IR 05000445/2008006

IR 05000445-08-006 and 05000446-08-006, on 01/28/2008 - 05/22/2008, Comanche Peak Steam Electric Station, Units 1 and 2: Triennial Fire Protection Inspection

ML081890579
Person / Time
Site:	Comanche Peak
Issue date:	07/03/2008
From:	O'Keefe N, Laura Smith NRC/RGN-III/DRS/EB2
To:	Blevins M Luminant Generation Co
References
IR-08-006
Download: ML081890579 (33)

Text

UNITED STATES NUC LE AR RE G UL AT O RY C O M M I S S I O N uly 3, 2008

SUBJECT:

COMANCHE PEAK STEAM ELECTRIC STATION, UNITS 1 AND 2 - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000445/2008006 AND 05000446/2008006

Dear Mr. Blevins:

On May 22, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Comanche Peak Steam Electric Station, Units 1 and 2. The enclosed report documents the inspection findings, which were discussed in a debrief meeting at the end of the onsite inspection on February 14, 2008, with Mr. D. A. Goodwin, Director Nuclear Operations, and other members of your staff, and again in an exit meeting conducted on May 22, 2008, with Mr. D. Kross, Plant Manager, and other members of your staff.

During this triennial fire protection inspection, the inspection team examined activities conducted under your license related to safety and compliance with the Commissions rules and regulations and the conditions of your license. The inspection consisted of a selected examination of procedures and records, observations of activities and installed plant systems, and interviews with personnel.

This report documents two NRC-identified findings. These findings were evaluated under the risk significance determination process as having very low safety significance (Green).

Because of the very low safety significance of these violations and because they were entered into your corrective action program, the NRC is treating these findings as noncited violations consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the violation or the significance of the violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U. S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U. S. Nuclear Regulatory Commission, Region IV, 612 East Lamar Boulevard, Suite 400, Arlington, Texas, 76011; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the Comanche Peak Steam Electric Station.

Comanche Peak Steam Electric Station -2-In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/ by NOKeefe for Linda J. Smith, Chief Engineering Branch 2 Division of Reactor Safety Dockets: 50-445, 50-446 Licenses: NPF-87, NPF-89

Enclosure:

NRC Inspection Report 05000445/2008006 and 05000446/2008006 w/attachment: Supplemental Information

REGION IV==

Dockets: 50-445, 50-446 License: NPF-87, NPF-89 Report: 05000445/2008006 and 05000446/2008006 Licensee: Luminant Generation Company LLC Facility: Comanche Peak Steam Electric Station, Units 1 and 2 Location: FM-56, Glen Rose, Texas Dates: January 28 through May 22, 2008 Team Leader: J. M. Mateychick, Senior Reactor Inspector, Engineering Branch 2 Inspectors: P. Qualls, Reactor Inspector, Engineering Branch 2 B. Correll, Reactor Inspector, Engineering Branch 2 R. Mullikin, Reactor Inspector, Engineering Branch 2 Accompanying Personnel: K. Sullivan, Consultant (Brookhaven National Laboratory)

Approved By: Linda Joy Smith, Chief Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

IR 05000445/2008006 and 05000446/2008006; 01/28/2008 - 05/22/2008; Comanche Peak

Steam Electric Station, Units 1 and 2: Triennial Fire Protection Inspection The report covered a 2-week period of inspection by region-based inspectors and a contractor.

The inspection identified two Green noncited violations. The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609,

"Significance Determination Process." Findings for which the significance determination process does not apply may be green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Cornerstone: Mitigating Systems

Green.

A noncited violation of Unit 1, License Condition 2.G, Fire Protection, was identified for the fire suppression systems in Fire Zones SE16 and SE18 (remote safety-related panels/Train B switchgear rooms) not being installed in accordance with the approved fire protection program. The fire suppression systems in Fire Zones SE16 and SE18 are manually actuated dry pipe deluge (pre-action) systems with closed sprinkler heads. The actual configuration did not provide protection in the areas containing one train of safe shutdown cables enclosed in 1-hour fire barriers. The team determined that the fire suppression systems in Fire Zones SE16 and SE18 were not installed in accordance with the configurations in Calculation 0210-63-0064, Partial Sprinkler Coverage Evaluation. The configurations in this calculation were approved by the NRC as the basis for allowing suppression systems with less than full area coverage. The configuration also did not meet the National Fire Protection Association codes. The licensee entered this finding into its corrective action program under Smart Form SMF-2008-000324-00.

Failure to ensure the installed fire suppression systems met the requirements of the approved fire protection program was a performance deficiency. This finding was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The significance of this finding was assessed using Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process. In completing the Fire Protection Significance Determination Process, Phase 1 and 2 worksheets, it was determined that no potential ignition source could potentially have a direct impact on the cable raceways protected by fire barriers or their supports and that the largest potential ignition sources in the fire zones could not form a hot gas layer sufficient to impact the protected cable raceways or their supports. The evaluation indicated that the finding had a very low safety significance (Green) during the Phase 2 significance determination process.

(Section 1R05.4)

Green.

