IR 05000416/2014007

IR 05000416-14-007; on 04/14/2014 - 05/21/2014; Grand Gulf Nuclear Station; Triennial Fire Protection Team Inspection

ML14181B397
Person / Time
Site:	Grand Gulf
Issue date:	06/30/2014
From:	John Dixon NRC/RGN-IV/DRS/EB-2
To:	Kevin Mulligan Entergy Operations
J. Mateychick
References
IR-14-007
Download: ML14181B397 (35)

Text

UNITED STATES une 30, 2014

SUBJECT:

GRAND GULF NUCLEAR STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000416/2014007

Dear Mr. Mulligan:

On May 21, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Grand Gulf Nuclear Station and discussed the results of this inspection with Mr. D. Wiles, Engineering Director, and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented one finding of very low safety significance (Green) in this report.

This finding involved a violation of NRC requirements. The NRC is treating the violation as a non-cited violation consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violation or significance of the violation in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Grand Gulf Nuclear Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Grand Gulf Nuclear Station. In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

John L. Dixon Jr., Acting Branch Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-416 License No. NPF-29 Enclosure:

Inspection Report No. 05000416/2014007 w/Attachment: Supplemental Information Electronic Distribution to Grand Gulf Nuclear Station

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-416 License: NPF-29 Report Nos.: 05000416/2014007 Licensee: Entergy Operations, Inc.

Facility: Grand Gulf Nuclear Station Location: P.O. Box 756 Port Gibson, MS 39150 Dates: April 14, 2014 - May 21, 2014 Team Leader: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 Inspectors: S. Alferink, Reactor Inspector, Engineering Branch 2 S. Graves, Senior Reactor Inspector, Engineering Branch 2 N. Okonkwo, Reactor Inspector, Engineering Branch 2 Approved By: John L. Dixon Jr., Acting Branch Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY

IR 05000416/2014007; 04/14/2014 - 05/21/2014; Grand Gulf Nuclear Station; Triennial Fire

Protection Team Inspection.

The report covered a two-week triennial fire protection team inspection by specialist inspectors from Region IV. One finding, which was a non-cited violation, was documented. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red) and determined using Inspection Manual Chapter 0609, Significance Determination Process.

Cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects Within the Cross-Cutting Areas. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process.

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of License Condition 2.C.(41),

Fire Protection Program, for the failure to provide adequate 8-hour emergency lights.

Specifically, the licensee failed to provide adequate lighting at all locations operators perform actions within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> during an alternative shutdown outside of the control room. The licensee entered this issue into their corrective action program as Condition Report CR-GGN-2014-03508 and confirmed operators are required to carry flashlights.

The failure to provide adequate 8-hour emergency lights for safe shutdown outside of the control room was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire)attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences because it affected the ability to reach and maintain safe shutdown conditions in case of a fire.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, dated September 20, 2013. The team assigned the finding a low degradation rating because the failure to provide adequate 8-hour emergency lights at all locations would not prevent reaching and maintaining safe shutdown conditions in the event of a control room fire. Specifically, the team determined that operators performing the alternative shutdown are required to carry flashlights. Because this finding had a low degradation rating, it screened as having very low safety significance (Green).

The team reviewed Inspection Manual Chapter 0310 and assigned a cross-cutting aspect in the area of Human Performance for failure to ensure equipment was available and adequate to support nuclear safety. Specifically, the Licensee added steps to operate breakers in an electrical panel in 2005 and 2012. On both occasions the Licensee failed to provide adequate emergency lighting at that location as required by the fire protection program [H.1].

Licensee-Identified Violations

None.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at the Grand Gulf Nuclear Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas and one or more mitigating strategies for review. The inspection team used the fire hazards analysis section of the Grand Gulf Nuclear Station Individual Plant Examination of External Events to select the following three risk-significant fire areas (inspection samples) for review:

Fire Area Description Fire Area 11 Auxiliary Building 139 Ft Elevation Fire Area 31 Division 1 Switchgear Room Fire Area 38 Division 2 Switchgear Room The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(41), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Updated Final Safety Analysis Report, Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis. Specific documents reviewed by the team are listed in the attachment.

Three fire area inspection samples and one mitigating strategy sample, 05-S-01 Strategy III, D/G Startup Without AC or DC Power, were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met applicable license commitments.

