IR 05000298/2010006

IR 05000298-10-006, on October 18,2010 - March 14, 2011, Nebraska Public Power District; Cooper Nuclear Station: Triennial Fire Protection Team Inspection, Preliminary White Finding

ML110760579
Person / Time
Site:	Cooper
Issue date:	03/17/2011
From:	Anton Vegel Division of Reactor Safety IV
To:	O'Grady B Nebraska Public Power District (NPPD)
References
EA-11-024 IR-10-006
Download: ML110760579 (55)

Text

March 17, 2011

SUBJECT:

COOPER NUCLEAR STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000298/2010006; PRELIMINARY WHITE FINDING

Dear Mr. O'Grady:

On November 5,2010, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Cooper Nuclear Station. The enclosed inspection report documents the inspection results, which were discussed in an exit meeting on March 14, 2011, with Mr. D. Buman, Director of Engineering, and other members of your staff.

During this inspection, the NRC staff examined activities conducted under your license as they relate to public health and safety and compliance with the Commission's rules and regulations and with the conditions of your license. Within these areas, the inspection consisted of selected examination of procedures and representative records, observations of activities, and interviews with personnel.

Based on the results of this inspection, the NRC has identified two findings that were evaluated for risk under the Significance Determination Process. Violations were associated with each of the findings.

The attached report discusses a finding that was preliminarily determined to be a White finding, a finding with low-to-moderate increased safety significance which may require additional NRC inspections. This finding was assessed based on the best available information, including influential assumptions, using the applicable Significance Determination Process (SOP). As described in Section 1 R05.01 of the attached report, this finding involves the failure to verify that procedure steps to safely shutdown the plant in the event of a fire would actually reposition three motor operated valves to the required positions and the concurrent failure to address a previous finding that involved the same procedure steps. This finding has preliminary low-to-moderate safety significance because it involves llJultiple fire areas and risk factors that were not dependent on specific fire damage. The scenarios of concern involve larger fires in specific areas of the piant which trigger operators to implement fire response procedures to place the plant in a safe shutdown condition. Since performing some of those actions using the

Nebraska Public Power District 2-procedures as not have aligned three valves to their required positions, this would challenge the operators' ability to establish adequate core cooling. This finding does not represent an immediate safety concern because your staff promptly changed the procedures to

!ocally reposition position the valves.

This finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy. The current Enforcement Policy is included on the NRC's web site at.:..:.==~..:....:...:...=:...~.;::..::..:-==c:::=c::...

In accordance with Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final determination of safety significance within 90 days of this letter. The significance determination process encourages an open dialog between the staff and the licensee; however the dialogue should not impact the timeliness of the staff's final determination. Before we make a final decision on this matter, we will hold a Regulatory Conference to provide you an opportunity to present to the NRC your perspectives on the facts and assumptions used by the NRC to arrive at the finding and assess its significance. The Regulatory Conference should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. This Regulatory Conference will be open for public observation.

At the Regulatory Conference, in addition to providing your perspectives on the finding and the significance, please be prepared to discuss (1) the cause(s) for the performance deficiency, (2)

corrective actions taken or planned for the performance deficiency, and (3) the reasons why your corrective actions for Violation 05000298/2008008-01, a finding with low-to-moderate safety significance, were not adequate to verify that the procedure would have worked as intended.

Please contact Neil O'Keefe at (817) 860-8137 within 10 days of receipt of this letter to schedule a date for the Regulatory Conference. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.

Because the NRC has not made a final determination for this matter, no Notice of Violation is being issued for this inspection finding at this time. In addition, please be advised that the characterization of the apparent violation described in the enclosed inspection report may change as a result of further NRC review.

Based on the results of this inspection, the NRC has also identified one additional issue that was evaluated under the risk significance determination process as having very low safety significance (Green). The finding was determined to involve a violation of NRC requirements.

However, because it was entered into your corrective action program, the NRC is treating the finding as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy.

The NCV is described in the subject inspection report. If you contest the noncited violation or the significance of the noncited violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, A TIN: Document Control Desk, Washington DC 20555-0001, with copies to: (1)

the Regional Administrator, Region IV; (2) the Director, Office of Enforcement, U. S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and (3) the NRC Resident Inspector at

Nebraska Public Power District

- 3 -

Cooper Nuclear Station.

addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at Cooper Nuclear Station. The information you provide wil! be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure(s), and your response, if you choose to provide one, will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC Web site at ~~:::".,,",-:c.:~.~~=,,::::~=~;:L.

To the extent possible, your response should not include any personal privacy or proprietary, information so that it can be made available to the Public without redaction.

