IR 05000321/2003006

Draft Version of Edwin I. Hatch Nuclear Power Plant - NRC Triennial Fire Protection IR 05000321-03-006 and 05000366-03-006

ML050560349
Person / Time
Site:	Hatch
Issue date:	08/31/2003
From:	NRC/RGN-II
To:
References
FOIA/PA-2004-0277 IR-03-006
Download: ML050560349 (43)

Text

I -

\

* U. S. NUCLEAR REGULATORY COMMISSION-Dce Nos.

f Lies Nos.: -REGION II 50-321, 50-366

- Reorkt Nos.: DPR-57, NPF-5-o . 0 05000321/200306 and 05000366/200306-A .4 0-6 KI 1 .

kheer e.SAIv ;It /-S-747/1 aRI 74 Pi

-. S/

(::_- A//9 G-5- el-c5 Inspector)

%-. V Vlou I a , I I1 r- Iv wtvJ uul II muo. 9 'I K. Sullivan, Consultant, Brookhaven National Laboratory Accompanying S. Belcher, Nuclear Safety Intern, Week 1 Personnel:

Approved by: Charles R. Ogle, Chief Engineering Branch 1 Division of Reactor Safety Enclosure

4,--- -

SUMMARY OF FINDINGS

IR 05000321/200306, 050003661200306; Southern Nuclear Operating Company; 7/7-11/2003 and 7/21-25/2003; E. I.Hatch Nuclear Plant, Units 1-and 2; Triennial Fire

`Protection The report covered a two-week period of inspection by three regional inspectors and a contractor from Brookhaven National Laboratory. Three Green non-cited violations (NCVs) and three unresolved items with potential safety significance greater than Green were identified.

The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609, -Significance Determination Process" (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review.' The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

A..

NRC-Identified and Self-Revealing Findings

Comer -stone: Mitigating Systems

• 'URI. The team identified an unresolved item in that a local manual operator action, to prevent spurious opening of all eleven safety relief valves (SRVs) during a fire event, would not be performed in sufficient time to be effective. Also, licensee reliance on this manual action for hot shutdown during a fire, instead of physically protecting cables from fire damage, had not been approved by the NRC.

This finding is unresolved pending completion of a significance determination. In

• - response to this potential issue, the licensee promptly moved the manual action step to the front of the Fire Procedure to-enable operators to accomplish the action much sooner during a fire event. This'finding was determined to have potential safety" significance greater than very low significance because of the use of manual actions in lieu of physical protection as required by 10 CFR 50 Appendix R, Section III.G.2.

(Section 1R05.05.b.1)

URI. The team identified an unresolved item in that a fire in Fire Area 2104 could cause all eleven SRVs to open at a time when residual heat removal (RHR) system may not be available. To mitigate this event, the licensee's safe shutdown analysis report (SSAR) credits the use of Core Spray Loop A to provide reactor coolant makeup.

However, the licensee did not provide any objective evidence (e.g., specific calculation or analysis) which demonstrated that, assuming worst-case fire damage in Fire Area 2104, the limited set of equipment available would be capable of mitigating the event in a manner that satisfies the shutdown performance goals specified in Appendix R, section L.1.e to IOCFR 50.

This finding is unresolved pending completion of the NRC review of a calculation of record which demonstrates the capability of the Core Spray system to mitigate the above event. This finding was determined to have potential safety significance greater than very low significance because of a lack of a calculation of record and

., . I -..

b.

documentation of the limited set of equipment that would be credited for safe shutdown under these conditions. (Section 1R.05.03.b)

URI: The team identified an unresolved item in connection with the implementation of design change request (DCR)91-134, SRV Backup Actuation via Pressure Transmitter-Signals. The installed plant modification failed to implement the one-out-of-two taken'

twice logic that was specified as design input requirements in the design change.,.'

package. Additionally, implementation of a two-out-of-two coincident taken twice logic, has introduced a potential common cause failure of all eleven SRVs because of fire induced damage to two instrumentation circuit cables in close proximity to each other.

This finding is unresolved pending completion of a significance determination.. This finding is greater than minor because it impacts the mitigating system cornerstone. This finding has the potential for defeating manual control of Group WN SRVs that are required for ensuring that the suppression pool temperature will not exceed the heat capacity temperature limit (HCTL) for the suppression pool. (Section 1R21 .01 .b)

Green.

The team identified a finding with very low safety significance in that a local

... I manual operator action to operate safe shutdown equipment was too difficult and was also unsafe. The licensee had relied on this action instead of providing physical i protection of cables from fire damage or preplanning cold shutdown repairs. However, the team judged that some operators would not be able to perform the action.

I I

I This finding involved a violation of 10 CFR 50, Appendix R, Section III.G.1 and Technical Specification 5.4.1. The finding is greater than minor because it affected the. ii availability and reliability objectives and the equipment performance attribute of the mitigating systems comerstone. Since the licensee could have time to develop and implement cold shutdown repairs to facilitate accomplishment of the action, this finding did not have potential safety significance greater than very low safety significance.

(Section 1R05.05.b.2)

Green.

The team identified a finding with very low safety significance in that the licensee relied on some manual operator actions to operate safe'shutdown equipment, instead of providing the required physical protection of cables from fire damage, and'

without NRC approval.

This finding involved a violation of .10 CFR 50, Appendix R, Section III.G.2. The finding is greater than minor because it affectedthe availability and reliability objectives and the equipment performance attribute of the mitigating systems cornerstone. Since the actions could reasonably be accomplished by operators in a timely manner, this finding did not have potential safety significance greater than very low safety significance.

(Section 1R05.05.b.3)

Green.

The team identified a finding with very low safety significance in that emergency lighting was not adequate for some manual operator actions that were needed to support post-fire operation of safe shutdown equipment.

, *  ;

' r ' .S' , '_',

",_' '  ;, t or ' e' .

... _. . .... t i

. t . t \ . . . .

' ;>01  :' *%

I'.; A_'* ' .

.. . .: 5 .  ; . .

. .. . . 8 .

,

.

• . s .

This finding involved a violation of 10 CFR 50, Appendix R, Section III.J. The finding is:.

greater than minor because it affected the reliability objective and the equipment P . , .

. e , . - .

performance attribute of the mitigating systems cornerstone. Since operators would be

_ . J '

e . .

" 1 ' ' ' " .

able to accomplish the actions with the use of flashlights, this finding did not have potential safety significance greater than very low safety significance. (Section A*' . l ' . '

. '.," ,, < ' ' ' ' ' ' .

.' ' " ' ' . . h b

. 6 ': 1R05.07.b) . -

', ' ' "' '. ' "

-: s -

Licensee-Identified Violations

. ....

-

None

. . .. .

.- ... . - .

. ..

. . .

- .: .-

-- ..

. . .

.. . .

• . .

. -

. . . .

. . .

. . .

.. . .

. . .  :

. . . .

' ' . . ' ' ' '

.. .

. . . .

. .

- . .

. . .. . .

.. , . . . .. .

.

. . . .

. .

• . ,

I

REPORT DETAILS

REACTOR SAFETY

.

Cornerstones: Initiating Events, Mitigating Systems and Barrier Integrity

1R05 FIRE PROTECTION

The purpose of this inspection was to review the Hatch Nuclear Plant fire'protection program (FPP).for selected risk-significant fire areas. Emphasis was placed on verification that the post-.

fire safe shutdown (SSD) capability and the fire protection features provided for ensuring that.at least one redundant train of safe shutdown systems is maintained free of fire damage'. .The

inspection was performed in accordance with the Nuclear Regulatory Commission (NRC)..

Reactor Oversight Program using a.risk-informed approach for selecting the fire'areas and attributes to be inspected. The team used the licensee's Individual Plant Examination for' r

External Events and in-plant tours to choose four risk-significant fire areas for detailed inspection and review. The fire areas chosen for review during this inspection were:

Fire Area 2016, West 600 V Switchgear Room, Control Building, Elevation 130 feet.

Fire Area 2104, East Cableway, Turbine Building, Elevation 130 feet.

l .

