fire. Examples of cables in fire areas that do not meet Appendix R,Section III.G.1 and are not free of fire damage include, but are not limited to, cables associated with redundant RHR LPCI valves FCV-74-067 in Fire Area 5 and FCV-74-053 in Fire Area 8. This condition applies to Browns Ferry Units 1, 2, and 3, and has existed since the restart of each unit (Unit 2-1991, Unit 3-1995, Unit 1-2007).

The licensee documented this issue in their CAP in PER 169491. This finding is identified as AV 05000259, 260, 296/2009009-04, Failure to Meet the Requirements of Enclosure 1 10 CFR Part 50, Appendix R, Section III.G.1 for 20 Fire Areas. The URIs 05000260/2006014-01 and 05000259, 260, 296/2009007-04 are closed.

.04 (Closed) URI 05000259, 260, 296/2009002-01, Inappropriate Change to SSI Entry

Conditions for Appendix R Fire Events

a. Inspection Scope

This URI described an issue related to SSI entry condition changes. On December 23, 2008, the licensee issued Revision 2 to procedure 0-SSI-001, Safe Shutdown Instructions, which instituted a significant change to the SSI entry conditions. This revision added an entry condition based on the operators ability to restore and maintain reactor water level above +2 inches on the narrow range scale using available equipment. With this change in effect, operators would not enter the SSIs during an Appendix R fire event unless they were unable to restore and maintain reactor water level above +2 inches. In January 2009, the inspectors reviewed the effect of Revision 2 to procedure 0-SSI-001, on the operators ability to align and operate designated SSD equipment in a manner that would ensure their capability to perform their intended functions during an Appendix R fire event. Based on this review, the inspectors questioned the adequacy of the revised SSI entry conditions to ensure critical parameters would be maintained consistent with assumptions in the SSA. The inspectors concluded that failure to enter the SSIs at the correct time could invalidate critical SSI timelines for operator actions to ensure reactor core and containment cooling functions are met. After further review of the inspectors concerns, the licensee subsequently determined that the entry conditions of procedure 0-SSI-1 did not ensure timely entry into the SSIs in the event that decay heat removal capability was lost due to fire damage. The Revision 2 procedure change evaluation of 0-SSI-001 did not consider the potential impact on decay heat removal and containment cooling functions during a fire event. The licensee initiated PER 162779 to address this specific issue.

Following further discussions with the NRC regarding acceptability of the SSI entry conditions, the licensee also initiated PER 164685 and subsequently issued Revision 4 of 0-SSI-001, on February 27, 2009, which changed the entry conditions to those contained in Revision 1 of the SSI. The entry conditions prescribed by Revisions 1 and 4 of 0-SSI-001 were based on the magnitude of the fire, and did not include qualifiers related to plant parameters (e.g., reactor water level, suppression pool temperature).

The inspectors identified URI 05000259, 260, 296/2009002-01, to review additional information from the licensee in order to fully assess the safety and enforcement implications regarding the adequacy of the revised SSI entry conditions.

The team evaluated the facts and circumstances associated with this URI to determine the safety significance of the issues.

b. Findings

Introduction.

The team identified an AV of Technical Specification 5.4.1.a, in that, the licensees revision to the SSI entry conditions in December 2008 resulted in inadequate procedural guidance. Specifically, the revision to Procedure 0-SSI-001, Safe Shutdown Instructions, added an entry condition based on the operators ability to restore and maintain reactor water level above +2 inches on the narrow range scale with available Enclosure 1 equipment. This revision could have delayed or precluded entry into the SSIs during an Appendix R fire event.

Description.

The licensee issued Revision 2 of Procedure 0-SSI-001, "Safe Shutdown Instructions," on December 23, 2008. This revision added an entry condition which could have delayed or precluded the operator from entering the post-fire SSD instruction (SSI 0-SSI-001) if reactor vessel water level was above +2 inches (narrow range instrument).

The level during normal operations is +33 inches (narrow range instrument). The team determined that the procedure also allowed the operator time to restore level to + 2 inches (narrow range instrument) if it had fallen below that level before entering the SSIs.

