IR 05000361/2007008

IR 05000361-07-008 and 05000362-07-008; 03/26/2007 - 04/12/2007; San Onofre Nuclear Generating Station; Triennial Fire Protection Inspection

ML072060253
Person / Time
Site:	San Onofre
Issue date:	07/24/2007
From:	Laura Smith Division of Reactor Safety IV
To:	Rosenblum R Southern California Edison Co
References
FOIA/PA-2011-0221 IR-07-008
Download: ML072060253 (34)

Text

July 24, 2007

SUBJECT:

SAN ONOFRE NUCLEAR GENERATING STATION UNITS 2 AND 3 - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000361/2007008 AND 05000362/2007008

Dear Mr. Rosenblum:

On June 15, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed a team inspection at the San Onofre Nuclear Generating Station. The enclosed report documents the inspection findings, which were discussed on June 15, 2007, with Mr. E. Scherer, Manager, Nuclear Regulatory Affairs, and other members of your staff during an exit meeting.

During this triennial fire protection inspection, the inspection team examined activities conducted under your license related to safety and compliance with the Commissions rules and regulations and the conditions of your license. The inspection consisted of selected examination of procedures and records, observations of activities and installed plant systems, and interviews with personnel.

During this inspection, there was one finding of very low safety significance. This finding involved a violation of NRC requirements. The violation is being treated as a noncited violation because it was of very low safety significance and was entered in your corrective action program consistent with Section VI.A of the Enforcement Policy. If you contest the violation or the significance of the violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U. S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U. S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas, 76011; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the San Onofre Nuclear Generating Station.

Southern California Edison Company-2-In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection. In the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web-site at http://www.nrc.gov/NRC/ADAMS/Index.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Linda J. Smith, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos.: 50-361, 50-362 License Nos.: NPF-10, NPF-15

Enclosure:

Inspection Report 05000361 and 05000362/2007008 w/Attachment: Supplemental Information

REGION IV==

Dockets No.:

50-361, 50-362 License No.:

NPF-10, NPF-15 Report No.:

05000361/2007008 and 05000362/2007008 Licensee:

Southern California Edison, Co.

Facility:

San Onofre Nuclear Generating Station, Units 2 and 3 Location:

San Clemente, CA Dates:

March 26, 2007 through June 15, 2007 Inspectors:

N. O'Keefe, Senior Reactor Inspector (Team Leader)

J. Mateychick, Senior Reactor Inspector S. Alferink, Reactor Inspector R. Mullikin, Counsultant Accompanying By:

K. Sullivan, Brookhaven National Lab D. Andrukat, NRR Approved By:

Linda J. Smith, Chief Engineering Branch 2 Division of Reactor Safety

Enclosure Enclosure-2-

SUMMARY

OF ISSUES

IR 05000361/2007008 and 05000362/2007008; 03/26/2007 - 04/12/2007; San Onofre Nuclear Generating Station; Triennial Fire Protection Inspection.

The inspection was conducted by three region-based inspectors and two consultants.

One Green finding was identified during this inspection. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.

The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-649, Reactor Oversight Process, Revision 3, dated July 2000.

NRC-Identified and Self Revealing Findings

Green.

A noncited violation of License Condition 2.C.(14), Fire Protection, was identified for failure to ensure that redundant trains of safe shutdown equipment would remain free of fire damage in Fire Area 2-AC-50-29. Specifically, the cables for redundant trains of safe shutdown equipment in both units were not separated by at least 10 feet as described in Deviation Number 8, and they also failed to meet Section III.G.2 of Appendix R to 10 CFR 50. Four Train B cables in conduits were found to be located within 10 feet of the Train A switchgear room cooling units in both plants.

The concern was that a single fire could cause loss of Train B 120V vital ac power and battery charger, as well as cause loss of Train A ac and dc power due to the loss of room cooling. This issue was entered into the corrective action program under Action Requests 070400873 and 070400998.

Failure to ensure that redundant trains of safe shutdown equipment would remain free of fire damage in accordance with the license basis was a performance deficiency. This finding was more than minor because it affected the protection against external factors attribute of the Mitigating Systems cornerstone. The significance of this finding was assessed using Appendix F of Manual Chapter 0609, Fire Protection Significance Determination Process. This finding was categorized as a localized cable/component protection issue with high degradation rating. The evaluation of the potential fire sources and fire targets indicated that the finding had very low safety significance because none of the potential fire sources were expected to damage all four Train B cables or cause the loss of function in both trains. (Section 1R05.2.b.1)

B.

Licensee-Identified Findings None.

REPORT DETAILS

1R05 Fire Protection The purpose of this inspection was to review the San Onofre Nuclear Generating

Station (SONGS) fire protection program (FPP) for selected risk-significant fire areas.