Fire Area 2404, Switchgear Room 2E, Diesel Generator Building, Elevation 130 feet.'

Fire Area 2408, Switchgear Room 2F, Diesel Generator Building, Elevation 130 feet.,

The team evaluated the licensee's FPP against applicable requirements, including Operatipg License Condition 2.C.(3)(a), Fire Protection; Title 10 of the Code of Federal Regulations, Part 50 (10 CFR 50), Appendix R; 10 CFR 50.48; Appendix A of Branch Technical Position (BTP ' .

Auxiliary and Power Conversion Systems Branch (APCSB) 9.5-1; related NRC Safety Evaluation Reports (SERs); the Hatch Nuclear Plant Updated Final Safety Analysis Report (HNP-FSAR); and plant Technical Specifications (TS). The team evaluated all areas of this inspection, as documented below, against these requirements.

Documents reviewed by the team are listed in the attachment.

.01 Systems Required

Arhive and Maintain Post-Firs Safe ShutdownIn

a. Inspection Scope

The licensee's Safe Shutdown Analysis Report (SSAR) was reviewed to determine the components and systems necessary to achieve and maintain safe shutdown conditions in the event of fire in each of the selected fire areas. The objectives of this evaluation

-were as follows:

(a) Verify that the licensee's shutdown methodology has correctly identified the components and systems necessary to achieve and maintain a safe shutdown condition.

(b) Confirm the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring and support system functions.

(c) Verify that a safe shutdown can be achieved and maintained without off-site power, when it can be confirmed that a postulated fire in any of the selected fire areas could cause the loss of off-site power.

(d) Verify that local manual operator actions are consistent with the plant's fire protection licensing basis.

b Findings - of;/l, £ The team identified a potential concern where the licensee used manual actions to disconnect terminal board sliding links in order to isolate two 4-2 ma)instrumentation' loop control circuits in order to prevent the spurious actuation of eeven SRVs. This issue is discussed in section 1R05.03.b of the report.

.02 Fire Protection of Safe Shutdown Capability

a. Inspection Scope

For the selected fire areas, the team evaluated the frequency of fires or the potential for fires, the combustible fire load characteristics and potential fire severity, the separation of systems necessary to achieve safe shutdown (SSD), and the separation of electrical components and circuits located within the same fire area to ensure that at least one SSD path was free of fire damage. The team also inspected the fire protection features to confirm they were installed in accordance with the codes of record to satisfy the applicable separation and design requirements of 10 CFR 50, Appendix R, Section lll.G, and Appendix A of BTP APCSB 9.5-1. The team reviewed the following documents,-

which established the controls and practices to prevent fires and to control combustible fire loads and ignition sources, to verify that the objectives established by the NRC-approved fire protection program (FPP) were satisfied:

• Updated Final Safety Analysis Report (UFSAR) Section 9.1-A, Fire Protection Plan Administrative Procedure 40AC-ENG-008-OS, Fire Protection Program

• Administrative Procedure 42FP-FPX-018-OS, Use, Control, and Storage of Flammable/Combustible Materials

• Preventive Maintenance Procedure 52PM-MEL-012-0, Low Voltage Switchgear Preventive Maintenance The team toured the selected plant fire areas to observe whether the licensee had properly evaluated in-situ fire loads and limited transient fire hazards in a manner consistent with the fire prevention and combustible hazards control procedures. In

Sf addition, the team reviewed the licensee's fire safety inspection reports and corrective action program (CAP) condition reports (CRs) resulting from fire, smoke, sparks, arcing, and overheating incidents for the years 2000-2002 to assess the effectiveness of the fire prevention program and to identify any maintenance or material condition problems related to fire incidents.

The team reviewed fire brigade response, fire brigade qualification training, and drill program procedures; fire brigade drill critiques; and drill records for the operating shifts from'January 1999 - December 2002. The reviews were performed to determine whether fire brigade drills had been conducted in high fire risk plant areas and whether fire brigade personnel qualifications, drill response, and performance met the requirements of the licensee's approved FPP.

The team walked down the fire brigade equipment storage areas and dress-out locker areas in the fire equipment building and the turbine building to assess the condition of fire fighting and smoke control equipment.' Fire brigade personal protective equipment located at both of the fire brigade dress-out areas and fire fighting equipment storage area in the turbine building were reviewed to evaluate equipment accessibility and functionality. Additionally, the team observed whether emergency exit lighting was provided for personnel evacuation pathways to the outside exits as identified in the National Fire Protection Association (NFPA) 101, Life Safety Code, and the' Occupational Safety and Health Administration (OSHA) Part 1910, Occupational Safety and Health Standards. This review also included examination of whether backup emergency lighting was provided for access pathways to and within the fire brigade

- equipment storage areas and dress-out locker areas in support of fire brigade'.

operations should power fail during a fire emergency. The fire brigade self-contained breathing apparatuses (SCBAs) were reviewed for adequacy as well as the availability of supplemental breathing air tanks and their refill capability.

The team reviewed fire fighting pre-fire plans for the selected areas to determine if appropriate information was provided to fire brigade members and plant operators to facilitate suppression of a fire that'could impact SSD. Team members also walked down the selected fire areas to compare the associated pre-fire plans and drawings with as-built plant conditions. This was done to verify that fire fighting pre-fire plans and drawings were consistent with the fire protection features and potential fire conditions described in the Fire Hazards Analysis (FHA).

The team reviewed the adequacy of the design, installation, and operation of the manual suppression standpipe and fire hose system for the control building. This was accomplished by reviewing the FHA, pre-fire plans and drawings, engineering mechanical equipment drawings, design flow and pressure calculations and NFPA 14 for hose station location, water flow requirements and effective reach capability. Team members also walked down the selected fire areas in the control building to ensure that hose stations were not blocked and to verify that the required fire hose lengths to reach the safe shutdown equipment in each of the selected areas were available.. Additionally,

g - l

:

.

.

-the team obseirved placement of the fire hoses and extinguishers to assess consistency D

with the fire fighting pre-fire plans and drawings.

.

• w W .

b. Findings

..-

..

I No findings of significance were identified.

.i

.03 Post-Fire Safe Shutdown Capabilitv

i

.I Inspection Scone

. I

..t...

-0 CFR 50.48, "Fire Protection," and Appendix R to 10 CFR 50, "Fire Protect' '-

Pr mfor Nuclear Power Facilities Operating Prior to January 1, 197 tablish specific rotection features required to satisfy General Design erion 3, "Fire Protection" (' , Appendix Ato 10 CFR 50).Section III.

Appendix R requires

. ..

. i fire protection feature provided for equipment impo t to safe shutdown. An acceptable level of fire pr tion may be achiev various combinations of fire protection features (barriers, firpressio stems, fire detectors, and spatial ..

i separation of safety trains) delineate ctionnII ( '

compliance with the technical requ en-licensees must either seek an mption frc i alternative shutdown capa y in accordanc i regulation.

For each se ed fire area, the results of the Section .Gof Appendix R is documented in eva tions was to determine the fire-inducec sess the plant impact given those loses.

