IR 05000336/2016007

Errata for Millstone Power Station - NRC Triennial Fire Protection Inspection Report 05000336/2016007 and 05000423/2016007 Amended to 05000336/2016008 and 05000423/2016008

ML17004A249
Person / Time
Site:	Millstone
Issue date:	01/04/2017
From:	Glenn Dentel Engineering Region 1 Branch 2
To:	Stoddard D Dominion Resources
Dentel G
References
IR 2016008
Download: ML17004A249 (36)

Text

uary 4, 2017

SUBJECT:

ERRATA FOR MILLSTONE POWER STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000336/2016007 AND 05000423/2016007 AMENDED TO 05000336/2016008 AND 05000423/2016008

Dear Mr. Stoddard:

The U.S. Nuclear Regulatory Commission (NRC) has identified an error in NRC Inspection Report 05000336/2016007 and 05000423/2016007, dated September 14, 2016 (ADAMS Accession No. ML16258A175). Specifically, the report incorrectly lists the report number as 2016007. The correct report number is 2016008. This error affects the first page of the cover letter, the distribution page, the report cover page, the summary of findings page, page 4 of the report, and the supplemental information page. As a result, the NRC has reissued the report in its entirety to correct this error.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA/

Glenn T. Dentel, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-336 and 50-423 License Nos. DPR-65 and NPF-49

Enclosure:

Inspection Report 05000336/2016008 and 05000423/2016008 w/Attachment:

Supplemental Information

REGION I==

Docket Nos.: 50-336, 50-423 License Nos.: DPR-65, NPF-49 Report Nos.: 05000336/2016008 and 05000423/2016008 Licensee: Dominion Nuclear Connecticut, Inc.

Facility: Millstone Power Station, Units 2 and 3 Location: P.O. Box 128 Waterford, CT 06385 Dates: July 25, 2016 through August 11, 2016 Inspectors: J. Patel, Reactor Inspector (Team Leader)

Division of Reactor Safety (DRS)

W. Cook, Senior Reactor Analyst, DRS E. DiPaolo, Senior Reactor Inspector, DRS D. Orr, Senior Reactor Inspector, DRS K. Young, Senior Reactor Inspector, DRS L. Dumont, Reactor Inspector, DRS S. Galbreath, Reactor Inspector, DRS J. Rady, Reactor Inspector, DRS Observers: S. Freeman, Senior Reactor Analyst, NRC, Region II, DRS Approved by: Chris Cahill, Acting Branch Chief Engineering Branch 3 Division of Reactor Safety i Enclosure

SUMMARY OF FINDINGS

IR 05000336/2016008, 05000423/2016008; 07/25/2016 - 08/11/2016; Dominion Nuclear

Connecticut, Inc.; Millstone Power Station, Units 2 and 3; Fire Protection (Triennial).

This report covered a two week on-site triennial fire protection team inspection by specialist inspectors. One finding of very low safety significance was identified. This finding was determined to be a non-cited violation. The significance of most findings is indicated by their color (Green, While, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process. The cross-cutting aspects associated with findings were determined using IMC 0310, "Components Within The Cross-Cutting Areas." Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 6, dated July 2016.

Cornerstone: Mitigating Systems

Green.

The team identified a finding of very low safety significance (Green) involving a non-cited violation of Millstone Power Station, Unit 2, Renewed Facility Operating License Condition 2.C.(3) to implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report (FSAR). Specifically,

Dominion failed to maintain the #2 steam generator (SG) atmospheric dump valve (ADV)free from fire damage, which may have affected the availability to maintain hot shutdown conditions from the main control room for a fire in Fire Area R-14, Lower 4.16kV Switchgear Room and Cable Vault. Dominion promptly entered this safe shutdown issue into their corrective action program as condition report (CR) 1043458. Immediate corrective actions included implementing compensatory measures in the form of fire watches for fire area R-14 that are being tracked by Reasonable Assurance of Safety (RAS) determination 3037040.

Longer term corrective actions included submitting an exemption request to the NRC for use of a local operator manual action (OMA) to operate the #2 SG ADV in lieu of meeting fire protection requirements for fire area R-14. The team considered Dominions immediate and longer term corrective actions appropriate.

The performance deficiency was more than minor because it affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to an external event to prevent undesirable consequences in the event of a fire.

Specifically, the use of an OMA during post-fire safe shutdown is not as reliable as normal systems operation which could be utilized had the requirements of 10 CFR Part 50,

Appendix R,Section III.G.2 been met and, therefore, prevented fire damage to credited components and/or cables, specifically the #2 SG ADV. The inspectors used IMC 0609,

Appendix F, Fire Protection Significance Determination Process, Phase 1 and determined the reactor is able to reach and maintain a hot safe shutdown condition because the SG ADVs are used for transition to cold shutdown, therefore this finding was of very low safety significance (Green). This finding does not have a cross cutting aspect because the performance deficiency occurred greater than three years ago when the June 30, 2011 exemption request letter to the NRC was supplemented by letter on February 29, 2012, and is not indicative of current licensee performance. (Section 1R05.01)ii

