IR 05000293/2015008

IR 05000293/2015008, 11/02/2015 - 11/19/2015, Pilgrim Nuclear Power Station, Triennial Fire Protection Inspection

ML15355A367
Person / Time
Site:	Pilgrim
Issue date:	12/21/2015
From:	Rogge J Engineering Region 1 Branch 3
To:	Dent J Entergy Nuclear Operations
Rogge J
References
IR 2015008
Download: ML15355A367 (29)

Text

J. Den UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION I

2100 RENAISSANCE BLVD., SUITE 100 KING OF PRUSSIA, PA 19406-2713 December 21, 2015 Mr. John Dent Site Vice President Entergy Nuclear Operations, Inc.

Pilgrim Nuclear Power Station 600 Rocky Hill Road Plymouth, MA 02360-5508 SUBJECT: PILGRIM NUCLEAR POWER STATION - TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000293/2015008

Dear Mr. Dent:

On November 19, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed a triennial fire protection inspection at your Pilgrim Nuclear Power Station (Pilgrim). The enclosed inspection report documents the inspection results, which were discussed on November 19, 2015, with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations, and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed station personnel. The inspectors also reviewed mitigation strategies for addressing large fires and explosions.

Based on the results of this inspection, one finding of very low safety significance (Green) was identified. This finding was also determined to be a violation of NRC requirements. However, because of its very low safety significance, and because it was entered into your corrective action program, the NRC is treating this finding as a non-cited violation (NCV) consistent with Section 2.3.2 of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington D.C. 20555-0001; with copies to the Regional Administrator, Region I; Director, Office of Enforcement; and the NRC Resident Inspector at Pilgrim. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region I, and the NRC Resident Inspector at Pilgrim. In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390 of the NRC's

"Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS) component of the NRC's document system, Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

John F. Rogge, Chief Engineering Branch 3 Division of Reactor Safety Docket No: 50-293 License No: DPR-35

Enclosure:

Inspection Report 05000293/2015008 w/Attachment, Supplemental Information

REGION I==

Docket No: 50-293 License No: DPR-35 Report No: 05000293/2015008 Licensee: Entergy Nuclear Operations, Inc. (Entergy)

Facility: Pilgrim Nuclear Power Station (Pilgrim)

Location: 600 Rocky Hill Road Plymouth, MA 02360 Dates: November 2 - 19, 2015 Inspectors: J. Richmond, Senior Reactor Inspector (Team Leader)

Division of Reactor Safety (DRS)

W. Cook, Senior Reactor Analyst D. Orr, Senior Reactor Inspector E. DiPaolo, Senior Reactor Inspector J. Patel, Reactor Inspector L. Dumont, Reactor Inspector Approved by: John F. Rogge, Chief Engineering Branch 3 Division of Reactor Safety i Enclosure

SUMMARY

IR 05000293/2015008; 11/02/2015 - 11/19/2015; Pilgrim Nuclear Power Station (Pilgrim);

Triennial Fire Protection Inspection.

This report covered a two week on-site triennial fire protection team inspection by specialist inspectors. One finding of very low safety significance (Green) was identified. This finding was determined to be a non-cited violation. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process." The cross-cutting aspects associated with findings were determined using IMC 0310, "Components Within the Cross-Cutting Areas." Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649,

"Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very low safety significance involving a non-cited violation of Pilgrim Operating License Condition 3.F for failure to implement and maintain all aspects of the approved Fire Protection Program. Specifically, Entergy's post fire safe shutdown analysis did not adequately evaluate system requirements necessary to achieve cold shutdown conditions when the A Reactor Recirculation System motor operated valves are damaged by fire. As a result, Entergy may not have been able to establish cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, as required by their safe shutdown analysis and regulatory requirements for this scenario. Entergy entered this issue into their corrective action program as condition reports CR-PNP-2015-09136 and CR-PNP-2015-09400, and implemented fire watches in the affected fire areas as an interim compensatory measure.

