IR 05000261/2004006

IR 05000261-04-006, on 08/16-20/2004 and 08/30/2004 - 09/03/2004; H. B. Robinson Steam Electric Plant, Unit 2, Triennial Fire Protection

ML043010287
Person / Time
Site:	Robinson
Issue date:	10/10/2004
From:	Payne D NRC/RGN-II/DRS/EB
To:	Moyer J Carolina Power & Light Co
References
IR-04-006
Download: ML043010287 (35)

Text

ber 10, 2004

SUBJECT:

H. B. ROBINSON STEAM ELECTRIC PLANT - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000261/2004006

Dear Mr. Moyer:

On September 3, 2004, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your H. B. Robinson Steam Electric Plant. The enclosed inspection report documents the inspection findings, which were discussed on that date with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents two findings involving post-fire safe shutdown vulnerabilities. These findings involve violations of NRC requirements; however, their safety significance has not been determined and could potentially be greater than very low (Green). These findings did not present an immediate safety concern and compensatory measures are in place while long-term corrective actions are being implemented. The report also documents two NRC-identified findings of very low safety significance (Green) involving violations of NRC requirements.

However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating the findings as non-cited violations (NCVs)

consistent with Section VI.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region 2; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the H. B. Robinson Steam Electric Plant.

CP&L 2 In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publically Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

D. Charles Payne, Chief Engineering Branch 2 Division of Reactor Safety Docket No.: 50-261 License No.: DPR-23

Enclosure:

NRC Triennial Fire Protection Inspection Report 05000261/2004006 w/Attachment: Supplemental Information

REGION II==

Docket No.: 50-261 License No.: DPR-23 Report No.: 05000261/2004006 Licensee: Carolina Power and Light Company Facility: H. B. Robinson Steam Electric Plant, Unit 2 Location: 3581 West Entrance Road Hartsville, SC 29550 Dates: August 16 - 20, 2004 (Week 1)

August 30 - September 3, 2004 (Week 2)

Inspectors: R. Schin, Senior Reactor Inspector (Lead Inspector)

G. MacDonald, Senior Project Engineer C. Smith, Senior Reactor Inspector F. McCreesh, Fire Protection Inspector (Contractor)

Approved by: D. Charles Payne, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000261/2004006; 08/16 - 20/2004 and 08/30 - 09/03/2004; H. B. Robinson Steam Electric

Plant, Unit 2; Triennial Fire Protection.

The report covered an announced two-week period of inspection by three regional inspectors and one contractor inspector. Two Green non-cited violations and two unresolved items pending significance determinations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609,

Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

Cornerstone: Mitigating Systems

Green.

A non-cited violation of 10 CFR 50, Appendix R, Section III.G.2, was identified for relying on unapproved local manual operator actions instead of the required physical protection or separation of cables from fire damage. The operator actions were to be accomplished outside the main control room (MCR)and were relied on for hot safe shutdown from the MCR for a severe fire in the south cable vault or the B emergency diesel generator room. The licensee entered this issue into its corrective action program. The operator actions could reasonably be accomplished and are acceptable as compensatory actions until full compliance with the regulation is restored.

The finding adversely affected the reliability and capability of equipment required to achieve and maintain a safe shutdown condition following a severe fire. The finding degraded the defense-in-depth for fire protection. The finding is greater than minor because it is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective. Because the manual actions could reasonably be accomplished, the finding was determined to have very low safety significance. (Section 1R05.01.b)

Green.

A non-cited violation of Operating License Condition E, Fire Protection Program, was identified for failure to identify and correct a through-wall hole in a penetration seal fire barrier. The penetration seal was in a three-hour fire rated wall separating the Unit 2 cable spreading room from the turbine building. Upon discovery, the licensee declared the penetration seal inoperable, entered the issue into the corrective action program, and installed a temporary repair.

The finding adversely affected the reliability and capability of equipment required to achieve and maintain a safe shutdown condition following a severe fire. The finding adversely affected the fire confinement defense-in-depth element of fire protection. The finding is greater than minor because it is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone. Because the hole through the seal was small (less than about 1/8 inch in diameter), the finding was determined to have very low safety significance. (Section 1R05.09.b)

• TBD. A violation of 10 CFR 50, Appendix R, Sections III.G and III.L, was identified related to post-fire safe shutdown vulnerabilities described by the licensee in LER 05000261/2003003-00, Discovery Of Two New Appendix R Safe Shutdown Vulnerabilities. The violation has potential safety significance greater than very low significance because it adversely impacts the reliability and capability of equipment, including pressurizer power-operated relief valves (PORVs), PORV block valves, and charging pump suction valves, that is required to achieve and maintain safe shutdown following a severe fire.

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it degraded the defense-in-depth for fire protection. In addition, the finding is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective. The finding did not present an immediate safety concern and compensatory measures are in place while long-term corrective actions are being implemented. The finding is applicable to post-fire safe shutdown from outside the main control room during a fire in the cable spreading room, emergency switchgear room, or control room. (Section 4OA3.01)

• TBD. A violation of Operating License Condition E, Fire Protection Program, was identified for inadequate corrective actions for the conditions described in LER 05000261/2003003-00, Discovery Of Two New Appendix R Safe Shutdown Vulnerabilities. The licensees interim compensatory measures directed operators to close the pressurizer power-operated relief valve (PORV) block valves in response to a confirmed fire in the cable spreading room or emergency switchgear room, but did not de-energize the block valve circuits. Consequently, the block valves remained vulnerable to fire damage that could spuriously re-open them. The violation has potential safety significance greater than very low significance because it adversely impacts the reliability and capability of equipment, including pressurizer PORVs and PORV block valves, that is required to achieve and maintain safe shutdown following a severe fire.

