IR 05000397/2015008

IR 05000397/2015008; 07/28/2015 - 10/01/2015; Columbia Generating Station; Triennial Fire Protection Team Inspection

ML15307A231
Person / Time
Site:	Columbia
Issue date:	11/03/2015
From:	Greg Werner NRC/RGN-IV/DRS/EB-2
To:	Reddemann M Energy Northwest
References
IR 2015008
Download: ML15307A231 (35)

Text

ber 3, 2015

SUBJECT:

COLUMBIA GENERATING STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT (05000397/2015008)

Dear Mr. Reddemann:

On October 1, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Columbia Generating Station and discussed the results of this inspection with Mr. A. Javorik, Vice President Engineering, and other members of your staff. The inspection team documented the results of this inspection in the enclosed inspection report.

A team of NRC inspectors documented three findings of very low safety significance (Green) in this report. These findings involved violations of NRC requirements including one licensee-identified violation. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of the violations in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Columbia Generating Station.

If you disagree with a crosscutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-397 License No. NPF-21

Enclosure:

Inspection Report 05000397/2015008 w/Attachment: Supplemental Information

REGION IV==

Docket: 05000397 License: NPF-21 Report Nos.: 05000397/2015008 Licensee: Energy Northwest Facility: Columbia Generating Station Location: North Power Plant Loop Richland, WA 99354 Dates: July 28 through October 1, 2015 Team Leader: S. Makor, Reactor Inspector Inspectors: J. Mateychick, Senior Reactor Inspector E. Uribe, Reactor Inspector A. Sanchez, Senior Resident Inspector Accompanying D. Andrukat, Fire Protection Engineer Personnel:

Approved By: Gregory E. Werner Chief, Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY

IR 05000397/2015008; 07/28/2015 - 10/01/2015; Columbia Generating Station; Triennial Fire

Protection Team Inspection.

This report covered a two-week triennial fire protection team inspection by three specialist inspectors from Region IV, one fire protection engineer, and a senior resident inspector. Two findings, which were non-cited violations, were documented. Additionally, the team documented one licensee-identified violation of very low safety significance. The significance of inspection findings is indicated by their color (i.e., Green, White, Yellow, or Red) and determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015.

Cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 14, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of License Condition 2.C.14, Fire Protection Program (Generic Letter 86-10), for the failure to establish procedural guidance for validating the underground fire main condition to ensure the required fire suppression system demands were met. Specifically, the licensee failed to provide acceptance criteria in Plant Procedure Manual 15.4.2, Fire Main Hydraulic Data Acquisition, to validate that the fire water supply at the base of the largest demanding fire suppression system was adequate given the current condition of the fire main. From review of design information, the team verified the licensee met their fire protection system design flow and pressure requirements, determined that other pumps would be available, and determined this finding did not affect the ability to achieve safe shutdown.

The licensee entered this deficiency in their corrective action program as Action Request AR-00335821.

The failure to provide adequate acceptance criteria to validate the condition of the water supply was a performance deficiency. Specifically, the licensee failed to provide adequate acceptance in the Plant Procedure Manual 15.4.2 for Surveillance Requirement 1.10.1.14 to ensure that the current fire water supply can meet the largest demanding fire suppression system. The performance deficiency was more than minor because it was associated with the protection of external events attribute (fire) of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected the firewater supply category. Using Appendix F, Attachment 1, Fire Protection Significance Determination Process Phase 1 Worksheet, Task 1.4.7, Fire Water Supply, the team assigned a very low safety significance (Green) to the finding because of the availability of at least 50 percent of the required firewater capacity. The team confirmed this after verifying the water supply exceeded the minimum in the water supply calculations, the availability of additional fire pumps beyond that required for the minimum water supply and the condition did not affect the ability to achieve safe shutdown. The finding did not have a cross-cutting aspect since the performance deficiency was more than three years old and not indicative of current performance. (Section 1R05.03)

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of Technical Specification 5.4,

Procedures, for the failure to provide adequate procedures to implement the fire protection program. Specifically, the alternative shutdown procedure failed to assure operator actions for post-fire safe shutdown would be performed within the required times following a control room evacuation due to fire. The licensee entered this issue into their corrective action program as Action Request AR-00335854 and issued Night Order Number 1668 providing direction to the operators as a compensatory measure until they completed additional corrective actions.