The finding was more than minor because it was similar to example 3.k of the NRC Inspection Manual Chapter (IMC) 0612, Appendix E, "Examples of Minor Issues," and was associated with the Protection Against External Factors (e.g., fire) attribute of the Mitigating Systems Cornerstone and adversely affected the objective to ensure the availability and reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). The team performed a Phase 1 Significance Determination Process (SDP) screening, in accordance with IMC 0609, Appendix F, "Fire Protection SDP." This finding screened to very low safety significance (Green) because it did not affect the ability to reach and maintain a hot shutdown condition (i.e., it only affected the ability to reach or maintain cold shutdown conditions). This finding had a cross-cutting aspect in the area of Problem Identification & Resolution, Evaluation, because, in 2013, Entergy incorrectly assumed that the B RRS MOVs would be available during any fire that could damage the A MOV cables without thoroughly evaluating whether the routing for the B MOV cables ensured they would remain undamaged and available. [P.2] (Section 1R05.06)

Other Findings

A violation of very low safety significance that was identified by Entergy was reviewed by the inspectors. Corrective actions taken or planned by Entergy have been entered into Entergy's corrective action program. This violation and corrective action tracking numbers are listed in Section 4OA7 of this report.

ii

REPORT DETAILS

Background This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure (IP) 71111.05T, "Fire Protection." The objective of the inspection was to assess whether Entergy Nuclear Operations, Inc. (Entergy) had implemented an adequate fire protection program and whether post-fire safe shutdown capabilities had been established and were properly maintained at Pilgrim Nuclear Power Station (Pilgrim). The following fire areas (FAs) or fire zones (FZs) were selected for detailed review based on prior inspection results and risk insights from the Pilgrim Individual Plant Examination of External Events (IPEEE):

Fire Areas (Fire Zones)

• FZ 1.10 Reactor Building (RB) West Elevation (Elev.) 23 foot

• FZ 1.22 "B" Reactor Building Closed Cooling Water Pump Room (RBCCW)

Reactor Auxiliary Bay Elev. 3 foot

• FA 3.2 Cable Spreading Room (CSR)

Inspection of these fire areas/zones fulfilled the inspection procedure requirement to inspect a minimum of three samples.

The inspection team evaluated Entergy's fire protection program (FPP) against applicable requirements which included Technical Specifications, Operating License Condition 3.F, NRC Safety Evaluation Reports (SERs), 10 CFR 50.48, and 10 CFR 50, Appendix R and Branch Technical Position (BTP) Auxiliary and Power Conversion Systems Branch (APCSB)9.5-1 and Appendix A. The team also reviewed related documents that included the Updated Final Safety Analysis Report (UFSAR), Section 10.8, fire protection plan, fire hazards analysis (FHA), and post-fire safe shutdown (SSD) analyses.

The team evaluated aspects of three mitigating strategies for responding to large fires and explosions, which are required by Operating License Condition 3.K and 10 CFR 50.54(hh)(2).

The team also reviewed related documents that included Nuclear Energy Institute (NEI) 06-12, "B.5.b Phases 2 & 3 Submittal Guidance." Inspection of these strategies fulfills the inspection procedure requirement to inspect a minimum of one sample.

Specific documents reviewed by the team are listed in the Attachment to this report.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection (IP 71111.05T)

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the FHA, post-fire safe shutdown analyses, and supporting drawings and documents to verify whether the safe shutdown capabilities were properly protected from fire damage. The team evaluated equipment and cable separation to determine whether the applicable separation requirements of Appendix R,Section III.G, and the Pilgrim design and licensing bases were maintained for the credited safe shutdown equipment and their supporting power, control, and instrumentation cables. The team's review included an assessment of the adequacy of the selected systems for reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and associated support system functions.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to evaluate whether the material conditions of the fire area boundaries were adequate for the fire hazards in the area. The team compared the fire area boundaries, including walls, ceilings, floors, fire doors, fire dampers, penetration seals, electrical raceway and conduit fire barriers, and redundant equipment fire barriers and radiant energy heat barriers to design and licensing basis requirements, industry standards, and the Pilgrim FPP, as approved by the NRC, to identify any potential degradation or non-conformances.

The team reviewed selected engineering evaluations, installation and repair work orders, and qualification records for a sample of penetration seals to determine whether the fill material was properly installed and whether the as-left configuration satisfied design requirements for the intended fire rating. The team also reviewed similar records for selected fire protection wraps to verify whether the material and configuration was appropriate for the required fire rating and conformed to the engineering design.