The inspection was performed in accordance with Inspection Procedure (IP) 71111.05T, Fire Protection (Triennial). Emphasis was placed on verification of the post-fire safe shutdown capability. The inspection was performed in accordance with the NRC regulatory oversight process using a risk-informed approach for selecting the fire areas and attributes to be inspected. The team used the Individual Plant Examination for External Events for SONGS to choose risk-significant areas for detailed inspection and review. Inspection Procedure 71111.05T, Fire Protection (Triennial), requires selecting three to five fire areas for review. The five fire areas reviewed during this inspection were:

• Fire Area 2(3)-AC-50-40, Train A Switchgear Room (Units 2 and 3)

• Fire Area 2(3)-AC-50-29, Unit 2 Lobby/Motor Control Room (Units 2 and 3)

• Fire Area 2(3)-AC-30-20A, Main Control Room (Units 2 and 3)

• Fire Area 2(3)-TK-30-161A, Unit 2 Auxiliary Feedwater Pump Room (Units 2 and 3)

• Fire Area 2(3)-AC-9-17, Relay Room (Units 2 and 3)

For each of these fire areas, the inspection focused on fire protection features, systems and equipment necessary to achieve and maintain safe shutdown conditions and licensing basis commitments.

Documents reviewed by the team are listed in the attachment.

.1 Shutdown From Outside Main Control Room

a. Inspection Scope

The team reviewed the functional requirements identified by the licensee as necessary for achieving and maintaining hot shutdown conditions to ensure that at least one post-fire safe shutdown success path was available in the event of fire in each of the selected areas and alternative shutdown for the case of control room evacuation. The team reviewed piping and instrumentation diagrams of systems credited in accomplishing safe shutdown functions to independently verify whether the licensees shutdown methodology had properly identified the required components. The team focused on the following functions that must be available to achieve and maintain safe shutdown conditions:

Enclosure

• Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

• Reactor coolant makeup capable of maintaining the reactor coolant inventory,

• Reactor heat removal capable of achieving and maintaining decay heat removal,

• Supporting systems capable of providing other services necessary to permit extended operation of equipment necessary to achieve and maintain hot shutdown conditions,

• Verify that a safe shutdown can be achieved and maintained with and without off-site power.

A review was also conducted to ensure that all required components in the selected systems were included in the licensees safe shutdown analysis. The team identified the systems required for each of the primary safety functions necessary to achieve and maintain shutdown conditions. These systems were then evaluated to identify the systems that interfaced with the selected fire areas and were the most risk significant systems required for reaching hot shutdown conditions.

b. Findings

Introduction.

An unresolved item was identified associated with the technical basis for the critical times associated with several manual actions necessary for control room evacuation.

Discussion. The team reviewed the technical basis for manual action completion times used for control room evacuation. These manual actions are needed to comply with 10 CFR 50, Appendix R, Section III.G.3, and the plant response must meet the requirements of Section III.L.

The team identified that the licensee did not have an analysis which documented the plant response during the control room evacuation scenario. Instead, there were a number of calculations which addressed the adequacy of staffing and the feasibility of the manual actions. The team noted that there is no requirement to have a documented analysis for this purpose, but it was common industry practice to have some form of analysis in order to demonstrate compliance with Section III.L.

The team selected 12 samples, which represented several dozen individual manual actions, to review. The licensee was requested to demonstrate that the critical completion times for the associated actions would result in the plant response remaining within the requirements of Section III.L. The licensee was able to do this for all but the following actions:

a.

Isolate steam generator blowdown and restore auxiliary feedwater flow within 30 minutes. Initial calculations indicate that steam generators could dry out after 20 minutes with maximum blowdown flow present and no auxiliary feedwater flow. While significant reactor subcooling margin (35EF) was still available after Enclosure 30 minutes, restoring auxiliary feedwater to a hot, dry steam generator was not analyzed for these conditions. During timed walkthroughs of the control room evacuation procedure, the team determined that the action to isolate blowdown flow was accomplished in less than 5 minutes, and auxiliary feedwater was initiated in 25 minutes.

b.

Start an emergency diesel generator and energize the associated buses within 30 minutes. The most limiting components requiring power were those associated with restoring auxiliary feedwater flow, which also had a limiting time of 30 minutes. Since the blowdown flow isolation affected the times that both these actions would need to be completed, it was possible that these times were shorter than the critical times specified in the existing calculations. Restoring an emergency diesel generator and auxiliary feedwater flow were more than simple actions, walkdown results indicated that they could be performed within about 21 minutes.

c.

Isolate reactor coolant system letdown within 30 minutes. The team specifically questioned whether the Section III.L requirements could be met with expected reactor coolant system seal leakage and technical Specification allowed leakage.

The initial calculations indicated that pressurizer water level could go offscale low in about 23 minutes under maximum letdown conditions without charging. The team noted that the manual actions to isolate letdown were early in the control room evacuation procedure, and were performed in 7 minutes.

Assessment. The team concluded that there were two issues to be resolved. One involved whether the conclusions of the licensees safe shutdown analysis were adequate, and the other involved whether the control room evacuation procedure was adequate to meet the requirements of 10 CFR 50, Appendix R, Sections III.G.3 and III.L. Additional information was needed from the licensee to determine the safety significance. This issue was entered into the corrective action program under Action Request 070600585.

The team used the guidance in Inspection Procedure 71111.05T to assess whether the manual actions discussed above were reasonable and feasible. This was done by conducting timed walkthroughs of the manual actions specified for the five fire areas selected as samples for this inspection. These walkthroughs were conducted using qualified plant operators. The completion times determined in these walkthroughs, noted above, indicated that actual completion times were expected to be much shorter than the allowable times from the safe shutdown analysis. In each case, the team judged that there was no immediate safety concern because the actual completion times appeared to be adequate to support safe shutdown.

