IR 05000483/2012007

IR 05000483-12-007, 04/16/2012 - 05/04/2012, Callaway Plant, Triennial Fire Protection Team Inspection

ML12159A598
Person / Time
Site:	Callaway
Issue date:	06/07/2012
From:	Geoffrey Miller NRC/RGN-IV/DRS/EB-2
To:	Heflin A Union Electric Co
vlm/Graves S
References
EA-12-111 IR-12-007
Download: ML12159A598 (31)

Text

June 7, 2012

SUBJECT:

CALLAWAY PLANT - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT (05000483/2012007) AND EXERCISE OF ENFORCEMENT DISCRETION

Dear Mr. Heflin:

On May 3, 2012, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Callaway Plant. The enclosed inspection report documents the inspection results, which were discussed in an exit meeting on May 3, 2012, with Mr. D. Neterer, Plant Director, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed personnel.

One NRC-identified finding of very low safety significance (Green) was identified during this inspection. Additionally, one finding involving 10 CFR 50.48(b) was identified and was a violation of NRC requirements. The inspectors have screened this violation and determined that it warrants enforcement discretion per the Interim Enforcement Policy Regarding Enforcement Discretion for Certain Fire Protection Issues and Section 11.05(b) of Inspection Manual Chapter 0305 (EA-12-111).

If you contest any non-cited violation in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, D.C. 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Senior Resident Inspector at the Callaway Plant.

UNITED STATES NUCLEAR REGULATORY COMMISSION RE G IO N I V 1600 EAST LAMAR BLVD ARLINGTON, TEXAS 76011-4511 In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). To the extent possible, your response should not include any personal privacy or proprietary, information so that it can be made available to the Public without redaction.

Sincerely,

/RA/

Geoffrey Miller, Chief Engineering Branch 2 Division of Reactor Safety

Docket No. 50-483 License No. NPF-30

Enclosure: Inspection Report No. 05000483/2012007

w/Attachment: Supplemental Information

Electronic Distribution - Callaway Plant

cc w/enclosure: Electronic Distribution

SUMMARY OF FINDINGS

IR 05000483/2012007; 04/16/2012 05/04/2012; Callaway Plant; Triennial Fire Protection

Team Inspection.

The report covered a two-week triennial fire protection team inspection by specialist inspectors from Region IV. One Green finding was identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609,

Significance Determination Process. Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a finding for the failure to establish preventive maintenance of local transfer/isolation switch JEHS0021A, B D/G Fuel Oil Transfer Pump Iso/Run for the train B emergency diesel generator fuel oil transfer pump in procedures covering fire protection program implementation. As a result, the licensee failed to ensure that the local control circuit for the fuel oil transfer pump would be isolated from the effects of fire damage caused by a control room fire. The train B emergency diesel generator was the credited alternative ac power supply for the control room fire scenario. The licensee entered this deficiency into their corrective action program as Callaway Action Request System 201202931 to establish preventive maintenance for this component.

The failure to establish preventive maintenance on local transfer/isolation switch JEHS0021A, B D/G Fuel Oil Transfer Pump Iso/Run in procedures covering fire protection program implementation was a performance deficiency. Specifically, the licensee failed to ensure that component specific isolation/run switch testing procedures existed and ensured circuit isolation and transfer of control from the control room in the event of a fire. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609,

Appendix FProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix F" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Fire Protection Significance Determination Process, because it affected fire protection defense in depth strategies involving post fire safe shutdown. Using Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, the team assigned a low degradation rating to the finding because the capability to achieve safe shutdown in the event of a control room fire would be minimally impacted by the failure to establish a preventive maintenance procedure for the train B emergency diesel generator fuel oil transfer pump local transfer/isolation switch. Because this finding had a low degradation rating, it screened as having very low safety significance (Green). The finding did not have a cross-cutting aspect because it was not indicative of current performance since the performance deficiency existed for more than three years. (Section 1R05.05.1)

Licensee-Identified Violations

None.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial),effective January 1, 2012, at the Callaway Plant. The licensee committed to adopt a risk informed fire protection program in accordance with National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, but had not yet completed the program transition. The inspection team evaluated the implementation of the existing approved fire protection program in selected risk-significant areas, with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for review. The inspection team used the fire hazards analysis section of the Callaway Plant Individual Plant Examination of External Events and inputs from Callaways NFPA-805 license amendment request Fire Probabilistic Risk Assessment to select the following four risk significant fire areas (inspection samples) for review:

• Fire Area A-21 Control Room AC and Filtration Units Room (Room 1501).

• Fire Area C-9 ESF Switchgear Room (North) (Room 3301).

• Fire Area C-27 Control Room Area.

• Fire Area T-2 Turbine Building 50 feet North of Auxiliary Building Wall, General Area.