The team reviewed the licensees progress towards identification and mitigation of potential multiple spurious actuations associated with fire damage to safe shutdown electrical circuits and systems. The team reviewed the licensees Engineering Report GGNS-EE-10-00002, Expert Panel for Addressing Multiple Spurious Operations, Revision 0, which documented the licensees approach to identifying and correcting multiple spurious actuation scenarios as part of resolution for issues described in Nuclear Energy Institute (NEI) 00-01, Guidance for Post-Fire Safe-Shutdown Circuit Analysis, Revision 2. The team also reviewed Revision 1 to Engineering Report GGNS-EE-10-00002, which expanded the scope of potential multiple spurious actuations to include scenarios identified in draft Revision 3 to NEI 00-01. The licensee had entered these additional potential scenarios into their corrective action program.

The team also reviewed the licensees corrective actions taken to address non-cited violation 05000416/2011007-03, Failure to Take Timely Corrective Actions to Protect Safe Shutdown Equipment from Fire Damage. This non-cited violation was written to address the licensees failure to take timely corrective action for motor-operated valve vulnerabilities identified in NRC Information Notice 92-18, Potential Loss of Remote Shutdown Capability during a Control Room Fire. The licensee included these reviews and modifications in their program to address potential multiple spurious actuations. The team reviewed engineering change packages and post-modification testing associated with susceptible motor-operated valves and interviewed licensee staff involved in developing and implementing the changes and performing acceptance testing. The team determined the licensee had appropriately addressed the guidance in Information Notice 92-18 and had completed appropriate corrective actions for identified multiple spurious actuation vulnerabilities.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements. The team also reviewed the carbon dioxide suppression system tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for firefighting.

The team observed an unannounced fire drill in the Auxiliary Building and subsequent drill critique on April 30, 2014, using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly. The team observed fire brigade members fight a simulated fire in the Auxiliary Building, located in the radiological controlled area. The team verified that the licensee identified problems; openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate firefighting techniques;

(4) sufficient firefighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified:

• a fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains

• a fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train)

• adequate drainage is provided in areas protected by water suppression systems

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Updated Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown were trained and available onsite at all times, exclusive of those assigned as fire brigade members.

The team performed a walkdown of the post-fire safe shutdown procedure with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

Introduction.

The team identified an unresolved item associated with the potential spurious actuation of the safety relief valves during control room fire scenarios.

Description.

The team reviewed the licensees safe shutdown analyses, thermal hydraulic analysis, and the licensing basis for control room fire scenarios. The team identified three issues of concern that require additional information and inspection for resolution.

Concern 1: Required Alternative Shutdown Scenarios The first issue of concern was associated with the identification of the control room fire scenarios that were required by the licensing basis to be considered and mitigated. The NRC promulgated guidance for alternative and dedicated shutdown capability in Generic Letter 86-10, Implementation of Fire Protection Requirements. In Question 5.3.10, Design Basis Plant Transients, the staff addressed the plant transients that should be considered in the design of alternative or dedicated shutdown systems. The staff stated that a loss of offsite power shall be assumed for any alternative shutdown area. In addition, the staff stated that the safe shutdown capability should not be adversely affected by a fire in any plant area which results in the loss of all automatic function (signals, logic) from the circuits located in the area in conjunction with one worst case spurious actuation or signal resulting from the fire.

On February 24, 2005, the licensee identified a concern with the transient analysis for a control room fire and documented it in Condition Report CR-GGN-2005-00770. The licensee stated that, it appears that it does not assume the loss of offsite power concurrent with the loss of all automatic functions (signals, logic) in conjunction with the worst case spurious actuation or signal resulting from the fire as required by Section III.L of Appendix R and Generic Letter 86-10.

On August 24, 2005, the licensee evaluated this concern and determined that the fire induced spurious actuation of the safety relief valves could occur in any of three ways:

1. A single intra-cable short within the control circuit cable could actuate an individual safety relief valve. The safety relief valve control cables were routed together within the control room with each cable containing multiple control conductors and multiple 125 Vdc conductors.

2. Two intra-cable shorts within two separate instrument cables or two intra-cable shorts within a single instrument cable could actuate all eight of the safety relief valves associated with the automatic depressurization system.

3. Two intra-cable shorts within two separate instrument cables to either Division I or Division II circuits could open all 20 safety relief valves.

The licensee concluded in their evaluation that it is expected that the worst case spurious actuation or signal resulting from a fire in the control room would involve opening of 20 safety relief valves.