A noncited violation of Technical Specification 5.4.1.d was identified concerning the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, procedures for operation of Valves 1-8000A and 1-8000B (power-operated relief valve block valves) and Valves 1-8701A and 1-8702B (residual heat removal loop hot-leg recirculation valves) had local manual actions that might not be completed successfully because of potential fire damage. Procedures ABN-804A,

Response to a Fire in the Safeguards Building, Revision 5, and ABN-806A, Response to a Fire in the Electrical and Control Building, Revision 5, directed operators to open the valves from their electrical power supplies because of potential fire damage to control circuits between the main control room and the electrical breakers. Plant operators were instructed to depress a breaker contactor to stroke the valve open. After the operator depresses the contactor, control power is required to hold the contactor closed while the valve strokes. The team identified that potential fire damage to control circuits between the main control room and the electrical breakers could cause a control power fuse to fail, preventing the valve from stroking. The licensee has entered this issue into their corrective action program as Smart Form SMF-2008-000311-00.

Failure to provide adequate procedures for the implementation of the fire protection program was a performance deficiency. This finding was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences. The significance of this finding was assessed using Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process. The evaluation determined that the procedural deficiency only affected valves required to reach and maintain cold shutdown conditions; therefore, the finding screened as having very low safety significance (Green). (Section 1R05.7)

B. Licensee-Identified Findings None.

REPORT DETAILS

1R05 Fire Protection

The inspection team evaluated the fire protection program for the Comanche Peak Steam Electric Station, Units 1 and 2, in selected risk-significant areas. The team emphasized verifying the ability of the licensee to maintain post-fire safe shutdown capability. The team used the individual plant examination for external events for the Comanche Peak Steam Electric Station to choose risk-significant areas for detailed inspection and review. Inspection Procedure 71111.05T, "Fire Protection (Triennial),"

requires selecting three to five fire areas for review. The risk-significant areas in Unit 1 selected for detailed inspection and review included:

Fire Area AA, Safety Related Chiller Area (778' EL) - Fire Zone AA153 Fire Area SB, Containment Penetration Area ( 831'-6" EL) - Fire Zone SB144 Fire Area SE, Remote Safety Related Panels / Train B Switchgear (831'-6" and 852'-6" EL) - Fire Zones SE16 & SE18 For each of these fire areas (samples), the team focused on fire protection features, systems and equipment necessary to achieve and maintain safe shutdown conditions, and satisfy licensing basis commitments.

Documents reviewed by the team are listed in the attachment.

.1 Shutdown From Outside The Main Control Room

a. Inspection Scope

In the event of fire in the main control room (Fire Area EO), the Unit 1 cable spreading room (Fire Area EN), the Unit 2 cable spreading room (Fire Area EM), or the main control room heating, ventilation, and air conditioning mechanical equipment rooms (Fire Zones 73 and 74), operators may be forced to abandon the main control room and implement an alterative shutdown capability. As part of this inspection, the team reviewed licensee documentation describing the methodology for achieving and maintaining post-fire safe shutdown conditions from outside the main control room. The principal sources of this information include: Comanche Peak Steam Electric Station Fire Protection Report, Units 1 and 2, Revision 27; Final Safety Analysis Report, Section 9.5.1, Fire Protection System; Design Basis Document ME-020, Revision 10; Fire Safe Shutdown Analysis; and Calculation ME-CA-0000-1086, AFSSA for Comanche Peak Steam Electric Station Unit 1 and Unit 2.@ The teams review focused on a verification that the licensee=s credited method of accomplishing required shutdown functions would remain available in the event of a fire.

The objectives of this evaluation were to:

(a) Verify that the licensee's shutdown methodology correctly identified the components and systems necessary to achieve and maintain a safe shutdown condition.

(b) Verify that safe shutdown can be achieved and maintained with or without the availability of off-site power.

To assure the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions, piping and instrumentation diagrams were reviewed and compared to the list of safe shutdown equipment documented in the licensee's fire safe shutdown analysis and the referenced supporting calculations. In addition, plant drawings, operating procedures, operator lesson plans, and other relevant documents were reviewed to verify the flow paths and operational characteristics of systems relied on to accomplish required safe shutdown functions. The team focused on the following functions that must be available to achieve and maintain safe shutdown conditions:

• Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

• Reactor coolant makeup capable of maintaining the reactor coolant inventory,

• Reactor heat removal capable of achieving and maintaining decay heat removal, and

• Supporting systems capable of providing other services necessary to permit extended operation of equipment necessary to achieve and maintain hot shutdown conditions.

The team verified that required shutdown functions were adequately isolated from the main control room and were capable of being controlled from the remote shutdown panel. As part of this review, the capability to transfer control from the main control room to the remote shutdown panel was reviewed to ensure that, once actuated, the isolation transfer scheme provided an adequate level of electrical isolation so that required shutdown functions would not be adversely affected as a result of fire damage in the main control room.

b. Findings

Introduction.

The team identified an unresolved item associated with Technical Specification 5.4.1.d concerning the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedure ABN-803A, Response to a Fire in the Control Room or Cable Spreading Room, Revision 8, which is used to perform an alternate shutdown, may be inadequate to assure that the charging pump relied on for achieving post-fire safe shutdown would not be damaged because of a loss of suction. During an alternate shutdown, the charging pump is

necessary to support the reactivity control and reactor coolant makeup functions by providing borated water from the refueling water storage tank.

Description.