- On a sample basis, an evaluation was performed to verify that systems and equipment

• identified in the licensee's SSAR as being required to achieve and maintain hot

• shutdown conditions would remain free of fire damage in the event of fire in the selected fire areas. The evaluation included a review of cable routing data depicting the location of power and control cables associated with SSD Path 1 and Path 2 components of the RCIC and HPCI systems. Additionally, on a sample basis, the team reviewed the licensee's analysis of electrical protective device (e.g., circuit breaker, fuse, relay) ,

coordination. 7;, fSflo7 sn 0gtz/ ,)

Xindings Qapability of Equipment Credited in SSAR to Mitigate the Spurious Actuation of Eleven SRVs

• ' lnt introduction: The team identified a potential concern wheF the licensee used manual actions 4odi :caare terminal b odw linkifdor to isolate two 4 to 20 ma instrumentation control loop circuits in-ordr to preve n of le Als5o"/4 L.1  ; #'S't $

rv Cr0 so HA4-~e.

un~dii SR~s h~di u te ~ ~ lx d ~;&i Ui ~iside, ed et fepair and'....

cot c h saining sale..

uihml actions in lieu of

.roviding

Description:

The SSAR states that a f nFire Area 0col cause all eleven SRVs to spuriously actuate as a result of fir damage to t ocables that are located in close proximity in this area. The specific ci cults that c Idcause this event have been identified by the licensee (circuit nos ABE01 9 8 and ABEQI19C09).- Each of these two circuits provides a 4 to 20 mi~ipinstr entation signal from SRV high-pressure- '

actuation transmitters (21321-N12713 and 2 -N127D) to master trip unij§2B21CfN697B.

and 2B21-N697D, respectively. The purp se of this circuitry is to viffe an electrical backup to the mechanical trip capability fthe individua SV nthe event of high reactor pressure, the circuits would pr vide a signal to th rip units which would cause all eleven SRVs to actuate (~open). T epressure signal from each transmitter is con setv~rveyedunit vaatwo-conductor, instrument cable that is routed to its repciveti through this fire area (two separate cables). Each cable consists of a single twisted pair

• . .of insulated conductors, an uninsulated drain wire that is wound around the twisted pair.

of conductors, and a foil shield. In Fire Area 2104 the two cables are located in close proximity, in the same cap le tray. Actuation of the SRV electrical backup is'completely

'blind' to the operatorsiVnlike ADS, it does not provide any pre-actuation indication

~-(e.g~.u, alctua~tionoftie ADS timer) oran inhibit capability (e.g., ADS inhibit switch). Since the operators typically would not initiate a manual scram until fire damage significantly.

interfered with control of the plant, its possible that all eleven SRVs could open at 100%.

• power, prior-to scramming the reactor. This scenario could lace the plant in an.

• unanalyzed condition.

Unlike ic.y1al control circuit, a direct short or ot short" between conductors of a 4 to.

20 ff4t~famp instrument circuit may not be n esary to initiate an undesired (false high)siginaj For cables that transmit low-level rtrument signals, any degradation of the

-- 1? iation of the individual twisted condu ors; due to fire -damage may be sufficient to cause leakage currents to be generated between the two conductors. Such leakage current would appear as a false high pressure signal to the trip units. If both cable

,~...wee-aaged~as a result of fire, false signals generated as a result of leakage.crr in each cable, webtdd actuate the SRV electrical backup scheme which would 'causal eleven of the SRVs to open. The conductor insulation and jacket material of each cable is cross-linked polyethylene (XLPE). Since both cables are in the same tray and exposed to the same heating rate, there is a reasonable likelihood that both instrumentation cables would suffer insulation damage at the same time and both circuits could fail hig imultaneously.

The license s SSAR recognizes the potential safety significance of this event and describes methods that have been developed to prevent its occurrence and/or mitigate its impact on the plant's post-fire safe shutdown capability should it occur. To prevent this scenario, the licensee has developed procedural guidance which directs operators

II

/ vrA' Z.

.

'14f ri -

A  ; </as

.. .

.

Z~.

Ai( X 1* 4wzllllZ I1A:

'AI v/r X.

A

'I.

/6O C;-/Z ...

l...

A/O A'rZ- ee Ar

/ e .. s-,oKe, sll-eil--Il ff roll 5' -'

p

-"

/ -./ A-1-4-c- & C4; 'co .

P a

-S;7p-- --00%

-1

.

Pt In vvazr- ,2et dI Ai-- ..74 2 ,Aoe-- 9

,0- 'a-

.- ,Z(

-4.,

,t,-

/J~l-~9 7 h te+

SA ,  : 5r#-

'07 A.~- / tl , , A, _

I

.14 .4

. I .r ' oe-l

, 'i4~ e4 K/,-- z-c, 54 vy /, elIoo.l-4 ...

.

• ' _ _ _ _ _ _ _ _ _ _ __._ _

toopen link BB-10in panel 2H11-P927 and link BB'-10in panel 2H11-P28. Opening of these links would prevent actuation of the SRV trip units by removing the 4 to 20 ~~

q~jmm-signal fed by the pressure transmitter . In the even, the 3RVs were to open priorto operars co eting this action, the SSAR credits re ray ioop A to mitigate eevent inspection team had several concerns regarding the licensee's a~proacl~ Specific concerns identified by the team

" I'cluded:

,.

' Ae

.

Theti in'f fremvn nt he , inpcto temhd eea at o n cesr y thre 4cto20 conen eadinh the time '

, , A .-..-, h v fr fire r e tion stmet oh evn h Xop ee ooe Wh ' eperator er on (oenin inks) e nsis te with the 3::'h ca ity of the i ed set Ofis scand equipf credited in t .

.S or 'ing post-r a utdown c iion in the off e Fi A r a2 ting e the time sfies

. e inab. y o the opera s o uly onI

'With regar perator actions to prevent fire damage from causing all SR5s Toopen~ydingthe inspection~helicensee performed an evaluationwhich estimated that approximately thirty minutes would passfrom the time of fire detecti

, time an operator would implement rocedura actions to

• ~~ 4 3 0 me) m4 h toMlcomng t pro-vide an mcn ff sffoctivdown n ingth+e s a - p ytua ~of fmfein Asteia214 i the -44.4G; saa agreed to enhance its

.

.- existing procedures so that the action would be taken immediately following confirmation of fire in areas where the spurious actuation could occur.

ou The team consid dy1oerator's actiof opening terminal board links to be not in compliance wi th censing s. Current licensing basis documents which . _ g orgimatreque for exemption dated May 16,t1986oandi subsequent afety Evaluation pr(SR dated January 2, 1987~lcharacterizdd the

.pening of links as'a repair a vitethat is not permitted as a means of coin I Section.Ih.G of Appendix R.the ,sdthe o iesnksrnwast csiderea Ta repair by both the licensee and the NRC staff not provide any evidence to justify why these actions are immda ctel lingeA.,pa - E .-

l activity in its current SSAR. Inwresponse to this inspection findingo utle licensee initiated a Condition Report (CR 2003800152, dated 7/24/03) to evaluate actions to open links, in order to determine if they are necessary to achieve hot shutdown, and if an exemption

/ from Appendix.R Is required.

.

• um4tb4he -a.4wa ecause there is a potential for all SRVs to' spuriously actuate s a result of firinFire Area 2104 at a time when RHR is not available, the SSAR c dits the use of ore pray Loop A to accomplish the reactor coolant makeup function. uring the inspe ion,6  :-

7124103, the licensee vekrfao-perf6rmed a simulator exercise of an event which caused all 11 SRVs to open. During this exercise, simulator RPV level instruments

'Th;'c ated that Gore Spray would be capable of maintaining level above the top of active fuel. However, he lifensee did not provide any objective evidence (e.g., specific calculation or analysis) which demonstrated that, assuming worst-case fire damage in Fire Area 2104, the limited set of equipment available would be capable of mitigating the' event in a manner that satisfies the shutdown performance goals specified in Appendix Riection L.1.e to 1OCFR 50.

'

licensee's failure to implement'the design input requirements of one-out-of-takenice logic for DCR 91-134 resulted in the following plant problem.he logic that was instaltm1by DCR 91-134 for the SRVs was a two-out-of-two coident taken twice' logic in additio a one-out-of-two'coincident taken twice lo t.he team determined that the two-out-of- coincident logic input from trip un aster relays K31OD and K335D represented a coon cause failure for groWA" SRVs for a fire in'fire area .

2104. Specifically, cable AB9008 associawith pressure transmitter 2B21-N127B' current loop, and cable ABE'19C soped with pressure transmitter'2B21-N127D1' current loop, are both routed in the s ble tray in fire area 2104. Both shielded twisted pair instrument cables unprotecte mthe effects of a fire in this fire area.

Fire induced insulation dage to both cables cou suIt in leakage currents which causes the instrume ops to fail high. This failure mo ulates a high nuclear boiler pressure dition which would initiate SRV backup actul f the group A".