Docket No. 50-298 License No. DPR-46

Sincerely, Anton Vegel, DT-Division of Reactor Safety Enclosure: Inspection Report No. 05000298/2010006 w/Attachments: Supplemental Information Final Significance Determination Summary cc w/enclosure:

Distribution via ListServ for CNS

Docket:

License:

Report Nos.:

Licensee:

Facility:

Location:

Dates:

Team Leader:

Inspectors:

Approved By:

U 50-298 DPR-46 05000298/2010006 Nebraska Public Power District Cooper Nuclear Station 72676 648A Avenue Brownville, NE 68321 COMMISSION October 18, 2010 through March 14, 2011 J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 S. Alferink, Reactor Inspector, Engineering Branch 2 E. Uribe, Reactor Inspector, Engineering Branch 2 J. Watkins, Reactor Inspector, Engineering Branch 2 G. George, Reactor Inspector, Engineering Branch 1 Anton Vegel, Director n;\\I;",jnn nf RQ<:>f'tnr <::<:>fQt\\l 1-01'1 v IVlVI I VI 1'

...... c..tVLVI

"-'-Alw]

- 1 -

Enclosure

SUMMARY

IR 05000298/2010006; October 18,2010 - March 14, 2011, Nebraska Public Power District;

Cooper Nuclear Station: Triennial Fire Protection Team Inspection.

This report covers a two week fire protection team inspection, follow-up inspection and significance determination effort by specialist inspectors from Region IV. One finding was identified with an associated apparent violation, vvhich was preliminary determined to have low-to-moderate safety significance (White). Two Green findings, which were noncited violations (NCVs), were also identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process (SOP) does not apply may be Green or be assigned a severity level after NRC management review. The crosscutting aspects, where applicable, were determined using Inspection Manual Chapter 0310, "Components Within the Cross Cutting Areas." The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

..

Apparent Violation. An apparent violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," and Criterion XVI, "Corrective Action," with a preliminary white significance, was identified for failure to ensure that some steps contained in Emergency Procedures at Cooper Nuclear Station would work as written and the concurrent failure to assure that a condition adverse to quality was promptly identified and corrected, respectively. Specifically, steps in Emergency Procedure 5.4 POST-FIRE, "Post-Fire Operational Information," and Emergency Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside Control Room," intended to reposition motor operated valves from the motor starter cabinet, would not have worked as written because the steps were not appropriate for the configuration of three valve motor starters. This finding was entered into the licensee's corrective action program under Condition Reports CR-CNS-201 0-08193 and CR-CNS-2010-08242, however the licensee failed to adequately correct the procedure and the procedure remained unworkabie.

The failure to verify that procedure steps needed to safely shutdown the plant in the event of a fire would actually reposition motor operated valves to the required positions and the simultaneous failure to address the previous finding that the same procedure steps would not work as written, was a performance deficiency. This finding was more than minor safety significance because it impacted the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. This finding affected both the procedure quality and protection against external factors (such as fires) attributes of this cornerstone objective. This finding was determined to have a preliminary lovv-to-moderate safety significance (White) during a Phase 3 evaluation using best available information. This problem, which has existed since 1997, involves risk factors that were not dependent on specific fire damage. The scenarios of concern involve larger fires in specific areas of the plant which trigger operators to implement fire response procedures to place the plant in a safe shutdown condition. Since some of those actions could not be completed using the procedures as written, this would challenge the operators' ability to establish adequate core cooling. This finding had a crosscutting aspect in the Corrective Action Program component, under the Problem Identification and Resolution area (P.1 (c) - Evaluation), because the licensee failed to properly evaluate the circuit operation or conduct verification tests to ensure that corrective actions for a previous violation would reliably position the three valves. Upon identification of this issue, both emergency procedures were revised to assure correct valve alignment by manually operating the valve locally. Therefore, this finding does not represent a current safety concern. (Section 1 R05.1)

Green.

A noncited violation of 10 CFR 50.65(a)(2) was identified for the failure to monitor the performance of the emergency lighting system against the established performance criteria. The licensee included the emergency lighting system in the Maintenance Rule program and specified that the emergency light batteries must be capable of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of operation, as required by 10 CFR Part 50, Appendix R, Section iii.J. The team identified that the licensee did not perform tests that demonstrated the capability of the emergency lights to last for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; therefore, the licensee failed to monitor the performance of the emergency lights against the established performance criteria. This finding was entered into the licensee's corrective action program under Condition Reports CR-CNS-201 0-08014 and CR-CNS-2010-08250.

