IR 05000440/2009007

IR 05000440-09-007(DRS), on 06/08/2009-06/26/2009, Perry Nuclear Power Plant, Unit 1, Fire Protection Triennial Baseline Inspection

ML092170701
Person / Time
Site:	Perry
Issue date:	08/05/2009
From:	Robert Daley Engineering Branch 3
To:	Bezilla M FirstEnergy Nuclear Operating Co
References
IR-09-007
Download: ML092170701 (29)

Text

ugust 5, 2009

SUBJECT:

PERRY NUCLEAR POWER PLANT FIRE PROTECTION TRIENNIAL BASELINE INSPECTION NRC INSPECTION REPORT 05000440/2009007(DRS)

Dear Mr. Bezilla:

On June 26, 2009, the U. S. Nuclear Regulatory Commission (NRC) completed a Triennial Fire Protection Inspection at your Perry Nuclear Power Plant. The enclosed report documents the inspection results, which were discussed on June 26, 2009, with Mr. J. Grabner and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents three NRC-identified findings of very low safety significance (Green). All of these findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they were entered into your corrective action program, the NRC is treating the findings as Non-Cited Violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, Region III; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Perry Nuclear Power Plant. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region III, and the NRC Resident Inspector at the Perry Nuclear Power Plant.

The information you provide will be considered in accordance with Inspection Manual Chapter 0305. In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS)

component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Robert C. Daley, Chief Engineering Branch 3 Division of Reactor Safety Docket No.: 50-440 License No.: NPF-58 Enclosure: Inspection Report No. 05000440/2009007(DRS)

w/Attachment: Supplemental Information cc w/encl: J. Hagan, President and Chief Nuclear Officer - FENOC J. Lash, Senior Vice President of Operations and Chief Operating Officer - FENOC D. Pace, Senior Vice President, Fleet Engineering - FENOC K. Fili, Vice President, Fleet Oversight - FENOC P. Harden, Vice President, Nuclear Support Director, Fleet Regulatory Affairs - FENOC Manager, Fleet Licensing - FENOC Manager, Site Regulatory Compliance - FENOC D. Jenkins, Attorney, FirstEnergy Corp.

Public Utilities Commission of Ohio C. OClaire, State Liaison Officer, Ohio Emergency Management Agency R. Owen, Ohio Department of Health

SUMMARY OF FINDINGS

IR 05000440/2009007(DRS); 06/08/2009 - 06/26/2009; Perry Nuclear Power Plant, Unit 1;

Fire Protection Triennial Baseline Inspection.

This report covers an announced fire Protection Triennial Baseline Inspection. The inspection was conducted by Region III inspectors. Three Green findings associated with Non-Cited Violations (NCVs) were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609 Significance Determination Process (SDP). Findings for which the SDP does not apply may be "Green," or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated July 2006.

Cornerstone: Initiating Events

No violations of significance were identified.

Cornerstone: Mitigating Systems

Green.

The inspectors identified a finding of very low safety-significance and associated NCV of Technical Specification (TS) 5.4.1a for failure to maintain procedures for post-fire operation of control room heating, ventilation, and air conditioning (HVAC) Train A fans and for control of the Division 1 remote shutdown room toolbox inventory. Specifically,

Procedure ARI-H13-P904-0001-B6, "Control Room HVAC Train A Tripped," stated that if a fire has occurred and the Train A fans have tripped, then restart the Train A fans in emergency recirculation mode. The correct action was to restore Train B fans in emergency recirculation mode. In addition, Procedure IOI-11 "Control Room Isolation," Attachment 20, contained a list of equipment operators were to obtain from the toolbox, located by the alternate remote shutdown panel, following a control room fire. The list included nine items; one of the items consisting of three FRS-R 4-Amp fuses was missing. The procedure should have been revised to remove the requirement to obtain the fuses. The licensee entered this finding into their corrective action program as CR 09-60317 and CR 09-60373.

The finding was determined to be more than minor because the finding was associated with the mitigating system cornerstone attribute of procedure quality and affected the cornerstones objective of ensuring the capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to maintain the procedures could have complicated plant safe shutdown in the event of a fire. The inspectors determined that the finding was of very low safety-significance since the procedure deficiencies did not substantially impact performance in the event of a fire.

(Section 1R05.1b)

Green.

The inspectors identified a finding of very low safety significance and associated NCV of the Perry Nuclear Power Plant, Unit 1, Facility Operating License Condition 2.C.(6) and 10 CFR Part 50, Appendix R, Section III.G.2, involving the licensees failure to ensure, in the event of a fire, that one redundant train of systems necessary to achieve and maintain hot shutdown conditions was free of fire damage. Specifically, the licensee failed to ensure, in the event of a control room fire that certain Systems,

Structures, and Components (SSCs) necessary to achieve and maintain hot shutdown conditions (e.g., MOVs 1P45-F0014A and 1P45-F0068A and emergency service water system (ESW) equipment) were free of fire damage. The licensee entered this finding into their corrective action program for resolution as CR 09-60977. The control room area, which is susceptible to this condition, is continuously manned; therefore making a compensatory action of a fire watch un-necessary.

The finding was determined to be more than minor because the finding was associated with the mitigating systems cornerstone attribute of protection against external factors (Fire) and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The Phase 2 screening determined this finding was of very low safety-significance because no potentially challenging fire scenarios were developed.

(Section 1R05.2b)

Green.

The inspectors identified a finding of very low safety significance and associated NCV of the Perry Nuclear Power Plant, Unit 1, Facility Operating License Condition 2.C.(6)and 10 CFR Part 50, Appendix R, Section III.G.3, for failure to provide the required electrical isolation in the design of the post-fire safe shutdown control logic circuitry.