On November 2, 2009, the NRC provided the following additional guidance for alternative and dedicated shutdown capability in Regulatory Guide 1.189, Fire Protection for Nuclear Power Plants, Revision 2:

The licensee should consider one spurious actuation or signal to occur before control of the plant is achieved through the alternative or dedicated shutdown system for fires in areas that require alternate or dedicated shutdown. After the operators transfer control from the control room to the alternative or dedicated shutdown system, single or multiple spurious actuations that could occur in the fire-affected area should be considered, in accordance with the plants approved fire protection program.

The approach outlined in Appendix D to NEI 00-01 provides an acceptable methodology for evaluating alternative and dedicated shutdown, when applied in conjunction with this regulatory guide. In addition, the second paragraph of Appendix G to NEI 00-01 provides information regarding the analysis of multiple spurious actuations for alternative and dedicated shutdown systems.

The licensee continued to evaluate this concern through their corrective action program.

On August 17, 2012, the licensee developed Engineering Report GGNS-EE-10-00003, Safe Shutdown Evaluation of Control Room Fire Scenarios, Revision 0. In this report, the licensee relied on guidance contained in Appendix G, Generic List of MSOs, to NEI 00-01, Guidance for Post Fire Safe Shutdown Circuit Analysis, Revision 2, when evaluating the effect of a control room fire spuriously actuating all 20 safety relief valves.

Specifically, the licensee stated:

In accordance with the second paragraph of Appendix G to NEI 00-01, scenarios that involve spurious operation of multiple safe shutdown components concurrent with failure of automatic functions need not be included in the analysis of impacts for the main control room. However, if plant response to such transients could negate the capability to achieve and maintain post-fire safe shutdown, a voluntary review of the postulated scenarios may be warranted to supplement a previously approved alternative shutdown capability that scenarios that involve the spurious operation of multiple safe shutdown components concurrent with the failure of automatic functions need not be included in the analysis of impacts for the control room.

The team reviewed the NRC positions provided in Regulatory Guide 1.189, Revision 2, and discussed these positions with personnel in the Office of Nuclear Reactor Regulation. The team determined that the NRC endorsed the approach outlined in Appendix D, Alternative/Dedicated Shutdown Requirements, to NEI 00-01, Revision 2 (when applied in conjunction with Regulatory Guide 1.189, Revision 2). The team also determined that the NRC neither endorsed nor rejected the approach for analyzing multiple spurious actuations for alternative and dedicated shutdown systems outlined in Appendix G to NEI 00-01, Revision 2.

The team was concerned that the licensee may not have adequately followed the guidance for identifying the control room fire scenarios that were required to be considered and mitigated. The NRC staff will need to perform additional review to determine if the plants licensing basis required the licensee to analyze and mitigate the spurious actuation of a single safety relief valve (due to a single intra-cable hot short in a single cable), the spurious actuation of the automatic depressurization system (due to two intra-cable hot shorts in a single cable), or the spurious actuation of all twenty safety relief valves (due to a single intra-cable hot short in two separate cables).

Concern 2: Time Available for Operators to Depressurize the Reactor The second issue of concern was associated with the amount of time available for operators to depressurize the reactor during control room fire scenarios. For control room fires, the licensees alternative shutdown strategy required operators to take immediate actions to restore electrical power, align a residual heat removal pump in the low pressure coolant injection mode, and depressurize the reactor using six safety relief valves prior to the reactor vessel level reaching -160.

The licensee described the plant response during an alternative shutdown in Engineering Report GGNS-NE-10-00003, GGNS EPU Appendix R - Fire Protection, Revision 2. This thermal hydraulic analysis calculated the amount of time for the reactor vessel level to reach -160 (assuming no high pressure injection sources were available)and the resulting maximum peak clad temperature. Using a nominal scenario with no spurious actuations, the licensee determined the reactor vessel level would reach -160 within 14.3 minutes and the reactor would experience a maximum peak clad temperature of 597 °F. The team performed a timed walkdown of the alternative shutdown procedure and determined that it took operators approximately 12 minutes to align the equipment required for depressurizing the reactor and injecting with the residual heat removal pump.

The licensee also analyzed the plant response using an alternate scenario with the spurious actuation of all 20 safety relief valves. In this alternate scenario, the licensee determined the residual heat removal pump would initiate in the low pressure coolant injection mode within 118 seconds to restore level, the residual heat removal pump would begin injecting water into the reactor within 153 seconds, and the reactor would experience a maximum peak clad temperature of 597 °F.

