IR 05000445/2009004

IR 05000445-09-004 & 05000446-09-004 on 06/21/09 - 09/19/09 for Comanche Peak

ML093000301
Person / Time
Site:	Comanche Peak
Issue date:	10/27/2009
From:	Walker W C NRC/RGN-IV/DRP/RPB-A
To:	Flores R Luminant Generation Co
References
IR-09-004
Preceding documents:	ML100490992 (18 February 2010)
Download: ML093000301 (50)

Text

October 27, 2009

Rafael Flores, Senior Vice President and Chief Nuclear Officer Luminant Generation Company, LLC Comanche Peak Steam Electric Station P.O. Box 1002 Glen Rose, TX 76043 Subject: COMANCHE PEAK STEAM ELECTRIC STATION - NRC INTEGRATED INSPECTION REPORT 05000445/2009004 AND 05000446/2009004

Dear Mr. Flores:

On September 19, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Comanche Peak Steam Electric Station. The enclosed integrated inspection report documents the inspection findings, which were discussed on October 1, 2009, with you and other members of your staff. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents six NRC-identified findings of very low safety significance (Green).

These findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these findings as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the noncited violations or the significance of the noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E. Lamar Blvd, Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the Comanche Peak Steam Electric Station facility. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at the Comanche Peak Steam Electric Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305. Luminant Generation Company, LLC - 2 - In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, and its enclosure, will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,/RA/ Wayne C. Walker, Chief Project Branch A Division of Reactor Projects Docket: 50-445: 50-446 License: NPF-87; NPF-89

Enclosure:

NRC Inspection Report 05000445/2009004 and 005000446/2009004 w/Attachment 1: Supplemental Information w/Attachment 2: Results of the Staff's Review of Manual Actions in the Licensing Basis cc w/

Enclosure:

Mike Blevins, Chief Operating Officer Luminant Generation Company LLC Comanche Peak Steam Electric Station P.O. Box 1002 Glen Rose, TX 76043 Mr. Fred W. Madden, Director Regulatory Affairs Luminant Generation Company LLC P.O. Box 1002 Glen Rose, TX 76043 Timothy P. Matthews, Esq. Morgan Lewis 1111 Pennsylvania Avenue, NW Washington, DC 20004 County Judge P.O. Box 851 Glen Rose, TX 76043 Luminant Generation Company, LLC - 3 - Mr. Richard A. Ratliff, Chief Bureau of Radiation Control Texas Department of Health P.O. Box 149347, Mail Code 2835 Austin, TX 78714-9347 Environmental and Natural Resources Policy Director Office of the Governor P.O. Box 12428 Austin, TX 78711-3189 Mr. Brian Almon Public Utility Commission William B. Travis Building P.O. Box 13326 Austin, TX 78711-3326 Ms. Susan M. Jablonski Office of Permitting, Remediation and Registration Texas Commission on Environmental Quality MC-122 P.O. Box 13087 Austin, TX 78711-3087 Anthony Jones Chief Boiler Inspector Texas Department of Licensing and Regulation Boiler Division E.O. Thompson State Office Building P.O. Box 12157 Austin, TX 78711 Chief, Technological Hazards Branch FEMA Region VI 800 North Loop 288 Federal Regional Center Denton, TX 76209

Luminant Generation Company, LLC - 4 - Electronic distribution by RIV: Regional Administrator (Elmo.Collins@nrc.gov) Deputy Regional Administrator (Chuck.Casto@nrc.gov) DRP Director (Dwight.Chamberlain@nrc.gov) DRP Deputy Director (Anton.Vegel@nrc.gov)

DRS Director (Roy.Caniano@nrc.gov) DRS Deputy Director (Troy.Pruett@nrc.gov) Senior Resident Inspector (John.Kramer@nrc.gov) Resident Inspector (Brian.Tindell@nrc.gov) Senior Project Engineer (Bob.Hagar@nrc.gov)

Branch Chief, DRP/A (Wayne.Walker@nrc.gov) CP Site Secretary (Sue.Sanner@nrc.gov) Public Affairs Officer (Victor.Dricks@nrc.gov) Branch Chief, DRS/TSB (Michael.Hay@nrc.gov) RITS Coordinator (Marisa.Herrera@nrc.gov) Regional Counsel (Karla.Fuller@nrc.gov) Congressional Affairs Officer (Jenny.Weil@nrc.gov)

OEMail Resource DRS STA (Dale.Powers@nrc.gov) OEDO RIV Coordinator (Leigh.Trocine@nrc.gov) ROPreports

File located:R:\_REACTORS\_CPSES\CP 2009004 RP-JGK.doc ML#093000301 SUNSI Rev Compl. Yes No ADAMS Yes No Reviewer Initials Publicly Avail Yes No Sensitive Yes No Sens. Type Initials SRI:DRP/A RI/DRP/A C:DRS/OB C:DRS/PSB1 C:DRS/PSB2 JKramer BTindell RLantz MShannon GWerner

/RA/ /RA/ /RA/ /RA/ /RA/ 10/26/09 10/26/09 10/19/09 10/20/09 10/20/09 C:DRS/EB1 C:DRS/EB2 C:DRP/A C:DRP/A RLKellar NO'Keefe WWalker RHagar

/RA/ /RA/ /RA/ /RA/ 10/19/09 10/19/09 10/27/09 10/27/09 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax Enclosure U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 50-445, 50-446 License: NPF-87, NPF-89 Report: 05000445/2009004 and 05000446/2009004 Licensee: Luminant Generation Company LLC Facility: Comanche Peak Steam Electric Station, Units 1 and 2 Location: FM-56, Glen Rose, Texas Dates: June 21 through September 19, 2009 Inspectors: J. Kramer, Senior Resident Inspector B. Tindell, Resident Inspector P. Elkmann, Senior Emergency Preparedness Inspector R. Hagar, Senior Project Engineer J. Mateychick, Senior Reactor Inspector

Approved By: Wayne Walker, Chief, Project Branch A Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000445/2009004, 05000446/2009004; 06/21/2009 - 09/19/2009; Comanche Peak Steam Electric Station, Units 1 and 2, Fire Protection, Flood Protection Measures, Plant Modifications, Other Activities. The report covered a 3-month period of inspection by resident inspectors and announced baseline inspections by region based inspectors. Six Green noncited violations were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, "Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The inspectors identified a Green noncited violation of License Condition 2.G for the failure of the licensee to seal a penetration in the Unit 2 train B safety chiller electrical cabinet. As a result, the equipment was vulnerable to water damage from a fire sprinkler activation during a postulated fire on the redundant train. The licensee entered the finding into their corrective action program as Smart Form SMF-2009-001069-00.

The finding was more than minor because it was associated with the protection against external events attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective, in that, it decreased the reliability of the redundant safety chiller train in case of fire on the Unit 2 train A safety chiller.

Using NRC Manual Chapter 0609, the inspectors determined that a Phase 3 analysis was required. Based on the senior reactor analyst's significance determination process Phase 3 analysis, this finding was determined to have very low safety significance. The finding did not have a crosscutting aspect because it was not representative of current licensee performance (Section 1R05).

Green.

The inspectors identified a Green noncited violation of 10 CFR Part 50, Appendix B, Criterion III, for the failure of the licensee to follow the design basis and seal electrical penetration conduits in the containment spray pump rooms. As a result, the water from a pipe break in the valve isolation tank rooms would flow into the conduits in the containment spray pump room and could cause a train of residual heat removal, safety injection, and containment spray equipment to become inoperable. The licensee entered the finding into their corrective action program as Smart Form SMF-2009-000926-00.

The finding was more than minor because it was associated with the design control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the capability of systems that respond to events.

Using NRC Manual Chapter 0609, the inspectors determined that a Phase 3 analysis was required. Based on the senior reactor analyst's significance determination process Phase 3 analysis, this finding was determined to have very low safety significance. The finding did not have a crosscutting aspect because it was not representative of current licensee performance (Section 1R06).

Green.

The inspectors identified a Green noncited violation of Technical Specification 5.4.1.a for failure to comply with the work control procedure which requires that all transient equipment be tracked. Specifically, the licensee placed a floating dock in the service water intake structure for maintenance activities and did not track the dock in Maximo, the licensee's computer program for tracking work. As a result, the dock remained in place significantly longer than allowed without doing an engineering evaluation for the effects, potentially reducing the reliability of the service water pumps in case of a fire or flood. The licensee entered the finding into their corrective action program as Smart Form SMF-2009-001548-00.

The finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and adversely affected the objective, in that, the reliability of the service water system was reduced in the cases of a fire or the probable maximum flood. The inspectors determined that because the fire scenario did not reflect the dominant risk of the finding, the flooding scenario would be used for the significance determination process. Using NRC Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," the finding was determined to be of very low safety significance because the performance deficiency did not cause the loss of any safety function. This finding has a human performance crosscutting aspect associated with resources, in that the licensee failed to provide adequate training for personnel H.2b] (Section 1R18).

Green.

The inspectors identified a noncited violation of Technical Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedure ABN-803A, "Response to a Fire in the Control Room or Cable Spreading Room," Revision 8, which is used to perform an alternative shutdown from outside of the control room, failed to assure that the train A charging pump, relied on for achieving postfire safe shutdown, would not be damaged because of a loss of suction. During an alternative shutdown, operators must use the train A charging pump for the reactivity control and reactor coolant makeup functions by providing borated water from the refueling water storage tank. The licensee entered the finding into their corrective action program as Smart Form SMF-2009-004453-00.

Failure to ensure that Procedure ABN-803 contained sufficient instructions to ensure that the credited train A centrifugal charging pump would be available following a postulated control room abandonment was a performance deficiency.

This finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. Based on the senior reactor analyst's significance determination process Phase 3 analysis, this finding was determined to have very low safety significance. The finding did not have a crosscutting aspect because it was not representative of current licensee performance (Section 4OA5.4).

Green.

The inspectors identified a noncited violation of Unit 1 License Condition 2.G and Unit 2 License Condition 2.G. Specifically, the licensee failed to ensure that one train of the equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage as specified in the approved fire protection program. The inspectors identified that the licensee relied upon local manual actions to mitigate the effects of potential fire damage rather than provide the physical separation or protection required in the approved fire protection program. The licensee entered the finding into their corrective action program as Smart Form SMF-2009-004454-00.

Failure to ensure that one train of the systems required for hot shutdown is free from fire damage was a performance deficiency. This finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences.

Based on the senior reactor analyst's significance determination process Phase 3 analysis, this finding was determined to have very low safety significance. The finding did not have a crosscutting aspect because it was not representative of current licensee performance (Section 4OA5.5).

Green.

The inspectors identified a noncited violation of Technical Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, during operator walkthroughs, the inspectors identified that Procedure ABN-803A, "Response to a Fire in the Control Room or Cable Spreading Room," Revision 8, used to perform an alternative shutdown from outside of the control room, had two examples of critical actions that could not be completed in the time required by the postfire safe shutdown analysis. The steps to respond to a potential spurious opening of the train A power-operated relief valve and a potential loss of station service water cooling to the emergency diesel generator were not completed within the maximum allowable times specified in the procedure. As a compensatory measure, the licensee issued night orders to alert operators of these procedural concerns. The licensee entered the finding into their corrective action program as Smart Form SMF-2009-004455-00.