The criterion of +2 inches (narrow range instrument) did not ensure that all the initial conditions of the SSA would be maintained during a post-fire SSD evolution (e.g.,

suppression pool temperature). The licensee agreed that the revised entry conditions did not ensure timely entry into the SSIs in the event they lost decay heat removal capability as a result of fire damage. On February 27, 2009, the licensee issued Revision 4 of Procedure 0-SSI-001 which returned the entry conditions to an acceptable set of procedure entry conditions.

Analysis.

Failure to meet Technical Specifications requirements due to inadequate procedural guidance is a performance deficiency. This finding is more than minor because it is associated with the procedure quality attribute of the Mitigating Systems cornerstone and it affected the cornerstone objective of protection against external events such as fire to prevent undesirable consequences. As the performance deficiency is a fire protection finding, the team attempted to use IMC 0609, Appendix F, "Fire Protection Significance Determination Process." As specified in the Assumptions and Limitations for IMC 0609, Appendix F, the process does not include explicit treatment of fires leading to MCR abandonment, either due to fire in the MCR or due to fires in other FAs, and recommended that additional guidance be sought in the conduct of such an analysis. Given the number of FAs impacted, an SDP Phase 2 analysis was not performed. Because a multiple fire area assessment effort was beyond the intended scope of the fire protection SDP Phase 2 analysis, the finding was forwarded to the senior reactor analysts for review. The senior reactor analysts further discussed the issue with the team and determined that there were other obstacles to quantifying the risk of the performance deficiency, including:

The likelihood that reactor water level would remain above +2 inches narrow range reactor vessel water level, during a postulated fire, given that spurious equipment operations may be occurring was difficult to assess. For a given fire in any one of the 38 fire areas in the plant, equipment misalignments could either make it more likely or less likely (in any of the Units 1, 2, or 3) that reactor water level would remain above +2 inches. The analysts could not quantify this probability, which was a necessary first step to assess the risk of the non-conforming case.

The analysts found that in order to determine the risk significance of this performance deficiency, detailed modeling of the damage done to equipment in each of the 28 applicable fire areas would be necessary, which would require significant staff resources.

The analysts determined that some recovery credit should be given to reflect that the operators may diagnose the problem and deliberately deviate from the SSIs. Enclosure 1 The analysts could not quantify (for a postulated fire event when the entry criteria for the SSIs were not met i.e., reactor vessel water level was greater than +2 inches)whether operators would deliberately enter the SSI procedures in order to deal with the event.

In the event a fire occurred in the plant during that period (December 23, 2008, until February 27, 2009) and reactor vessel water level above + 2 inches (narrow range instrument), operators could attempt a safe shutdown, but they would use the emergency operating instructions (EOIs). The team found that the operators would use these EOIs when the SSIs should have been used. The use of the EOIs would not ensure a successful SSD because: 1) the initial conditions of the post-fire SSD analysis may not be maintained; 2) the credited set of post-fire SSD equipment as determined by circuit analysis would not necessarily be used; and 3) the local operator actions specified by the post-fire SSD analysis to mitigate spurious equipment operation would not be performed.

Due to the fact that the SDP methods and tools were not adequate to determine the significance of the finding within the established SDP timeliness goal of 90 days, the analysts used qualitative methods which received NRC management review as provided for in NRC IMC 0609, Appendix M, Significance Determination Process Using Qualitative Criteria.

The risk of this condition (i.e., failing to enter the SSIs during a postulated fire because the entry criteria were non-conservative) was evaluated in comparison to the risk significance of the licensees Appendix R,Section III.G.1/III.G.2 performance deficiencies discussed in Sections 4OA5.02 and 4OA5.03 of this IR. The fire scenarios would develop in a similar manner to those involving the III.G.1/III.G.2 issues.

Therefore, the analysts assumed that not entering the SSI procedures was at least as risk-significant as entering them. Utilizing the risk assessment described in Sections 4OA5.02 and 4OA5.03 (base case), the analysts applied quantitative and qualitative factors to determine the preliminary risk of this finding. Influential assumptions in the risk analysis included:

One of the most important factors in evaluating this condition was time. For example, if high pressure injection was lost during this event, then depressurization and transition to RHR was much more time critical. As described in the licensees Procedure O-SSI-001, The initiation of RHR system should occur within 25 minutes from the loss of all high pressure make-up to the reactor to minimize the consequences of uncovering the fuel. Hence, the probability of failure would be higher for these scenarios.