Specifically, the control logic for the Division 1 diesel generator building ventilation fan 1M43-C001A did not have the required physical isolation to isolate control room fire-induced electrical faults when transferring control to the remote shutdown station. This is required to ensure that postulated fire-induced electrical faults would not result in the loss of post-fire alternative safe shutdown equipment. The licensees immediate corrective action was to perform a preliminary evaluation of the electrical circuitry and cables. The licensee entered this finding into their corrective action program as CR 09-60873. The control room area, which is susceptible to this condition, is continuously manned; therefore making a compensatory action of a fire watch unnecessary.

The finding was determined to be more than minor because the finding was associated with the mitigating systems cornerstone attribute of protection against external factors (Fire) and affected the cornerstones objective of ensuring the capability of systems that respond to initiating events to prevent undesirable consequences. The violation is associated with degradation of a fire protection feature. In accordance with IMC 0609,

Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 3b, the inspectors determined the finding degraded the fire protection defense-in-depth strategies. Therefore, screening under IMC 0609, Appendix F, Fire Protection Significance Determination Process, was required. Using Part 1 of the Fire Protection SDP Phase 1 Worksheet in Manual Chapter 0609, Significance Determination Process [SDP], the performance issue was determined to be in the post-fire safe shutdown category. The degradation rating was low based on FirstEnergy Nuclear Operating Companys (FENOCs) engineering evaluation that concluded that there were no fire induced electrical faults resulting from a control room fire that would prevent the plant from achieving and maintaining a safe shutdown in the event of a control room fire. Therefore, the finding screened as Green or of very low safety-significance in the Phase 1 Worksheet. This violation is being treated as a NCV consistent with Section VI.A of the Enforcement Policy (Section 1R05.6b). The cause of the finding related to the cross-cutting aspect of problem identification and resolution

P.1(c).

Licensee-Identified Violations

No violations of significance were identified.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events and Mitigating Systems

1R05 Fire Protection

The purpose of the fire protection triennial baseline inspection was to conduct a design-based, plant specific, risk-informed, onsite inspection of the licensees fire protection programs defense-in-depth elements used to mitigate the consequences of a fire. The fire protection program shall extend the concept of defense-in-depth to fire protection in plant areas important to safety by:

• preventing fires from starting;

• rapidly detecting, controlling and extinguishing fires that do occur; and

• providing protection for structures, systems, and components important to safety so that a fire that is not promptly extinguished by fire suppression activities will not prevent the safe shutdown of the reactor plant.

The inspectors evaluation focused on the design, operational status, and material condition of the reactor plants fire protection program and post-fire safe shutdown systems. The objectives of the inspection were to assess whether the licensee had implemented a fire protection program that:

(1) provided adequate controls for combustibles and ignition sources inside the plant;

(2) provided adequate fire detection and suppression capability;

(3) maintained passive fire protection features in good material condition;

(4) established adequate compensatory measures for out-of-service, degraded or inoperable fire protection equipment, systems or features;

(5) ensured that procedures, equipment, fire barriers, and systems exist so that the post-fire capability to safely shutdown the plant was ensured;

(6) included feasible and reliable operator manual actions when appropriate to achieve safe shutdown; and

(7) identified fire protection issues at an appropriate threshold and ensured these issues were entered into the licensees problem identification and resolution program.

In addition, the inspectors review and assessment focused on the licensees post-fire safe shutdown systems for selected risk-significant fire areas. Inspector emphasis was placed on determining that the post-fire safe shutdown capability and the fire protection features were maintained free of fire damage to ensure that at least one post-fire safe shutdown success path was available. The inspection was performed in accordance with U. S. Nuclear Regulatory Commission (NRC) Inspection Procedure (IP) 71111.05T, Fire Protection (Triennial), dated April 21, 2006. The NRC regulatory oversight process IP used a risk-informed approach for selecting the fire areas and/or fire zones and attributes to be inspected. The inspectors with assistance from a senior reactor analyst used the licensees Individual Plant Examination for External Events (IPEEE) to select several risk-significant areas for detailed inspection and review. The fire areas and/or fire zones selected for review during this inspection are listed below and constitute five inspection samples.

Fire Zone Description 1AB-2 Auxilary Building - Elevation 599' 1CC-4f Control Complex - Elevation 620'-6" (Divison 1 & 4 Mech/Elect Cable Chase)1CC-6 Control Complex - Elevation 679'-6" (HVAC Systems Train B )

1DG-1a Divison 2 DG Building - Elevation 620'-6" 1DG-1d Diesel Generator Building Hallway - Elevation 620'-6"

.1 Shutdown from Outside Main Control Room

a. Inspection Scope

The inspectors reviewed the functional requirements identified by the licensee as necessary for achieving and maintaining hot and cold shutdown conditions to ensure that at least one post-fire safe shutdown success path was available in the event of fire in each of the selected fire areas and for alternative shutdown in the case of control room evacuation. The inspectors reviewed the plant systems required to achieve and maintain post-fire safe shutdown to determine if the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for each fire area selected for review. Specifically, the review was performed to determine the adequacy of the systems selected for reactivity control, reactor coolant inventory makeup, reactor heat removal, process monitoring, and support system functions. The review also included the fire safe shutdown analysis to ensure that all required components in the selected systems were included in the licensees safe shutdown analysis.

The inspectors reviewed the licensees post-fire safe shutdown analysis, normal and abnormal operating procedures, piping and instrumentation drawings, electrical drawings, their updated final safety analysis report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that rely on shutdown from outside the control room. This review included verification that shutdown from outside the control room could be performed both with and without the availability of offsite power.

