IR 05000286/2008007

IR 05000286-08-007 on 01/22/2008 - 02/08/2008 for Indian Point, Unit 3; Triennial Fire Protection Team Inspection

ML080770172
Person / Time
Site:	Indian Point
Issue date:	03/17/2008
From:	Rogge J Engineering Region 1 Branch 3
To:	Pollack J Entergy Nuclear Operations
References
IR-08-007
Download: ML080770172 (29)

Text

rch 17, 2008

SUBJECT:

INDIAN POINT NUCLEAR GENERATING UNIT 3 - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT INTEGRATED INSPECTION REPORT 05000286/2008007

Dear Mr. Pollock:

On February 8, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Indian Point Nuclear Generating Plant Unit 3. The enclosed inspection report documents the inspection results, which were discussed on February 8, 2008, with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations, and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, three findings of very low safety significance (Green)

were identified. These findings were also determined to be violations of NRC requirements.

However, because of their very low safety significance, and because they were entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a written response within 30 days of the date of this inspection report with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington D.C. 220555-001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement; and the NRC Senior Resident Inspector at the Indian Point 3 facility.

In accordance with Title 10 of the Code of Federal Regulations Part 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS).

Mr. Joseph ADAMS is accessible from the NRC Web Site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

John F. Rogge, Chief Engineering Branch 3 Division of Reactor Safety Docket No. 50-286 License No. DPR-64 Enclosure: Inspection Report No. 05000286/2008007 w/Attachment: Supplemental Information

Mr. Joseph

SUMMARY OF FINDINGS

IR 05000286/2008007; 01/22/2008 - 02/08/2008; Entergy Nuclear Northeast, Indian Point

Nuclear Generating Unit 3; Triennial Fire Protection Team Inspection.

The report covered a two-week triennial fire protection team inspection by specialist inspectors.

Three findings of very low significance were identified. These findings were determined to be non-cited violations. The significance of most findings is indicated by their color (Green, White,

Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process.

Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Initiating Events

Green.

The team identified a Green non-cited violation of technical specification 5.4.1.d for failure to provide adequate procedure directions in 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, for operators to properly determine if a loss of cooling to the reactor coolant pump (RCP) seal had occurred due to spurious closure of motor operated valves in the component cooling water (CCW) system.

This finding was more than minor because it affected the procedure quality attribute of the Initiating Events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, establishing adequate guidance to diagnose and align RCP seal cooling functions is important to limit the likelihood of an RCP seal loss of coolant accident. The team assessed this finding in accordance with NRC IMC 0609,

Appendix F, Fire Protection Significance Determination Process. This finding screened to very low safety significance (Green) in Phase 1 of the SDP because it was assigned a low degradation rating. The team determined that this finding has a cross-cutting aspect in the area of human performance because Entergy did not provide adequate procedure guidance to diagnose and align RCP seal cooling functions adequately to preclude seal leakage rates in excess of Appendix R Safe-Shutdown evaluation for a control building fire scenario. (H.2(c)) (Section 1RO5.01)

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of technical specification 5.4.1.d for failure to provide procedure directions in 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, that were adequate to ensure operators could isolate steam generator blowdown flow within the time assumed in supporting design calculations.

This finding was more than minor because it affected the procedure quality attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team assessed this finding in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected post-fire safe shutdown procedures and systems and screened to very low safety significance (Green) in Phase 1 of the SDP because it was assigned a low degradation rating. The team determined that this finding has a cross-cutting aspect in the area of human performance because Entergy did not provide adequate procedure guidance in 3-AOP-SSD-1 to ensure time critical actions are completed as quickly as possible and consistent with design calculation IP-CALC-06-00029 assumptions and operator training. (H.2(c)) (Section 1RO5.01)

Green.

The team identified a non-cited violation of technical specification 5.4.1.d for failure to provide adequate procedure directions in 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, to prevent spurious opening of the power operated relief valves (PORVs) and letdown isolation valves in the event the affected circuits could not be de-energized prior to leaving the control room.

This finding was more than minor because it affected the procedure quality attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team assessed this finding in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected post-fire safe shutdown procedures and systems and screened to very low safety significance (Green) in Phase 1 of the SDP because it was assigned a low degradation rating.