Once the licensee instituted the SSIs, these procedures would supersede the EOIs.

For a postulated major disabling fire, the licensees success in achieving safe shutdown is entirely dependent upon correct implementation of the SSI procedures.

The analysts further determined that the dominant factors that reduced the risk significance from the base case were: 1) exposure time of the performance deficiency (66 days); 2) the reduced likelihood that a severe damaging fire would render high pressure injection unavailable, thus making rapid transition to RHR necessary; and 3)defense in depth from training, procedures, and multiple systems. The approximate value for these reduction factors was 3E-2. Enclosure 1 The analysts found that the factors that potentially increased the risk significance were:

1) sequences that involve reactor vessel level remaining above +2 inches would likely preclude recovery; 2) if recovery credit was given, human error probability (HEP) values would be high; and 3) transient combustibles and hot-work fires, if considered (which they were not in the III.G.1/III.G.2 findings), would increase risk.

The table below provides a more detailed description of the various factors that may either increase or decrease the risk significance of this condition, relative to the III.G.1/III.G.2 performance deficiencies:

Factors that Increase Risk Significance Factors that Decrease Risk Significance Sequences (i.e., fire scenarios) that would The condition existed from December 23, result in reactor water level remaining greater 2008, when the licensee issued Revision 2 to than +2 inches would likely preclude recovery.

Procedure 0-SSI-001, Safe Shutdown The SSI procedure, Revision 2, entry criteria Instructions until the licensee corrected the stated Reactor water level cannot be restored procedure with Revision 4 on February 27, and maintained above +2 inches narrow range 2009. Thus the exposure time was 66 days, level with operation of available equipment. If and the risk of this condition would be 18%

operators had low pressure injection sources (66/365) of the annualized risk of the (which would always be true even in severely III.G.1/III.G.2 performance deficiencies.

damaging fires), then they would likely not consider this entry criteria to have been met.

Consequently, the impact of not entering the SSIs would make systems necessary to achieve safe shutdown vulnerable. This factor was not quantified.

If the operators were to realize during a Some fire scenarios would not render high postulated fire that they needed to enter the pressure injection unavailable for one or more SSIs despite the guidance, the likelihood of units. For those scenarios, the ability to inject success would be low i.e., the HEP values high pressure water allows operators more would be high. In recovering the plant, the time to transition the plant to safe shutdown in operators would be combating the casualty a controlled manner (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months vs. 25 minutes).

with less time available because some time With high pressure injection available, would have been spent implementing the operators would not have to rapidly EOIs. Further, operator stress would likely be depressurize and transition to RHR.

higher following the decision to transition to Procedure 0-SSI-001, Safe Shutdown the SSIs. These HEP factors were not Instructions, Table 2, Available High quantified but could be significant (possibly 1 Pressure Makeup for Worst Case Fire, shows order of magnitude greater that HEP values for that when considering the effect of a fire on the III.G.1/III.G.2 findings).

Unit 1, there are 10 fire zones or areas which had the potential to render high pressure injection (Feedwater, RCIC, and HPCI)unavailable. For Units 2 and 3 the numbers are 9 and 5, respectively. Fire areas that did not have a credible ignition source were not considered and did not affect the reduction factor. The analysts assumed that a fire in a given fire area had roughly equal ignition frequencies in all three units. The analysts averaged these numbers across the three Enclosure 1 Factors that Increase Risk Significance Factors that Decrease Risk Significance units resulting in a reduction factor of 19%.

This factor represents the likelihood that a severe damaging fire would render high pressure injection unavailable and thus require rapid depressurization and transition to RHR.

Some fires were not included in the associated Defense in depth. Guidance existed in the Phase 3 analysis for the III.G.1/III.G.2 AVs EOIs directing operators regarding (i.e., transient combustibles and hot-work suppression pool heat absorption capability fires). If included, these may increase the risk and when to establish cooling. Further, the significance, though probably not significantly.

operators are frequently trained on these This factor was not quantified.

procedures. Though suppression pool cooling may have been adversely affected by a delayed or total failure to enter the SSI, thus failing to use protected equipment, other defenses remained intact, e.g., multiple trains. This factor was not quantified.