The inspectors also examined the operators ability to perform the necessary manual actions for achieving safe shutdown by reviewing post-fire shutdown procedures, the accessibility of safe shutdown equipment, and the available time for performing the actions.

The inspectors reviewed the updated final safety analysis report and the licensees engineering and/or licensing justifications (e.g., NRC guidance documents, license amendments, Technical Specifications, safety evaluation reports, exemptions, and deviations) to determine the licensing basis.

b. Findings

Failure to Maintain Procedures for Post-Fire Operation of Control Room HVAC Fans and Control of Remote Shutdown Room Toolbox Inventory

Introduction:

The inspectors identified a finding of very low safety significance (Green)and associated Non-Cited Violation (NCV) of Technical Specification (TS) 5.4.1a for failure to maintain procedures for post-fire operation of control room heating, ventilation, and air conditioning (HVAC) Train A fans and for control of the Division 1 remote shutdown room toolbox inventory. Specifically, Procedure ARI-H13-P904-0001-B6, "Control Room HVAC Train A Tripped," stated that if a fire has occurred and the Train A fans have tripped, then restart the Train A fans in emergency recirculation mode. The correct action was to restore Train B fans in emergency recirculation mode. In addition, Procedure IOI-11 "Control Room Isolation," Attachment 20, contained a list of equipment required for operator actions that was not accurate.

Description:

The inspectors reviewed the licensee's list of operator actions associated with 10 CFR Part 50, Appendix R, Section III.G.2 areas. Three of the operator actions involved bypassing trips of ventilation systems from the control room as a result of fire induced shorts and were listed as hot shutdown requirements. The specific actions for two of the operator actions involved performing procedure steps to transfer the control room ventilation trains to recirculation mode and restarting the fans following a fire induced short of each trains' pressure switches. The third operator action involved restarting the emergency diesel generator room ventilation supply fans following spurious CO2 actuation in one or more diesel generator rooms following a fire in a common corridor outside the diesel generator room. All of the mitigating actions were to be taken by operators manipulating controls from panels within the control room. The specific scenarios for the three manual operator actions involved the following:

• A fire in Fire Area 1CC-4a (Division 1 Cable Spreading Area) and 1CC-6 (Train B HVAC Systems Area) could fail cables for pressure switches that control Train A Control Room HVAC fans. The control room would receive an alarm for loss of power to or low flow sensed on the Train A fans. Given the alarm, operators were instructed to follow procedures ARI-H13-P904-0001, "Common HVAC Control Panel," and SOI-M25/26, "Control Room HVAC and Emergency Recirculating System." The procedures directed the operator to question whether a fire has occurred in the fire areas, and if so, restart HVAC fans in emergency recirculation mode.

• A fire in Fire Area 1CC-4e (Division 1 Cable Spreading Area) could fail cables for pressure switches that control Train B Control Room HVAC fans. Similar to the previous discussion, the control room would receive an alarm for loss of power to or low flow sensed on the Train B fans. Given the alarm, operators were instructed to follow procedures ARI-H13-P904-0001, "Common HVAC Control Panel," and SOI-M25/26, "Control Room HVAC and Emergency Recirculating System." The procedures directed the operator to question whether a fire has occurred in the fire areas, and if so, restart HVAC fans in emergency recirculation mode.

• A fire in Fire Area DG-1d (Common Connecting Corridor Between The Control Complex, Service Building, Diesel Generator Areas) could cause spurious CO2 initiation in any or all of the Division 1, 2, and 3 diesel generator rooms. Procedure ONI-P54, "Fire," Section 9, contained a note stating that a fire in the diesel building hallway could cause spurious CO2 initiation in the diesel rooms. Procedure ONI-P54, "Fire," directed the operator to implement Procedure SOI-M43, "Diesel Generator Building Ventilation System." Procedure SOI-M43 instructed the operator to perform steps to restart the ventilation system supply fans to purge the room of CO2.

The inspectors observed licensee personnel simulate performance of the procedures for all three of the manual actions described above. The first operator manual action involved fires in Fire Areas 1CC-4a and 1CC-6, which affected the Control Room HVAC Train A fans. Procedure ARI-H13-P904-0001-B6, "Control Room HVAC Train A Tripped," stated that if a fire has occurred and the Train A fans have tripped, then restart the Train A fans in the emergency recirculation mode. The inspectors observed that the procedure was in error since the correct manual action was to restore the other train (Train B) fans in the emergency recirculation mode.

Although Procedure ARI-H13-P904-0001-B6 had erroneous instructions, a subsequent procedure, SOI-M25/26, "Control Room HVAC, and Emergency Recirculating System,"

included a verification of the proper configuration of the HVAC equipment. Therefore, this procedure error would likely have been recovered during performance of the subsequent procedure and the proper HVAC configuration re-established. The inspectors also noted that the revision of Procedure ARI-H13-P904-0001-B6, which contained the instruction error, was issued in June 1995. The licensee stated that no training was provided on this procedure since the last NRC triennial fire protection inspection. As a result, the licensee initiated condition report (CR) 09-60317 to investigate this issue and designated the CR as a "limited apparent cause" report which would include an evaluation of all alarm response instructions related to fire response and protection.

The inspectors performed an inventory of the Division 1 Remote Shutdown Room Toolbox using Procedure IOI-11, "Shutdown from outside Control Room."

20 of this procedure, "Control Room Isolation," Step 3.1, contained a list of equipment that operators were to obtain from the toolbox following a control room fire.

The list included 9 items; however, one item, consisting of three FRS-R 4-Amp fuses, was missing. Furthermore, fuses that were present in the toolbox were placed in individual bags, yet the bags and some of the fuses in them were not readily identifiable.

