IR 05000352/2007006
| ML072400443 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 08/27/2007 |
| From: | Rogge J Engineering Region 1 Branch 3 |
| To: | Crane C Exelon Generation Co, Exelon Nuclear |
| References | |
| IR-07-006 | |
| Download: ML072400443 (27) | |
Text
ust 27, 2007
SUBJECT:
LIMERICK GENERATING STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000352/2007006 AND 05000353/2007006
Dear Mr. Crane:
On August 3, 2007, the NRC completed a triennial fire protection team inspection at your Limerick Generating Station. The enclosed report documents the inspection results which were discussed at an exit meeting on August 9, 2007, with Mr. C. Mudrick and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.
This report documents one NRC-identified finding of very low safety significance (Green). The finding was determined to involve a violation of NRC requirements. However, because of the very low safety significance and because it was entered into your corrective action program, the NRC is treating this finding as a non-cited violation (NCV) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Limerick Generating Station. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/ADAMS.html (the Public Electronic Reading Room).
Sincerely,
/RA/
John F. Rogge, Chief Engineering Branch 3 Division of Reactor Safety Docket Nos. 50-352, 50-353 License Nos. NPF-39, NPF-85 Enclosure: NRC Inspection Report 05000352/2007006 and 05000353/2007006
SUMMARY OF FINDINGS
IR 05000352/2007006, 05000353/2007006; 07/16/2007 - 08/03/2007; Exelon Nuclear;
Limerick Generating Station, Units 1 and 2; Triennial Fire Protection Team Inspection.
The report covered a two-week triennial fire protection team inspection by three Region I specialist inspectors. One Green finding was identified. The significance of most findings is indicated by their color (Green, White, Yellow) using Inspection Manual Chapter (IMC) 0609,
Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.
NRC-Identified Findings
Cornerstone: Mitigating Systems
- Green.
The team identified a finding of very low safety significance (Green) involving a non-cited violation of the Limerick Generating Station operating license, in that the procedure for shutting down the plant in response to a fire in the cable spreading room was not consistent with the safe shutdown analysis. Specifically, impediments related to the safe shutdown procedure would have prevented the operators from securing the high pressure coolant injection (HPCI) system within the design time limit. Fire induced cable failures in the cable spreading room could allow HPCI to overfill the reactor vessel which would adversely affect the operation of the reactor core isolation cooling (RCIC)system and the main steam relief valves (MSRVs).
This issue was more than minor because it affected the procedure quality attribute associated with the mitigating systems cornerstone as related to the objective of ensuring the reliability and availability of the RCIC system and MSRVs under postulated fire scenarios. The finding was of very low safety significance based on a Phase 2 Significance Determination Process (SDP) evaluation performed in accordance with IMC 0609, Appendix F, Fire Protection Significance Determination Process. (Section 1R05.01)
Licensee-Identified Violations
None ii
REPORT DETAILS
Background This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure (IP) 71111.05T, Fire Protection. The objective of the inspection was to assess whether Exelon Nuclear, has implemented an adequate fire protection program and that post-fire safe shutdown capabilities have been established and are being properly maintained at the Limerick Generating Station (LGS). The following fire areas (FAs)were selected for detailed review based on risk insights from the LGS Individual Plant Examination of External Events (IPEEE):
C Fire Area 12 C Fire Area 23 C Fire Area 68 C Fire Area 79 The inspection team evaluated the licensees fire protection program (FPP) against applicable requirements which included plant technical specifications, operating license condition 2.C.3, NRC safety evaluation reports (SERs), 10 CFR 50.48, and Branch Technical Position (BTP)
Chemical Engineering Branch (CMEB) 9.5-1. The team also reviewed related documents that included the Updated Final Safety Analysis Report (UFSAR), the fire hazards analysis (FHA),and the safe shutdown analysis.
Specific documents reviewed by the team are listed in the attachment.
REACTOR SAFETY
Cornerstones: Initiating Events, Mitigating Systems
1R05 Fire Protection
.01 Post-Fire Safe Shutdown From Outside the Main Control Room (Alternative Shutdown)
and Normal Shutdown
a. Inspection Scope
Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings (P&IDs), electrical drawings, the UFSAR and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that rely on shutdown from outside the control room.