The failure to monitor the performance of the emergency lighting system against the performance criteria stated in the Maintenance Rule program was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to ensure that emergency lights would last for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> could adversely affect the ability of operators to perform all of the manual actions required to support safe shutdown in the event of a fire. The significance of this finding was evaluated using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because the performance deficiency affected fire protection defense-in-depth strategies invoiving post fire safe shutdown systems. The finding was assigned a low degradation rating since the finding minimally impacted the performance and reliability of the fire protection program element. Specifically, the team determined that the licensee's preventive maintenance strategy provided reasonable assurance that the emergency lights would last sufficiently long for the operators to perform the most time-critical manual actions required to support safe shutdown in the event of a fire. The team also noted that operators were required to obtain and carry flashlights. Therefore, the finding screened as having very low safety significance (Green). This finding had a crosscutting aspect in the area of Human Performance associated with Decision Making because the licensee failed to identify possible unintended consequences of the decision to change the maintenance program for the emergency lights. Specifically, the licensee failed to identify that deleting light testing impacted (Section 1 R05.B)

Licensee-Identified Violations

None

REPORT DETAILS

i.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity 1 ROS Fire Protection (71111.0STTP)

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.0STTP, "Fire Protection-NFPA Transition Period (Triennial)," at Cooper Nuclear Station. The licensee committed to adopt a risk informed fire protection program in accordance with National Fire Protection Association Standard 80S (NFPA-80S), but had not yet completed the program transition. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas, with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shut the plant down.

Inspection Procedure 71111.0STTP requires selecting three to five fire areas for review.

The inspection team used the fire hazards analysis section of the Cooper Nuclear Station Individual Plant Examination of External Events to select the following five risk-significant fire zones (inspection samples) for review:

• Fire Area I / Fire Zone 2A Control Rod Drive Units - North Reactor Building Elevation 903' 6"

• Fire Area I / Fire Zone SB Reactor Motor Generator Set Area Reactor Building Elevation 976' 0"

• Fire Area II I Fire Zone 3A Switchgear Room 1 F Reactor Building Elevation 931' 6"

• Fire Area IX / Fire Zones 14A Diesel Generator 1A Room Diesel Generator Building Elevation 903' 6"

• Fire Area IX / Fire Zones 14C Diesel Oil Day Tank Room Diesel Generator Building Elevation 903' 6" The inspection team evaluated the licensee's fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(S); NRC safety evaluations; 10 CFR S0.48; Branch Technical Position 9.S-1; and 10 CFR SO, Appendix R. The team also reviewed related documents that included the Final Safety Analysis Report (FSAR), Section 9.S; the fire hazards analysis; and the post-fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Five fire area inspection samples were completed. Also, one B.S.b strategy review sample was completed.

- S -

.1 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensee's method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path would remain free of fire damage in the event of a fire. In addition, the team verified that the licensee met applicable license commitments.

b. Findings

Introduction.

An apparent violation of 10 CFR Part 50, Appendix B, Criterion Vand Criterion XVI, with a preliminary White significance, was identified for the repeated failure to ensure that some steps contained in emergency procedures at Cooper Nuclear Station would work as written. Specifically, steps in Emergency Procedure 5.4 POST-FIRE, "Post Fire Operational Information," and Emergency Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside Control Room," intended to reposition motor operated valves at the motor starter cabinet, would not have worked as written because the steps were not appropriate for the configuration of the motor starters.

Description.

Post-fire safe shutdown strategies at the Cooper Nuclear Station require equipment operations to be performed in accordance with one of two emergency procedures. For most fire areas, plant shutdown is performed using Emergency Procedure 5.4 POST-FIRE, "Post-Fire Operational Information," Revision 37, in conjunction with other plant procedures. For areas where fires might necessitate evacuation of the control room, alternative shutdown is performed using Emergency Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside the Control Room,"

Revision 38.

The team performed a walkthrough of Emergency Procedure 5.4 POST-FIRE for selected fire areas by observing plant operators simulate actions required by the procedure. This procedure required operators to reposition multiple motor-operated valves (MOVs) from each valve's motor starter cabinet. The procedure steps direct operators to open the motor starter cabinet, remove the control power fuses, then press designated contactors for a specified amount of time to reposition the valve to the required position.

The team was concerned that some of the procedure steps might not be reliably performed by the operators because bulky electrical safety gloves might not allow access to recessed contactors. When the licensee attempted to demonstrate their method, they identified that it would not work for one type of contactor. The internal configuration of the contactor would not complete the power circuit by depressing it. The manufacturer describes the design as having "direct magnet drive with positive pull-in of contactors." Since control power was removed by pulling fuses before operating the contactors, the magnet system would not engage the power contacts to the valve motor.

The inspectors noted that the operator performing the procedure steps would have no indication that the valve(s) did not reposition. Because the procedures do not specifically require checking the valve positions for most fire locations, the failure to reposition would not be readily apparent.