This did not allow easy access to required fuses during an actual event.

The three missing FRS-R 4-Amp fuses were equipment needed up until recently to perform compensatory manual actions to replace power fuses for the emergency service water (ESW) pump A discharge valve 1P45-F0130A in the event of a control room fire.

The licensee performed modification ECP 08-0122 during the Spring 2009 Refueling Outage to eliminate this compensatory manual action. Therefore, the operators were instructed by this procedure to obtain fuses that served no purpose. As a result, the licensee issued CR 09-60373 to document the investigation of this issue. The licensee revised Procedure IOI-11 to delete the requirement for obtaining the three FRS-R 4-Amp fuses in Attachment 20. The inspectors later performed another inventory and found the above issues corrected such that an operator could quickly and accurately obtain the required equipment during an actual event.

Analysis:

The inspectors determined that the failure to maintain procedures for post-fire operation of control room HVAC Train A fans and for control of the Division 1 remote shutdown room toolbox inventory was a performance deficiency. The inspectors determined that the finding was more than minor because it was associated with the mitigating system cornerstone attribute of procedure quality and affected the cornerstone objective of ensuring the capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to maintain the procedures could have complicated plant safe shutdown in the event of a fire.

The finding was evaluated using IMC 0609 Appendix F, "Fire Protection Significance Determination Process (SDP)." Using Part 1 of the Inspection Manual Chapter 0609, fire protection Significance Determination Process Phase 1 Worksheet, the performance issue was determined to be in the post-fire safe shutdown category. The degradation rating was low because the issue involved procedure deficiencies, which could have been compensated by operator experience/familiarity. Therefore, the finding screened as Green or of very low safety-significance in the Phase 1 Worksheet. The inspectors did not identify a cross-cutting aspect associated with this finding.

Enforcement:

Perry Unit 1 Technical Specification (TS) 5.4.1a. requires, in part, that written procedures/instructions shall be established, implemented and maintained covering the typical activities covered by procedures identified in Regulatory Guide (RG) 1.33, Quality Assurance Program Requirements (Operation), Revision 2, Appendix A, "Typical Procedures for Pressurized Water Reactors and Boiling Water Reactors," February 1978.

Regulatory Guide 1.33, Revision 2, Appendix A, Section 6, Procedures for Combating Emergencies and Other Significant Events, Items p and v, Fire in Control Room or Forced Evacuation of Control Room and Plant Fires, respectively, identified those fire protection activities to be covered by procedures. These TS required procedures are represented by Procedure ARI-H13-P904-0001-B6, "Control Room HVAC Train A Tripped" and Procedure IOI-11, "Shutdown From Outside Control Room."

Contrary to the above, since the revision of Procedure ARI-H13-P904-0001-B6 effective June 15, 1995, and following implementation of engineering change package (ECP) 08-0122 for Procedure IOI-11 during the spring 2009 Refueling Outage, the licensee failed to appropriately maintain those fire protection activities to be covered by procedures as required by TS 5.4.1a. Because this violation was of very low safety-significance and it was entered into the licensees corrective action program as CR 09-60317 and CR 09-60373, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000440/2009007-01 (DRS)).

.2 Protection of Safe Shutdown Capabilities

a. Inspection Scope

For each of the selected fire areas, the inspectors reviewed the fire hazards analysis, safe shutdown analysis, and supporting drawings and documentation to verify that safe shutdown capabilities were properly protected.

The inspectors reviewed the licensee procedures and programs for the control of ignition sources and transient combustibles to assess their effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis.

The inspectors performed plant walkdowns to verify that protective features were being properly maintained and administrative controls were being implemented.

The inspectors also reviewed the licensees design control procedures to ensure that the process included appropriate reviews and controls to assess plant changes for any potential adverse impact on the fire protection program and/or post-fire safe shutdown analysis and procedures.

b. Findings

Failure to Assure That Systems Structures and Components Necessary to Achieve And Maintain Hot Shutdown Conditions Were Free of Fire Damage Without Repair Actions

Introduction:

The inspectors identified a finding of very low safety-significance (Green)and associated NCV of the Perry Nuclear Power Plant (PNPP), Unit 1, Facility Operating License Condition 2.C.(6) and 10 CFR Part 50, Appendix R, Section III.G.2, involving the licensees failure to ensure, in the event of a fire, that one redundant train of systems necessary to achieve and maintain hot shutdown conditions was free of fire damage.

Specifically, the licensee failed to ensure, in the event of a control room fire, certain systems, structures, and components (SSCs) necessary to achieve and maintain hot shutdown conditions (e.g., MOVs 1P45-F0014A and 1P45-F0068A and emergency service water system (ESW) equipment) were free of fire damage. The licensee entered this finding into their corrective action program as CR 09-60977.

Description:

NRC Information Notice 92-18, "Potential for Loss of Remote Shutdown Capability During a Control Room Fire," identified that motor operated valves (MOVs),important for safe shutdown could receive spurious control signals during a postulated control room fire before an operating crew had sufficient time to evacuate the control room and transfer emergency control to the remote shutdown panel (RSP). As a result, valve or valve operator damage could occur before the fire-damaged portion of the circuit was isolated from the control room to the RSP. Subsequently, in PNPPs LER 96-006, Revision 0 and Revision 1 reported a deficiency in control circuitry design associated with eight MOVs requiring design modifications to address fire induced circuit faults (e.g., hot shorts). Recently, PNPP modified the essential service water MOV 1P45-F0130A to eliminate the effects of hot shorts on the valve circuit. However, MOVs 1P45-F0014A and 1P45-F0068A remained unmodified and still have procedure steps to replace blown fuses in the motor control cubicles to enable operation of these MOVs from the RSP to achieve and maintain hot shutdown after a fire in the control room.