Failure to provide adequate procedural guidance to implement the requirements of the approved fire protection program was a performance deficiency. This finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. Based on the senior reactor analyst's significance determination process Phase 3 analysis, this finding was determined to have very low safety significance. The finding did not have a crosscutting aspect because it was not representative of current licensee performance (Section 4OA5.6).

B. Licensee-Identified Violations

None

REPORT DETAILS

Summary of Plant Status Comanche Peak Steam Electric Station Unit 1 operated at approximately 100 percent power for the entire reporting period. Comanche Peak Steam Electric Station Unit 2 operated at approximately 100 percent power for the entire reporting period.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and Emergency Preparedness

1R01 Adverse Weather Protection

.1 Readiness to Cope with External Flooding

a. Inspection Scope

The inspectors evaluated the design, material condition, and procedures for coping with the design basis probable maximum flood. The evaluation included a review to check for deviations from the descriptions provided in the Final Safety Analysis Report for features intended to mitigate the potential for flooding from external factors. As part of this evaluation, the inspectors checked that the roofs did not contain obstructions or obvious loose items that could clog drains in the event of heavy precipitation. Additionally, the inspectors performed a walkdown of the protected area to identify any modification to the site that would inhibit site drainage during a probable maximum precipitation event or allow water ingress past a barrier. The inspectors also reviewed the abnormal operating procedure for mitigating the design basis flood to ensure it could be implemented as written.

These activities constitute completion of one external flooding sample as defined in Inspection Procedure 71111.01-05.

b. Findings

No findings of significance were identified.

1R04 Equipment Alignments

Partial Equipment Walkdowns

a. Inspection Scope

The inspectors performed partial system walkdowns of the following risk-significant systems:

• July 13, 2009, Unit 2, uninterruptible power supply heating, ventilation, and cooling systems

• July 16, 2009, Unit 2, diesel generator 2-01 while the turbine driven auxiliary feeedwater pump was unavailable for maintenance

• July 29, 2009, Unit 1, diesel generator 1-01 while diesel generator 1-02 was unavailable for maintenance

• August 19, 2009, Unit 1, safety injection train B while train A was unavailable for maintenance The inspectors selected these systems based on their risk significance relative to the reactor safety cornerstones at the time they were inspected. The inspectors attempted to identify any discrepancies that could affect the function of the system and, therefore, potentially increase risk. The inspectors reviewed applicable operating procedures, system diagrams, Final Safety Analysis Report, technical specification requirements, outstanding work orders, Smart Forms, and the impact of ongoing work activities on redundant trains of equipment in order to identify conditions that could have rendered the systems incapable of performing their intended functions. The inspectors also walked down accessible portions of the systems to verify system components and support equipment were aligned correctly and operable. The inspectors examined the material condition of the components and observed operating parameters of equipment to verify that there were no obvious deficiencies. The inspectors also verified that the licensee had properly identified and resolved equipment alignment problems that could cause initiating events or impact the capability of mitigating systems or barriers and entered them into the corrective action program with the appropriate significance characterization. These activities constituted completion of four partial system walkdown samples as defined in Inspection Procedure 71111.04-05.

b. Findings

No findings of significance were identified.

1R05 Fire Protection

Quarterly Fire Inspection Tours

a. Inspection Scope

The inspectors conducted fire protection walkdowns in the following risk-significant plant areas:

• August 11, 2009, fire zone 1SC7, Unit 1, turbine driven auxiliary feedwater pump room

• September 10, 2009, fire area EN, Unit 1 cable spreading room

• September 10, 2009, fire area EM, Unit 2 cable spreading room

• September 10, 2009, fire zone AA154, Unit 2, safety chillers

The inspectors reviewed areas to assess if licensee personnel had implemented a fire protection program that adequately controlled combustibles and ignition sources within the plant; effectively maintained fire detection and suppression capability; maintained passive fire protection features in good material condition; and had implemented adequate compensatory measures for out of service, degraded or inoperable fire protection equipment, systems, or features, in accordance with the licensee's fire plan. The inspectors selected fire areas based on their overall contribution to internal fire risk as documented in the plant's Individual Plant Examination of External Events with later additional insights, their potential to affect equipment that could initiate or mitigate a plant transient, or their impact on the plant's ability to respond to a security event. Using the documents listed in the attachment, the inspectors verified that fire hoses and extinguishers were in their designated locations and available for immediate use, that fire detectors and sprinklers were unobstructed, that transient material loading was within the analyzed limits, and fire doors, dampers, and penetration seals appeared to be in satisfactory condition. Specific documents reviewed during this inspection are listed in the attachment. These activities constituted completion of four quarterly fire-protection inspection samples as defined in Inspection Procedure 71111.05-05.

b. Findings

Introduction.

The inspectors identified a Green noncited violation of License Condition 2.G for the failure of the licensee to seal a penetration in the Unit 2 train B safety chiller electrical cabinet. As a result, the equipment was vulnerable to water damage from a fire sprinkler activation during a postulated fire on the redundant train.

Description.

On February 26, 2009, while performing a walkdown of the Unit 2 safety chillers, the inspectors discovered an unsealed penetration on the top of a cabinet that contained electrical equipment for the Unit 2 train B safety chiller. The redundant train A safety chiller is separated from train B by a partial height wall and a water curtain. The water curtain consists of a group of fast acting fire sprinklers above the wall. With a train A safety chiller fire and a water curtain actuation, the water curtain spray would reach the electrical cabinet for the train B chiller. The cabinet was designed so the spray would not enter the cabinet and wet electrical equipment. The inspectors observed sprinkler locations, the location of the unsealed penetration, and the electrical equipment inside of the cabinet. The inspectors concluded that if a fire occurred on the train A safety chiller, it was reasonable that water would enter the cabinet and short control power to the train B safety chiller, which would then render both safety chillers inoperable. The inspectors determined, through a review of the licensee's basic cause evaluation, that the unsealed penetration in the cabinet was likely created during construction because no work history that could have caused the hole could be found. The inspectors walked down a sample of other electrical enclosures and no other unsealed cabinet penetrations were found. The inspectors concluded that this performance deficiency was not representative of current licensee performance.

Analysis.

The licensee's failure to seal a penetration in equipment was a performance deficiency, which resulted in redundant equipment that was vulnerable to water damage. The finding was more than minor because it was associated with the protection against external events attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective, in that, it decreased the reliability of the Unit 2 train B safety chiller train in case of fire in the Unit 2 train A safety chiller. The inspectors determined that NRC Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," was not applicable for assessing the significance of this finding and that a Phase 3 analysis was required.

A senior reactor analyst performed a bounding Phase 3 significance determination to evaluate the fire protection finding. First, the analyst identified an approximate frequency for a chiller fire from the NRC Manual Chapter 0609, Appendix F, Attachment 4, "Fire Ignition Source Mapping Information: Fire Frequency, Counting Instructions, Applicable Fire Severity Characteristics, and Applicable Manual Fire Suppression Curves." The analyst selected the most conservative fire initiation frequency for a chiller component that was listed in the table. The frequency was 6.5 x 10-4/year and was for large electric motors (greater than 100 horsepower). There were no other significant fire initiation contributors in the room. The analyst used the Comanche Peak SPAR model, Revision 3.50, dated May 27, 2009, to calculate the conditional core damage probability for a bounding event that included a fire, plant trip and failure of both chillers. The analyst used a cutset truncation of 1.0 x 10-13 and assumed a duration of 1 year.

The conditional core damage probability was 5.8 x 10

-5. The approximate bounding delta core damage frequency (CDF), assuming a zero baseline and giving no credit for fire mitigation or consideration that the alternate chiller might not fail from sprinkler spray, was a product of the conditional core damage probability and the fire initiating frequency:

CDF = 6.5 x 10

-4

• 5.8 x 10

-5 = 3.8 x 10

-8 Since the calculated CDF was less than 1 x 10

-6, the finding was of very low safety significance (Green). Since the CDF was less than 1 x 10

-7, the analyst determined that there was not a significant contributor to the large early release frequency. The inspector determined that no crosscutting component is associated with this finding because it is not representative of current licensee performance.

Enforcement.

The Unit 2 Facility Operating License Condition 2.G. states, "Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 87." Comanche Peak Final Safety Analysis Report Section 13.3B, "CPSES Fire Protection Program," Amendment 101, states, "CPSES is committed to meeting the requirements of the Fire Protection Report." Comanche Peak Fire Protection Report, Revision 25, Deviation 1b

(2) states "Equipment is provided with spray shields and penetrations into the equipment are sealed to protect against water damage due to sprinkler actuation." Contrary to the above, on February 26, 2009, a Unit 2 train B safety chiller electrical equipment cabinet penetration was not sealed to protect against water damage due to sprinkler actuation. Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-000714-00, it is being treated as a noncited violation,

consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000446/2009004-01, "Failure to Seal Electrical Enclosure."

1R06 Flood Protection Measures

a. Inspection Scope

The inspectors reviewed selected risk important plant design features to protect the plant and its safety related equipment from internal flooding events. The inspectors reviewed flood analysis, design documents, engineering calculations, and the Final Safety Analysis Report. Specific documents reviewed during this inspection are listed in the attachment. To verify proper wall penetration seals were in place, on March 15, 2009, the inspectors walked down the Unit 2 containment spray pump rooms. These activities constitute completion of one flood protection measures inspection sample as defined by IP 71111.06-05.

b. Findings

Introduction.

The inspectors identified a Green noncited violation of 10 CFR Part 50, Appendix B, Criterion III, for the failure of the licensee to follow the design basis and seal electrical penetration conduits in the Unit 2 containment spray pump rooms. As a result, the water from a pipe break in the valve isolation tank rooms would flow into the conduits in the containment spray pump room and could cause a train of residual heat removal, safety injection, and containment spray equipment to become inoperable.

Description.

On March 15, 2009, the inspectors performed a walkdown of the Unit 2 containment spray pump rooms and did not observe sealant in the electrical penetrations between the containment spray pump rooms (Rooms 51 and 54) and the valve isolation tank rooms (Rooms 63 and 65). The inspectors informed the licensee about the observation and the possible breach of a fire barrier. The licensee inspected the penetrations and determined that the penetrations were not sealed. The licensee reviewed the fire protection requirements for the penetrations and determined that the penetrations went through a wall that was a non-rated fire barrier and there was not a need to seal the penetrations for fire protection. However, the licensee determined that the wall penetrations were credited in the building flooding analysis. The licensee performed a walkdown of the Unit 1 penetrations and found them to be correctly sealed. The inspectors determined that Design Basis Document DBD-ME-002, "Penetration Seals," Revision 8, establishes the design basis for penetration seals and that Section 5.1.2 documents that pressure rated barriers are determined by reviewing Calculation 2-FP-0001, "Barrier Functional List." Calculation 2-FP-0001, Attachment 1 provided a listing of the functional barrier requirements of the Unit 2 penetrations and documented that the penetrations will have a pressure rating of 150 inches of water. The inspectors determined that the penetrations did not meet the pressure rating requirement. The inspectors discussed the missing penetration seals with the licensee and determined the seals were most likely not sealed during the initial construction timeframe. The inspectors concluded that this finding was not representative of current licensee performance.

Analysis.