This review included verification that shutdown from outside the control room could be performed both with and without the availability of offsite power. Plant walkdowns were also performed to verify that the plant configuration was consistent with that described in the safe shutdown and fire hazards analyses. These inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation and support systems functions. The team verified that the systems and components credited for use during post-fire safe shutdown would remain free from fire damage. The team verified that the transfer of control from the control room to the alternative shutdown location(s)would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).
Similarly, for fire areas that utilize shutdown from the control room, the team also verified that the shutdown methodology properly identified the components and systems necessary to achieve and maintain safe shutdown conditions.
Operational Implementation The team verified that the training program for licensed and non-licensed operators included alternative shutdown capability. The team also verified that personnel required for safe shutdown using the normal or alternative shutdown systems and procedures were trained, available onsite at all times, and exclusive of those assigned as fire brigade members.
The team reviewed the adequacy of procedures utilized for post-fire safe shutdown and performed an independent walk through of procedure steps to ensure the implementation and human factors adequacy of the procedures. The team also verified that operators could reasonably be expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions which were verified included restoring alternating current (AC) electrical power, establishing remote shutdown panel operation, establishing reactor coolant makeup, and establishing decay heat removal.
Specific procedures reviewed for alternative shutdown, including shutdown from outside the control room included the following:
C SE-1, Remote Shutdown, Revision 24; C 2FSSG-3023, Fire Area 23 Fire Guide, Revision 2; and C 2FSSG-3068W, Fire Area 68W Fire Guide, Revision 2.
The team reviewed manual actions to ensure that they had been properly reviewed and approved and that the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area. The team also reviewed periodic testing records of the alternative shutdown transfer capability and instrumentation and control functions to ensure the tests demonstrated the functionality of the alternative shutdown capability.
b. Findings
Introduction:
The team identified a finding of very low safety significance (Green)involving a violation of the LGS operating license, in that the procedure for shutting down the plant in response to a fire in the cable spreading room was not consistent with the safe shutdown analysis. Specifically, human performance impediments related to the safe shutdown procedure would have prevented the operators from securing high pressure coolant injection (HPCI) within the design time limit. Fire induced cable failures in the cable spreading room could cause the spurious operation of the HPCI system and result in overfill of the reactor vessel. This would affect the operation of reactor core isolation cooling (RCIC) system and the main steam relief valves (MSRVs).
Description:
LGSs thermal hydraulic analysis for fire safe shutdown, G-080-VC-00028, analyzes a scenario where a fire in the cable spreading room causes a spurious start of HPCI that also bypasses the HPCI level 8 automatic trip. For this scenario, there is a protected switch at the remote shutdown panel which will secure HPCI. The analysis determined that for the worst case conditions, HPCI must be secured within four minutes. If not secured promptly, HPCI would overfill the reactor vessel and water would enter the main steam lines which would adversely impact RCIC and the MSRVs.
Operator action to secure the HPCI system is credited in the fire safe shutdown analysis for the Unit 2 cable spreading room, LF-0016-023.
During the inspection, several walkdowns conducted in the plant and in the simulator were performed to assess the ability to secure HPCI within the specified four minutes.
During these walkdowns several complications were identified, two of which were significant. First, the single key required to secure the HPCI system was located inside a box containing sixty similar keys, but was not labeled for quick identification. Second, the procedure directing the operator to secure HPCI, procedure 2FSSG-3023, Fire Area 023 Fire Guide, referred to a section in procedure SE-1, Remote Shutdown, which was ambiguous since the exact step was not referenced and the necessary prerequisites were not identified. Based upon these human performance impediments and a demonstration conducted by the licensee which took nearly seven minutes to complete, the team had no confidence that the HPCI system could be secured within the four minute time limit.
Corrective action program issue report (IR) 656185 was written to address this issue.
