IR 05000482/2008010

IR 05000482-08-010, on 09/29/2008 - 12/09/2008, Wolf Creek Nuclear Operating Corporation, Wolf Creek Generating Station; Triennial Fire Protection Team Inspection

ML090020490
Person / Time
Site:	Wolf Creek
Issue date:	01/02/2009
From:	O'Keefe N NRC/RGN-IV/DRS/EB-2
To:	Muench R Wolf Creek
References
IR-08-010
Download: ML090020490 (43)

Text

UNITED STATES NUC LE AR RE G UL AT O RY C O M M I S S I O N ary 2, 2009

SUBJECT:

WOLF CREEK GENERATING STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000482/2008010

Dear Mr. Muench:

On December 9, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Wolf Creek Generating Station. The enclosed inspection report documents the inspection results, which were discussed on October 24, 2008, with Mr. M. Sunseri, Vice President Operations and Plant Manager, and other members of your staff. The final results for a number of issues were discussed in a telephonic exit meeting on December 9, 2008, with Mr. T. Garrett, Vice President Engineering, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents three NRC-identified findings. These findings were determined to involve two violations of NRC requirements of very low safety significance (Green) and one Severity Level IV violation. The report also documents a licensee-identified violation which was determined to be of very low safety significance. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, D.C.

20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Senior Resident Inspector at the Wolf Creek Generating Station.

Wolf Creek Nuclear Operating Corporation -2-In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Neil OKeefe, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-482 License No. NPF-42

Enclosure:

Inspection Report No. 05000482/2008010 w/Attachment: Supplemental Information

REGION IV==

Docket: 05000482 License: NPF-42 Report: 05000482/2008010 Licensee: Wolf Creek Operating Corporation Facility: Wolf Creek Generating Station Location: 1550 Oxen Lane SE Burlington, Kansas Dates: September 29 to December 9, 2008 Team Leader: S. Alferink, Senior Reactor Inspector, Engineering Branch 2 Inspectors: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 A. Dahbur, Senior Reactor Inspector, Engineering Branch 2 (Region III)

N. Okonkwo, Reactor Inspector, Engineering Branch 2 J. Adams, Reactor Inspector, Engineering Branch 1 Accompanying Personnel: K. Sullivan, Consultant (Brookhaven National Laboratory)

Approved by: Neil OKeefe, Chief Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

IR 05000482/2008010; 09/29/2008 - 12/09/2008; Wolf Creek Nuclear Operating Corporation;

Wolf Creek Generating Station; Triennial Fire Protection Team Inspection.

The report covered a two-week triennial fire protection team inspection by specialist inspectors.

Two Green findings and one Severity Level IV violation, which were non-cited violations (NCVs), were identified. The significance of most findings is indicated by their color (Green,

White, Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a Green non-cited violation of License Condition 2.C.(5),

Fire Protection, for the failure to ensure that a fire pump would automatically start upon low pressure in the fire main in the event of a fire in the communications corridor. The team determined that cables for both fire pumps were routed in cable trays in the communications corridor. As a result, a single fire could result in the failure of both fire pumps to start automatically or manually from the control room. A fire pump could be started locally to restore the water supply, but the delay would reduce the effectiveness of the fire suppression systems in limiting the growth of a fire and minimizing damage to safety-related equipment. The licensee entered this issue into the corrective action program as Condition Report 2008-005190.

Failure to ensure that a fire pump would automatically start upon low pressure in the fire main in the event of a fire in the communications corridor is a performance deficiency. This finding is more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences. The team judged the delay in starting a fire pump to be approximately five minutes. Using guidance in Manual Chapter 0609, Appendix F, Table 2.7.1, and Manual Chapter 0609, Appendix F,

Attachment 2, the team determined this issue to be categorized as a fixed fire protection finding with a low degradation. This finding is of very low safety significance because the finding was assigned a low degradation rating. This finding was not assigned a cross-cutting aspect because it has existed since original construction and does not represent current performance. (Section 1R05.04)

Green.

The team identified a non-cited violation of License Condition 2.C.(5), Fire Protection, for operator actions taken in response to fire damage in Fire Area (Reactor Trip Switchgear Room 1403) that remove the ability to remotely operate equipment required for post-fire safe shutdown. Specifically,

Procedure OFN KC-016, Fire Response, directs operators to remove the Train B 125 Vdc control power supply if a fire in Fire Area causes the Train B power-operated relief valve to spuriously open and its associated block valve fails to close. Removing the Train B 125 Vdc control power supply affects several of the functions credited for post-fire safe shutdown in Fire Area A-27. The licensee entered this issue into the corrective action program as Condition Report 2008-005210.

Removing the ability to remotely operate equipment required for post-fire safe shutdown, as specified in Procedure OFN KC-016, is a performance deficiency.

This finding is more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences. The team determined the risk significance using Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process.

This finding is of very low safety significance since all fire ignition sources screened out and a hot gas layer would not form in this area. This finding was not assigned a cross-cutting aspect because the cause was not representative of current performance. (Section 1R05.07.b(2))

• SL-IV. The team identified a Severity Level IV non-cited violation for making changes to the approved fire protection program in a manner contrary to the requirements of License Condition 2.C.(5).(b). Prior to 2005, the licensee made multiple revisions to Procedure OFN RP-017, Control Room Evacuation, without demonstrating the changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. Specifically, the licensee had revised the alternative shutdown procedure to allow some manual actions to be completed in times longer than the approved time commitments. When revising the alternative shutdown procedure, the licensee did not evaluate the changes to ensure they would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. The licensee entered this issue into the corrective action program as Performance Improvement Request 2005-3317.