SRVs whc ould cause the SRVs to assume a stuck-open mode a ration.

Spur actuation of group WA".SRVs for a fire in fire area 2104 defeats the capability to naually control these SRVs as is required per the SSAR.

i:I

.A.nalvzis: This finding is grecn r than minor because it affected the availatb"ty and reliability objectives and the equi ent performance attribute of the mitigating systems cornerstone. In order to achieve s shutdow conditions for a fire in any of the fire-areas chosen for review, manual conI of tw SRVs is required. For Path I group "A" SRVs 2B21-FO13B and 2B21-FO13F ar re uired to remain manually operable.

Additionally, for Path 2 group "A"SRVs 2 -F013D and 2B21-FO13G are required to remain manually operable. These acti s an ecessary to ensure that the suppression pool temperature will not exceed the eat capac temperature limit (HCTL) for the suppression pool. One SRV ( per ath) is opene manually control depressurization approximately two and a half ho rs after event initiatio in order to maintain the suppression pool below the I-IL. -The second SRV is opened approximately four hours to allow use of the alternate shutdown cooling mode of operation.

.

Enfor mefnt: 10 CFR 50App endix R, *tion L.1.e states that during the post fire shutdowvs the reactor coolant s eprocess variables shall be maintained within those p~bdlted for a loss of nor ower. Additionally, 10 CFR 50 Appendix R,

.0 'Jpw

/Z - -

-

Ad4~a Fey~~~0- -*-

.4 Z

-

s*as tl-- 7

/

-Ile 15 - IA--C / /<4 Z4f e fo -73py  ;

A4 or

^

Ig Isr 44( SA'c1 4.-

7- I /

s4L5o4 -

-7 71 -/v_

4 w ",M-  ;,-

.Pi, 1.24 I e

/6~fe 471/ A- 415 Sf, 1-4( eAC- I/ I74' olfw, -r, j q %4% ) * -0j zoO30O6 -61 a

'730--

- \ s - - J wz ee 4A4$ 0el14 0 15zg

-

j I(

ow , 114e r1e7e A,:e-----Pi~

,also I A- .

---

xtr40A14t ,

el CZ .

9-ha .

.

F / -E7 ..1 , -P 4-~ g .

A ir-

/ 9 ,

.

- -- -- -11, - 41

-7're-w - - - - -

-

.- 75, -

Issued  ; ,7A4 -

lol*e Mg6-C v

u section lIll.G.2 does not permi euse of manual actions in lieu of protection without proval of an exemption om th RC. This finding was ternined to safety significance greater than ye owsignifican caeuse of the following: (1)the licensee's failure to obtain NRC appr Ifo theys6"of manual actions in lieu of providing protection in accordance wihIerq~irements of 10 CFR 50, Appendix R, section Ill.G.2 and (2)the lack of a calc aoofrecord and documentation of the limited set of equipment that would crdtfrsafe shutdown under these conditions. Pendinn rnmn.linn -' t of rec'brd which demonstrates the c ate spurious actuation of eleven SRVs, this .; .

. Ca.abilitv of Equipment Credite1 n of Eleven SRVs.

O4 AlternatebShitv ol H 4lternative Shutdown

a. Inspection Scope

j yZ i .

,-.-

The selected fire ar , U ( 7 /- 1II1involved reactor shutdown from the ie control room and alternative safe shd wever, the licensee's plansforSSDfollo) .

- amyn. local manual operator actions that would ..

- ,., the control room. This section of the inspe g ,(,7 V/4 or actions.

The team reviewed A. s :c Go .

capability for a fire in the selected fire areas t ' nsistent with the' Appendix R safe shl were written so that the operator actions co that were necessary for the actions to be eff s included SSD capability;

(4) perso dlant in hot standby could be provide from the  ; 'ade; and

(5) the licensee periodically' quipment.

The team walked dc to be performed outside of the control area o8til mliirn control room tor a tire in'the selected fre areas and

-scussed them with operators. These actions were documented in bnormal 'perating Procedure (AOP) 34AB-X43-001-2, Version 10.8, dated May 28, 2003. The team evaluated whether the local manual operator actions could reasonably be performed, using the criteria outlined in NRC Inspection Procedure (IP)71111.05, Enclosure 2. The team also reviewed applicable operator training lesson plans and job performance measures (JPMs) and discussed them with operators. In addition, the team reviewed records of actual operator staffing on selected days.

1. Untimely and Unapproved Manual ODerator Action for Fire Safe Shutdown

• :

.9 :

Introduction:

The team found that a local manual operator'action to prevent spurious opening of all eleven SRVs would not be performed in sufficient time to be effective.' '

Licensee reliance on this manual action for hot shutdown during a fire, instead of

. '- physically protecting cables from fire damage, had not been approved by the NRC.

Description:

The team noted that $tep 9.3.2.1 of AOP 34AB-X43-001-2, Fire Procedure, Version 10.8, dated May 28, 2003, stated: "To.prevent all eleven SRVs from opening simultaneously, open links BB-10 in Panel 2H11-P927 and BB-10 in Panel 2H11-P928."

The team noted that spurious opening of all eleven SRVs would be considered a large' loss of coolant accident (LOCA), and that a LOCA must be prevented from occurring. -

during afire event. Additionally, the team observed that this step was sufficiently far.

back in the procedure that it may not be completed in time to prevent potential fire

.

' ' damage to cables from causing all eleven SRVs to spuriously open.

' -The licensee had no preplanned estimate of how long it would take operators to complete this step during a fire event. 'The're was no event time line or operator training JPM on this step. The team noted that, during a fire event, operators could be using many other procedures concurrent with the Fire Procedure. For example, they could be' using other procedures to communicate with the fire brigade about the fire, respond to a'.

.reactor trip, deal with a loss of offsite power, and provide emergency classifications and:

- 'offsite notifications of the fire event. During the inspection, licensee operators estimated that, during a fire event, it could take about 30 minutes before operators would

' accomplish step 9.3.2.1. The team concurred with that time estimate. However, NRC fire models indicated that fires could potentially cause damage to cables in as little as

- about five to ten minutes. Consequently, the team concluded that during a fire event the licensee's procedures would not ensure thatytep 9.3.2.1 would be accomplished in time

' 'to prevent potential spurious opening of all eleven SRVs.

.

The team also identified other isues with Step 9.3.2.1. There was no emergency lighting inside the panels, seht if the fire caused a loss of normal lighting (e.g., by causing a loss of offsite power), operators would need to use flashlights to' perform the

-- .

actions inside the panels. Consequently, the team considered the emergency lighting for tep 9.3.2.1 to be inadequate (see section 1R05.07.b). In addition, labeling of the links inside the panels was so poor that operators stated that they would not fully 'rely on the labeling. Also, the tool that operators would use to loosen and slide the links inside the energized panels was made of steel and was not professionally electrically insulated. Further, licensee reliance on this operator action, instead of physically protecting the cables as required by 10 CFR 50, Appendix R, Section III.G.2, had not been approved by the NRC.

The licensee stated that cable damage to two' instrument cables, for reactor pressure signals, would be needed to spuriously open all eleven SRVs. Since the licensee stated that the two cables were in the same cable tray in fire area 2104, the Unit 2 east cableway, the team considered that a fire in that area could potentially cause all eleven SRVs to spuriously open (see section 1R21.01).

I10 In response to this potential issue, the licensee initiated r '

revised the Fire Procedure before the end of the inspecti .

of steomptl 9.3.2.1 to the beginning of the procedure. The procedure actionsto:

be accomplished much sooner during a fire in the Unit 2, 'her fire areas that were vulnerable to the potential for spuriously.

'Vs.

Analysis:

The team determined that this potential issue it - - -- bcircuits.

• As described in NRC Inspection Procedure (IP)71111.05, Fire Protectioin,'inspection of associated circuits is temporarily limited. Consequently, the team did not pursue the" cable routing or circuit analysis that would be necessary to evaluate the possibility, risk,

- or potential safety significance of Group)b and C&SRVs spuriously opening due to fire:

damage to the instrument cables. The team did, however, perform a circuit analysis of .