For the evaluation of the alternate scenario, the licensee relied upon guidance contained in NEI 00-01, Appendix G, to credit the automatic initiation of the residual heat removal pump in the low pressure coolant injection mode. The team noted that this assumption could be considered adequate for analyzing control room fire scenarios that were outside of the licensing basis, but would be considered inadequate for demonstrating compliance with control room fire scenarios that were required to be considered and mitigated since it credited the availability of electrical power as well as the automatic initiation of the residual heat removal pump.

In either case, the team noted that the evaluation of the alternate scenario failed to account for the steps in the alternative shutdown procedure that directed operators to open the breaker for the residual heat removal pump prior to restoring electrical power and subsequently restarting the pump. The team performed a timed walkdown of the alternative shutdown procedure and determined that it took operators approximately 8 minutes to open the breaker for the residual heat removal pump and approximately 12 minutes to depressurize the reactor and restart the residual heat removal pump.

The team was concerned that the licensees determination of the time available for operators to depressurize the reactor may be incorrect. Specifically, the team was concerned that the licensees determination that operators had 14.3 minutes available to take the required immediate actions prior to the reactor vessel level reaching -160 may be incorrect since the evaluation failed to assume any spurious actuations. As described in the previous concern, the licensee may be required to consider and mitigate the spurious actuation of a single safety relief valve, the automatic depressurization system, or all 20 safety relief valves. The team noted that the thermal hydraulic analysis did not evaluate the plant response to the spurious actuation of a single safety relief valve or the automatic depressurization system.

The team required additional information in order to resolve this concern. Specifically, the team required a thermal hydraulic analysis that provided the plant response to the control room fire scenarios that were required to be considered and mitigated. This thermal hydraulic analysis will be used to determine the amount of time available for operators to restore electrical power, align the residual heat removal pump in the low pressure coolant injection mode, and prepare to depressurize the reactor prior to reaching a reactor vessel level of -160.

Concern 3: Isolation of the Safety Relief Valve Circuits The third issue of concern was associated with the isolation of the safety relief valve circuits. For control room fires, the licensees alternative shutdown strategy required operators to open two breakers (72-11A23 and 72-11B34) in order to ensure that the 14 non-credited safety relief valves were closed. The six credited safety relief valves were isolated from the control room via the use of transfer switches.

The team was concerned that hot shorts in the control room could cause a spurious actuation that threatened the ability to achieve and maintain safe shutdown conditions.

The team noted that the control room cabinets containing the safety relief valve circuits also contained other 125 Vdc circuits that may remain energized during an alternative shutdown. The team was concerned that hot shorts from one of these circuits could prevent the closure of safety relief valves (if spuriously open) or could spuriously open the safety relief valves after the control room was isolated and control transferred from the control room to the remote shutdown panel.

The team required additional information in order to resolve this concern. Specifically, the team required an evaluation of the remaining circuits in the control room panels that contain the safety relief valve circuits in order to determine if any of these other circuits remain energized during an alternative shutdown.

The licensee entered these issues of concern into the corrective action program as Condition Report CR-GG-2014-03690. These issues of concern are being treated as an Unresolved Item 05000416/2014007-01, Possible Spurious Actuation of the Safety Relief Valves During Control Room Fire Scenarios.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The teams evaluation focused on the cables of selected components from the Residual Heat Removal, Standby Service Water, Nuclear Steam Supply Shutoff and Emergency Diesel Generator Systems. For the sample of components selected, the team reviewed electrical elementary diagrams, wiring diagrams, circuit protection and coordination, and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. Specific components reviewed by the team are listed in the attachment.

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

b. Findings

Introduction.

The team identified an unresolved item associated with the potential loss of communications systems during control room fire scenarios.

Description.

The licensee developed Engineering Report GGNS-EE-11-00001, GGNS Appendix R Safe Shutdown Analysis (FPP-1), Revision 0, to document a revalidation of the post-fire safe shutdown analysis. This analysis described three different intraplant communications systems. These systems included the radio system, public address system, and sound-powered telephones.

The licensee provided a summary of the communications systems, but did not provide a detailed evaluation of the availability of the communications systems during control room fire scenarios. The licensee noted that two of the inverter cabinets for the public address system were included in the safe shutdown equipment list, but were not credited to provide communications for safe shutdown since the sound-powered telephones or hand-held radios could also be used. The licensee concluded that because of the diverse and overlapping coverage of the intraplant communications systems, it is reasonable to conclude that adequate communications will remain available.