CR 09-60977 documented the condition for evaluation and resolution. Perry Nuclear Power Plant is considering modifications to MOVs P45-F0014A and 1P45-F0068A to eliminate the hot shorts potential and the need to replace the fuses, but has not initiated Engineering Change Packages yet.

In a second example, a fire in the Unit 1 control room could cause spurious circuit faults that result in adverse system operations prior to the isolation of SSCs from the control room to operating control by the remote shutdown panel. Faults in the control circuits or power sources could result in a spurious actuation of the Division 1 Diesel Generator (DG). Fire induced spurious faults in the controls for ESW equipment (e.g., Pump or isolation valves) could result in a failure to supply ESW cooling water to the Division 1 DG.

The result would be a trip of the Division 1 DG on high jacket water temperature. Perry procedure ONI-SPI A-5 specified that it might be necessary to install a jumper in the diesel generator control panel to eliminate the high jacket water temperature trip signal. The licensee believed that both the fuse replacement and the jumper were not adverse changes to the Perry fire Protection Program. The inspectors concluded that these repair activities were adverse to safe shutdown. Since the MOVs and the Division 1 EDG were both relied upon for alternative shutdown, and would have been damaged by the fire, these alternative shutdown capabilities were no longer independent of the fire area, and therefore reduced the reliability of the Perry alternative shutdown system. CR 09-60977 documented the condition for evaluation and corrective action.

Analysis:

The inspectors determined that licensee procedures which specified the replacement of blown fuses and the installation of a jumper following a CR fire, was a repair and was contrary to the plants license condition that required one redundant train of systems necessary to achieve and maintain hot shutdown conditions remain free of fire damage and was a performance deficiency. The finding was determined to be more than minor because the finding was associated with the mitigating systems cornerstone attribute of protection against external factors (Fire) and affected the cornerstones objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the inspectors determined that the licensee was performing repairs by installing fuses for MOVs 1P45-F0014A and by 1P45-F0068A and by installing a jumper for overriding a trip signal to restore operation of EDG 1 in order to achieve and maintain hot shutdown conditions.

For these repair actions to be implemented would have required the approval of the NRC to deviate from the requirements of 10 CFR Part 50 Appendix R, Section III.G.

In accordance with IMC 0609, Significance Determination Process, Attachment 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 3b the inspectors determined the finding affected the fire protection defense-in-depth strategies. Therefore, screening under IMC 0609, Appendix F, Fire Protection Significance Determination Process, was required. While IMC 0609 Appendix F does not include explicit treatment of fires in the main control room, the Phase 2 process can be used with other guidance to conduct the risk analysis. The fire ignition source associated with this deficiency was electrical cabinets. The ignition source screening determined this deficiency did not result in ignition of secondary combustible fuels and did not cause damage consistent with fire damage state scenarios of interest. Therefore, the screening determined this finding was of very low safety-significance (Green), because no potentially challenging fire scenarios were developed.

The inspectors did not identify a cross-cutting aspect associated with this finding because the cause is not indicative of current performance, rather caused by licensees historical interpretation of manual actions and license condition requirements.

Enforcement:

Perry Nuclear Power Plant, Unit No. 1, Facility Operating License NPF-58, Condition 2.C.(6), "Fire Protection," requires, in part, that FENOC shall implement and maintain all provisions of the approved Fire Protection Program, as described in the FSAR, as amended, for PNPP and as approved in the Safety Evaluation Report (NUREG-0887) dated May 1982 and Supplement Nos. 1 through 10.

Perrys USAR Section 9A.6 stated that PNPP complied with 10 CFR Part 50, Appendix R, Section III.G, "Fire Protection of Shutdown Capability."Section III.G.3 of 10 CFR Part 50, Appendix R requires, in part, that alternative of dedicated shutdown capability and its associated circuits, independent of cables, systems, or components in the area, room, or zone under consideration should be provided:

(1) Where the protection of systems whose function is required for hot shutdown does not satisfy the requirement of Paragraph G.2 of this section.

(2) Where redundant trains of systems required for hot shutdown located in the same fire area may be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems.

Appendix R,Section III.L contains the requirements for an alternative shutdown system.

Specifically, 10 CFR Part 50, Appendix R, Section III.L.3 requires, in part, that the alternative shutdown capability shall be independent of the specific fire area.

Contrary to the above, prior to June 24, 2009, the licensee failed to assure that fire protection features were capable of limiting fire damage so that SSCs necessary to achieve and maintain hot shutdown conditions were free of fire damage without repair actions. Specifically, circuits that were required for alternative shutdown capability were not assured to be free of fire damage during a control room fire, and therefore were not independent of the fire area. Consequently, PNPP procedures inappropriately specified:

(1) replacing fuses to enable operation of some MOVs from the RSP; and

(2) installing a jumper in the Diesel Generator Control panel to override a possible trip signal to operate of the EDG 1. Because this violation was of very low safety-significance and it was entered into the licensees corrective action program as CR 09-60977, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000440/2009007-02 (DRS)).

.3 Passive Fire Protection

a. Inspection Scope

For the selected fire areas, the inspectors evaluated the adequacy of fire area barriers, penetration seals, fire doors, electrical raceway fire barriers, and fire rated electrical cables. The inspectors observed the material condition and configuration of the installed barriers, seals, doors, and cables. The inspectors reviewed approved construction details and supporting fire tests. In addition, the inspectors reviewed license documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association (NFPA) codes to verify that fire protection features met license commitments.