Enforcement.

Additional information was needed to determine whether there was a violation of 10 CFR 50, Appendix R, Sections III.G.3 and III.L. Specifically, the concern was that the safe shutdown analysis allowed 30 minutes to isolate letdown, start an emergency diesel generator, initiate auxiliary feedwater, and secure steam generator blowdown, without demonstrating that these completion would ensure that the plant remained within the performance parameters specified in Section III.L. Pending review of additional analysis by the licensee, this will be treated as an unresolved item:

Enclosure URI 05000361; 362/2007008-01, Review Adequacy of Manual Action Completion Times for Control Room Evacuation.

.2 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify whether the shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the fire areas selected for review. The team also reviewed and observed walkdowns of the procedures for achieving and maintaining safe shutdown in the event of a fire to verify that the safe shutdown analysis provisions were properly implemented. The team focused on the following functions that must be ensured to achieve and maintain post-fire safe shutdown conditions:

(1) reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

(2) reactor coolant makeup capable of maintaining the reactor coolant level within the level indication in the pressurizer,

(3) reactor heat removal capable of achieving and maintaining decay heat removal,

(4) supporting systems capable of providing all other services necessary to permit extended operation of equipment necessary to achieving and maintaining hot shutdown conditions, and

(5) process monitoring capable of providing direct readings to perform and control the above functions.

The team reviewed the licensees methodology for achieving and maintaining post-fire safe shutdown methodology. The teams evaluations were primarily based on discussions with licensee personnel and review of the following documents:

• San Onofre 2&3 Fire Hazards Analysis Updated (UFHA), June 2005

• DBD-SO23-TR-FP, Fire Protection Topical Report, Revision 11

• DBD-SO23-TR-AR, Appendix R Safe Shutdown Topical DBD, Revision 11

• Calculation 900035BS, SONGS 2/3 SO23-13-21 Fire Area Summary, Revision 4

• Calculation 90035AO. Appendix R Manual Actions Feasibility Evaluation, Revision 8

• Calculation 90035BI, Appendix R Time Line Calculations for Manual Actions, Revision 5

• Calculation N-0220-038, Plant Transient Response to Selected Appendix R Scenarios, Revision 0.

The team reviewed the separation of safe shutdown cables, equipment, and components located within the same fire areas. For each of the selected fire areas, the team verified that at least one post-fire safe shutdown success path would remain free Enclosure of fire damage. For each component identified on the Safe Shutdown Equipment List (Calculation No. 90035AH), power, control and instrumentation cables associated with its operation were identified and evaluated for the potential impact of fire damage on the ability to achieve and maintain post-fire safe shutdown conditions (Calculation No. 90035AN). The team examined the adequacy of electrical independence, physical separation and fire protection features provided for cables and equipment needed to assure the operation of systems that would be relied on to achieve and maintain safe shutdown conditions in the event of fire. The specific components selected for review are delineated in the Attachment.

On a sample basis, the team also reviewed the adequacy of electrical protective devices (e.g., circuit breakers, fuses, relays), coordination, and the adequacy of electrical protection provided for nonessential cables which share a common enclosure (e.g., cable trays) with cables of equipment required to achieve and maintain safe shutdown conditions. The evaluation included a review of cable routing data depicting the location of power and control cables associated with selected components of the shutdown systems. Additionally, the team reviewed the protection of diagnostic instrumentation required for safe shutdown for fires in the selected areas.

.1 Inadequate Fire Separation

Introduction:

A Green noncited violation of License Condition 2.C.(14), Fire Protection, was identified for failure to ensure that redundant trains of safe shutdown equipment would remain free of fire damage in Fire Area 2-AC-50-29. Specifically, the cables for redundant trains of safe shutdown equipment in both units were not separated as described in Deviation Number 8, and they also failed to meet Section III.G.2 of Appendix R to 10 CFR 50. Several cables were located such that one fire could possibly disable two trains of dc power.

Description:

The licensees Safe Shutdown Analysis had determined (circa 1986) that Fire Area 2-AC-50-29 does not meet the technical requirements of Section III.G.2(b) of Appendix R to 10 CFR 50 to the extent it requires cables, equipment and associated nonsafety circuits of redundant trains to be separated by a horizontal distance of more than 20 feet with no intervening combustibles or fire hazards. The licensee had determined that although the area did not satisfy the technical requirements of Section III.G.2, the existing physical separation of redundant trains of shutdown equipment would provide an acceptable level of fire protection for redundant trains of shutdown systems. By letter dated May 31, 1987, the licensee requested a deviation from its commitment to meet Section III G.2 of Appendix R. (Deviation No. 8, Units 2 and 3 Lobby/Motor Control Room Fire Area 2-AC-50-29). By letter dated, June 29, 1988, the staff provided its safety evaluation of Deviation No. 8. In the Safe Shutdown Deviations section, the NRC approved the deviation.