Based on discussions with site communications personnel, the team determined that a fire-induced short in the radio system control console cable could key the repeater, preventing the operators and fire brigade from using the radio system. The licensee noted that the control console was connected via a phone line, and operators could mitigate this scenario by cutting the telephone cables in the radio repeater room (located outside the control room).

During a walkdown of the alternative shutdown procedure, the team confirmed that public address system handsets were located in all areas that required communications between operators, but the team identified that sound-powered telephone jacks were not located in the Division I diesel generator room. The team noted that the alternative shutdown procedure required communications between the operators performing steps at the diesel generator and the switchgear during the time critical actions.

Because the public address system had circuits and equipment located in the control room, the team was concerned that a control room fire could possibly disable both the radio system and the public address system. Since the sound-powered telephone jacks were not provided in all areas that required communications between operators, the team was concerned that the licensee may not have sufficient communications capability for all control room fire scenarios.

The team required additional information in order to resolve this concern. Specifically, the team required an evaluation of the public address system circuits and equipment in the control room to determine if a control room fire could disable the radio system and the public address system.

The licensee entered these issues of concern into the corrective action program as Condition Report CR-GG-2014-03803. These issues of concern are being treated as an Unresolved Item 05000416/2014007-02, Possible Loss of Communications Systems During Control Room Fire Scenarios.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain safe shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkdown of the alternative shutdown procedure. The team observed a blackout test in the Division I switchgear room demonstrating the lighting provided by only the 8-hour emergency lights.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(41), Fire Protection Program, for the failure to provide adequate 8-hour emergency lights. Specifically, the licensee failed to provide adequate lighting at all locations operators perform actions within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> during an alternative shutdown outside of the control room.

Description.

For fires in the control room, operators evacuate the control room and perform an alternative shutdown in accordance with Procedure 05-1-02-II-1, Shutdown From The Remote Shutdown Panel. The team performed walkdowns of this procedure with operators simulating the required actions. The team also evaluated the 8-hour emergency lighting and communications systems provided to support these activities.

Eight-hour emergency lights are required at locations where operators perform actions and the designated access/egress paths to the equipment.

The team identified two examples where the licensee failed to provide adequate 8-hour emergency lights during walkdowns of Procedure 05-1-02-II-1, Attachment XXI, Control Room Operator Actions (RHR A Injection to Reactor).

1. Step a. directs the operator to open three breakers in power panel NSP64DP03 in

the Division II switchgear room to defeat the carbon dioxide suppression system in the switchgear rooms for personnel protection. No emergency lighting coverage has been provided at that location. Emergency lights in the room would not be sufficient to allow the operator to perform the action without use of a flashlight. While this action is not required to achieve safe shutdown, it is the first action in the attachment and any additional time spent due to use of a flashlight will delay the subsequent time critical actions required for safe shutdown. As such, the location is part of the access/egress path. This step was added to the procedure in 2005.

2. Steps g.(1), g.(2) and h.(1) direct the operator to open breakers in panel 1H13-P628,

DC Bus 1DA1, in the Division I switchgear room. No emergency lighting unit was provided to illuminate the breakers. The licensee conducted a blackout test and an operator simulated opening one of the breakers without using a flashlight. The operator had to read the procedure step at a location nearby with sufficient lighting.

At the panel, the operator found the label of a different breaker he could read and used his plant knowledge to count the beakers to locate the one to operate. The operator was not able to read the label of the breaker being operated. Two NRC inspectors observing the test were not able to read any of the breaker labels in the panel. These steps were added to the procedure in 2012.

The licensee entered this issue into their corrective action program as CR-GGN-2014-03508 and confirmed operators are required to carry flashlights.

Analysis.

The failure to provide adequate 8-hour emergency lights for safe shutdown outside of the control room was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences because it affected the ability to reach and maintain safe shutdown conditions in case of a fire.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013. The team assigned the finding to the post-fire safe shutdown category since it impacted the alternate shutdown (control room abandonment) element.

The team assigned the finding a low degradation rating because the failure to provide adequate 8-hour emergency lights at all locations would not prevent reaching and maintaining safe shutdown conditions in the event of a control room fire. Specifically, the team determined that operators performing the alternative shutdown are required to carry flashlights. The use of flashlights and the operators experience provide adequate compensatory measures for locations with inadequate lighting from the fixed emergency lighting units. Because this finding had a low degradation rating, it screened as having very low safety significance (Green).