Considering the qualitative and quantitative factors described above, the preliminary significance of this finding was determined to be Greater Than Green. The team determined that this finding did not present an immediate safety concern because the licensee revised the safe shutdown instruction in February 2009 and removed the +2-inch reactor vessel water level entry condition.

The cause of the finding had a cross-cutting aspect in the Decision Making component of the Human Performance area. It was related to the licensee not using conservative assumptions in decision making and not conducting reviews to verify the validity of underlying assumptions and identifying possible unintended consequences (H.1.(b)).

Enforcement:

Technical Specification 5.4.1.a. requires that written procedures shall be established, implemented, and maintained covering the activities in NRC Regulatory Guide 1.33, "Quality Assurance Program Requirements (Operation)," Revision 2.

Regulatory Guide 1.33, Appendix A, Section 6.v, requires procedures for combating emergencies such as plant fires. Procedure 0-SSI-001, Safe Shutdown Instructions, Revision 2, specified the licensees fire emergency response for a major disabling fire.

Embodied within these requirements is the requirement that the procedures are adequate.

Contrary to the above, the entry conditions for Procedure 0-SSI-001, "Safe Shutdown Instructions," Revision 2, were inadequate. Specifically, on December 23, 2008, the licensee implemented Revision 2 to the SSI which added a reactor vessel water level entry criterion that would have required operators to remain in the emergency operating instructions until reactor vessel water level decreased to less than +2 inches narrow range, thus delaying or preventing establishment of SSD conditions during a postulated fire. The violation occurred on December 23, 2008, and the condition existed for 66 days. The licensee entered this finding into the corrective action program (PERs 162431, 162779 and 164685) and adequate procedural guidance was restored when Procedure 0-SSI-001 was revised on February 27, 2009, to eliminate the +2-inch reactor water level entry condition. Pending determination of the findings final safety significance, this finding is identified as AV 05000259, 260, 296/2009009-05, Inadequate Enclosure 1 Safe Shutdown Instruction Entry Conditions for Appendix R Fire Events. Unresolved item 05000259, 260, 296/2009002-01 is closed.

.05 (Closed) URI 05000259, 260, 296/2009007-01, Suppression Pool Initial Temperature

Assumed in the Appendix R Thermo-Hydraulic Analysis May not be the Most Limiting Value

a. Inspection Scope

This URI involved questions related to postulated fire scenarios in which the initial suppression pool temperature assumed in the licensees Appendix R thermo-hydraulic analysis may not be the most limiting value for a postulated fire in certain FAs. During a 2009 inspection (documented in IR 05000259, 260, 296/2009007), the inspectors noted that a fire-induced single spurious equipment operation could result in plant parameters being outside the initial conditions assumed in the thermo-hydraulic analysis and SSA prior to entry into the SSIs. This was corroborated by a simulator exercise for a postulated fire in FA 9, which demonstrated the effect on suppression pool temperature of a single main steam safety relief valve (MSSRV) spuriously opening at the onset of a fire. During the simulator exercise, suppression pool temperature quickly rose above the 95 degrees Fahrenheit value assumed in the thermo-hydraulic analysis. The inspectors concluded that suppression pool temperature above the analyzed value could impact the net positive suction head (NPSH) required for the LPCI pumps, which were credited for providing core cooling (if high pressure systems were not available) and suppression pool cooling. The team reviewed licensee information related to this URI in order to assess the licensees actions to address this issue.