Licensee-Identified Violations

None iii

REPORT DETAILS

Background This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure (IP) 71111.05T, Fire Protection. The objective of the inspection was to assess whether Entergy Nuclear Northeast has implemented an adequate fire protection program and that post-fire safe shutdown capabilities have been established and are being properly maintained at the Indian Point Nuclear Generating Unit 3 (IP-3). The following fire areas (FAs) and fire zones (FZs) were selected for detailed review based on risk insights from the IP-3 Individual Plant Examination (IPE)/Individual Plant Examination of External Events (IPEEE):

• FA CTL-3, FZ 15

• FA CTL-3, FZ 102A

• FA PAB-2, FZ 5,6,7

• FA PAB-2, FZ 17A

• FA TBL-5, FZ 49A, 50A The inspection team evaluated the licensees fire protection program (FPP) against applicable requirements which include plant Technical Specifications, Operating License Condition 2.H, NRC Safety Evaluations, 10 CFR 50.48, and 10 CFR 50, Appendix R. The team also reviewed related documents that include the Updated Final Safety Analysis Report (UFSAR), Section 9.6.2, the fire hazards analysis (FHA), and the post-fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection (IP 71111.05T)

.01 Post-Fire Safe Shutdown From Outside Main Control Room (Alternative Shutdown) and

Normal Shutdown

a. Inspection Scope

Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentations drawings (P&IDs), electrical drawings, the UFSAR and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that rely on shutdown from outside the control room.

This review included verification that shutdown from outside the control room could be performed both with and without the availability of offsite power. Plant walkdowns were also performed to verify that the plant configuration was consistent with that described in the safe shutdown and fire hazards analyses. These inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions. The team verified that the systems and components credited for use during this shutdown method would remain free from fire damage. The team verified that the transfer of control from the control room to the alternative shutdown location(s) would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Similarly, for fire areas that utilize shutdown from the control room, the team also verified that the shutdown methodology properly identified the components and systems necessary to achieve and maintain safe shutdown conditions.

Operational Implementation The team verified that the training program for licensed and non-licensed operators included alternative shutdown capability. The team also verified that personnel required for safe shutdown using the normal or alternative shutdown systems and procedures are trained and available onsite at all times, exclusive of those assigned as fire brigade members.

The team reviewed the adequacy of procedures utilized for post-fire shutdown and performed an independent walk through of procedures steps to ensure the implementation and human factors adequacy of the procedures. The team also verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified by the team included restoration of alternating current (AC) electrical power, establishing the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

Specific procedures reviewed for alternative shutdown, including shutdown from outside the control room included the following:

• 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6

• 3-ONOP-FP-1, Plant Fires, Rev. 22

• 3-SOP-ESP-001, Local Equipment Operation and Contingency Actions, Rev. 17 The team reviewed manual actions to ensure that they could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area. The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to ensure the tests are adequate to endure the functionality of the alternative shutdown capability.

b. Findings

b.1 Potential Loss of Reactor Coolant Pump (RCP) Seal Cooling

Introduction:

The team identified a Green non-cited violation of technical specification 5.4.1.d for a failure to provide adequate procedure directions in 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, for operators to properly determine if a loss of cooling to the reactor coolant pump (RCP) seal had occurred due to spurious closure of motor operated valves in the component cooling water (CCW) system.

Description:

The team reviewed IP3-ANAL-FP-01503, Safe Shutdown Analysis Report, Rev. 2, and noted that a fire in the control building, fire area CTL-3, may cause the RCP CCW thermal barrier cooling motor-operated valves (MOVs), AC-MOV-769, AC-MOV-797, AC-FCV-625, and AC-MOV-789 to spuriously fail closed due to the effects of the fire.

Spurious closure of any one of the MOVs would isolate CCW flow to the thermal barrier cooling to the RCPs. Also, a fire in this area could cause the loss of RCP seal injection flow due to fire damage causing a spurious trip of the charging pumps or the loss of the pump suction flow path due to a valve failure (e.g., volume control tank outlet valve CH-LCV-112C). In the event of a loss of all RCP seal cooling (i.e. loss of seal injection flow concurrent with a loss of CCW flow to the thermal barrier) the procedure directs the operators to isolate both seal injection and CCW to the RCP seals to prevent thermal shock of overheated seals should either method of cooling be inadvertently restored.