The team reviewed Inspection Manual Chapter 0310 and assigned a cross-cutting aspect in the area of Human Performance for failure to ensure equipment was available and adequate to support nuclear safety. Specifically, the Licensee added steps to operate breakers in an electrical panel in 2005 and 2012. On both occasions the Licensee failed to provide adequate emergency lighting at that location as required by the fire protection program. (H.1)

Enforcement.

License Condition 2.C.(41), Fire Protection Program, requires that the licensee comply with the requirements of the approved Fire Protection Program as described in Revision 5 to the Updated Final Safety Analysis Report and as approved in the Safety Evaluations dated August 23, 1991, and September 29, 2006.

The fire protection program requirements are described in the Updated Final Safety Analysis Report Section 9.5.1 and Appendices 9A, 9B, and 9C. Table 9.5-11, Fire Protection Program Comparison With NRC Requirements, Section D.5.a states, in part, Special units with a minimum rating of 8-hour lamp life are used in areas essential to safe shutdown and access/egress routes to these areas. Table 9.5-12, Fire Protection Program Comparison With Appendix R to 10 CFR 50, Section J, states, in part, Comply.eight-hour emergency lighting has been provided for areas essential to the operation of equipment required for safe shutdown as tabulated in Table 9.5.15 and in the access and egress routes thereto. Table 9.5-15 Lighting System Tabulation, states that for Control Building Elevation 111 - 0, Room OC202, Division I Switchgear Area, and Room OC215, Division II Switchgear Area, Eight hour emergency battery packs are provided, where required for operation of, or access/egress to, equipment essential to safe shutdown.

Contrary to the above, from 2005 through at least May 21, 2014, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program.

Specifically, the licensee failed to provide adequate emergency lighting units in all areas needed for operation of safe shutdown equipment and in access and egress routes thereto.

Because this violation was of very low safety significance and has been entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000416/2014007-03, Failure to Provide Adequate Emergency Lighting.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed the licensee's safe shutdown analysis and Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, to determine whether repairs were required to achieve cold shutdown. The licensee identified two repairs that were potentially required in order to reach cold shutdown based on the safe shutdown methodology implemented.

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

The team verified that the licensee did not credit the use of any operator manual actions as compensatory measures for achieving safe shutdown for fires in areas that did not require an alternative shutdown capability.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed changes to the approved fire protection program. The team verified that the changes did not constitute an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees approved fire protection program, implementing procedures, and programs for the control of ignition sources and transient combustibles.

The team assessed the licensees effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis. The team performed plant walkdowns to independently verify that transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Alternative Mitigation Strategy Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by 10 CFR 50.54(hh)(2).

The team verified that the licensee maintained and implemented adequate procedures, maintained and tested equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team walked down the strategy with licensee operators and performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment. The strategy and procedure selected for this inspection sample included:

• 05-S-01-Strategy Attachment III, D/G Startup Without AC or DC Power One mitigating strategy sample was completed.

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

Meeting Summary The team presented the preliminary inspection results to K. Mulligan, Site Vice-President, and other members of the licensee staff at a debrief meeting on May 2, 2014.

The licensee acknowledged the findings presented.

The team presented the inspection results to D. Wiles, Engineering Director, and other members of the licensee staff at a telephonic exit meeting on May 21, 2014. The licensee acknowledged the findings presented.

The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

L. Brown, Operations Department Performance Improvement Coordinator

D. Chipley, Senior Design Engineer - Electrical

K. Christian, Senior Manager - Production

T. Coutu, Nuclear Safety Assurance Director

A. Fox, Design Engineering - Codes Program Supervisor

M. Goodwin, Operations Manager

G. Hawkins, Senior Manager - Site Projects/Maintenance Services

C. Lewis, Emergency Planning Manager

J. McAdory, Fire Protection Engineer

R. McNemar, Fire Marshal

E. Meaders, Training Manager

R. Miller, Radiological Protection Manager

M. Milly, Maintenance Manager

K. Mulligan, Site Vice-President

J. Nadeau, Regulatory Assurance Manager

G. Philips, Engineering Supervisor Electrical Design

J. Seiter, Regulatory Assurance Specialist

R. Sorrels, Fire Protection Engineer

T. Thornton, Design Engineering Manager

D. Wiles, Engineering Director

NRC Personnel

R. Smith, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

Possible Spurious Actuation of The Safety Relief Valves

05000416/2014007-01 URI During Control Room Fire Scenarios Possible Loss of Communication Systems During Control

05000416/2014007-02 URI Room Fire Scenarios

Opened and Closed

05000416/2014007-03 NCV Failure to Provide Adequate Emergency Lighting