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it degraded the defense-in-depth for fire protection. In addition, the finding is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective. The finding did not present an immediate safety concern and compensatory measures are in place while long-term corrective actions are being implemented. The finding is applicable to post-fire safe shutdown from outside the main control room during a fire in the cable spreading room or emergency switchgear room. (Section 4OA3.02)

Licensee-Identified Violations

None.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

The purpose of this inspection was to review the H. B. Robinson Nuclear Plant fire protection program (FPP) for selected risk-significant fire areas. Emphasis was placed on verification that the post-fire safe shutdown (SSD) capability [from both the main control room (MCR) and the dedicated shutdown (DS) system] and the fire protection features provided for ensuring that at least one redundant train of SSD systems is maintained free of fire damage. The inspection was performed in accordance with the U.S. Nuclear Regulatory Commissions (NRC) Reactor Oversight Process using a risk-informed approach for selecting the fire areas and attributes to be inspected. The inspection team used the licensees Individual Plant Examination for External Events and in-plant tours to choose three risk-significant fire areas for detailed inspection and review. The fire areas (zones) chosen for review during this inspection were:

• Fire Area (FA) A1, Fire Zone (FZ) 1; emergency diesel generator (EDG) B room; located in the auxiliary building on the 226 ft. level. SSD for a large fire in this zone is from the MCR.

• FA A5, FZ 19; cable spreading room; located in the auxiliary building on the 246 ft. level. SSD for a large fire in this zone is from outside the control room using the DS system.

• FA E, FZ 10; south cable vault; located in the auxiliary building on the 226 ft.

level. SSD for a large fire in this zone is from the MCR.

The inspection team evaluated the licensees FPP against applicable requirements, including Operating License Condition E, Fire Protection Program; Title 10 of the Code of Federal Regulations, Part 50 (10 CFR 50), Appendix R; 10 CFR 50.48; commitments to Appendix A of Branch Technical Position Auxiliary and Power Conversion Systems Branch 9.5-1; related NRC safety evaluation reports (SERs); and plant Technical Specifications (TS). The team also reviewed related FPP requirements, as described in the Updated Final Safety Analysis Report (UFSAR), including Section 9.5.1, Fire Protection System; Appendix 9.5.1.A, Fire Hazards Analysis; Appendix 9.5.1.B, Fire Protection Program Description; and Appendix 9.5.1.C, Post-Fire Safe Shutdown Analysis (SSA) Report. The team evaluated all areas of this inspection, as documented below, against these requirements.

Specific documents reviewed by the inspectors are listed in the attachment.

.01 Systems Required to Achieve and Maintain Post-fire Safe Shutdown

a. Inspection Scope

In addition to the requirements listed above, the team reviewed the licensees Appendix R and Station Blackout Safe-Shutdown Analysis Flowpath/Boundary Diagrams; SSD component lists; SSD cable routing data sheets; electrical elementary drawings; and related operating procedures to evaluate the licensees methodology for SSD in the event of a fire in one of the three selected FAs. The team also performed walkdown inspections of the three FAs. In addition, the team walked down the proceduralized operator actions that could be needed to achieve and maintain hot shutdown following a fire in any of the three FAs. The objectives of this review were to:

• Verify that the licensee's post-fire safe shutdown methodology had correctly identified the components and systems necessary to achieve and maintain SSD conditions.

• Confirm the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring and support system functions.

• Verify that SSD can be achieved and maintained with or without off-site power unless it can be confirmed that a postulated fire in any of the selected FAs could not cause the loss of off-site power.

• Verify that local manual operator actions are consistent with the plants fire protection licensing basis.

The team evaluated whether the SSA properly identified and categorized components in terms of safe shutdown function. Additionally, the team evaluated the SSA results of fire induced damage to the EDG undervoltage relay control cables to verify that safe shutdown could be achieved with or without a loss of offsite power (LOOP) for a fire in any of the selected FAs. The team also checked if instrumentation required for post-fire SSD (e.g., pressurizer level and steam generator level) was analyzed by the licensee to demonstrate that the instruments would be free from fire damage for the FAs inspected.

The SSD components which were reviewed for operability during and after a fire in each of the selected FAs are listed in the attachment. Drawings and operating procedures reviewed are also included in the attachment.

b. Findings

Unapproved Local Manual Operator Actions Instead of Required Physical Protection or Separation of Cables to Preclude Fire Damage

Introduction:

The team identified a non-cited violation (NCV) of 10 CFR 50, Appendix R, Section III.G.2, having very low safety significance (Green). The NCV was related to reliance on unapproved local manual operator actions for SSD instead of having the required physical protection or separation of cables from fire damage. The operator actions were to be accomplished outside the MCR and were relied on for achieving and maintaining hot SSD from the MCR for a severe fire in the south cable vault or the B EDG room. The operator actions could reasonably be accomplished and are acceptable as compensatory actions until full compliance with the regulation is restored.

Description:

The team noted that procedure DSP-005, Hot Shutdown From The Control Room With A Fire In Either Cable Vault, Rev. 15, relied on local manual operator actions to achieve and maintain hot SSD. Procedure EPP-4, Reactor Trip Response, Rev. 14, which was used for SSD from the MCR following a fire in B EDG Room, also relied on local manual actions to achieve and maintain hot SSD. The local manual operator actions were relied on instead of meeting the physical protection or separation requirements of 10 CFR 50, Appendix R, Section III.G.2. The licensee had not received NRC exemptions from these requirements for protecting cables from fire damage.

One local manual operator action included in this finding involved opening direct current (DC) breakers in the battery room to de-energize the solenoids for many air operated valves and consequently to prevent spurious actuations of the valves. With the DC breakers closed, fire damage to cables could cause spurious actuations of the valves to undesired positions that could adversely affect SSD. These valves included pressurizer power operated relief valves (PORVs) PCV-455C and PCV-456; letdown isolation valves LCV-460A, LCV-460B, and CVC-200A; and main steam isolation valves MS-V1-3A, MS-V1-3B, and MS-V1-3C. Other examples of local manual operator actions included in this finding were: opening manual valve CVC-358 to provide a suction source to the charging pumps, powering a condensate storage tank (CST) level indicator from the DS bus, powering vital battery chargers, and powering pressurizer heaters. The complete list of the local manual operator actions that are the subject of this finding is included in the attachment.