Preventing thermal shock is necessary to avoid a potential increase in the seal leak rate that could exceed the charging pump make-up capacity.

The team reviewed safe shutdown procedure, 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, that is used when the control room must be evacuated due to a fire in area CTL-3 or when fire damage has affected the control of equipment from the control room. The procedure and its attachments provide directions for operation of equipment from outside the control room to place and maintain the plant in a safe shutdown condition. The procedures also include actions that may be necessary to prevent or to mitigate potential spurious operation of equipment caused by the effects of the fire. During this review, the inspectors found that the procedure did not include adequate guidance to determine if a complete loss of cooling to the RCP seals had occurred. The procedure directs the operators to determine if there is seal injection and/or thermal barrier cooling by checking that a charging and/or CCW pump is operating.

However, the procedure does not include directions to ensure the CCW flow has not been blocked by spurious operation of motor operated valves in the flow path. Thus an operating CCW pump with one or more of the four MOVs spuriously closed would not be a proper indication of seal cooling.

Specifically, Attachment 6 of 3-AOP-SSD-1 specifies the actions to be taken by the nuclear plant operator (NPO) in the primary auxiliary building. These actions include opening circuit breakers on motor control centers to prevent the spurious operation of a number of motor operated valves (MOVs), including valves in the CCW flow path for the RCP thermal barrier cooling (AC-MOV-769, AC-MOV-797, AC-FCV-625, and AC-MOV-789). After opening the circuit breakers, the operator does not verify that spurious actuation had not already occurred and thereby isolated CCW flow to the thermal barriers.

The team noted that Step 6.18 of Attachment 6, directs the operator to check if RCP seal injection and CCW had been isolated due to a loss of both operating pumps. If they were not isolated, the operator is directed to open AC-MOV-769, AC-MOV-797, AC-FCV-625, and AC-MOV-789 and then to restore seal injection flow. If one of these MOVs were closed, and the charging pump had not operated continuously, all seal cooling would have occurred and reopening the CCW valves and restoring seal injection would be contrary to the recommendations of Westinghouse Technical Bulletin 04-22, Reactor Coolant Pump Seal Performance - Appendix R Compliance and Loss of All Seal Cooling, Rev. 1, and could result in thermal shock to the seals.

Entergy entered this issue in the corrective action program as CR-IP3-2008-00410 and initiated hourly fire watches in the affected areas as a compensatory measure pending resolution of this issue.

Analysis:

The team concluded that Entergys failure to establish an adequate shutdown procedure to diagnose and align RCP seal cooling functions to preclude seal leakage rates in excess of those assumed in the Appendix R safe shutdown evaluation was a performance deficiency. This performance deficiency is more than minor because it affected the procedure quality attribute of the initiating events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, establishing adequate guidance to diagnose and align RCP seal cooling functions is important to limit the likelihood of an RCP seal loss of coolant accident caused by thermal shock to the seals.

The team assessed this finding in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected post-fire safe shutdown procedures and systems and screened to very low safety significance (Green)in Phase 1 of the SDP because it was assigned a low degradation rating. The low degradation rating was assigned based on procedure reviews and walkdowns performed by the team. The team conducted a walk down of the safe shutdown procedure with an operator to determine how long seal cooling may have been lost prior to performing the steps that perform the restoration of CCW and seal injection. The results of this walkdown showed that CCW would have been restored at approximately 16 minutes. Westinghouse Technical Bulletin TB-04-22, Rev. 1, Reactor Coolant Pump Seal Performance -

Appendix R Compliance and Loss of All Seal Cooling, provides guidance for estimating how long it would take for a RCP seal temperature to reach the point where thermal shock could occur upon restoration of cooling. Based on actual measured seal leak off rates of 2.5 gallons per minute (gpm) or less during the previous year of operation and using the 48.1 gallon purge volume determined in calculation IP-RPT-06-00022, Rev. 0, Model 93 Reactor Coolant Pump Buffer Volume Related to Safe Shutdown Analysis Validation, the team determined that cooling should not be restored after approximately 19 minutes (48.1 gallons/2.5gpm).