The three valves with this type of contactor were residual heat removal (RHR) system valves RHR-MO-25A and RHR-MO-25B, Train A and B Inboard Injection Isolation Valves, and reactor recirculation (RR) system valve RR-MO-53A, Reactor Recirculation A Pump Discharge Valve. The procedural deficiency in Emergency Procedure 5.4 POST-FIRE impacted the response to fires in 11 fire areas, each involving one valve. One of the valves, RHR-MO-25B, is operated in the same manner during alternative shutdown in accordance with Emergency Procedure 5.4 FIRE-SID, which contained the same procedural deficiency, for fires in two additional fire areas. The 13 affected fire areas are listed below:

Fire Area CB-A CB-A-1 CB-B CB-C CB-D RB-DI (SE)

RB-Di (SW)

RB-FN RB-J RB-K RB-M RB-N TB-A Control Building Reactor Protection System Room 1A, Seal Water Pump Area, and Hallway Control Building Division 1 Switchgear Room and Battery Room Control Building Division 2 Switchgear Room and Battery Room Control Building Reactor Protection System Room 1 B Control Room, Cable Spreading Room, Cable Expansion Room, and Auxiliary Relay Room Reactor Building RHR Pump B/HPCI Pump Room Reactor Building South/Southwest 903, Southwest Quad 889 and 859, and RHR Heat Exchanger Room B Reactor Building 903, Northeast Corner Reactor Building Critical Switchgear Room 1 F Reactor Building Critical Switchgear Room 1 G Reactor Building North/Northwest 931 and RHR Heat Exchanger Room A Reactor Building South/Southwest 931 and RHR Heat Exchanger Room B Turbine Building (multiple areas)

Opening either valve RHR-MO-25A or valve RHR-MO-25B is necessary to establish alternative shutdown cooling. Alternative shutdown cooling involves using a train of RHR to take suction from the suppression pool, inject the low pressure water to flood the reactor vessel, and recirculate the water through the safety relief valves (SRVs) back to the suppression pool. Establishing alternative shutdown cooling can be very time-sensitive. If high-pressure coolant injection (HPCI) is not available, the licensee

provided calculations that show that core damage can occur in as little as 15 minutes after valve RHR-MO-258 fails to open.

Valve RR-MO-53A is the discharge isolation valve for Reactor Recirculation Pump 1-A.

This valve is only required for cold shutdown. For some fire areas, the normal shutdown cooling mode of RHR system operation was credited in the fire safe shutdown analysis to be available. In shutdown cooling mode, the RHR system takes suction from the suction pipe of reactor recirculation system loop "A". The reactor coolant is then cooled and returned to a reactor recirculation loop discharge pipe. The failure to close either valve RR-MO-53A or RR-MO-43A would result in a short circuit of the shutdown cooling flow, bypassing the reactor vessel. The cool down from hot shutdown conditions and the transition to normal shutdown cooling allows time to close either valve RR-MO-53A or RR-MO-43A using local manual operation.

In 2004, a related but separate violation (NCV 05000298/2004008-01) was issued for failure to protect cables from fire damage for MOVs required to be available for post fire safe shutdown. The licensee committed to adopt a risk-informed fire protection program in accordance with 10 CFR 50.48(c) and NFPA-805, and planned to address the 2004 violation through their NFPA-805 conversion. To be able to delay correcting the 2004 violation, the licensee was required to verify that the compensatory measures for the violation (the operator manual actions) were adequate to ensure safety, in this case to be able to safely shut the plant down in the event of a fire.

Inspection Report 05000298/2004008 noted reliability concerns with the method of operating the MOVs. These included the fact that the contactors were not labeled to ailow operators to know which contactors the procedure instructed them to operate, no indication was available at the motor starter cabinet for the operator to know the valves had reached their required position, and valve position was not verified locally at the valves. As part of corrective action, the licensee installed "open" and "closed" labels near contactors in the motor starter cabinets.

In 2007, inspectors identified that some of the operator manual actions used as compensatory measures for the 2004 violation would not have repositioned 10 of the MOVs. The procedures did not account for the fact that these 10 MOVs had different motor starter circuits than most valves. Despite installing labels following the 2004 violation, the licensee failed to recognize that these 10 MOVs had a more complex circuit design which required two or three contactors to be operated at the same time, while the procedures only required operating one "open" or one "close" contactor. A White finding with an associated violation (Violation 05000298/2008008-01, EA 07-204)was issued for having an inadequate procedure and failing to verify that the procedure would work.

Inspection Report 05000298/2008007 again documented the reliability concerns that there were no valve position indications at the MOV motor starter cabinets, and the procedures did not direct local valve position checks. Additional reliability concerns were also documented concerning the adequacy of the procedures and the instrumentation available to diagnose the failure of an MOV to reposition.

The licensee took corrective actions to change and verify the procedures to address the 2008 finding; however the licensee's efforts again failed to identify details of the

electrical design which would result in the procedure steps not repositioning three MOVs.

Analysis.