The licensee's failure to seal the electrical penetrations is a performance deficiency and, as a result, water from a pipe break in the valve isolation tank rooms would flow into the conduits in the containment spray pump room and could cause a train of residual heat removal, safety injection, and containment spray equipment to become inoperable. The finding was more than minor because the performance deficiency was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the capability of systems that respond to events. Using NRC Inspection Chapter 0609, the inspectors determined that a Phase 3 analysis was required. A senior reactor analyst performed a Phase 3 significance determination to evaluate the flooding concern. First, the analyst identified the approximate frequency for a break of the affected system piping. Using "Comanche Peak Internal Flooding Analysis - Flood Zone Scenario Frequency Screening," Table 4.1.1-3, dated October 17, 2005, the analyst determined the estimated break frequency as 1.8 x 10

-5/year for each affected room. The analyst used the Comanche Peak SPAR model, Revision 3.50, dated May 27, 2009, to calculate the conditional core damage probability (CCDP) for a bounding event that included a failure of the piping, a plant trip and the failure of one train of residual heat removal coincident with a failure of one train of safety injection. All other initiating events were set to false. The analyst used a cutset truncation of 1.0 x 10

-13 and assumed an exposure interval of 1 year. The CCDP for that event was 6.4 x 10

-7. For a flood in one room, the approximate delta core damage frequency (CDF) was a product of the flood frequency and the calculated CCDP: CDF/room = 1.8 x 10

-5

• 6.4 x 10

-7 = 1.2 x 10-11. Assuming a based CDF of 0.0, the total CDF was calculated as: CDF/room

• 2 rooms = 1.2 x 10

-11

• 2 = 2.4 x 10

-11 Since the calculated CDF was less than 1 x 10

-6, the finding was of very low safety significance (Green). Since the CDF was less than 1 x 10

-7, the analyst determined that there was not a significant contributor to the large early release frequency. The inspector determined that no crosscutting component isassociated with this finding because it is not representative of current licensee performance.

Enforcement.

The inspectors determined that 10 CFR Part 50, Appendix B, Criterion III, requires, in part, that measures shall be established to assure that the design basis for safety related functions of structures, systems, and components are correctly translated into specifications, drawings, procedures and instructions. Design Basis Document DBD-ME-002, "Penetration Seals," Revision 8, Section 5.1.2 documents, in part, that pressure rated barriers are determined by reviewing Calculation 2-FP-0001, "Barrier Functional List." Calculation 2-FP-0001, Attachment 1 provides a listing of the functional barrier requirements of the Unit 2 penetrations and on page 3 documented that the containment spray pump room to electrical chase 780 penetration will have a pressure rating of 150 inches of water. Contrary to the above, the licensee failed to seal the penetration and provide the appropriate design pressure rating. As a result, a pipe break and flood in the valve isolation tank room could cause a train of residual heat removal, safety injection, and containment spray equipment to become inoperable. Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-000926-00, it is being

treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NRC 05000446/2009004-02, "Failure to Seal Electrical Penetrations."

1R11 Licensed Operator Requalification Program

.1 Quarterly Licensed Operator Requalification Program Inspection

a. Inspection Scope

On August 31, 2009, the inspectors observed a crew of licensed operators in the plant's simulator to verify that operator performance was adequate, evaluators were identifying and documenting crew performance problems, and training was being conducted in accordance with licensee procedures. The inspectors evaluated the following areas:

• Licensed operator performance

• Crew's clarity and formality of communications

• Crew's ability to take timely actions in the conservative direction

• Crew's prioritization, interpretation, and verification of annunciator alarms

• Crew's correct use and implementation of abnormal and emergency procedures

• Control board manipulations

• Oversight and direction from supervisors

• Crew's ability to implement appropriate emergency plan actions and notifications The inspectors compared the crew's performance in these areas to pre-established operator action expectations and successful critical task completion requirements.

These activities constituted completion of one quarterly licensed operator requalification program sample as defined in Inspection Procedure 71111.11.

b. Findings

No findings of significance were identified.

1R12 Maintenance Effectiveness

a. Inspection Scope

The inspectors evaluated the following risk significant systems, components, and degraded performance issues:

• Unit 1 flow path for emergency boration

• Unit 1 diesel generator 1-02 The inspectors reviewed events where ineffective equipment maintenance has resulted in valid or invalid automatic actuations of engineered safeguards systems and independently verified the licensee's actions to address system performance or condition problems in terms of the following:

• Implementing appropriate work practices

• Identifying and addressing common cause failures

• Scoping of systems in accordance with 10 CFR 50.65(b)

• Characterizing system reliability issues for performance

• Charging unavailability for performance

• Trending key parameters for condition monitoring

• Ensuring proper classification in accordance with 10 CFR 50.65(a)(1) or (a)(2) The inspectors verified appropriate performance criteria for structures, systems, and components classified as having an adequate demonstration of performance through preventive maintenance, as described in 10 CFR 50.65(a)(2), or as requiring the establishment of appropriate and adequate goals and corrective actions for systems classified as not having adequate performance, as described in 10 CFR 50.65(a)(1). The inspectors assessed performance issues with respect to the reliability, availability, and condition monitoring of the system. In addition, the inspectors verified that maintenance effectiveness issues were entered into the corrective action program with the appropriate significance characterization. Specific documents reviewed during this inspection are listed in the attachment. These activities constituted completion of two quarterly maintenance effectiveness samples as defined in Inspection Procedure 71111.12-05.

b. Findings

No findings of significance were identified.

1R13 Maintenance Risk Assessments and Emergent Work Control

a. Inspection Scope

The inspectors reviewed licensee personnel's evaluation and management of plant risk for the maintenance and emergent work activities affecting risk-significant and safety-related equipment listed below to verify that the appropriate risk assessments were performed prior to removing equipment for work:

• July 30, 2009, Unit 1, diesel generator 1-02 maintenance and severe thunderstorm warning

• August 13, 2009, Unit 1, motor driven auxiliary feedwater pump 1-01 and residual heat removal pump 1-01 concurrent outages

• August 21, 2009, Unit 1 turbine driven auxiliary feedwater pump inoperable but available during testing

• August 28, 2009, Unit 2, motor driven auxiliary feedwater pump 2-01 and turbine driven auxiliary feedwater pump 2-01 inoperability during pump discharge check valve reverse flow testing The inspectors selected these activities based on potential risk significance relative to the reactor safety cornerstones. As applicable for each activity, the inspectors verified that licensee personnel performed risk assessments as required by 10 CFR 50.65(a)(4)and that the assessments were accurate and complete. When licensee personnel performed emergent work, the inspectors verified that the licensee personnel promptly

assessed and managed plant risk. The inspectors reviewed the scope of maintenance work, discussed the results of the assessment with the licensee's probabilistic risk analyst or shift technical advisor, and verified plant conditions were consistent with the risk assessment. The inspectors also reviewed the technical specification requirements and inspected portions of redundant safety systems, when applicable, to verify risk analysis assumptions were valid and applicable requirements were met.

These activities constituted completion of four maintenance risk assessments and emergent work control inspection samples as defined in Inspection Procedure 71111.13-05.

b. Findings

No findings of significance were identified.

1R15 Operability Evaluations

a. Inspection Scope

The inspectors reviewed the following issues:

• SMF-2009-003309-00, Unit 2, safety injection 2-01 voiding

• SMF-2009-003767-00, Unit 1, diesel generator 1-02 with water identified in the cylinder head water during engine roll

• SMF-2009-003927-00, hot flux channel factor relaxed axial offset control

• SMF-2009-003970-00, Unit 2, offsite power operability during lagging MVAR testing The inspectors selected these potential operability issues based on the risk-significance of the associated components and systems. The inspectors evaluated the technical adequacy of the evaluations to ensure that technical specification operability was properly justified and the subject component or system remained available such that no unrecognized increase in risk occurred. The inspectors compared the operability and design criteria in the appropriate sections of the technical specifications and Final Safety Analysis Report to the licensee's evaluations, to determine whether the components or systems were operable. Where compensatory measures were required to maintain operability, the inspectors determined whether the measures in place would function as intended and were properly controlled. The inspectors determined, where appropriate, compliance with bounding limitations associated with the evaluations. Additionally, the inspectors reviewed a sampling of corrective action documents to verify that the licensee was identifying and correcting any deficiencies associated with operability evaluations. Specific documents reviewed during this inspection are listed in the attachment. These activities constituted completion of four operability evaluation inspection samples as defined in Inspection Procedure 71111.15-05.

b. Findings

No findings of significance were identified.

1R18 Plant Modifications

a. Inspection Scope

To verify that the safety functions of important safety systems were not degraded, the inspectors reviewed the temporary modification that involved placing a floating dock in the service water intake structure. The inspectors reviewed the temporary modification and the associated safety evaluation screening against the system design bases documentation, including the Final Safety Analysis Report and the technical specifications, and verified that the modification did not adversely affect the system operability/availability. The inspectors also verified that the installation and restoration were consistent with the modification documents and that configuration control was adequate. Additionally, the inspectors verified that the temporary modification was identified on control room drawings, appropriate tags were placed on the affected equipment, and licensee personnel evaluated the combined effects on mitigating systems and the integrity of radiological barriers. These activities constitute completion of one sample for temporary plant modifications as defined in Inspection Procedure 71111.18-05.

b. Findings

Introduction.

The inspectors identified a Green noncited violation of Technical Specification 5.4.1.a for failure to comply with the work control procedure which requires that all transient equipment be tracked. Specifically, the licensee placed a floating dock in the service water intake structure (SWIS) for maintenance activities and did not track the dock in Maximo, the licensee's computer program for tracking work. As a result, the licensee left the dock remained in place significantly longer than allowed without completing an engineering evaluation for the effects, thereby potentially reducing the reliability of the service water pumps in case of a fire or flood.

Description.

The inspectors reviewed the licensee's process to control the installation of a floating dock inside the service water intake structure. The licensee uses Maximo, an electronic work control process, to ensure that transient equipment is tracked and only allowed to remain in place for less than 90 days or evaluated as a permanent change. However, the inspectors noted that the licensee failed to track the floating dock in the service water intake structure and left the equipment in place for 244 days, before removing it on April 27, 2008. The licensee had installed the dock on August 27, 2007, for use as a diving platform to support pump bay cleaning as preventative maintenance every three years. The evaluation related to the temporary floating dock, FDA-1999-001657-01-01, states, "The SWIS is a highly sensitive fire area. Because of this sensitivity, and the fact that the floating deck consists of a very large quantity of combustible plastic, the use of the floating dock is restricted under the Fire Protection Program. The dock is to be installed

temporarily for use only during times of need, as discussed above." The Comanche Peak Fire Protection Report, Revision 25, in Deviation 1a for having all redundant service water equipment in one fire area, states in part, that, "A fire caused by transient combustibles is mitigated because the area is designated 'No Storage' area." The area is below the pumps is sensitive because it can affect all four trains of service water.

However, because of the distance to the targets, and because the dock was floating in water, the inspectors concluded that a fire of the floating dock would have a very low probability of failing redundant service water equipment. The inspectors questioned the licensee about potential for the floating dock to damage equipment in the service water intake structure during a probable maximum flood. The licensee evaluated the concern and determined that the dock would impact non-safety equipment and potentially crush it during the flood. The foreign material caused by this event had a potential for entering all four service water pumps which would affect the reliability of the pumps in both units. The inspectors concluded that although non-safety related equipment could be damaged during the flood, there was a very small likelihood that the foreign material would cause all of the pumps to fail simultaneously. The licensee conducted a cause evaluation for the performance deficiency and concluded that the cause was due to planning personnel transferring to a new role without adequate training. The inspectors reviewed the evaluation and concluded that the failure to provide adequate training was the most significant contributor to the performance deficiency.