The team also noted that in parallel with the actions taken by the NPO performing 6 of the AOP, the shift manager continues to implement the action of the AOP at step 4.18. These actions include evaluation of the charging pump status and starting a charging pump if required. Starting a charging pump would restore RCP seal injection and thereby re-establish seal cooling. The team reviewed the sequencing of the procedure steps associated with starting of a charging pump and concluded that, although specific times were not available, it would be likely that seal injection would be restored well within the 19 minute period recommended in the technical bulletin. As a result, a low degradation rating was assigned because the results of the walkdown and procedure reviews showed that the restoration of seal cooling, although inadvertent, would have occurred prior to a significant heat up of the seals and detrimental thermal shock likely would not have occurred.

Enforcement:

Indian Point Unit 3 Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to this requirement, as of February 8, 2008, Entergy did not provide an adequate alternative shutdown procedure to preclude seal leakage rates in excess of Appendix R Safe-Shutdown evaluation as required by Entergys fire protection program. Because this finding was of very low safety significance (Green) and has been entered into Entergys corrective action program (CR-IP3-2008-00410), this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy. NCV 05000286/2008007-01, Inadequate Procedure Guidance to Diagnose and Align RCP Seal Cooling b.2 Steam Generator Blowdown Isolation

Introduction:

The team identified a Green non-cited violation of technical specification 5.4.1.d for failure to provide adequate procedure directions in 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, to ensure operators could isolate steam generator blowdown flow within the time assumed in supporting design calculations.

Description:

The team reviewed Entergys post-fire safe shutdown analysis, post-fire shutdown procedures and associated calculations to determine, in part, whether time critical actions had been identified and that adequate procedures had been implemented to accomplish these actions. The team found that the note preceding step 4.1 of procedure 3-AOP-SSD-1 included isolation of steam generator blowdown flow as a time critical action that should be completed as quickly as possible.

The team also reviewed supporting calculations including IP-CALC-06-00029, Rev. 1, Appendix R Cooldown to RHR Initiation Using Retran-3D, that evaluates a fire protection scenario for IP-3 and assumes steam generator blowdown is isolated at 20 minutes after a reactor trip. Timely isolation of the blowdown flow is necessary to support meeting an acceptance criteria specified in this calculation that was Available steam generator wide range level should remain on span. Also, the team noted that calculation IP-CALC-04-00766, Rev. 1, IP3 SG Boil Dry Analysis with RETRAN-3D, calculated the time for steam generator dryout (loss of effective heat transfer from the reactor coolant system to the steam generators) under various scenarios. The results of this calculation showed that dryout would occur between approximately 30 and 39 minutes depending on assumed initial reactor power level, time delay to the trip of reactor coolant pumps and inventory losses due to steam generator blowdown flow rates of 50 or 80 gpm for a 30 minute duration. The team also reviewed licensed operator lesson plan I3LP-LOR-AOP-010, Safe Shutdown Outside the Control Room, Rev. 1, and noted that the plan specified the time for blowdown isolation as 20 minutes.

The team reviewed procedure 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, and the results of timed walkthroughs of the procedure previously performed by plant operators to assess the performance of time critical actions.

The team found that isolation of steam generator blowdown was not specifically included in the actions for which times were recorded. However, the team noted that the time recorded for energization of 480 volt electrical bus 312 was 19 minutes. Subsequent to the bus energization, the operator performing Attachment 6 to the procedure must perform 12 additional steps prior to reaching the step which isolates steam generator blowdown.

Since it did not appear reasonable to the team that the blowdown isolation time of 20 minutes would be achievable, the team performed a procedure walkthrough with plant operators and determined that blowdown isolation would be achieved in approximately 29 minutes.

The team concluded that the steam generator blowdown isolation would not be accomplished within the 20 minutes assumed in calculation IP-CALC-06-00029 and meeting the 30 minute assumption in calculation IP-CALC-04-00766 would also be challenging. However, the team also concluded that the procedural inadequacy would not result in the plant entering unrecoverable condition due to steam generator dryout because blowdown isolation was performed in less than 30 minutes and because in parallel with the NPO performing the actions of Attachment 6 of procedure 3-AOP-SSD-1, other operators are dispatched to establish auxiliary feedwater flow to the steam generators in accordance with Attachment 2 of the procedure. The results of the licensees timed walkdown showed that feedwater was established in approximately 16 to 18 minutes. The licensee has entered this issue into the corrective action program for resolution.