The inspectors walked down accessible portions of the selected fire areas to observe material condition and the adequacy of design of fire area boundaries (including walls, fire doors, and fire dampers) to ensure they were appropriate for the fire hazards in the area.

The inspectors reviewed the installation, repair, and qualification records for a sample of penetration seals to ensure the fill material was of the appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings of significance were identified.

.4 Active Fire Protection

a. Inspection Scope

For the selected fire areas, the inspectors evaluated the adequacy of fire suppression and detection systems. The inspectors observed the material condition and configuration of the installed fire detection and suppression systems. The inspectors reviewed design documents and supporting calculations. In addition, the inspectors reviewed license basis documentation, such as, NRC safety evaluation reports, deviations from NRC regulations, and the National Fire Protection Association (NFPA) codes to verify that fire suppression and detection systems met license commitments.

b. Findings

No findings of significance were identified.

.5 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

For the selected fire areas, the inspectors verified that redundant trains of systems required for hot shutdown would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems including the effects of flooding. The inspectors conducted walkdowns of each of the selected fire areas to assess conditions, such as, the adequacy and condition of floor drains, equipment elevations, and spray protection.

b. Findings

No findings of significance were identified.

.6 Alternative Shutdown Capability

The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1), required the licensee to provide fire protection features that were capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions remained free of fire damage. Specific design features for ensuring this capability were provided in BTP CMEB 9.5-1, Section C.5.b, Paragraph (2). When compliance with the separation criteria of BTP CMEB 9.5-1, Section C.5.b, Paragraphs

(1) and

(2) could not be met, BTP CMEB 9.5-1, Section C.5.b, Paragraph

(3) and Section C.5.c, required an alternative or dedicated shutdown capability be provided that was independent of the specific fire area under consideration.

Additionally, alternative or dedicated shutdown capability must be able to achieve and maintain hot standby conditions and achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdown conditions thereafter.

a. Inspection Scope

The inspectors reviewed selected safe shutdown systems required to achieve safe shutdown to determine if the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions in accordance with the requirements discussed above. The inspectors focused on the adequacy of the systems and components to perform reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support system functions.

The inspectors also reviewed selected components whose inadvertent operation due to a fire may adversely affect post-fire safe shutdown capability. The purpose of this review was to determine if a single exposure fire in one of the fire areas could prevent the proper operation of safe shutdown components. The inspectors focused on the electrical isolation capability of selected equipment needed for post-fire safe shutdown to ensure that such equipment could be operated from the alternate shutdown emergency control station(s).

The inspectors conducted walkdowns of the selected fire area to determine if operators could reasonably be expected to perform the alternate safe shutdown procedure actions.

The review included operator training, as well as consistency between the operations shutdown procedures and any associated administrative controls.

b. Findings

Failure to Provide Required Electrical Isolation for Post-Fire Safe Shutdown Electrical Circuits

Introduction:

The inspectors identified a finding of very low safety-significance (Green)and associated NCV of the Perry Nuclear Power Plant, Unit 1, Facility Operating License Condition 2.C.(6) and 10 CFR Part 50, Appendix R, Section III.G.3, for failure to provide the required electrical isolation in the design of the post-fire safe shutdown control logic circuitry. Specifically, the control logic for the Division 1 diesel generator building ventilation fan 1M43-C001A did not have the required physical isolation to isolate control room fire-induced electrical faults when transferring control to the remote shutdown station. This is required to ensure that postulated fire-induced electrical faults would not result in the loss of post-fire alternative safe shutdown equipment. The licensees immediate corrective action was to perform a preliminary evaluation of the electrical circuitry and cables. The licensee entered this finding into their corrective action program as CR 09-60873.

Description:

The inspectors reviewed the control logic circuit for the Division 1 diesel generator building ventilation fan 1M43-C001A, shown on electrical elementary diagram B-208-135, Sheet 3, Revision Z. This fan was credited to support safe shutdown operation from the alternate shutdown station in the event of a control room fire. The design review was performed to determine compliance with the licensing and regulatory requirements to ensure that in the event of a control room fire, hot shorts, open circuits, or shorts to ground would not prevent implementation of safe shutdown. The inspectors verified if the licensee incorporated the required electrical isolation to ensure that the dedicated shutdown system was independent of the specific fire area(s).

The inspectors identified that the remote shutdown control circuitry for fan 1M43-C001A, as delineated on the design drawings, was not completely physically isolated from the control room circuitry and consequently the effects of a control room fire. This control logic did not meet the electrical independence requirements of 10 CFR Part 50, Appendix R, Section III.G.3 and III.L. The inspectors determined that upon transferring fan controls to the remote shutdown location (Division 1 diesel engine control panel 1H51-P054A), the control logic for the fan did not have the required electrical isolation, such as switch or relay contacts, to ensure that fan control circuits routed in the control room were physically independent from fan control circuits located in emergency control station 1H51-P054A.

The following specific concerns related to the fans control logic circuitry were identified:

(1) The circuit from the control room panel 1H13-P747 (conductor No. 05E) to K25 relay and to MCC EF1A08 Compartment P, Terminal 24 (conductor No. 3X2 and 42 starting coil for the fan) was not electrically isolated from the control room circuits.

(2) No documented evaluation was available for the use of a 1.5-Amp fuse (on the ground side of the fans start circuitry) for circuit isolation.

(3) Isolation circuitry for the fans start logic using relay M43-K40, contacts 11-12 and 13-14 (operate on engine speed >441 rpm) and relay 1R43-R1A, contact 13-14 (transfer switch relay) was not apparent since the same 120Vac power source (without it being fused), was used after transfer to the remote location.