To confirm that the as-installed separation of redundant shutdown systems was consistent with the configuration described in Deviation No. 8, the inspection team reviewed the licensees cable routing database and a drawing that was specifically developed by the licensee to show the routing of redundant cable raceways within Fire Enclosure Area 2-AC-50-29. Several instances were identified where the separation distance between redundant trains of shutdown cables were less than the 10 feet specified in Deviation No. 8.

The licensee entered this finding into its corrective action program under Action Requests (AR) 070400873 and 070400998. Specifically, although Deviation No. 8 stated that the separation between Train A emergency air conditioning fans and the redundant Train B emergency power and instrumentation cables is approximately 10 feet with no intervening combustibles, Train B cables associated with 120VAC vital buses (2/3Y02 and 2/3Y04) and 125VDC distribution system (2/3B002, 2/3B004, 2/3D2 and 2/3D4) were found to be routed in four conduits that are separated from the Train A cooling unit by 1.5 to 4 feet. Cables routed in one of the four raceways must remain free of fire damage to achieve and maintain safe shutdown. The specific raceways cables, and equipment that may be affected by fire are as follows:

Unit 2 - Raceway Group BC1 - Located in north corridor (Corridor 303B)adjacent to Train A emergency AC Fans Raceway Cable ID Equipment Train PU2IHBK20 P2BBJ46P1 2B004 - 125V Battery Charger for BUS D4 D

PU2IHBK21 P2BY6201P 2Y02 -120 VAC Vital Bus Channel B B

PU2IHBK22 P2BY6202P 2Y04 -120 VAC Vital Bus Channel D D

PU2IHBK23 P2BBZ03P1 2B002 -125V Battery Charger for Bus D2 B

PU2IHBK23 P2BBZ03P1 2D2 - 125 VDC Switchboard B

Unit 3 - Raceway Group BC2 - Located in south corridor (Corridor 303D)adjacent to Train A emergency AC Fans Raceway Cable ID Equipment Train PU3IVBK20 P3BBJ46P1 3B004 -125V Battery Charger for Bus D4 D

PU3IVBK22 P3BY6201P 3Y02 -120VAC Vital Bus Channel B B

PU3IVBK23 P3BY6202P 3Y04-120 VAC Vital Bus Channel D D

PU3IVBK21 P3BBZ03P1 3B002 - 125V Battery Charger for Bus D2 B

PU3IVBK21 P3BBZ03P1 3D2 -125 VDC Switchboard B

The licensee activated Fire Impairment No. 07040066 to establish established an hourly fire watch patrol within Fire Area 2-AC-50-29 as a compensatory measure until this issue was resolved. The licensee planned to modify the plant to provide adequate separation between the redundant cables and the Train A cooling unit.

As a result of its review, the team determined that the inadequate separation of redundant shutdown systems in Fire Area 2-AC-50-29 was a violation of License Enclosure Condition 2.C.(14), Fire Protection, for failure to ensure that redundant trains of safe shutdown systems in the same fire area were free of fire damage. Specifically, the team determined that since Fire Area 2-AC-50-29 does not comply with the conditions of its approved deviation, it must meet the technical requirements of Section III.G.2 of Appendix R, which Deviation Number 8 states it does not.

Analysis:

Failure to implement the approved fire protection program by failing to meet either the conditions of Deviation No. 8 or meet the requirements of 10 CFR 50, Appendix R, Section III.G.2, was a performance deficiency. This finding was more than minor because it affected the protection against external factors attribute of the Mitigating Systems cornerstone. The significance was assessed using Appendix F of Manual Chapter 0609, Fire Protection Significance Determination Process. This finding was categorized as a localized cable or component protection issue.

This finding involved having four Train B cables in conduits that were located within 10 feet of the Train A switchgear room cooling units in both plants. The concern was that a single fire could cause loss of Train B 120V vital ac power and battery charger, as well as causing loss of Train A ac and dc power due to the loss of room cooling. In order for this to occur, all four cables in question would need to be damaged for the Train B function to be lost. The cables in question were 1.5 to 4 feet from the Unit 2 cooling unit, and 2.5 to 4 feet from the Unit 3 cooling unit. The degradation was conservatively assigned as highly degraded because the separation was a small fraction of the stated 10 feet in one case. This was considered conservative since the only fixed fire source was the Train A ventilation cooling unit fan motor, which was encased in a steel air handling unit. This unit was described by the licensee as being equivalent to a radiant heat shield in the deviation. No credit was given in this evaluation because this claim was not verified by the team. Using the fire zone of influence for a 10 horsepower motor, this fire source was determined to be capable of causing fire damage to only the closest cable in each unit. Because the four cables in each unit were in conduits, the fire would not be capable of spreading from one to another. In order to challenge the redundant safety function, all four cables would have to be damaged, but this was determined to not be credible. Therefore, this fire source screens out.

Transient combustible fires and hotwork were also considered as potential fire sources.

Transient combustible fire sources were screened out because this fire area was subject to strict administrative controls, since this was a condition of the NRC-approved deviation. Additionally, the location where the transient combustibles would have to be stored in order to damage the cables would have been such that they would have blocked access in this corridor, making it highly unlikely that any material storage would be permitted. Therefore, this potential fire source was screened out in accordance with Appendix F. Hotwork as a fire source was also screened out because the licensee demonstrated that no hotwork permits were approved in the area of concern during the prior year.