The team noted that, prior to the inspection, the licensee had reviewed these local manual operator actions against the feasibility criteria listed in NRC Inspection Procedure (IP) 71111.05, Enclosure 2, Inspection Criteria For Fire Protection Manual Actions, dated March 6, 2003. The team independently reviewed the actions and judged that they all met the criteria of Enclosure 2 and all could reasonably be accomplished.

Analysis:

This finding affected the reliability and capability of equipment required to achieve and maintain a SSD condition following a severe fire. The finding degraded the defense-in-depth for fire protection. The finding is greater than minor because it is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective. The finding is applicable to the south cable vault (FZ 10) and the B EDG room (FZ 1). Because the manual actions could reasonably be accomplished, the finding was determined to be of very low safety significance (Green).

Enforcement:

10 CFR 50.48(b)(1) requires, in part, that all nuclear power plants licensed to operate prior to January 1, 1979, must satisfy the applicable requirements of Appendix R,Section III.G.Section III.G.2 applies to the ability to achieve and maintain hot SSD from the control room during a fire. It states, in part, that where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, one of three means of protecting cables to ensure that one of the redundant trains is free of fire damage shall be provided. The three means involve physical protection or separation of cables to preclude fire damage - III.G.2 does not allow local manual operator actions in lieu of protection.

Contrary to the above, on September 3, 2004, local manual operator actions were relied on for post-fire hot SSD instead of physical protection or separation of cables to preclude fire damage. These actions were in procedures DSP-005, Rev. 15 and EPP-4, Rev. 19 and are listed in the Attachment. Because this violation is of very low safety significance and because it has been entered into the corrective action program (AR 00136518), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000261/2004006-001, Unapproved Local Manual Operator Actions Instead of Required Physical Protection or Separation of Cables to Preclude Fire Damage. The operator actions could reasonably be accomplished and are acceptable as compensatory actions until full compliance with the regulation is restored.

.02 Fire Protection of Safe Shutdown Capability

a. Inspection Scope

For the selected fire areas, the team reviewed the following documents which established and implemented controls and practices to prevent fires and to control the storage of permanent and transient combustible materials and ignition sources. This review was performed to ensure that the objectives established by the NRC-approved fire protection program were satisfied.

• FP-001, Fire Emergency, Revision (Rev.) 43

• FP-003, Control of Transient Combustibles, Rev. 19

• FP-004, Duties of a Fire Watch, Rev. 13

• FP-006, Handling of Flammable Liquids and Gases, Rev. 3

• FP-010, Housekeeping Controls, Rev. 22

• FP-013, Fire Protection Systems Surveillance Requirements, Rev. 9

• FP-014, Control of Fire Barrier Penetrations, Rev. 8

• OMM-002, Fire Protection Manual, Rev. 35

• OMM-003, Fire Protection Pre-Plans / Unit 2, Rev. 40 The team toured the selected plant fire zones to observe:

(1) the material condition of fire protection systems and equipment,

(2) the storage of permanent and transient combustible materials, and

(3) the licensees implementation of the procedures for limiting fire hazards, housekeeping practices, and cleanliness conditions. These reviews were accomplished to ensure that the licensee was maintaining the fire protection systems, had properly evaluated in-situ combustible fire loads, controlled hot-work activities, and limited transient fire hazards in a manner consistent with the plant administrative and FPP procedures.

The team reviewed the fire brigade staging and dress-out areas to assess the operational readiness of fire fighting and smoke control equipment. The fire brigade personal protective equipment and the self contained breathing apparatuses were reviewed for adequacy and functionality. The team also reviewed operator and fire brigade staffing, fire brigade response, fire brigade qualification training, and the fire brigade drill program procedures. Fire brigade response to drill scenarios were reviewed for the past year.

The team also reviewed the fire fighting pre-plans for the selected fire zones to determine if appropriate information was provided to the fire brigade members to identify equipment important to safe shutdown and to facilitate fire suppression of a fire that could impact safe shutdown capability.

In addition, the team reviewed the adequacy of the design and installation of the fire suppression system for the three selected FAs. This was accomplished by reviewing the engineering design drawings, suppression system vendor calculations and analysis, and as-built system configuration for suppression system location requirements to check that they were consistent with the code of record and code compliance documents.

b. Findings

No findings of significance were identified.

.03 Post Fire Safe Shutdown Circuit Analysis

a. Inspection Scope

The team performed an independent review of selected SSD equipment, including a number of valves, instruments, and other equipment, which the licensee credited for mitigating a fire in each of the three selected FAs. This review included examination of the Safe Shutdown Component Index; Electrical Distribution Procedures; Safe Shutdown Cable Schedule; FPP-RNP-300, Table 6-1, Separation Discrepancy Resolution; and control wiring diagrams.

The team also performed circuit analysis of SSD equipment in order to evaluate the potential for spurious valve operations or malfunctions of SSD equipment from fire induced damage in the three FAs choosen. The criteria for acceptance was that a fire in any of the FAs will not defeat the capability to achieve and maintain safe hot shutdown.

The scope of the safe shutdown equipment reviewed included pressurizer PORVs PCV-455C and PCV-456 and pressurizer PORV block valves RC-535 and RC-536.

Additionally, the team reviewed fuse and circuit breaker coordination studies for the on-site emergency electrical distribution system and the 480 VAC DS Bus in order to verify that selective coordination had been established for power supplies to safe shutdown equipment required to be operable for a fire in any of the selected FAs. Specific breakers and circuits reviewed are listed in the attachment to this report.

b. Findings

Performance in this area contributed to two findings, which are discussed in Section 4OA3.