b. Findings

In their SSA which addressed the potential for a MSSRV spuriously opening due to fire damage to cables, the licensee concluded that the plant could withstand one open MSSRV as long as suppression pool temperature was 95 degrees Fahrenheit at the time the SSI is entered. However, when the scenario of a MSSRV spuriously opening was run on the plant simulator, the suppression pool temperature increased so rapidly that it was clear that the suppression pool temperature could be above 95 degrees Fahrenheit before the operator entered the SSI. Subsequently, the licensee performed a calculation which showed that the spurious opening of one MSSRV would result in a suppression pool temperature of 110 degrees Fahrenheit at the time the SSI is entered. Reanalysis of the SSD evolution with suppression pool temperature at 110 degrees Fahrenheit showed that all temperatures remained within acceptable limits. Of particular interest was the suppression pool temperature as it relates to the available NPSH for the RHR pump which would be used for reactor core cooling during the SSD evolution. The licensee revised the abnormal operating instructions to specify tripping the reactor whenever the conditions of stuck open MSSRV, suppression pool temperature of 95 degrees Fahrenheit and a plant fire exist. The team concluded that the potential to exceed the initial condition of 95 degrees Fahrenheit in the SSD analysis had no adverse effect on any mitigating system, and URI 05000259, 260, 296/2009007-01 is closed. Enclosure 1

.06 (Closed) URI 05000259, 260, 296/2009007-02, Containment Isolation Valves not

Included in the Appendix R Separation Analysis

a. Inspection Scope

In a letter to the NRC regarding their request for extended power uprate, dated November 15, 2007, TVA stated that credit for containment overpressure (COP) was needed during certain fire scenarios to ensure adequate net positive suction head (NPSH) for the residual heat removal (RHR) pump operating in the alternate shutdown cooling mode. In this letter, TVA also stated that they had reviewed the fire scenarios in which COP would be needed (in FAs 4 and 9), and concluded that the CIVs did not traverse through those FAs; therefore would not be subject to fire-induced spurious operation. During the April 2009, fire protection focused baseline inspection, TVA told inspectors that the CIVs were not included in the Appendix R separation analysis, which called into question the basis for the licensees conclusion that the CIVs were not in FAs 4 and 9. In addition, given that CIVs were not included in the Appendix R separation analysis, the inspectors questioned the adequacy of the SSA (i.e., were the CIV cables sufficiently analyzed for spurious operation in all FAs where COP was needed for safe shutdown). The licensee initiated PER 169484 to review the Appendix R separation analysis to verify that CIVs were not present in FAs 4 and 9, and to determine if the CIVs needed to be included in the SSA.

b. Findings

The team reviewed the design of the following 17 valves in the CIV system (grouped below into seven areas) to determine if they could be subject to fire-induced spurious operation.

Drywell exhaust, FCV-64-29 & 30

Drywell 2-inch vent, FCV-64-31 & 34 and FCV-84-20

Suppression chamber exhaust, FCV-64-32 & 33 and FCV-84-19

Hardened wet well vent, FCV-64-221 & 222

Drywell atmosphere supply, FCV-64-17, 18 & 19

Reactor building floor drain, FCV-77-2A & 2B

Reactor building equipment drain, FCV-77-15A & 15B All of the 17 valves incorporated normally-closed, fail-closed design, and were all 120 VAC solenoid valves utilizing energize-to-open logic. The licensees SSA concluded that it was not critical that the containment remain isolated for fire events in the control building; therefore it was not necessary to protect against fire-induced spurious operation of CIV for fires in the control building. The only cable associated with the CIVs which left the control building were those which ran from the inboard and outboard isolation valve panels (9-42 and 9-43) in the instrument rooms on the 593-foot elevation of the control building to the CIVs in the reactor building. The team reviewed the circuit design associated with these cables, and determined that fire-induced open circuits or short circuits within these cables could not cause the valves to spuriously open. However, a short circuit within a cable which ran from an isolation valve panel to the main control room could cause a valve to spuriously open. The team reviewed the routing of these cables and found that they were routed via a short section of vertical enclosed cableway, Enclosure 1 into the cable spreading room and up to the main control room, staying entirely within the control building. In the SSA, the licensee determined that the only critical FAs with regard to containment isolation integrity were FAs 4 and 9, electrical board rooms within the reactor building area at the 593-foot elevation. The team walked-down these FAs and reviewed cable routing data, and verified that there were no cables associated with the CIVs routed in FAs 4 or 9. Based on the above, the team concluded that fire-induced spurious opening of CIVs was not a concern with regard to the post-fire SSD; therefore, URI 05000259, 260, 296/2009007-02 is closed.