Analysis:

The team determined that the failure to ensure the plant procedure accomplished time critical actions as quickly as possible was a performance deficiency that was reasonably within Entergys ability to foresee and prevent. Specifically, timed walkthroughs of the procedure did not establish the times for all designated time critical actions and the isolation of steam generator blowdown was procedurally the last step performed by the nuclear plant operator in Attachment 6 to 3-AOP-SSD-1.

This finding was more than minor because it affected the procedure quality attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team assessed this finding in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected post-fire safe shutdown procedures and systems and screened to very low safety significance (Green) in Phase 1 of the SDP because it was assigned a low degradation rating. A low degradation rating was assigned because the procedural deficiency did not result in steam generator dryout and therefore decay heat removal capability was maintained.

Enforcement:

Indian Point Unit 3 Technical Specification 5.4.1.d states in part that, written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to this requirement, as of February 8, 2008, Entergy did not provide an adequate alternative shutdown procedure to ensure time critical actions are performed as quick as possible and in consistent with design calculation assumptions and operator training. Because this finding was of very low safety significance (Green)and has been entered into Entergys corrective action program (CR-IP3-2008-00399), this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy. NCV 05000286/2008007-02, Inadequate Procedure Guidance to Isolate Steam Generator Blowdown Flow b.3 Power Operated Relief Valves (PORVs) and Letdown Isolation Procedure

Introduction:

The team identified a Green non-cited violation of technical specification 5.4.1.d for failure to provide adequate procedure directions in 3-AOP-SSD-1, Control Room Inaccessibility Safe Shutdown Control, Rev. 6, to prevent spurious opening of the PORVs and to close the letdown isolation valves in the event the affected circuits could not be de-energized prior to leaving the control room.

Description:

The team reviewed Entergys post-fire safe shutdown analysis and post-fire shutdown procedures to determine whether the procedures were adequate and consistent with the safe shutdown analysis. The team found that step 4.9 of procedure 3-AOP-SSD-1 directs the operators to open circuit breakers in two DC control panels in the control room prior to evacuating the control room in the event of a fire. The purpose of this step is to prevent possible spurious opening of the PORVs and to isolate letdown flow to conserve reactor coolant system inventory.

Section 3.8.4 of Enclosure 2 to NRC Generic Letter (GL) 86-10, Implementation of Fire Protection Requirements, provides the NRC position on actions the operators can take before evacuating the control room in the event of a fire. The GL states that usually the only manual action given credit for in the control room prior to evacuation is a reactor trip and that for additional actions deemed necessary prior to evacuation a demonstration of the capability of performing such actions would have to be provided.

The team noted that step 4.9 of the procedure directs the operators to open the circuit breakers but does not require it be performed prior to evacuating the control room. If the breakers are not opened prior to evacuating the control room, the procedure does not provide a backup step to accomplish the same function from outside the control room.

There is also a potential that the fire location in the control room may prevent opening the circuit breakers in the control room and thereby necessitate a backup action from outside the control room. The licensee has entered this issue into the corrective action program for resolution.

Analysis:

The team determined that the failure to ensure the plant procedure included the necessary backup steps for control room actions was a performance deficiency that was reasonably within Entergys ability to foresee and prevent. Specifically, the procedure failed to ensure the actions to de-energize the PORVs and letdown isolation valves could be performed and would be performed prior to evacuating the control room and did not provide a backup method to de-energize the circuits from outside of the control room.

This finding was more than minor because it affected the procedure quality attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team assessed this finding in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected post-fire safe shutdown procedures and systems and screened to very low safety significance (Green) in Phase 1 of the SDP because it was assigned a low degradation rating. A low degradation rating was assigned because of the following considerations:

• the control room is continually manned and a fire is likely to be promptly quickly identified and extinguished,

• the DC panel where the actions are required is in the vicinity of, and within sight of, a control room operator such that a fire in these panels would likely be identified and controlled before it would spread to other panels which contain the PORV and letdown valve control circuitry,

• in the event the fire occurred in the DC distribution panel, the associated fire damage would likely trip the upstream feeder circuit breaker and thereby result in de-energization of the circuits of concern,

• timed walkdowns of the control room actions demonstrated that all control room actions (procedure steps 4.1 thru 4.17) can be performed in 2-3 minutes, making it very likely that step 4.9 would be performed prior to evacuation.