The team also reviewed recent inspection and functional test records for fire dampers, and the inspection records for penetration seals and fire barriers, to verify whether the inspection and testing were adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

In addition, the team reviewed recent test results for the Halon fire damper functionality tests for the CSR to verify whether the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team evaluated manual and automatic fire suppression and detection systems in the selected fire areas to determine whether they were installed, tested, maintained, and operated in accordance with NRC requirements, National Fire Protection Association (NFPA) codes of record, and the Pilgrim FPP, as approved by the NRC. The team also assessed whether the suppression systems capabilities were adequate to control and/or extinguish fires associated with the hazards in the selected areas.

The team reviewed the as-built capability of the fire water supply system to verify whether the design and licensing basis and NFPA code of record requirements were satisfied, and to assess whether those capabilities were adequate for the hazards involved. The team reviewed the fire water system hydraulic analyses to assess the adequacy of a single fire water pump to supply the largest single hydraulic load on the fire water system plus concurrent fire hose usage. The team evaluated the fire pump performance tests to assess the adequacy of the test acceptance criteria for pump minimum discharge pressure at the required flow rate, to verify whether the criteria was adequate to ensure that the design basis and hydraulic analysis requirements were satisfied. The team also evaluated the underground fire loop flow tests to verify whether the tests adequately demonstrated that the flow distribution circuits were able to meet design basis requirements. In addition, the team reviewed recent pump and loop flow test results to verify whether the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

The team reviewed design specifications, vendor requirements, and routine functional testing for the Halon suppression system for the CSR. The team walked down accessible portions of the Halon system, including storage tanks and supply systems, to independently assess the material condition, operational lineup, and availability of the system. The team also reviewed and walked down the associated firefighting strategies and Halon system operating procedures.

The team walked down accessible portions of the detection and water suppression systems in the selected areas and major portions of the fire water supply system, including motor and diesel driven fire pumps and fire water storage tanks, interviewed system and program engineers, and reviewed selected condition reports (CRs) to independently assess the material condition of the systems and components.

In addition, the team reviewed recent test results for the fire detection and suppression systems for the selected fire areas to verify whether the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed Pilgrim's firefighting strategies (i.e., pre-fire plans) and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. The team independently inspected the fire brigade equipment, including personnel protective gear (e.g., turnout gear) and smoke removal equipment, to determine operational readiness for firefighting.

In addition, the team reviewed Pilgrim's fire brigade equipment inventory and inspection procedure and recent inspection and inventory results to verify whether adequate equipment was available, and whether any potential material deficiencies were identified.

b. Findings

No findings were identified.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed document reviews and plant walkdowns to determine whether redundant trains of systems required for hot shutdown, located in the same or adjacent fire areas, were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team evaluated whether:

• A fire in one of the selected fire areas would not release smoke, heat, or hot gases that could cause unintended activation of suppression systems in adjacent fire areas which could potentially damage all redundant safe shutdown trains

• A fire suppression system rupture, inadvertent actuation, or actuation due to a fire, in one of the selected fire areas, could not directly damage all redundant trains (e.g. sprinkler caused flooding of other than the locally affected train) and

• Adequate drainage was provided in areas protected by water suppression systems

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the UFSAR, and other supporting documents for the selected fire areas to verify whether Entergy had properly identified the systems and components necessary to achieve and maintain post-fire safe shutdown conditions. The team evaluated selected systems and components credited by the safe shutdown analysis for reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support system functions to assess the adequacy of Entergy's alternative shutdown methodology. The team also assessed whether alternative post-fire shutdown could be performed both with and without the availability of off-site power. The team walked down selected plant configurations to verify whether they were consistent with the assumptions and descriptions in the safe shutdown and fire hazards analyses. In addition, the team evaluated whether the systems and components credited for use during post-fire safe shutdown would remain free from fire damage.

The team reviewed the training program for licensed and non-licensed operators to verify whether it included alternative shutdown capability. The team also verified whether personnel required for post-fire safe shutdown, using either the normal or alternative shutdown methods, were trained and available on-site at all times, exclusive of those assigned as fire brigade members.

The team reviewed the adequacy of procedures utilized for post-fire shutdown and performed an independent walk through of procedure steps (i.e., a procedure tabletop)to assess the adequacy of implementation and human factors within the procedures.

The team also evaluated the time required to perform specific actions to verify whether operators could reasonably be expected to perform those actions within sufficient time to maintain plant parameters within specified limits.