The failure to provide an adequate procedure to assure operators performed post-fire safe shutdown actions within the required time following a control room evacuation due to fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013. Since operators would take more than the 10 minutes specified in their procedure to initiate reactor depressurization, the team could not determine that the operators had maintained the ability to reach and maintain safe shutdown conditions. The dominant core damage sequences involved (1) a fire in the control room that required a control room evacuation and (2) the failure of operators to initiate emergency depressurization. Therefore, a Region IV senior reactor analyst performed a bounding detailed risk evaluation. The analyst noted that additional time was available in a probabilistic risk assessment calculation. The additional time available in a probabilistic risk assessment calculation helped to minimize the risk.

Based on this information, the finding screened to Green because the licensee could achieve safe shutdown.

The finding did not have a crosscutting aspect since the performance deficiency was more than three years old and not indicative of current performance. (Section 1R05.05)

Licensee-Identified Violations

A violation of very low safety significance that was identified by the licensee has been reviewed by the team. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. This violation and the corrective action tracking number are listed in Section 4OA7 of this report.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at Columbia Generating Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas and one or more mitigating strategies for review. The inspection team used the fire hazards analysis section of the Columbia Generating Station individual plant examination of external events to select the following five risk-significant fire areas (inspection samples)for review:

Fire Area Description R-1J Reactor Building 522 Elevation RC-08 Switchgear Room 2 RC-13 Emergency Chiller RC-5 Battery Room 1 RC-1A Radwaste Building 437N The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(14), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1, Guidelines for Fire Protection for Nuclear Power Plants. The team also reviewed related documents that included the final safety analysis report, Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis. Specific documents reviewed by the team are listed in the attachment.

Five fire area inspection samples and two mitigating strategy samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walk downs of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met applicable license commitments.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verified that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walk down of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walk down of major system support equipment in other areas (e.g., fire pumps and water supply systems) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements. The team also reviewed the water supply surveillance requirements to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for firefighting.

The team observed an unannounced fire drill and subsequent drill critique on September 1, 2015, using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly. The team observed fire brigade members fight a simulated fire in the radioactive waste building, located in the radiological controlled area. The team verified that the licensee identified problems; openly discussed them in a self-critical manner at the drill debrief; and identified appropriate corrective actions.

Specific attributes evaluated were

(1) proper wearing of turnout gear and self-contained breathing apparatus,

(2) proper use and layout of fire hoses,

(3) employment of appropriate fire-fighting techniques,

(4) sufficient fire-fighting equipment was brought to the scene,

(5) effectiveness of fire brigade leader communications, command, and control,

(6) utilization of pre-planned strategies,

(7) adherence to the pre-planned drill scenario, and

(8) drill objectives.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.14, Fire Protection Program (Generic Letter 86-10), for the failure to establish procedural guidance for validating the underground fire main condition to ensure the required fire suppression system demands were met. Specifically, the licensee failed to provide acceptance criteria in Plant Procedure Manual 15.2.4, Fire Main Hydraulic Data Acquisition, to validate that the fire water supply at the base of the largest demanding fire suppression system was adequate given the current condition of the fire main. From review of design information, the team verified the licensee met their fire protection system design flow and pressure requirements, determined that other pumps would be available, and determined this finding did not affect the ability to achieve safe shutdown. The licensee entered this deficiency in their corrective action program as Action Request AR-00335821.

Description.

In the event of a fire, the water supply must be adequate to meet the design requirements of the fire suppression systems per the guidance in the National Fire Protection Association codes the licensee committed to ensure prompt extinguishment and that fire damage would not prevent operation of equipment needed to achieve and maintain safe shutdown conditions. Under Licensee Controlled Specification 1.10, Fire Protection, Surveillance Requirement 1.10.1.14 requires that Columbia Generating Station perform a flow test to validate the condition of yard piping (i.e., water supply, fire main). The licensees Plant Procedure Manual 15.4.2, Fire Main Hydraulic Data Acquisition, describes a hydraulic flow analysis of the underground fire main developed to satisfy Surveillance Requirement 1.10.1.14.

The team reviewed Plant Procedure Manual 15.4.2 that detailed how to position various valves of the underground main in such a way as to get one directional flow from the FP-P-2A fire pump in the circulating water pump house, around the complete fire main loop and back to the circulating water pump house. Specifically, with the pump running the licensee takes residual pressure readings from specific hydrants and at the base of sprinkler system number 13 (all locations temporarily equipped with a pressure gage).