Since all fire sources screened, and the area was protected with area-wide fire detection and suppression systems, this issue was determined to have very low safety significance in accordance with Appendix F. This finding was not a current safety concern because the licensee implemented prompt compensatory measures while corrective action was being implemented.

Enclosure

Enforcement.

San Onofre License Condition 2.C.(14), Fire Protection, requires that Southern California Edison shall implement and maintain in effect all provisions of the approved fire protection program. This program shall be

(1) as described in the Updated Fire Hazards Analysis through Revisions 3 as revised by letters to the NRC dated May 31, July 22, and November 20, 1987 and January 21, February 22, and April 21, 1988; and

(2) as approved in the NRC staffs Safety Evaluation Report (SER)(NUREG 0712) dated February 1981; Supplements 4 and 5 to the SER, dated January 1982 and February 1982, respectively; and the safety evaluation dates November 15, 1982; as supplemented and amended by the Updated Fire Hazards Analysis Evaluation for San Onofre 2 and 3, Revision 1, dated June 29, 1988. Southern California Edison may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of fire. San Onofre Units 2 and 3 are committed to complying with the requirements of 10 CFR 50, Appendix R, Section III.G.

Deviation from the requirements of Section III.G.2 was requested by letter dated May 31, 1987, and approved in SER dated June 29, 1988 on the basis that redundant Train B emergency power and instrument cables in the area of the Train A emergency fan had a horizontal separation between the cables and the fan unit of approximately 10 feet at the closest point.

Contrary to the above, the team identified that, since original construction, redundant trains of cables for equipment needed to assure safe shutdown in the event of a fire in Fire Area 2-AC-50-29 were not separated as described in the deviation request.

Specifically, in the north area in Unit 2, and in the south area in Unit 3, Train B cables affecting ac and dc power were located within 10 feet of the Train A switchgear room cooling unit such that one fire had the potential to cause loss of redundant safe shutdown functions. These cables had not been previously recognized to exist in this location, so they were not assessed as part of the deviation analysis. The location of these cables was not consistent with the deviation as approved.

Since these examples did not comply with the configuration approved in Deviation Number 8, the licensee was required to comply with basic requirements of Appendix R,Section III.G.2. However, this requirement was also not met, as stated by the licensee in the application for the deviation. Therefore, it was concluded that the licensee failed to comply with their approved fire protection program, which was a violation of license Condition 2.C(14). This issue was entered into the corrective action program under Action Requests 070400873 and 070400998. Noncited Violation 05000361; 362/2007008-02, Fire Separation in Fire Area 2-AC-50-29 Did Not Comply With Deviation Request.

.2 Reliance On Unapproved Manual Actions

Introduction.

The team identified that the licensees Safe Shutdown Analysis relied upon manual actions to mitigate the effects of potential equipment damage to redundant trains of safe shutdown equipment due to fire, rather than ensuring that this equipment was free of fire damage.

Enclosure Discussion. Upon thorough review of the licensing basis for the fire protection program, it was determined that manual actions were specifically submitted and approved by the NRC for alternative shutdown areas, as well as for one fire area (Fire Area 2-AC-50-29).

For nonalternative shutdown areas, the fire protection program was approved based upon compliance with the requirements of 10 CFR 50, Appendix R, Section III.G.1 or III.G.2, unless deviations were specifically requested and approved. Only Deviation No. 8, for Fire Area 2-AC-50-29, discussed and received approval for specific manual actions. The manual actions in question were listed in Abnormal Operating Procedure SO23-13-21, Fire, Revision 13. Therefore, an apparent violation was identified because, by relying on unapproved manual actions to ensure safe shutdown equipment would remain free of fire damage, the licensee was not implementing the approved fire protection program in multiple fire areas, contrary to License Condition 2.C.(14), Fire Protection.

The licensee stated that they did not agree that a violation occurred, however, they placed the issue in the corrective action program and stated that they intend to address the issue.

Enforcement.

The NRC is exercising discretion not to cite this apparent violation because the licensee has met the conditions of Enforcement Guidance Memorandum 98-02, Revision 2, and Supplement 2 to that revision. Specifically, this issue has been placed into the corrective action program under Action Request 070600585, and will be addressed through the corrective action program.

Also, appropriate compensatory measures were implemented, in the form of hourly fire watches and manual actions.

The team used the guidance in Inspection Procedure 71111.05T to assess whether the manual actions could be reliably completed. This was done by conducting timed walkthroughs of the manual actions specified for the five fire areas selected as samples for this inspection. These walkthroughs were conducted using qualified plant operators.

These samples included Fire Area 2/3-AC-50-29, which had the largest number of actions for any fire area. In every case, operators were able to perform the actions more quickly than the designated limiting times. The manual actions, though unapproved, were reviewed by the team and determined to be reasonable and feasible in accordance with guidance in Inspection Procedure 71111.05T. Therefore, there is no immediate safety concern.

.3 Passive Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, fire doors, electrical raceway fire barriers and fire rated electrical cables. The team observed the material condition and configuration of the installed barriers, seals, doors, and cables. The team compared the as-installed configurations to the approved construction details and supporting fire tests. In addition, the team reviewed license documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association code to verify that fire protection features met license commitments.