Analysis.

The licensee's failure to track the floating dock in the service water intake structure was a performance deficiency and resulted in transient equipment remaining in the plant for an extended period of time. As a result, the service water system's reliability could have been reduced, in that the dock increased the exposure of system components to flood and fire damage. The finding was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and adversely affected the objective, in that the reliability of the service water system could have been reduced in the cases of a fire or the probable maximum flood. The inspectors determined that because the fire scenario did not reflect the dominant risk of the finding, the flooding scenario would be used for the significance determination process. Using NRC Manual Chapter 0609, Attachment 4, "Phase 1 - Initial Screening and Characterization of Findings," the finding was determined to be of very low safety significance because the performance deficiency did not cause the loss of any safety function. This finding has a human performance crosscutting aspect associated with resources because the licensee failed to provide adequate training for personnel H.2b].

Enforcement.

Technical Specification 5.4.1.a requires, in part, that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A. Regulatory Guide 1.33, Appendix A, Item 9.e., requires, in part, procedures for the control of maintenance, repair, replacement, and modification work. Procedure STA-606, "Control of Maintenance and Work Activities," Revision 29, Step 6.1.6 requires, in part, that transient equipment shall be tracked in Maximo to ensure the requirements of Procedure STA-602 "Temporary Modifications and Transient Equipment Placements" are satisfied. Contrary to the above from August 27, 2007 to April 27, 2008, the licensee failed to track the

floating dock in Maximo to ensure the transient equipment placement requirements were satisfied. Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-001548-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-03; 05000446/2009004-03, "Failure to Control Transient Equipment."

1R19 Postmaintenance Testing

a. Inspection Scope

The inspectors reviewed the following postmaintenance activities to verify that procedures and test activities were adequate to ensure system operability and functional capability:

• July 21, 2009, control room air conditioning unit X-04 testing following oil heater replacement

• July 30, 2009, diesel generator 1-02 testing following diesel generator cylinder head replacement

• August 13, 2009, valve 1-PV-2453B, motor driven auxiliary feedwater pump 1-01 discharge to steam generator 1-02 flow control valve, diagnostic testing following valve refurbishment

• August 19, 2009, safety injection train A testing following maintenance on valve 1-8922A, safety injection pump 1-01 discharge check valve

• September 1, 2009, safety injection pump 2-02 testing following 6.9 kV breaker replacement

• September 2, 2009, diesel generator 2-02 testing following a maintenance activity to measure crank shaft deflection The inspectors selected these activities based upon the structure, system, or component's ability to affect risk. The inspectors evaluated the activities to ensure the testing was adequate for the maintenance performed, the acceptance criteria were clear, and the test ensured equipment operational readiness. The inspectors evaluated the activities against technical specifications, the Final Safety Analysis Report, 10 CFR Part 50 requirements, licensee procedures, and various NRC generic communications to ensure that the test results adequately ensured that the equipment met the licensing basis and design requirements. In addition, the inspectors reviewed corrective action documents associated with postmaintenance tests to determine whether the licensee was identifying problems and entering them into the corrective action program and that the problems were being corrected commensurate with their importance to safety. Specific documents reviewed during this inspection are listed in the attachment. These activities constituted completion of six postmaintenance testing inspection samples as defined in Inspection Procedure 71111.19-05.

b. Findings

No findings of significance were identified.

1R22 Surveillance Testing

a. Inspection Scope

The inspectors reviewed the Final Safety Analysis Report, procedure requirements, technical specifications, and corrective action documents to ensure that the surveillance activities listed below demonstrated that the systems, structures, and/or components tested were capable of performing their intended safety functions: Pump or Valve Inservice Test

• August 28, 2009, turbine driven auxiliary feedwater pump discharge to steam generators check valve testing in accordance with OPT-530B, "AFW Check Valve Reverse Flow Test," Revision 2 Routine Surveillance Testing

• August 12, 2009, diesel generator 1-01 monthly test in accordance with Procedure OPT-214A, "Diesel Generator Operability Test," Revision 19

• September 9, 2009, Unit 2, Channel 0548, steam generator narrow range level channel operational test in accordance with procedure INC-7332B, "Analog Channel Operational Test and Channel Calibration Steam Generator Narrow Range Level, Loop 4, Protection Set III, Channel 0548," Revision 1 Reactor Coolant System Leakage Detection Surveillance Testing

• August 3 through 14, 2009, unit 1 reactor coolant leakage calculations performed in accordance with Procedure OPT-303, "Reactor Coolant System Water Inventory," Revision 13 Containment Isolation Valve Test

• September 16, 2009, local leak rate test for penetration 2-MIII-0022 performed on March 31, 2008, in accordance with OPT-825B, "Appendix J LLRT for Penetration 2-MIII-0022," Revision 1 The inspectors either witnessed or reviewed test data to verify that the significant surveillance test attributes were adequate to address the following:

• Preconditioning

• Evaluation of testing impact on the plant

• Acceptance criteria

• Test equipment

• Procedures

• Jumper/lifted lead controls

• Test data

• Testing frequency and method demonstrated technical specification operability

• Test equipment removal

• Restoration of plant systems

• Fulfillment of ASME Code requirements

• Updating of performance indicator data

• Reference setting data

• Annunciators and alarms setpoints Specific documents reviewed during this inspection are listed in the attachment. These activities constituted completion of five surveillance testing inspection samples (one in-service test sample, two routine surveillance testing samples, one reactor coolant system leakage test, and one containment isolation valve test) as defined in Inspection Procedure 71111.22-05.

b. Findings

No findings of significance were identified.

1EP6 Drill Evaluation

a. Inspection Scope

On August 12, 2009, the inspectors evaluated the conduct of a licensee emergency drill to identify any weaknesses and deficiencies in classification, notification, and protective action recommendation development activities. The inspectors observed emergency response operations in the simulator and technical support center to determine whether the event classification, notifications, and protective action recommendations were performed in accordance with procedures. The inspectors also compared any inspector-observed weakness with those identified by the licensee staff in order to evaluate the critique and to verify whether the licensee staff was properly identifying weaknesses and entering them into the corrective action program. As part of the inspection, the inspectors reviewed the drill package and other documents listed in the attachment. These activities constituted completion one emergency preparedness drill sample as defined in Inspection Procedure 71114.06-05.

b. Findings

No findings of significance were identified.

4OA1 Performance Indicator Verification

.1 Data Submission Issue

a. Inspection Scope

The inspectors performed a review of the data submitted by the licensee for the second quarter 2009 performance indicators for any obvious inconsistencies prior to its public release in accordance with NRC Inspection Manual Chapter 0608, "Performance Indicator Program."

This review was performed as part of the inspectors' normal plant status activities and, as such, did not constitute a separate inspection sample.

b. Findings

No findings of significance were identified.

.2 Mitigating Systems Performance Index - Emergency ac Power System (MS06)

a. Inspection Scope

The inspectors sampled licensee submittals for the Mitigating Systems Performance Index - Emergency ac Power System performance indicator for Units 1 and 2 for the period from the third quarter 2008 through the second quarter 2009. To determine the accuracy of the performance indicator data reported during those periods, the inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, "Regulatory Assessment Performance Indicator Guideline," Revision 5. The inspectors reviewed the licensee's operator narrative logs, mitigating systems performance index derivation reports, issue reports, event reports and NRC integrated inspection reports for the period of the third quarter 2008 through the second quarter 2009 to validate the accuracy of the submittals. The inspectors reviewed the mitigating systems performance index component risk coefficient to determine if it had changed by more than 25 percent in value since the previous inspection, and if so, that the change was in accordance with applicable Nuclear Energy Institute guidance. The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the performance indicator data collected or transmitted for this indicator and none were identified. Specific documents reviewed are described in the attachment to this report.

These activities constitute completion of two mitigating systems performance index emergency ac power system samples as defined in Inspection Procedure 71151-05.

b. Findings

No findings of significance were identified.

.3 Mitigating Systems Performance Index - High Pressure Injection Systems (MS07)

a. Inspection Scope

The inspectors sampled licensee submittals for the Mitigating Systems Performance Index - High Pressure Injection Systems performance indicator for Units 1 and 2 for the period from the third quarter 2008 through the second quarter 2009. To determine the accuracy of the performance indicator data reported during those periods, the inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, "Regulatory Assessment Performance Indicator Guideline," Revision 5. The inspectors reviewed the licensee's operator narrative logs, issue reports, mitigating systems performance index derivation reports, event reports and NRC integrated inspection reports for the period of the third quarter 2008 through the second quarter 2009 to validate the accuracy of the submittals. The inspectors reviewed the mitigating systems performance index component risk coefficient to determine if it had changed by more

than 25 percent in value since the previous inspection, and if so, that the change was in accordance with applicable Nuclear Energy Institute guidance. The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the performance indicator data collected or transmitted for this indicator and none were identified. Specific documents reviewed are described in the attachment to this report.

These activities constitute completion of two mitigating systems performance index high pressure injection system samples as defined in Inspection Procedure 71151-05.

b. Findings

No findings of significance were identified.

.4 Mitigating Systems Performance Index - Heat Removal System (MS08)

a. Inspection Scope

The inspectors sampled licensee submittals for the Mitigating Systems Performance Index - Heat Removal System performance indicator for Units 1 and 2 for the period from the third quarter 2008 through the second quarter 2009. To determine the accuracy of the performance indicator data reported during those periods, the inspectors used definitions and guidance contained in Nuclear Energy Institute Document 99-02, "Regulatory Assessment Performance Indicator Guideline," Revision 5. The inspectors reviewed the licensee's operator narrative logs, issue reports, event reports, mitigating systems performance index derivation reports, and NRC integrated inspection reports for the period of the third quarter 2008 through the second quarter 2009 to validate the accuracy of the submittals. The inspectors reviewed the Mitigating Systems Performance Index component risk coefficient to determine if it had changed by more than 25 percent in value since the previous inspection, and if so, that the change was in accordance with applicable Nuclear Energy Institute guidance. The inspectors also reviewed the licensee's issue report database to determine if any problems had been identified with the performance indicator data collected or transmitted for this indicator and none were identified. Specific documents reviewed are described in the attachment to this report.

These activities constitute completion of two mitigating systems performance index heat removal system samples as defined in Inspection Procedure 71151-05.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Physical Protection

.1 Routine Review of Identification and Resolution of Problems

a. Inspection Scope

As part of the various baseline inspection procedures discussed in previous sections of this report, the inspectors routinely reviewed issues during baseline inspection activities and plant status reviews to verify that they were being entered into the licensee's corrective action program at an appropriate threshold, that adequate attention was being given to timely corrective actions, and that adverse trends were identified and addressed. The inspectors reviewed attributes that included: the complete and accurate identification of the problem; the timely correction, commensurate with the safety significance; the evaluation and disposition of performance issues, generic implications, common causes, contributing factors, root causes, extent of condition reviews, and previous occurrences reviews; and the classification, prioritization, focus, and timeliness of corrective actions. Minor issues entered into the licensee's corrective action program because of the inspectors' observations are included in the attached list of documents reviewed. These routine reviews for the identification and resolution of problems did not constitute any additional inspection samples. Instead, by procedure, they were considered an integral part of the inspections performed during the quarter and documented in Section 1 of this report.

b. Findings

No findings of significance were identified.