In reviewing the issues identified in this URI, the team found that the Browns Ferry FPR contained the assumption that since the CIV system had two valves in series, it would take two fire-induced spurious operations to jeopardize containment integrity. The licensee concluded that it was unlikely that two fire-induced spurious operations could occur; therefore, did not need to be analyzed. This called into question whether Browns Ferrys licensing basis (and the resulting design basis) included protection against multiple fire-induced spurious operation. The team researched Browns Ferry licensing basis documents, and concluded that the licensing basis for Browns Ferry included the need to protect against multiple fire-induced spurious operations if they could adversely affect SSD. The team presented the results of this review to licensee management, who agreed that the design basis as stated in their FPR with regard to multiple fire-induced spurious operations was not consistent with the licensing basis. The licensee stated that they would revise the design basis to include consideration of multiple fire-induced spurious operations. The subject of whether multiple fire-induced spurious operations are required to be protected in accordance with 10 CFR Part 50, Appendix R, Section III.G.2 is a generic fire protection issue. On May 14, 2009, the NRC issued Enforcement Guidance Memorandum 09-002, which described the conditions under which a licensee could be granted enforcement discretion for non-compliances related to multiple fire-induced circuit failures causing spurious operation. On March 4, 2009, the TVA declared their intention to transition their fire protection licensing basis to NFPA 805. Under certain conditions, non-compliances identified by the NRC or the licensee during this period of transition may be granted enforcement discretion for up to three years (Federal Register, 73 FR 52705). The licensee is expected to resolve these issues in the NFPA 805 transition process.

.07 (Closed) URI 05000259, 260, 296/2009007-03, Operator Manual Actions to Isolate Main

Steam Safety Relief Valves for a Unit 2 Appendix R Fire Event

a. Inspection Scope

This URI involved questions related to the Unit 2 SSIs being different from the Unit 1 and Unit 3 SSIs, in that the Unit 2 SSIs did not include OMAs to address closure of an MSSRV if the valve were to spuriously open due to a postulated fire. The inspectors discussed the apparent inconsistency with licensee personnel at that time who stated that the analyses were different because the vendor who performed the Unit 2 SSA was different from the vendor who performed the SSA for Units 1 and 3. The team followed up on this URI and reviewed the relevant procedures and drawings to assess the licensees actions to address this issue. Enclosure 1

b. Findings

At Browns Ferry there are 13 MSSRVs per unit, which are solenoid valve controlled using energize to open logic and 250 VDC control power. To provide overpressure protection, four of the valves were set to open at 1135 psig, four set to open at 1145 psig, and five set to open at 1155 psig. Five MSSRVs were wired to open on an automatic depressurization signal. Four valves could be controlled from both the MCR and the backup control panel, and these were provided with normal and alternate control power. These were the four valves that were credited for establishing the LPCI flow path used in the SSIs. Review of the control circuit showed that a short-circuit on a cable that ran between the backup control panel (25-32) and auxiliary instrument panel (9-30), or on a cable that ran from panel 9-30 to the MCR, could result in spurious opening of a MSSRV. An internal short-circuit or open circuit on a cable which ran to the MSSRV itself could not cause spurious opening. The licensee had performed an analysis which showed that spurious opening of one, and only one, MSSRV would not have an adverse affect on post-fire SSD. To cover the case of a spurious fire-induced automatic depressurization signal or spurious overpressure signal, the system incorporated inhibit switches. The SSIs included steps to put these switches in the inhibit position, which would prevent spurious operation. During an April 2009 inspection (IR 05000259, 260, 296/2009007), inspectors noted that the Unit 1 and 3 SSD instructions included outside-the-control room operator actions to close a MSSRV that may have spuriously opened, but that the Unit 2 SSD instruction did not appear to have a similar step. PER 169487 was initiated at that time to address this apparent discrepancy. Based on the following, the team found that the procedures had been adequate with respect to spurious opening of MSSRVs. Units 1 and 3 had control circuit devices for some MSSRVs at local panels 1-925-658 and 3-925-658 and for some MSSRVs at the backup control panel (25-32),whereas Unit 2 had corresponding control circuit devices for all the MSSRVs at the 25-32 panel. As a result, the Units 1 and 3 SSIs included a step to mitigate spurious opening of MSSRVs which was performed at panel 925-658. Whereas Unit 2 did not need a corresponding step because any MSSRV which had spuriously opened would have been reclosed when all the transfer/isolation switches at panel 25-32 were placed in the emergency position. In addition, Abnormal Operating Instructions 1/2/3 - AOI-1-1, Relief Valve Stuck Open, included a steps to reclose a spuriously opened MSSRV by opening the appropriate 250 VDC control power circuit breaker. The team concluded there was no issue with regard to Unit 2 procedural guidance for operators to deal with spuriously opened MSSRVs whether due to fire damage or failed instrumentation. This URI 05000259, 260, 296/2009007-03 is closed. The issues of using OMAs to mitigate the effects of fire damage in lieu of ensuring one train of equipment needed for SSD is free of fire damage, as required by 10 CFR Part 50, Appendix R, Sections III.G.1 and III.G.2, are addressed above in Sections 4OA5.02 and 4OA5.03 of this IR.