Specific procedures reviewed for normal and alternative post-fire shutdown included:

• 2.4.143, Shutdown from Outside Control Room, Revision 53, 54, 55, and 56

• 2.4.143.2, Shutdown with a Fire in Reactor Building West (Fire Area 1.10)

Revision 25

• 2.4.143.2, Shutdown with a Fire in Reactor Building West (Fire Area 1.10)and Affected "B" Division (Fire Areas 1.22, 1.23, 1.28, 2.1, 2.10, 3.5, 4.1, 5.3)

Revision 26

• 5.5.1, General Fire Procedure, Revision 27

• 5.5.2, Special Fire Procedure, Revision 53 The team reviewed selected operator manual actions to verify whether they had been properly reviewed and approved and whether the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area.

The team also reviewed the periodic testing of the alternative shutdown transfer and isolation capability, and instrumentation and control functions, to evaluate whether the tests were adequate to ensure the functionality of the alternative shutdown capability.

b. Findings

No findings were identified.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed Entergy's post-fire safe shutdown analysis for the selected fire areas to determine whether the analysis identified both required and associated electrical circuits and cables for the systems and components necessary to achieve and maintain safe shutdown. The team reviewed electrical schematics and cable routing data for power, control, and instrument cables associated with selected components.

Specifically, the team evaluated the selected circuits and cables to determine whether they were

(a) adequately protected from potential fire damage, or

(b) analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown, or

(c) analyzed to show that potential damage could be mitigated with approved operator manual actions, in order to verify whether fire-induced faults could adversely impact safe shutdown capabilities. The team's evaluations considered credible fire scenarios, cable insulation attributes, cable failure modes, cable routing, and common power supply or electrical bus configurations.

In addition, the team reviewed cable raceway drawings and cable routing databases for a sample of components required for post-fire safe shutdown to determine whether those cables were routed as described in the safe shutdown analysis. The team also reviewed equipment important to safe shutdown, but not part of the success path, to assess whether Entergy's safe shutdown methodologies were appropriate, conformed to design and licensing basis requirements.

Cable failure modes were reviewed for the following components:

• MO1001-7A, Residual Heat Removal (RHR) Loop A Pump A Suction Valve

• MO4060A, RBCCW Loop A RHR Heat Exchanger A Inlet Valve

• MO1301-22, Condensate Storage Tank to Reactor Core Isolation Cooling (RCIC) Pump Suction Valve

• MO202-4A, Reactor Recirculation System (RRS) Pump A Suction Valve

• P202A, RBCCW Loop A Pump A

• TI5021-01A, Torus Temperature Indicator The team reviewed a sample of circuit breaker and fuse over-current protection coordination studies to determine whether equipment needed for post-fire safe shutdown activities could be adversely affected due to a lack of coordination that could result in a common power supply or common electrical bus concern.

The team assessed the transfer of control from the control room to the alternative shutdown locations to determine whether it would be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

.1 Failure to Analyze Reactor Recirculation System Motor Operated Valves for the Post-fire

Cold Shutdown Function

Introduction:

The team identified a finding of very low safety significance (Green),involving a non-cited violation of Pilgrim Operating License Condition 3.F for failure to implement and maintain all aspects of the approved Fire Protection Program.

Specifically, Entergy's post fire safe shutdown (SSD) analysis did not adequately evaluate system requirements necessary to achieve cold shutdown conditions (CSD)when the A Reactor Recirculation System motor operated valves are damaged by fire.

As a result, Entergy may not have been able to establish cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, as required by their safe shutdown analysis and regulatory requirements for this scenario. As a result, Entergy may not have been able to establish RHR shutdown cooling (SDC) in order to achieve CSD within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, as required by their SSD analysis and Appendix R,Section III.G.3 regulatory requirements.

Description:

Entergy's SSD analysis (PS-32, "Appendix R Safe Shutdown Analysis")

stated that for FA 1.9 (RB East), the CSD heat removal function was accomplished using the "B" train of RHR in the SDC mode. For FA 1.9, "A" RHR SDC was analyzed as failed due to fire damage. For FA 3.1 (main control room (MCR)) and FA 3.2 (CSR), the SSD analysis stated that both the "A" and "B" trains of RHR SDC were available to perform the CSD heat removal function. All three FAs required alternative shutdown from outside the MCR. Entergy's alternative shutdown operating procedure 2.4.143 directed operators to close the RRS pump discharge motor operated valve (MOV) for the associated RHR train (e.g., RRS MOV MO202-5A for "A" RHR, and RRS MOV MO202-5B for "B" RHR).