.2 Daily Corrective Action Program Reviews

a. Inspection Scope

In order to assist with the identification of repetitive equipment failures and specific human performance issues for follow-up, the inspectors performed a daily screening of items entered into the licensee's corrective action program. The inspectors accomplished this through review of the station's daily corrective action documents. The inspectors performed these daily reviews as part of their daily plant status monitoring activities, so these reviews and did not constitute any separate inspection samples.

b. Findings

No findings of significance were identified.

.3 Semi-Annual Trend Review

a. Inspection Scope

The inspectors performed a review of the licensee's corrective action program and associated documents to identify trends that could indicate the existence of a more significant safety issue. The inspectors focused their review on repetitive equipment

issues, but also considered the results of daily corrective action item screening discussed in Section 4OA2.2, above, licensee trending efforts, and licensee human performance results. The inspectors nominally considered the 6-month period of the second and third quarter 2009, although some examples expanded beyond those dates where the scope of the trend warranted.

The inspectors also included issues documented outside the normal corrective action program in major equipment problem lists, repetitive and/or rework maintenance lists, departmental problem/challenges lists, system health reports, quality assurance audit/surveillance reports, self-assessment reports, and maintenance rule assessments.

The inspectors compared and contrasted their results with the results contained in the licensee's corrective action program trending reports. Corrective actions associated with a sample of the issues identified in the licensee's trending reports were reviewed for adequacy.

These activities constitute completion of one semi-annual trend inspection sample as defined in Inspection Procedure 71152-05.

b. Findings

No findings of significance were identified.

.4 Selected Issue Follow-up Inspection

a. Inspection Scope

The inspectors completed a review of the licensee's actions with regard to reactivity management. The inspectors attended a reactivity management team meeting. The inspectors discussed reactivity management with the program owner and reviewed corrective action documents associated with reactivity management. Specific documents reviewed during this inspection are listed in the attachment.

These activities constitute completion of one in-depth problem identification and resolution sample as defined in IP 71152-05.

b. Findings

No findings of significance were identified.

4OA5 Other Activities

.1 Quarterly Resident Inspector Observations of Security Personnel and Activities

a. Inspection Scope

During the inspection period, the inspectors performed observations of security force personnel and activities to ensure that the activities were consistent with the licensee's security procedures and regulatory requirements relating to nuclear plant security. These observations took place during both normal and off-normal plant working hours.

These quarterly resident inspector observations of security force personnel and activities did not constitute any additional inspection samples. Rather, they were considered an integral part of the inspectors' normal plant status review and inspection activities.

b. Findings

No findings of significance were identified.

.2 Temporary Instruction 2515/175, "Emergency Response Organization, Drill/Exercise Performance Indicator, Program Review"

a. Inspection Scope

The inspectors performed Temporary Instruction 2515/175, ensured the completeness of Attachment 1, and forwarded the data to NRC Headquarters.

b. Findings

No findings of significance were identified.

.3 Institute of Nuclear Power Operations Plant Assessment Report Review

a. Inspection Scope

The inspectors reviewed the final report for the Institute of Nuclear Power Operations plant assessment for the Comanche Peak Steam Electric Station conducted in June 2008. The inspectors reviewed the report to ensure that issues identified were consistent with the NRC perspectives of licensee performance and to verify if any significant issues were identified that required further NRC follow-up.

b. Findings

No findings of significance were identified.

.4 (Closed) Unresolved Item 05000445/2008006-01; 05000446/2008006-01, "Inadequate Postfire Safe Shutdown Procedure"

Introduction.

The inspectors identified a noncited violation of Technical Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedure ABN-803A, "Response to a Fire in the Control Room or Cable Spreading Room," Revision 8, which is used to perform an alternate shutdown from outside of the control room, failed to assure that the charging pump relied on for achieving postfire safe shutdown would not be damaged because of a loss of suction. During an alternate shutdown, operators use the charging pump for the reactivity control and reactor coolant makeup functions by providing borated water from the refueling water storage tank.

Description.

During normal plant operations, the chemical and volume control system provides a continuous feed (charging and seal injection) and bleed (letdown and seal

leak-off) for the reactor coolant system. Normally one centrifugal charging pump is in operation. In the event of fire in the control room or cable spreading room, operators accomplish inventory makeup using the train A centrifugal charging pump with the refueling water storage tank as a source of borated water makeup. Procedure ABN-803A included steps to establish a suction path from the refueling water storage tank to the charging pumps. However, the inspectors determined that, if the charging pump credited for safe shutdown was running at the time of the fire, a spurious closure of one of the two series-connected volume control tank outlet valves prior to opening one of the refueling water storage tank outlet valves would result in a loss of suction and damage to the credited charging pump.

Valves 1-LCV-0112D and 1-LCV-0112E, refueling water storage tank to charging pump suction, are motor-operated valves connected in parallel to the suction of the charging pumps. Each valve is controlled from a switch on Panel CB-06 in the control room.

Prior to evacuating the control room and establishing control at the remote shutdown panel, Procedure ABN-803A, Section 2.3, Step 4(g) directed operators to open Valves 1-LCV-0112D and 1-LCV-0112E. However, these actions are not credited because they were not approved by the NRC, since the time available to perform actions prior to evacuating the control room may be very limited. From a review of related wiring diagrams, the inspectors determined that the occurrence of a single short to ground for each valve could preclude the success of this step. In addition, Procedure ABN-803A includes a back-up action outside the control room to ensure Valve 1-LCV-112E is open; however, the inspectors determined operators did not complete this step for at least 20 minutes during a walk-through of the procedure. The licensee has entered this issue into their corrective action program as Smart Form SMF-2009-004453-00.

Analysis.

The inspectors determined that, in the event of a postulated fire in the control room or cable spreading room, the train A centrifugal charging pump may fail from lack of an open suction path. If the train A pump was running at the time of the fire, a spurious closure of either volume control tank outlet valves, prior to operators opening one of the refueling water storage tank outlet valves, would result in a loss of suction and damage to the pump. The inspectors determined that the failure to ensure that Procedure ABN-803 contained sufficient instructions to ensure that the train A centrifugal charging pump would be available following a postulated control room abandonment was a performance deficiency. This deficiency was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. The inspectors evaluated the deficiency using NRC Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process." However, the deficiency required a Phase 3 evaluation because Manual Chapter 0308, Attachment 3, Appendix F, "Technical Basis for Fire Protection Significance Determination Process for at Power Operations," states that Manual Chapter 0609, Appendix F, does not include explicit treatment of fires in the control room.

The senior reactor analyst used the fire ignition frequency for the control room (FIF CR) and the cable spreading room (FIF CSR) listed in the Comanche Peak Steam Electric Station Individual Plant Examination of External Events for Severe Accident Vulnerabilities, as the best available information. The analyst multiplied the fire initiation frequencies by an appropriate severity factor (SF) and a nonsuppression probability. For the control room, the nonsuppression probability was developed to indicate the chance that operators failed to extinguish the fire within 20 minutes, assuming 2-minute detection, leading to abandonment of the control room (NP CRE). For the cable spreading room, the nonsuppression probability included the probability that the automatic halon system failed (NPCS-A) and the probability that the fire brigade failed to manually suppress the fire prior to damage that required abandonment of the control room (NPCS-M). The resulting control room and cable spreading room evacuation frequencies (EVAC) were calculated as follows: Postulated Control Room Fire EVAC = (FIF CR

• SF

• NP CRE) = (1.9 x 10

-2/year

• 0.1

• 1.3 x 10

-2) = 2.5 x 10

-5/year Postulated Cable Spreading Room Fire EVAC = (FIF CSR

• SF

• NPCS-A

• NPCS-M) = (3.2 x 10

-3/year

• 0.1

• 5.0 x 10

-2

• 2.4 x 10

-1) = 3.8 x 10

-6/year The control room has 116 panels for Unit 1 and common equipment, each unit cable spreading room has 99 electrical panels. The circuitry for the volume control tank valves are located in 6 different panels in the control room, one which contains cabling for both valves, and 2 termination cabinets in the cable spreading room. Additionally, at least one smart short would have to occur in the cabinet to fail the valve closed. The analyst estimated the probability of this short to be 0.6 using accepted industry values. Finally, as stated above, the performance deficiency will only impact risk if the train A pump is operating at the time of the postulated fire. This represents a 0.5 probability that one of two centrifugal charging pumps is running (PPUMP). The resulting probability that a control room fire would affect the panels and/or cabinets of interest (PCR-Affected) is the fraction 5/116 multiplied by the probability of having a single smart short in the cabinet plus the fraction 1/116 multiplied by the probability of having one of two smart shorts in the cabinet (3.3 x 10

-2). Likewise, the probability that a cable spreading room fire would affect the panels and/or cabinets of interest (PCSR-Affected) is the fraction 2/99 multiplied by the probability of having a smart short in the cabinet or 1.2 x 10

-2. The intersections of postulated fires in either fire area that affect either of the subject valves, while the train A pump is running, and leading to control room abandonment (intersection) were calculated as follows:

Postulated Control Room Fire intersection = PCR-Affected

• PPUMP

• EVAC = 3.3 x 10

-2

• 0.5

• 2.5 x 10

-5/year = 4.1 x 10

-7/year Postulated Cable Spreading Room Fire intersection = PAffected

• PPUMP

• EVAC = 1.2 x 10

-2

• 0.5

• 3.8 x 10

-6/year = 2.3 x 10

-8/year The analyst determined the delta conditional core damage probability (CCDP) by subtracting the base case conditional core damage probability for a control room abandonment (0.1) from the bounding fire damage conditional core damage probability (1.0) for a value of 0.9. The bounding delta conditional core damage frequencies

(CDF) for a 1-year exposure (EXP), representing the current assessment period, were calculated by multiplying the frequencies of occurrence by the delta conditional core damage probability as follows: Postulated Control Room Fire CDF = intersection

• CCDP

• EXP = 4.1 x 10

-7/year

• 0.9

• 1 year = 3.7 x 10-7 Postulated Cable Spreading Room Fire CDF = intersection

• CCDP

• EXP = 2.3 x 10

-8/year

• 0.9

• 1 year = 2.1 x 10-8 Because postulated fire ignition frequencies for the control room and the cable spreading room are independent from each other, the total CDF can be determined by simple addition of the two probabilities above (3.9 x 10

-7).

In accordance with Manual Chapter 0609, Appendix A, Attachment 1, step 2.2.6, "Screen for the Potential Risk Contribution Due to Large Early Release Frequency (LERF)," the finding was screened for its potential risk contribution to the large, early release frequency because the total CDF was greater than 1 x 10

-7. The analyst evaluated the affect of the finding on the large, early release frequency in accordance with Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process." Given that Comanche Peak has a large, dry containment and that control room abandonment sequences do not include steam generator tube ruptures or intersystem loss of coolant accidents, the analyst determined that this finding was not significant with respect to the large-early release frequency. Therefore, the analyst determined this finding was of very low risk significance (Green).

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure ABN-803A, Revision 8, implements this requirement for fires

requiring the control room to be evacuated. Contrary to the above, the licensee failed to provide adequate procedures for implementing the fire protection program. Specifically, the procedural guidance for implementing the postfire safe shutdown strategy would fail to prevent damage to the credited centrifugal charging pump if it was in operation at the time of a fire requiring an evacuation of the control room. Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-004453-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-04; 00500446/2009004-04, "Inadequate Postfire Safe Shutdown Procedure."