LGS promptly added clear labeling for the HPCI key, revised all affected fire response procedures, and conducted operator training on securing HPCI following a postulated fire in the cable spreading room. The team concluded that these corrective actions were appropriate and provided reasonable assurance that a reactor vessel overfill event could be averted in the event of a spurious fire induced HPCI system initiation. A preliminary evaluation by LGS concluded that the thermal hydraulic analysis, of record, was overly conservative and that the time available to secure HPCI prior to vessel overfill may be between 6.5 to 7 minutes. The team learned that LGS was considering a revision to the design basis to extend the available time to the operators to secure HPCI.
The performance deficiency associated with this finding was that LGS failed to assure that an important time requirement in the safe shutdown analysis was translated and properly validated in the remote shutdown procedure. This deficiency resulted in operators not being able to secure HPCI within the fire safe shutdown credited four minute time limit. The licensee entered this performance deficiency into their corrective action program for resolution.
Analysis:
The team referred to MC 0612 and determined this issue was more than minor because it affected the procedure quality attribute associated with the mitigating systems cornerstone as related to the objective of ensuring the reliability and availability of the RCIC system and MSRVs under postulated fire safe shutdown conditions.
The team assessed this finding in accordance with NRC Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process. This finding affected operator response to postulated fires in the Unit 1 cable spreading room, the Unit 2 cable spreading room, and the combined control room. Based upon the screening criteria of Appendix F and using conservative fire scenario characterizations (medium degradation) and propagation (frequency and confinement), this finding screened to very low risk significance (Green) per Task No. 2.3.5. In support of this risk significance conclusion, the team noted that the Unit 1 and 2 cable spreading rooms are designated transient combustible free zones, fire/smoke detection systems alarm in the control room, automatic sprinkler systems and manual CO2 suppression systems are installed, and the electrical cables installed are flame retardant in accordance with Institute of Electrical and Electronic Engineers (IEEE) 383, IEEE Standard for Qualifying Class 1E Electric Cables and Field Splices for Nuclear Power Generating Stations. Similar fire scenario assumptions and design attributes were credited with respect to postulated fires in the control room and the team noted that the control room is continuously manned. Accordingly, the risk contribution to this finding associated with postulated control room fires is negligible. This significance determination was independently reviewed and verified by a Region I Senior Reactor Analyst.
Enforcement:
License Condition 2.C.3 for LGS Unit 1 and Unit 2 states that, Exelon Nuclear shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the UFSAR. Appendix 9A of the UFSAR requires the licensee to comply with BTP CMEB 9.5-1, position C.5.c, Alternative or Dedicated Shutdown Capability. The BTP CMEB 9.5-1, position C.5.c.3 requires procedures to implement the capability to perform alternative (remote) shutdown. Contrary to these requirements, from approximately October 14, 2004, to August 3, 2007, the licensees procedure for remote shutdown was not adequate to prevent overfilling of the reactor vessel following a spurious, fire-induced start of HPCI. Because the finding was of very low safety significance and has been entered into LGSs corrective action program (IR 656185), this violation is being treated as a non-cited violation (NCV), consistent with Section VI.A.1 of the NRC Enforcement Policy. NCV 05000352, 353/2007006-01, Inadequate Fire Safe Shutdown Procedure for Securing HPCI.
.02 Protection of Safe Shutdown Capabilities
a. Inspection Scope
The team reviewed the fire hazards analysis, safe shutdown analyses and supporting drawings and documentation to verify that safe shutdown capabilities were properly protected. The team ensured that separation requirements of the UFSAR, were maintained for the credited safe shutdown equipment including supporting power, control and instrumentation cables. This review included an assessment of the adequacy of the selected systems for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and associated support system functions.
The team reviewed the licensees procedures and programs for the control of ignition sources and transient combustibles to assess their effectiveness in preventing fires and controlling combustible loading within limits established in the FHA. A sample of hot work and transient combustible control permits were also reviewed. The team performed plant walkdowns to verify that protective features were being properly maintained and administrative controls were being implemented.
The team also reviewed the licensees design control procedures to ensure that the process included appropriate reviews and controls to assess plant changes for any potential adverse impact on the fire protection program and/or post-fire safe shutdown analysis and procedures.
b. Findings
No findings of significance were identified.
