IR 05000280/2003007

IR 05000280-03-007 and IR 05000281-02-007 on 01/24/03 - 01/31/03 and 2/10/03 - 02/14/03, for Virginia Electric and Power Company; Surry, Units 1 and 2; Triennial Fire Protection; Safety System Design and Performance Capability

ML030930560
Person / Time
Site:	Surry
Issue date:	03/31/2003
From:	Ogle C NRC/RGN-II/DRS/EB
To:	Christian D Virginia Electric & Power Co (VEPCO)
References
IR-03-007
Download: ML030930560 (45)

Text

March 31, 2003

SUBJECT:

SURRY POWER STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 50-280/03-07 AND 50-281/03-07

Dear Mr. Christian:

On February 14, 2003, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Surry Power Station, Units 1 and 2. The enclosed inspection report documents the inspection findings, which were discussed on that date with Mr. T. Sowers and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents four findings that have potential safety significance greater than very low significance, however a safety significance determination has not been completed. One issue did present an immediate safety concern and compensatory measures were put in place on February 13, 2003. A plant modification was installed on February 19, 2003 correcting the problem. The other three issues did not present an immediate safety concern.

In addition, the report documents two NRC-identified findings of very low safety significance (Green), both of which were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these two findings as non-cited violations (NCVs)

consistent with Section VI.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Surry Power Station.

VEPCO

In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publically Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37

Enclosure:

Inspection Report 50-280, 281/03-07 w/Attachment: Supplemental Information

REGION II==

Docket Nos.:

50-280, 50-281 License Nos.:

DPR-32, DPR-37 Report No.:

50-280/03-07 and 50-281/03-07 Licensee:

Virginia Power and Electric Company (VEPCO)

Facility:

Surry Power Station Location:

5850 Hog Island Road Surry, VA 23883 Dates:

January 24 - 31, 2003 (Week 1)

February 10 - 14, 2003 (Week 2)

Inspectors:

P. Fillion, Reactor Inspector G. McCoy, Resident Inspector, Surry Power Station C. Payne, Fire Protection Team Leader (Lead Inspector)

S. Walker, Reactor Inspector G. Wiseman, Fire Protection Inspector Approved by:

Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety

CONTENTS REACTOR SAFETY......................................................... 1 1R05 Fire Protection........................................................ 1

.01 Systems Required to Achieve and Maintain Post-Fire Safe Shutdown............. 1

.02 Fire Protection of Safe Shutdown Capability................................. 2

.03 Post-Fire Safe Shutdown Circuit Analysis................................... 3

.04 Alternative Shutdown Capability.......................................... 4

.05 Operational Implementation of Alternative Shutdown Capability.................. 5

.06 Communications..................................................... 16

.07 Emergency Lighting................................................... 17

.08 Cold Shutdown Repairs................................................ 17

.09 Fire Barriers and Fire Area/Zone/Room Penetration Seals..................... 18

.10 Fire Protection Systems, Features, and Equipment........................... 19

.11 Compensatory Measures............................................... 22 1R21 Safety System Design and Performance Capability........................... 23

.01 Review of Output Breaker Circuitry for Emergency Diesel Generator No. 3........ 23 OTHER ACTIVITIES........................................................ 25 4OA2 Identification and Resolution of Problems.................................. 25 4OA6 Meetings, Including Exit................................................ 25 ATTACHMENT: SUPPLEMENTAL INFORMATION Key Points of Contact........................................................ 1 List of Items Opened, Closed, and Discussed...................................... 1 List of Documents Reviewed................................................... 2 List of Acronyms........................................................... 9

SUMMARY OF FINDINGS

IR 05000280/2003-007, 05000281/2003-007; Virginia Power & Electric Company; 1/24-

31/2003 and 2/10-14/2003; Surry Power Station, Units 1 and 2; Triennial Fire Protection; Safety System Design and Performance Capability The report covered a two-week period of inspection by regional inspectors. Two Green non-cited violations (NCVs) and four unresolved items with potential safety significance greater than Green were identified. The significance of most findings is indicated by their color (Green,

White, Yellow, Red) using IMC 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

A.

Inspector Identified and Self-Revealing Findings Cornerstones: Initiating and Mitigating Systems

TBD. The safe shutdown strategy and related fire response procedures may be inadequate to assure a safe shutdown of the Unit 1 reactor for a fire in Emergency Switchgear and Relay Room (ESGR) Number 1. The licensees fire response procedures may not preclude plant damage, may fail to prevent potential spurious operations and may require the operator to enter the affected fire area to perform directed actions.

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it was associated with the ability to achieve a safe shutdown of the Unit 1 reactor following a fire in ESGR No. 1 and affects the initiating event and mitigating systems cornerstone objectives. Also, the finding has potential safety significance greater than very low, safety significance because RCP seal package failure could cause a seal loss-of-coolant accident and failure of the specified alternative shutdown strategy.

(Section 1R05.05)

TBD. The safe shutdown strategy and related fire response procedures may be inadequate to assure a safe shutdown of the Unit 1 reactor for a fire in the Unit 1 cable vault and cable tunnel. The licensees fire response procedures may not preclude plant damage, may fail to prevent potential spurious operations and may require the operator to enter the affected fire area to perform directed actions.

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it was associated with the ability to achieve a safe shutdown of the Unit 1 reactor following a fire in the Unit 1 cable vault and cable tunnel and affects the initiating event and mitigating systems cornerstone objectives. Also, the finding has potential safety significance greater than very low, safety significance because RCP seal package failure could cause a seal loss-of-coolant accident and failure of the specified alternative shutdown strategy. (Section 1R05.05)

TBD. The shared ventilation system between the main control room (MCR) and the Unit 1 and Unit 2 emergency switchgear and relay rooms (ESGRs) do not have adequate separation, isolation, or barriers to prevent smoke and toxic gases from being transported to the ESGRs during a fire in the MCR. The alternative shutdown capability for an MCR fire is located in each units ESGR, respectively.

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it was associated with the ability to achieve a safe shutdown of the Unit 1 and Unit 2 reactors following a fire in the MCR and affects the mitigating systems cornerstone objectives. The finding has potential safety significance greater than very low, safety significance because operator inability to safely man the ASPs could result in failure of the specified alternative shutdown strategy. (Section 1R05.09)

Green.

A failure to establish written operating test procedures to demonstrate the functional capability of the diesel-driven fire pump (DDFP) loss-of-power automatic start feature could have resulted in a loss of fire suppression water during a loss-of-offsite power condition.

A non-cited violation of 10 CFR 50.48 was identified. This finding is greater than minor because it is associated with fire protection performance and degraded the ability to meet the mitigating systems cornerstone objective. The finding is considered to have very low safety significance because the DDFP successfully started when a loss-of-power test was performed. (Section 1R05.10)

Green.

A failure to properly implement and maintain an adequate fire protection program inspection and valve position control process could have resulted in isolation of the fuel oil supply to the diesel-driven fire pump (DDFP). The position of the DDFP fuel oil supply valve was not being controlled by the licensee.

A non-cited violation of 10 CFR 50.48 was identified. This finding is greater than minor because it is associated with fire protection performance and degraded the ability to meet the mitigating systems cornerstone objective. The finding is considered to have very low safety significance because the fuel oil supply valve was in its proper position and it had not been mis-positioned in the past.

(Section 1R05.10)

TBD. A design problem within the control logic for the output circuit breakers could have resulted in overloading the shared emergency diesel generator (EDG).

This finding is unresolved pending completion of a significance determination.

The finding is greater than minor because it was associated with the EDG performance and affected the mitigating systems cornerstone objective. Also, the finding has potential safety significance greater than very low significance because the calculated overload was a magnitude that could have resulted in failure of the EDG during a loss-of-offsite power event. (Section 1R21.01)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems and Barrier Integrity

1R05 FIRE PROTECTION The purpose of this inspection was to review the Surry Power Station (SPS) fire

protection program (FPP) for selected risk-significant fire areas. Emphasis was placed on verification that the post-fire safe shutdown (SSD) capability and the fire protection features provided for ensuring that at least one redundant train of safe shutdown systems is maintained free of fire damage. The inspection was performed in accordance with the Nuclear Regulatory Commission (NRC) Reactor Oversight Program using a risk-informed approach for selecting the fire areas and attributes to be inspected. The team used the licensees Individual Plant Examination for External Events and in-plant tours to choose three risk-significant fire areas for detailed inspection and review. The three fire areas selected were:

• Fire Area 3, Unit 1 Emergency Switchgear and Relay (ESGR) Room; Service Building +9.5 Ft. Level

• Fire Area 5, Main Control Room (MCR); Service Building +27.5 Ft. Level

• Fire Area 14, Unit 2 Normal Switchgear Room; Service Building +58.5 Ft. Level For each of the selected fire areas, the team focused the inspection on the fire protection features, and on the systems and equipment necessary for the licensee to achieve and maintain safe shutdown conditions in the event of a fire in those fire areas.