During normal plant operations, the chemical and volume control system normally operates to allow a continuous feed (charging and seal injection) and bleed (letdown and seal leak-off) for the reactor coolant system. Normally one centrifugal charging pump is in operation.

In the event of fire in the main control room or cable spreading room, inventory makeup is intended to be accomplished using the Train A centrifugal charging pump with the refueling water storage tank as a source of borated water makeup.

Procedure ABN 803A included procedural steps to establish a suction path from the refueling water storage tank to the charging pumps. However, the inspection team determined that if the charging pump credited for safe shutdown was running at the time of the fire, a spurious closure of one of the two series-connected volume control tank outlet valves (1-LCV-112B or 1-LCV-112C) prior to successfully opening one of the refueling water storage tank outlet valves would result in a loss of suction and damage to the credited charging pump.

The refueling water storage tank to Charging Pump Suction Valves 1-LCV-0112D and 1-LCV-0112E are motor-operated isolation valves and are connected in parallel to the suction of the charging pumps. Each valve is controlled from a switch on Panel CB-06 in the main control room. Prior to evacuating the main control room and establishing control at the remote shutdown panel, operators are directed in Section 2.3, Step 4(g), of Procedure ABN-803A, to open refueling water storage tank Suction Valves 1-LCV-112D and 1-LCV-112E. However, these actions are not credited because they were not approved by the NRC, since the time available to perform actions prior to evacuating the control room may be very limited. From a review of related wiring diagrams, the inspection team determined that the occurrence of a single short to ground for each valve could preclude the success of this step. In addition, although the procedure includes a back-up action outside the main control room to ensure refueling water storage tank Suction Valve 1-LCV-112E is open, this step was not performed for at least 20 minutes, based on the teams observations during a walk-through of the procedure.

Analysis.

Failure to ensure that Procedure ABN-803 contained sufficient instructions to ensure that the Train A centrifugal charging pump would be available in a control room evacuation was potentially a performance deficiency. The team determined that this finding was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

Volume control tank outlet Valves 1-LCV-0112B and 1-LCV-0112C are motor-operated valves connected in series in the line from the volume control tank to the charging pumps. In the main control room, each valve is controlled from a switch located on the same panel (CB-06) as the refueling water storage tank suction valve switches. Should either of the volume control tank outlet valves spuriously close during the time prior to successfully opening one of the refueling water storage tank suction valves, the

operating charging pump could be damaged. If the credited charging pump is in operation and is damaged, operators may not be able to achieve the reactivity control and reactor coolant makeup functions required for post-fire safe shutdown using the protected train.

The team initiated an evaluation of this finding using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. However, additional analysis, to be performed by a senior reactor analyst, is needed to determine the safety significance of this issue. The licensee has entered this issue into their corrective action program as Smart Form SMF-2008-000488-00.

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure ABN-803A, Response to a Fire in the Control Room or Cable Spreading Room, Revision 8, implements this requirement for fires requiring the main control room to be evacuated. The team was concerned that procedural guidance may have been inadequate to prevent damage to the protected centrifugal charging pump if it was in operation at the time of a fire requiring an evacuation of the main control room.

Pending completion of additional analyses to determine if a credible fire scenario exists for this concern and to determine the safety significance of this finding, this issue is being treated as an unresolved item: URI 05000445; 446/2008006-01, Inadequate Post-Fire Safe Shutdown Procedure.

.2 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the fire safe shutdown analysis to verify whether the shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the fire areas selected for review. The team also reviewed and observed walkdowns of the procedures for achieving and maintaining safe shutdown in the event of a fire to verify that the fire safe shutdown analysis provisions were properly implemented. The team focused on the functions required to achieve and maintain post-fire safe shutdown conditions.

For each of the selected fire areas, the team reviewed the adequacy of separation and protection provided for redundant trains of cables and equipment required to achieve and maintain hot shutdown conditions. The results of this evaluation were then compared to the licensee=s methodology for meeting the requirements of 10 CFR 50.48, as described in its approved fire protection program.

On a sample basis, the team verified that systems and equipment identified by the licensee as being required to achieve and maintain hot shutdown conditions would remain free of fire damage in the event of a fire in the selected fire areas. Specifically, the team examined the adequacy of electrical independence, physical separation and fire protection features provided for cables and equipment needed to assure the operation of systems that are relied on to achieve and maintain safe shutdown conditions in the event of a fire. The evaluation included a review of cable routing data for a sample of components. The specific components selected for review are delineated in the attachment.

On a sample basis, the team also reviewed the adequacy of electrical protective devices (e.g., circuit breakers, fuses, and relays), coordination, and the adequacy of electrical protection provided for nonessential cables which share a common enclosure with cables of equipment required to achieve and maintain safe shutdown conditions.

Additionally, the team reviewed the protection of diagnostic instrumentation required for safe shutdown for fires in the selected areas.

b. Findings

Introduction.

The team identified an unresolved item concerning the possible failure to implement the approved fire protection program. Specifically, the team identified that the licensees fire protection program relied upon local manual actions to mitigate the effects of potential fire damage to equipment required to achieve and maintain safe hot shutdown conditions, rather than ensuring one train of the required equipment was free from fire damage as specified in the approved fire protection program.

Description.