Failure to demonstrate that changes to the approved fire protection program would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire prior to changing the alternative shutdown procedure is a performance deficiency. This finding is more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences. This finding was assessed using traditional enforcement since it had the potential for impacting the NRCs ability to perform its regulatory function. Using the guidance in Section D.3 of Supplement I of the NRC Enforcement Policy, this violation was determined to be a Severity Level IV violation since the licensee implemented corrective actions, provided a technical evaluation for the new alternative shutdown procedure, and performed an evaluation of the changes made in the alternative shutdown procedure. This finding was not assigned a cross-cutting aspect because the procedure changes were made in the 2005 timeframe and do not represent current performance.

(Section 4OA5.02)

Licensee-Identified Violations

A violation of very low safety significance that was identified by the licensee has been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. This violation and the corrective action tracking number are listed in Section 4OA7 of this report.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at the Wolf Creek Generating Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas, with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T, Fire Protection (Triennial), requires the selection of three to five fire areas for review. The inspection team used the fire hazards analysis section of the Wolf Creek Generating Station Individual Plant Examination of External Events to select the following five risk-significant fire areas (inspection samples) for review:

• Fire Area A-8 Auxiliary Building - 2000 Elevation, General Area

• Fire Area A-16 Auxiliary Building - 2026 Elevation, General Area

• Fire Area A-17 South Electrical Penetration (Room 1409)

• Fire Area C-27 Control Room

• Fire Area C-35 Control Building Corridor - 2016 Elevation The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(5), NRC Safety Evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Updated Final Safety Analysis Report (UFSAR), Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment.

.01 Shutdown From Outside Main Control Room

a. Inspection Scope

The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the UFSAR, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained for fires in areas where post-fire safe shutdown relies on manipulating shutdown equipment from outside the control room. The team verified that hot and cold shutdown could be achieved and maintained with or without offsite power available. The team also verified that the safe shutdown analysis properly identified the components and systems needed to achieve and maintain safe shutdown conditions.

b. Findings

Introduction.

The team identified an unresolved item concerning the availability of diagnostic instrumentation needed to respond to a loss of reactor coolant pump seal cooling during certain fire scenarios.

Description.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. One of the procedures covered by this requirement is Procedure OFN KC-016, Fire Response.

Procedure OFN KC-016, Revision 19, identified that fire damage in the following four fire areas could isolate both reactor coolant pump seal injection and thermal barrier cooling:

• Fire Area A-21 Control Room AC and Filtration Units (Room 1501)

• Fire Area C-22 Upper Cable Spreading (Room 3801)

• Fire Area C-30 South Vertical Cable Chase (Room 3617)

Control Building Elevation 2047-6 to 2073-6

• Fire Area C-33 South Vertical Cable Chase (Room 3804)

Control Building Elevation 2073-6 Reactor coolant pump seal injection and thermal barrier cooling are the two methods used to cool the reactor coolant pump seals. One method of seal cooling must be maintained during reactor coolant pump operation to prevent seal failure, which, in some cases, could lead to increased seal leakage beyond the capacity of the charging pump.

Procedure OFN KC-016 requires operators to recognize when one or both seal cooling methods were lost and take specific mitigating actions.

While checking the feasibility of manual actions, the team identified that neither Procedure OFN KC-016 nor any other fire protection program document identified the instrumentation needed to identify a loss of seal cooling. Since the procedure required operators to recognize the loss of cooling and take response actions and the procedure did not identify the instrumentation to be used, the team could not verify that it would remain free of fire damage for fires in these four fire areas.

Analysis.

The team was unable to verify that manual actions used as compensatory measures for potential fire damage could be reliably performed (these compensatory measures were implemented in response to Apparent Violation 05000482/2005008-03, Failure to Ensure Redundant Safe Shutdown Systems Are Protected in Accordance with the Provisions of the Approved Fire Protection Program). If the operators failed to implement appropriate actions, seal failure and an uncontrolled loss of coolant could occur. Such a seal failure was not analyzed as part of the approved fire protection program. The team determined that this deficiency may be more than minor because it was associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

Additional information is needed from the licensee in order to determine whether the instrumentation needed to promptly recognize and diagnose challenges to reactor coolant pump seal cooling was available and would be free of fire damage. The significance of this issue will be determined if this issue does involve a performance deficiency. The licensee implemented an hourly fire watch in the affected fire areas as a compensatory measure. The licensee entered this issue into their corrective action program as Condition Report 2008-005171.

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Report E-1F9910, Post-Fire Safe Shutdown Analysis, Revision 4, documents an area-by-area analysis of the post-fire safe shutdown capability. The post-fire safe shutdown analysis is part of the approved fire protection program as defined in License Condition 2.C.(5), Fire Protection.

The post-fire safe shutdown analysis identified the potential for the loss of reactor coolant pump seal injection and thermal barrier cooling for fires in Fire Areas A-21, C-22, C-30, and C-33. Procedure OFN KC-016, Fire Response, Revision 19, identified the operator actions necessary to mitigate possible failures of equipment due to fire damage in order to implement the post-fire safe shutdown analysis.

The team was concerned that the procedural guidance provided may not be adequate to allow operators to successfully perform the required post-fire safe shutdown actions required by the approved fire protection program. This issue could impact the ability to control reactor coolant system inventory and pressure to support the post-fire safe shutdown.

Additional information is needed from the licensee in order to determine whether the instrumentation needed to promptly recognize and diagnose challenges to reactor coolant pump seal cooling was available and would be free of fire damage. This information is needed to determine whether a violation existed for this issue. Therefore, this issue is being treated as an unresolved item (URI): URI 05000482/2008010-01, Post-Fire Safe Shutdown Procedure Did Not Identify Diagnostic Instrumentation.

.02 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walk-downs of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the licensee properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G.

Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire. In addition, the team verified that the licensee met license commitments.

b. Findings

No findings of significance were identified.

.03 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and ensure the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings of significance were identified.