The team also evaluated the 3-hour rated fire barrier between Fire Areas 45 and 54

[Mechanical Equipment Rooms (MERs) 3 and 4].

The team evaluated the licensees fire protection program against applicable requirements, including Operating License Condition 3.I, Fire Protection; Title 10 of the Code of Federal Regulations Part 50 (10 CFR 50), Appendix R; 10 CFR 50.48; Appendix A of Branch Technical Position (BTP) Auxiliary and Power Conversion Systems Branch (APCSB) 9.5-1; related NRC Safety Evaluation Reports (SERs); the Surry Updated Final Safety Analysis Report (UFSAR); and plant Technical Specifications (TS). The team evaluated all areas of this inspection, as documented below, against these requirements.

.01 Systems Required To Achieve and Maintain Post-Fire Safe Shutdown

a. Inspection Scope

The team reviewed the licensees fire protection program documented in VPAP-2401, Fire Protection Program, the SPS UFSAR, and the SPS 10 CFR 50 Appendix R Report to determine the systems required to achieve post-fire SSD. The team selected the chemical and volume control (CVCS), auxiliary feedwater (AFW), and component cooling water (CCW) systems to review for their support in the fire protection program.

The team also reviewed the safe shutdown equipment lists, system flow diagrams, and the fire area hazards analysis (in the Appendix R report) for each of the three selected fire areas to evaluate the completeness and adequacy of the FPP and the systems relied upon to mitigate fires in the selected fire areas. Specific licensee documents and drawings reviewed during the inspection are listed in the Attachment.

b. Findings

No findings of significance were identified.

.02 Fire Protection of Safe Shutdown Capability

a. Inspection Scope

For the selected fire areas, the team evaluated the frequency of fires or the potential for fires, the separation of systems necessary to achieve safe shutdown, and the separation of electrical components and circuits located within the same fire area to ensure that at least one train of redundant safe shutdown systems is free of fire damage. The team also inspected the fire protection features to confirm they were installed in accordance with the codes of record to satisfy the separation and design requirements of 10 CFR 50, Appendix R, Section III.G. The team reviewed the following documents which establish the controls to prevent fires and to control combustible hazards and ignition sources to verify that the objectives established by the NRC-approved FPP were satisfied:

• UFSAR, Section 9.10, Fire Protection

• Appendix R Report, Chapter 8, Combustible Loading Analysis

• Administrative Procedure VPAP-2401, Fire Protection Program

• The Approved Combustible Storage Areas List

• Transient fire loading approvals for 2002-2003 The team toured the selected plant fire areas to observe whether the licensee limited fire hazards in a manner consistent with the fire prevention and combustible hazards control procedures. In addition, the team reviewed fire protection inspection reports, and quarterly engineering FPP health reports for the years 2001-2002.

The team reviewed the drawings and design calculations for the reactor coolant pump (RCP) oil collection system enclosures and tanks to assess their ability to collect and contain any oil leakage and spray from the oil containing components of the RCPs in accordance with the requirements of BTP APCSB 9.5-1, Appendix A, Position D.2.a.

The team also reviewed the RCP operating procedures to confirm that the RCP oil collection tanks were normally maintained in an empty condition and that guidance was available for the plant operators to identify, and respond to, lubricating oil leaks from an RCP motor.

The team reviewed the fire brigade response procedures, training procedures, and drill program procedures. In addition, the team evaluated fire brigade drill records and critiques for the operating shifts from April 2001-December 2002. The reviews were performed to determine whether fire brigade drills had been conducted in high fire risk plant areas and whether fire brigade personnel qualifications, drill response, and performance met the requirements of the licensees approved fire protection program.

The team walked down the fire brigade staging and locker areas in the security and turbine buildings to assess the condition of fire fighting and smoke control equipment.

The team examined the fire brigades personal protective equipment located at both dress-out areas and the fire fighting equipment in the turbine building staging area to evaluate equipment accessibility and functionality. Additionally, the team observed whether emergency exit lighting was provided for personnel evacuation pathways to the outside exits as identified in National Fire Protection Association (NFPA) 101, Life Safety Code. This review also included an examination of backup emergency lighting availability on pathways to and within the dress-out and staging areas to support fire brigade operations during a fire-induced power failure. The fire brigade self-contained breathing apparatuses were examined and assessed for adequacy. Additionally, the availability of supplemental breathing air tanks, and the capability for refill, was evaluated.

Team members walked down the selected fire areas to compare the associated fire fighting pre-fire strategies and drawings with as-built plant conditions. This was done to verify that fire fighting pre-fire strategies and drawings were consistent with the fire protection features and potential fire conditions described in the Appendix R Report.

Also, the team reviewed drawings and engineering calculations for fire suppression caused flooding associated with the ESGR No. 1 (Fire Area 3) floor and equipment drain system to verify that those actions required for alternative shutdown (ASD) would not be inhibited by fire suppression activities or leakage from fire suppression systems.

The team reviewed flow diagrams and engineering calculations associated with the 1A and 1B battery rooms heating, ventilation, and air conditioning (HVAC) systems. This review was done to verify that systems used to accomplish SSD would not be inhibited by a fire in the battery rooms caused by hydrogen gas buildup due to inoperable ventilation supply and exhaust fans. The team also reviewed the annunciator response procedure for loss of ventilation in the battery rooms to verify that actions were specified to ensure that hydrogen gas concentrations generated by the station batteries remained below explosive limits. Additionally, design control procedures were reviewed to verify that plant changes were adequately reviewed for the potential impact on the FPP, SSD equipment, and procedures as required by Surry Units 1 and 2 Operating License Condition 3.I.

b. Findings

No findings of significance were identified.

.03 Post-Fire Safe Shutdown Circuit Analysis

a. Inspection Scope

The team reviewed how systems would be used to achieve inventory control, reactor coolant pump seal protection, core heat removal and reactor coolant system (RCS)pressure control during and following a postulated fire in the fire areas selected for review. Portions of the licensees Appendix R Report which described the methodology and system flow diagrams were reviewed. Control circuit schematics were analyzed to identify and evaluate cables important to safe shutdown. The team traced the routing of cables through fire areas selected for review by using cable schedule, and conduit and tray drawings. The team walked down these fire areas to compare the actual plant configuration to the layout indicated on the drawings. The team evaluated the above information to determine if the requirements for protection of control and power cables were met. The following motor operated valves (MOVs) and other components were reviewed:

• 1-CH-FCV-1122, Charging Pump Flow Control Valve

• 1-CH-HCV-1310A, Charging to Loop 2 Isolation Valve

• 1-CH-HCV-1311, Auxiliary Spray Valve

• 1-CH-LCV-1460A, Letdown Isolation Valve

• 1-CH-FCV-1160, Alternate Charging to Loops Valve

• 1-CH-MOV-1370, RCP Seal Injection Valve

• 1-CH-MOV-1381, RCP Seal Return Valve

• 1-CH-MOV-1286A, Charging Pump Discharge Valve

• 1-CH-MOV-1286C, Charging Pump Discharge Valve

• 1-CH-MOV-1289B, Charging Line Stop Valve

• 1-CH-MOV-1373, Charging Pump Recirc to Seal Water Heat Exchanger Valve

• 1-RC-PCV-1455C, Pressurizer PORV

• 1-RC-PCV-1456, Pressurizer PORV

• 1-RC-MOV-1536, Pressurizer Block Valve

• 1-RC-MOV-1535, Pressurizer Block Valve

• 1-SI-MOV-1869B, Safety Injection to RCS Valve

• 1-FW-LT-1477A, Steam Generator A Wide Range Level Instrument

• EP-PNL-RMP, Remote Monitoring Panel

• EP-PNL-ASC-RMP, Remote Monitoring Panel

• 4160V Breaker 1J13, Emergency Diesel Generator #3 Trip Circuit

b. Findings

The inspectors identified that the design of emergency diesel generator (EDG) No. 3 emergency bus select/tie strategy could result in simultaneous close signals to the feeder breakers on the 1J and 2J buses. This could result in both buses tying to EDG No. 3 and thus subject the EDG to loads in excess of that currently evaluated. This finding was identified during the course of this fire protection inspection but is not caused by or directly associated with a fire induced fault. Consequently, details related to this finding are located in Section 1R21 below.

No other findings of significance were identified.

.04 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the licensees ASD methodology to determine the adequacy of the identified components and systems to achieve and maintain SSD conditions for each fire area selected for review and to verify conformance with applicable requirements as listed in Section

.01 above.

The SPS Appendix R Report identified thirteen fire areas requiring use of an ASD strategy in order to achieve SSD. The team reviewed the licensees ASD methodology for two of these fire areas. For a significant fire in ESGR No. 1 (Fire Area 3), ASD from the MCR would be used to place the unit in hot shutdown utilizing system cross-connect with Unit 2 as necessary. For a significant fire in the MCR (Fire Area 5), ASD from the Auxiliary Shutdown Panels (ASP) would be used to place the unit in hot shutdown. The team specifically reviewed the adequacy of the systems and components [both in the MCR and at the ASP] selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and support system functions.