4OA6 Meetings, Including Exit

On October 9, 2009, the team leader presented the inspection results to Mr. J. Randich, General Manager, Site Operations, and members of the licensees staff, who acknowledged the findings. No proprietary information is included in this inspection report. Following completion of additional reviews in the Region II office, another exit Enclosure 1 meeting was held by telephone with Mr. R. Krich and members of the licensees staff on January 19, 2010, to provide an update on changes to the preliminary inspection findings. The licensee acknowledged the findings.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

S. Austin, Site Licensing Engineer

S. Berry, Component Engineering Manager

S. Bono, Site Engineering Director

P. Chase, Acting Operations Manager

J. Emens, Site Licensing Supervisor

V. Furr, Probability and Risk Analysis Program Manager

R. Goodwin, Site Licensing Manager

D. Green, Corporate Browns Ferry Lead Project Engineer

S. Kammer, Fire Protection Engineer

R. Krich, Vice President, Nuclear Licensing

J. Kulisek, Operations Procedure Supervisor

L. Long, Fire Protection Specialist

P. Lovvorn, Electrical Design Engineer

M. McAndrew, Operations Superintendent

J. McCarthy, Director of Safety and Licensing

J. McCrary, Operations Support

J. Miller, Operations Manager

K. Nesmith, TVA Corporate Nuclear Design Engineering Senior Manager

L. Nicholson, TVA Corporate Licensing/Performance Improvement

K. Polson, Site Vice President

J. Randich, General Manager of Site Operations

R. Sampson, Electrical Engineering Design Supervisor

B. Simril, TVA Corporate Fire Protection Program Manager

E. Smith, Site Fire Operations Manager

L. Stafford, Site Appendix R/Fire Protection Program Engineer

R. West, Site Vice President

R. Whalen, TVA Corporate Nuclear Engineering Vice President

J. Wolcott, Extended Power Operations Project Manager

NRC

J. Hanna, Senior Reactor Analyst, Region II

K. Korth, Resident Inspector

G. MacDonald, Senior Reactor Analyst, Region II

R. Nease, Branch Chief, Engineering Branch 2, Division of Reactor Safety, Region II

W. Rogers, Senior Reactor Analyst, Region II

T. Ross, Senior Resident Inspector

C. Stancil, Resident Attachment

LIST OF ITEMS

OPENED, CLOSED AND DISCUSSED

Opened

05000259, 260, 296/2009009-03 AV Failure to Protect Cables of Systems Necessary to Achieve and/or Maintain Post-Fire Safe Shutdown Conditions for Fire Areas Subject to the Requirements of 10 CFR Part 50, Appendix R, Section III.G.2 (Section 4OA5.02)

05000259, 260, 296/2009009-04 AV Failure to Meet the Requirements of 10 CFR Part 50, Appendix R, Section III.G.1 for 20 Fire Areas (Section 4OA5.03)

05000259, 260, 296/2009009-05 AV Inadequate Safe Shutdown Instruction Entry Conditions for Appendix R Fire Events (Section 4OA5.04)

Opened and Closed

05000259, 260, 296/2009009-01 NCV Deficiencies with Emergency Lighting Units (Section 1R05.09)