GroupXfASRVs for which the licensee takes credit for a fire in fire area 2104.: (see

• .

section 1R21.01).

Enforcement:

10 CFR 50, Appendix R.Section III.G.2 requires that where cables or.

equipment, including associated non-safety circuits that could prevent operation or*:.

cause mal-operation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are, located within the same fire area outside of the primary containment, one .of the

• following means of ensuring that one or the redundant trains is free of fire damage shall.,

be provided: 1) a fire barrier with a 3-hour rating; 2) separation of cables by a horizontal distance of more than 20 feet with no intervening combustibles and with fire detectors and automatic fire suppression; or 3) a fire barrier with a 1-hour rating with fire-detectors and automatic suppression.

-

The licensee had not provided physical protection against fire damage for the two instrument cables by one of the prescribed methods. Instead, the licensee had relied on manual operator actions to prevent the spurious opening of all eleven SRVs. Licensee:

• personnel contended that fire damage to two cables was outside of the Hatch licensing'.

basis and consequently that there was no. requirement to protect the instrument cables.

• However, the licensee could provide no evidence to support that position.

.

This potential issue will remain unresolved pending the NRC completion of a t .

determination. This potential issue is identified as URI 50-366/03-06-02, Untimely and Unapproved Manual Operator Action for Fire Safe Shutdown.

.

Local Manual Operator Action was Too Difficult and Unsafe

Introduction:

A finding of very low safety significance was identified in that a local -

manual operator action to operate SSD equipment was too difficult and was also unsafe.

The team judged that some operators would not be able to perform the action. This finding involved a violation of NRC requirements.

A-h *.Descrintion:The team observed thatiteps 4.15.8.1.1 and 9.3.5.1 of the Fire Procedure

.were relied on instead of providing physical protection for cables or providing a procedure for cold shutdown repairs. Both steps required the same local manual operator action: "Manually OPEN 2E1 1-FO15A, Inboard LPCI Injection Valve, as

.required." This action was to be taken in the Unit 2 drywell access, which'was a locked high radiation, contaminated, and hot area with temperatures over 100 degrees F.

Valve 2E1 1-F01 5A was a large (24-inch diameter) motor-operated gate valve with a three-foot diameter handwheel. Themain difficulty with manually opening this valve was

• lack of an adequate place to stand. An operator showed the team that to perform the action he would have to climb up to'and stand on a small section of pipe lagging (a curved area about four inches wide by 12 inches' long), and then reach back and to his right side, to hold the handwheel with his right hand, while reaching forward and to his right to hold the clutch lever for the motor operator with his left hand. He would not have good balance while performing the action. The foothold, which was large enough to support only one foot, was well flattened arid appeared to have been used in the past to manually operate this valve. The foothold was about six to seven feet above a steel grating, and the team observed that space available for potential use of a ladder to better access the 2E1 1-FO15A valve handwheel was not good.

Other difficulties with manually opening the valve included the heat; reque wearing of

full anti-contamination clothing, a hardhat, and safety glasses; and inadequate emergency lighting (see ~ection 1R05.07). Also, there was no note or step in the procedure to ensure that the RHR pumps were not running before attempting to

-manually open the 2E1 1-F015A valve. If an RHR pump were running, it could create a differential pressure across the valve which could make manually opening it much more

difficult. If the operator did not have sufficient agility fl strength or stamina, he would be

' - .:unable to complete the action. Also, the team judge6d that inability to remove sweat from

' .his'eyes, due to wearing gloves that could be contaminated, would be a limiting factor

'.

for the operator. In addition, if the operator slipped or lost his balance, he could fall and become injured. Considering all of the difficulties, the team judged that this action was unsafe and that some operators would not be able to perform it..

The licensee had no operator training job performance measure (JPM) for performing this action and could not demonstrate that all operators could perform the action. One

- .

experienced operator, who appeared to be in much better physical condition that an average nuclear plant operator, stated that he had manually operated the valve in the

'past, but that it had been very difficult for him.

The team judged that, since this action was not required to maintain hot shutdown and was required for cold shutdown following a fire in one of the four selected fire areas, licensee personnel could have time to improve the working conditions after a fire. They could have time to install scaffolding or temporary ventilation; improve the lighting; and assign multiple operators to manually open the valve. They could have time to perform a 'cold shutdown repair.' However, the licensee had not preplanned any cold shutdown repairs for opening this valve.

12.

Analvsis: This finding is greater than minor because it affected thev1W*nd reliability objectives and the equipment performance attribute o uitItingsystems cornerstone. Since the licensee could have time to develop nd1plement cold' shutdown repairs to facilitate accomplishrmnent of the action is finding did not~have. - --

potential safety significance greater than very low safety significanctj..

Enforcement:

10 CFR 50, Appendix R, Section III.G.1 requires that fire protection.

features shall be provided for systems important to safe shutdown and shall be capable.

of limiting fire damage so that systems necessary to achieve and maintain cold.

shutdown from either the control room or'emergency control stations can' be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In addition, TS 5.4.1 requires that written procedures hall e established, implemented, and maintained covering activities including ire rotection Frogram implementation and including the applicable procedures reco m ded in:..:

Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Regulatory Guide 1.33 recommends procedures for combating emergencies including plant fires and rocedure4 for operation and shutdown of safety-related BWR systems. The ire -

rotection program includes the SSAR which requires that valve' 2E1 1-F01 5 Ye::-

pened fo1SSD following a fire in WrefArea 2104, the Unit 2 east cableway. AOP 34AB--

X43-001-2, Fire Procedure, Version 10.8, dated May 28, 2003, implements these' requirements in that it provides information and actions necessary to mitigate the..

consequences of fires and to maintain an operable shutdown train following fire damage to specific fire areas. Also, AOP 34AB-X43-001-2 provides steps 4.15.8.1.1 and 9.3.5.1 for manually opening valve 2E11-FO15A following a fire in fire area 2104.

ntrary to the above, the licensee had no procedure for repairing any related fire ' -

d mage within 7,2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Instead, the licensee relied on local manual operator actions, a described in 7eps 4.15.8.1.1 and 9.3.5.1 of AOP 34AB-X43-001-2. However, those (nlA k co cedure steps were inadequate in that some operators would not be able to perform them because the required actions were too difficult and also were unsafe. In response to this issue, the licensee initiated CR 203008202. Because the identified inadequate operator actions are of very low safety significance and the issue has been entered into the licensee's corrective action program, this violation is being treated as an NCV, consistent with Section VL.AA1 of the NRC's Enforcement Policy: NCV 50-366/03-06-03, Local Manual Operator Action for Post-Fire Safe Shutdown Equipment '.'.'s Teo Diffic'ult and-lIsafeP 3. Unapproved Manual Operator Actions for Post-Fire Safe Shutdown

Introduction:

A finding of very low safety significance was identified in that the licensee relied on some manual operator actions to operate SSD equipment, instead of providing the required physical protection of cables from fire damage and witlhout NRC approval.

This finding involved a violation of NRC requirements.

Description:

The team observed that AOP 34AB-X43-001-2, Fire Procedure, included some local manual operator actions to achieve and maintain hot shutdown that had not been approved by the NRC. Examples included:

- -

St 4.15.2.2; ...if a loss of offsite power occurs and emergency busses energize.

A"ace Station Service battery chargers 2R42-S026 (2R42-S029), 2R42-S027 (2R42-S030) AND 2R42-S028 (2R42-S031) in service per 34SO-R42-001-2."

Step 4.15.4.5; ...IfHPCI fails to automatically trip on high RPV level... MOPEN the following links to energize 2E41-F124, Trip Solenoid Valve, AND to fail 2E41-F3025 HPCI Governor Valve, in the CLOSED position:

TT-75 in panel 2H11-P601' TTr 79 inl nOul -H1p{;AM Step 4.15.4.6; ...lf HPCI fails to automatically trip on high RPV level... "OPEN breaker 25 in panel 2R25-S002 to fail 2E41-F3052, HPCI Governor Valve, in the CLOSED position.": -c-PAu '

7///i/ 0.7.