The team determined that if both the suction and discharge RRS MOVs remained open in the RRS loop to which the RHR pump discharge was aligned, then RHR flow would bypass the reactor core and SDC would not be established. The team identified the following deficiencies with Entergy's SSD analysis:

• Motor Control Center (MCC) B-20 was the power source for all four RRS pump MOVs and was located in FA 1.9

• "B" loop RRS MOVs MO202-4B and MO202-5B were not included in the SSD analysis and had not been evaluated to determine whether they would remain free of fire damage

• "A" loop RRS MOVs MO202-4A and MO202-5A were analyzed in the SSD model as available for remote operation from MCC B-20 for FAs 3.1 and 3.2.

However, the SSD analysis also identified that the "A" loop RRS MOVs were susceptible to fire damage as described in NRC Information Notice (IN)92-18, "Potential for Loss of Remote Shutdown Capability during a Control Room Fire" For FA 1.9, the team concluded that Entergy had not adequately evaluated the only credited CSD heat removal method (i.e., "B" RHR SDC). This was because the "B" RRS MOVs were not included in the SSD analysis and because the MCC, relied upon to power and operate the MOVs, was also located in the FA of concern.

For FAs 3.1 and 3.2, the team concluded that Entergy had not adequately evaluated either credited CSD heat removal method (i.e., either "A" or "B" RHR SDC). The "B" RHR SDC had not been adequately evaluated because the "B" RRS MOVs were not included in the SSD analysis. In addition, the team identified that the "B" RRS MOVs were also susceptible to fire damage as described in IN 92-18. Based on interviews with Entergy's staff, the team determined that Entergy had previously evaluated the potential fire damage to the "A" RRS MOVs as acceptable because if the "A" MOVs had failed open due to fire damage, Entergy had assumed that the "B" MOVs would have remained free of fire damage and available to place "B" RHR into SDC. However, the team determined that all four of the "A" and "B" RRS MOVs could fail open from a fire in either FA 3.1 or 3.2 because there were no isolation or transfer switches installed at the alternative shutdown panel locations for those MOVs and there were no operating procedure instructions to de-energize them at the MCC to prevent potential fire damage.

As a consequence, since all four RRS MOVs were susceptible to fire damage in FAs 3.1 and 3.2 and no actions were taken to prevent or mitigate the postulated fire damage, the team concluded that both trains of RHR SDC might be unavailable to achieve CSD.

Entergy entered this issue into their corrective action program as CRs CR-PNP-2015-09136 and CR-PNP-2015-09400, and implemented fire watches in the affected fire areas as an interim compensatory measure.

Analysis:

The team determined that a failure to ensure MOVs necessary to achieve CSD within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> would remain functional was a performance deficiency.

Specifically, Entergy's CSD method required operators to re-position the "A" or "B" train RRS MOVs from open to closed, but the SSD analysis had not evaluated "B" train RRS MOVs, and had assumed that if the "A" train RRS MOVs had failed in the open position, then the "B" MOVs would be available for use.

This finding was more than minor because it was similar to example 3.k of Inspection Manual Chapter (IMC) 0612, Appendix E, "Examples of Minor Issues," which determined that calculation errors would be more than minor if, as a result of the errors, there was reasonable doubt of the operability of the component. For this issue, the team had a reasonable doubt as to whether CSD could be established within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> using the credited SSD method. In addition, this issue was associated with the Protection Against External Factors (e.g., fire) attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability and reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

The team performed a Phase 1 Significance Determination Process (SDP) screening, in accordance with IMC 0609, Appendix F, "Fire Protection SDP." This issue screened to very low safety significance (Green) because it did not affect the ability to reach and maintain a hot shutdown condition (i.e., it only affected the ability to reach or maintain CSD conditions).