Other Findings

Three violations of very low safety significance that were identified by Dominion were reviewed by the team. Corrective actions taken or planned by Dominion have been entered into Dominions corrective action program (CAP). The violations and corrective action tracking numbers are listed in Section 4OA7 of this report.

iii

REPORT DETAILS

Background This report presents the results of a triennial fire protection inspection conducted in accordance with the U.S. Nuclear Regulatory Commission (NRC) Inspection Procedure (IP) 71111.05T, Fire Protection (Triennial). The objective of the inspection was to assess whether Dominion Nuclear Connecticut, Inc. (Dominion) has implemented an adequate fire protection program (FPP) and that post-fire safe shutdown capabilities have been established and are being properly maintained at the Millstone Power Station Unit 2 and Unit 3 (Millstone). The following fire areas (FA) and/or fire zones (FZ) were selected for detailed review based on risk insights from the Millstone Individual Plant Examination of External Events (IPEEE).

Unit 2 Fire Areas / Fire Zones R-7 / A-15, A Diesel Generator Room A R-1 / A-32, Main Ventilation Room (Air Handling Units)

R-14 / T-7, 6.9 & 4.16 kV Switchgear Room R-14 / T-9, East Cable Vault Unit 3 Fire Areas AB-6, West MCC & Rod Control Area CB-11, Instrument Rack Room and Underfloor Area EG-3, North Emergency Generator Enclosure ESF-3, North Residual Heat Removal - Heat Exchanger Cubicle Inspection of these areas/zones fulfills the inspection procedure requirement to inspect a minimum of three samples.

The inspection team evaluated Dominions FPP against applicable requirements which included Unit 2 Renewed Facility Operating License Condition 2.C.(3), Unit 3 Renewed Facility Operating License Conditions 2.H, NRC Safety Evaluation Reports (SERs), Title 10 of the Code of Federal Regulations (10 CFR) 50.48, 10 CFR Part 50, Appendix R and Branch Technical Position (BTP)

Chemical Engineering Branch (CMEB) 9.5-1. The team also reviewed related documents that included the Updated Final Safety Analysis Report (UFSAR), Fire Protection Program, Fire Hazards Analyses (FHA), and post-fire Safe Shutdown Analyses Reports.

The team also evaluated two Unit 2 and two Unit 3 licensee mitigating strategies for addressing large fires and explosions as required by Unit 2 Renewed Facility Operating License Condition 2.C.(13), Unit 3 Renewed Facility Operating License Condition 2.C.(10), and 10 CFR 50.54 (hh)(2). Inspection of these strategies fulfills the inspection procedure requirement to inspect a minimum of one sample.

Specific documents reviewed by the team are listed in the Attachment to this report.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection (IP 71111.05T)

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the FHA, safe shutdown analyses, and supporting drawings and documentation to verify that post-fire safe shutdown capabilities were properly protected.

The team ensured that applicable separation requirements of Section III.G of 10 CFR Part 50, Appendix R for Unit 2 and BTP CMEB 9.5-1 for Unit 3 as well as the licensees design and licensing bases were maintained for the credited safe shutdown equipment and their supporting power, control, and instrumentation cables. This review included an assessment of the adequacy of the selected systems for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and associated support system functions.

b. Findings

Introduction:

The team identified a finding of very low safety significance (Green)involving a non-cited violation of Millstone Unit 2 Renewed Facility Operating License Condition 2.C.(3) to implement and maintain in effect all provisions of the approved fire protection program as described in the FSAR. Specifically, Dominion failed to maintain the #2 SG ADV free from fire damage, which may have affected the availability to maintain hot shutdown conditions from the main control room for a fire in Fire Area R-14, Lower 4.16kV Switchgear Room and Cable Vault.

Description:

The inspectors reviewed the operator manual actions (OMAs) contained in operating procedure AOP 2579M, Fire Procedure for Hot Standby Appendix R Fire Area R-14, and compared them against the list of NRC approved OMAs in lieu of meeting III.G.2 fire protection requirements and determined that an unapproved OMA was being implemented in AOP 2579M. The OMAs in lieu of meeting III.G.2 fire protection requirements were approved in an NRC exemption dated December 18, 2012. The missing OMA was an action to locally operate air-operated valve, 2-MS-190B, #2 SG ADV. The OMA is necessary since a self-induced loss of offsite power (LOOP) will occur and station blackout (SBO) condition may occur from fire related cable damage. Either condition, LOOP or SBO, will cause a loss of instrument air in response to a significant fire in fire area R-14.

The LOOP will occur when AOP 2579M is implemented because step 3.4 requires the operators to trip the reactor (causing a loss of the normal station service transformer)and step 3.9 requires the operators to direct CONVEX (transmission operator) to de-energize the reserve station service transformer. A SBO may subsequently occur if the B emergency diesel generator (EDG) is running and its output breaker does not close, which could occur due to fire-related circuit damage. In either condition, LOOP or SBO, the F instrument air compressor, will be de-energized and a loss of instrument air will occur.