Electrical diagrams of power, control, and instrumentation cables required to support ASD were analyzed for fire induced faults that could defeat operation from the MCR or the ASP. The team reviewed the electrical isolation and protective fusing in the transfer circuits of components (e.g., motor operated valves) required for post-fire SSD at the ASP to verify that the SSD components were physically and electrically separated from the fire area. The team also examined the electrical circuits for a sampling of components operable at the ASP to ensure that a fire in the ESGRs would not adversely affect SSD capability from the MCR.

b. Findings

No findings of significance were identified.

.05 Operational Implementation of Alternative Shutdown Capability

a. Inspection Scope

The team reviewed and walked down the following fire procedures common to both units to evaluate consistency, adequacy, training and operator familiarity as these common procedures would be implemented during the performance of fire area specific ASD procedures for the MCR and ESGR No. 1.

• 0-VSP-E3, Fire Detected, Revision 11

• 0-AP-48.00, Fire Protection - Operations Response, Revision 14

• 0-FCA-10.00, Establishing Communications, Revision 0

• 0-FCA-11.00, Remote Monitoring, Revision 1

• 0-FCA-14.00, Charging and Seal Injection Flow Paths, Revision 2 The team reviewed the operational implementation of the ASD capability for a fire in the MCR and ESGR No. 1 to determine if:

(1) the procedures used for ASD were consistent with the safe shutdown analysis (SSA) methodology and assumptions;

(2) the procedures were written so that the operator actions could be correctly performed within the times assumed in the SSA;

(3) the training program for operators included ASD capability; and

(4) personnel required to achieve and maintain the plant in hot standby from ASP could be provided from normal onsite staff, exclusive of the fire brigade. The team walked down procedures Fire Contingency Action (FCA) 0-FCA-1.00, Limiting MCR Fire, Revision 29, and 1-FCA-4.00, Limiting ESGR Number 1 Fire, Revision 13, in combination with the common fire procedures listed above, to evaluate whether these procedures could be performed within the required times given the minimum required operator staffing level, with or without offsite power. Operator and fire brigade staffing was reviewed to establish compliance with TS and conformance with the FPP. The team discussed the training with operators to ascertain if they were familiar with the actions and the location of significant equipment.

• Findings The licensees Appendix R analysis described the means by which SSD could be achieved in the event of fire on Unit 1 or Unit 2 to meet the requirements of Appendix R to 10 CFR 50, Sections III.G.3 and III.L. Alternative shutdown capability independent of the existing cabling and equipment was provided for plant locations which did not meet the requirements of Section III.G.2 of Appendix R. The licensees analysis identified a minimum set of plant systems and components necessary for achieving the safe shutdown performance goals of 10 CFR 50, Appendix R. One of the minimum required systems was the CVCS which would be used to provide makeup water to the RCS. This would be accomplished using two separate and independent flow paths: the seal injection lines to the RCP seals, and the normal charging line to the loop 2 cold leg. The Surry charging pump discharge headers are cross-connected between units through a normally isolated line. Per the licensees analysis and procedures, in the event that one units charging pumps were incapacitated due to fire, the opposite units charging pumps could be used to provide charging to the fire-affected units RCS through the charging pump cross-connect. Local manual operator action would be required to make this alignment. The team noted from the licensees analysis that the Appendix R analysis is based on reestablishing charging flow via the cross-connect within 70 minutes. The team determined that in certain fire scenarios, charging pump flow could be temporarily lost, hence RCP seal injection to the fire-affected unit would be temporarily lost as well.

The team identified that the licensees Appendix R analysis failed to evaluate the potential adverse effect on the RCP seal packages from restoring seal injection flow following a prolonged loss of seal injection. This contributed to the findings and unresolved items (URIs) described below.

a.

Fire Area 3, Emergency Switchgear and Relay Room Number 1

Introduction:

A finding was identified in that for a severe fire in ESGR No. 1, the safe shutdown strategy and related fire response procedures may be inadequate to assure a safe shutdown of the Unit 1 reactor. The team had three specific concerns related to this finding:

• For certain fire scenarios in ESGR No. 1, RCP seal injection will be interrupted. The licensees SSA recognized this condition could occur but failed to identify and analyze the possible adverse impacts of this condition on the RCP seal packages during development of the SSD strategy. Annunciator response, abnormal operating and fire contingency action procedures do not provide guidance to assure that continuous seal injection is maintained. Also procedure implementation may not be timely in restoring seal injection flow, thus possibly resulting in severe RCP seal package damage and subsequently a seal loss-of-coolant accident (SLOCA).

• Fire procedure 1-FCA-4.00 directed two actions which required the operator to enter the fire-affected area to accomplish. The procedure also failed to include steps to prevent spurious operation of six AFW valves required in providing AFW flow to the Unit 1 S/Gs for secondary heat removal.

• Fire procedure 0-FCA-14.00 directed opening five 480v breakers [to prevent spurious operation] which required the operator to enter the fire-affected area to accomplish. In addition, one procedure step and one caution statement lacked sufficient clarity to assure proper operator performance. The procedure also failed to provide guidance for evaluating the status of RCP seal cooling prior to reestablishing seal injection after it had been lost per Westinghouse technical guidance.

This is a URI pending completion of the significance determination process (SDP).

Description:

BACKGROUND: Emergency power buses 1H and 1J are located in ESGR No. 1 and provide power to charging pumps 1A, 1B and 1C. Uninterruptible Power Supplies (UPS)1A2 and 1B1 are also located in ESGR No. 1 and provide control power to the RCP thermal barrier CCW return isolation valves 1-CC-TV-140A and 140B. Fire damage to these components could result in loss of the RCP seal injection flow and loss of normal charging water flow from the normal Unit 1 source as well as loss of RCP thermal barrier cooling.

Adequate RCP seal cooling can be achieved by maintaining continuous RCP seal injection or maintaining continuous CCW cooling to the RCP thermal barrier heat exchangers. During normal plant operation, both systems would usually be operating.

Surrys strategy for achieving a safe shutdown of the reactor during a fire did not make the CCW system a protected system. [The SPS Appendix R Report identified the CCW system as a post-fire cold shutdown repair. The analysis stated that the system was only required for residual heat removal (RHR) heat exchanger cooling during plant cooldown and to cool charging system letdown flow once it had been restored (10-13 hours after isolation which occurs at step 4 of 1-FCA-4.00 for an ESGR No. 1 fire).]

The team noted that the RCP thermal barrier heart exchanger cooling return lines combine into a common header before exiting containment. This header has two air-operated, containment isolation valves (AOVs) in series, 1-CC-TT-140A and 1-CC-TT-140B (one inside containment, the other outside). Both AOVs fail closed on a loss of control power. The team confirmed that the AOV control cables passed through ESGR No. 1, were not protected from fire, and had no contingency actions defined to prevent or respond to a spurious valve operation. Also, these cables were powered from cabinets located in ESGR No. 1 (UPS cabinet 1A1 and 1B2). A severe fire in ESGR No.

1 could cause either isolation valve to fail closed which would result in a long term loss of RCP thermal barrier cooling. Thus, adequate RCP seal cooling cannot be assured using thermal barrier heat exchanger cooling.

Recognizing the above issue, Surrys SSA instead relied upon supplying continuous, uninterrupted RCP seal injection flow to assure adequate seal package cooling. The Unit 2 charging system, through an existing cross-connect, is utilized in the licensees SSA and procedures to provide charging flow and seal injection if the Unit 1 charging system were rendered inoperable. However the team determined that because fire damage could result in a loss of seal injection and normal charging flow, seal package conditions should be evaluated before restoring seal injection. Industry issued guidance, (Westinghouse Emergency Response Guideline (ERG) Direct Work Request No. DW-94-011, dated December 12, 1996), determined that reestablishing seal injection or restoring CCW to the thermal barrier heat exchangers would not be appropriate if all seal cooling had been lost long enough that the maximum RCP seal parameters identified in the RCP Vendor Manual were exceeded. Per this guidance, this was to prevent unintended consequences that could result in additional pump damage or failure of plant safety systems [specifically CCW].

ISSUES:

Safe Shutdown Strategy Deficiencies For certain fire scenarios in ESGR No. 1, the power for all Unit 1 charging pumps could be lost or system valves could spuriously operate resulting in damage to the pumps.

Until a charging pump is recovered or cross-connect established with Unit 2, all RCP seal injection flow would be lost. The licensees Appendix R analysis for achieving SSD of the reactor is based on reestablishing charging flow via the cross-connect within 70 minutes after loss of the Unit 1 charging pumps [during a severe auxiliary building fire].