The team walked down these actions and judged that they could reasonably be.

accomplished by operators in a timelyrmanner.

, the team determined that.-

these operator actions were being used instead of ysically protecting cables from fire damage that could cause a loss of station servic batterychargersora HPCl pump runaway.

Analysis:

The finding is greater than minor because it affected the availability and reliability objectives and the equipment performance attribute of the mitigating'systems cornerstone. Since the actions could reasonably be accomplished by operators in a timely manner, this finding did not have potential safety significance greater than' very low safety significance.

Enforcement:

10 CFR 50, Appendix R, Section III.G.2 requires that where cables or..

equipment, including associated non-safety circuits that could prevent operation cause maloperation due to hot shorts, open circuits, or shorts to ground ndant trains of systems necessary to achieve and maintain hot shutdown ditions are located within the same fire area outside of the primary conta nt, one of the following means of ensuring that one or the redundant tr& is free of fire damage shall be provided: 1) a fire barrier, with a 3-hour rating; 2) aration of cables by a-.

horizontal distance of more than 20 feet with no in ening combustibles and with fire detectors and automatic fire suppression; or 3) a'fire barrier with a 1-hour rating with fire detectors and automatic suppression.

/

Contrary to the above, the licensee had not provided the required physical protection against fire damage for power to the station service battery chargers or for HPCI electrical control cables. Instead, the licensee relied on local manual operator actions, without NRC approval. In response to this issue, the licensee initiated CR2003800166.

dated 7/2&2003. Because the issue had very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC's Enforcement Policy: NCV 50-366103-06-04, Unapproved Manual Operator Actions for Post-Fire Safe Shutdown.

d dow of :oi .s

• .06 Communications a.

Inspection ScoMe The team reviewed the plant communications systems that would be relied upon to support fire brigade and safe shutdown activities. The team walkedow prinso the safe shutdown procedures to Verify that adequate communications equipment would

• be available for personnel performing local manual operator actions.~In addition, the team reviewed the adequacy of the radio communication system used by the fire

• brigade to communicate with the main control room.

• b.

Findings

• No findings of significance were identified.

.07 Emermuenic Lighting

a. Inspection Scope

The team inspected the licensee's emergency lighting systems to verify that 8-hour' emergency lighting coverage was provided as required by 10 CFR 50, Appendix R, Section a II.J., to support local manual operator actions that were needed for post-fire' operation of SSD equipment. During walkdowns of the post-fire SSD operator actions for fires in the selected fire areas, the team checked if emergency lighting units were installed and if lamp heads were aimed to adequately illuminate the SSD equipment, 'the' equipment identification tags, and the access and egress routes thereto, so that operators would be able to perform the actions without needing to use flashlights.

b. Findings

Inadequate Emergency Lighting for Operation of Safe Shutdown Eguip~ment

Introduction:

A finding with very low safety significance was identified in that.emergency lighting was not adequate for some manual operator actions that were needed to support post-fire operation of SSD equipment. This finding involved a violation of NRC requirements.

Description:

The team observed that emergency lighting was not adequate for some manual operator actions that were needed to support post-fire operation of SSD equipment. Examples included the following operator actions in procedure 34AB-X43-001-2, Fire Procedure, Versiona10.8, dated May 28, 2003:

Step 4.15.2.2; ...if a loss of offsite power occurs and emergency busses energize t"Place Station Service battery chargers 2R42-Si26 (2R42-wn29), 2R42-S027 Io (2R42-ST30) AND 2R42-Se28 (2R42-ta31) in service per 34wd-R42-001-2.m

15.

Step 4.15.4.5; ...lf HPCI fails to automatically trip on high RPV level... "OPEN the.

following links to energize 2E41-F124, Trip Solenoid Valve, AND to fail 2E41-F3025 HPCI Governor Valve, in the CLOSED position:

TT-75 in panel 2H1-1-P601

.

TT-76 in panel 2H11I-P601" Step 4.15.5; "IF 2R25-S065, Instrument Bus 2B, is DE-ENERGIZED perform the following manual actions to maintain 2C32-R655, Reactor Water Level Instrument, operable:

4.15.5.1; At panel 2H1 1-P612, OPEN links AAA-11 and AAA-12.

4.15.5.2; At panel 2H11-P601, CLOSE links HH-48 and HH-49."

Steps 4.15.8.1.1 and 9.3.5.1; "Manually OPEN 2E11-FO15A, Inboard LPCI Injection Valve, as required."

Steps 4.15.8.1.2 and 9.3.5.2; "Manually CLOSE 2E11-FO18A, RHR Pump A Minimum Flow Isolation Valve, as required.

.

Step 9.3.2.1; "To prevent all 11 SRVs from opening simultaneously, open links BB-10 in Panel 2H11-P927 and BB-10 in Panel 2H11-P928."

Step 9.3.3; "At Panel 2H11-P627, open links AA-19, AA-20, AA-21, and AA-22, to prevent spurious actuation of SRVs 2B21-FO13D AND 2B21-FO13G."

Step 9.3.6; "OPEN link TB9-21 in Panel 2H11-P700 to open Drywell Pneumatic System Inboard Inlet Isolation, 2P70-F005."

Step 9.3.7; "OPEN link TBl-12 in Panel 2H1 1-P700 to open Drywell Pneumatic System Outboard Inlet Isolation, 2P70-F005."

Step 9.3.9.1; "Confirm OR manually CLOSE RHR Shutdown Cooling Valve 2E11 -FOO6D."

Step 9.3.9.2; "Manually OPN.Shutdown Cooling Suction Valve 2E11-F008, IF required..."' #2 The team verified that were readily available and judged that operators would be able to use the flashlights accomplish the actions, with two exceptions. One exception was the action to open terminal board links in two panels to prevent all eleven SRVs from spuriously opening, which was judged to be untimely (see section

1R05 .05.b.1). The other exception was the action to open 2E11-FO15A, which was

judged to be too difficult (see section 1R05.05.b.2). For all of these actions, the lack of adequate emergency lighting could make the actions more difficult to complete in a timely manner and increase the chance of operator error.

Analysis:

' This finding is greater than minor because it 'affected the reliab ty o ective

and the equipment performance attribute of the mitigating systems comers o . Since operators would be able to accomplish the actions with the use of flashlight his finding did not have potential safety significance greater than very low safety significance.,Lj t  :

"

Enforcement:

10 CFR 50, Appendix R, Section III.J. requires thateemergency lighting units with at least an 8-hour battery power supply shall be provided in all areas needed for operation of.safe shutdown equipment and in access and egress routes thereto.

Contrary to the above, emergency lighting units were not adequately provided in all areas needed for operation of safe shutdown equipment. In response this issue, the licensee initiated CRs 2003008237 and 2003008179. Because the identified lack of

emergency lighting is of very low safety significance and has been entered into the licensee's corrective action program, this violation is being treated as an NCV, consistent with Section Vl.A.1 of the NRC's Enforcement Policy: NCV 50-366/03-06-05, Inadequate Emergency Lighting for Operation of Safe Shutdown Equipment.

.08 Cold Shutdown Repairs

-The licensee had identified no needed cold shutdown repairs. Also, with the exception of the potential need for a cold shutdown repair to open valve 2E1 1-F15A (see section I R05.05.b.2), the team identified no other need for cold shutdown repairs.

Consequently, this section of IP 71111.05 was not performed..

.09 Fire Barriers and Fire Area/Zone/Room Penetration Seals

a. Inspection Scope

CfThe team reviewed the selected fire areas to evaluate the adequacy of the fire resistance of fire area barrier enclosure walls, ceilings, floors, fire barrier mechanical and electrical penetration seals, fire doors, and fire dampers. The team selected several fire barrier features for detailed evaluation and inspection to verify proper installation and qualification. This was' accomplished by observing the material condition and configuration of the installed fire barrier features, as well as construction details and supporting fire endurance tests for the installed fire barrier features, to verify the as-built configurations were qualified by appropriate fire endurance tests. The team also reviewed the FHA to verify the fire loading used by the licensee to determine the fire resistance rating of the fire barrier enclosures. The team also reviewed the installation instructions for sliding fire doors, the design details for mechanical and electrical penetrations, the penetration seal database, Generic Letter (GL) 86-10 evaluations, and the fire protection penetration seal deviation analysis for the technical basis of fire barrier penetration seals to verify that the fire barrier installations met design requirements and license commitments. In addition, the team reviewed completed surveillance and maintenance procedures for selected fire barrier features to verify the fire barriers were being adequately maintained.