.04 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the licensees SSD Component/Cable Separation Analysis, and walked down the FAs to determine the plant configuration, in order to evaluate the adequacy of the licensees safe shutdown mitigation strategy for post-fire SSD from outside the MCR during a fire in the cable spreading room. The objectives of this evaluation were to:

• Verify that the licensee's alternative shutdown methodology had correctly identified the components and systems necessary to achieve and maintain hot SSD conditions.

• Confirm the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and support system functions.

• Verify that hot SSD from outside the MCR can be achieved and maintained with or without offsite power.

The inspectors reviewed, on a sample basis, control wiring diagrams showing the control circuits for selected SSD components. Additionally, the inspectors evaluated cable routing information for selected SSD components in order to verify that transfer of controls from the MCR to the charging pump room panel would not be affected by fire in this area. The inspectors evaluated the transfer circuits to confirm that double fusing had been provided in accordance with the recommendations of IE Information Notice No. 85-09: Isolation Transfer Switches and Post Fire Shutdown Capability.

b. Findings

Performance in this area contributed to two findings, which are discussed in Section 4OA3.

.05 Operational Implementation of SSD Capability

a. Inspection Scope

The team reviewed the operational implementation of the SSD capability that would be used during a severe fire in one of the selected FAs. Training program records were reviewed to verify that licensed personnel training included both control room and alternative SSD using the dedicated shutdown procedures (DSPs), emergency operating procedures (EOPs), and abnormal operating procedures (APs). Staffing records for both day shift and night shift for selected dates (1/1/04, 3/9/04, 7/4/04, and 7/5/04) were reviewed to verify that the staffing would meet the minimum required to implement alternative SSD required by TS 5.2.2 and staff the fire brigade required by the FPP. The team also reviewed the last completed surveillance test results for operability testing of alternative SSD transfer and control functions listed below to verify that the testing demonstrated alternative SSD instrumentation functionality and SSD equipment capability from the alternate control locations.

• OST-906, Emergency Control Station Test (Refueling), completed on 5/20/04, 5/22/04, and 5/23/04.

• OST-918, Dedicated Shutdown Equipment and Instrumentation Check (Monthly),completed on 8/27/04.

The team reviewed the following procedures and the licensees procedure validation results to verify that the operators could accomplish SSD with the procedures within the time requirements established in the SSD licensing basis. The team also conducted detailed walkthroughs of portions of the procedures that involved operator actions outside of the control room. The team focused on timing and human factors aspects to verify that the procedures as written were adequate to achieve SSD for a fire in any of the selected FAs.

• DSP-001, Alternate Shutdown Diagnostic, Rev. 6

• DSP-002, Hot Shutdown Using The Dedicated/Alternate Shutdown System, Rev. 30

• DSP-005, Hot Shutdown From the Control Room With a Fire In Either Cable Vault, Rev. 15

• EPP-4, Reactor Trip Response, Rev. 19

• EPP-21, Energizing Pressurizer Heaters From Emergency Buses, Rev. 14

• FP-001, Fire Emergency, Rev. 43

• OP-402, Auxiliary Feedwater System, Rev. 61

• OP-601, DC Supply System, Rev. 37

b. Findings

No findings of significance were identified.

.06 Communications

a. Inspection Scope

The team reviewed plant communication capabilities to evaluate the availability of the communication systems which would be utilized for SSD during severe fires in the selected FAs. Post-fire SSD procedures called for use of portable radios. The team reviewed the radio storage locations to verify that adequate equipment was maintained in a charged and ready status to meet the SSD procedural requirements. The inspectors evaluated the portable radio repeater system to verify that it would not be affected by a fire in any of the selected FAs.

b. Findings

No findings of significance were identified.

.07 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting for access, egress, control stations, and local manual operator actions for SSD during severe fires in the selected FAs. During procedure walkthroughs, the team checked installed emergency lighting units (ELUs) to verify that illumination would be adequate to perform the procedural actions. The team also requested and observed a licensee test of the emergency lighting in the battery room, including turning off the normal lighting. In addition, the team reviewed ELU location drawings HBR2-11324 sheets 1-5 and procedure EDP-011, Dedicated/

Shutdown Emergency Lighting Units, to verify that these documents were consistent with the installed ELUs. Further, the team reviewed emergency lighting exemptions as addressed in NRC letters dated June 30,1988; October 2, 1992; October 8, 1992; and a CP&L letter dated September 29, 1995. ELU operability, condition checks, and ELU aiming were reviewed against the requirements of procedure PM-459, Self-Contained DC Emergency Lighting System. The team also reviewed operational testing for selected ELUs (ELS-53, 110, 67, 96, 7, and 39) by review of work orders 00064214, 00064211, 00064218, 00202086, and work requests AAHS002, AIAC-002, and 99-AFAGI to verify that the testing demonstrated at least an 8-hour capacity.

b. Findings

No findings of significance were identified.

.08 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed procedures and materials needed for cold shutdown repairs to verify that the repairs could be accomplished within the time restraints of the SSA and licensing basis. Operational Surveillance Test Procedure OST-922, Repair Equipment Checklist, was reviewed to identify the components stored in the bulk warehouse, to verify that selected materials were physically present in the warehouse, and to verify that the materials were properly labeled. The team specifically evaluated Attachment 10.2 of that procedure to confirm that replacement parts required for repairs to the pressurizer PORVs were available from storage. The team also reviewed procedure DSP-012, Pressurizer PORV Control/Power Repair Procedure to verify that repairs could be accomplished within the time restraints. In addition, the team reviewed and evaluated repair procedures used for making repairs to the residual heat removal (RHR)pump motor power cables, RHR system flow indications, and RHR flow control valves.

b. Findings

No findings of significance were identified.