Enforcement:

Indian Point Unit 3 Technical Specification 5.4.1.d states in part that, written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to this requirement, as of February 8, 2008, Entergy did not provide an adequate alternative shutdown procedure to ensure necessary actions would be performed prior to control room evacuation. Because this finding was of very low safety significance (Green) and has been entered into Entergys corrective action program (CR-IP3-2008-00409), this violation is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy. NCV 05000286/2008007-03, Inadequate Procedure Directions to De-energize PORV and Letdown Valve Circuits

.02 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the FHA, safe shutdown analyses and supporting drawings and documentation to verify that safe shutdown capabilities were properly protected. The team ensured that separation requirements of Section III.G of 10 CFR 50, Appendix R were maintained for the credited safe shutdown equipment and their supporting power, control and instrumentation cables. This review included an assessment of the adequacy of the selected systems for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and associated support system functions.

The team reviewed the licensee procedures and programs for the control of ignition sources and transient combustibles to assess their effectiveness in preventing fires and in controlling combustibles to assess their effectiveness in preventing fires and in controlling combustible loading within limit established in the FHA. The team performed plant walkdowns to verify that protective features were being properly maintained and administrative controls were being implemented.

b. Findings

No findings of significance were identified.

.03 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe material condition and the adequacy of design of fie area boundaries (including walls, fire doors and fire dampers), and electrical raceway fire barriers to ensure they were appropriate for the fire hazards in the area.

The team reviewed installation/repair and qualification records for a sample of penetration seals to ensure the fill material was of the appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings of significance were identified.

.04 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected plant fire areas. This included verification that the manual and automatic detection and suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association (NFPA) code of record, or as NRC approved deviations, and that each suppression system would control and/or extinguish fires associated with the hazards in the selected areas. A review of the design capability of the suppression agent delivery systems were verified to meet the code requirements for the hazards involved. The team also performed a walkdown of accessible portions of the detection and suppression systems in the selected areas as well as a walkdown of major system support equipment in other areas to assess the material condition of the systems and components.

The team reviewed electric and diesel fire pump flow and pressure tests to ensure that the pumps were meeting their design requirements. The team also reviewed the fire main loop flow tests to ensure that the flow distribution circuits were able to meet the design requirements.

The team also assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown. In addition, the team inspected the fire brigade equipment to determine operational readiness for fire fighting.

b. Findings

No findings of significance were identified.

.05 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed document reviews and plant walkdowns to verify that redundant trains of systems required for hot shutdown are not subject to damage from fire suppression activities or from the rupture of inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas (or the inadvertent actuation or rupture of a fire suppression system) would not directly cause damage to all redundant trains (e.g. sprinkler caused flooding of other than the locally affected train).

• Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings of significance were identified.

.06 Alternative Shutdown Capability

a. Inspection Scope

Alternative shutdown capability for the areas selected for inspection utilizes shutdown from outside the control room and is discussed in section 1R05.01 of this report.

b. Findings

No findings of significance were identified.

.07 Circuit Analysis

a. Inspection Scope

The team verified that the licensee performed a post-fire safe shutdown analysis for the selected fire areas and the analysis appropriately identified the structures, systems, and components important to achieving and maintaining safe shutdown. Additionally, the team verified that the licensees analysis ensured that necessary electrical circuits were properly protected and that circuits that could adversely impact safe shutdown due to hot shorts, shorts to ground, or other failures were identified, evaluated, and dispositioned to ensure spurious actuations would not prevent safe shutdown.

The teams review considered fire and cable attributes, potential undesirable consequences and common power supply/bus concerns. Specific items included the credibility of the fire threat, cable insulation attributes, cable failure modes, multiple spurious actuations, and actuations resulting in flow diversion or loss of coolant events.

The team also reviewed cable raceway drawings for a sample of components required for post-fire safe shutdown to verify that cables were routed as described in the cable routing matrices.

Cable failure modes were reviewed for the following components:

• RCP component cooling water thermal barrier cooling MOVs (AC-MOV-769, AC-MOV-797, AC-FCV-625, and AC-MOV-789);

• RCS letdown level control valves, CH-LCV-459 and CH-LCV460;

• Volume control tank outlet isolation valve, CH-LCV-112C; and

• Refueling water storage tank (RWST) to charging pumps suction valve, CH-LCV-112B.