.04 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the manual and automatic detection and suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps and Halon or carbon dioxide storage tanks and supply system) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pump flow and pressure tests to ensure that the pumps met their design requirements. The team also reviewed the fire main loop flow tests to ensure the flow distribution circuits met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected the fire brigade equipment (including smoke removal equipment) to determine operational readiness for fire fighting.

In lieu of observing a fire drill, the team observed live fire training, conducted on October 3, 2008, and the subsequent training critique using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly. The team observed off-watch fire brigade members fight a fire in the licensees live fire training facility, located in the owner controlled area away from the plant. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient fire fighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(5), Fire Protection, for the failure to ensure that a fire pump would automatically start upon low pressure in the fire main in the event of a fire in the communications corridor.

Description.

The fire suppression water supply system contains two 100 percent capacity fire pumps located in the circulating water screenhouse. One pump is required to supply water for fixed water suppression systems and fire hoses. Each pump is designed to start automatically upon low pressure in the pump discharge header. The pumps may also be started manually from the control room or locally in the circulating water screenhouse.

The team determined that cables for both fire pumps were located in Fire Areas C-21 (Lower Cable Spreading Room) and CC-1 (Communications Corridor). Fire damage could cause a short to ground on a single cable, which could prevent the automatic starting or manual starting from the control room of its associated pump. However, damage to these fire pump cables after a pump was started would not prevent the pump from continuing to run.

The team determined that a fire in the lower cable spreading room would not result in the failure of both fire pumps because of the presence of a pre-action sprinkler system.

The team determined that the pre-action system would charge the sprinkler header prior to the expected time needed to damage the fire pump cables. Charging the header would cause a fire pump to automatically start on low pressure in the fire main while the

fire was still in the incipient stage. Since subsequent fire damage would not prevent the pumps from continuing to run, a fire in the lower cable spreading room would not affect the availability of the water supply for the required automatic or manual fire suppression systems.

The team determined that a fire in the communications corridor could result in the failure of both fire pumps to start automatically or manually from the control room. The team noted that the communications corridor did not have a pre-action sprinkler system.

Instead, the licensee relied on manual hose stations and fire extinguishers for fire suppression. The team determined that the licensee would likely not recognize the inability of the fire pumps to automatically start until after the fire brigade arrived and attempted to fight the fire.

Analysis.

The failure to ensure that a fire pump would automatically start upon low pressure in the fire main in the event of a fire in the communications corridor was a performance deficiency. The team determined that this deficiency was more than minor because it was associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences. In particular, a fire in the communications corridor has the potential to lead to a loss of offsite power if not promptly extinguished.

The significance of this finding was evaluated using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving suppression. This finding was associated with the fixed fire protection system category.

The team reviewed the locations of the control cables for both fire pumps in the communications corridor and concluded that there were fire sources which could potentially damage the cables for both pumps. The team determined there were no design features or procedural actions which ensured that a fire pump would be started prior to damaging fire pump cables for a fire in the communications corridor. Since either fire pump could be started locally, the significance of cable damage involved the potential to delay fire suppression activities.

The team judged the delay in locally starting a fire pump to be approximately five minutes after the fire brigade attempted to pressurize the first fire hose. Using guidance in Manual Chapter 0609, Appendix F, Table 2.7.1, Non-suppression Probability Values for Manual Fire Fighting Based on Fire Duration (Time to Damage after Detection) and Fire Type Category, and Manual Chapter 0609, Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, the team concluded the performance deficiency minimally impacted the performance and reliability of the manual suppression system. This finding was assigned a low degradation rating and screened as Green in Step 1.3 of the fire protection significance determination process.

As a compensatory measure, the licensee modified Procedure OFN KC-016, Fire Response, to require the fire pumps be started upon detection of a fire in the communications corridor. The licensee entered this issue into their corrective action

program as Condition Report 2008-005190. This finding was not assigned a cross-cutting aspect because it has existed since original construction and does not represent current performance.

Enforcement.

License Condition 2.C.(5) states, in part, that the licensee shall maintain in effect all provisions of the approved fire protection program as described in the Standardized Nuclear Unit Power Plant System (SNUPPS) Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek Site Addendum through Revision 15, and as approved in the Safety Evaluation Report through Supplement 5. The Wolf Creek Updated Safety Analysis Report combined the SNUPPS Final Safety Analysis Report, Revision 17, and the Wolf Creek Site Addendum, Revision 15, into one document. The Updated Safety Analysis Report and Safety Evaluation Report, Supplement 5, Section 9.5.1.1, state that the fire pumps will automatically start upon low pressure in the fire main.

Contrary to the above, since construction, the licensee failed to implement and maintain in effect some provisions of the approved fire protection program. Specifically, the licensee failed to ensure that a fire pump would automatically start upon low pressure in the fire main. A single fire in the communications corridor could damage cables associated with both fire pumps and prevent the automatic and remote starting of the fire pumps. Because this finding is of very low safety significance and has been entered into the corrective action program, this finding is being treated as a non-cited violation, consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000482/2008010-02, Failure to Ensure a Fire Pump Would Automatically Start for One Fire Area.

.05 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, are not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train).

• Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings of significance were identified.

.06 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the UFSAR, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room. This review verified that these conditions could be achieved and maintained with or without offsite power available.

Plant walkdowns were conducted to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location(s) would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that the licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown are trained and available onsite at all times, exclusive of those assigned as fire brigade members.

An independent walkthrough of the post-fire safe shutdown procedure was performed to determine the adequacy of the procedure and ensure the implementation and human factors adequacy of the procedure. The team verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified included restoring electrical power, establishing the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team reviewed manual actions to ensure that they had been properly reviewed and approved and that the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to ensure the tests are adequate to ensure the functionality of the alternative shutdown capability.

b. Findings

Introduction.

The team identified an unresolved item concerning changes made to the NRC-approved fire protection program that potentially adversely affected the ability to achieve and maintain safe shutdown in the event of a fire without prior NRC staff approval. Specifically, the licensee changed the approved fire protection program to allow some voiding in the core in the event of a control room fire which caused a pressurizer power-operated relief valve to spuriously open.