.09 Fire Barriers and Penetration Seals

a. Inspection Scope

The team reviewed the selected FAs to evaluate the adequacy of the fire resistance of fire area barrier enclosure walls, ceilings, floors, fire barrier mechanical and electrical penetration seals, fire doors, and fire dampers. This was accomplished by observing the material condition and configuration of the installed fire barrier features, as well as reviewing construction details and supporting fire endurance tests for the installed fire barrier features, to verify the as-built configurations were qualified by appropriate fire endurance tests.

The team also reviewed the fire barriers shown on the fire plan drawings for the selected FAs and walked down these areas to evaluate the adequacy of the fire resistance of the installed barriers. The team selected several fire barrier penetration seals, fire dampers, and fire doors for evaluation and inspection to verify proper installation and qualification.

The team also reviewed licensee evaluations of the non-standard fire barrier penetration seals for each of the selected fire zones.

Additionally, the team reviewed licensing documentation, engineering evaluations for the fire barrier features, and National Fire Protection Association (NFPA) code compliance documents and code deviations to verify that the fire barrier installations met design requirements and license commitments. Further, the team reviewed surveillance and maintenance procedures for selected fire barrier features to verify the fire barriers were being adequately maintained. The team also verified that adequate evaluation and testing had been conducted to ensure that the various fire dampers in the selected fire zones would close with the given room ventilation conditions.

b. Findings

Inoperable Penetration Seal

Introduction:

The team identified an NCV of Operating License Condition E, Fire Protection Program, having very low safety significance (Green). The NCV was related to an inoperable penetration seal in a three-hour fire rated wall separating the Unit 2 cable spreading room from the turbine building.

Description:

The team identified an opening in a penetration seal through which a steady stream of cool air from the Unit 2 cable spreading room to the turbine building could be felt. The team determined that a small, through penetration crack existed in 3-hour silicone foam penetration seal CP-6310.00-FB-25. The crack in the penetration seal was judged to be approximately equivalent to a 1/8 inch diameter hole through the barrier. The acceptance criteria for 3-hour penetration seals was established in OST-623, Fire Barrier Penetration Seal Inspection (18 Months), Rev. 18, Section 8.2 and 10.1. The criteria stated in part that for silicone foam seals there must be 12 inches of foam in place with no holes, tears, rips, missing pieces, or excessive shrinkage.

Licensee personnel promptly evaluated the condition and declared the seal inoperable.

In addition, they installed an interim temporary fix within a few hours of being notified of the condition. Further, licensee personnel completed a permanent repair of the penetration seal during the course of the inspection.

Analysis:

The inoperable penetration seal represented a licensee performance deficiency because the hole in the seal would be expected to be identified and corrected by the criteria contained in OST-623. The finding aversely affected the fire confinement capability defense-in-depth element. The finding is greater than minor because it is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective.

Using IMC 0609, Appendix F, Fire Protection Significance Determination Process, the team assessed the defense-in-depth (DID) element of fire barrier degradation in the fire confinement category. Based on the finding being an approximately 1/8 inch diameter through-barrier hole in an elastomeric low density silicone foam seal, the degradation level was categorized as low (IMC 0609, Appendix F, Attachment 2, Table A2.2).

Consequently, the significance was determined to be Green.

Enforcement:

Operating License Condition E, Fire Protection Program, requires that all provisions of the approved FPP as described in the UFSAR be implemented and maintained in effect. UFSAR Section 9.5.1.6 states that a periodic testing and surveillance program has been established to verify the ability of the Fire Protection System components to function as required and that these criteria are contained in plant procedures. OST-623, Fire Barrier Penetration Seal Inspection (18 Months), Section 8.2 and Attachment 10.1 established the acceptance criteria for 3-hour penetration seals. The acceptance criteria stated in part that for RTV silicone foam seals there must be 12 inches of foam in place with no holes, tears, rips, missing pieces or excessive shrinkage.

Contrary to the above, on August 17, 2004, the NRC team found that penetration seal CP-6310.00-FB-25 had a through-barrier hole between the Unit 2 cable spreading room and the turbine building. Because the finding is of very low safety significance and has been entered into the licensees corrective action program (AR 0136122), this violation is being treated as an NCV, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000261/2002006-002, Inoperable Fire Barrier Penetration Seal.

10. Fire Protection Systems, Features, and Equipment

a. Inspection Scope

The team reviewed UFSAR Section 9.5.1, which discussed fire protection code deviations and administrative procedures used to prevent fires and control combustible hazards and ignition sources. This review was performed to verify that the objectives established by the NRC-approved FPP were satisfied. The team also toured the selected plant fire zones to observe the licensees implementation of these procedures.

The team reviewed the water supply system, operational valve lineups, and system availability associated with the fire pumps. The inspection team examined the electric motor-driven fire pump and the diesel engine-driven fire pump to observe system material condition, evaluate the as-built configuration of the systems, and to check for proper system controls and valve lineups.

The team reviewed the adequacy of the design and installation of the automatic detection and alarm system for the selected fire zones. This was accomplished by reviewing the as-built configuration of the detector layout relative to the construction characteristics of the selected fire zones. The inspection team reviewed the code compliance analyses for the selected fire areas as well as the justification for any code deviations.

The team reviewed the fire protection pre-plans and fire strategies to check the proximity of fire hose locations to adequately reach the selected fire areas for manual fire fighting efforts. The team reviewed the manual suppression standpipe and fire hose system to verify adequate design, installation, and operation in the selected fire zones.