(4) Use of normally open contacts 7-8, 9-10 and 11-12 of transfer switch relay 1R43-R1A in the fans control circuitry appeared not to perform any control or isolation functions after the transfer action.

The lack of isolation from potential control room fire induced faults (i.e., hot shorts, shorts to ground, open circuits) could potentially have affected the operation of this fan from the remote shutdown location following a control room fire. An analysis to assess the potential adverse effects of fire induced hot shorts, shorts to ground or open circuits on operation of fan 1M43-C001A from the remote shutdown location was not available for NRC review during the inspection. The post-fire safe shutdown analysis needed to include a review of circuit concerns to ensure that one success path of shutdown SSCs remained free of fire damage for a single fire in any single plant fire area. All circuits for which fire-induced failure could prevent safe shutdown must be addressed in the analysis and appropriate protection must be provided.

The licensees must ensure that fire protection features are provided for SSCs important to safe shutdown that are capable of limiting fire damage so that one success path necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage.

Perrys USAR Section 7.4.1.4, Remote Shutdown System (RSS), stated

(1) the RSS is designed to achieve a cold reactor shutdown from outside the control room following a postulated fire in the control room requiring control room evacuation and

(2) the Division 1 remote shutdown capability is designed to control the required shutdown systems from outside the control room irrespective of shorts, opens, or grounds in the control circuit in the control room that may have resulted from an event causing an evacuation. The functions needed for Division 1 remote shutdown control are provided with manual transfer switches at the remote shutdown panel, which override controls from the control room and transfer the controls to the RSS.

Title 10 CFR Part 50, Appendix R, Paragraph III.G.2 and NUREG 0800, require that if cables or equipment that could prevent operation or cause maloperation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions due to hot shorts, open circuits or shorts to ground are located in the same fire area, one train must be protected in accordance with the conditions of Paragraph III.G.2; OR if adequate separation of redundant trains of safe shutdown can not be achieved, then an alternate means of shutdown, independent of the area under consideration, be provided per Paragraph III.G.3. Paragraph III.G.3, requires that an alternate or dedicated shutdown capability and its associated circuits, independent of cables, systems or components in the area under consideration, shall be provided. The requirements for the alternative means are described in Appendix R, Section L. In the event of a control room fire, the power and control circuitry of one train of safe shutdown systems must be electrically and physically isolated from control room components and circuits, affected by the fire, to ensure that one train remains free of fire damage. The design must ensure that the safe shutdown capability from the alternate shutdown locations will not be adversely affected by fire induced faults.

In addition, the inspectors reviewed the licensees corrective actions to address related issues previously identified in several CRs and LERs. The inspectors determined that the engineering evaluations and Extent of Condition (EOC) reviews performed by the licensee as part of corrective action (CA) 06-11366-4 to address a similar NCV issued by the NRC during the last FP triennial inspection in report 2006006 was ineffective in identifying the inspectors finding. In addition, similar electrical circuit isolation issues were identified in Perry LER 2006-03 regarding fire induced hot shorts in the EDG logic circuits, which could result in failure to start or spuriously trip the Division 1 EDG, and in LER 2006-01 which reported a condition of an internal wiring jumper on a switch in the RSP that was found to be installed incorrectly. This resulted in lack of isolation of control room circuitry when transferring control switches to the emergency position. None of the EOC reviews performed for these LERs identified the finding identified during this inspection.

To address this finding, the licensees immediate corrective action was to initiate CR 09-60873 on June 18, 2009, to perform an evaluation of control room circuits and/or cables to determine if similar circuit isolation issues exist.

Analysis:

The inspectors determined that failure to provide appropriate electrical isolation of post-fire safe shutdown electrical circuits from the control room was contrary to the requirements of alternative shutdown capability in 10 CFR 50, Appendix R, Section L, and committed to in the Perry USAR, and was a performance deficiency. The finding was determined to be more than minor because failure to provide appropriate electrical isolation of post-fire safe shutdown electrical circuits from the control room was associated with the mitigating systems cornerstone attribute of Protection Against External Factors (Fire) and affected the cornerstones objective of ensuring the capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the control logic for the Division 1 diesel generator building ventilation fan 1M43-C001A did not have the required physical isolation to isolate control room fire-induced electrical faults when transferring controls to the remote shutdown station.

This is required to ensure that postulated fire-induced electrical faults would not result in the loss of post-fire alternative safe shutdown equipment.

In accordance with IMC 0609, Significance Determination Process, 0609.04, Phase 1 - Initial Screening and Characterization of Findings, Table 3b the inspectors determined that the finding degraded the fire protection defense-in-depth strategies. Therefore, screening under IMC 0609, Appendix F, Fire Protection Significance Determination Process, was required. Using Part 1 of the Fire Protection SDP Phase 1 Worksheet in Manual Chapter 0609, Significance Determination Process [SDP], the performance issue was determined to be in the post-fire safe shutdown category. The degradation rating was low based on FENOCs engineering evaluation of this design issue that concluded that there were no fire induced electrical faults resulting from a control room fire that would prevent the plant from achieving and maintaining a safe shutdown in the event of a control room fire.

Therefore, the finding screened as Green or of very low safety significance in the Phase 1 Worksheet.

This finding has a cross-cutting aspect in the area of problem identification and resolution because the licensee missed several past opportunities to implement effective extent of condition reviews related to lack of separation of control room circuits from alternate shutdown station circuits as documented in a number of CRs and LERs.