.03 Passive Fire Protection
a. Inspection Scope
The team walked down accessible portions of the selected fire areas to observe the material condition and design adequacy of fire area boundaries (including walls, fire doors and dampers), and electrical raceway fire barriers to ensure they were appropriate for the fire hazards within the area.
The team reviewed installation/repair and qualification records for a sample of penetration seals to ensure the fill material was of the appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for fire protection wraps to ensure the material was of an appropriate fire rating and that the installation met the engineering design.
b. Findings
No findings of significance were identified.
.04 Active Fire Protection
a. Inspection Scope
The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected plant fire areas. This included verification that the manual and automatic detection and suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association (NFPA)code of record, or as NRC approved deviations, and that each suppression system would control or extinguish fires associated for the hazards in the selected areas. A review of the design capability of suppression agent delivery systems was verified to meet the code requirements for the fire hazards involved. The team also performed a walkdown of accessible portions of the detection and suppression systems in the selected areas as well as a walkdown of major support equipment in other areas (e.g.,
fire pumps, carbon dioxide (CO2) storage tanks and supply system) and assessed the material condition of the systems and components.
The team reviewed electric and diesel fire pump flow and pressure tests to ensure that the pumps were meeting their design requirements. The team also reviewed the fire main loop flow tests to ensure that the flow distribution circuits were able to meet the design requirements.
The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown. In addition, the team inspected the fire brigades protective ensembles, self-contained breathing apparatus (SCBA), and various fire brigade equipment (including smoke removal equipment) to verify fire fighting readiness.
b. Findings
No findings of significance were identified.
.05 Protection From Damage From Fire Suppression Activities
a. Inspection Scope
The team reviewed documents and walked down the selected fire areas to verify that redundant trains of systems required for hot shutdown were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:
C A fire in one of the selected fire areas would not directly, through production of smoke, heat or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.
C A fire in one of the selected fire areas (or the inadvertent actuation or rupture of a fire suppression system) would not directly cause damage to all redundant safe shutdown trains (e.g., sprinkler caused flooding of other than the locally affected train).
C Adequate drainage was provided in areas protected by water suppression systems.
b. Findings
No findings of significance were identified.
.06 Alternative Shutdown Capability
Alternative shutdown capability for the selected fire areas inspection utilizes shutdown from outside the control room and is discussed in Section 1R05.01 of this report.
.07 Circuit Analyses
a. Inspection Scope
The team verified that the licensee performed a post-fire safe shutdown analysis for the selected fire areas and that the analysis appropriately identified the structures, systems, and components important to achieving and maintaining post-fire safe shutdown.
Additionally, the team verified that licensees analysis ensured that necessary electrical circuits were properly protected and that circuits that could adversely impact safe shutdown due to hot shorts, shorts to ground, or other failures were identified, evaluated, and dispositioned to ensure spurious actuations would not prevent safe shutdown.
The teams review considered fire and cable attributes, potential undesirable consequences and common power supply/bus concerns. Specific items included the credibility of the fire threat, cable insulation attributes, cable failure modes, spurious actuations, and actuations that could result in a loss of coolant event.
The team also reviewed cable routing data sheets and wiring diagrams for a sample of components to verify that all necessary cables had been included in the safe shutdown analysis and that the routing ensures safe shutdown equipment cables remained free from fire damage.
Cable failure modes were reviewed for the following components:
C HV49-2F029, HV49-2F031, RCIC Suppression Suction Valves; C HV49-2F012, HV49-2F013, RCIC Pump Discharge Valves; C PSV41-2F013A, C, and N, SRVs; C HV51-2F004A, HV51-2F006A, RHR Loop A Pump Suction Valves; C 2AP202, RHR Pump A; and C HV51-2F017A, LPCI Outboard Containment Isolation Valve.
The team reviewed circuit breaker coordination studies to ensure equipment needed to conduct post-fire safe shutdown activities would not be impacted due to a lack of coordination. The team confirmed that the coordination studies addressed multiple faults due to fire. Additionally, the team reviewed a sample of circuit breaker maintenance records to verify that circuit breakers for components required for post-fire safe shutdown were properly maintained in accordance with procedural requirements.
b. Findings
No findings of significance were identified.