This would assure that pressurizer level remained within the indicating range which is a performance requirement of 10 CFR 50, Appendix R, Section III.L.3. However, the analysis did not address the impact of losing RCP seal injection, combined with the loss of thermal barrier heat exchanger cooling, over this time frame. Based on inspector and auxiliary operator walkdowns of 0-VSP-E3, 0-AP-48.00, 1-FCA-4.00, 0-FCA-10.00, and 0-FCA-14.00 for a fire in ESGR No. 1, the team estimated that about 20-25 minutes could pass without charging and RCP seal injection before the cross-connect lineup with Unit 2 was established. Without thermal barrier heat exchanger cooling and seal injection, high temperature RCS water would flow up the RCP shaft, past the thermal barrier heat exchange to the No. 1 seal. A hot seal package could result in pump shaft warping and seal misalignment resulting in RCP seal leakage.

In regards to this potential, Westinghouse Direct Work No. DW-94-011 states that:

Approximately 13 minutes following the loss of all [RCP] cooling flow, the seal area water temperature will be approaching 550°F. If actions are not taken to initiate a cooldown of the seal package, seal leakage will increase from approximately 3 gpm per pump (normal) to approximately 21 gpm per pump. This seal leakage is based of the expected response of the seals and could increase if one or more seals fail completely open.

Further, this document states that while the RCP vendors manual identifies limits for reestablishing seal cooling, those limits were only intended for a loss of seal cooling of short enough duration that the seal package heatup is limited. Recognizing that the effectiveness of establishing CCW to the thermal barrier heat exchanger following an extended loss was unknown and may jeopardize the integrity of the CCW system, the Westinghouse ERG Operations Subcommittee concluded that no attempt should be made to restore seal cooling via the thermal barrier heat exchanger and seal cooling should be restored by a controlled RCS cooldown. Also, this document states that the limits on restoring seal injection contained in the RCP vendors manual will still be observed. The team noted that these concerns were not captured in the licensees Appendix R analysis. Instead the licensees procedures focused on maintaining pressurizer level in the indicating range.

During certain fire scenarios, the licensees Appendix R analysis also recognized that spurious signals could occur during a fire. The analysis assumed that the worst case failure of a single MOV resulting from spurious operation could occur. The team found that the single failure of charging valve 1-CH-HCV-1289A, 1-CH-HCV-1289B, or 1-CH-HCV-1310A would result in the loss of normal charging flow (even after cross-connect with Unit 2). In this situation, the licensees analysis relies on the RCP seal injection charging path. If the seal injection charging path is not viable, based on the above concerns, then the licensees SSD strategy would also fail to achieve the performance goal of maintaining pressurizer level in the indicating range.

Based on the above, the team concluded that the licensees ASD strategy for using the charging system cross-connect with the unaffected unit may not be effective in restoring a charging flow path, may not maintain pressurizer level in the indicating range and may not protect the RCP seal packages. Also, implementation may increase the likelihood of initiating an SLOCA during a fire event.

Fire Response Procedure 1-FCA-4.00 Deficiencies

• Step 2. RNO b) would require an operator to enter ESGR No. 1 in order to perform a local manual, operator action to remotely shut the Main Steam Trip Valves (MSTVs).

[The inspectors noted that each individual MSTV could also be locally closed at the main steam valve house. While such action was not procedurally directed, the operators were aware this option was available.] Because of the smoke and heat hazard from the fire, an operator may be unable to accomplish the actions as directed. Additionally, should the operator attempt entry into the fire area to perform this action, it could decrease the effectiveness of the manually actuated Halon fire suppression system installed in this fire area.

• Step 15.RNO d) failed to direct operator action to prevent spurious closure of six AFW supply valves to the Unit 1 steam generators (S/Gs). When all Unit 1 AFW pumps are unavailable, this step directs using the Unit 2 AFW pumps to supply auxiliary feedwater flow via two cross-connect lines. These cross-connect lines would feed all three Unit 1 S/Gs through six MOVs (1-FW-MOV-151A through F).

The control cables for these six MOVs pass through ESGR No. 1, were not protected and no procedural guidance (i.e., local manual, operator action to open the power breaker) was given to prevent spurious closure of the valves.

• Step 22.RNO b)3) would require an operator to enter ESGR No. 1 in order to perform local manual, operator actions to restart a CCW pump which is not needed until taking the plant to cold shutdown. No guidance was given for delaying this action until after the fire was out and the compartment accessible. Because of the smoke and heat hazard from the fire, an operator may be unable to accomplish the actions as directed. Additionally, should the operator attempt entry into the fire area to perform these actions, it could decrease the effectiveness of the manually actuated Halon fire suppression system installed in this fire area.

Fire Response Procedure 0-FCA-14.00 Deficiencies

• 1, Step 1b directs closing the charging systems volume control tank (VCT) outlet valves on the affected unit (after realigning charging pump suction from the VCT to the Refueling Water Storage Tank (RWST)). A caution statement at the beginning of the attachment directed the operator to skip step 1b to close the VCT outlet valves (and steps 1c through 1e) if the unit had no charging pumps running.

The team determined the caution statement with regard to skipping step 1b for the affected units VCT did not appear to be consistent with the procedural intent of the overall step.

• Step 7, of this attachment, lacked clarity as witnessed by a qualified operator failing to successfully accomplish the step. During inspector walkdown, a qualified auxiliary operator did not know how to fail open seal water flow control valve 1-CH-HCV-1186 per step 7. The actions demonstrated by the operator would have failed this valve closed.

• Steps 7 and 8 directed aligning the seal injection flow path after charging flow was initiated through the charging cross-connect line. Per the above discussion, these actions appeared to conflict with Westinghouse guidance to not initiate RCP seal injection following a prolonged loss. (Westinghouse ERG Direct Work No. DW-94-011, dated 11/15/96)

• 3, Step 3 would require an operator to enter ESGR No. 1 to open five 480v breakers on load centers 1J1-1 and 1H1-1 to prevent spurious valve operation.

Because of the smoke and heat hazard from the fire, an operator may be unable to accomplish the actions as directed. Additionally, should the operator attempt entry into the fire area to perform these actions, it could decrease the effectiveness of the manually actuated Halon fire suppression system installed in this fire area. [The team noted that Attachment 4 of 0-FCA-14.00, provided contingency actions for mechanically failed charging and seal injection valves. Each of the five valves associated with the above breakers had an alternate strategy in Attachment 4 that could accomplish its required SSD function without requiring the operator to enter the fire-affected area. However, use of this attachment had not been analyzed for nor directed for conditions of breaker inaccessibility.]

Because of the above issues, the team concluded that the licensees procedures may not preclude plant damage, may fail to prevent potential spurious operations and may require the operator to enter the affected fire area to perform directed actions. In summary, the fire response procedures may not assure a safe shutdown of the reactor.

The licensee initiated plant issue (PI) PI S-2003-0637 to evaluate 0-FCA-14.00 regarding an operator needing to manipulate breakers in the fire-affected area and PI S-2003-0638 to correct the steps in ()-FCA-3.00 and ()-FCA-4.00 that incorrectly bypassed steps that preserved an AFW flow path.

Analysis:

The team determined that this finding was associated with the protection against external factors and procedure quality attributes. It affected the objective of the initiating events cornerstone to limit the likelihood of events that challenge critical safety functions as well as the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events, and is therefore greater than minor. The team determined the finding had potential safety significance greater than very low, safety significance because RCP seal package failure could cause an SLOCA and failure of the specified alternative shutdown strategy. However, the finding remains unresolved pending completion of a significance determination.

Enforcement:

10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part.

Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements.

The licensees UFSAR commits to 10 CFR 50, Appendix R, Sections III.G and III.L.

Section III.G.3 states that alternative shutdown capability should be provided where the protection of systems whose function is required for hot shutdown, does not satisfy the requirements of III.G.2.Section III.L of Appendix R provides requirements to be met by alternative shutdown methods.Section III.L.2.b states, in part, that The reactor coolant makeup function shall be capable of maintaining the reactor coolant level...within the level indication in the pressurizer in PWRs.Section III.L.3 specifies that procedures shall be in effect to implement this capability.

Contrary to the above, the alternative shutdown capability specified for a fire in the ESGR No. 1 did not meet this requirement. Specifically, the licensees procedures may not preclude plant damage, may fail to prevent potential spurious operations and may require the operator to enter the affected fire area to perform directed actions. Pending determination of the safety significance, this finding is identified as URI 50-280/03-07-001, Fire Response Procedures 1-FCA-4.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1.

2. Fire Area 1, Unit 1 Cable Vault and Cable Tunnel

Introduction:

A finding was identified in that for a severe fire in the Unit 1 cable vault and cable tunnel, the safe shutdown strategy and related fire response procedures may be inadequate to assure a safe shutdown of the Unit 1 reactor. The team had three specific concerns related to this finding:

• For certain fire scenarios in the Unit 1 cable vault and cable tunnel, RCP seal injection will be interrupted. The licensees SSA recognized this condition could occur but failed to identify and analyze the possible adverse impacts of this condition on the RCP seal packages during development of the SSD strategy.