05000259, 260, 296/2009009-02 NCV Failure to Establish Adequate Compensatory Measures for an Out-of-Service Hose Station (Section 1RO5.11)

Closed

05000260, 296/2006004-03 URI Incomplete and Unfeasible Compensatory Measures for Ensuring RHR Pump NPSH During Appendix R Events (Section 4OA5.01)

05000259/2006012-01 URI Feasibility and Reliability of Local Manual Operator Actions to Achieve Safe Shutdown (Section 4OA5.02)

05000260/2006014-01 URI Postulated Fire-Induced Circuit Failures Could Prevent the Operator from Opening LPCI Injection Valve 2-FCV-074-053 from the Main Control Room and Result in Failure to Establish LPCI Flow Into the Reactor Vessel (Section 4OA5.03)

05000260, 296/2006014-03 URI Unapproved Local Manual Operator Actions in Lieu of Cable Protection for a Fire Area Subject to the Requirements of Appendix R Section III.G.2 (Section 4OA5.02)

05000259, 260, 296/2009002-01 URI Inappropriate Change to SSI Entry Conditions for Appendix R Fire Events (Section 4OA5.04) Attachment

05000259, 260, 296/2009007-01 URI Suppression Pool Initial Temperature Assumed in the Appendix R Thermo-Hydraulic Analysis May not be the Most Limiting Value (Section 4OA5.05)

05000259, 260, 296/2009007-02 URI Containment Isolation Valves not Included in the Appendix R Separation Analysis (Section 4OA5.06)

05000259, 260, 296/2009007-03 URI Operator Manual Actions to Isolate Main Steam Safety Relief Valves for a Unit 2 Appendix R Fire Event (Section 4OA5.07)

05000259, 260, 296/2009007-04 URI Categorization of Operator Manual Actions as Meeting Appendix R Section III.G.1 Versus III.G.2 (Section 4OA5.03)

Discussed

05000259/2009-005-00 and -01 LER Common Accident Logic Not Evaluated for Appendix R Event (Section 4OA3) Attachment

LIST OF DOCUMENTS REVIEWED

IR 05000259/2009009

Text

REGION II

SUBJECT:

Dear Mr. Swafford:

Enclosures:

SUMMARY OF FINDINGS

NRC Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Licensee-Identified Violations

REPORT DETAILS

REACTOR SAFETY

1R05 Fire Protection

.01 Shutdown from the Main Control Room (MCR)

a. Inspection Scope

b. Findings

.02 Protection of Safe Shutdown Capabilities

a. Inspection Scope

b. Findings

.03 Passive Fire Protection

a. Inspection Scope

b. Findings

.04 Active Fire Protection

a. Inspection Scope

b. Findings

.05 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

b. Findings

.06 Alternative Shutdown Capability

a. Inspection Scope

b. Findings

.07 Circuit Analyses

a. Inspection Scope

b. Findings

.08 Communications

a. Inspection Scope

b. Findings

.09 Emergency Lighting

a. Inspection Scope

b. Findings

Introduction.

Description.

Analysis.

Enforcement.

.10 Cold Shutdown Repairs

a. Inspection Scope

b. Findings

.11 Compensatory Measures

a. Inspection Scope

b. Findings

Introduction.

Description.

Analysis.

Enforcement.

OTHER ACTIVITIES

4OA2 Identification and Resolution of Problems

a. Inspection Scope

b. Findings

4OA3 Event Follow-up

4OA5 Other Activities

.01 (Closed) Unresolved Item 05000260, 296/2006004-03, Incomplete and Unfeasible

a. Inspection Scope

b. Findings

.02 (Closed) URI 05000259/2006012-01, Feasibility and Reliability of Local Manual Operator

a. Inspection Scope

b. Findings

Introduction.

Description.

Analysis.

Enforcement.

.03 (Closed) URI 05000260/2006014-01, Postulated Fire-Induced Circuit Failures Could

a. Inspection Scope

b. Findings

Introduction.

Description.

Analysis.

Enforcement.

.04 (Closed) URI 05000259, 260, 296/2009002-01, Inappropriate Change to SSI Entry

a. Inspection Scope

b. Findings