Description.

During a triennial fire protection inspection in 2005, the team identified an apparent violation concerning the failure to assure reactor coolant system subcooling during an alternative shutdown with both pressurizer power-operated relief valves spuriously opening due to fire damage. This issue was documented as Apparent Violation 05000482/2005008-02, Failure to Maintain Reactor Coolant System Subcooling During the Alternative Shutdown.

Calculation AN-02-021, OFN RP-017, Control Room Evacuation Consequence Evaluation, Revision 0, had predicted reactor coolant system subcooling margin would not be maintained, significant voiding would occur in the core, and a steam void would form in the reactor vessel head during an alternative shutdown scenario with both pressurizer power-operated relief valves spuriously opening. The licensee had concluded this was acceptable since the calculation demonstrated the void formation would be limited, natural circulation would be maintained in the reactor coolant system, sufficient decay heat removal would be maintained, and no fuel damage would occur.

This violation was treated as an apparent violation because the team determined it met the criteria of the NRC Enforcement Manual, Section 8.1.7.1 for deferring enforcement actions for postulated fire induced circuit failures. The licensee considered the spurious opening of both pressurizer power-operated relief valves to be outside of the plant licensing basis for the fire protection program since multiple spurious operations were necessary for this condition to occur. The NRC has been working to clarify the regulatory requirements for addressing multiple spurious actuations.

Since the 2005 triennial fire protection inspection, the licensee made significant changes to the alternative shutdown methodology implemented by Procedure OFN RP-017, Control Room Evacuation. The licensee also developed Report E-1F9915, Design Basis Document for OFN RP-017, Control Room Evacuation, Revision 0, and Evaluation SA-08-006, RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire, Revision 0, to demonstrate the adequacy of the revised alternative shutdown procedure. These new evaluations predicted that a fire in the control room causing a single pressurizer power-operated relief valve to spuriously open could cause a steam bubble to void approximately 40 percent of the reactor vessel head.

The team performed walkthroughs of the revised alternative shutdown procedure with both licensed and non-licensed operators. The team confirmed that the operators could perform all time critical steps within the limits used to develop Report E-1F9915 and Evaluation SA-008-006. The team was initially unable to confirm the adequacy of the current alternative shutdown procedure because Evaluation SA-008-006 did not present enough parameters to demonstrate plant performance and did not include specific acceptance criteria. The licensee was able to revise the evaluation to include enough

plant parameters to demonstrate plant performance and provided a statement of the acceptance criteria which were used to conclude the plant performance was acceptable.

The approved fire protection program appeared to require the licensee to meet the requirements of 10 CFR Part 50, Appendix R, Section III.L.Section III.L states, in part, that, During the post-fire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal a.c. power. However, one of the acceptance criteria used in Evaluation SA-008-006 states, It is not necessary to maintain reactor process variables within those predicted for a loss of normal a.c. power as long as the analysis demonstrates that a control room fire will not result in the plant reaching an unrecoverable condition, which could lead to core damage.

The licensee stated that their current licensing basis allowed them to use the prevention of an unrecoverable condition, citing letter SLNRC 84-0109, dated August 23, 1984.

This letter provided the staff with the SNUPPS response plan for a postulated control room fire. It noted that implementation of the response plan for a control room fire would ensure that the plant would not reach an unrecoverable condition which could result in core damage.

The team noted that the licensee did not identify this as a deviation from the requirements of 10 CFR Part 50, Appendix R, Section III.L.1, nor did the NRC approval of the alternative shutdown approach in the safety evaluation report (NUREG-0881, Supplement Number 5) acknowledge any such deviation.

License Condition 2.C.(5).(b) states, The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. The team was concerned that the licensee changed the fire protection program in a manner that could adversely affect the ability to achieve and maintain safe shutdown in the event of a fire without prior NRC approval. However, the staff is conducting additional reviews to determine whether the license condition could allow the licensee to use different criteria to determine the acceptability of an adverse effect than the criteria used by the NRC.

Analysis.

Changing the approved fire protection program in a manner that could adversely affect the ability to achieve and maintain safe shutdown in the event of a fire without prior NRC staff approval was potentially a performance deficiency. The team determined that this may be more than minor because it was associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The licensee implemented an hourly fire watch in the control room as a compensatory measure. The licensee entered this issue into their corrective action program as Condition Report 2008-005208. Additional NRC action is needed to determine whether this issue involves a performance deficiency and to determine significance.

This issue does not involve a current safety concern because Evaluation SA-08-006 demonstrated that no core damage would occur and steam voiding in the reactor could be corrected.

Enforcement.

License Condition 2.C.(5).(b) states that the licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. The approved fire protection program appears to require that the licensee meet the technical requirements of 10 CFR Part 50, Appendix R, Section III.L.Section III.L requires that the reactor coolant system process variables be maintained within those predicted for a loss of normal a.c. power during the post-fire shutdown.

The team was concerned that the licensee was not meeting the technical requirements of 10 CFR Part 50, Appendix R, Section III.L. Specifically, the team was concerned that the licensee did not assure that the reactor coolant system process variables would be maintained within those predicted for a loss of normal a.c. power during the post-fire shutdown, as demonstrated by the presence of voiding in the core. The team was able to confirm that the licensee demonstrated no fuel damage would occur in an alternative shutdown scenario due to a control room fire with a single pressurizer power-operated relief valve spuriously opening.

The team was also concerned that the licensee made changes to the approved fire protection program that could adversely affect the ability to achieve and maintain safe shutdown in the event of a fire without prior approval of the Commission. Specifically, the team was concerned that the licensee changed the approved fire protection program to allow voiding in the core in the event of a control room fire which caused a pressurizer power-operated relief valve to spuriously open, contrary to the requirements of 10 CFR Part 50, Appendix R, Section III.L. The team believes that this change is considered an adverse effect on the ability to achieve and maintain safe shutdown.