In 2011, Dominion submitted an exemption request to the NRC for several OMAs in lieu of meeting III.G.2 fire protection requirements in several fire areas and initially postulated a loss of instrument air for Fire Area R-14. Three OMAs were requested related to the loss of instrument air for Fire Area R-14 in a June 30, 2011 exemption request letter to the NRC. Subsequent to the June 30, 2011 exemption request letter, Dominion walked down several fire areas and from a mechanical perspective concluded that a loss of instrument air should no longer be postulated for several fire areas. R-14 was included as a fire area for which a loss of instrument air was no longer considered credible. In a request for additional information response letter dated February 29, 2012, Dominion stated that the loss of instrument air was no longer postulated in fire area R-14 and others, and requested the NRC delete the OMA for locally operating the #2 SG ADV. In a correction letter dated October 29, 2012, Dominion again reiterated that for Fire Area R-14, and others, a Loss of Instrument Air was not postulated, but Dominion clarified that some of the OMAs that were related to a loss of instrument air should be retained for postulated fire cable damage or loss of power. However, the OMA for locally operating the #2 SG ADV was not retained since it was not susceptible to cable damage or loss of power for a fire in area R-14. Dominion stated in its June 30, 2011 exemption request letter to the NRC that after auxiliary feedwater (AFW) is established from the control room, operation of the ADV (2-MS-1 90B) is the required method of removing decay heat to maintain hot standby and transition to cold shutdown.

As described above, the inspectors determined that implementing AOP 2579M as written will cause a loss of instrument air and the OMA to locally operate the #2 SG ADV will be necessary after AFW is restored and decay heat removal is transitioned from the main steam safety valves to the #2 SG ADV for steam generator pressure control. The inspectors noted that Dominion is currently implementing an unapproved OMA in lieu of meeting III.G.2 fire protection requirements. Dominion promptly entered this safe shutdown issue into their corrective action program as CR 1043458. Immediate corrective actions included implementing compensatory measures in the form of fire watches for fire area R-14 that are being tracked by RAS determination 3037040.

Longer term corrective actions included submitting an exemption request to the NRC for use of a local OMA to operate the #2 SG ADV in lieu of meeting fire protection requirements for fire area R-14. The team considered Dominions immediate and longer term corrective actions appropriate.

Analysis:

Dominions failure to protect the #2 SG ADV, credited for post-fire safe shutdown from fire damage in Fire Area R-14 caused by single spurious actuation, is considered a performance deficiency. The performance deficiency was more than minor because it affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to an external event to prevent undesirable consequences in the event of a fire. Specifically, the use of an OMA during post-fire safe shutdown may not be as reliable as normal systems operation which could be utilized had the requirements of 10 CFR Part 50, Appendix R, Section III.G.2 been met and, therefore, prevented fire damage to credited components and/or cables, specifically the #2 SG ADV.

The inspectors used IMC 0609, Appendix F, Fire Protection Significance Determination Process, Phase 1 and determined the reactor is able to reach and maintain a hot safe shutdown condition because the ADVs are used for transition to cold shutdown, therefore this finding was of very low safety significance (Green).

This finding does not have a cross cutting aspect because the performance deficiency occurred greater than three years ago when the June 30, 2011 exemption request letter to the NRC was supplemented by letter on February 29, 2012, and is not indicative of current licensee performance.

Enforcement:

Millstone Power Station, Unit 2, Renewed Facility Operating License Condition 2.C.(3) requires Dominion in part to implement and maintain in effect all provisions of the approved fire protection program as described in the FSAR. FSAR Section 9.10.6, Safety Shutdown Design Bases, states in part Paragraph 50.48(b) of 10 CFR 50, which became effective on February 17, 1981, that all nuclear plants licensed to operate prior to January 1, 1979, comply with specific portions of Section III of Appendix R to 10 CFR 50.Section III.G requires that fire protection features be provided for those systems, structures, and components important to safe shutdown.

These features must be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions from either the main control room or the emergency control stations is free of fire damage.

Contrary to the above, since February 17, 1981 (the effective date of Appendix R and revised 10 CFR 50.48), and ongoing as of the inspection exit date, Dominion failed to implement all provisions of the approved fire protection program. Specifically, the safe shutdown strategy in Fire Area R-14 for Millstone Unit 2 relied upon an unapproved OMA to mitigate post-fire safe shutdown equipment malfunctions caused by a single spurious actuation, in lieu of protecting the equipment in accordance with 10 CFR Part 50 Appendix R, Section III.G.2. The specific OMA associated with Fire Area R-14 includes local manual control of the #2 SG ADV. Dominions immediate corrective actions included implementing compensatory measure in the form of fire watches for fire area R-14. Because this violation was of very low safety significance (Green), and was entered into Dominions CAP (CR 1043458), this issue is being treated as an NCV consistent with Section 2.3.2 of the Enforcement Policy. (NCV 05000336/2016008-01, Unapproved OMA in Lieu of Meeting III.G.2 Fire Protection Requirements for Fire Area R-14, Lower 4kV Switchgear Room and Cable Vault)

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to evaluate whether the material conditions of the fire area boundaries were adequate for the fire hazards in the area. The team compared the fire area boundaries, including walls, ceilings, floors, fire doors, fire dampers, penetration seals, and redundant equipment fire barriers to design and licensing basis requirements, industry standards, and the Millstone Power Station Unit 2 and Unit 3 FPPs, as approved by the NRC, to identify any potential degradation or non-conformances.