Enclosure

b. Findings

No findings of significance were identified.

.4 Active Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire suppression and detection systems. The team observed the material condition and configuration of the installed fire detection and suppression systems. The team reviewed design documents and supporting calculations, test procedures, and surveillance test results. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association codes to verify that fire suppression and detection systems met license commitments.

The team also observed a fire drill and the subsequent drill critique using the guidance in Inspection Procedure 71111.05AQ. Team members observed the site fire department simulate fire fighting activities in plant Fire Area 3-AC-85-71 (Unit 3 nonvital switchgear room), as well as control room operator response. The inspectors verified that the licensee staff identified deficiencies, openly discussed them in a self-critical manner during the drill debrief, and took appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient fire fighting equipment brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other plant areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings of significance were identified.

.5 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

For the selected fire areas, the team verified that redundant trains of systems required for hot shutdown would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems, including the effects of flooding. The team reviewed calculations and conducted walkdowns of each of the selected fire areas to assess conditions, such as the adequacy and condition of floor drains, equipment elevations, and spray protection.

b. Findings

No findings of significance were identified.

Enclosure

.6 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the licensee's alternative shutdown methodology to determine if the licensee properly identified the components, systems, and instrumentation necessary to achieve and maintain safe shutdown conditions from the auxiliary shutdown panel and alternative shutdown locations. The team focused on the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring and support system functions. The team verified that hot and cold shutdown from outside the control room could be achieved and maintained with offsite power available or not available. The team verified that the transfer of control from the control room to the alternative locations was not affected by fire-induced circuit faults by reviewing the provision of separate fuses for alternative shutdown control circuits.

The team also reviewed the operational implementation of the licensee's alternative shutdown methodology. Team members observed a walk-through of the control room evacuation procedures with both licensed reactor and senior reactor operators. The team observed operators simulate performing the steps of Procedure SO23-13-2, "Shutdown from Outside the Control Room," Revision 8, which provided instructions for performing an alternative shutdown from the hot shutdown panel, and dedicated shutdown panel and for manipulating equipment in the plant. The team verified that the minimum number of available operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable plant shutdown time requirements and that equipment labeling was consistent with the procedure. Also, the team verified that procedures, tools, dosimetry, keys, lighting, and communications equipment were available and adequate to support successfully performing the procedure as intended. The team also reviewed records for operator training conducted on this procedure.

The team verified that required shutdown functions were adequately isolated from the main control room and capable of being controlled from the remote shutdown panel. As part of this review, the capability to transfer control from the Main Control Room to the remote shutdown panel was reviewed to verify that, once actuated, the isolation transfer scheme provided an adequate level of electrical isolation so that required shutdown functions would not be adversely affected as a result of fire damage in the main control room.

b. Findings

No findings of significance were identified.

.7 Circuit Analyses

a. Inspection Scope

The team reviewed the licensees post-fire safe shutdown analysis to verify that the licensee had identified circuits with the potential to impact safe shutdown. On a sample basis, the team verified that cables of equipment required to achieve and maintain hot Enclosure shutdown conditions in the event of fire in selected fire zones had been properly identified. In addition, the team verified that these cables had either been adequately protected from the potentially adverse effects of fire damage, mitigated with approved manual operator actions, or analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. In order to accomplish this, the team reviewed electrical schematics and cable routing data for power and control cables associated with each of the selected components.

Since the licensee utilized thermoset cables for each of the components selected for review, the team reviewed the following cable failure modes:

1. Spurious actuations due to any combination of conductors within a single

multiconductor cable;

2. A maximum of two cables considered where multiple individual cables may be

damaged by the same fire;

3. For cases involving direct current control circuits, the potential spurious operation

due to failures of the control cables (even if the spurious operation requires two concurrent shorts of the proper polarity, e.g., plus-to-plus and minus-to-minus);and

4. For cases involving decay heat removal system isolation valves at high-

pressure/low-pressure interfaces, the vulnerability of three-phase power cables due to three-phase proper polarity hot shorts.

In addition, on a sample basis, the adequacy of circuit protective coordination for safe shutdown power sources was evaluated. The specific power sources selected for review include: 4160VAC Switchgear 2AO4, 480VAC ESF Load Center 2B04, 480VAC MCC 2BY 125VDC Distribution Switchboard 2D1, and 120VAC Vital Bus 2Y01. Also, on a sample basis, the adequacy of electrical protection provided for non-essential cables that share a common enclosure with cables of required shutdown equipment was reviewed to ensure that the non-essential cables are adequately protected to preclude common enclosure concerns.

b. Findings

No findings of significance were identified.

.8 Communications

a. Inspection Scope

The team reviewed the adequacy of the communication system to support plant personnel in the performance of alternative safe shutdown functions and fire brigade duties. The team verified that plant sound powered phone system and radios were available for use and maintained in working order. The team reviewed that the electrical power supplies and cable routing for these systems to verify that either the telephones or the radios would remain functional following a fire. The team discussed system Enclosure design and testing with the system engineers and the fire chief. Additionally, the team observed proper use and functioning of these communications systems during the fire drill conducted on March 28, 2007 and procedure walkthroughs conducted March 27 - 29, 2007.

b. Findings

No findings of significance were identified.