The team reviewed a sample of three fire areas in Unit 1, which do not require evacuation of the main control room during the shutdown. The team reviewed the approved fire protection program as defined in License Condition 2.G and determined that one train of equipment required to achieve and maintain hot shutdown is required to be free from fire damage. The team noted that the approved fire protection program allows local manual actions to respond to spurious operations of equipment other than that required for safe shutdown which could impact the safe shutdown.

The team conducted walkdowns with licensee operations personnel of Procedures ABN-804A, Response To a Fire In The Safeguards Building, Revision 5, and ABN-806A, Response To a Fire In The Electrical and Control Buildings, Revision 5. The team found that the fire protection program, as implemented, relied on the use of local manual actions to align and control equipment required to achieve and maintain hot shutdown instead of assuring that one train was free from fire damage. This approach expanded the use of local operator manual actions outside of the control room beyond the response to spurious operations allowed in the approved fire protection program.

The team concluded that the licensees fire protection program, as implemented, provided less physical separation and protection from the affects of fire than the approved program required, and is inherently less reliable than ensuring that one train of the required systems are free from fire damage.

An example of this concern is the licensees treatment of air-operated valves (AOVs) in the charging and auxiliary feedwater systems, which are required to perform the reactor coolant inventory control and decay heat removal functions, respectively. The licensee did not designate the instrument air system as a required support system and ensure it would remain free of fire damage, so air may not be available to operate these AOVs.

Consistent with this approach, the licensee did not protect the circuits required to operate these AOVs from fire damage. These AOVs are required to be operable from the control room to reach and maintain hot shutdown. Instead, the licensee relied on local manual actions outside of the control room to de-energize the AOVs to their failed positions, and in the case of the turbine driven auxiliary feedwater pump, to then control the turbine manually. Additional local manual actions are required to position other valves to compensate for the loss of control of the AOVs.

This issue was discussed extensively with the license and the Office of Nuclear Reactor Regulation, and the staff has concluded that the NRC did not approve manual actions in lieu of protection for equipment required for safe shutdown. The licensee disagreed with the teams interpretation of the fire protection program requirements and believed the program complies with their license condition.

Analysis.

Failure to ensure that one train of the systems required for hot shutdown is free from fire damage was a performance deficiency. The team determined that this finding was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The team initiated an evaluation of this finding using the significance determination process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. However, additional analysis, to be performed by a senior reactor analyst, is needed to determine the safety significance of this issue. Additional information will be required from the licensee concerning the extent of the condition in order to assess the significance.

The team used the guidance in Inspection Procedure 71111.05T to assess whether the manual actions could be reliability completed. Walkthroughs of the manual actions specified for the fire areas selected as samples for the inspection were conducted with qualified plant operators. These operators were able to perform all actions using the current plant procedures. The team determined that the sample of manual actions were reasonable and feasible in accordance with the guidance in Inspection Procedure 71111.05T, and are therefore an acceptable compensatory measure.

Therefore, this finding does not present an immediate safety concern.

Enforcement:

The approved fire protection program, as defined in License Condition 2.G for Unit 1, requires one train of equipment needed for establishing and maintaining hot shutdown to be free from fire damage. The team was concerned that the licensee failed to properly implement the approved fire protection program.

Specifically, the licensee relied on the use of local operator manual actions to operate components required to achieve and maintain safe hot shutdown conditions in lieu of protecting one train of equipment required for safe shutdown. The team was concerned that the licensees fire protection program, as implemented, may have provided less physical separation and protection from the affects of fire than required by the approved fire protection program.

Pending completion of additional analyses to determine the extent of condition and the safety significance of this finding, this issue is being treated as an unresolved item:

URI 05000445;446/2008006-02, Unapproved Local Manual Actions For Hot Shutdown.

.3 Passive Fire Protection

a. Inspection Scope

.

For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, fire doors, electrical raceway fire barriers and fire rated electrical cables. The team observed the material condition and configuration of the installed barriers, seals, doors, and cables. The team compared the installed configurations to the approved construction details and supporting fire tests. In addition, the team reviewed license documentation such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association (NFPA) codes to verify that fire protection features met license commitments.

b. Findings

No findings of significance were identified.

.4 Active Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy and material condition of fire suppression and detection systems. The team reviewed design documents and supporting calculations for these systems. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the NFPA codes to verify that fire suppression and detection systems met license commitments.

The team also observed an announced site fire brigade drill and the subsequent drill critique using the guidance in Inspection Procedure 71111.05AQ. The fire brigade simulated fighting an oil fire in the oil storage area of the Fuel Building 810-6" elevation.

Team members observed the fire brigade simulate fire fighting activities in the plant.

The inspectors verified that the licensee staff identified deficiencies; openly discussed them in a self-critical manner at the drill debrief, and took appropriate corrective actions.

Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient fire fighting equipment brought to the

scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other plant areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) completion of drill objectives.

b. Findings

Introduction.

The team identified a Green noncited violation of Unit 1 License Condition 2.G. Specifically, the fire suppression systems installed in Fire Zones SE16 and SE18 (remote safety related panels/Train B switchgear rooms) were not installed in accordance with the approved fire protection program.

Description.