The failure to verify that procedure steps needed to safely shutdown the plant in the event of a fire would actually reposition motor operated valves to the required positions, and to address a previous finding that the same procedure steps would not work as written, was a performance deficiency. This performance deficiency is of more than minor safety significance because it impacted the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. This finding affected both the procedure quality and protection against external factors (such as fires)attributes of this cornerstone objective.

The significance determination process (SOP) Phase 1 Screening Worksheet (Manual Chapter 0609, Attachment 4), Table 3b directs the user to Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems.

However, the Assumptions and Limitations section of Appendix F states that finings involving multiple fire areas are beyond the scope of Appendix F, and findings involving control room evacuation are not explicitly treated in Appendix F. Therefore, a Phase 3 analysis was performed.

The license claimed that the issue involved a performance deficiency that only impacted cold shutdown, and therefore should be screened as Green during a Phase 1 SOP. The NRC concluded that this finding cannot be screened out because the complexity of the issue (e.g., multiple fire areas affected) precludes simple screening, and because the plant conditions and system dependencies prevent a conclusion that only cold shutdown is affected.

Manual Chapter 0308 describes the basis for Appendix F screening out issues involving only cold shutdown as follows:

The second question screens findings to green that impact only the ability of the plant to achieve cold shutdown. This is consistent with the common risk analysis practice of defining hot shutdown as success. That is, both fire PRAs

[probabilistic risk assessments] and Internal Events PRAs typically assume that achieving a safe and stable hot shutdown state constitutes success and the end state for accident sequence analyses. Note that this screening step applies only to findings against 10CFR50 Appendix R, Section III.G.1.b. All other regulatory provisions are considered to involve, in part or in whole, measures provided for preservation and protection of the post-fire hot shutdown capability and will not be screened in this step (e.g., fire prevention, fire suppression, fire brigade, fire barriers, etc.).

The licensee's fire safe shutdown strategy and implementing procedures for the scenarios of concern direct operators to proceed to cold shutdown within a few hours.

Operation in hot shutdown and cold shutdown rely on the suppression pool with limited capability for cooling the suppression pool. This strategy is too complex to allow simple risk screening for this finding.

A risk analysis was performed previously for the 2008 procedural problems that affected ten valves, including the three valves addressed by this performance deficiency. This was documented in Inspection Report 05000298/2008008 (EA 07-204). In both the 2008 and current cases, valves RHR-MOV-25A, RHR-MOV-25B, and RHR-MOV-53A were incapable of being remotely operated from the motor starter as prescribed by Procedures 5.4 POST-FIRE and 5.4 FIRE-SID. Therefore, the linked event tree model developed for the risk estimate performed in 2008 was used to assess the significance of the current issue for these three valves.

Fires that do not require control room evacuation are addressed in Procedure 5.4 POST-FIRE. For fire areas that do not involve control room evacuation, the analyst concluded that the risk for the current finding is less than 1.0E-7 (this is unchanged from 2008 evaluation).

The risk attributable to post fire remote shutdown (control room abandonment sequences) results predominantly from the failure of Valve RHR-MOV-25B to open as described in Procedure 5.4 FIRE-SID. This is the credited train and the only procedural means for initiating alternative shutdown cooling during the recovery actions. Changes were made to Procedure 5.4 FIRE-SID subsequent to the 2008 issue which were credited in the current analysis and resulted in a decrease in the risk significance of the subject valves.

The non-recovery probability was decreased by a factor of 78 for the current finding because of changes that were made to Procedure 5.4 FIRE-SID. These changes in 1 of the procedure directed the operator at the remote shutdown panel to close SRVs if RHR injection was not observed to be successful and stabilize conditions using high pressure injection. Also, it directed operators to delay securing HPCI (if it was running) until RHR injection is confirmed. Additionally, Attachment 2 to the procedure directed the reactor building operator to open valve RHR-MOV-25B manually if the valve did not operate. However, there is limited instrumentation available at the remote shutdown panel to be able to recognize and diagnose that the valve did not open, and no available indications at the motor starter cabinet. Therefore, the operator who might be able to diagnose the failure of RHR-MO-25B did not have a procedure with the critical recovery step, and the operator with the correct recovery step in his procedure did not have the capability to know whether it was needed.

Using the linked event tree model and a period of exposure of one year, the analyst calculated the f..CDF to be 2.0E-6/yr for postulated fires leading to the abandonment of the main control room. The analyst concluded that the performance deficiency was of low to moderate significance (White).

A more detailed description to the Phase 3 analysis is attached to this report.

The NRC expects that licensees will ensure that issues potentially impacting nuclear safety are promptly identified, fully evaluated, and that actions are taken to address safety issues in a timely manner, commensurate with their significance. Additionally, the NRC expects that for significant problems, licensees will conduct effectiveness reviews of corrective actions to ensure that the problems are resolved. Because the licensee

failed to properly evaluate the circuit operation or conduct verification tests to ensure that corrective actions for a previous violation would reliably position the three valves, the team concluded that this finding has a crosscutting aspect in the Corrective Action Program component, under the Problem Identification and Resolution area (P.1 (c) -

Evaluation).