The procedure established a test criterion to identify whether significant deterioration of the underground fire main loop had occurred. The procedure considered the piping had no significant degradation if the current residual pressure reading to be within 90 percent of its previous reading. However, the check only compares to the previous test and not the original readings when the licensee installed the system. In addition, there was no acceptance criteria that indicates a minimum water supply requirement at the base (or point of calculation) of each fire suppression system, especially at the most demanding fire suppression scenario identified in Final Safety Analysis Report, Section F.2.4.1, the cable spreading room.

The team determined the lack of establishing minimum required flow criteria combined with the failure to compare to the original test values could result in the licensee not identifying that the water supply failed to meet design flows and remain functional. For example, a cumulative effect could occur where the fire main loop may pass each test, but over several test periods, the water supply could drop below the actual criteria required for the fire suppression systems to meet minimum flow and pressure. The team confirmed that the licensee performed no other tests to verify flow and pressure. From review of design information, the team verified the licensee met their fire protection system design flow and pressure requirements, determined that other pumps would be available, and determined this finding did not affect the ability to achieve safe shutdown.

The licensee entered this deficiency in their corrective action program as Action Request AR-00335821.

Analysis.

The failure to provide an adequate acceptance criteria to validate the condition of the water supply was a performance deficiency. Specifically, the licensee failed to provide adequate acceptance in the Plant Procedure Manual 15.4.2 for Surveillance Requirement 1.10.1.14 to ensure that the current fire water supply can meet the largest demanding fire suppression system. The performance deficiency was more than minor because it was associated with the protection of external events attribute (fire) of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected the firewater supply category. Using Appendix F, Attachment 1, Fire Protection Significance Determination Process Phase 1 Worksheet, Task 1.4.7, Fire Water Supply, the team assigned a very low safety significance (Green) to the finding because of the availability of at least 50 percent of the required firewater capacity. The team confirmed this after verifying the water supply exceeded the minimum in the water supply calculations, the availability of additional fire pumps beyond that required for the minimum water supply and the condition did not affect the ability to achieve safe shutdown. The finding did not have a cross-cutting aspect since the performance deficiency was more than three years old and not indicative of current performance.

Enforcement.

Fire Protection License Condition 2.C(14), Fire Protection Program (Generic Letter 86-10), specifies that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in Section 9.5.1 and Appendix F of the Final Safety Analysis Report. The Final Safety Analysis Report, Appendix F.5, Essential Fire Protection System Operability/Testing Program, states, in part, that the operability requirements, compensatory actions, and testing requirements for the essential fire protection systems are located in Licensee Controlled Specification 1.10, Fire Protection. Licensee Controlled Specification 1.10, Surveillance Requirement 1.10.1.14, requires that they perform a flow test to validate the condition of yard piping.

Contrary to the above, prior to October 1, 2015, the licensee failed to perform adequate flow tests to validate condition of the yard piping. Specifically, the licensee failed to ensure the procedures for conducting the required flow tests have the necessary acceptance criteria to validate the condition of the yard main and to ensure the adequate supply of water to the fire suppression systems. This finding is of very low safety significance. From review of design information, the team verified the licensee met their fire protection system design flow and pressure requirements, determined that other pumps would be available, and determined this finding did not affect the ability to achieve safe shutdown. The licensee entered this deficiency in their corrective action program as Action Request AR-00335821. Consequently, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000397/2015008-01, Failure to Ensure Adequate Acceptance Criteria in Fire Main Surveillance Testing.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed plant walk downs and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train).

• Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the final safety analysis report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walk downs to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown were trained and available on-site at all times, exclusive of those assigned as fire brigade members.

The team performed a timed walk down of the alternative shutdown Procedure ABN-CR-EVAC, Control Room Evacuation and Remote Cooldown, Revision 33, with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified if the operators could reasonably be expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

Introduction.

The team identified a Green non-cited violation of Technical Specification 5.4, Procedures, for the failure to provide adequate procedures to implement the fire protection program. Specifically, the alternative shutdown procedure failed to assure operator actions for post-fire safe shutdown would be performed within the required times following a control room evacuation due to fire. The licensee entered this issue into their corrective action program as Action Request AR-00335854 and issued Night Order Number 1668 providing direction to the operators as a compensatory measure until they completed additional corrective actions.

Description.

On August 19, 2015, the team performed a timed walk down of the alternative shutdown Procedure ABN-CR-EVAC, Control Room Evacuation and Remote Cooldown, Major Revision 033, Minor Revision 001, with licensed and non-licensed operators to determine the adequacy of the procedure. The teams evaluation of the data from the timed walk downs of Procedure ABN-CR-EVAC indicated that the operators would not align the plant systems to allow the emergency depressurization to begin within the required 10 minutes. The team determined, based on the timed walk down, that emergency depressurization could begin approximately 14.4 minutes after the reactor scram.