The fire suppression systems in Fire Zones, SE16 and SE18 are manually actuated dry pipe deluge (preaction) systems with closed sprinkler heads. During plant walkdowns, the team noted that the fire suppression systems did not provide protection in the vicinity of one train of safe shutdown cables. These safe shutdown cables were protected by 1-hour fire barriers, so they are required by the fire protection program to have fire suppression coverage. The team also noted that the configuration of the fire suppression systems in Fire Zones SE16 and SE18 did not meet the requirements of NFPA 13 and 15.

Section 6.3.5 of Section II of the Fire Protection Report stated that manually actuated preaction sprinkler systems are installed to provide floor area and/or concentrated cable tray coverage in the electrical equipment rooms and cable spreading rooms, including Fire Zones SE16 and SE18. This section also stated that the water suppression systems would be installed in accordance with NFPA 13 or 15. The NRC approved these suppression systems with less than full area coverage based on the configuration described and evaluated in Calculation 0210-63-0064.

Circuits required for safe shutdown are routed through Fire Zones SE16 and SE18 in cable trays and conduits protected by 1-hour fire barriers. The supports for these cable raceways are unprotected. The team identified that the installed configuration of the fire suppression systems in Fire Zones SE16 and SE18 do not provide coverage in the areas of cable raceways protected with 1-hour fire barriers and their unprotected supports as required be the approved fire protection program. Additionally, the partial coverage manually actuated suppression systems do not meet NFPA codes, which would be another method of compliance. The licensee entered this finding into its corrective action program under Smart Form SMF-2008-000324-00.

Analysis:

Failure to ensure that the installed fire suppression systems meet the requirements of the approved fire protection program was a performance deficiency.

The team determined that this deficiency was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The team used Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process and evaluated the finding under the fixed fire protection

systems category with a high degradation rating. The circuits in Fire Zones SE16 and SE18, which are required for post-fire safe shutdown are routed in cable raceways protected by 1-hour fire barriers with unprotected supports, and do not have sprinkler coverage. In completing the fire protection Significance Determination Process, Phase 1 and 2 worksheets, the team determined that no potential ignition source could potentially have a direct impact on the protected cable raceways or their supports. The team determined that the largest potential ignition sources in the fire zones could not form a hot gas layer sufficient to impact the protected cable raceways or their supports using the spreadsheet, Predicting Hot Gas Layer Temperature in a Room Fire With Forced Ventilation, contained in NUREG-1805, Fire Dynamics Tools (FDT)

Quantitative Fire Hazard Analysis Methods for the U.S. Nuclear Regulatory Commission Fire Protection Inspection Program. Based on these evaluations, the finding screened as having very low safety significance (Green) during the Phase 2 significance determination.

Enforcement:

License Condition 2.G for Unit 1 states, in part, that the Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the safety evaluation report (NUREG-0797)and its supplements through Supplemental Safety Evaluation Report 24. The approved fire protection program included the installation of fire suppression systems with less than full area coverage in some areas of the plant, including Fire Zones SE16 and SE18, as documented in Supplemental Safety Evaluation Report 21. The partial area suppression systems were accepted by the NRC staff based on the system configurations and fire area evaluations provided in Calculation 0210-063-0064, Partial Sprinkler Coverage Evaluation.

Contrary to the above, the licensee failed to implement the provisions of the approved fire protection program. Specifically, the partial coverage fire suppression systems installed in Fire Zones SE16 and SE18 did not provide coverage as approved by the NRC, and are also not in compliance with NFPA 13 and 15. Because this finding is of very low safety significance and has been entered into the corrective action program, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000445/2008006-03, Inadequate Fire Suppression Systems.

.5 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

For the sample areas, the team verified that redundant trains of systems required for hot shutdown were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems including the effects of flooding.

The team also verified that where redundant trains of systems were located in the same fire area, the electrical cables of one train were protected from the affects of fire suppression activities.

b. Findings

No findings of significance were identified.

.6 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the licensee's alternative shutdown methodology to determine if the licensee properly identified the components, systems, and instrumentation necessary to achieve and maintain safe shutdown conditions from the remote shutdown panel and alternative shutdown locations. The team focused on the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring and support system functions. The team verified that hot and cold shutdown from outside the control room could be achieved and maintained with offsite power available or not available. The team verified that the transfer of control from the control room to the alternative locations was not affected by fire-induced circuit faults by reviewing the provision of separate fuses for alternative shutdown control circuits.

The team also reviewed the operational implementation of the licensee's alternative shutdown methodology. Team members observed a walk-through of the control room evacuation procedures with both licensed reactor operators and non-licensed equipment operators. The team observed operators simulate performing the steps of Procedure ABN-803A, Response to a Fire in the Control Room or Cable Spreading Room," which provided instructions for performing an alternative shutdown from the Unit 1 dedicated remote shutdown panel and for manipulating equipment in the plant.

The team verified that the minimum number of available operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable time requirements and that equipment labeling was consistent with the procedure. Also, the team verified that procedures, tools, dosimetry, keys, lighting, and communications equipment were available and adequate to support successfully performing the procedure as intended. The team reviewed records for operator training conducted on this procedure.

b. Findings

Introduction.

The team identified an unresolved item associated with Technical Specification 5.4.1.d concerning the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedure ABN-803A, Response to a Fire in the Control Room or Cable Spreading Room, which is used to perform an alternate shutdown, appeared to have two examples of critical actions that could not be completed in the time required by design documents.