Enforcement.

Title 10 of the Code of Federal Regulations, Part 50, Appendix S, Criterion V, "Instructions, Procedures, and Drawings," requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings.

Title 10 of the Code of Federal Regulations, Part 50, Appendix S, Criterion XVI requires, in part:

Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. In the case of Significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective action taken to preclude repetition.

Emergency Procedure 5.4 POST-FIRE, "Post-Fire Operational Information," Revision 37, and Emergency Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside the Control Room," Revision 38, were designated as quality-related procedures used to implement operator actions to safely shutdown the plant in response to a fire. Violation 05000298/2008008-01 (EA 07-204) documented a significant condition adverse to quality in that steps in Emergency Procedure 5.4 POST-FIRE and Emergency Procedure 5.4 FIRE-SID would not achieve and maintain a safe shutdown condition in the event of certain fires.

Contrary to the above, between July 1997 and November, 2010, the licensee failed to ensure that activities affecting quality were prescribed by documented procedures appropriate to the circumstances, and to assure that a significant condition adverse to quality was promptly corrected. Specifically, Emergency Procedure 5.4 POST-FIRE and Emergency Procedure 5.4 FIRE-SID were changed in 1997 to add steps that were inappropriate to the circumstances because they would not work as written to reposition three motor operated valves needed to establish core cooling. The licensee failed to properly verify and validate procedure steps when the procedure changes were made and on multiple occasions between July 1997 and November 2010, including verification and validation actions performed in response to Violation 05000298/2008008-01..

In addition, contrary to the above, between July 2008 and November 2010, the licensee failed to identify, correct, and preclude repetition of a Significant condition adverse to quality. Specifically, Violation 05000298/2008008-01 identified a significant condition adverse to quality in that Emergency Procedure 5.4 POST-FIRE and Emergency Procedure 5.4 FIRE-SID would not work as written and the licensee had failed to verify and validate procedure steps to ensure that they would work to accomplish the necessary tasks. While addressing that violation, the licensee failed to perform sufficient

circuits to identify and correct a problem with valves RHR-MOV-25A, RHR-MOV-25B, and RHR-MOV-53A.

The licensee entered this issue into their corrective action program as Condition Reports CR-CNS-2010-08193 and CR-CNS-2010-08242. This violation is being treated as an apparent violation (AV), consistent with the Enforcement Policy: AV 05000298/2010006-01, Inadequate Post-Fire Safe Shutdown Procedures.

Because the licensee failed to correct this condition as part of Violation 05000298/2008008-01, and because Violation 05000298/2008008-01 did not receive enforcement discretion, this finding was not appropriate for enforcement discretion.

. 2 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure that the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

. 3 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified that the manual and automatic detection and suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pump flow and pressure tests to verify that

the pumps met their design requirements. The team also reviewed high pressure carbon dioxide suppression system functional tests and inspections to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for fire fighting.

The team observed an unannounced fire drill, conducted on November 1, 2010, and the subsequent drill critique using the guidance contained in Inspection Procedure 71111.05AQ, "Fire Protection Annual/Quarterly." The team observed fire brigade members fight a simulated fire in the Reactor Building, located in a switchgear room. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions.

Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient fire fighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings were identified.

.4 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains.

• Adequate drainage was provided in areas protected by water suppression systems.

b. Findings

No findings were identified,

,5 Alternative Shutdown Capability a, Inspection Scope Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available, Plant walkdowns were conducted to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses, The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown controi circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown were trained and available onsite at all times, exclusive of those assigned as fire brigade members.

A walkthrough of the post fire safe shutdown procedure with licensed and non-licensed operators was performed to determine the adequacy of the procedure, The team verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team reviewed manual actions to ensure that they had been properly reviewed and approved and that the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests are adequate to demonstrate the functionality of the alternative shutdown capability,

.6 b.

a. Findings

No findings were identified.

Circuit Analysis I nSl2ection SCOl2e This segment of inspection is suspended for plants in transition to a risk-informed fire protection program in accordance with NFPA 805. Therefore, the team did not evaluate this area.

b. Findings

No findings were identified.

. 7 Communications

.8 a. Insl2ection Scol2e

b.

a.

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

The team reviewed the licensee's response to Condition Report CR-CNS-201 0-07848.

The team verified the licensee properly implemented the Maintenance Rule program with respect to the communications systems required for alternative shutdown.

Findings No findings were identified.

Emergency Lighting Insl2ection Scol2e The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkthrough of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with piant procedures and industry practices. The team also verified the licensee properly implemented the Maintenance Rule program with respect to the emergency lighting systems required for alternative shutdown.