• *:

'

The team evaluated the adequacy of the fire resistance of fire barrier electrical raceway' fire barrier system (ERFBS) enclosures for cable protection to satisfy the applicable separation and design requirements of 10 CFR 50, Appendix R, Section III.G.2.

Specifically, the team examined the design drawings, construction details, installatipnj ffecords, and supporting fire endurance tests for the ERFBS enclosures installed inire Lea 2104, the Unit 2 East Cableway. Visual inspections of the enclosures were iformed to confirm that the ERFBS installations were consistent with the design drawings and tested configurations.

The team reviewed abnormal operating fire procedures, selected fire fighting pre-plans, fire damper location and detail drawings,' and heating ventilation and air conditioning (HVAC) system drawings to verify that access to shutdown equipment and selected operator manual actions would not be inhibited by smoke migration from one area to adjacent plant areas used to accomplish SSD.

'b.

Findings

- No findings of significance were identified.

'- Fire Protection Systems. Features, and Eguigment

a. Inspection Scope

The team reviewed flow diagrams, cable routing information, and operational valve lineup procedures associated with the fire pumps and fire protection water supply system. The review evaluated whether the common fire protection water delivery and supply components could be damaged or inhibited by fire-induced failures of electrical power supplies or control circuits. Using operating and test procedures, the team toured the fire pump house and diesel driven fire pump fuel storage tanks to observe the system material condition, consistency of as-built configurations with engineering drawings, and determine correct system controls and valve lineups. Additionally, the team reviewed periodic test procedures for the fire pumps to assess whether the surveillance test program was sufficient to verify proper operation of the fire protection water supply system in accordance with the program operating requirements specified in Appendix B of the FHA.

The team reviewed the adequacy of the fire detection systems in the selected plant fire areas in accordance with the design requirements in Appendix R, III.G.1 and III.G. 2.

The team walked down accessible portions of the fire detection systems in the selected fire areas to evaluate the engineering design and operation of the installed configurations. The team also reviewed engineering drawings for fire detector types, spacing, locations and the licensee's technical evaluation of the detector locations for the detection systems for consistency with the licensee's FHA, engineering evaluations for NFPA code deviations, and NFPA 72E. In addition, the team reviewed surveillance

.18 procedures and the detection system operating requirements specified in Appendix B of

the FHA to determine the adequacy of fire detection component testing and to ensure that the detection systems could function when needed.

The team performed in-plant walk-downs of the Unit 2 East Cableway automatic wet pipe sprinkler suppression system to verify the proper type, placement and spacing of ' - -

the sprinkler heads as well as the lack of obstructions for effective functioning. The ' .

team examined vendor information, engineering evaluations for NFPA code deviations,'

and design calculations to verify that the required suppression system water density for' the protected area was available. Additionally, the team reviewed the physical.

configuration of electrical raceways and safe shutdown components in the fire area to' determine whether water from a pipe rupture, actuation of the automatic suppression '

system, or manual fire suppression activities in this area could cause damage'that could inhibit the plant's ability to safely shutdown.

The team reviewed the adequacy of the design and installation of the manual C02 hose rW eppression system for the diesel generator building switchgear rooms 2E and 2F

• (re'eas 2404 and 2408). The team performed in-plant walk-downs of the diesel generator building C02 fire suppression system to determine correct system controls and valve lineups to assure accessibility and functionality of the system, as well as associated ventilation system fire dampers. The team also reviewed the licensee's actions to address the potential for C02 migration to ensure that fire suppression and.

post-fire safe shutdown actions would not be impacted. This was accomplished by the review of engineering drawings, schematics, flow diagrams, and evaluations associated with the diesel generator building floor drain system to determine whether systems and operator actions required for SSD would be inhibited by C02 migration through the floor drain system.

b. Findings

No findings of significance were identified.

.11 Comrrensatory Measures

a. Inspection Scope

The team reviewed Appendix B of the FHA and applicable sections of the fire protection program administrative procedure regarding administrative controls to identify the need for and to implement compensatory measures for out-of-service, degraded, or inoperable fire protection or post-fire safe shutdown equipment, features, and systems.

The team reviewed licensee reports'for the fire protection status of Unit 1, Unit 2 and of shared structures, systems, and components. The review was performed to verify that the risk associated with removing fire protection and/or post-fire systems or components, was properly assessed and implemented in accordance with the approved fire protection program. The team also reviewed Corrective Action Program Condition Reports generated over the last 18 months for fire protection features that were out of service for long periods of time. The review was conducted to assess the licensee's effectiveness in returning equipment to service in a reasonable period of time.

b. Findings

No findings of significance were identified.

1R21 SAFETY SYSTEM DESIGN AND PERFORMANCE CAPABILITY

01.

DCR 91-1 34. SRV Backup, Actuation via Pressure Transmitter Signals a Inspection Scope

.; . :;- .

' ' De;.

The team performed an independent design review of plant modification DCR 91-1 34 rais ringin

 ::':' "- order

- to forhlngc ervice evaluatepriods the technical adequacy ofwas of time.RThrevie the i design opdemchange package toe tedin resposesin andcncerns its associated

'.~ ~ '.- ~~rase .efcieneral in G 10 CFR 50.59 evaluation. The scope of the review Electurnicg Requpornt tEo-erviceinuatieaonal and circuit analysis ofSVperforftmane.drn

• performed by the team was limited to the group "A"SRVs for which the licensee takes credit in mitigating a fire in the fire areas selected for the inspection.

Introduction -t Fet"i

• An inadequate plant modification and 10 C-FR 60.69- cvaluatiop. completed for CR91 -

134 failed to implement the design input requirements of one-out-of-two taken twice logic for the SRVs backup actuation vie, pressure transmitter signals.

January-February 1991 Turbine Trip Events iant for Hatch Units and 2. In order to ensure that individual SRV(s) will actuate at o ear the appropriate set point and within allowable limits, a backup mode of operation(vas implemented by this DCR. The design was intended to mitigate the effects of corrosion-induced set point drift of the Target Rock SRVs; Automatically controlled two stage SRVs are insta d on the main steam lines inside containment for the purpose of relieving nuclear oiler pressure either by normal mechanical action or by automatic action of an lectro-pneumatic control system. Each SRV can be manually controlled by use of a two^pition switch located in the main control room. When placed in the "Open" pos5 i 5ntlje switch energizes the pilot valve of the individual SRV and causes it to go open. Wr*the switch is placed in the "Auto" position the SRV is opened upon receipt of either an Auto Depressurization System (ADS), or Low-Low Set (LLS) control logic signal. Either signal will initiate opening of the valve. DCR 91-134 provided a backup mode for initiation of electrical trip of the pilot

-4 valve s lenoid, which nendent of ADS or LLS logic. The backup mode required no o~6rator action to initiate ening of the SRVs and was considered a "blind control loo to the operators se there are no instruments that provided the operators information concerni he open/close status of the SRVs.

The scope of e plant moW ation ifivolved the installation of four Rosemount pressure,.

transmitters (Model No 154GP9R)),O0-3009 psig, in the 2H21-P404 and P405 instrument racks at.158 of the @eactorybuilding. Each pressure transmitter formed part of a 4-20 ma current loop and provided the analog trip signal for SRV actuation within the following set point groups.

SRV GrouD SRV Identification Tags SRV Set Point A 2B21-FO13B, D, F, and G 1120 psig B 2B21-FO13A, C, K, and M .