Annunciator response, abnormal operating and fire contingency action procedures do not provide guidance to assure that continuous seal injection is maintained. Also procedure implementation may not be timely in restoring seal injection flow, thus possibly resulting in severe RCP seal package damage and subsequently a seal loss-of-coolant accident (SLOCA).

• Fire procedure 1-FCA-3.00 failed to include steps to prevent spurious operation of six AFW valves required in providing AFW flow to the Unit 1 S/Gs for secondary heat removal.

• Fire procedure 0-FCA-14.00 directed the opening of up to twenty-nine 480v breakers [to prevent spurious operation] which required the operator to enter the fire-affected area to accomplish. Other issues related to this procedure discussed in finding 1 above are also applicable to a fire in this area.

This is a URI pending completion of the SDP.

Description:

BACKGROUND: Power and control cables for Unit 1 safety and shutdown related valves and components are routed from ESGR No. 1 through the Unit 1 cable tunnel and cable vault to the auxiliary and safeguards buildings, and into containment. The Unit 1 cable vault contains four 480v motor control centers (MCCs), 1H1-2N, 1H1-2S, 1J1-2E, and 1J1-2W. These MCCs contain the power supply breakers for most of the safety-related MOVs in the plant. Safe shutdown components affected by this cable routing include the charging pumps and MOVs in the normal charging and RCP seal injection flow paths, the AFW pumps and MOVs in the AFW flow path to the S/Gs, and the RCP thermal barrier heat exchanger CCW cooling return line containment isolation valves. Fire damage to these cables could result in loss of the RCP seal injection flow and loss of normal charging water flow from the normal Unit 1 source as well as loss of RCP thermal barrier cooling. Because both trains of shutdown systems are located in this area, Surrys SSA developed an ASD methodology for achieving hot shutdown.

Adequate RCP seal cooling can be achieved by maintaining continuous RCP seal injection or maintaining continuous CCW cooling to the RCP thermal barrier heat exchangers. During normal plant operation, both systems would usually be operating.

Surrys strategy for achieving a safe shutdown of the reactor did not make the CCW system a protected system. [The SPS Appendix R Report identified the CCW system as a post-fire cold shutdown repair. The analysis stated that the system was only required for residual heat removal (RHR) heat exchanger cooling during plant cooldown and to cool charging system letdown flow once it had been restored (10-13 hours after isolation at step 4 of 1-FCA-3.00).]

The team noted that the RCP thermal barrier exchanger cooling return lines combine into a common header before exiting containment. This header has two air-operated, containment isolation valves (AOVs) in series, 1-CC-TV-140A and 1-CC-TV-140B (one inside containment, the other outside). Both AOVs fail closed on a loss of control power. The team confirmed that the AOV control cables passed through the Unit 1 cable vault and cable tunnel, were not protected from fire, and had no contingency actions defined to prevent or respond to a spurious valve operation. Hence, a severe fire in the Unit 1 cable vault and cable tunnel could cause either isolation valve to fail closed which would result in a long term loss of RCP thermal barrier cooling. Thus, adequate RCP seal cooling cannot be assured using thermal barrier heat exchanger cooling.

Recognizing the above issue, Surrys SSA instead relied upon supplying continuous, uninterrupted RCP seal injection flow to assure adequate seal package cooling. The Unit 2 charging system, through an existing cross-connect, is utilized in the licensees SSA and procedures to provide charging flow and seal injection if the Unit 1 charging system were rendered inoperable. However the team determined that because fire damage could result in a loss of seal injection and normal charging flow, seal package conditions should be evaluated before restoring seal injection. Industry issued guidance, (Westinghouse Emergency Response Guideline (ERG) Direct Work Request No. DW-94-011, dated December 12, 1996), determined that reestablishing seal injection or restoring CCW to the thermal barrier heat exchangers would not be appropriate if all seal cooling had been lost long enough that the maximum RCP seal parameters identified in the RCP Vendor Manual were exceeded. Per this guidance, this was to prevent unintended consequences that could result in additional pump damage or failure of plant safety systems.

ISSUES:

Safe Shutdown Strategy Deficiencies For certain fire scenarios in the Unit 1 cable vault and cable tunnel, the power for all Unit 1 charging pumps could be lost or system valves could spuriously operate resulting in damage to the pumps. Until a charging pump is recovered or cross-connect established with Unit 2, all RCP seal injection flow would be lost. The licensees Appendix R analysis for achieving SSD of the reactor is based on reestablishing charging flow via the cross-connect within 70 minutes after loss of the Unit 1 charging pumps [during a severe auxiliary building fire]. This would assure that pressurizer level remained within the indicating range which is a performance requirement of 10 CFR 50, Appendix R, Section III.L.3. However, the analysis did not address the impact of losing RCP seal injection, combined with the loss of thermal barrier heat exchanger cooling, over this time frame. Based on inspector and auxiliary operator walkdowns of 0-VSP-E3, 0-AP-48.00, 1-FCA-3.00, 0-FCA-10.00, and 0-FCA-14.00 for a fire in ESGR No. 1, the team estimated that about 20-25 minutes could pass without charging and RCP seal injection before the cross-connect lineup with Unit 2 was established. Without thermal barrier heat exchanger cooling and seal injection, high temperature RCS water would flow up the RCP shaft, past the thermal barrier heat exchange to the No. 1 seal. A hot seal package could result in pump shaft warping and seal misalignment resulting in an RCP SLOCA.

In regards to this potential, Westinghouse Direct Work No. DW-94-011 states that:

Approximately 13 minutes following the loss of all [RCP] cooling flow, the seal area water temperature will be approaching 550°F. If actions are not taken to initiate a cooldown of the seal package, seal leakage will increase from approximately 3 gpm per pump (normal) to approximately 21 gpm per pump. This seal leakage is based of the expected response of the seals and could increase if one or more seals fail completely open.

Further, this document states that while the RCP vendors manual identifies limits for reestablishing seal cooling, those limits were only intended for a loss of seal cooling of short enough duration that the seal package heatup is limited. Recognizing that the effectiveness of establishing CCW to the thermal barrier heat exchanger following an extended loss was unknown and may jeopardize the integrity of the CCW system, the Westinghouse ERG Operations Subcommittee concluded that no attempt should be made to restore seal cooling via the thermal barrier heat exchanger and seal cooling should be restored by a controlled RCS cooldown. Also, this document states that the limits on restoring seal injection contained in the RCP vendors manual will still be observed. The team noted that these concerns were no captured in the licensees Appendix R analysis. Instead, the licensees procedure focused on maintaining pressurizer level in the indicating range.

During certain fire scenarios, the licensees Appendix R analysis also recognized that spurious signals could occur during a fire. The analysis assumed that the worst case failure of a single MOV resulting from spurious operation could occur. The team found that the single failure of charging valve 1-CH-HCV-1289A, 1-CH-HCV-1289B, or 1-CH-HCV-1310A would result in the loss of normal charging flow (even after cross-connect with Unit 2). In this situation, the licensees analysis relies on the RCP seal injection charging path. If the seal injection charging path is not viable, based on the above concerns, then the SSD strategy would also fail to achieve the performance goal of maintaining pressurizer level in the indicating range.

Based on the above, the team concluded that the licensees ASD strategy for using the charging system cross-connect with the unaffected unit may not be effective in restoring a charging flow path, may not maintain pressurizer level in the indicating range and may not protect the RCP seal packages. Also, implementation may increase the likelihood of initiating an SLOCA during a fire event.

Fire Response Procedure 1-FCA-3.00 Deficiencies

• Step 13.RNO d) failed to direct operator action to prevent spurious closure of six AFW supply valves to the Unit 1 steam generators (S/Gs). When all Unit 1 AFW pumps are unavailable, this step directs using the Unit 2 AFW pumps to supply auxiliary feedwater flow via two cross-connect lines. These cross-connect lines would feed all three Unit 1 S/Gs through six MOVs (1-FW-MOV-151A through F).

The power and control cables for these six MOVs pass through Unit 1 cable vault and cable tunnel, were not protected and no procedural guidance (i.e., local manual, operator action to open the upstream MCC feeder breaker) was given to prevent spurious closure of the valves.