The team reviewed selected engineering evaluations, installation and repair work orders, and qualification records for a sample of penetration seals to determine whether the fill material was properly installed and whether the as-left configuration satisfied design requirements for the intended fire rating.

The team also reviewed recent inspection and functional test records for fire dampers, and the inspection records for penetration seals and fire barriers, to verify whether the inspection and testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team evaluated manual and automatic fire suppression and detection systems in the selected fire areas to determine whether they were installed, tested, maintained, and operated in accordance with NRC requirements, National Fire Protection Association (NFPA) codes of record, and the Millstone FPPs, as approved by the NRC. The team also assessed whether the suppression systems capabilities were adequate to control and/or extinguish fires associated with the hazards in the selected areas.

The team reviewed the as-built capability of the fire water supply system to verify the design and licensing basis and NFPA code of record requirements were satisfied, and to assess whether those capabilities were adequate for the hazards involved. The team reviewed the fire water system hydraulic analyses to assess the adequacy of a single fire water pump to supply the largest single hydraulic load on the fire water system plus concurrent fire hose usage. The team evaluated the fire pump performance tests to assess the adequacy of the test acceptance criteria for pump minimum discharge pressure at the required flow rate, to verify the criteria was adequate to ensure that the design basis and hydraulic analysis requirements were satisfied. The team also evaluated the underground fire loop flow tests to verify the tests adequately demonstrated that the flow distribution circuits were able to meet design basis requirements. In addition, the team reviewed recent pump and loop flow test results to verify the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

The team reviewed initial discharge testing, design specifications, vendor requirements, modifications and engineering evaluations, and routine functional testing for the CO2 and Halon suppression systems for the areas protection. The team walked down accessible potions of the CO2 and Halon systems, including storage tanks and supply systems, to independently assess the material condition, operational lineup, and availability of the systems. The team also reviewed and walked down the associated firefighting strategies and CO2 and Halon system operating procedures.

The team walked down accessible portions of the detection and water suppression systems in the selected areas and major portions of the fire water supply system, including motor and diesel driven fire pumps, interviewed system and program engineers, and reviewed selected corrective action program documents (condition reports) to independently assess the material condition of the systems and components.

In addition, the team reviewed recent test results for the fire detection and suppression systems for the selected fire areas to verify the testing was adequately conducted, the acceptance criteria were met, and any performance degradation was identified.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed Millstone's firefighting strategies (i.e. pre-fire plans) and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. The team independently inspected the fire brigade equipment, including personnel protective gear (e.g. turnout gear) and smoke removal equipment, to determine operational readiness for firefighting.

In addition, the team reviewed Millstone's fire brigade equipment inventory and inspection procedure and recent inspection and inventory results to verify adequate equipment was available, and any potential material deficiencies were identified.

b. Findings

No findings were identified.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team walked down the selected fire areas and adjacent areas, and reviewed selected documents to determine whether redundant safe shutdown trains could be potentially damaged from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. During the walkdowns, the team evaluated the adequacy and condition of floor drains, equipment elevations, and spray protection.

Specifically, to determine whether a potential existed to damage redundant safe shutdown trains, the team evaluated whether:

A fire in one of the selected fire areas would not release smoke, heat, or hot gases that could cause unintended activation of suppression systems in adjacent fire areas which could potentially damage all redundant safe shutdown trains; or A fire suppression system rupture, inadvertent actuation, or actuation due to a fire, in one of the selected fire areas, could not directly damage all redundant trains (e.g. sprinkler caused flooding of other than the locally affected train); and Adequate drainage was provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Post-Fire Safe Shutdown Capability - Normal and Alternative

a. Inspection Scope

The team reviewed the safe shutdown analysis, thermal-hydraulic analysis, operating procedures, time critical operator action validation studies, piping and instrumentation drawings (P&lDs), electrical drawings, the UFSAR, and other supporting documents for the selected fire areas to verify whether Dominion had properly identified the systems and components necessary to achieve and maintain post-fire safe shutdown conditions.

The team evaluated selected systems and components credited by the safe shutdown analysis for reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support system functions to assess the adequacy of Dominion's alternative shutdown methodology. The team also assessed whether alternative post-fire shutdown could be performed both with and without the availability of off-site power. The team walked down selected plant configurations to verify whether they were consistent with the assumptions and descriptions in the safe shutdown and fire hazards analyses. In addition, the team evaluated whether the systems and components credited for use during post-fire safe shutdown would remain free from fire damage.

The team reviewed the training program for licensed and non-licensed operators to verify whether it included alternative shutdown capability. The team also verified whether personnel required for post-fire safe shutdown, using either the normal or alternative shutdown methods, were trained and available on-site at all times, exclusive of those assigned as fire brigade members.

The team reviewed the adequacy of procedures utilized for post-fire shutdown and performed an independent walk through of procedure steps (i.e., a procedure tabletop)to assess the adequacy of implementation and human factors within the procedures.

The team also evaluated the time required to perform specific actions to verify whether operators could reasonably be expected to perform those actions within sufficient time to maintain plant parameters within specified limits.