The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(5), NRC safety evaluation report and supplemental safety evaluation reports, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Final Safety Analysis Report (FSAR),

Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Four inspection samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe

shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire. In addition, the team verified that the licensee met applicable license commitments.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and to verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design. The team also held discussions with Fire Protection staff to address the integrity of fire protection coatings that had been subjected to prolonged exposure to moisture.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the manual and automatic detection and suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team walked down accessible portions of the detection and suppression systems in the selected fire areas. The team also walked down major system support equipment in

other areas (e.g., fire pumps and Halon supply systems) to assess the material condition of these systems and components.

The team reviewed the electric fire pump flow tests, pressure tests, and data trending to verify that the pump met its design requirements. The team reviewed the testing of the flow characteristics (Hazen-Williams coefficient) of the fire protection piping used to monitor for system degradation. The team also reviewed the Halon suppression system functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training and qualification.

The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for fire fighting. On May 1, 2012, the team observed a training scenario where the fire brigade connected the fire main water supply to the onsite fire/tanker truck, and demonstrated the ability to provide adequate flow through fire hoses in an elevated recirculation loop configuration.

b. Findings

No findings were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walk downs and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train).

• Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology

The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

Plant walkdowns were conducted to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation

The team verified that the licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown are trained and available onsite at all times, exclusive of those assigned as fire brigade members.

A walkthrough of the post-fire safe shutdown procedure with licensed and non-licensed operators was performed to determine the adequacy of the procedure and ensure the implementation and human factors adequacy of the procedure. The team verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team reviewed manual actions to ensure that they had been properly reviewed and approved and that the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests are adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

===.1

=

The team identified a finding of very low safety significance (Green) for the failure to establish preventive maintenance of local transfer/isolation switch JEHS0021A, B D/G Fuel Oil Transfer Pump Iso/Run for the train B emergency diesel generator fuel oil transfer pump in procedures covering fire protection program implementation. As a result, the licensee failed to ensure that the local control circuit for the fuel oil transfer pump would be isolated from the effects of fire damage caused by a control room fire.

Description.

In the event the control room must be evacuated due to a fire, the operators must transfer control of post-fire safe shutdown equipment from the control room to the auxiliary shutdown panel and other locations in the plant as directed by Procedure OTO-ZZ-00001, Control Room Inaccessibility, Revision 35. Alignment for alternative shutdown operation is accomplished, in part, via a series of isolation/run switches that:

(1) transfer control of selected equipment to the alternate shutdown panel,

(2) reposition selected components to the desired post-fire safe shutdown position, and

(3) isolate the control room portions of the circuits from the effects of a fire. The isolation function was required to ensure that fire damage would not prevent operation of equipment needed to achieve and maintain safe shutdown conditions in the event a fire forces evacuation of the control room.

The team reviewed the licensees list of components required for achieving and maintaining hot shutdown conditions for post-fire safe shutdown scenarios, which included the emergency diesel generator fuel oil transfer pumps. The team reviewed recent maintenance for these components and identified that hand switch JEHS0021A, B D/G Fuel Oil Transfer Pump Iso/Run was not included in the maintenance procedures and had not had preventive maintenance performed. The failure to perform preventive maintenance of the isolation function of the system could result in the failure to electrically isolate the control circuit of the train B emergency diesel generator fuel oil transfer pump from the control room in the event of a fire. The train B emergency diesel generator was the credited alternative ac power supply for control room fire scenarios.

Analysis.

The failure to establish preventive maintenance on local transfer/isolation switch JEHS0021A, B D/G Fuel Oil Transfer Pump Iso/Run in procedures covering fire protection program implementation was a performance deficiency. Specifically, the licensee failed to ensure that component specific isolation/run switch testing procedures existed and ensured circuit isolation and transfer of control from the control room in the event of a fire. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense in depth strategies involving post fire safe shutdown. Using Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, the team assigned a low degradation rating to the finding because the capability to achieve safe shutdown in the event of a control room fire would be minimally impacted by the failure to establish a preventive maintenance procedure for the train B emergency diesel generator fuel oil transfer pump local transfer/isolation switch. Because this finding had a low degradation rating, it screened as having very

low safety significance (Green). The finding did not have a cross-cutting aspect because it was not indicative of current performance since the performance deficiency existed for more than three years.

Enforcement.

Enforcement action does not apply because the finding did not involve a violation of regulatory requirements. The licensee entered this deficiency into their corrective action program as Callaway Action Request System 201202931. Because the finding did not involve a violation of regulatory requirements and had very low safety significance (Green), it is identified as a Finding: FIN 05000483/2012007-01, Failure to Establish Preventive Maintenance for Equipment Used to Achieve Post-Fire Safe Shutdown.

===.2

=

The following violation that affects 10 CFR 50.48 was identified by the NRC and is a violation of NRC requirements. This violation has been screened and determined to warrant enforcement discretion per Section 9.1 of the Enforcement Policy, Enforcement Discretion for Certain Fire Protection Issues (10 CFR 50.48).