Fire Response Procedure 0-FCA-14.00 Deficiencies

• Fire response procedure 1-FCA-3.00 provides guidance for achieving ASD of the reactor during a fire in the Unit 1 cable vault and cable tunnel (Fire Area 1). The procedure directs implementation of fire response procedure 0-FCA-14.00 to align the charging and RCP seal injection flow paths. Attachment 3 of 0-FCA-14.00, directs the opening of power breakers for up to 29 CVCS and safety injection (SI)system MOVs to prevent spurious operation during a severe fire. During the walkdown of this procedure attachment for a fire in ESGR No. 1, the team noted that the power breakers for the following 24 MOVs were located in the Unit 1 cable vault:

• 1-CH-MOV-1286A 1-CH-MOV-1275C

• 1-CH-MOV-1287A 1-CH-MOV-1270A

• 1-CH-MOV-1275A 1-CH-MOV-1270B

• 1-CH-MOV-1267A 1-CH-MOV-1115B

• 1-CH-MOV-1267B 1-CH-MOV-1115C

• 1-CH-MOV-1286B 1-CH-MOV-1370

• 1-CH-MOV-1287B 1-CH-MOV-1289A

• 1-CH-MOV-1275B 1-SI-MOV-1842

• 1-CH-MOV-1269A 1-CH-MOV-1115E

• 1-CH-MOV-1269B 1-CH-MOV-1115D

• 1-CH-MOV-1286C 1-CH-MOV-1289B

• 1-CH-MOV-1287C 1-CH-MOV-1373 Performing this attachment in response to a Unit 1 cable vault and cable tunnel fire would require an operator to enter the fire-affected area. Because of the smoke and heat hazard from the fire, an operator would be unable to accomplish the actions as directed. This area is also protected by an automatically actuated carbon dioxide (CO2)gaseous suppression system. Should the operator attempt entry into the fire area to perform these actions, it could decrease the effectiveness of the CO2 fire suppression system as well as endanger the operator. The team noted that Attachment 4 of procedure 0-FCA-14.00 provided contingency actions for mechanically failed charging and seal injection valves. Each of the 24 valves associated with the above breakers had an alternate valve or mitigation strategy in Attachment 4 that could accomplish its required function. However, the team determined that each alternate valve also had its power breaker located in the fire-affected area and thus, would be unaccessible as well.

Because of the above issues, the team concluded that the licensees procedures may not preclude plant damage, may fail to prevent potential spurious operations and may require the operator to enter the affected fire area to perform directed actions. In summary, the fire response procedures may not assure a safe shutdown of the reactor.

The licensee initiated plant issue (PI) PI S-2003-0637 to evaluate 0-FCA-14.00 regarding an operator needing to manipulate breakers in the fire-affected area and PI S-2003-0638 to correct the steps in ()-FCA-3.00 and ()-FCA-4.00 that incorrectly bypassed steps that preserved an AFW flow path.

Analysis:

The team determined that this finding was associated with the protection against external factors and procedure quality attributes. It affected the objective of the initiating events cornerstone to limit the likelihood of events that challenge critical safety functions as well as affected the objective of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events, and is therefore greater than minor. The team determined the finding had potential safety significance greater than very low, safety significance because local manual operator actions to prevent spurious valve operation in the charging system flow path were directed to be performed in the fire area. The team concluded that the local manual, operator actions to open breakers in the fire area could not be accomplished per 0-FCA-14.00 nor were the contingency actions directed by the procedure sufficient to compensate for this problem. Spurious valve operations in the charging system makeup and seal injection flow paths could impair control of pressurizer level within the indicating band and result in failure of the specified ASD strategy. However, the finding remains unresolved pending completion of a significance determination.

Enforcement:

10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part.

Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements.

The licensees UFSAR commits to 10 CFR 50, Appendix R, Sections III.G and III.L.

Section III.G.3 states that alternative shutdown capability should be provided where the protection of systems whose function is required for hot shutdown, does not satisfy the requirements of III.G.2.Section III.L of Appendix R provides requirements to be met by alternative shutdown methods.Section III.L.2.b states, in part, that The reactor coolant makeup function shall be capable of maintaining the reactor coolant level...within the level indication in the pressurizer in PWRs.Section III.L.3 specifies that procedures shall be in effect to implement this capability.

Contrary to the above, the alternative shutdown capability specified for a fire in the Unit 1 cable vault and cable tunnel did not meet this requirement. Pending determination of the safety significance, this finding is identified as URI 50-280/03-07-002, Fire Response Procedures 1-FCA-3.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1.

.06 Communications

a. Inspection Scope

The team reviewed the adequacy of the communication system to support plant personnel in the performance of ASD functions and fire brigade duties. The team evaluated the licensees use of a system of personnel beepers to notify operations and fire brigade personnel in the event of a fire. The team also assessed the radio repeater system for function and redundancy where components were located in the affected fire area. The team reviewed the adequacy of the radio communication system utilized by the fire brigade and examined the licensees portable radio channel features should the radio repeaters be unavailable. The team walked down sections of 0-FCA-10.00, Establishing Communications, in conjunction with the fire response procedures for the fire areas under review, to verify the viability of the post-fire communications. The team inspected selected ASD equipment requiring local manual operator actions in remote areas of the plant. The team assessed the ability of operators at the ASP to communicate with personnel in these remote areas. The team also reviewed records from periodic tests of the radio repeater system and from periodic inventory of operator post-fire SSD equipment lockers to assess whether the surveillance test program for the radios was sufficient to assure proper operation during a fire.

b. Findings

No findings of significance were identified.

.07 Emergency Lighting

a. Inspection Scope

The team reviewed the design and operation of, and examined the manufacturers data sheets for the direct current (DC) emergency lighting system self-contained, battery powered units. The team checked if these battery power supplies were rated with at least an 8-hour capacity as required by Section III.J of Appendix R. During plant walk downs of selected areas where operators performed local manual actions, the team inspected area emergency lighting units (ELUs) for operability and checked the aiming of lamp heads to determine if adequate illumination was available to correctly and safely perform the actions required by the procedures. The team inspected emergency lighting features along access and egress pathways used during SSD and ASD activities for adequacy and personnel safety. The team also reviewed periodic test and maintenance procedures and records to determine if adequate surveillance testing was in place to assure proper operation of the ELUs in the event of a fire at the site.

b. Findings

No findings of significance were identified.

.08 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed fire response procedure 0-FCA-17.00, Limiting Fire Cooldown and examined plant equipment to establish that the licensee had dedicated repair procedures, equipment, and materials to accomplish repairs of damaged components required for achieving cold shutdown conditions, that these components could be made operable, and that cold shutdown could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The team examined the cold shutdown repair equipment for restoring an RHR pump to operation.

Locker inventories were reviewed for replacement of electrical power and control cables for pumps and valves needed to take the plant to cold shutdown following a large fire.

The team checked if the equipment was appropriately labeled, maintained in good condition and of sufficient quantity to successfully accomplish all required repairs. The team evaluated the estimated manpower and the time required to perform post-fire repairs for reasonableness.

b. Findings

No findings of significance were identified.

.09 Fire Barriers and Fire Area/Zone/Room Penetration Seals

a. Inspection Scope

The team walked down the selected fire areas, including the 3-hour rated fire barrier between MERs 3 and 4 (Fire Areas 45 and 54), to evaluate the adequacy of the fire resistance of barrier enclosure walls, ceilings, floors, and structural steel support protection. This evaluation also included fire barrier concrete block walls, penetration seals, fire doors, and fire dampers to ensure that at least one train of SSD equipment would be maintained free of fire damage. The team observed the material condition and configuration of the installed fire barrier features. In addition, the team reviewed licensing documentation and engineering evaluations of Generic Letter 86-10 fire barrier features, and NFPA code deviations to verify that the fire barrier installations met design requirements and license commitments. Visual inspections of selected barriers were performed to confirm that the 3-hour rated penetration seal installations were consistent with the tested configurations. The team compared the observed fire barrier penetration seal configurations to the design drawings and tested configurations. The team also compared the penetration seal ratings with the ratings of the barriers in which they were installed.

The team reviewed ASD procedures, selected fire fighting pre-plan strategies, fire damper locations, and HVAC system drawings to verify that access to remote shutdown equipment and operator manual actions would not be inhibited by smoke migration from one area to adjacent plant areas used to accomplish SSD.

b. Findings

Introduction:

A finding was identified in that the shared ventilation system between the MCR (Fire Area 5) and the Unit 1 and Unit 2 ESGRs (Fire Areas 3 and 4) did not have adequate separation, isolation, or barriers to prevent smoke and toxic gases from being transported to the ESGRs during a fire in the MCR. The alternative shutdown capability for an MCR fire is located in each units ESGR, respectively. This is a URI pending completion of the SDP.

Description:

The Surry Appendix R Report identified the MCR fire area as an alternative shutdown area. For a severe fire in the MCR, the operators would abandon the MCR and utilize the Unit 1 and Unit 2 ASPs, located in the Unit 1 and Unit 2 ESGRs respectively, to achieve safe shutdown of the units. The ESGRs share a common ventilation system with the MCR. Fire and smoke dampers, located in the ventilation system ducts, were designed to prevent fire and smoke from spreading from the ESGRS to the MCR. While manual actuation of the Halon system in response to an ESGR fire would signal these dampers to close, the team found that there were no smoke or fire actuation devices to signal them to shut during a fire in the MCR. These dampers also did not have the capability of being manually actuated. A large fire in the MCR areas could generate large amounts of heavy black smoke and toxic gases. The open dampers could permit the spread of smoke and toxic gases from the MCR to the ESGR. This situation could present a habitability concern for the operators at the Unit 1 and Unit 2 ASPs, while they attempted safe shutdown of their respective units.