Specific procedures reviewed for normal and alternative post-fire shutdown included the following:

Unit 2 AOP 2559, Fire; AOP 2579A, Fire Procedure for Hot Standby Appendix R Fire Area R-1; AOP 2579AA, Fire Procedure for Cooldown and Cold Shutdown Appendix R Fire Area R-1; AOP 2579EE, Fire Procedure for Cooldown and Cold Shutdown Appendix R Fire Area R-7, R-9, R-14, and R-17; AOP 2579G, Fire Procedure for Hot Standby Appendix R Fire Area R-7; and, AOP 2579M, Fire Procedure for Hot Standby Appendix R Fire Area R-14.

Unit 3 EOP 3509, Fire Emergency; EOP 3509.1, Control Room, Cable Spreading Area or Instrument Rack Room Fire; EOP 3509.6, Auxiliary Building West MCC/Rod Control/ACU Area Fire; EOP 3509.15, North (A) EDG Enclosure or East (A) F.O. Vault Fire; and, EOP 3509.19, ESF Building North RHR Heat Exchanger Cubicle Fire.

The team reviewed selected operator manual actions to verify whether they had been properly reviewed and approved and whether the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area. The team also reviewed the periodic testing of the alternative shutdown transfer and isolation capability, and instrumentation and control functions, to evaluate whether the tests were adequate to ensure the functionality of the alternative shutdown capability.

b. Findings

No findings were identified.

.06 Circuit Analysis

a. Inspection Scope

The team verified that the licensee performed a post-fire safe shutdown analysis for the selected fire areas and the analysis appropriately identified the structures, systems, and components important to achieving and maintaining safe shutdown. Additionally, the team verified that the licensees analysis ensured that necessary electrical circuits were properly protected and that circuits that could adversely impact safe shutdown due to hot shorts or shorts to ground were identified, evaluated, and dispositioned to ensure spurious actuations would not prevent safe shutdown.

The teams review considered fire and cable attributes, cable routing, potential undesirable consequences and common power supply/bus concerns. Specific items included the credibility of the fire threat, cable insulation attributes, cable failure modes, and actuations resulting in flow diversion or loss of coolant events.

The team also reviewed cable raceway drawings and/or cable routing databases for a sample of components required for post-fire safe shutdown to verify that cables were routed as described in the safe shutdown analysis. The team also reviewed equipment important to safe shutdown, but not part of the success path, to verify that the licensee had taken appropriate actions in accordance with the design and licensing basis and NRC Regulatory Guide 1.189, Revision 2.

Cable failure modes were reviewed for the following components:

Unit 2 P18B, Charging Pump B; 2-CH-501, VCT Outlet Header to Charging Pumps Isolation Valve; 2-CH-519, Loop 1A Charging Isolation Valve; and, PI-1023B-1, SG #2 Pressure Indicator.

Unit 3 3RCS*LCV459, VCT Letdown Isolation Valve; 3RCS*SV8095A, Head Vent Isolation Valve; 3CHS*MV8438A, Charging Pump A Header Isolation Valve; 3FWS*LI501A, SG #1 Level Indicator; and, 3RCS*PI405B, RCS Pressure Indicator.

The team reviewed a sample of circuit breaker coordination studies to ensure equipment needed to conduct post-fire safe shutdown activities would not be impacted due to a lack of coordination that could result in a common power supply or common bus concern.

The team verified that the transfer of control from the control room to the alternative shutdown location(s) would not be affected by fire-induced circuit faults (e.g. by the provision of separate fuses and power supplies for alternative shutdown control circuits).

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team reviewed safe shutdown procedures, the safe shutdown analysis, and associated documents to verify an adequate method of communications would be available to plant operators following a fire. During this review the team considered the effects of ambient noise levels, clarity of reception, reliability, and coverage patterns.

The team also inspected the designated emergency storage lockers to verify the availability of portable radios for the fire brigade and for plant operators. The team also verified that communications equipment such as repeaters and transmitters would not be affected by a fire.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team observed the placement and coverage area of eight-hour emergency lights throughout the selected fire areas to evaluate their adequacy for illuminating access and egress pathways and any equipment requiring local operation or instrumentation monitoring for post-fire safe shutdown. The team also verified that the battery power supplies were rated for at least an eight-hour capacity. Preventive maintenance procedures, the vendor manual, completed surveillance tests, and battery replacement practices were also reviewed to verify that the emergency lighting was being maintained consistent with the manufacturers recommendations and in a manner that would ensure reliable operation.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed Dominion's dedicated repair procedures, for components which might be damaged by fire and were required to achieve post-fire cold shutdown (CSD).

The team evaluated selected CSD repairs to determine whether they could be achieved within the time frames assumed in the design and licensing bases. In addition, the team verified whether the necessary repair equipment, tools, and materials (e.g., pre-cut cables with prepared attachment lugs) were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified compensatory measures were in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment, passive fire barriers, pumps, valves, or electrical devices providing safe shutdown functions or capabilities). The team evaluated whether the short term compensatory measures adequately compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings were identified.