Furthermore, the approved fire protection program as defined by License Condition 2.C.(14), Fire Protection Program (Generic Letter 86-10), states, in part, The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in Section 9.5.1 and Appendix F of the Final Safety Analysis Report (FSAR) for the facility thru Amendment #39. . .and as approved in the Safety Evaluation Report issued in March 1982 (NUREG 0892) and in safety evaluations issued with letters dated November 11, 1987. This included the ability to safely shutdown the plant for the scenario where a control room requires evacuation due to a fire and the licensee would perform the shutdown outside of the control room using Procedure ABN-CR-EVAC.

Additionally, the licensee submitted Final Safety Analysis Report, Amendment 37, by letter GO2-86-917, dated September 22, 1986, where Section F.4.4.1.5 describes the design requirements of the alternative/dedicated safe shutdown system provided in accordance with 10 CFR Part 50, Appendix R, Section III.L. The licensee stated, in part, This assumes, of course, that the criteria of Generic Letter 86-10 Sections 5.3.l0a and 5.3.10b apply, i.e., only one worst case spurious actuation need be considered at any one time.

The licensee identified a single opened safety relief valve as the worst case spurious actuation. The scenario was analyzed in General Electric Hitachi Nuclear Energy analysis GEH-0000-0075-4920-R5, GE14 Fuel Design Cycle-Independent Analyses for Energy Northwest Columbia Generating Station, Revision 5, dated March 2015, in Section 9.1, Appendix R Evaluation. The analysis assumes reactor vessel depressurization will begin 10 minutes after the reactor scram and concluded that there would be no core heat-up, and the peak clad temperature would remain at the initial steady state fuel temperature. This analysis was one of the inputs forming the bases of Procedure ABN-CR-EVAC, and in establishing the 10-minute requirement to begin emergency depressurization.

As a result, the team found the performance of the timed walk down to not meet the licensees analyzed requirements and commitments.

Analysis.

The failure to provide an adequate procedure to assure operators performed post-fire safe shutdown actions within the required time following a control room evacuation due to fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013.

Since operators would take more than the 10 minutes specified in their procedure to initiate reactor depressurization, the team could not determine that the operators had maintained the ability to reach and maintain safe shutdown conditions. Therefore, a senior reactor analyst performed a detailed risk evaluation.

The analyst noted differences between design calculations and probabilistic risk assessment calculations. Design calculations typically employ very conservative methods that include design margins to account for uncertainties. These calculations help to ensure that offsite releases will be less than the limits contained in 10 CFR Part 100, Reactor Site Criteria. Probabilistic risk assessment calculations, however, determine the risk for severe core damage within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of an initiating event, a less demanding outcome. Licensees are required to meet limits specified by design basis calculations, but a findings significance is determined using probabilistic risk assessment methods.

The analyst referenced Document FPSA-1-RE-001, Columbia Generating Station Fire Probabilistic Safety Assessment, Quantification, and Results, Revision 2, E, Control Room

Analysis.

This document provided a more realistic estimate of available time to perform the operator action. The analyst identified a similar scenario in the probabilistic risk assessment document. With respect to the plant response, the design basis scenario and the probabilistic risk assessment scenario were the same. The probabilistic risk assessment scenario included a station blackout with a spuriously open safety relief valve. The General Electric Company report included a plant trip, main steam isolation valve closure, a spuriously opened safety relief valve, and no credit for injection except for the low pressure safety injection pump at the remote shutdown panel. Further, this injection source was not available until the operator took the manual actions to depressurize the reactor. Therefore, the time to core damage for both scenarios should be the same.

Document FPSA-1-RE-001 specified, in part:

For the spuriously opened safety relief valve in a station blackout - no injection scenario - there was about 24 minutes to top of active fuel, with core damage about 30 minutes later.

The total time available before core damage was about 54 minutes. During the timed walk down activities, operators could initiate depressurization of the reactor coolant system within 15 minutes of the plant trip and main steam isolation valve closure. The dominant core damage sequences involved

(1) a fire in the control room that required a control room evacuation and

(2) the failure of operators to initiate emergency depressurization. The additional time available in a probabilistic risk assessment calculation helped to minimize the risk. Considering the new information from the probabilistic risk assessment calculation, the senior reactor analyst revisited Inspection Manual Chapter 0609, Appendix F. Task 1.3.1 instructed the team to screen the finding to Green if operators could reach and maintain safe shutdown. Based on the probabilistic risk assessment calculation, the answer was affirmative. This finding was of very low safety significance (Green).