Fire procedure 0-FCA-1.00, Limiting MCR Fire, did not require the operators to bring Self-contained Breathing Apparatus (SCBA) gear to the ESGR nor are any readily available at the ESGRs. The SSA did not include an evaluation of potential maloperation of the ventilation system, its components, or its effect on habitability at the ASP. As a result, the alternative shutdown capability was not physically independent of the fire area as required by Sections III.G.3 and III.L of Appendix R. The licensee stated that smoke and toxic gases would not migrate through the ventilation system from the MCR to the ESGRs but at the time of the inspection could not provide an analysis to support this position. The licensee initiated plant issue (PI) PI-S-2003-0643 to evaluate the independence and operability of the ESGR ventilation system during an MCR fire.

Analysis:

The team determined that this finding was associated with the protection against external factors attribute and affected the objective of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events, and is therefore greater than minor. The team determined the finding had potential safety significance greater than very low, safety significance because operator inability to safely man the ASPs could result in failure of the specified alternative shutdown strategy. However, the finding remains unresolved pending completion of a significance determination.

Enforcement:

10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part.

Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements.

The licensees UFSAR commits to 10 CFR 50, Appendix R, Sections III.G and III.L.

Section III.G.3 states that alternative shutdown capability should be provided where the protection of systems whose function is required for hot shutdown, does not satisfy the requirements of III.G.2.Section III.L of Appendix R provides requirements to be met by alternative shutdown methods.Section III.L.3 specifies that the alternative shutdown capability shall be independent of the specific fire area(s) and shall accommodate postfire conditions where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Contrary to the above, the alternative shutdown capability specified for a fire in the MCR did not meet this requirement. Pending determination of the safety significance, this finding is identified as URI 50-280, 281/03-07-003, Alternate Shutdown Panel Ventilation System Not Independent from Impacts of a Main Control Room Fire.

.10 Fire Protection Systems, Features, and Equipment

c. Inspection Scope

The team reviewed flow diagrams, cable routing information, and valve lineup procedures associated with the fire pumps and fire protection water supply system. The team evaluated the common fire protection water delivery and supply components to determine if they could be damaged or inhibited by fire-induced failures of electrical power supplies or control circuits. Using operating procedures, the team toured the fire pump house and water storage tanks to observe the system material condition, consistency of the as-built configuration with engineering drawings, and to determine correct system controls and lineup. In addition, the team reviewed periodic test procedures for the fire pumps to assess whether the surveillance test program was sufficient to verify proper operation of the fire protection water supply system in accordance with the program acceptance criteria delineated in the Technical Requirements Manual (TRM).

The team examined the adequacy of installed fire protection features in accordance with the separation and design requirements in Appendix R, III.G.1 and III.G.3. The team walked down accessible portions of the fire detection and alarm systems in the selected fire areas to evaluate the engineering design and operation of the installed configurations. The team also reviewed engineering drawings for fire detector spacing and locations in Fire Area 3 and an independent fire protection consultants technical evaluation of the detector locations for the installed detection system to verify compliance with the licensees Appendix R Report and NFPA 72E, Standard on Automatic Fire Detectors, 1984 Edition. The team reviewed the adequacy of the design, installation, and operation of the manual suppression standpipe and fire hose system for the service building complex. The team reviewed the adequacy of the design and installation of the manual Halon fire suppression systems for the emergency switchgear room. This review included Halon fire suppression system controls to assure accessibility and functionality of the system, as well as associated ventilation system fire/Halon isolation dampers. The team also examined licensee design calculations, vendor certifications, and pre-operational test data to verify the required quantity of Halon for the area was available. Additionally, the team reviewed engineering drawings, schematics, flow diagrams, and evaluations associated with the area floor drain system to determine whether systems and operator actions required for ASD would be inhibited by potential leakage from manual Halon or fire hose station suppression activities.

The team examined design calculations to verify that the required fire hose water flow for each of the selected areas was available. The team reviewed a sample of manual fire hose lengths to determine whether they could reach the SSD equipment.

Additionally, the team observed placement of the fire hoses and extinguishers to assess consistency with the fire fighting strategies.

1. Failure to Test the Diesel-Driven Fire Pump Automatic Start Capability

Introduction:

A Green non-cited violation (NCV) was identified for failure to establish written operating test procedures to demonstrate the functional capability of the diesel-driven fire pump (DDFP) automatic start feature during a loss of power condition. The licensees testing program, as prescribed by VPAP-2401 and TRM 3.7.1.12, only tested the low fire header pressure automatic start feature.

Description:

Two fire pumps were installed in the fire pump house. One was an electric motor-driven fire pump (MDFP) powered from the normal plant electrical system. The second was a diesel-engine driven fire pump capable of providing fire protection water upon loss of the MDFP or upon the loss of the normal plant electrical system. Surry UFSAR, Section 9.10.2.2.2, Fire Pumps, states that the diesel driven fire pump will start automatically upon a loss of AC control power. Sections 714 and 715 of NFPA 20, Standard for the Installation of Stationary Pumps for Fire Protection, require that the DDFP have an automatic start feature which starts the DDFP upon a loss of circuit power to the battery chargers and fire pump controller. The team found that the DDFP had the required automatic start feature installed but it was not being periodically tested as required by VPAP-2401 and TRM 3.7.1.12. The licensee initiated PI-S-2003-0629 to evaluate the operability of the DDFP loss-of-power automatic start feature and to add testing of this feature to the periodic surveillance requirements of the pump. On February 12, 2003, the licensee conducted a successful operational test of the DDFP automatic start feature on loss of power.

Analysis:

The team determined that this finding was associated with the protection against external factors attribute and affected the objective of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events, and is therefore greater than minor. The finding was considered to have very low safety significance (Green) because the DDFP successfully started when a loss-of-power test was performed.

Enforcement:

10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part.

Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements. Surry UFSAR, Section 9.10.2.2.2 states that the diesel driven fire pump will start automatically upon a loss of AC control power. Surry administrative procedure VPAP-2401, Section 6.1.15.a states that testing of fire protection equipment shall be performed in accordance with the established periodic test and/or fire protection maintenance procedure program and shall comply with the requirements of the TRM. TRM surveillance requirement 3.7.1.12 requires that a system functional test be performed on the Fire Suppression Water System. Further, the TRM states that the system functional test shall include simulated automatic actuation of the system throughout its operating sequence and verifying that each automatic valve in the flow path actuates to its correct position.

Contrary to the above, the licensee failed to establish written operational periodic test procedures to demonstrate the functional capability of the DDFP loss-of-power automatic start feature. Because the failure to test this feature is of very low safety significance and has been entered into the corrective action program (PI S-2003-0629),this violation was being treated as an NCV, consistent with Section VI.A.1 of the NRCs Enforcement Policy: NCV 50-280, 281/03-07-004, Failure to Adequately Test Diesel Driven Fire Pump Automatic Start Features.

2. Inadequate Supervision of Diesel-Driven Fire Pump Fuel Oil Supply Isolation Valve

Introduction:

A Green NCV was identified for failure to properly implement and maintain an adequate fire protection program inspection and valve position control procedure.

Description:

During a plant walk down of valve lineup procedure 1-OP-52.2A, Fire Protection System Alignment, Rev. 6, the team determined that fuel oil supply isolation valve 1-FP-717 for the DDFP was not in the valve lineup procedure nor was its position controlled in accordance with the licensees approved fire protection program. However, the team found that the valve was the open position, as required. The lack of valve position control increased the likelihood that the valve could have been mis-positioned closed and not identified during normal and restorative valve lineup checks. This could have rendered the DDFP inoperable due to loss of fuel supply.

Analysis:

The team determined that this finding was associated with the protection against external factors attribute and affected the objective of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events, and is therefore greater than minor. A licensee search of PIs did not find a record of this valve being found mis-positioned in the past. The finding was considered to have very low safety significance (Green) because the valve was in its proper position when identified by the team and it had not been mis-positioned in the past.

Enforcement:

10 CFR 50.48 states, in part, Each operating nuclear power plant must have a fire protection program that satisfies Criterion 3 of Appendix A to this part.

Surry Unit 1 Operating License DPR-32, and Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements. Surry administrative procedure VPAP-2401, Section 6.1.15 establishes the requirements for performing inspection and maintenance on fire equipment, systems, and components to ensure that conditions adverse to fire protection are promptly identified and corrected in accordance with applicable regulations.

Contrary to the above, the licensee failed to include the DDFP fuel oil supply isolation valve 1-FP-717 in valve lineup procedure 1-OP-52.2A, and failed to control the valves position. Because the failure to control this valve is of very low safety significance and has been entered into the corrective action program (PI S-2003-0436), this violation was being treated as an NCV, consistent with Section VI.A.1 of the NRCs Enforcement Policy: NCV 50-280, 281/03-07-005, Inadequate Control of Diesel Driven Fire Pump Fuel Oil Isolation Valve.