.08 Communications
a. Inspection Scope
The team reviewed safe shutdown procedures, the safe shutdown analysis, and associated documents to verify an adequate method of communications would be available to plant operators following a fire. During this review, the team considered the effects of ambient noise levels, clarity of reception, reliability, and coverage patterns.
The team also inspected the designated emergency storage lockers to verify the availability of portable radios for the fire brigade and plant operators. The team also verified that communications equipment such as repeaters and transmitters would not be affected by a fire.
b. Findings
No findings of significance were identified.
.09 Emergency Lighting
a. Inspection Scope
The team observed the placement and coverage area of eight-hour emergency lights throughout the selected fire areas and evaluated their adequacy for illuminating access and egress pathways and any equipment requiring local operation and/or instrumentation monitoring for post-fire safe shutdown. The team also verified that the battery power supplies were rated for at least an eight-hour capacity. Preventive maintenance procedures, the vendor manual, completed surveillance tests, and battery replacement practices were reviewed to verify that the emergency lighting was being maintained in a manner that would ensure reliable operation.
b. Findings
No findings of significance were identified.
.10 Cold Shutdown Repairs
a. Inspection Scope
The team verified that the licensee had dedicated repair procedures, equipment, and materials to accomplish repairs of components required for cold shutdown which might be damaged by the fire to ensure cold shutdown could be achieved within the time frames specific in their design and licensing bases. The inspectors verified that the repair equipment, components, tools, and materials (e.g. pre-cut cables with prepared attachment lugs) were available and accessible on site.
b. Findings
No findings of significance were identified.
.11 Compensatory Measures
a. Inspection Scope
The team verified that compensatory measures were in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment, passive fire barriers, pumps, valves or electrical devices providing safe shutdown functions or capabilities). The team also verified that the short term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that licensee was effective in returning the equipment to service in a reasonable period of time.
b. Findings
No findings of significance were identified.
OTHER ACTIVITIES
4OA2 Identification and Resolution of Problems
.01 Corrective Actions for Fire Protection Deficiencies
a. Inspection Scope
The team verified that the licensee was identifying fire protection and post-fire safe shutdown issues at an appropriate threshold and entering them into the corrective action program. The team also reviewed a sample of selected issues to verify that the licensee had completed or planned appropriate corrective actions.
b. Findings
No findings of significance were identified.
4OA6 Meetings, Including Exit
Exit Meeting Summary
On August 9, 2007, the team presented the inspection results to Mr. C. Mudrick, Site Vice President, and other members of the site staff. No proprietary information was included in this inspection report.
ATTACHMENT:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Exelon Generation Company
- C. Mudrick, Site Vice President
- E. Callan, Plant Manager
- B. Dickinson, Director of Engineering
- P. Gardner, Director of Operations
- C. Rich, Director of Training
- S. Bobyock, Manger Engineering Programs
- J. Brittain, NOS
- C. Bruce, Fire Program Engineer
- F. Burzinski, Fire Marshall
P. Chaso Supervisor
- S. Cleaver, Engineering Design Fire
- D. Doran, Sr. Manger Systems Engineering
- M. Evans, Systems Engineer Fire Protection
- D. Hamilton, Sr. Manager Engineering Design
- R. Harding, Regulatory Assurance
- R. George, Manager Electrical Design
- M. Jesse, Manager NOS
- E. Kelly, Engineering Manager
- R. Kreider, Manger Regulatory Assurance
- M. Kurchet, Dresden
- C. Pragman, Corporate Fire Protection
- M. Taylor, Corporate Fire Protection
NRC
- J. Rogge, Chief, Engineering Branch 3, Division of Reactor Safety
- W. Cook, Senior Reactor Analyst, Division of Reactor Safety
- S. Hansell, Senior Resident Inspector, LGS
- C. Bickett, Resident Inspector, LGS
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
NONE
Open and
Closed
- 05000352, 353/2007006-01 NCV Inadequate Fire Safe Shutdown Procedure for Securing HPCI (Section 1R05.01)
Closed
NONE
Discussed
NONE