Pending a final staff position to determine whether this concern involved a violation of NRC requirements and analyses to determine the safety significance of this finding, this issue is being treated as an unresolved item: URI 05000482/2008010-03, Changes to the Approved Fire Protection Program May Not Meet NRC Acceptance Criteria.

.07 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The teams evaluation focused on the cables of selected components from the auxiliary feedwater, chemical volume and control, essential service water, main steam atmospheric vent, and main steam isolation systems. For the sample of components selected, the team reviewed electrical elementary and block diagrams and identified

power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. Specific components reviewed by the team are listed in the attachment.

b. Findings

(1) Operator Actions May Create the Potential for Secondary Fires

Introduction.

The team identified an unresolved item concerning the potential that operator actions taken in response to fires in 14 fire areas may cause secondary fires and invalidate the safe shutdown analysis.

Description.

Procedure OFN KC-016, Fire Response, Revision 19, specified operator actions to be taken in response to fires outside of the control room. This procedure provides the mitigating actions needed to maintain hot standby in the event of various failures and spurious actuations. The team identified the following 14 fire areas where the mitigating actions may cause secondary fires and invalidate the safe shutdown analysis:

• Fire Area A-8 Auxiliary Building - 2000 Elevation, General Area

• Fire Area A-11 Cable Chase (Room 1335)

• Fire Area A-16 Auxiliary Building - 2026 Elevation, General Area

• Fire Area A-17 South Electrical Penetration (Room 1409)

• Fire Area A-18 North Electrical Penetration (Room 1410)

• Fire Area A-27 Reactor Trip Switchgear (Room 1403)

• Fire Area C-18 North Vertical Cable Chase (Room 3419)

• Fire Area C-21 Lower Cable Spreading (Room 3501)

• Fire Area C-22 Upper Cable Spreading (Room 3801)

• Fire Area C-23 South Vertical Cable Chase (Room 3505)

• Fire Area C-24 North Electrical Chase (Room 3504)

• Fire Area C-30 South Vertical Cable Chase (Room 3617)

• Fire Area C-33 South Vertical Cable Chase (Room 3804)

• Fire Area RB Reactor Building (Containment)

For these 14 fire areas, the procedure directs the operators to remove power to a power-operated relief valve if a fire causes the power-operated relief valve to spuriously open and operators are unable to close its associated block valve. Specifically, the procedure directs the operators to open circuit breakers on the associated 125 Vdc power supply. The inspectors noted that the failure of the block valve to close is considered fire damage and is not considered a spurious operation of the valve.

The licensee specified this action in order to close the power-operated relief valve and preclude the potential for spurious opening due to inter-cable faults (i.e., cable-to-cable hot shorts). However, the team determined this action would also remove the control power used to operate 4160 Vac and 480 Vac circuit breakers. The removal of control power would prevent remote breaker operations and disable circuit breakers protective trips for the train affected by the fire.

Removing control power to the circuit breaker results in a loss of its ability to automatically isolate faults before severe damage occurs. As a result, fire-induced faults (shorts to ground) in non-essential power cables of the affected 4160 Vac and 480 Vac supplies may not clear until after tripping an upstream feeder breaker to the supplies, which would remove power from equipment which was assumed by the safe shutdown analysis to be unaffected. This action would prevent breakers from automatically opening during an overload condition and has the potential to initiate secondary fires in plant locations outside of the initial fire area.

The safe shutdown analysis assumed that a fire is present in only one fire area at any time. The team determined that the operator actions taken in response to fires in the listed fire areas had the potential to initiate secondary fires in other plant locations, which would invalidate the safe shutdown analysis and could impact the ability to achieve and maintain safe shutdown.

Analysis.

The team was concerned that operator actions specified for responding to the fire-induced spurious opening of a pressurizer power-operated relief valve could remove electrical circuit protection and create the potential for secondary fires outside the initial fire area. Taking actions that could create secondary fires was potentially a performance deficiency. The team determined that this deficiency may be more than minor because it was associated with the Protection Against External Factors attribute of the Initiating Events Cornerstone and could affect the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

Additional information is needed from the licensee to understand the potential for secondary fires and the possible locations of those fires based on the circuit design and remaining protection available. The licensee will provide the routing of power-operated relief valve cables in the 14 fire areas of concern and will identify the affected components where breaker coordination would be lost. The significance of this issue will be determined if this issue does involve a performance deficiency.

As a compensatory measure, the licensee implemented an hourly fire watch in the affected fire areas, with the exception of the reactor building, which is not readily accessible during power operations. For the reactor building, the licensee is monitoring the containment temperature as a compensatory measure. The licensee entered this issue into their corrective action program as Condition Report 2008-005210.

Enforcement.

License Condition 2.C.(5) states, in part, that the licensee shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek Site Addendum through Revision 15, and as approved in the Safety Evaluation Report through Supplement 5. The Wolf Creek Updated Safety Analysis Report combined the SNUPPS Final Safety Analysis Report, Revision 17, and the Wolf Creek Site Addendum, Revision 15, into one document.

Appendix 9.5B of the Updated Safety Analysis Report provides an area-by-area analysis of the power block that incorporated Drawing E-1F9905, Fire Hazards Analysis, Revision 2, by reference. Drawing E-1F9905 states that the overall intent is to demonstrate that a single plant fire will not negatively affect the post-fire safe shutdown

capability and that if a circuit damaged by a fire is protected by an individual overcurrent protection device, that device is assumed to function to clear the fault.

The team was concerned that operator actions specified for responding to the fire-induced spurious opening of a pressurizer power-operated relief valve could remove electrical circuit protection and create the potential for secondary fires outside the initial fire area. Specifically, removal of control power to 4160 Vac and 480 Vac circuit breakers prevents operation of the devices overcurrent protection function. Failure of circuit breakers to clear faults on power cables damaged by fire would create the potential for the overcurrent condition to start a secondary fire at another location. The plants post-fire safe shutdown capability has only been evaluated for damage due to a single fire.