Description.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Alternate shutdown at the Comanche Peak Steam Electric Station requires operators to safely shutdown the plant in accordance with Procedure ABN-803A for Unit 1.

The team performed a walkthrough of Procedure ABN-803A for a simulated fire in either the control room or cable spreading room that required operators to shutdown the plant using manual actions and controls at the remote shutdown panel. Attachment 13 of Procedure ABN-803A specified the maximum allowable times to complete certain actions. The team noted during the timed walkthrough by operators that the following actions could not be performed within the required times.

Example 1 - Spurious Opening of the Train A Power Operated Relief Valve A fire in either the main control room or cable spreading room could result in a power operated relief valve spuriously opening. To close the Train A and B power operated relief valves, a relief reactor operator would, in accordance with Attachment 2 of Procedure ABN-803A, transfer control of the power operated relief valves from the main control room to the remote shutdown panel. When this is accomplished, the fire induced hot short would be isolated and the power operated relief valve would return to its closed position. According to Attachment 13 of Procedure ABN-803A, this action must be completed within 5 minutes to avoid empting the pressurizer.

Step d of Attachment 2 instructed the relief reactor operator to transfer control of 46 switches at the transfer panel from the main control room to the remote shutdown panel. The team timed the completion of all 46 transfer switches to be 7 minutes, and 24 seconds. The team estimated that the transfer of the Train A power operated relief valve would occur at approximately 6 minutes. Attachment 2, Step c, stated that the transfer of the 46 switches cannot be started until communication has been established with the reactor operator at the remote shutdown panel.

The team determined from the walkthrough that the reactor operator performing 1 would not reach the remote shutdown panel until 4 minutes and 26 seconds after the reactor was tripped. Thus, the relief reactor operator could not procedurally start the transfer switch process until 4 minutes and 26 seconds, which delayed these actions. The team estimated that the Train A power-operated relief valve would not be closed until 8 minutes 26 seconds after the reactor trip, which exceeded the 5 minute requirement in Procedure ABN-803A.

Example 2 - Loss of Station Service Water Cooling to the Emergency Diesel Generators A fire in either the main control room or cable spreading room could result in a loss-of-offsite power with the subsequent automatic start of both emergency diesel generators.

In addition, the fire could also cause damage to the circuits of the station service water system resulting in the loss of cooling to the emergency diesel generators.

Procedure ABN-803A, Attachment 1, Step f, instructs the reactor operator to initiate station service water at the remote shutdown panel if it is not operating. The team timed the completion of this step at 12 minutes and 7 seconds. Attachment 13 states that station service water must be initiated within 7 minutes.

In Procedure ABN-803A, Attachment 2, step f, the relief reactor operator transfers the Train A emergency diesel generator controls to LOCAL. If the emergency diesel generator had undergone an emergency start from standby, the automatic high temperature trip would be bypassed. The relief reactor operator should recognize at this step that station service water cooling was not available and shut down the running emergency diesel generator at 9 minutes and 45 seconds.

The licensee provided the team Evaluation 2003-000404-01-00, which analyzed the effects of the loss of station service water cooling on emergency diesel water jacket water temperature. The analysis determined that during the summer, if the emergency diesel generator emergency starts from standby with a load of 6.3 MW, the time to failure of the emergency diesel generator would be 4 minutes, and 4 seconds. The time to failure without cooling water under the expected load under these circumstances has not been previously analyzed.

Fire damage resulting in the automatic starting of the credited emergency diesel generator without starting the required station service water cooling could result in the loss of the electrical power supply credited for post-fire safe shutdown since the procedure removes offsite power.

Analysis.

Failure to provide adequate procedural guidance to implement the requirements of the approved fire protection program was potentially a performance deficiency. The team determined that this deficiency was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The team initiated an evaluation of this finding using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. However, additional analysis, performed by senior reactor analyst, is needed to determine the safety significance of this issue. As a compensatory measure, the licensee issued night orders to alert operators of these procedural concerns and has entered this issue into their corrective action program as Smart Form SMF-2008-000300.

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure ABN-803A, Response to a Fire in the Control Room or Cable Spreading Room, implemented the requirements for fires when the main control room must be evacuated. The maximum times for operators to align the systems used for hot shutdown and to respond to spurious actuations due to fire damage were listed in Engineering Report ENR-2005-000316-01-00, Thermal/Hydraulic Analysis of the Fire Safe Shutdown Scenario, Revision 0.

The team was concerned that the procedural guidance provided was not adequate to allow operators to successfully perform required post-fire safe shutdown manual operations as required in the approved fire protection program. Specifically, inadequate

procedural guidance was provided for the timely closure of a spuriously open power operated relief valve and to prevent potential damage to the required emergency diesel generator if fire damage starts the emergency diesel generator without service water cooling available. This finding could impact the ability to control reactor coolant system inventory and pressure and assure an electrical power supply to support the safe shutdown operations.

Pending completion of additional analyses to determine the safety significance of this finding and to determine whether a credible fire scenario exists for these examples, this issue is being treated as an unresolved item: URI 05000445;446/2008006-04, Inadequate Alternative Shutdown Procedure.