.11 Fire Protection Program Changes

a. Inspection Scope

The team reviewed recent changes to the approved fire protection program to verify that the changes did not constitute an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees procedures and programs for the control of ignition sources and transient combustibles to assess their effectiveness in preventing fires and in controlling combustible loading within limits established in the FHA. A sample of hot work and transient combustible control permits were also reviewed. The team performed plant walkdowns to verify that transient combustibles and ignition sources were being implemented in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Large Fires and Explosions Mitigation Strategies

a. Inspection Scope

The team conducted a review of selected mitigation strategies intended to maintain or restore core decay heat removal and spent fuel pool cooling capabilities under the circumstances associated with the loss of large areas of the plant due to explosions and/or fires. The team assessed whether Dominion continued to meet the requirements of the Millstone Power Station Units 2 and 3 Operating Licenses and 10 CFR 50.54(hh)(2).

The team reviewed the following mitigation strategies:

Unit 2 and 3 Manual Operation of Turbine-Driven AFW Pump; and, Unit 2 and 3 Manual Operation of SG ADVs.

The team's review included: a detailed assessment of the procedural guidance; a tabletop discussion with licensed operators; and a walk down of four mitigation strategies with operators to assess the feasibility of the strategies and operator familiarity; maintenance and surveillance testing of selected strategy equipment; and an inventory check of the B.5.b pump and equipment trailers to ensure the appropriateness of equipment storage and availability.

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems (IP 71152)

.01 Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team reviewed a sample of condition reports associated with fire protection program and post-fire safe shutdown issues to determine whether Millstone was appropriately identifying, characterizing, and correcting problems in these areas, and to assess whether the planned or completed corrective actions were appropriate.

b. Findings

No findings were identified.

4OA3 Follow-up of Events and Notices of Enforcement Discretion (IP 71153)

.1 (Closed) Licensee Event Report (LER) 05000336/2013-003-00 (Unit 2): Postulated DC

Ammeter Circuit Hot Shorts On October 30, 2013, during a review of industry operating experience, Dominion identified a postulated fire induced circuit failure involving unfused direct current (DC)ammeter circuits for Millstone Power Station, Unit 2. The fire induced circuit failures could cause a secondary fire that could adversely affect safe shutdown equipment and cause a loss of alternate shutdown capability which is contrary to Unit 2 Renewed Facility Operating License Condition 2.C.(3) and Appendix R requirements. The license condition and regulation requires in part, post-fire safe shutdown cables remain free of the effects of fire-induced cable faults during postulated fires. Specifically, the licensee identified DC ammeter circuits for Unit 2, were not provided with overcurrent protection to limit fault current in the 125 volt (V) DC systems. Postulated fires that result in a short to ground concurrent with an opposite polarity short from the same battery could result in excessive current flow in the ammeter wiring. The excessive current could heat-up the conductor and could result in a secondary fire in another fire area. The secondary fire could adversely affect safe shutdown equipment and cause a loss of alternate shutdown capability. Dominion determined the cause of the condition was a latent design error that was made during plant construction involving the failure to include protective fuses in DC ammeter circuits.

The licensee submitted LER 05000336/2013-003-00 to report this event in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition that significantly degraded plant safety. The licensee entered this issue into their corrective action program as condition report number CR530987 and implemented compensatory measures in the affected fire areas pending final resolution of the issue.

The licensee completed an engineering evaluation (RAS000244) of the issue and developed a design change (MP2-14-01007) to add fuses to the affected ammeter circuits. Dominion completed the necessary modifications for all affected ammeter circuits by May 7, 2014.

The significance and enforcement aspect of this issue are discussed in Section 4OA7.1 of this inspection report. LER 05000336/2013-003-00 is closed.

.2 (Closed) Licensee Event Report (LER) 05000336/2014-002-00 (Unit 2): DC Circuit Hot

Shorts On March 12, 2014, during a review of industry operating experience, Dominion identified postulated fire induced circuit failures involving unfused DC motor control circuits for Millstone Power Station Unit 2. The postulated fire induced circuit failures could cause a secondary fire that could adversely affect fire safe shutdown equipment contrary to Unit 2 Renewed Facility Operating License Condition 2.C.(3) and Appendix R requirements. The license condition and regulation requires in part, post-fire safe shutdown cables remain free of the effects of fire induced cable faults during postulated fires. Specifically, the licensee identified 125 V DC control and indication circuits for a non-safety related main turbine emergency lube oil pump that was not provided with overcurrent protection. Postulated fires in the turbine battery room, the cable vault, the plant equipment operator meeting area and the control room could cause failure of the unprotected 125 V DC circuits, which in turn could cause failure of the control circuits for safe shutdown equipment. Dominion determined the cause of the condition was a manufacturers design error that involved the failure to include protective fuses in DC motor control circuits during plant construction.

The licensee submitted LER 05000336/2014-002-00 (Unit 2) to report this event in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition that significantly degraded plant safety. The licensee entered this issue into their corrective action program as condition report number CR541980 and implemented compensatory measures in the affected fire areas pending final resolution of the issue.