.9 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting system required to support plant personnel in the performance of alternative safe shutdown functions to verify it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions are required. The locations and positioning of emergency lights were observed during a walkthrough of the control room evacuation procedure.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team used the guidance in Inspection Procedure 71111.05T, Fire Protection (Triennial), and Generic Letter 86-10, Implementation of Fire Protection Requirements, to review licensee procedures to determine whether repairs were required to achieve cold shutdown and to verify that dedicated repair procedures, equipment, and material needed to accomplish those repairs were available on the site.

The team also evaluated whether cold shutdown could be achieved within the required time using the licensee's procedures and repair methods.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The team reviewed the licensees program with respect to compensatory measures in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems or features.

Enclosure The team reviewed the Licensee Controlled Specifications applicable to active and passive fire protection equipment and post-fire safe shutdown equipment, the current fire impairment log, a sample of fire impairments and program implementing procedures to determine whether the procedures adequately controlled compensatory measures for fire protection systems, equipment and features (e.g., detection and suppression systems and equipment, and passive fire barriers) and post-fire safe shutdown components. The following implementing procedures were reviewed:

• SO123-FP-1 Fire Protection Program

• S023-XIII-4.13 Inspection For Control of Combustibles and Transient Fire Loads

• S023-XIII-4.100 Units 2 and 3 Fire Monitoring System (FMS) Computer Use and Impairment Scope Identification

• S023-XIII-4.200 Units 2 and 3 Fire-Rated Assemblies Impairment Scope Identification

• S023-XII I-4.300 Units 2 and 3 Safe Shutdown Components Impairment Scope Identification

• S023-XIII-4.400 Units 2 and 3 Fire Detection Instrumentation and Fire Suppression Systems Impairment Scope Identification

• S023-XV-1.41 Control of Ignition Sources

• S023-XV-4.13 Control of Work and Storage Areas Within the Protected Area

• S023-7-1 Fire Suppression Water System Operation

• S023-7-4 Halon Fire Protection System Operation

• S023-7-5 Carbon Dioxide Fire Protection System Operation

• S023-7-8 Fire Monitoring System Computer Use and Operation

• SO123-XIII-4.600 Fire Protection Impairment

• SO123-XIII-7 Firewatch

• SO123-XX-10 Maintenance Rule Risk Management Program Implementation

• SOG-AD-0014Fire Department Supervision fo FPS Personnel

b. Findings

No findings of significance were identified.

Enclosure

4OA2 Problem Identification and Resolution

a. Inspection Scope

The team reviewed a sample of action requests to verify that the licensee was identifying fire protection-related issues at an appropriate threshold and entering those issues into the corrective action program. A listing of action requests reviewed is provided in the attachment to this report.

b. Findings

No findings of significance were identified.

4OA5 Other Activities

.1 (Closed) Unresolved Item 05000361; 05000362/2004008-01:

Potentially Inadequate Safe Shutdown Procedure The inspector performed an in-office review of licensee documentation and discussed this item with onsite fire protection staff and engineers. Concerns 1 through 4 were previously closed in Inspection Report 05000361;362/2006004.

During a triennial fire protection inspection, the team identified a number of concerns with Procedure SO23-13-21, "Fire," Revision 8, that questioned the adequacy of the procedure to achieve and maintain safe shutdown conditions for fires located outside the control room. The specific concerns with Procedure SO23-13-21 included for each fire area failures to:

(1) translate all equipment required to be operated, as specified in the safe shutdown analysis into the procedure;

(2) identify diagnostic instrumentation that remained available;

(3) prioritize operator actions required to prevent damage to required shutdown equipment; and

(4) include limitations resulting from fire scenarios (i.e., had based response times on accident analyses rather than fire scenarios) when identifying critical times for operating equipment.

The licensee had informed the team that these issues had been self-identified during a manual action evaluation in 2001 and during a 2004 Directed Assessment of the Fire Protection Program. The team determined that the licensee:

(1) had performed a comprehensive self assessment that expanded the potential safety significance of issues identified in the 2001 manual action assessment,

(2) initiated Action Request 040400370 to address each issue identified during the 2004 Directed Assessment, and

(3) implemented compensatory measures (i.e., roving fire watches in safe shutdown areas of both units) on August 17, 2004. The directed assessment also identified that an inadequate 10 CFR 50.59 evaluation had been performed in 1996 that should have identified the concerns above.

Concern 5 - Adequacy of 10 CFR 50.59 Review of Procedure Change Enclosure The inspectors determined that the licensee:

• Revised Procedure SO23-13-21 on April 10, 1996, to support a complete format change, reduce repetitive steps, and remove information considered to be "skill of the craft." The licensees 10 CFR 50.59 screening determined that a 10 CFR 50.59 safety evaluation was not required for the procedure change given the intent and scope of the procedure change (format change, reduce repetitive steps, remove information that was considered to be skill of the craft).

Removed the specific identification of the train of safe shutdown equipment to be used, as this was considered a skill of the craft based on operators knowledge of the plant layout and safe shutdown system operation strategy.