The finding did not have a crosscutting aspect since the performance deficiency was more than three years old and not indicative of current performance.

Enforcement.

Technical Specification 5.4 requires, in part, that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure ABN-CR-EVAC is a procedure required to implement the fire protection program. Procedure ABN-CR-EVAC, Step 7.2, in part, states, that the worst case spurious actuation postulated for CGS is a spuriously opened relief valve that requires emergency depressurization in 10 minutes (refer to GEH-0000-0075-4920-R0 analysis).

Contrary to the above, prior to October 1, 2015, the licensee failed to maintain adequate written procedures covering the fire protection program. Specifically, the licensee failed to assure that Procedure ABN-CR-EVAC would allow operators the time to perform emergency depressurization within the required 10 minutes in order to achieve post-fire safe shutdown. During a timed walk down on August 18, 2015, the operators took approximately 14.4 minutes to initiate emergency depressurization.

The licensee entered this deficiency into the corrective action program as Action Request AR-00335854 and the licensee has issued Night Order Number 1668 providing direction to the operators as a compensatory measure until they implemented the permanent corrective actions. Because this violation was of very low safety significance and appropriate corrective actions taken, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000/2015008-02, Inadequate Alternative Shutdown Procedure.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The team evaluated the cables of selected components from the high pressure core spray system, reactor water clean-up system, control building ventilation, and essential service water system. For the sample of components selected, the team reviewed electrical elementary and block diagrams and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. Specific components reviewed by the team are listed in the attachment.

b. Findings

A licensee-identified violation is documented under Section 4OA7.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment, such as repeaters and transmitters, would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walk down of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team verified through interviews and procedure reviews that no repairs were needed to reach and maintain cold shutdown.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions).

The team reviewed Procedure SWP-FPP-01, Nuclear Fire Protection Program, Revision 34; Plant Procedure Manual 1.3.10, Plant Fire Protection Program Implementation, Revision 32; Plant Procedure Manual 1.3.10B, Active Fire System Operability and Impairment Control, Revision 14; Plant Procedure Manual 1.3.57, Barrier Impairment, Revision 3; Plant Procedure Manual 1.3.85, On-Line Fire Risk Management, Revision 19; and Licensee Controlled Specification 1.10, Fire Protection, Revision 73. The team verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

The team reviewed operator manual actions credited for achieving safe shutdown for fires that do not require an alternative shutdown. The team reviewed Procedure ABN-FIRE, Fire; and Calculations NE-02-85-19, Post Fire Safe Shutdown (PFSS) Analysis, and NE-02-94-35, System Impacts on Post Fire Safe Shutdown.

The team verified that operators could reasonably be expected to perform the actions within the applicable shutdown time requirements. The team reviewed these operator manual actions using the guidance contained in NUREG-1852, Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire, dated October 2007.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed six changes to the approved fire protection program from July 23, 2012, to February 20, 2015. The team evaluated whether the changes constituted an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees approved fire protection program, implementing procedures, and programs for the control of ignition sources and transient combustibles.

The team assessed the licensees effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis. The team independently performed plant walk downs to verify that the licensee properly controlled transient combustibles and ignition sources in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Alternative Mitigation Strategy Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by 10 CFR 50.54(hh)(2).

The team verified that the licensee maintained and implemented adequate procedures, maintained and tested equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the offsite ability to obtain fuel for the portable pump and foam used for fire-fighting efforts. The strategy and procedure selected for this inspection sample included:

• Procedure ABN-TSG-005, Reactor Pressure Vessel Make-Up via Pumper Truck

• Procedure ABN-TSG-007, Condensate Storage Tank Make-Up Two mitigating strategy samples were completed.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of action requests associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of action requests, calculations, and other documents during the inspection.

b. Findings

No findings were identified.

4OA5 Other Activities

None

4OA6 Meetings, Including Exit

Exit Meeting Summary

On September 3, 2015, the team conducted a technical debrief with Mr. W. Grover Hettel, Vice President, Operations. The licensee acknowledged the findings presented.

The team presented the inspection results to Mr. A. Javorik, Vice President, Engineering, and other members of the licensee staff at an exit meeting on October 1, 2015. The licensee acknowledged the findings presented.