1130 psigX C 2B21-F013E, H, and D 1140 psig Pressure transmitters 2B21-N127A and 2B21-N127C were wired ATT-2H1-1-P927. Pressure transmitter 2B21-N127A instrume I o compone S*i.

of a trip unit master relay K308C and trip unit slave relay KK 1C and loop components for pressure transmitter 2B21-N127C coted of a tri T A

relay K335C in addition to trip unit slave relays K336C and K363C.- Thes' -

instrument loops constituted a "Division' pressure monitoring channels ar intended to provide the one-out of two logic signal from this Division for In -Z-backup actuation. The design owjective of having two instrument channel.,

compliance with HNP-2-FSAR,>ction 15.1.6.1, Application of Single Fai This criteria requires for anticipated operational occurrences (AQOs) that sequences within mitigation systems be single component failure proof. A utinurU OT one instrument channel in a division will therefore not eliminate the protection provided by either of the instrument cha els.

-

Additionally, pressure ransmitters 2B21-N127B and 2B21-N127D were.'

cabinet 2H11-P928. Pressuretransmitter 2B21-N1 27B instrument loo; Jew ot consisted of a trip unit master relay K31OD and trip unit slave relays KK P -7 K332D. The loop components for pressure transmitter 2B21-N127D co unit master relay K335D in addition to trip unit slave relays K336D and I two instrument loops constituted a separate 'Division' pressure monitor x/

were intended to provide the one-out of two logic signal from this Divisicl SRV backup actuation. The design objective of having two instrument assure compliance with HNP-FSAR, section 15.1.6.1, as described abc The Group 'A' SRVs were provided logic input signals from the trip unit master relays.

The Group "B and C" SRVs were provided logic input signals from the trip unit slave

v* V V/ T.

IM2.

-7,-, /.&

T-I J-2 1

• I-. IOC C kK32A2 K332(

K33 C-.

.k33C K35C'

.

r .

• /

,532z ty/,/ -7 e ge 3/0oD Vt z-7P .. 53-7bD5

. . I -

ump"',

Fw- --,

-/II 2-d

..

A-.

-

PZ-X7O-  :

lwa // /

475

-lead I - - -

1114u-I e. - -

al (7<L e7

0~ -lt -4 /0 Coincident logic input is required from both Division instrument loops in order to initiate a SRV backup actuation via the pressure transmitter signals.,

_Anlysis: Th Isee in A es cre m cs or in order to eve nd ainta nsafsh tdo~W'n co Group-SRVs are r d a fire in fire ar select for re w.

The team performed a circuit analysis of SRV 2B21 -FO1 3F ( Path 1) and SRV 2B21-F013G (Path 2) in order to verify that the design objectives of implementing a one-out-'.

of-two taken twice logic had been achieved. Based on this review the team determined that the design objective of implementing a one-out-of-two taken twice logic had not A-i been installed for the SRVs. The logic installed for the SRVs was a two-out-of-two ,/p coincident taken twice logic in addition to a one-out-of-two coincident taken twice logic.'

I The logic implementel-'esult in spurious actuation of group SAISRVs for a fire in fire area 2104 and defeats the cbpability to manually control these SRVs as is required per Enforcement 10 CFR 50, Appendix B, Criterion Ill, requires that design control measures shall provide for verifying or checking the adequacy of design. Additiena.1y,

/ 10 CFR 50.50 pe she licenseet ake hang

.4 myortant to safety with a different resultanany-prvioucly

alated in the FSAR-.7 logic implemented by the licensee for DCR 91-134 was different from the specified

% > .design input requirements. The plant installation failed to correctly implement the one-

-L _ /1/out-of-two taken twice logic that was specified for the SRV backup actuation via pressure transmitter signals design change package. This failure has created a condition where fire induced failures of two instrument circuit cables, (within close proximity to each other), could result in spurious actuation of all eleven SRVs with the eleven SRVs assuming a stuck open mode of operation, based on the logic input from trip master unit relays K31 OD, and K335D and their associated trip unit slave relays.

Tho 10 CFR 50.59 Evalution performed inr the pi1nt md tinn failed to Identify,thi falr

~e diinly, the 10 50.59 Evaluatio wavrs-ir SRI iar it did 1h~uL~I not Provide an technical basis that an Unreviewed safety estgonte l (USQ) lIdd not been created by implementation of the plant modification Pending- -

Of by the NRC, this item is identified as URI 50-366/03-06-06, Implementation of DCR 91-0i 134 Results in Spurious Actuation of Eleven SRVs because of Fire Induced Faults.

This inspectio ding may b otentially G c ue" by havn lications for other/icen es who havej pleme ted a p1 modificat on si to DCR 1-9 BW aa k1ontainment ain

OTHER ACTIVITIES

40A2 Identification and Resolution of Problems

a. Inspection Scope

-

40A2 Identification and Resolution of Problems

a. Inspection Scope

The team reviewed a sample of licensee audits, self-assessments, and condition reports (CRs) to verify that items related to fire prot ection and to SSD were appropriately entered into the licensee's CAP in accordanice with the Hatch quality assurance program:

and procedural requirements. The items selected were reviewed for classification and appoprateessof the corrective actions talken or initiated to resolve the issues. In

• addition, the team reviewed the licensees~ aapplicability evaluations and corrective

• actions for selected industry experience issi jes related to fire protection. The operating experience (QE) reports were reviewed to verify that the licensee's review and actions were appropriate.

The team reviewed licensee audits and self. -assessments of fire protection and safe shutdown to assess the types of findings thzat were generated and to verify that the findings were appropriately entered into the licensee's corrective action program.

b..

Findings 1:. -

No findings of significance were identified.

. .I . I DA6 Meetings. Including Exit

. . .

The team presented the inspection results to Mr. R. Dedrickson, Assistant General Manager, and other members of your staff at the conclusion of the inspection on July 25, 2003 The licensee acknowledged the findings presented. Proprietary information Is

• not included in the inspection report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

M. Beard Acting Engineering Support Supervisor.

V. Coleman Quality Assurance Supervisor

M. Dean Nuclear Specialist, Fire Protection

B. Duval Chemistry Superintendent

R. Dedrickson Assistant General Manager for Plant hatch

M. Googe. Maintenance Manager

J. Hammonds Operations Manager

D.Javorka Administrative Assistant, Senior

R.King: Acting Engineering Support Manager

I.Luker; Senior Engineer, Licensing

T.Metzer Acting Nuclear safety arid Compliance Manager

A.Owens Senior Engineer, Fire Protection

J.Payne Senior Engineer, Corrective Action Program

D.Parker Senior Engineer, Electrical

-J. Rathodl Bechtel Engineering Group Supervisor

K.Rosanski. Oglethorpe Power Corporation Resident Manager

.- M. Raybon Summer Intern

J.Vance Senior Engineer, Mechanical & Civil

R. Varnadore Outages and Modifications Manager

NRC personnel

-

N. Garret,

Senior Resident Inspector

C. Payne Fire Protection Team Leader

1IST OF ITEMS OPENED,CLOSED, ND DISCUSSED

Opened

50-366/03-06-01, URI Capability of Equipment Credited in the SSAR to(iligate the"

Spurious Actuation of Eleven SRVs. (Section 1 Ra)3.b)

50-366/03-06-02 URI Untimely and Unapproved Manual Operator Action for Post-Fire

Safe Shutdown (Section 1R05.05.b.1)

50-366/03-06-06, URI Implementation of DCR 91-134 Results in Spurious Actuation of

Eleven.SRVs because of Fire Induced Faults (Section.1 R21.01.b)

Opened and Closed

50-366/03-06-03 NCV Local Manual Operator Action for Post-Fire Safe Shutdown

Equipment was Too Difficult and Unsafe (Section 1R05.05.b.2)

50-366/03-06-04 NCV Unapproved Manual Operator.Actions for Post-Fire"Safe

Shutdown (Section 1R05.05.b.3) .

50-366/03-06-05 NCV Inadequate Emergency Lighting for Operation of Post-Fire Safe

Shutdown Equipment' (Section 1R05.07.b) -

Discussed

'None