This finding had a cross-cutting aspect in the area of Problem Identification and Resolution, Evaluation. Specifically, in 2013, Entergy evaluated the "A" RRS MOVs and determined that they did not need to be protected from fire damage to eliminate the IN 92-18 vulnerability based on redundancy provided by the "B" RRS MOVs. Entergy incorrectly assumed that the "B" RRS MOVs would be available during any fire that could damage the "A" MOV cables without thoroughly evaluating whether the routing for the "B" MOV cables ensured they would remain undamaged and available. [P.2]

Enforcement:

Pilgrim License Condition 3.F, in part, required Entergy to implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved by the NRC. Entergy's SSD analysis PS-32, Section 6.2, stated that FAs 1.9, 3.1, and 3.2 satisfied the requirements for Appendix R,Section III.G.3 and utilized Alternative Shutdown Capability. Section 4.1, stated that the Alternative Shutdown Capability satisfied the requirements of Appendix R,Section III.G and III.L. Appendix R,Section III.L.1.(d), stated, in part, that Alternative Shutdown Capability shall be able to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Contrary to above, from 1992 (i.e., when susceptibility for potential MOV damage was identified in IN 92-18) until present, Entergy did not ensure that cold shutdown conditions could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for all fire areas utilizing Alternative Shutdown Capability. Specifically, Entergy's SSD analysis did not include RRS MOVs which were required to be re-positioned in order to implement the credited CSD method. As a consequence, Entergy may not have been able to establish RHR SDC as intended, and may not have been able to achieve CSD within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Because this finding was of very low safety significance (Green) and was entered into Entergy's corrective action program (CR-PNP-2015-09136 and CR-PNP-2015-09400), this violation is being treated as an NCV, consistent with Section 2.3.2.a of the NRC Enforcement Policy. (NCV 05000293/2015008-01, Failure to Analyze Reactor Recirculation System Motor Operated Valves for the Post-fire Cold Shutdown Function)

.07 Communications

a. Inspection Scope

The team reviewed safe shutdown procedures, the safe shutdown analysis, and associated documents to verify whether an adequate method of communications would be available to plant operators following a fire and during an alternative safe shutdown scenario. Specifically, the team evaluated whether plant telephones, page systems, and portable radios would be available for use and were properly maintained. During this review, the team considered the effects of ambient noise levels, clarity of reception, reliability, and coverage patterns.

The team inspected selected emergency storage lockers to independently verify whether portable communication equipment was available for the fire brigade and plant operators. In addition, the team evaluated whether radio or phone repeaters, transmitters, and power supplies would be reasonably unaffected by a fire.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team walked down the emergency lights in the selected fire areas to independently evaluate the placement and coverage areas of the lights. The team assessed whether the lights provided adequate illumination on local equipment and instrumentation required for post-fire safe shutdown, to ensure local operations could be reliably performed under expected post-fire conditions. Emergency light placement was also evaluated to determine adequate illumination of local area access and egress pathways.

The team verified whether the emergency light batteries were rated for at least an eight-hour capacity. Preventive maintenance procedures, the vendor manual, completed surveillance tests, and battery replacement practices were also reviewed to evaluate whether the emergency lighting had been maintained in a manner that would ensure reliable operation.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

Entergy did not identify any systems or components that would require repairs to achieve post-fire cold shutdown. The team assessed Entergy's determination that no dedicated repair procedures, equipment, or materials were needed to accomplish repairs of components required for cold shutdown which might be damaged by a fire, to verify whether cold shutdown could be achieved within the time frames specified in the design and licensing bases without performing any cold shutdown repairs.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified whether compensatory measures were in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment, passive fire barriers, pumps, valves, or electrical devices providing safe shutdown functions or capabilities).

The team evaluated whether the short term compensatory measures adequately compensated for the degraded function or feature until appropriate corrective action could be taken and whether Entergy was effective in returning the equipment to service in a reasonable period of time. The team noted that for the selected fire areas which were designated as 10 CFR 50 Appendix R, Section III.G.2 areas, there were no compensatory measures in the form of operator manual actions.

b. Findings

No findings were identified.

.11 Review and Documentation of FPP Changes

a. Inspection Scope

The team reviewed recent changes to the approved fire protection program to assess whether those changes had an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed Entergy's procedures and programs for the control of ignition sources and transient combustibles to assess their effectiveness in preventing fires and in controlling combustible loading within limits established in the FHA. A sample of hot work and transient combustible control permits were reviewed to assess the adequacy of Entergy's fire protection program administrative controls. The team performed plant walkdowns to independently verify whether transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Large Fires and Explosions Mitigation Strategies

a. Inspection Scope

The team conducted a review of selected mitigation strategies intended to maintain or restore core decay heat removal and spent fuel pool cooling capabilities under the circumstances associated with the loss of large areas of the plant due to explosions and/or fires. The team assessed whether Entergy continued to meet the requirements of Pilgrim License Condition 3.K and 10 CFR 50.54(hh)(2).