Hose stations in the selected areas were inspected to ensure that hose lengths depicted on the engineering documents were also the hose lengths located in the field. This was done to verify that installed fire hoses could effectively support manual fire fighting efforts in the selected fire areas.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The team reviewed the compensatory measures and administrative controls for out-of-service or inoperable fire protection features. The review was performed to verify that the risk associated with removing fire protection systems or components from service was adequately addressed and compensatory measures were implemented in accordance with the FPP. Selected records of inoperable equipment were reviewed to verify that appropriate compensatory measures were invoked and that the inoperable equipment was returned to service in a reasonable period of time. The team also reviewed the interim compensatory measures put in place for the SSD deficiencies identified in Licensee Event Report (LER) 05000261/2003003-00.

b. Findings

Performance in this area contributed to one finding, which is discussed in Section 4OA3.02.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The team reviewed selected licensee audits, self assessments, and ARs to verify that items related to fire protection and SSD were appropriately entered into the licensees corrective action program in accordance with the licensees quality assurance program and procedural requirements. This review included ARs related to fire protection, post-fire SSD, and related operating experience. In addition, the team reviewed LER 05000261/2003003-00, Discovery of Two New Appendix R Safe Shutdown Vulnerabilities, and the licenses interim corrective actions for the conditions described in the LER.

b. Findings

Performance in this area contributed to two findings, which are discussed in Section 4OA3.

4OA3 Event Folllowup

.01 (Closed) LER 05000261/2003003-00, Discovery Of Two New Appendix R Safe

Shutdown Vulnerabilities

Introduction:

A finding was identified related to SSD deficiencies described by the licensee in LER 05000261/2003003-00. The finding is applicable to SSD from outside the MCR during a fire in the cable spreading room (FZ 19), emergency switchgear room (FZ 20), or control room (FZ 22). This finding is an unresolved item (URI) pending completion of the NRC significance determination process (SDP). This finding involves a violation of NRC requirements; however, its safety significance has not been determined and could potentially be greater than very low significance. The finding did not present an immediate safety concern and compensatory measures are in place while long-term corrective actions are being implemented.

Description:

LER 05000261/2003003-00 described the licensee identification in November 2003 of two vulnerabilities of cables to fire damage that could result in an unrecoverable condition. The LER stated that this could be caused by a fire in the cable spreading room (FZ 19) or the emergency switchgear room (FZ 20). The two vulnerabilities included:

• Potential spurious failure open of both air-operated pressurizer PORVs (PCV-455C and PCV-456). This scenario involved postulated a LOOP and failure of both EDGs being caused by the fire so that the PORV block valves would have no power and could not be closed. The scenario could cause a rapid drop in reactor coolant system (RCS) pressure and the loss of an unrecoverable amount of RCS coolant in less than 10 minutes. The LER stated that a simulator run for the event showed that two failed open PORV flowpaths would result in formation of a void in the reactor vessel head in about 90 seconds.

• Potential spurious failure closed of the motor-operated charging pump suction valve from the volume control tank (LCV-115C) and the air-operated charging pump suction valve from the refueling water storage tank (LCV-115B). If offsite power remained available during the event and the A charging pump was one of the two charging pumps normally running at the time of the event, a loss of suction could damage the pump. Loss of the A charging pump would represent loss of the DS RCS makeup function.

The team verified that both pressurizer PORVs and both charging pump suction valves had control circuit cables in the cable spreading room and in the emergency switchgear room. Also, the valves were vulnerable to spurious actuations that could be caused by fire damage to those cables. In addition, the team found that all four of the valves were vulnerable to spurious actuations that could be caused by a fire in one other area, the MCR (FZ 22).

The team found another vulnerability that was not addressed in the LER. Cables for both PORV block valves (RC-535 and RC-536) were also vulnerable to fire damage in the same three areas. Further, in the cable spreading room, cables for both PORV block valves were in the same cable tray (tray R40) with cables for both PORVs and both charging pump suction valves. Tray R40 was directly above 12 open relay racks, which were fire ignition sources. The team considered that a fire in one or more of the relay racks could potentially damage all of these cables if the automatic Halon system failed to immediately extinguish the fire.

The team determined that the minimum number of cable failures (and spurious actuations) of concern was two. The two failures could be spurious failure open of one PORV and failure of the related block valve in its normal open position. These failures would result in a LOCA that was not isolable from the control room. Such a LOCA would rapidly decrease RCS pressure and could result in a steam void forming in the reactor vessel head within about four minutes. Formation of a steam void in the reactor vessel head would not be consistent with the requirements of 10 CFR 50, Appendix R, Section III.L.Section III.L. requires that during alternative or dedicated post-fire shutdown, the RCS process variables shall be maintained within those predicted for a loss of normal alternating current (AC) power. During a loss of normal AC power event, RCS pressure does not drop sufficiently to cause formation of a steam void in the reactor vessel head. The team concluded that to meet the requirements of Section III.L, the licensee would need to prevent pressurizer PORVs from spuriously opening due to fire damage, especially in areas where the fire could also affect the PORV block valves (i.e., the cable spreading room, emergency switchgear room, and control room).

The team noted that NRC Fire Protection SERs dated August 8, 1984, and November 21, 1985, described details of how the licensee would meet the requirements of 10 CFR 50, Appendix R for alternative/dedicated safe shutdown. The SERs stated that the licensee would de-energize the pressurizer PORVs early in fire scenarios to prevent spurious operation. (The SERs referenced licensee letters to the NRC of February 6, 1984, and June 18, 1985.) The team found that licensee actions to de-energize the PORVs were in procedure DSP-002, Hot Shutdown Using the Dedicated/Alternate Shutdown System. However, procedure DSP-001, Alternate Shutdown Diagnostic, directed operators to enter DSP-002 only when the fire had caused sufficient equipment failures so that emergency operating procedures could not maintain control of the plant.

A senior reactor operator stated that if a fire failed pressurizer PORVs open and the block valves could not be closed, operators would not enter DSP-002 unless all safety injection was also failed. The team concluded that the actions in DSP-002 would not occur soon enough to prevent spurious operation of the pressurizer PORVs.

Analysis:

The finding adversely impacted the reliability and capability of equipment required to achieve and maintain SSD following a severe fire. The finding degraded the defense-in-depth for fire protection. The finding is greater than minor because it is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective. The finding is applicable to FZ 19, FZ 20, and FZ 22 and is unresolved pending the completion of a significance determination.