• Determined during the Appendix R/Fire Protection Program 2004 Directed Assessment that some operator actions credited in the safe shutdown analyses were not included in the Procedure SO23-13-21 and that the actions were deleted during the changes made to Revision 1 of the procedure.

• Concluded that, had the change been completed today in accordance with the 10 CFR 50.59 process, a full evaluation would have been required and would have concluded that NRC approval was needed.

The licensee attributed the root cause of the event in 1996 to the following contributing causes:

(1) a lack of industry guidance/standards for post-fire safe shutdown procedures,

(2) inadequate knowledge of the procedure change author of the original procedure intent and the safe shutdown analyses,

(3) lack of realization that the procedure author was deleting actions relied upon in the analyses, and

(4) a review by a qualified fire protection engineer was not specified when significant changes were made to post-fire safe shutdown procedures.

The licensee took the following corrective actions:

(1) incorporated the missing information into Procedure SO23-13-21, Revision 8, and documented the error in Action Request 040400370,

(2) concluded that although the actions were missing, operators could still have shutdown the reactor in the event of a fire, and

(3) initiated an evaluation to ensure appropriate actions to prevent recurrence were taken.

The inspector determined that the procedure could be implemented as written although some enhancements were required. Further, the inspector determined that this failure to perform an appropriate 10 CFR 50.59 evaluation was licensee-identified and the licensee addressed the issue in their corrective action program.

Analysis:

Failing to perform a 10 CFR 50.59 evaluation was determined to be a performance deficiency. This issue had the potential to impact the NRCs ability to perform its regulatory function for failure to perform an appropriate 10 CFR 50.59 analysis. However, this finding was determined to be of minor safety significance Enclosure because it would not have impacted the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. Specifically, the inspector determined that the procedure provided adequate guidance to operations personnel although some enhancements were needed.

Enforcement:

The Updated Final Safety Analysis Report, Section 9.5.1.3, "Safety Evaluation," specifies that the specific content of this section required by Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (sic)," Revision 2, is discussed in the Updated Final Hazards

Analysis.

The Updated Fire Hazard Analysis, Section 7.9, specified for Fire Area 2-AC-50-29 that, "Safe shutdown capability will be provided by utilizing Trains A or B systems. Safe shutdown analysis demonstrates that either Trains A or B systems of both units may be damaged by fire, but due to physical separation at least one train for each unit will remain available. Functionally redundant components protected from fire damage will be utilized in conjunction with operator action on manual or disabled components to achieve safe shutdown." The licensee used Procedure SO23-13-21 to implement the actions required to achieve safe shutdown in this fire area. Contrary to the above, on April 10, 1996, the licensee revised Procedure SO23-13-21 and eliminated appropriate guidance for taking manual actions to safely shutdown the reactor without performing the required safety evaluation.

This failure to comply with 10 CFR 50.59 constitutes a violation of minor significance that is not subject to enforcement action in accordance with Section IV of the NRCs Enforcement Policy. The licensee entered this deficiency into their corrective action program as Action Request A040400370. The inspector determined that the licensee had identified this deficiency during their 2004 Directed Appendix R/Fire Protection Program self assessment.

4OA6 Meetings, Including Exit

On March 12, 2007, the team presented the inspection results to Mr. R. Waldo, Vice President, Nuclear Generation, Mr. B. Katz, Vice President, Nuclear Oversight and Regulatory Affairs, and other members of his staff who acknowledged the findings.

On June 15, a telephonic exit meeting was conducted by telephone to present the final enforcement and significance for the findings to Mr. E. Scherer and other members of his staff, who acknowledged the finding.

The inspectors confirmed that proprietary information was not provided or examined during this inspection.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

D. Arai, Systems/Maintenance Engineer

D. Axline, Licensing Engineer

D. Breig, Station Manager

M. Carr, Manager, PRA

J. Dahl, Operations Manager, Design and Procedure Review

F. dePeralta-Meister, Consultant

D. Ensminger, Fire Chief

J. Gisi, Supervisor, Fire Protection Services

P. Hawkins, System Engineer

B. Katz, Vice President, Nuclear Oversight and Regulatory Affairs

J. Klante, Fire Department Training

J. McGaw, Consulting Engineer, Design Engineering

T. Rak, Design Engineering Supervisor, Electrical Controls Systems and Analysis

A. Ratchford, Consultant

B. Richter, Engineering Supervisor, Fire Protection

A. Scherer, Manager, Nuclear Regulatory Affairs

K. Sheek, Plant Equipment Operator

R. Waldo, Vice President, Nuclear Generation

C. Vadoli, Design Engineer

T. Yackle, Manager, Maintenance and System Engineering

NRC

D. Loveless, Senior Reactor Analyst, RIV

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000361;362/2007008-01 URI Review Adequacy of Manual Action Completion Times for Control Room Evacuation. (Section 1R05.1)

Closed

05000361;362/2004008-01 URI Potentially Inadequate Safe Shutdown Procedure (Concern 5) (Section 4OA5)

Opened and Closed

05000361;362/2007008-02 NCV Fire Separation in Fire Area 2/3-AC-50-29 Did Not Comply With Deviation Request.

(Section 1R05.2.b.1)