Additional information is needed from the licensee to understand whether there is a credible potential for secondary fires and the possible locations of those fires based on the circuit design and remaining protection available. The licensee will provide the routing of power-operated relief valve cables in the 14 fire areas of concern and will identify the affected components where breaker coordination would be lost. This information is needed to determine whether a violation existed for this issue. Therefore, this issue is being treated as an unresolved item: URI 05000482/2008010-04, Operator Actions May Create the Potential for Secondary Fires.

(2) Operator Actions Affect the Ability to Operate Post-Fire Safe Shutdown Equipment

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(5), Fire Protection, for operator actions taken in response to fire damage in Fire Area A-27 (Reactor Trip Switchgear Room 1403) that remove the ability to remotely operate equipment required for post-fire safe shutdown.

Description.

Procedure OFN KC-016, Fire Response, Revision 19, specified operator actions to be taken in response to fires outside of the control room. This procedure provides the mitigating actions needed to maintain hot standby in the event of various failures and spurious actuations, and it is based on operators using equipment in the control room.

The procedure directs the operators to remove power to a power-operated relief valve if a fire in Fire Area A-27 causes the Train B power-operated relief valve to spuriously open and operators are unable to close its associated block. Specifically, the procedure directs the operators to open circuit breakers on the associated 125 Vdc control power supply.

The licensee specified this action in order to close the power-operated relief valve and preclude the potential for spurious opening due to inter-cable faults (i.e., cable-to-cable hot shorts). However, the team determined that this action would also remove the ability to remotely operate the train of equipment relied upon for post-fire safe shutdown. The inspectors noted that the failure of the block valve to close is considered fire damage and is not considered a spurious operation of the valve.

The safe shutdown analysis credits Train B equipment for post-fire safe shutdown for a fire in Fire Area A-27. Removing 125 Vdc control power to this equipment affects several of the functions credited for post-fire safe shutdown. The Train B components that were credited for post-fire safe shutdown and would be affected by removing the Train B 125 Vdc control power supply included:

• Motor-driven auxiliary feedwater pump

• Centrifugal charging pump

• Essential service water pump

• Component cooling water pump

• Emergency diesel generator The inspectors determined that removing 125 Vdc control power would prevent the affected pumps from being manually started or stopped from the control room, as directed in the operating procedures. The inspectors noted, however, that the pumps could still be started or stopped locally. The team determined that removing 125 Vdc control power would also prevent the operation of the associated emergency diesel generator and would stop the diesel generator if it was already running.

Analysis.

Taking actions in response to a fire in Fire Area A-27 that remove the ability to remotely operate the train of equipment required for post-fire safe shutdown was a performance deficiency. The team determined that this deficiency was more than minor because it was associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The team initiated an evaluation of this finding using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it has the potential to affect fire protection defense-in-depth strategies involving post-fire safe shutdown systems.

This finding was associated with the post-fire safe shutdown category. It was assigned a moderate degradation rating since the performance deficiency affected the ability to remotely start and stop some of the equipment required for post-fire safe shutdown from the control room. However, with the exception of the emergency diesel generator, operators would still be able to control the equipment locally. Additionally, the team determined that none of the affected equipment was located in Fire Area A-27.

The team performed a Phase 2 analysis to determine the risk significance. The team determined that the power-operated relief valve cables were located outside of the zone of influence of the nearest ignition source. Additionally, the team determined that no hot gas layer was expected based on the available fire sources. This issue screened as Green in Step 2.3 of the fire protection significance determination process.

The licensee implemented an hourly fire watch in Fire Area A-27 as a compensatory measure. The licensee entered this issue into their corrective action program as Condition Reports 2008-004075 and 2008-005172. This finding was not assigned a cross-cutting aspect because it has existed since original construction and does not represent current performance.

Enforcement.

License Condition 2.C.(5) states, in part, that the licensee shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek Site Addendum through Revision 15, and as approved in the Safety Evaluation Report through Supplement 5. The Wolf Creek Updated Safety Analysis Report combined the SNUPPS Final Safety Analysis Report, Revision 17, and the Wolf Creek Site Addendum, Revision 15, into one document.

Appendix 9.5B of the Updated Safety Analysis Report provides an area-by-area analysis of the power block that incorporated Drawing E-1F9905, Fire Hazards Analysis, Revision 2, by reference. Drawing E-1F9905 states that a success path of post-fire safe shutdown equipment, unaffected by a fire in Fire Area A-27, would remain available for achieving and maintaining hot standby.

Contrary to the above, since construction, the licensee failed to implement and maintain in effect some provisions of the approved fire protection program. Specifically, the licensee failed to ensure that a success path of post-fire safe shutdown equipment would remain available for achieving and maintaining hot standby in the event of a fire in Fire Area A-27. Specifically, the operator actions that respond to potential fire damage to the Train B power-operated relief valve would eliminate the ability to remotely control the required train of safe shutdown equipment. Because this finding is of very low safety significance and has been entered into the corrective action program, this finding is being treated as a non-cited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000482/2008010-05, Operator Actions Affect the Ability to Operate Post-Fire Safe Shutdown Equipment.

.08 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems are available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that communications equipment such as repeaters and transmitters would not be affected by a fire.

b. Findings

No findings of significance were identified.

.09 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions are required. The team evaluated the

locations and positioning of the emergency lights during a walkthrough of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials (e.g., pre-cut cable connectors with prepared attachment lugs) were available and accessible on site.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions or capabilities). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings of significance were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team verified that the licensee identified fire protection and post-fire safe shutdown issues at an appropriate threshold and entered them into the corrective action program.