Enforcement:

10 CFR 50.48(b)(1) requires, in part, that all nuclear power plants licensed to operate prior to January 1, 1979, must satisfy the applicable requirements of Appendix R,Section III.G.Section III.G invokesSection III.L, which requires that the alternate or dedicated post-fire SSD capability shall be able to achieve and maintain hot standby conditions and the reactor coolant system process variables shall be maintained within those predicted for a loss of normal alternating current power. Also, 10 CFR 50, Appendix R, and related NRC Fire Protection SERs dated August 8, 1984, and November 21,1985, confirmed the licensees compliance with Sections III.G. and III.L and required that where alternate or dedicated shutdown is relied upon, the pressurizer PORVs must be de-energized early in fire scenarios to prevent spurious operation.

Contrary to the above, prior to November 19, 2003, the licensees alternative/dedicated post-fire SSD capability for a fire in FZs 19, 20, or 22 did not meet these requirements.

Plant procedures would not de-energize the pressurizer PORVs early in fire scenarios to prevent spurious operation. Further, spurious operation of the PORVs could cause a steam void in the reactor vessel head and failure to maintain RCS process variables within those predicted for a loss of normal AC power. Additionally, spurious operation of the charging pump suction valves could result in damage to the A charging pump, which in turn could result in failure to maintain RCS process variables (e.g., pressurizer level) within those predicted for a loss of normal AC power. These nonconforming conditions have existed since the requirements of Appendix R became applicable in 1984 and 1985. Pending completion of a significance determination, this finding is identified as URI 05000261/2004006-03, Appendix R Safe Shutdown Vulnerabilities.

.02 Inadequate Corrective Actions for Appendix R Safe Shutdown Vulnerabilities

Introduction:

A finding was identified regarding the adequacy of the interim corrective actions established by the licensee for the conditions described in LER 05000261/

2003003-00. This finding is applicable to SSD from the MCR during a fire in the cable spreading room (FZ 19) or emergency switchgear room (FZ 20). The finding is a URI pending completion of the NRC SDP. This finding involves a violation of NRC requirements; however, its safety significance has not been determined and could potentially be greater than very low significance. The finding did not present an immediate safety concern and compensatory measures are in place while long-term corrective actions are being implemented.

Description:

As described in LER 05000261/2003003-00, the licensee established interim compensatory measures in the form of new operator actions in procedure FP-001, Fire Emergency. Upon confirming the existence of a fire in the cable spreading room or the emergency switchgear room, operators were directed to close the pressurizer PORV block valves (RC-536 and RC-535) and to verify that the A charging pump was not running. However, the NRC team determined that these corrective actions were not adequate because they did not include de-energizing the PORV block valve control circuits. Consequently, the fire could cause the PORV block valves to spuriously re-open after being closed by the control room operators.

After the team identified this concern, the licensee initiated AR 00136517, Additional Compensatory Measures Needed for LER 2003003. In addition, the licensee revised procedure FP-001 before the end of the inspection so that: 1) for a confirmed fire in the cable spreading room, operators were directed to close the pressurizer PORV block valves and open their respective circuit breakers in the emergency switchgear room; and 2) for a confirmed fire in the emergency switchgear room, operators were directed to de-energize the pressurizer PORVs by operating PORV test switches in the cable spreading room. For a fire in the control room, the licensee determined that operators would be present in the control room during power operations and could be expected to recognize and extinguish a fire in the control panels before damage would occur to multiple circuits. Consequently, no additional compensatory measures were identified for the control room.

Analysis:

The finding adversely impacted the reliability and capability of equipment required to achieve and maintain SSD following a severe fire. The finding degraded the defense-in-depth for fire protection. The finding is greater than minor because it is associated with the protection against external factors attribute and degraded the reactor safety mitigating systems cornerstone objective. The finding is applicable to FZ 19 and FZ 20 and is unresolved pending the completion of a significance determination.

Enforcement:

Operating License Condition E, Fire Protection Program, requires that the licensee maintain all provisions of the approved Fire Protection Program as described in the UFSAR and as approved in the Fire Protection SER dated February 28, 1978, including supplements. The UFSAR states that the plant will meet the guidelines of 6, Quality Assurance, of the NRC August 4, 1977 letter, Nuclear Plant Fire Protection Functional Responsibilities, Administrative Control, and Qualilty Assurance.

The CP&L Corporate Quality Assurance Program Manual, NGGM-PM-007, Rev. 7, Section 15.7, implements that requirement and requires that Conditions Adverse to Quality of fire protection items shall be identified, reported, dispositioned, and corrected in accordance with Section 12.0 of NGGM-PM-007. Section 12.5.1.6 of NGGM-PM-007 requires that corrective action appropriate for the condition be determined and scheduled for timely implementation.

Contrary to the above, the licensee did not implement corrective actions appropriate for the conditions described in LER 05000261/2003003-00. The interim compensatory corrective actions were not adequate because they left the pressurizer PORV block valves vulnerable to fire damage that could spuriously re-open them. This condition has existed since November 19, 2003. Pending completion of a significance determination, this finding is identified as URI 05000261/2004006-04, Inadequate Corrective Actions For Appendix R Safe Shutdown Vulnerabilities.

4OA6 Meetings, Including Exit

On September 3, 2004, the lead inspector presented the inspection results to Mr. J. Moyer and other members of his staff who acknowledged the findings.