The team reviewed three mitigation strategies:

• Spent Fuel Pool Internal Make-Up

• Spent Fuel Pool External Make-Up and

• Primary Containment Injection (i.e., Containment Flooding)

The team's review included: a detailed assessment of the procedural guidance; a walk down of three mitigation strategies with trained operators to assess the feasibility of the strategies and operator familiarity; maintenance and surveillance testing of selected strategy equipment; and an inventory check of selected strategy equipment to ensure the appropriateness of equipment storage and availability. The team also evaluated the adequacy of corrective actions associated with issues identified during previous inspections and recent self-assessments in this area. The documents reviewed are listed in the attachment to this report.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems (IP 71152)

a. Inspection Scope

The team reviewed a sample of CRs associated with the fire protection program, post-fire safe shutdown issues, and mitigation strategy issues to determine whether Entergy was appropriately identifying, characterizing, and correcting problems associated with these areas and whether the planned or completed corrective actions were appropriate.

The CRs reviewed are listed in the attachment.

b. Findings

No findings were identified.

4OA3 Follow-Up of Events and Notices of Enforcement Discretion (IP 71153 - 1 Sample)

.1 (Closed) Licensee Event Report (LER) 05000293/2015-010-00

Motor-Operated Valve Control Circuit Vulnerability to IN 92-18 Concern During an industry initiative to review multiple spurious operation (MSO) issues in the 2006 to 2012 time frame, Entergy identified a vulnerability that involved lack of limit switch and torque switch protection of MOVs. This potential vulnerability was described in NRC Information Notice (IN) 92-18, "Potential for Loss of Remote Shutdown Capability during a Control Room Fire." The specific vulnerability involved the unlikely scenario of a large scale fire, forced evacuation of the MCR, and subsequent inability to operate MOVs from their alternative control locations due to spurious operation caused by postulated fire damage to the MOV control cables.

On October 5, 2015, Entergy determined that the above described vulnerability constituted an unanalyzed condition that degraded plant safety. For a few areas designated as Appendix R,Section III.G.3 alternative shutdown areas, Entergy concluded that their safe shutdown methodology did not ensure that one train of equipment, necessary to achieve and maintain post-fire safe shutdown, would be available from their alternative control locations. Entergy entered this issue into their corrective action program as CRs CR-PNP-2015-07993 and CR-PNP-2015-08286.

Entergy determined that existing compensatory measures for other fire program deficiencies were not sufficient for the identified MOV vulnerabilities and implemented fire watches in additional plant areas where MOV local operation was credited for the MOV control cables that could be affected. Longer term corrective actions included valve control circuit modifications to eliminate the vulnerabilities.

Entergy determined the cause of the condition was the result of incorrect assumptions made in the 1992-1993 time frame during the plant staff's review of the IN 92-18 issue, along with improper use of Entergy's corrective action program once the vulnerability was identified in 2012. Specifically, Entergy did not correctly categorize the deficiency as a condition adverse to fire protection, and as a result did not identify appropriate compensatory measures along with NRC reportability requirements. There were no actual safety consequences of this condition (i.e., a fire event did not occur).

The team reviewed the LER, the associated causal analysis and corrective actions taken and planned, interviewed Entergy staff, and walked down associated cables. The significance and enforcement aspect of this issue is discussed in Section 4OA7 of this inspection report. The inspectors did not identify any new issues during the review of this LER. This LER is closed.

4OA6 Meetings, including Exit

The team presented the inspection results to Mr. John Dent, Site Vice President, and other members of Entergy's staff on November 19, 2015. The team verified that this report does not contain proprietary information.

4OA7 Licensee Identified Violations

The following violation of very low safety significance (Green) was identified by Entergy and was a violation of NRC requirements which met the criteria of the NRC Enforcement Policy for being dispositioned as a non-cited violation.

.1 Motor-Operated Valve Control Circuit Vulnerability due to Fire Damage

LER 05000293/2015-010-00 described an unanalyzed condition in which Entergy identified that selected MOVs were subject to fire-induced failures. As a result, Entergy determined that the postulated fire damage might adversely affect their ability to achieve or maintain post-fire safe shutdown.