The licensee completed an engineering evaluation (RAS000252) of the issue and developed a design change (MP2-14-01040) to add overcurrent protection (fuses) to the affected motor control circuit. Dominion completed the necessary modifications for the affected motor control circuit by May 5, 2014.

The significance and enforcement aspect of this issue are discussed in Section 4OA7.2 of this inspection report. LER 05000336/2014-002-00 (Unit 2) is closed.

.3 (Closed) Licensee Event Report (LER) 05000423/2014-002-00 (Unit 3): DC Circuit Hot

Shorts On March 12, 2014, during a review of industry operating experience, Dominion identified postulated fire induced circuit failures involving unfused DC motor control circuits for Millstone Power Station Unit 3. The postulated fire induced circuit failures could cause a secondary fire that could adversely affect fire safe shutdown equipment contrary to Unit 3 Renewed Facility Operating License Condition 2.H and the branch technical condition (BTP) 9.5-1 requirements. The license condition and the BTP requires in part, post-fire safe shutdown cables remain free of the effects of fire-induced cable faults during postulated fires. Specifically, the licensee identified 125 V DC control circuits for non-safety related main turbine emergency lube oil and a main generator emergency seal oil pumps that were not provided with overcurrent protection. Postulated fires in the turbine battery switchgear area, the cable spreading room, the instrument rack room, and the control room could cause failure of the unprotected 125 V DC control circuits, which in turn could cause failure of control circuits for safe shutdown equipment.

Dominion determined the cause of the condition was a manufacturers design error that involved the failure to include protective fuses in DC motor control circuits during plant construction.

The licensee submitted LER 05000423/2014-002-00 (Unit 3) to report this event in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition that significantly degraded plant safety. The licensee entered this issue into their corrective action program as condition report number CR541983 and implemented compensatory measures in the affected fire areas pending final resolution of the issue.

The licensee completed an engineering evaluation (RAS000253) of the issue and developed design change modifications (MP3-14-01071 and MP3-14-01092) to add overcurrent protection (fuses) to the affected motor control circuits. Dominion completed the necessary modifications for all affected motor control circuits by November 2, 2014.

The significance and enforcement aspect of this issue are discussed in Section 4OA7.3 of this inspection report. LER 05000289/2014-001-00 (Unit 3) is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. John Daugherty, Site Vice President, Millstone Power Station, and other members of the site staff at an exit meeting on August 11, 2016. No proprietary information was included in this inspection report.

4OA7 Licensee-Identified Violations

The following violations of very low safety significance (Green) were identified by the licensee and are violations of NRC requirements. These issues satisfy the criteria of the NRC Enforcement Policy of being dispositioned as Non-Cited Violations.

.1 LER 05000336/2013-003-00 (Unit 2) describes an unanalyzed condition in which

Dominion identified their DC ammeter circuits were unfused. Specifically, Dominion did not provide overcurrent protection for wiring associated with DC ammeter indication in the control room to prevent wires from overheating due to fire induced faults and excessive currents flowing through the cable. With enough current flowing through the cable, the potential existed that the overloaded ammeter wiring could damage system wiring or adjacent safety-related circuits in the cable raceways needed for post-fire safe shutdown. This condition could result in a loss of the associated safe shutdown components or a secondary fire in another fire area. The failure to protect safe shutdown cables from the effects of postulated fires was a performance deficiency.

This performance deficiency was a violation of Millstone Power Station, Unit 2, Renewed Facility Operating License Condition 2.C.(3), which requires in part, post-fire safe shutdown cables remain free of the effects of fire-induced cable faults during postulated fires. Contrary to the above, Dominion identified they failed to meet this requirement and the condition existed since initial construction of Unit 2. The issue was more than minor because it was associated with the protection against external events (fire) attribute of the mitigating systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined that the finding was of very low safety significance (Green), based IMC 0609, Appendix F, Fire Protection Significance Determination Process (SDP), Phase 2 screening criteria.

The finding screened to Green based upon, task number 2.3.5, because the affected cables were routed in alternate shutdown fire areas that are continually manned or protected by detection and automatic suppression systems.

Remaining fire areas are protected by detection systems, automatic suppression systems or rely on manual fire-fighting activities. Additionally, the cable construction is Institute of Electrical and Electronics Engineers (IEEE) 383 (thermoset) which decreases the likelihood of inter-cable and intra-cable interactions. Based on a team walkdown, the team determined that the ammeter cable routing was not routed near a credible fire ignition source in the affected fire areas. Because this finding is of very low safety significance and had been entered into Dominions corrective action program (CR530987), this violation is being treated as a Green, licensee-identified NCV consistent with the NRCs Enforcement Policy.

.2 LER 05000336/2014-002-00 (Unit 2) describes an unanalyzed condition in which

Dominion identified DC motor control circuits were unfused. Specifically, Dominion did not provide overcurrent protection for wiring associated with 125 V DC control circuits for a non-safety related main turbine emergency lube oil pump to prevent wires from overheating due to fire induced faults and excessive currents flowing through the cable. With enough current flowing through the cable, the potential existed that the overloaded motor control wiring could damage adjacent control circuit wiring for components which are needed to achieve and maintain post-fire safe shutdown for a fire in several fire areas (turbine battery room, cable vault, plant equipment operator meeting area, control room). This condition could result in a loss of the associated safe shutdown components or a secondary fire in another fire area. The failure to protect safe shutdown cables from the effect of postulated fires was a performance deficiency.