Proprietary information was reviewed during the inspection, but is not included in this report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

G. Attarian, Chief Engineer (Corporate)

C. Baucom, Supervisor, Licensing/Regulatory Programs

B. Clark, Manager, Nuclear Assessment

C. Church, Manager, Engineering

J. Ertman, Fire Protection Engineer (Corporate)

B. Gerwe, Fire Protection Engineer

R. Hightower, Fire Protection Engineer

J. Huegel, Manager, Maintenance

R. Ivey, Manager, Operations

G. Ludlam, Manager, Training

F. Modlin, Safe Shutdown Engineer

J. Moyer, Site Vice President

V. Smith, Operations Procedures Engineer

D. Stoddard, Plant General Manager

T. Tovar, Manager, Shift Operations

NRC Personnel

P. Fredrickson, Branch Chief, Division of Reactor Projects, RII

D. Jones, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000261/2004006-03 URI Appendix R Safe Shutdown Vulnerabilities (Section 4OA3.01)

05000261/2004006-04 URI Inadequate Corrective Actions For Appendix R Safe Shutdown Vulnerabilities (Section 4OA3.02)

Opened and Closed

05000261/2004006-001 NCV Unapproved Local Manual Operator Actions Instead of Required Physical Protection or Separation of Cables to Preclude Fire Damage (Section 1R05.01.b)

05000261/2002006-002 NCV Inoperable Fire Barrier Penetration Seal (Section 1R05.09.b)

Closed

05000261/2003003-00 LER Discovery Of Two New Appendix R Safe Shutdown Vulnerabilities (Section 4OA3.01)

Discussed

None LIST OF COMPONENTS INSPECTED Section 1R05.03: Post-Fire Safe Shutdown Circuit Analysis Component Identification Description AFW-PMP-A Auxiliary Feedwater Pump A AFW-V2-14A SDAFW Pump FW. Discharge to S/G A AFW-V2-14B SDAFW Pump FW. Discharge to S/G B AFW-V2-14C SDAFW Pump FW. Discharge to S/G C CC-0716A Cooling Water Inlet Valve CC-0716B Cooling Water Inlet valve CCW-PMP-A Component Cooling Water Pump A CCW-PMP-B Component Cooling Water Pump B CCW-PMP-C Component Cooling Water Pump C CHG-PMP-A Charging Pump A CHG-PMP-B Charging Pump B CHG-PMP-C Charging Pump C CVC-0310A Charging to Loop A Hot Leg CVC-0310B Charging to Loop B Cold Leg CVC-0387 Excess Letdown Line Stop Valve FCV-1424 MDAFW Pump A Flow Control Valve FCV-0626 Thermal Barrier Outlet Valve FO-XFER-PMP-B EDG B Fuel Oil Transfer Pump HCV-0121 Charging Flow HVCA-7B AFW Pump Room Fan Unit B HVA-1A Air Handler for Control Room Heating and Cooling HVE- 5 EDG Room B Supply Fan HVE-6 EDG Room A Supply Fan HVE-17 EDG Room B Exhaust Fan HVE-18 EDG Room A Exhaust Fan HVE-19A Control Room Emergency Air Handler LCV-0460A Letdown Isolation Valve LCV-0460B Letdown Isolation Valve LCV-0115B RWST Outlet Valve LCV-0115C VCT Outlet Valve LT-1454A Condensate Tank Storage Level

LT-607A Steam Generator A Level LT-607D Pressurizer Level MS-V1-8A S/G A Steam Supply Valve to SDAFW Pump.

MS-V1-8B S/G B Steam Supply Valve to SDAFW Pump MS-V1-8C S/G C Steam Supply Valve to SDAFW Pump PCV-0455C Pressurizer PORV PCV-0456 Pressurizer PORV PT-607E Pressurizer Pressure RC-0535 Pressurizer Block Valve RC-0536 Pressurizer Block Valve RC-0567 Reactor Vessel Head Vent Solenoid Isolation valve RC-0568 Reactor Vessel Head Vent Solenoid Isolation valve RC-0569 Pressurizer Vent Solenoid Isolation Valve RC-0570 Pressurizer Vent Solenoid Isolation Valve RC-0571 Pressurizer Vent Solenoid Isolation Valve RC-0572 CV Atmosphere Solenoid Isolation Valve SW-PMP-A Service Water Pump A SW-PMP-D Service Water Pump D TE-410 Cold Leg temperature Loop A TE-413 Hot Leg Temperature Loop A TE-413-1 Hot Leg Temperature Loop A V6-12A South Service Water Header Supply V6-12B Service Water Pump Disch. Header Cross-Connect V6-12C Service Water Discharge Header Cross-Connect V6-16A Service Water North Header Supply to Turbine Bldg.

V6-16B Service Water South Header Supply to Turbine Bldg.

V6-16C Service Water Isolation to Turbine Bldg 27UV/E1 EDG A Auto-Start and 480 V Bus E1 Clearing Logic Section 1R05.03 Fuse/Breaker Coordination 480 V Emergency Bus E1, Circuit Breakers 52/17B and 52/19B.

480 V Emergency Bus E1, Circuit Breakers 52/18B and 52/19B.

480 V Emergency Bus E2, Circuit Breakers 52/27B and 52/24B.

480 V Emergency Bus E2, Circuit Breakers 52/28B and 52/52/24B.

480 V DS Bus, Circuit Breakers 52/32B and 52/34D 480 V MCC 5, Circuit Breakers 52/34C, 52/11BR and 52/7M LIST OF NONCONFORMING LOCAL MANUAL OPERATOR ACTIONS Section 1R05.01.b.: Unapproved Local Manual Operator Actions for SSD Instead of the Required Physical Protection or Separation of Cables Procedure/Step Manual Action Description DSP-005 / 2 Open breakers to Panels D-C & G-C

DSP-005 / 14.A Manual operation of CVC-358 in Charging Pump Room DSP-005 / 21 Local verification of breaker status on MCC-5 DSP-005 / 23 Local verification of breaker status on MCC-6 DSP-005 / 24 RNO step if necessary to restart tripped Battery Charger using OP-601 DSP-005 / 36 RNO step to align Pzr Htrs to emergency buses using EPP-21 DSP-005 / 37 RNO step to align CST level from DS Bus using attachment 6 EPP-4 / 32 Restart Battery Chargers within 60 minutes following LOOP EPP-4 / 34 Restore Pressurizer Heater Power [Establish power from EDGs using procedure EPP-21]