Failure to ensure that one train of equipment, necessary to achieve and maintain safe shutdown, would remain free of fire damage was a licensee-identified performance deficiency. This performance deficiency was more than minor because it was associated with the Protection Against External Factors (e.g., fire) attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability and reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

This performance deficiency was a violation of Pilgrim Operating License Condition 3.F which, in part, required Entergy to implement and maintain in effect all fire protection features described in licensee submittals and as approved by the NRC. The Pilgrim FPP required Entergy to maintain one train of equipment necessary to achieve and maintain safe shutdown free of fire damage.

Contrary to Pilgrim's License Condition, from 1992 (i.e., when susceptibility for potential MOV damage was identified in IN 92-18) until present, Entergy did not maintain one train of equipment necessary to achieve and maintain safe shutdown free of fire damage.

Specifically, Entergy determined that some MOVs, which were required to support safe shutdown, could have been disabled as a result of fire damage to unprotected MOV control circuits. Entergy entered this issue into their corrective action program as CRs CR-PNP-2015-07993 and CR-PNP-2015-08286. Corrective actions taken or planned included additional analysis of safe shutdown methods and design modifications to eliminate the identified susceptibility to the postulated fire damage for selected MOVs.

Compensatory measures included fire watches in the affected fire areas.

Entergy evaluated this issue using the guidance in IMC 0609, Appendix F, "Fire Protection SDP," and determined that this issue was of very low safety significance. A Region 1 Senior Reactor Analyst (SRA) reviewed Entergy's evaluation and concluded that their significance determination was reasonable and appropriately bounded by conservative assumptions. Based upon detailed cable routing analysis and plant walkdowns, Entergy identified four plant areas where postulated fire damage could potentially compromise the credited safe shutdown trains. The four FAs were 1.9 (RB east side, Elev. 23-foot and 51-foot), 1.10 (RB west side, Elev. 23-foot and 51-foot),3.1 (MCR), and 3.2 (CSR). Entergy documented their risk evaluations in Engineering Calculation Nos. EC-61592 and EC-61735.

The inspection team walked down the four affected fire areas and sampled selected cables for independent verification, including consideration of: ignition sources and estimated fire frequencies, fire propagation and duration, probability of non-suppression and fire damage severity factors. The SRA verified that Entergy properly adhered to the guidance in IMC 0609, Appendix F, to assess the risk significance of postulated fire damage to targeted MOV cables outside of the MCR (i.e., in FAs 1.9, 1.10, and 3.2).

The SRA used the Pilgrim Standardized Plant Analysis Risk (SPAR) model to independently estimate the conditional core damage probabilities for the postulated fire scenarios and calculated comparable results. Based upon the Appendix F screening criteria and consideration for both zone of influence and hot gas layer fire damage state scenarios (FDS1 and FDS2, respectively), Entergy estimated the increase in risk to core damage associated with the targeted MOV cables outside of the MCR to be 2.3E-7/year.

Using similar methodology for FA 3.1 (MCR), Entergy estimated the increase in risk to core damage associated with the targeted cables in selected control room panels to be 3.8E-7/year. Collectively, the overall increase in core damage frequency for this performance deficiency was in the mid E-7 range, or very low risk significance (Green).

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

B. Ahern, System Engineer

D. Berkland, Senior Electrical Design Engineer

S. Burke, Senior Staff Engineer

F. Clifford, Operations Support Manager

J. Dent, Site Vice President

P. Harizi, Thermo-Hydraulic Design Engineer

M. Landry, Fire Protection System Engineer

C. Littleton, Probabilistic Risk Analysis Senior Engineer

F. McGinnis, Senior Licensing Engineer

C. McMorrow, Fire Marshal

D. Mannai, Senior Manager, Entergy Regularity Assurance North

E. Perkins, Regulatory Assurance Manager

J. Tucker, Mechanical Design Engineer

T. White, Design & Program Engineering Manager

NRC Personnel

E. Carfang, Senior Resident Inspector, Pilgrim

B. Scrabeck, Resident Inspector, Pilgrim

D. Frumkin, Fire Protection Branch, Nuclear Reactor Regulation (NRR)

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

05000293/2015008-01 NCV Failure to Analyze Reactor Recirculation System Motor Operated Valves for the Post-fire Cold Shutdown Function (Section 1R05.06)

Closed

05000293/2015-010-00 LER Motor-Operated Valve Control Circuit Vulnerability to IN 92-18 Concern (Section 4OA3)