This performance deficiency was a violation of Millstone Power Station, Unit 2, Renewed Facility Operating License Condition 2.C.(3), which requires, in part, post-fire safe shutdown cables remain free of the effects of fire induced cable faults during postulated fires. Contrary to the above, Dominion identified they failed to meet this requirement and the condition existed since initial construction. The issue was more than minor because it was associated with the protection against external events (fire)attribute of the mitigating systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined that the finding was of very low safety significance (Green), based on IMC 0609, Appendix F, Fire Protection Significance Determination Process, Phase 2 screening criteria.

The finding screened to Green based upon, task number 2.3.5, because the affected cables were routed in alternate shutdown fire areas that are continually manned or protected by detection and automatic suppression systems. Remaining fire areas are protected by detection systems, automatic suppression systems or rely on manual fire-fighting activities. Additionally, the cable construction is IEEE 383 (thermoset) which decreases the likelihood of inter-cable and intra-cable interactions. Based on a team walkdown, the team determined that the main turbine emergency lube oil pump cable routing was not routed near a credible fire ignition source in the affected fire areas.

Because this finding is of very low safety significance and had been entered into Dominions corrective action program (CR541980), this violation is being treated as a Green, licensee-identified NCV consistent with the NRCs Enforcement Policy.

.3 LER 05000423/2014-002-00 (Unit 3) describes an unanalyzed condition in which

Dominion identified DC motor control circuits were unfused. Specifically, Dominion did not provide overcurrent protection for wiring associated with 125 V DC control circuits for non-safety related main turbine emergency lube oil and main generator emergency seal oil pumps to prevent wires from overheating due to fire induced faults and excessive currents flowing through the cable. With enough current flowing through the cable, the potential existed that the overloaded motor control wiring could damage adjacent control circuit wiring for components which are needed to achieve and maintain post-fire safe shutdown for a fire in several fire areas (turbine battery switchgear area, cable spreading room, instrument rack room, control room). This condition could result in a loss of the associated safe shutdown components or a secondary fire in another fire area. The failure to protect safe shutdown cables from the effect of postulated fires was a performance deficiency.

This performance deficiency was a violation of Millstone Power Station, Unit 3, Renewed Facility Operating License Condition 2.H, which requires, in part, post-fire safe shutdown cables remain free of the effects of fire induced cable faults during postulated fires. Contrary to the above, Dominion identified they failed to meet this requirement and the condition existed since initial construction. The issue was more than minor because it was associated with the protection against external events (fire)attribute of the mitigating systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team determined that the finding was of very low safety significance (Green), based on IMC 0609, Appendix F, Fire Protection Significance Determination Process, Phase 2 screening criteria.

The finding screened to Green based upon, task number 2.3.5, because the affected cables were routed in alternate shutdown fire areas that are continually manned or protected by detection and automatic suppression systems. Remaining fire areas are protected by detection systems, automatic suppression systems or rely on manual fire-fighting activities. Additionally, the cable construction is IEEE 383 (thermoset) which decreases the likelihood of inter-cable and intra-cable interactions. Based on a team walkdown, the team determined that the main turbine emergency lube oil and main generator emergency seal oil pump cable routing was not routed near a credible fire ignition source in the affected fire areas. Because this finding is of very low safety significance and had been entered into Dominions corrective action program (CR541983), this violation is being treated as a Green, licensee-identified NCV consistent with the NRCs Enforcement Policy.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Daugherty, Site Vice President

D. Blakeney, Assistant Plant Manager

P. Anastas, Safe Shutdown Engineer

J. Armstrong, Fire Protection Engineer

T. Bryant, Maintenance Supervisor

D. DelBiondo, Site Fire Marshal

J. Farley, Electrical System Engineer

B. Ferguson, Unit 2 Senior Reactor Operator

R. Garver, Engineering Director

L. Kelly, Engineering Lead

W. McCollum, Unit 2 Supervisor

D. Mello, Senior Fire Instructor

K. Perkins, Electrical Engineering Supervisor

P. Russell, Unit 3 Senior Reactor Operator

A. Vargas-Mendez, Licensing Engineer

NRC Personnel

C. Cahill, Acting Branch Chief, Engineering Brach 3, Division of Reactor Safety

C. Highley, Resident Inspector, Millstone Power Station

L. Mckown, Resident Inspector, Millstone Power Station

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

05000336/2016008-01 NCV Unapproved OMA in Lieu of Meeting III.G.2 Fire Protection Requirements for Fire Area R-14, Lower 4kV Switchgear Room and Cable Vault

Closed

05000336/2013-003-00 LER Postulated DC Ammeter Circuit Hot Shorts (Unit 2),

(Section 4OA3.1)

05000336/2014-002-00 LER DC Circuit Hot Shorts (Unit 2), (Section 4OA3.2)

05000423/2014-002-00 LER DC Circuit Hot Shorts (Unit 3), (Section 4OA3.3)

Discussed

None