The team also reviewed a sample of selected issues to verify that the licensee had taken or planned appropriate corrective actions.

The NRC previously identified Apparent Violation 05000482/2005008-03, Failure to Ensure Redundant Safe Shutdown Systems Are Protected in Accordance with the Provisions of the Approved Fire Protection Program. The licensee had credited local manual actions to mitigate the effects of fire damage in lieu of providing the physical separation, physical protection, or an appropriate diverse means of accomplishing the safe shutdown function for fires that did not require control room evacuation. The licensee has maintained these local manual actions as interim compensatory measures pending completion of final corrective actions. The team performed walkthroughs and tabletop reviews with licensed operators to verify that these local manual actions could be reasonably accomplished and post-fire safe shutdown could be achieved. For the selected sample, the team determined the operators were able to perform all of the local manual actions using the current plant procedures and post-fire safe shutdown could be achieved.

The team also reviewed the licensees actions to address Unresolved Item 05000482/2005008-04, Lack of Evaluations of Changes to the Approved Fire Protection Program. Specifically, the licensee had previously revised Procedure OFN RP-017, Control Room Evacuation, without demonstrating the changes did not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. The changes of concern allowed some manual actions to be completed in times longer than the approved time commitments. This issue was unresolved because the licensee did not have a technical basis for the alternative shutdown procedure, so the inspectors were unable to determine risk significance until the licensee performed a technical analysis to be used as the basis for the alternative shutdown procedure.

The team determined that the licensee did not perform the evaluation requested in the unresolved item, and did not contact the NRC to discuss alternatives to the requested evaluation. Instead, the licensee made significant changes to improve the alternative shutdown procedure, and performed a technical evaluation of the most recent revision of the procedure, Revision 29, rather than evaluating the revision that was in effect at the time this unresolved item was issued. While this action may have restored compliance under a new set of circumstances, taking this corrective actions path prevented the NRC from assessing the significance of the violation directly.

While the staff was unable to explicitly assess the significance of the versions of OFN RP-017 that existed prior to 2005, the staff was able to infer from the recent changes that the earlier versions would not have represented a significance that was

more than very low safety significance. Therefore, this issue will be assessed using the criteria for traditional enforcement. This issue is further discussed in Section 4OA5.02.

b. Findings

No findings of significance were identified.

4OA5 Other Activities

.01 (Discussed) Apparent Violation 05000482/2005008-02: Failure to Maintain Reactor

Coolant System Subcooling During the Alternative Shutdown.

During a triennial fire protection inspection in 2005, the team identified an apparent violation concerning the failure to maintain reactor coolant system subcooling margin during an alternative shutdown with both pressurizer power-operated relief valves spuriously opened. Specifically, Calculation AN-02-021, OFN RP-017, Control Room Evacuation, Consequence Evaluation, Revision 0, predicted reactor coolant system subcooling margin would not be maintained and a steam void would form in the reactor vessel head during an alternative shutdown scenario if both pressurizer power-operated relief valves spuriously opened. This calculation demonstrated that the licensee failed to satisfy the requirements of 10 CFR Part 50, Appendix R, Section III.L.

Since the 2005 triennial fire protection inspection, the licensee made significant changes to the alternative shutdown methodology implemented by Procedure OFN RP-017, Control Room Evacuation. The licensee also developed Report E-1F9915, Design Basis Document for OFN RP-017, Control Room Evacuation, and Evaluation SA-08-006, RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire, to demonstrate the adequacy of the revised alternative shutdown procedure.

These new evaluations predicted that if a control room fire caused a single pressurizer power-operated relief valve to spuriously open, it could cause a loss of subcooling margin and formation of a steam bubble that would void approximately 40 percent of the reactor vessel head. Since the new evaluations demonstrated the potential for a control room fire with a single spurious operation to result in core voiding, the team determined that the licensee failed to meet the requirements of 10 CFR Part 50, Appendix R, Section III.L for the alternative shutdown scenario involving the spurious opening of one pressurizer power-operated relief valve.

This issue is further discussed in Section 1R05.06 above. Resolution of the scenario involving the spurious opening of two pressurizer power-operated relief valves described in Apparent Violation 05000482/2005008-02 is expected to be addressed in the resolution of URI 05000482/2008010-03. This apparent violation will be closed at that time.

.02 (Closed) Unresolved Item 05000482/2005008-04: Lack of Evaluation of Changes to the

Approved Fire Protection Program

Introduction.

The team identified a Severity Level IV non-cited violation for making changes to the approved fire protection program in a manner contrary to the

requirements of License Condition 2.C.(5).(b). Specifically, the licensee revised Procedure OFN RP-017, Control Room Evacuation, without demonstrating the changes did not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

Description.

During a triennial fire protection inspection in 2005, the team identified an unresolved item concerning unanalyzed changes to the alternative shutdown procedure, Procedure OFN RP-017. The licensee made commitments for the completion times for operator actions required to achieve and maintain hot shutdown conditions from outside the control room in Letter SLNRC 84-0109, dated August 23, 1984. The time commitments were approved by the NRC staff in Safety Evaluation Report, Supplement 5.

The team identified that the licensee revised the alternative shutdown procedure to allow some manual actions to be completed in times longer than the approved time commitments. Subsequently, the licensee confirmed they did not evaluate all changes to the approved fire protection program to ensure the changes did not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

This issue was unresolved because the licensee did not have a technical basis for the alternative shutdown procedure, so the inspectors were unable to determine risk significance until the licensee performed a technical analysis of the plant response during alternative shutdown.

Since the 2005 triennial fire protection inspection, the licensee made significant changes to improve the alternative shutdown procedure. The procedure changes incorporated actions to prevent thermal shock to reactor coolant pump seals and streamlined the steps to improve some critical completion times.

Analysis.

The failure to demonstrate that changes to the approved fire protection program would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire was a performance deficiency. The team determined that this deficiency was more than minor because it was associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.