The team identified several concerns with the adequacy of the emergency lights during the walkthrough of the alternative shutdown procedure. In response to these concerns, the licensee performed blackout tests to demonstrate the adequacy of the installed emergency lights. The team observed blackout tests in the following areas:

• Control Building Corridor, 903' Elevation

• Control Building Basement, 881' Elevation

• Diesel Generator 2 Room

b. Findings

Introduction.

The team identified a Green noncited violation of 10 CFR 50.65(a)(2) for the failure to monitor the performance of the emergency lighting system against the established performance criteria.

Description.

During the inspection, the team reviewed the licensee's maintenance program for the emergency lighting system. The team determined that the licensee did not perform tests that demonstrated the capability of the emergency lights to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Instead, the licensee replaced each emergency light battery at a prescribed frequency. The licensee previously demonstrated the capability of the emergency lights to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> via the performance of internal resistance measurements. In 2008, the licensee modified their maintenance program to remove the internal resistance measurements and rely upon the prescribed replacement strategy.

The team also reviewed the licensee's implementation of their Maintenance Rule program with respect to the emergency lighting system. The licensee included the emergency lighting system into the Maintenance Rule program and included a performance criterion for the emergency light batteries to support 8-hours of operation, as required by 10 CFR Part 50, Appendix R, Section III.J.

Since the licensee did not perform tests that demonstrated the capability of the emergency lights to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the team determined that the licensee failed to monitor the performance of the emergency lights against the established performance criteria.

Analysis.

The failure to monitor the performance of the emergency lighting system against the performance criteria stated in the Maintenance Rule program was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure of the emergency lights to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> could adversely affect the ability of operators to perform the manual actions required to support safe shutdown in the event of a fire.

The significance of this finding was evaluated using Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because the performance deficiency affected fire protection defense-in-depth strategies involving post-fire safe shutdown systems. The team assigned the performance deficiency to the Post-fire Safe Shutdown category since it affected systems or functions relied upon for post-fire safe shutdown.

The finding was assigned a low degradation rating since the finding minimally impacted the performance and reliability of the fire protection program element. Specifically, the team determined that the licensee's preventive maintenance strategy provided reasonable assurance that the emergency lights would last sufficiently long for the operators to perform the most time critical manual actions required to support safe shutdown in the event of a fire. The team also noted that operators were required to obtain and carry flashlights. Therefore, the finding screened as having very low safety significance (Green).

The NRC expects that licensee decisions demonstrate that nuclear safety is an overriding priority and to conduct effectiveness reviews of safety-significant decisions to identify possible unintended consequences. Because the licensee failed to identify that deleting emergency light testing impacted Maintenance Rule performance monitoring, the team concluded that this finding had a crosscutting aspect in the area of human performance associated with decision making. Specifically, the licensee failed to identify possible unintended consequences of the decision to change the maintenance program for the emergency lights. [H.1 (b)]

Enforcement.

Title 10 of the Code of Federal Regulations, Part 50, Section 65, Paragraph (a)(1), requires, in part, that licensees shall monitor the performance or conditions of structures, systems, or components (SSCs) within the scope of the maintenance rule as defined by 10 CFR 50.65 (b), against licensee established goals, in a manner sufficient to provide reasonable assurance that such SSCs are capable of fulfilling their intended functions.

Title 10 of the Code of Federal Regulations, Part 50, Section 65, Paragraph (a)(2)states, in part, that monitoring as specified in 10 CFR 50.65 (a)(1) is not required where it has been demonstrated that the performance or condition of a SSC is being effectively controlled through the performance of appropriate preventive maintenance, such that the SSC remains capable of performing its intended function.

The licensee's Maintenance Rule program included the emergency lighting system and established a performance criterion that the emergency lighting system batteries support 8-hours of operation, as required by 10 CFR Part 50, Appendix R, Section IILJ.

Contrary to the above, from October 3, 2008 to November 5, 2010, the licensee failed to demonstrate that the performance of the emergency lighting system was effectively controlled through the performance of appropriate preventive maintenance and did not smonitor the emergency lighting system against licensee established goals. Specifically, the licensee failed to demonstrate that the emergency lighting system remained capable of providing 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of illumination for post-fire safe shutdown.

The licensee entered this issue into their corrective action program as Condition Reports CR-CNS-2010-08014 and CR-CNS-2010-08250. Because this violation was of very low safety significance and it was entered into the licensee's corrective action program, this violation is being treated as a noncited violation, consistent with the Enforcement Policy: NCV 05000298/2010006-03, Failure to Monitor the Performance of the Emergency Lights Against the Maintenance Rule Criteria.

. 9 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in the design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

. 10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and postfire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

A finding related to this review was documented in Section 1 R05.01. No additional findings were identified.