.5 (Closed) Unresolved Item 05000445/2008006-02; 05000446/2008006-02, "Unapproved Local Manual Actions For Hot Shutdown"

Introduction.

The inspectors identified a Green noncited violation of Unit 1 License Condition 2.G and Unit 2 License Condition 2.G. Specifically, the licensee failed to ensure that one train of the equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage as specified in the approved fire protection program. The licensee relied upon local manual actions to mitigate the effects of potential fire damage rather than provide the physical separation or protection required in the approved fire protection program.

Description.

The inspectors reviewed a sample of three fire areas in Unit 1, which do not require evacuation of the control room during the shutdown. The inspectors reviewed the approved fire protection program as defined in License Condition 2.G and determined that one train of equipment required to achieve and maintain hot shutdown is required to be free from fire damage. The inspectors noted that the approved fire protection program allows local manual actions to respond to spurious operations of other equipment that could impact the safe shutdown but do not directly perform the required safe shutdown functions. The inspectors conducted walkdowns with operations personnel of Procedure ABN-804A, "Response To a Fire In The Safeguards Building," Revision 5, and Procedure ABN-806A, "Response To a Fire In The Electrical and Control Buildings," Revision 5. The inspectors found that the fire protection program, as implemented, relied on the use of local manual actions to align and control equipment required to achieve and maintain hot shutdown resulting from potential fire damage instead of assuring that one train was free from fire damage. This approach expanded the use of local operator manual actions outside of the control room beyond the response to spurious operations allowed in the approved fire protection program. The inspectors concluded that the licensee's fire protection program, as implemented, provided less physical separation and protection from the affects of fire than the approved program required, and was inherently less reliable than ensuring that one train of the required systems remained free from fire damage. An example of this concern was the licensee's treatment of air-operated valves in the charging and auxiliary feedwater systems, which were required to perform the reactor coolant inventory control and decay heat removal functions, respectively. The licensee did not designate the instrument air system as a required support system and ensure it

would remain free of fire damage, so air may not be available to operate these air-operated valves. Consistent with this approach, the licensee did not protect the circuits required to operate these air-operated valves from fire damage. These air-operated valves are normally controlled from the control room to reach and maintain hot shutdown. For postfire safe shutdown, the licensee did not assure the ability to control these valves from the control room by protecting valve control circuits or the air supply. Instead, the licensee relies on local manual actions outside of the control room to de-energize the air-operated valves to their failed positions, and in the case of the turbine-driven auxiliary feedwater pump, to then control the turbine manually. The licensee also assigns an equipment operator to control flow to the steam generators by throttling other manual valves as directed by the control room operators via radio to compensate for the loss of control of the air-operated valves. The licensee disagreed with the inspectors' interpretation of the fire protection program requirements and believed the current program complies with their license condition. The licensee submitted the basis for their position in Luminant letter CP-200800962, TXX-08105, dated July 24, 2008. This issue was discussed with the license and the Office of Nuclear Reactor Regulation, and the staff has concluded that the NRC did not approve manual actions in lieu of protection for equipment required for safe shutdown (refer to Attachment 2 of this report).

Comanche Peak Unit 1 License Condition 2.G states: "Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24." In Supplemental Safety Evaluation Report 12, the NRC staff documented the review of the AFire Protection of the Safe Shutdown Capability

@ against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b. The NRC staff concluded:

AThe applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability;

@ and AAssociated circuits whose fire-induced spurious operation could affect shutdown were identified to determine those components whose maloperation could affect safe shutdown. These spurious operations are terminated by operator actions.

The applicant identified these operator actions and allowed the operator sufficient time to perform these actions. On the basis of its evaluation, the staff concludes that these operator actions will terminate spurious operations that could affect plant shutdown.

@ (Emphasis added) The manual actions discussed related to spurious actuations resulting from damage to associated circuits. The NRC staff did not discuss or approve any deviations from the requirements for physical separation or protection specified in the standard review plan to allow the use of local operator manual actions to operate components necessary to

achieve or maintain hot shutdown. The licensee has entered this issue into their corrective action program as Smart Form SMF-2009-004454-00.

Analysis.

Failure to ensure that one train of the systems required for hot shutdown was free from fire damage was a performance deficiency. The inspectors determined that this finding was more than minor because it is associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. The inspectors initiated an evaluation of this finding using the significance determination process in Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving postfire safe shutdown systems. Additional information was required from the licensee concerning the scope of components identified as requiring manual actions, the fire areas where the manual actions were required and the routing of the cables of interest within those fire areas for Unit 1. Thirty-three components required to achieve and maintain hot shutdown were identified for further evaluation. Plant walkdowns were performed in 12 fire areas to identify fire scenarios that could potentially damage the cables of interest for these 33 valves credited for establishing and maintaining hot shutdown. Using the methodology in Manual Chapter 0609, Appendix F, the plant walkdown results identified seven fire scenarios in three fire areas with the potential to damage cables for eleven valves required to establish and maintain hot shutdown. Since the issue involved multiple fire areas, a modified Phase 2 analysis was developed to access the risk due to the seven fire scenarios. The analysis was reviewed by a senior reactor analyst, who confirmed the issue resulted in a total delta core damage frequency of 3.7 x 10

-7 and that the issue had very low safety significance.

Enforcement.

The Unit 1 License Condition 2.G states, "Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24." In Supplemental Safety Evaluation Report 12, the NRC staff concluded from review of the AFire Protection of the Safe Shutdown Capability

@ against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b, AThe applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability."

Contrary to the above, the licensee failed to properly implement the approved fire protection program. Specifically, the licensee did not assure that one train of equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage. The fire protection program, as implemented, relied on the use of local operator manual actions to operate components required to achieve and maintain safe hot shutdown conditions resulting from potential fire damage thus providing less physical separation and protection from the affects of fire than required by the approved fire protection program.

Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-004454-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-05; 00500446/2009004-05, "Failure to Assure that One Train of Equipment is Free From Fire Damage."

.6 (Closed) Unresolved Item 05000445/2008006-03; 05000446/2008006-03, "Inadequate Alternative Shutdown Procedure"

Introduction.

The inspectors identified a Green noncited violation of Technical Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedure ABN-803A, "Response to a Fire in the Control Room or Cable Spreading Room," that is used to perform an alternate shutdown, had two examples of critical actions that could not be completed in the time required by the postfire safe shutdown analysis. The licensee documented this deficiency in Smart Form SMF-2009-004455.

Description.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Alternate shutdown at the Comanche Peak Steam Electric Station requires operators to safely shutdown the plant in accordance with Procedure ABN-803A for Unit 1 for fire in the control room or cable spreading room requiring evacuation of the control room. The inspectors performed a walkthrough of Procedure ABN-803A for a simulated fire in either the control room or cable spreading room that required operators to shutdown the plant using manual actions and controls at the remote shutdown panel. Procedure ABN-803A, Attachment 13 specified the maximum allowable times to complete certain actions. The inspectors noted during the timed walkthrough by operators that the following actions could not be performed within the required times. Example 1 - Spurious Opening of the Train A Power-Operated Relief Valve A fire in either the control room or cable spreading room could result in a power-operated relief valve spuriously opening. To close the trains A and B power-operated relief valves, a relief reactor operator would, in accordance with Procedure ABN-803A, Attachment 2, transfer control of the power-operated relief valves from the control room to the remote shutdown panel. When this is accomplished, the fire induced hot short would be isolated and the power-operated relief valve would return to its closed position. According to Attachment 13 of Procedure ABN-803A, operators must complete this action within 5 minutes to avoid empting the pressurizer. Procedure ABN-803A, Attachment 2, step D instructed the relief reactor operator to transfer control of 46 switches at the transfer panel from the control room to the remote shutdown panel. The inspectors timed the completion of all 46 transfer switches to be 7 minutes and 24 seconds. The inspectors estimated that the transfer of the train A power-operated relief valve would occur at approximately 6 minutes. Attachment 2, step C, stated that the transfer of the 46 switches cannot be started until communication has been established with the reactor operator at the remote shutdown panel.

The inspectors determined from the walkthrough that the reactor operator performing Attachment 1 would not reach the remote shutdown panel until 4 minutes and 26 seconds after the reactor was tripped. Thus, the relief reactor operator could not procedurally start the transfer switch process until 4 minutes and 26 seconds, which delayed these actions. The inspectors estimated that the train A power-operated relief valve would not be closed until 10 minutes and 26 seconds after the reactor trip, which exceeded the 5 minute requirement in Procedure ABN-803A. Example 2 - Loss of Station Service Water Cooling to the Emergency Diesel Generators A fire in either the control room or cable spreading room could result in a loss-of-offsite power with the subsequent automatic start of both emergency diesel generators. In addition, the fire could also cause damage to the circuits of the station service water system resulting in the loss of cooling to the emergency diesel generators. Procedure ABN-803A, Attachment 1, step F, instructs the reactor operator to initiate station service water at the remote shutdown panel if it is not operating. The inspectors timed the completion of this step at 12 minutes and 7 seconds. Attachment 13 states that station service water must be initiated within 7 minutes. In Procedure ABN-803A, Attachment 2, step F, the relief reactor operator transfers the train A emergency diesel generator controls to "LOCAL." If the emergency diesel generator had undergone an emergency start from standby, the automatic high temperature trip would be bypassed. The relief reactor operator should recognize at this step that station service water cooling was not available and shut down the running emergency diesel generator at 9 minutes and 45 seconds. The licensee provided the inspectors Evaluation 2003-000404-01-00, which analyzed the effects of the loss of station service water cooling on emergency diesel water jacket water temperature. The analysis determined that during the summer, if the emergency diesel generator emergency starts from standby with a load of 6.3 MW, the time to failure of the emergency diesel generator would be 4 minutes and 4 seconds. The time to failure without cooling water under the expected load during postfire safe shutdown has not been specifically analyzed. Fire damage resulting in the automatic starting of the credited emergency diesel generator without starting the required station service water cooling could result in the loss of the electrical power supply credited for postfire safe shutdown since the procedure removes offsite power.

Analysis.

The inspectors and a senior reactor analyst evaluated each example of the violation as described below.

Example 1 - Spurious Opening of the Train A Power-Operated Relief Valve In the event of a postulated fire in the control room or cable spreading room, a pressurizer power-operated relief valve may spuriously open from fire damage. Inspectors determined that, by following Attachment 2 of Procedure ABN-803A, operators would not be able to close the open valve in a timely manner. This could result in the emptying of the pressurizer before level control could be established following a postulated control room abandonment. Failure to provide adequate

procedural guidance to implement the requirements of the approved fire protection program was a performance deficiency. The inspectors determined that this deficiency was more than minor because it is associated with the protection against external factors attribute of the Mitigating Systems cornerstone and could affect the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. The inspectors evaluated the deficiency using NRC Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process." However, the deficiency required a Phase 3 evaluation because Manual Chapter 0308, Attachment 3, Appendix F, "Technical Basis for Fire Protection Significance Determination Process for at Power Operations," states that Manual Chapter 0609, Appendix F, does not include explicit treatment of fires in the control room. As documented in Section 4OA5.4 of this inspection report, the analyst determined that the control room abandonment frequencies were 2.5 x 10

-5/year for postulated control room fires and 3.8 x 10

-6/year for postulated cable spreading room fires.