P.1(c)

Enforcement:

Perry Nuclear Power Plant, Unit No. 1, Facility Operating License NPF-58, Condition 2.C.(6), "Fire Protection," requires, in part, that FENOC shall implement and maintain all provisions of the approved fire protection program, as described in the FSAR, as amended, for PNPP and as approved in the Safety Evaluation Report (NUREG-0887) dated May 1982 and Supplement Nos. 1 through 10.

Perrys USAR Section 7.4.1.4, Remote Shutdown System (RSS), stated

(1) the RSS is designed to achieve a cold reactor shutdown from outside the control room following a postulated fire in the control room requiring control room evacuation; and

(2) the Division 1 remote shutdown capability is designed to control the required shutdown systems from outside the control room irrespective of shorts, opens, or grounds in the control circuit in the control room that may have resulted from an event causing an evacuation.

Contrary to the above, on June 18, 2009, the licensee failed to ensure that the alternate shutdown capability was independent of the specific fire area. Specifically, a lack of proper electrical isolation existed between the control logic circuitry in the control room panels and the control logic circuitry at the alternate shutdown station (panel 1H51-P054) located in the Division 1 diesel generator building. Because this violation was of very low safety-significance and it was entered into the licensees corrective action program as CR 09-60873, this violation is being treated as an NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy (NCV 05000440/2009007-03 (DRS)).

.7 Circuit Analyses

a. Inspection Scope

The inspectors reviewed the licensees post-fire safe shutdown analysis to verify that the licensee had identified both required and associated circuits that may impact safe shutdown. On a sample basis, the inspectors verified that the cables of equipment required achieving and maintaining hot shutdown conditions, in the event of fire in the selected fire zones, had been properly identified. In addition, the inspectors verified that these cables had either been adequately protected from the potentially adverse effects of fire damage, mitigated with approved manual operator actions, or analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. In order to accomplish this, the inspectors reviewed electrical schematics and cable routing data for power and control cables associated with each of the selected components.

In addition, on a sample basis, the adequacy of circuit protective coordination for the safe shutdown systems electrical power and instrumentation busses were evaluated.

Also, on a sample basis, a cable tray that contain both safe shutdown and non-safe shutdown cables was evaluated for proper circuit protection to ensure that cables are protected by a proper protective device in order to preclude common enclosure concerns.

b. Findings

No findings of significance were identified.

.8 Communications

a. Inspection Scope

The inspectors reviewed, on a sample bases, the adequacy of the communication system to support plant personnel in the performance of alternative safe shutdown functions and fire brigade duties. The inspectors verified that plant telephones, page systems, sound powered phones, and radios were available for use and maintained in working order. The inspectors reviewed the electrical power supplies and cable routing for these systems to verify that either the telephones or the radios would remain functional following a fire.

b. Findings

No findings of significance were identified.

.9 Emergency Lighting

a. Inspection Scope

The inspectors performed a plant walkdown of selected areas in which a sample of operator actions would be performed in the performance of alternative safe shutdown functions. As part of the walkdowns, the inspectors focused on the existence of sufficient emergency lighting for access and egress to areas and for performing necessary equipment operations. The locations and positioning of the emergency lights were observed during the walkdown and during review of manual actions implemented for the selected fire areas.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The inspectors reviewed the licensees procedures to determine whether repairs were required to achieve cold shutdown and to verify that dedicated repair procedures, equipment, and material to accomplish those repairs were available onsite. The inspectors also evaluated whether cold shutdown could be achieved within the required time using the licensee's procedures and repair methods. The inspectors also verified that equipment necessary to perform cold shutdown repairs was available onsite and properly staged.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The inspectors conducted a review to verify that compensatory measures were in place for out-of-service, degraded or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems, and equipment, passive fire barriers, pumps, valves or electrical devices providing safe shutdown functions or capabilities). The inspectors also conducted a review on the adequacy of short term compensatory measures to compensate for a degraded function or feature until appropriate corrective actions were taken.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The inspectors reviewed the licensees corrective action program procedures and samples of corrective action documents to verify that the licensee was identifying issues related to the fire protection program at an appropriate threshold and entering them in the corrective action program. The inspectors reviewed selected samples of condition reports, work orders, design packages, and fire protection system non-conformance documents.

b. Findings

No findings of significance were identified.

4OA6 Management Meetings

.1 Exit Meeting Summary

On June 26, 2009, at the conclusion of the inspection, the inspectors presented the inspection results to Mr. J. Grabner and other members of licensee management. The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

.2 Interim Exit Meetings

No interim exits were conducted.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

W. Allison, IRT

K. Baird, IRT

R. Coad, Manager - Regulatory Compliance

M. DeStefano, Training

C. Elberfeld, Supervisor - Nuclear Compliance

R. Fili, Manager - Program and Technical Services

J. Grabnar, Director - Site Engineering

T. Henderson, FENOC Regulatory Affairs

T. Hilston, Manager - Design

B. Huck, IRT

M. Makar, IRT

D. Shook, IRT

F. Smith, Manager - Emergency Planning

T. Veitch, Manager - Chemistry

L. Zerr, Engineer - Nuclear Compliance

Nuclear Regulatory Commission

M. Wilk, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000440/2009007-01(DRS) NCV Failure to Maintain Procedures for Post-Fire Operation of Control Room HVAC Fans and Control of Remote Shutdown Room Toolbox Inventory (Section 1R05.1b)

05000440/2009007-02(DRS) NCV Failure to Assure That Systems Structures and Components Necessary to Achieve And Maintain Hot Shutdown Conditions Were Free of Fire Damage Without Repair Actions (Section 1R05.2b)

05000440/2009007-03(DRS) NCV Failure to Provide Required Electrical Isolation for Post-Fire Safe Shutdown Electrical Circuits (Section 1R05.6b)

Discussed

None Attachment