. 11 B.5.b Inspection Activities

a. Inspection Scope

The team reviewed the licensee's implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with loss of large areas of the plant due to explosions or fire as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026, dated February 25: 2002 and 10 CFR 50.54(hh)(2).

The team reviewed a licensee's strategy to verify that they continued to maintain and implement procedures, maintain and test equipment necessary to properly implement the strategy, and to ensure that station personnel are knowledgeable and capable of implementing the procedure. The team performed a visual inspection of portable equipment used to implement the strategy to ensure availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of onsite vehicles capable of towing the portable pump. The team assessed the offsite ability to obtain fuel for the portable pump, and foam used for firefighting efforts. The team reviewed the following strategy as an inspection sample:

• 5.3 Alt-Strategy, "Alternative Core Cooling Mitigating Strategies," Revision 023, 4, "Manual Operation of RCIC [reactor core isolation cooling]."

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

40A2 Identification and Resolution of Problems Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. In addition, the team reviewed the corrective actions proposed and imolemented to verifv that thev were effective in correctina irlentifierl rlefir.ienr.ie!=: The

"

-

-

-

-

-

~.1

-

~

.-

-

-

-

-

_. -

-

. _.

-

-

-. -

- -- - '.;;I

- _. -

• • _ *.* -

-

-

-

• • _. _ ** _. -

-

• ** --

team also evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

Findings related to this review are documented in Sections 1 R05.01 and 1 R05.05. No additional findings were identified.

40A6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. D. Willis, General Manager, Plant Operations, and other members of the licensee staff at a debrief meeting on November 5, 2010. The licensee acknowledged the findings presented.

The team presented the inspection results to Mr. D. Suman, Director of Engineering, and other members of the licensee staff at an exit meeting on March 14, 2011. The licensee acknowledged the findings presented.

The inspectors confirmed that proprietary material examined during the inspection had been returned.

ATTACHMENTS:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

licensee Personnel

J. Aldana, Security Coordinator

R. Alexander, Electrical Superintendent

J. Austin, System Engineering Manager

1. Barker, Quality Assurance Manager

J. Bebb, Security Manager

S. Bebb, Administrative Services Manager

M. Bergmeier, Operation Support Group Supervisor

K. Billesbach, Materials, Purchasing and Contracts Manager

D. Buman, Director of Engineering

K. Cardy, Fire Protection Engineer

G. Chinn, Contractor

L. Deuhirst, Corrective Actions and Assessments Manager

R. Dyer, Engineering Support Program Engineer

J. Dykstra, Electrical Engineering Program Supervisor

R. Estrada, Design Engineering Manager

J. Flaherty, Senior Staff licensing Engineer

J Gage, Reactor Operator

R. Gauchat, Security Training Supervisor

1. Hattovy, Engineering Support Manager

D. Jones, Safety Coordinator

1. Kahland, Reactor Operator

C. Long, Engineering Specialist

D. McGargill, Non-licensed Operator

1. Mue!!er, Senior Reactor Operator

K. Newcomb, Fire Marshal

D. Oshlo, Information Technology Manager

R. Penfield, Operations Manager

D. Seylock, Training Manager

J. Shrader, Fire Safety Lead, Nebraska Public Power District

D. Van Der Kap, licensing Manager

M. Van Winkle, Electrical Design Supervisor

D. Weniger, Valves Program Engineer

D. Willis, General Manager, Plant Operations

A. Zaremba, Director of Nuclear Safety Assessment

NRC personnel

M. Chambers, Resident Inspector

S. Vaughn, NRR/DIRS/IPAB

J. Bowen, NRR/DIRS/IRIB

D. Loveless, Senior Reactor Analyst, RIV/DRS

M. Runyan, Senior Reactor Analyst, RIV/DRS

UST OF

ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000298/2009006-01 AV Inadequate Post-Fire Safe Shutdown Procedures (Section 1 R05.01)

Opened and Closed

05000298/2009006-02 NCV Failure to Correct a Condition Adverse to Quality Related to Post-Fire Safe Shutdown

Closed

ADAMS BWR CR CFR DRS FSAR HPCi LPSI MOV NCV NFPA NRC PAR PRA RCIC RHR SDP SRV (Section 1 R05.05)

None UST OF ACRONYMS Agencywide Documents Access and Management System Boiling Water Reactor Condition Report Code of Federal Regulations Division of Reactor Safety Final Safety Analysis Report High Pressure Coolant Injection Low Pressure Safety Injection Motor Operated Valve Noncited Violation National Fire Protection Association Nuclear Regulatory Commission Publicly Available Records Probabilistic Risk Assessment Reactor Core Isolation Cooling Residu'al Heat Removal Significance Determination Process Safety/Relief Valve