The licensee performed a technical evaluation of the most recent revision of the alternative shutdown procedure, Revision 29, rather than the revision that was in effect at the time this unresolved item was issued. The team assessed the changes implemented in Revision 29, and concluded that the licensee made improvements that allowed slightly faster completion times for several time-critical manual actions.

While the staff was unable to explicitly assess the significance of the versions of OFN RP-017 that existed prior to 2005, the staff was able to infer from the recent changes that the earlier versions would not have represented a significance that was more than very low safety significance. Therefore, this issue will be addressed using the criteria for traditional enforcement. This finding was not assigned a cross-cutting aspect because the cause was not representative of current performance.

Enforcement.

License Condition 2.C.(5).(b) states that the licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. Procedure AP10-100, Fire Protection Program, Revision 13, lists Procedure OFN RP-017, Control Room Evacuation, as an implementing procedure of the fire protection program. Contrary to the above, prior to February 1, 2006, the licensee made changes to the approved fire protection program without prior approval of the Commission without determining if those changes would adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

Specifically, the licensee implemented Revision 21 of Procedure OFN RP-017, Control Room Evacuation, without performing the required evaluation.

This finding was assessed using traditional enforcement since it had the potential for impacting the NRCs ability to perform its regulatory function. Specifically, the licensee failed to determine if prior NRC staff approval was needed for changes to the approved fire protection program. The team used guidance in the NRC Enforcement Manual, Section 7.7 to determine a severity level. Since the licensee implemented corrective actions, provided a technical evaluation for the new alternative shutdown procedure, and proved that the new alternative shutdown procedure is safe, the team concluded that a Severity Level IV violation was appropriate. The licensee entered this issue into the corrective action program as Performance Improvement Request 2005-3317. This violation is being treated as a non-cited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000482/2008010-06, Failure to Evaluate Changes to the Approved Fire Protection Program.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. M. Sunseri, Vice President Operations and Plant Manager, and other members of the licensee staff at an exit meeting on October 24, 2008. The licensee acknowledged the findings presented.

The team conducted a supplemental telephonic exit meeting with Mr. T. Garrett, Vice President Engineering, and other members of the licensee staff on December 9, 2008.

The licensee acknowledged the findings presented.

The inspectors asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements which meets the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600, for being dispositioned as a non-cited violation.

• License Condition 2.C.(5) requires the licensee to maintain in effect all provisions of the approved fire protection program described in listed regulatory documents. The provisions include the requirement that conditions adverse to fire protection are

promptly identified, corrected, and actions taken to preclude recurrence. Contrary to the above, prior to July 26, 2006, the licensee failed to take actions to preclude recurrence of leakage on the electric motor driven fire pump discharge relief valve, which eventually led to the pump being inoperable.

The significance of this finding was evaluated using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving suppression. This finding was associated with the fixed fire protection system category. It was determined to be of very low safety significance since it involved a low degradation of the fire protection program. This issue was entered into the licensees corrective action program as Condition Report 2008-004870.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Alford, Nuclear Engineering

R. Bodenhammer, Operations

D. Dixon, Engineering

D. Feldhauser, Quality Assurance

B. Fox, Fire Protection

K. Frederickson, Licensing

D. Garbe, Fire Protection

C. Garcia, Engineering

T. Garrett, Vice Preseident Engineering

P. Guevel, Engineering

S. Henry, Manager Operations

A. Jiao, Nuclear Engineering

W. Kennamore, Manager Nuclear

B. Masters, Engineering

B. Selbe, Fire Protection

M. Sunseri, Vice President Operations and Plant Manager

J. Suter, Fire Protection

W. Wagner, Nuclear Engineering

S. Wideman, Licensing

NRC

Mike Runyan, Senior Reactor Analyst, Division of Reactor Safety

Linda Smith, Senior Reactor Analyst, Division of Reactor Safety

Chris Long, Senior Resident Inspector

Phil Qualls, Fire Protection Engineer, NRR

Alex Klein, Branch Chief, Fire Protection Branch, NRR

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000482/2008010-01 URI Post-Fire Safe Shutdown Procedure Did Not Identify Diagnostic Instrumentation (Section 1R05.01)

05000482/2008010-03 URI Changes to the Approved Fire Protection Program May Not Meet NRC Acceptance Criteria (Section 1R05.06)

05000482/2008010-04 URI Operator Actions May Create the Potential for Secondary Fires (Section 1R05.07.b.(1))

Attachment

Opened and Closed

05000482/2008010-02 NCV Failure to Ensure a Fire Pump Would Automatically Start for One Fire Area (Section 1R05.04)

05000482/2008010-05 NCV Operator Actions Affect the Ability to Operate Post-Fire Safe Shutdown Equipment (Section 1R05.07.b.(2))

05000482/2008010-06 NCV Failure to Evaluate Changes to the Approved Fire Protection Program (Section 4OA5.02)

Closed

05000482/2005008-04 URI Lack of Evaluations of Changes to the Approved Fire Protection Program (Section 4OA5.02)

Discussed

05000482/2005008-02 AV Failure to Maintain Reactor Coolant System Subcooling During the Alternative Shutdown (Section 4OA5.01)

Attachment

LIST OF ACRONYMS ADAMS Agencywide Documents Access and Management System ac Alternating Current CFR Code of Federal Regulations dc Direct Current DRS Division of Reactor Safety FA Fire Area FHA Fire Hazards Analysis FPP Fire Protection Program FZ Fire Zone IP Inspection Procedure IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events IR Inspection Report NFPA National Fire Protection Association NRC Nuclear Regulatory commission PAR Publicly Available Records P&ID Piping and Instrumentation Drawing QA Quality Assurance SCBA Self-Contained Breathing Apparatus SER Safety Evaluation Report SNUPPS Standardized Nuclear Unit Power Plant System UFSAR Updated Final Safety Analysis Report Attachment