.7 Circuit Analyses

a. Inspection Scope

The team reviewed the licensee=s Fire Safe Shutdown Analysis to verify that the licensee had identified circuits that may impact safe shutdown. On a sample basis, the team verified that cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in selected fire zones had been properly identified. In addition, the team verified that these cables had either been adequately protected from the potentially adverse effects of fire damage, mitigated with approved manual operator actions, or analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. In order to accomplish this, the team reviewed electrical schematics and cable routing data for power and control cables associated with each of the selected components. On a sample basis, the team also verified the adequacy of fusing provided for items controlled from the remote shutdown panel and the accuracy of cable information included in the licensee=s computerized database (Genesis).

In addition, on a sample basis, the adequacy of circuit protective coordination for safe shutdown power sources was evaluated. The specific power sources selected for review included: 6.9kV Switchgear 1EA2, 480Vac Engineered Safety Features Load Center 1EB3-3, 120Vac Vital Bus 1PC1, and 125Vdc Switchboard 1ED2. Also, on a sample basis, the adequacy of electrical protection provided for non-essential cables that share a common enclosure with cables for required shutdown equipment was reviewed to ensure that the non-essential cables are adequately protected to preclude common enclosure concerns.

b. Findings

Introduction.

The team identified a Green noncited violation of Technical Specification 5.4.1.d concerning the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedures ABN-804A, Response to a Fire in the Safeguards Building, and ABN-806A, Response to a Fire in the Electrical and Control Building, each had an example of a local manual action that might not be completed successfully because of fire damage.

Description.

Technical Specification 5.4.1.d states, "Written procedures shall be established, implemented, and maintained covering the fire protection program implementation. Procedure ABN-804A, Response to a Fire in the Safeguards Building, directs operators to open Valve 1-8000B, Pressurizer 1-01 Power-Operated Relief Valve 0456 Block Valve. Procedure ABN-806A, Response to a Fire in the Electrical and Control Building, directs operators to open Valve 1-8701A, residual heat removal Loop 1 hot leg recirculation valve. Both valves are required to be opened from their electrical power supplies because of potential fire damage to control circuits between the main control room and the electrical breakers. The operators are instructed to depress a breaker contactor to stroke the valve open. The expected response is that the contactor will remain in the depressed position as the valve strokes open.

This method of stroking a motor operated valve relies on portions of the control circuits for the valve functioning normally. After the operator depresses the contactor, control power is required to hold the contactor closed while the valve strokes. All control power for a valve is provided from its electrical breaker via one set of fuses. The team identified that if fire damage to control circuits between the main control room and the electrical breakers causes a control power fuse to fail, the valve will not stroke as intended.

The licensee conducted an extent of condition review and identified that this same method of operation is also used to open Valve 1-8000A, Pressurizer 1-01 PORV 0455A block valve, and Valve 1-8702B, residual heat removal Loop 4 hot leg recirculation valve. The licensee entered this issue into their corrective action program as Smart Form SMF-2008-000311-00.

Analysis.

Failure to provide adequate procedural guidance to implement the requirements of the approved fire protection program was a performance deficiency.

The team determined that this deficiency was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The team evaluated this finding using the Significance Determination Process, Phase 1 screening worksheet for the Initiating Events, Mitigating Systems, and Barriers Cornerstones, provided in Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings." For this finding, Table 3b directs the user to Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. The team evaluated this issue using the fire protection Significance Determination Process, Phase 1 worksheet, Attachment 1 to Manual Chapter 0609, Appendix F.

The performance deficiency was categorized as affecting post-fire safe shutdown. Since the procedures did not adequately address the potential fire damage to the control circuits, the operators were not provided information on how to identify the problem or alternative steps to deal with the situation. Therefore, the team considered the deficiency to have a high degradation rating. The four valves involved with these

procedural instructions were not required to be opened to achieve and maintain post-fire safe hot shutdown conditions. Valves 1-8000A and 1-8000B (power-operated relief valve block valves) are opened during the transition from hot shutdown to cold shutdown. The flow paths allow the operators to cycle a power-operated relief valve to increase the rate of reactor coolant system depressurization if desired. Valves 1-8701A and 1-8702B (residual hear removal loop hot leg recirculation valves) are opened to align their respective residual hear removal loop for operation. Therefore, the team concluded that the procedural deficiency only affected the ability to reach and maintain cold shutdown conditions. The finding screened to Green in accordance with Significance Determination Process, Phase 1, Task 1.3.1, Qualitative Screening for All Finding Categories.

Enforcement.

Technical Specification 5.4.1.d states: Written Procedures shall be established, implemented and maintained covering the following activities: d. Fire Protection Program Implementation. The fire protection program implementation includes a series of procedures providing operators with instructions to respond to fires in various locations and achieve post-fire safe shutdown. The instructions were required to ensure operators could successfully perform a safe shutdown in the event of a fire.

Contrary to the above, the licensee provided operators inadequate procedural instructions used to implement the fire protection program for the operation of four valves. Instructions in Procedures ABN-804A and ABN-806A did not account for the affects of potential fire damage to control circuits for Valves 1-8000A, 1-8000B, 1-8701A and 1-8702B, which could prevent safe shutdown. Because this finding is of very low safety significance and has been entered into the licensees corrective action program, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000445; 446/2008006-05, Inadequate Post-Fire Safe Shutdown Procedures.