.11 Compensatory Measures

a. Inspection Scope

The team reviewed licensee reports for the fire protection status of Unit 1, Unit 2 and of shared structures, systems, and components. The review was performed to verify that the risk associated with removing fire protection and/or post-fire systems or components, was properly assessed. The team evaluated the adequacy of compensatory measures that were implemented in accordance with the approved fire protection program. The team also reviewed PI reports generated over the last 18 months as a result of any fire protection features that were not returned to service within the time frames required.

b. Findings

No findings of significance were identified.

==1R21 Safety System Design and Performance Capability

==

.01 Review of Output Breaker Circuitry for Emergency Diesel Generator No. 3

a. Inspection Scope

As part of its review of the post-fire safe shutdown circuit analysis (refer to report Section 1R05.03), the team reviewed the electrical circuitry for the EDG No. 3 output circuit breakers.

b. Findings

Introduction:

A finding of greater than very low safety significance was identified in that EDG No. 3 could be overloaded following a concurrent loss-of-offsite power on Units 1 and 2. The overload could occur due to this generator being shared between the two units and an inspector identified design deficiency in the EDG output breakers control circuits. No actual overload event occurred. This is a URI pending completion of the SDP.

Description:

Surry has three emergency diesel generators between its two units. EDG No. 1 was dedicated to Unit 1 and powers bus 1H. EDG No. 2 was dedicated to Unit 2 and powers bus 2H. The output cables of EDG No. 3 were connected such that it could power bus 1J on Unit 1 or bus 2J on Unit 2 depending on which circuit breaker was closed. Due to loading considerations, the design intent was that EDG No. 3 would never supply power to both 1J and 2J at the same time.

Review of the control circuits for EDG No. 3 output breaker 15J3 (Unit 1 drawing 11448-FE-21J, Rev 16) and output breaker 25J3 (Unit 2 drawing 11548-FE-21J, Rev 18)revealed that both circuit breakers could close simultaneously. This could happen following a simultaneous (or nearly simultaneous) loss of normal power on buses 1J and 2J. After various permissives in each breakers control circuits are made up, the breaker close signal in both circuits comes from the same relay which would be energized when the rated speed and voltage of the EDG are achieved. Because the two close signals would be essentially simultaneous, both breakers would close. The control circuits for the two output breakers were interlocked via auxiliary contacts (52b contacts) to prevent one breaker from closing when the other breaker was fully closed.

However, the team determined that the interlock did not achieve the desired result for the situation when both output breakers were open and then received simultaneous close signals. The licensee stated that testing to simulate loss of offsite power was performed on one bus at a time. This fact, together with the possibility that a dual unit loss of power never actually occurred since initial plant startup, explains why the problem was not previously identified.

The team noted that simultaneous breaker closure, as described above, would not have occurred during an event where offsite power was lost coincident with an accident signal. In that situation, the accident signal would block closure of the EDG output breaker on the non-accident unit. This design feature would ensure that the accident unit had two EDGs available.

This finding presented an immediate safety concern. After confirming that EDG No. 3 could supply power to bus 1J and 2J at the same time, the licensee evaluated the EDG loading for this case. The EDG control circuitry automatically sequences loads onto the EDGs during a loss of offsite power (without a coincident accident signal). The licensee determined that the combined steady state loading would be 3,168 kW as compared to an engine 2000-hour rating of 2750 kW (per UFSAR Page 8.5-4). The licensee stated that, in addition to the 2000-hour rating, the diesel engine had the following output capabilities: 2865 kW for 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />, 2900 kW for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and 2950 kW for 30 minutes.

The combined peak transient (motor starting) load was about 17 MVA. This was about 126 percent of the generator tested motor starting capacity of 12.5 MVA. At an assumed 0.2 power factor, this represented a 3.4 MW step load increase on the generator or about 115 percent of the 30-minute capability. This motor starting load could cause voltage and frequency to significantly deviate from rated values. The automatically connected steady state load was about 107 percent of the 30-minute capability, which could lead to early failure of an internal engine component.

The licensee initiated PI S-2003-0633 at 6:54 p.m. on February 13, 2003, and at 7:05 p.m. declared the emergency power supply inoperable for both bus 1J and 2J. At 7:19 p.m. the control switch for circuit breaker 15J3 was placed in the pull-to-lock position.

This action returned the 2J bus to operable status. A seven-day limiting condition of operation was entered on Unit 1 per Technical Specification 3.16.B. On February 19 the licensee modified the circuitry for breaker 15J3 to preclude simultaneous closure of the EDG No. 3 output circuit breakers, thus restoring the design basis.

Analysis:

The team determined that this finding was associated with the equipment performance attribute and affected the objective of the mitigating systems cornerstone to ensure the availability, reliability, and capability of systems that respond to initiating events, and is therefore greater than minor. The team determined that the finding had potential safety significance greater than very low significance because the calculated overload was a magnitude that could have resulted in failure of the EDG during a loss-of-offsite power event. However, the finding remains unresolved pending completion of a significance determination.

Enforcement:

A system design which could result in overload and subsequent failure of EDG No. 3 represents an inadequate design.

10 CFR 50, Appendix B, Criterion III, Design Control, states, in part, Measures shall be established to assure that applicable regulatory requirements and the design bases, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions.

The applicable design bases are described in UFSAR Sections 1.4.4 and 1.4.39. These sections discuss compliance with Design Criteria 4 and 39 as described in the Federal Register, Volume 32, No. 132, page 10213, dated July 11, 1967. Section 1.4.4 states:

No impairment of the safety of the reactor facilities is caused by sharing of any of these systems and in certain instances such sharing enhances system reliability. Section 1.4.39, Emergency Power for Engineered Safeguards, states the following:

The onsite and offsite power supplies are both independently capable of supplying power to the engineered safeguards. This capability is maintained even in the event of a failure of any single active component in either system. In the unlikely event of total loss offsite power, the emergency 4160 V buses are energized by the EDGs. Three diesel generators are available for two units. One diesel is exclusively for Unit 1, the second is exclusively for Unit 2, and the third functions as a backup for either unit.

Contrary to the above, the control circuits for the output circuit breakers for EDG No. 3 did not implement the design basis in that the control logic for EDG No. 3, as implemented with Surry drawings 11448-FE-21J and 11548-FE-21J, could result in overload and failure of the generator. Pending determination of the safety significance, this finding is identified as URI 50-280, 281/03-07-006, Emergency Diesel Generator No. 3 Bus-tie Breakers Control Circuit Design Deficiency.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

Corrective action program PIs resulting from fire, smoke, sparks, arcing, and equipment overheating incidents for the last 18 months were reviewed to assess the effectiveness of the fire prevention program and to identify any maintenance or material condition problems related to fire incidents.

b. Findings

No findings of significance were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On February 14, 2003, the inspectors presented the inspection results to Mr. T. Sowers and other members of your staff, who acknowledged the findings. The inspectors confirmed that proprietary information was not provided or examined during the inspection.

ATTACHMENT

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

M. Adams, Manager Site Engineering

M. Gaffney, OR Manager

B. Garber, Licensing

J. Grau, Maintenance

B. Gross, Operations

T. Gunning, Fire Protection System Engineer

B. Harris, Senior Reactor Operator

D. Haskins, Oversight Specialist III

D. Llewellyn, Manager Training

C. Luffman, Manager Protection Services

R. Lynch, Supervisor Nuclear Site Safety

R. MacManus, Nuclear Oversight

M. Smith, System Engineering Manager

T. Sowers, Director Operations and Maintenance

T. Steed, Manager Radiological Protection

NRC personnel

R. Musser, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

50-280/03-07-001 URI Fire Response Procedures 1-FCA-4.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 (Section 1R05.05)

50-280/03-07-002 URI Fire Response Procedures 1-FCA-3.00 And 0-FCA-14.00 Not Adequate To Assure Safe Shutdown Of Unit 1 (Section 1R05.05)

50-280, 281/03-07-003 URI Alternate Shutdown Panel Ventilation System Not Independent from Impacts of a Main Control Room Fire (Section 1R05.09)

50-280, 281/03-07-004 NCV Failure to Adequately Test Diesel Driven Fire Pump Automatic Start Features (Section 1R05.10)

50-280, 281/03-07-005 NCV Inadequate Control of Diesel Driven Fire Pump Fuel Oil Isolation Valve (Section 1R05.10)

ATTACHMENT 50-280, 281/03-07-006 URI Emergency Diesel Generator No. 3 Bus-tie Breakers Control Circuit Design Deficiency (Section 1R21.01)

Closed

50-280, 281/03-07-004 NCV Failure to Adequately Test Diesel Driven Fire Pump Automatic Start Features (Section 1R05.10)

50-280, 281/03-07-005 NCV Inadequate Control of Diesel Driven Fire Pump Fuel Oil Isolation Valve (Section 1R05.10)

Discussed

None