The controls and cabling for the power-operated relief valve are located in three different panels in the control room, one which contains cabling for both valves, and two termination cabinets in the cable spreading room. Additionally, at least one smart short would have to occur in the cabinet to fail a single valve open. The analyst estimated the conditional probability of this short to be 0.6 using accepted industry values. The resulting probability that a control room fire would affect the panels and/or cabinets of interest (PCR-Affected) is the fraction 2/116 multiplied by the probability of having a single smart short in the cabinet plus the fraction 1/116 multiplied by the probability of having one of two smart shorts in the cabinet (1.8 x 10

-2). Likewise, the probability that a cable spreading room fire would affect the panels and/or cabinets of interest (PCSR-Affected) is the fraction 2/99 multiplied by the probability of having a smart short in the cabinet or 1.2 x 10

-2. The intersections of postulated fires in either fire area that affect either of the subject valves leading to control room abandonment (intersection) were calculated as follows: Postulated Control Room Fire intersection = PCR-Affected

• EVAC = 1.8 x 10

-2

• 2.5 x 10

-5/year = 4.3 x 10

-7/year Postulated Cable Spreading Room Fire intersection = PCSR-Affected

• EVAC = 1.2 x 10

-2

• 3.8 x 10

-6/year = 4.7 x 10

-8/year As documented in Section 4OA5.4 of this inspection report, the analyst determined that the bounding delta conditional core damage probability for control room abandonment scenarios was 0.9.

Therefore, the bounding CDFs for an exposure period of 1 year were calculated as follows:

Postulated Control Room Fire CDF = intersection

• CCDP

• EXP = 4.3 x 10

-7/year

• 0.9

• 1 year = 3.9 x 10-7 Postulated Cable Spreading Room Fire CDF = intersection

• CCDP

• EXP = 4.7 x 10

-8/year

• 0.9

• 1 year = 4.2 x 10-8 Because postulated fire ignition frequencies for the control room and the cable spreading room are independent from each other, the total CDF can be determined by simple addition of the two probabilities above (4.3 x 10

-7).

As documented in Section 4OA5.4, the analyst determined that this finding was not significant with respect to the large-early release frequency. Therefore, the analyst determined that this finding was of very low risk significance (Green). Example 2 - Loss of Station Service Water Cooling to the Emergency Diesel Generators In the event of a postulated fire in the control room or cable spreading room, an automatic start of the train A emergency diesel generator could occur coincident with a fire-induced failure to provide cooling to the diesel via the station service water system. The inspectors determined that, by following Procedure ABN-803A, Attachment 1, operators would not be able to initiate station service water cooling in a timely manner. This could result in the failure of the electrical power supply credited following a postulated control room abandonment, namely the train A emergency diesel generator. Failure to provide adequate procedural guidance to implement the requirements of the approved fire protection program was a performance deficiency. The inspectors determined that this deficiency was more than minor because it is associated with the protection against external factors attribute of the Mitigating Systems cornerstone and could affect the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. The inspectors evaluated the deficiency using NRC Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process." However, the deficiency required a Phase 3 evaluation because Manual Chapter 0308, Attachment 3, Appendix F, "Technical Basis for Fire Protection Significance Determination Process for at Power Operations," states that Manual Chapter 0609, Appendix F, does not include explicit treatment of fires in the control room. As documented in Section 4OA5.4 of this inspection report, the analyst determined that the control room abandonment frequencies were 2.5 x 10

-5/year for postulated control room fires and 3.8 x 10

-6/year for postulated cable spreading room fires. The controls and cabling for the power-operated relief are located in three different panels in the control room, one which contains cabling for both valves, and two termination cabinets in the cable spreading room. Additionally, at least one smart short would have to occur in the cabinet to fail a single valve open. The analyst estimated the conditional probability of this short to be 0.6 using accepted industry values.

The resulting probability that a control room fire would affect the panels and/or cabinets of interest (PCR-Affected) is the fraction 2/116 multiplied by the probability of having a single smart short in the cabinet plus the fraction 1/116 multiplied by the probability of having one of two smart shorts in the cabinet (1.8 x 10

-2). Likewise, the probability that a cable spreading room fire would affect the panels and/or cabinets of interest (PCSR-Affected) is the fraction 2/99 multiplied by the probability of having a smart short in the cabinet or 1.2 x 10

-2. The intersections of postulated fires in either fire area that affect either of the subject valves leading to control room abandonment (intersection) were calculated as follows: Postulated Control Room Fire intersection = PCR-Affected

• EVAC = 1.8 x 10

-2

• 2.5 x 10

-5/year = 4.3 x 10

-7/year Postulated Cable Spreading Room Fire intersection = PCSR-Affected

• EVAC = 1.2 x 10

-2

• 3.8 x 10

-6/year = 4.7 x 10

-8/year As documented in Section 4OA5.4 of this inspection report, the analyst determined that the bounding delta conditional core damage probability for control room abandonment scenarios was 0.9. Therefore, the bounding CDFs for an exposure period of 1 year were calculated as follows: Postulated Control Room Fire CDF = intersection

• CCDP

• EXP = 4.3 x 10

-7/year

• 0.9

• 1 year = 3.9 x 10-7 Postulated Cable Spreading Room Fire CDF = intersection

• CCDP

• EXP = 4.7 x 10

-8/year

• 0.9

• 1 year = 4.2 x 10-8 Because postulated fire ignition frequencies for the control room and the cable spreading room are independent from each other, the total CDF can be determined by simple addition of the two probabilities above (4.3 x 10

-7).

As documented in Section 4OA5.4, the analyst determined that this finding was not significant with respect to the large-early release frequency. Therefore, the analyst determined that this finding was of very low risk significance (Green). As a compensatory measure, the licensee issued night orders to alert operators of these procedural concerns and has entered these issues into their corrective action program as Smart Form SMF-2009-004455-00.

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure ABN-803A, Revision 8 implemented the requirements for fires when the control room must be evacuated. The maximum times for operators to align the systems used for hot shutdown and to respond to spurious actuations because of fire damage were listed in Engineering Report ENR-2005-000316-01-00, "Thermal/Hydraulic Analysis of the Fire Safe Shutdown Scenario," Revision 0. Contrary to the above, the licensee failed to provide adequate procedural guidance for implementing their fire protection program. Specifically, for postfire safe shutdown operations the license provided inadequate procedural guidance for the timely

(1) closure of a spuriously open power-operated relief valve and

(2) securing the emergency diesel generator without service water cooling available to prevent potential damage. This finding could impact the ability to control reactor coolant system inventory and pressure and assure an electrical power supply to support the safe shutdown operations. Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-004455-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-06; 00500446/2009004-06, "Inadequate Alternative Shutdown Procedure."

4OA6 Meetings

Exit Meeting Summary

On August 18, 2009, the inspector presented the results of the fire protection triennial inspection unresolved items closeout to Mr. M. Lucas, Site Vice President, and other members of the licensee staff. The licensee acknowledged the information presented.

On October 1, 2009, the inspectors presented the resident inspection results to Mr. R. Flores, Senior Vice President and Chief Nuclear Officer, and other members of the licensee staff. The licensee acknowledged the issues presented. The inspectors acknowledged review of proprietary material during the inspection. No proprietary information has been included in the report.

1 ATTACHMENT 1

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Flores, Senior Vice President and Chief Nuclear Officer

M. Lucas, Site Vice President

S. Bradley, Manager, Radiation Protection

D. Fuller, Manager, Emergency Preparedness

T. Hope, Manager, Nuclear Licensing

D. Kross, Plant Manager

F. Madden, Director, Oversight and Regulatory Affairs

B. Mays, Director, Site Engineering

B. Patrick, Director, Maintenance

M. Pearson, Director, Performance Improvement

S. Sewell, Director, Operations

K. Tate, Manager, Security

D. Wilder, Manager, Plant Support

NRC Personnel

J. Kramer, Senior Resident Inspector

B. Tindell, Resident Inspector

LIST OF ITEMS

OPENED AND CLOSED

Opened and Closed

05000446/2009004-01 NCV Failure to Seal Electrical Enclosure (Section 1R05)

05000446/2009004-02 NCV Failure to Seal Electrical Penetrations (Section 1R06)

05000445/2009004-03

05000446/2009004-03 NCV Failure to Control Transient Equipment (Section 1R18)

05000445/2009004-04

05000446/2009004-04 NCV Inadequate Postfire Safe Shutdown Procedure (Section 4OA5.4)

05000445/2009004-05

05000446/2009004-05 NCV Failure to Assure That One Train of Equipment Is Free From Fire Damage (Section 4OA5.5)

05000445/2009004-06 NCV Inadequate Alternative Shutdown Procedure

Attachment 1

Opened and Closed

05000446/2009004-06 (Section 4OA5.6)

Closed

05000445/2008006-01

05000446/FIN-2008006-01 URI Inadequate Postfire Safe Shutdown Procedure

05000445/2008006-02

05000446/FIN-2008006-02 URI Unapproved Local Manual Actions For Hot Shutdown

05000445/2008006-04

05000446/FIN-2008006-04 URI Inadequate Alternative Shutdown Procedure

Section 1RO5: Fire Protection

PROCEDURES

NUMBER TITLE REVISION

ABN-901 Fire Protection System Alarms or Malfunctions 8

FPI-510 Electrical and Control Building Chiller Pump Rooms 3

ABN-805B Response to Fire in the Auxiliary Building or the Fuel Building 4

ABN-806B Response to Fire in the Electrical and Control Building 3

SMART FORMS

SMF-2009-001001-00

SMF-2009-000720-00 SMF-2009-000714-00

Section 1R12: Maintenance Effectiveness

SMART FORMS

SMF-2009-004780-00

Attachment 1 OTHER DOCUMENTS

Maintenance Rule Review Panel meetings 04-0226, 06-0321, & 09-0909 EVAL-2005-003441-06

Section 1R15: Operability Evaluations

PROCEDURES

NUMBER TITLE REVISION

MSM-C0-3831 Emergency Diesel Engine Cylinder Head Maintenance 3

WORK ORDERS

3756843

3770269

SMART FORMS

SMF-2009-003342-00

SMF-2009-003309-00 SMF-2009-004117-00

Section 1R18: Plant Modifications

PROCEDURES

NUMBER TITLE REVISION

STA-602 Temporary Modifications and Transient Equipment 16

STA-606 Control of Maintenance and Work Activities 29

10

CFR 50.59 Resource Manual 3

SMART FORMS

SMF-1999-001657-00

SMF-2009-001548-00

SMF-2008-003987-00

SMF-2009-001773-00

WORK ORDERS

2-07-173391-00

Attachment 1

Section 1R19: Postmaintenance Testing

PROCEDURES

NUMBER TITLE REVISION

MSM-P0-3343 Emergency Diesel Engine Crankshaft Deflection and Thrust Measurements

MSE-G0-6300 Breaker Enhancement Removal, Enhancement and Installation

SOP-630A 6900 V Switchgear 14

IONC-210 Instrumentation Tubing and Supports Installation and Rework 4

INC-2031 Valve Calibration Using Viper Control Valve Diagnostic System 0

INC-2012 Valve Calibration Fisher Controls Type 657 Air-to-Close Valve Actuators

MSM-C0-6604 Fisher Diaphragm Actuator Maintenance (Type 657, Sizes 30 - 60)