.8 Communications

a. Inspection Scope

The team verified through inspection of the contents of designated emergency storage lockers and review of emergency control station alternative shutdown procedures, that the portable communication equipment was available, operable, and adequate for alternative shutdown procedure performance. The inspection considered communication issues, such as ambient noise levels, clarity of reception, reliability, and coverage patterns.

b. Findings

No findings of significance were identified.

.9 Emergency Lighting

a. Inspection Scope

The team reviewed emergency lighting systems to verify it was adequate for the manual actions required to achieve and maintain hot shutdown conditions, and for illuminating access and egress routes to the areas where manual actions are required.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed licensee procedures to determine whether repairs were required to achieve cold shutdown and to verify that the repair material was available on the site.

The team verified that the licensee had pre-staged equipment necessary to perform the repairs as required by procedure. The team also evaluated whether cold shutdown could be achieved within the required time using the licensee's procedures and repair methods.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The team reviewed the licensees implementation of compensatory measures in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems or features.

The team reviewed Procedures STA-722, Fire Protection Program; STA-723, Fire Protection Systems/Equipment Requirements; and STA-738, Fire Protection/

Systems/Equipment Impairments, to determine whether the procedures adequately controlled compensatory measures for fire protection systems, equipment and features (e.g., detection and suppression systems and equipment, and passive fire barriers).

The team reviewed Procedure STA-604, Configuration Risk Management and Work Scheduling, and Instruction Number WCI-203, Weekly Surveillances/Work Scheduling, to determine whether the procedures adequately controlled compensatory measures for out-of-service, degraded, or inoperable post-fire safe shutdown equipment, systems or features.

b. Findings

No findings of significance were identified.

4OA2 Problem Identification and Resolution

a. Inspection Scope

The team reviewed a sample of smart forms associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. In addition the team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies.

b. Findings

No findings of significance were identified.

4OA5 Other Activities

a. Inspection Scope

The team reviewed the licensees response to Generic Letter 2006-03, Potentially Nonconforming Hemyc and MT fire Barrier Configurations, dated April 10, 2006.

The licensee responded by letter dated December 20, 2007. The licensees response indicated that Hemyc was used only as a radiant energy shield inside containment.

The team reviewed licensee evaluation ER-ME-128, Qualification of Hemyc Fire Barrier Material for Use as a Radiant Energy Shield, Revision 0, dated December 19, 2007.

The team found that the evaluation was adequate to demonstrate that the material, as applied at Comanche Peak Steam Electric Station, would meet the requirements for a radiant energy shield in containment.

b. Findings

No findings of significance were identified.

4OA6 Management Meetings

Debrief Meeting Summary On February 14, 2008, the team leader presented the inspection results to Mr. F.W.

Madden, Director, Nuclear Oversight and Regulatory Affairs, and other members of licensee management. The team destroyed or returned all proprietary information reviewed during the inspection to the licensee.

Exit Meeting Summary

The team leader presented the inspection results to Mr. D. Kross, Plant Manager, and other members of licensee management at the conclusion of the inspection in a conference call on May 22, 2008.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee

K. Apple, Fire Protection Supervisor

H. Beck, Fire Safe Shutdown Analysis Engineer (Consultant)

J. Boatwright, Westinghouse Engineering Services Manager

C. Dupre, Engineering Liaison

D. Goodwin, Director Nuclear Operations

A. Hall, Operations Support Manager

M. Hanley, Engineering Projects

J. Hicks, Principle Licensing Engineer

T. Hope, Nuclear Licensing Manager

S. Karpyak, Probabilistic Risk Analysis Supervisor

G. Krishnan, Procurement Engineering and Engineering Programs Manager

D. Kross, Plant Manager

F. Madden, Director, Oversite and Regulatory Affairs

B. Mays, Director, Engineering Support

J. Meyer, Technical Support Manager

D. Moore, Director, Shaw Engineering and Technical Services

K. Parkinson, Fire Protection (Consultant)

P. Passalugo, Engineering Programs Lead

J. Patton, Quality Assurance Supervisor

M. Pearson, Quality Assurance Manager

R. Plunkett, Fire Protection Engineer

J. Singh, Fire Protection Engineer/Program Engineer

J. Stone, Operations Procedure Supervisor

G. Struble, Operations Training Manager

C. Tran, Manager Nuclear Engineering Programs

M. Wisdom, Systems Engineering

L. Zimmerman, Manager, Modification Projects

NRC

D. Allen, Senior Resident Inspector

C. Johnson, Chief, Project Branch A

A. Klein, Chief, Fire Protection Branch

D. Frumkin, Team Leader, Fire Protection Branch

-1- Attachment

LIST OF ITEMS

OPENED AND CLOSED

Opened

05000445;446/2008006-01 URI Inadequate Post-Fire Safe Shutdown Procedure (Section 1R05.1)

05000445;446/2008006-02 URI Unapproved Local Manual Actions For Hot Shutdown (Section 1R05.2)

05000445;446/2008006-04 URI Inadequate Alternative Shutdown Procedure (Section 1R05.6)

Opened and Closed

05000445/2008006-03 NCV Inadequate Fire Suppression Systems (Section 1R05.4)

05000445;446/2008006-05 NCV Inadequate Post-Fire Safe Shutdown Procedures (Section 1R05.7)