The team reviewed circuit breaker coordination studies to ensure equipment needed to conducted post-fire safe shutdown activities would not be impacted due to a lack of coordination. The team confirmed that coordination studies had addressed multiple faults due to fire. Additionally, the team reviewed a sample of circuit breaker maintenance and records to verify that circuit breakers for components required for post-fire safe shutdown were properly maintained in accordance with procedural requirements.

b. Findings

No findings of significance were identified.

.08 Communications

a. Inspection Scope

The team reviewed safe shutdown procedures, the safe shutdown analysis, and associated documents to verify an adequate method of communications would be available to plant operators following a fire. During this review the team considered the effects of ambient noise levels, clarity of reception, reliability, and coverage patterns. The team also inspected the designated emergency storage lockers to verify the availability of portable radios for the fire brigade and for plant operators. The team also verified that communications equipment such as repeaters and transmitters would not be affected by a fire.

b. Findings

No findings of significance were identified.

.09 Emergency Lighting

a. Inspection Scope

The team observed the placement and coverage area of eight-hour emergency lights throughout the selected fire areas to evaluate their adequacy for illuminating access and egress pathways and any equipment requiring local operation and/or instrumentation monitoring for post-fire safe shutdown. The team also verified that the battery power supplies were rated for a least an eight-hour capacity. Preventive maintenance procedures, the vendor manual, completed surveillance tests, and battery replacement practices were also reviewed to verify that the emergency lighting was being maintained in a manner that would ensure reliable operation.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee had dedicated repair procedures, equipment, and materials to accomplish repairs of components required for cold shutdown which might be damaged by the fire to ensure cold shutdown could be achieved within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials (e.g. pre-cut cables with prepared attachment lugs) were available and accessible on site.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were in place for out-of-service, degraded or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g. detection and suppression systems and equipment, passive fire barriers, or pumps, valves or electrical devices providing safe shutdown functions or capabilities). The team also verified that the short term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

.01 Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team verified that the licensee was identifying fire protection and post-fire safe shutdown issues and appropriate threshold and entering them into the corrective action program. The team also reviewed a sample of selected issues to verify that the licensee had taken or planned appropriate corrective actions.

Additionally, the team reviewed the status of actions the licensee has taken and actions planned in response to NRC Generic Letter (GL) 2006-003, Potentially Nonconforming Hemyc and MT Fire Barrier Configurations.

b. Findings and Observations

No findings of significance were identified.

The team found that the licensee had submitted a revision to an existing exemption to change the fire resistive rating of the Hemyc electrical raceway fire barrier system from a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> rating to a 30 minute rating. The NRC subsequently approved the exemption request provided the existing Hemyc installations in fire areas ETN-4 and PAB-2 were modified to achieve at least a 24-minute fire resistance rating for cable tray configurations and a 30-minute fire resistance rating for conduits and junction box configurations. The scheduled completion date of the plant modifications and the performance of associated supporting engineering evaluations is December 1, 2008.

The team found that the licensee actions were in progress, with an expected completion date of December 1, 2008. The team confirmed that the Hemyc installations were continuing to be tracked as fire protection system impairments and that compensatory measures (one hour fire watch in affected fire areas) remained in place pending completion of the modifications.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented their preliminary inspection results to Mr. Joseph Pollock, Site Vice-President, and other members of the site staff at an exit meeting on February 8, 2008. No proprietary information was included in this inspection report.

ATTACHMENT

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Bencivenga Design Engineer

F. Bloise Design Engineer

R. Burroni Programs & Components Manager

J. Cottam Fire Protection Engineer

G. Dahl Licensing

M. Dries System Engineer

K. Elliott Fire Protection Engineer

R. Long Plant Operations

M. Troy Plant Programs Supervisor

NRC

J. Rogge, Chief, Engineering Branch 3, Division of Reactor Safety

W. Schmidt, Senior Reactor Analyst, Division of Reactor Safety

P. Cataldo, Senior Resident Inspector, Indian Point Unit 3

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

NONE

Opened and Closed

05000286/2008007-01 NCV Inadequate Procedure Guidance to Diagnose and Align RCP Seal Cooling

05000286/2008007-02 NCV Inadequate Procedure Guidance to Isolate Steam Generator Blowdown Flow

05000286/2008007-03 NCV Inadequate Procedure Directions to De-energize PORV and Letdown Valve Circuits

Closed

NONE

Discussed

NONE