The team verified that no proprietary information was retained or documented in this report.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and are violations of NRC requirements which meet the criteria of the NRC Enforcement Policy for being dispositioned as non-cited violations.

Fire Protection License Condition 2.C.14, Fire Protection Program (Generic Letter 86-10), states that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in Section 9.5.1 and Appendix F of the final safety analysis report. Final safety analysis report, Table F.3-2, Comparison with the Specific Commitments to 10 CFR Part 50, Appendix R, Section III.G.2, Fire Protection of Safe Shutdown Capability, states, in part, that cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are free of fire damage. Contrary to this, the licensee failed to ensure that cables or equipment that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground of redundant trains of a systems necessary to achieve and maintain hot shutdown conditions are free of fire damage.

The licensee documented in Action Request AR 00332688 that during a self-assessment for fire protection and post-fire safe shutdown programs, a multiple spurious operations scenario related to flow diversion from the suppression pool to the condensate storage tank was missed. It was identified that fire-induced circuit damage to cables for HPCS-V-10, HPCS-V-11, HPCS-V-15, HPCS-P-1, and HPCS-P-3 would cause a condition that could challenge operations achieving and maintaining safe shutdown conditions.

The team screened the violation using Inspection Manual Chapter 0609, Appendix F, requiring a Phase 2 screening as described in Attachment 1. The team concluded that the violation screens to very low safety significance because the ignition sources screen out during the Phase 2 significance determination process.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

B. Abney, Assistant Operations Manager-Crew, Operations

C. Anderson, Operations Supervisor, Security

V. Bhardwaj, Manager, Planning/Scheduling/Outage

D. Brandon, Manager, Plant Support Engineering

D. Brown, Manager, System Engineering

O. Brooks, Coordinator, Emergency Preparedness

S. Burn, Plant Fire Systems Engineer

S. Cooper, Plant Fire Marshall, Program Engineering

S. Clizbe, Manager, Emergency Preparedness

D. Clymer, Supervisor, Quality

G. Cullen, Technical Services Engineering Manager, Engineering

M. Davis, Manager, Operations

K. Eldridge, Engineer, Design Engineering

D. Gregoire, Manager, Regulatory Affairs

E. Gilmore, Manager, Information Services

W. Harper, Program Owner, Fire Protection

J. Hauger, Systems Engineering, Engineering

H. Henry, Access Control Supervisor, Performance Improvement

W. Hettle, Vice President, Operations

G. Higgs, Manager, Maintenance

M. Hummer. Licensing Engineer, Licensing

M. Huntsman, Equipment Operator

A. Javorik, Vice President, Engineering

S. Kasko, Reactor Operator

D. Kettering, Design Engineering, Engineering

M. Kaudisio, Manager, Radiation Protection

R. Long, Shift Manager, Operations

A. Mehinogic, System Engineer, Engineering

R. Meyers, Operations Training

C. Moon, Manager, Quality

S. Murphy, Captain, Security

S. Nappi, Manager, Records and Information Management

J. Peterson, Non-Plant Fire Protection Engineer

J. Pierce, Recovery Manager/Vice President, Operations

G. Pierre, Manager, Training

R. Prewett, Manager, Operations

A. Rice, Manager, Chemistry

G. Rheaume, Balance of Plant Supervisor, System Engineer

R. Sankor, Supervisor, Radiation Protection

D. Schumann, Principle Engineer

B. Schute, Vice President, Operations

D. Stephenson, Manager, Operations

Attachment

Licensee Personnel

B. Strecker, Supervisor, Information Systems

D. Suarez, Licensing Engineer, Regulatory Affairs

J. Tansy, Reactor Engineering Supervisor, Reactor Fuels

J. Trautvetter, Compliance Supervisor, Regulatory Affairs

C. Vadoli, Post Fire Safe Shutdown Program Owner, Design Engineering

R. Wainwright, Planning/Scheduling/Outage

D. Wolfgramm, Compliance Engineering, Regulatory Affairs

R. Wolfgramm, Supervisor, Fire Protection, Engineering

NRC Personnel

J. Groom, Senior Resident Inspector

D. Bradley, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000397/2015008-01 NCV Failure to Ensure Adequate Acceptance Criteria in Fire Main Surveillance Testing (Section 1R05.03)

05000397/2015008-02 NCV Inadequate Alternative Shutdown Procedure (Section 1R05.05)