MSG-1060 Electrical Terminations (Wire Sizes 26 awg thru 10 awg) 1

MSE-G0-1212 Low Voltage Insulating Material Installation 4

OPT-204A SI System 13

WORK ORDERS

367376

397278

3766683

3665095

SMART FORMS

SMF-2009-004117-00

Attachment 1

Section 1R22: Surveillance Testing

PROCEDURES

NUMBER TITLE REVISION

TDM-804A Equipment Data Tank Height VS Volume 2

OPT-303 Reactor Coolant System Water Inventory

13

INC-7332B Analog Channel Operational Test and Channel Calibration Steam Generator Narrow Range Level

WORK ORDERS

3749480

3749478

3749476

3749474

SMART FORMS

SMF-2009-003905-00

SMF-2009-004038-00

SMF-2009-004058-00 SMF-2009-004630-00

Section 1EP6: Drill Evaluation

SMART FORMS

SMF-2009-004095-00

SMF-2009-004096-00

SMF-2009-004099-00

SMF-2009-004100-00

SMF-2009-004102-00 SMF-2009-004103-00

Section 4OA1: Performance Indicator Verification

SMART FORMS

SMF-2008-003132-00

Section 4OA2: Identification and Resolution of Problems

PROCEDURES

NUMBER TITLE REVISION

OPT-308 Estimated Critical Condition Calculation 8

Attachment 1

Section 4OA5: Other Activities

DRAWINGS NUMBER TITLE REVISION M1-0202

Flow Diagram Main Steam Reheat and Steam Dump

CP-33 M1-0202, Sheet 03 Flow Diagram Main Steam Reheat and Steam Dump

CP-2 M1-0206 Flow Diagram Auxiliary Feedwater System

CP-20 M1-0206, Sheet 01 Flow Diagram Auxiliary Feedwater Trains

CP-14 M1-0253 Flow Diagram Chemical and Volume Control System

CP-21 M1-0253, Sheet A Flow Diagram Chemical and Volume Control System

CP-10 M1-0255 Flow Diagram Chemical and Volume Control System Volume Control Tank Loop

CP-27 M1-0255, Sheet 01 Flow Diagram Chemical and Volume Control System Charging and Positive Pump Trains

CP-23 M1-0229, Sheet A Flow Diagram Component Cooling Water System

CP-21 M1-0229, Sheet B Flow Diagram Component Cooling Water System

CP-25 2323-EI-0601-11 Safeguard Building Cable Tray Segments Elevation 790'-6" 4 2323-EI-0603-11 Safeguard Building Cable Tray Segments Elevation 852'-6" 4 2323-EI-0713-12 Auxiliary and Electrical Control Buildings Cable Tray Segments Elevation 790'-6" & 792'-0"

2323-EI-0716-12 Electrical Equipment Area Cable Tray Segments Elevation 810'-6"

2323-EI-0717-12 Auxiliary and Electrical Control Buildings Cable Tray Segments Elevation 832'-0"

2323-EI-0603-11 Safeguard Building Cable Tray Segments Elevation 852'-6" 4

PROCEDURES

NUMBER TITLE REVISION

ABN-803A Response To a Fire In The Control Room or Cable Spreading Room 8

ABN-804A Response To a Fire In The Safeguards Building 5

Attachment 1 NUMBER TITLE REVISION

ABN-805A Response to Fire in the Auxiliary Building or the Fuel Building

ABN-806A Response To a Fire In The Electrical and Control Buildings 5

SOP-304A Auxiliary Feedwater System 16

MISCELLANEOUS DOCUMENTS

NUMBER TITLE REVISION / DATE

CPSES Fire Protection Report

3, 6, and 27

License Number

NPF-87 Luminant Generation Company LLC, Docket Number 50-445, Comanche Peak Steam Electric Station, Unit Number 1, Facility Operating License Amendment

139 FSAR Section 9.5.1 Fire Protection Program Amendments 78 & 87 50000445/87-22 NRC Inspection Report January 11, 1988 50000445/8839, 50000446/8833 NRC Inspection Report June 24, 1988NUREG-0797 Safety Evaluation Report Related to the Operation Comanche Peak Steam Electric Station July 1981

NUREG-0797 Safety Evaluation Report Related to the Operation Comanche Peak Steam Electric Station Supplements 12, 21, 23, 25, 26, and 27

Attachment 2 ATTACHMENT 2

RESULTS OF THE STAFF'S REVIEW OF MANUAL ACTIONS IN THE LICENSING BASIS

Background On July 24, 2008, Luminant Power submitted letter serial

CP-200800962,

TXX-08105, entitled "Comanche Peak Licensing Basis on Use of Manual Actions for Fire Protection."

This was submitted in response to the NRC's issuance of Unresolved Item 05000445/2008006-02;

05000446/2008006-02, "Unapproved Local Manual Actions for Hot Shutdown."

This letter requested that the staff consider information provided in the attachment of the letter in the resolution of Unresolved Item 05000445/2008006-02; 05000446/2008006-02. The following discussion addresses how the staff considered the licensee's information and provides the staff's conclusions. NRC Staff Review The NRC agreed to review the issues discussed in the licensee's letter.

The lead inspector and a senior reactor analyst visited the site to discuss the licensee's information and the NRC understanding of their licensing basis.

In addition, conference calls were held with licensee management on July 14 and 29, 2009.

As discussed in Section 4OA5 of this report, the staff has confirmed that the unresolved item was associated with a violation of NRC requirements.

The basis for this conclusion is expanded upon here. The licensee's letter documented why they believed that the NRC approved manual actions within the fire protection program.

Inspections had previously attempted to resolve this same question, but had been unable to resolve the meaning of unclear references that interconnected multiple documents.

However, during the 2008 triennial fire protection inspection, it became apparent that the proper issue that needed to be resolved related to whether the licensee met the requirements for protecting and separating components identified by the licensee as required to achieve and maintain a hot shutdown condition in the event of a fire.

These required components must be protected and separated so that they remain free of fire damage.

The manual actions of concern could only be assessed in the context of whether or not they were intended to restore redundant trains of required equipment because of inadequate protection and separation. The staff's review of the documents that comprise the approved fire protection program are specified in License Condition 2.G, which states: Luminant Generation Company LLC shall implement and maintain in effect all the provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (safety evaluation report) (NUREG-0797) and its supplements through SSER (supplemental safety evaluation report) 24, subject to the following provision: Luminant Generation Company LLC may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. In each of the documents that comprise the fire protection program defined by the license condition that were submitted by the then-applicant, the applicant described that one of the three methods that listed in 10

CFR 50, Appendix R, Section

III.G.2 would be used to satisfy the

NRC-required separation and protection schemes when more than one train of redundant Attachment 2 equipment was located in the same fire area, unless another method was justified.

The staff concluded that such a justification for an alternate method of compliance would necessarily require a specific request for the staff to approve a deviation from the existing separation and protection requirements.

The staff's review concluded that there were no deviations requested to substitute manual actions for recovering the use of required equipment that was susceptible to fire damage, and therefore no justification was provided to the NRC for approval. The staff also noted that for each section of the Fire Hazards Analysis dealing with a fire area where more than one of the redundant trains needed for safe shutdown had cables located in that area, the licensee stated that: "One set of the redundant equipment and components within the area is protected by one of the means provided in Section

II-4.5."

This statement reiterated on an area by area basis that the applicant met the NRC's separation requirements. The staff reviewed the NRC Safety Evaluation Report, which provided the bases for the NRC's decisions concerning the acceptability of the fire protection program.

Supplement 12 concluded that: "The applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability."

The safety evaluation report does not mention any exceptions to this conclusion. The staff reviewed the licensee's contention that the NRC had reviewed the applicant's use of manual actions.

The staff was able to confirm that the NRC had reviewed and approved a specific set of manual actions.

These were clearly documented in the fire protection program documents.

However, these manual actions related to addressing possible spurious operation caused by fire damage to equipment that was not required to achieve and maintain hot shutdown.

The NRC verified that manual actions involving non-required equipment that could prevent required equipment from achieving or maintaining hot shutdown could be performed within sufficient time to ensure the functioning of the required systems.

In some cases, this review involved manual actions that were required to be performed locally in the same area as the postulated fire.

Because these manual actions involved non-required components, manual actions that could be demonstrated to be reliably performed were determined by the NRC to be acceptable.

Supplement 12 stated: Associated circuits whose fire-induced spurious operation could affect shutdown were identified to determine those components whose maloperation could affect safe shutdown.

These spurious operations are terminated by operator actions.

The applicant identified these operator actions and allowed sufficient time to perform these actions.

On the basis of its evaluation, the staff concludes that these operator actions will terminate spurious operations that could affect plant shutdown. The licensee verbally reported that the NRC conducted onsite inspections into the details of manual actions beyond these examples.

Both the licensee and the staff were unable to locate documentation concerning the scope or results of such reviews.

In discussions with the licensee, it was apparent that the licensee's procedures and analyses had not documented the purpose for each manual action in the fire response procedures.

Inspection guidance caused them to focus on whether the manual actions were reasonable and feasible, not specifically why the manual actions were needed.

Fire response procedures can be expected to have acceptable operator manual actions, including: actions to implement the approved alternative shutdown strategy (i.e. control room evacuation); actions to control the plant so as to achieve and maintain a shutdown to hot standby condition; actions intended for property protection and good operating practice (e.g. securing equipment that is not being used for safe shutdown); and actions to address possible spurious operation caused by fire damage to equipment that was not required to achieve and maintain hot shutdown.

However, while actions to restore Attachment 2 equipment required for safe shutdown to hot standby are not acceptable, these actions can be challenging to differentiate from the acceptable actions.

The licensee was required to identify the list of equipment required for safe shutdown.

In Comanche Peak's case, the Safe Shutdown Equipment List is not typical of other sites; Comanche Peak's documents listed the required equipment at the system or function level, rather than at the component level.

Lists identifying individual components located in each fire area and requiring manual actions based on the location of a fire did not differentiate between components being operated to restore required safe shutdown functions and those being operated in response to spurious operations.

This added a significant challenge to identification of unacceptable manual actions that were intended to restore equipment that was actually required to have been protected from fire damage.

Following issuance of Unresolved Item

05000445; 446/2008006-02, inspectors requested that the licensee provide the purpose for the operator manual actions specified in fire response procedures where inspectors could not confirm the purpose.

The licensee's response provided the first clear indication that some of these manual actions were intended to restore required equipment that the licensee had previously recognized was not protected from fire damage. The inspectors also noted that the most challenging statement in the licensing basis documentation to place in context was a statement in the Fire Protection Report, Section

III-3.1.1, which listed assumptions used in the fire analyses methodology description.

It stated: Manual operations are allowed to achieve hot standby following a reactor trip and to maintain hot standby conditions. The licensee contended that this statement allows the use of manual actions.

The staff's review of the Safety Evaluation Report found that this part of the Fire Protection Report is not discussed.

However, operators are allowed to perform manual actions to operate plant equipment in the normal manner to achieve and maintain hot standby, whether the need arose from a fire or some other reason.

This statement does not specifically discuss using manual operations to restore equipment that was required to achieve and maintain hot standby that was damaged by fire and not available to be operated by the normal means.

This statement does not directly address separation or protection of equipment.

Therefore, the staff concluded that this statement does not have relevance to the requirements to separate and protect required equipment. For completeness, the staff also considered whether the licensee may have made a change to the approved fire protection program under the belief that such changes were permissible under with the provisions in License Condition 2.G.

The licensee clearly stated that the manual actions in question were not made as part of a change to the fire protection program as originally submitted for approval.