The team identified a violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the team identified three examples where the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant in the event of a control room fire.

Description.

Operations personnel would use Procedure OTO-ZZ-00001, Control Room Inaccessibility, Revision 35, to shut down the reactor at the auxiliary shutdown panel and other control stations outside of the control room in the event a fire required evacuation of the control room. This procedure provided alternative methods to maintain post-fire safe shutdown functions, including reactor coolant inventory and decay heat removal. The procedure controlled reactor coolant inventory by using the train B charging pump and controlled decay heat removal by isolating main feedwater and then using auxiliary feedwater to supply two of the four steam generators.

The team performed a timed walkdown of the alternative shutdown procedure, and based on the walkdown results, the team identified three alternative shutdown scenarios where the procedure failed to provide operators with appropriate instructions. In the first scenario, the procedure failed to ensure that operators would control charging flow prior to overfilling the pressurizer after a safety injection signal. In the second scenario, the procedure failed to ensure that operators would prevent the drain down of the refueling water storage tank to the containment sump. In the final scenario, the procedure failed to ensure that operators would isolate main feedwater and control auxiliary feedwater prior to overfilling the steam generators.

Scenario 1: Potential Overfilling of the Pressurizer

The first example involved a control room fire with the spurious actuation of a single pressurizer power-operated relief valve. In this scenario, the open power-operated relief valve rapidly depressurizes the reactor coolant system and a safety injection signal occurs within one minute of the reactor trip. The resulting safety injection actuation causes both safety-related charging pumps to start and both boron injection header inlet isolation valves to open. The alternative shutdown procedure provided instructions for operators to control pressurizer level by throttling the train B boron injection header inlet

isolation valve (EM HV-8803B). The team determined this action would not be successful if the train A boron injection header inlet isolation valve (EM HV-8803A) also opened and both charging pumps were running, as expected, due to the safety injection signal. The team noted that the alternative shutdown procedure provided steps for operators to de-energize boron injection header inlet isolation valve EM HV-8803A, but did not provide steps to ensure the valve was closed.

AREVA document, Evaluation of Alternate Shutdown Manual Actions, Transient Analyses, and Operator Actions to Address NRC URI 2003007-02, dated June 9, 2005, contained the results for the licensees current thermal hydraulic analysis for control room fire scenarios. This analysis indicated that the charging pumps should be stopped within 35 minutes to prevent overfilling the pressurizer. The team determined that operators would not be able to control charging flow to the pressurizer until they stopped the train A charging pump, which occurred at approximately 39 minutes.

Scenario 2: Potential Drain Down of the Refueling Water Storage Tank

The second example involved a control room fire with the spurious opening of the train A containment recirculation sump isolation valve (EJ HV-8811A). In this scenario, the open isolation valve results in the drain down of the refueling water storage tank to the containment sump. The refueling water storage tank was the credited source of water for the charging pump during an alternative shutdown.

The approved fire protection program specified that operators would de-energize and manually close the train A refueling water storage tank isolation valve (BN HV-8812A) to prevent draining the refueling water storage tank. The team noted that the alternative shutdown procedure provided steps to de-energize the valve, but did not provide steps to close the valve, which would be required to prevent draining the tank.

The licensee had removed the procedure steps to manually close valve BN HV-8812A in Revision 23 to OTO-ZZ-00001 based on an analysis that the electrical interlock permissive between valves BN HV-8812A and EJ HV-8811A would not be affected by the control room fire. The team determined that the permissive between the valves could be affected by a control room fire, and the removal of the steps to manually close valve BN HV-8812A was an adverse change to a procedure covering fire protection program implementation.

Scenario 3: Potential Overfilling of the Steam Generators

The third example involved a control room fire with the failure to close the main steam isolation valves prior to evacuating the control room. In this scenario, the turbine-driven main feedwater pumps continue to inject feedwater into the steam generators, potentially overfilling the steam generators resulting in the loss of decay heat removal capability.

Feedwater overflow into the main steam lines could also disable the turbine-driven auxiliary feedwater pump, which was relied upon, in part, for post-fire safe shutdown decay heat removal.

The alternative shutdown procedure directed operators to close the main steam isolation valves from the control room before evacuation; however, the team determined that the approved fire protection program did not credit this action. The procedure also directed operators to de-energize the main feedwater isolation system cabinets as the backup

action after evacuation, which would ensure the main steam isolation valves and main feedwater isolation valves were closed. The licensees analysis indicated that main feedwater should be isolated within 8.2 minutes to preclude overfilling the steam generators and overcooling the plant. The team determined that this backup action required approximately 11 minutes to complete, which could result in overfilling the steam generators.

Analysis.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

A senior reactor analyst performed a Phase 3 evaluation to bound the risk significance of this finding because it involved an alternative shutdown scenario. The team determined that fires in the control room were the only fires that could lead to an alternative shutdown scenario. The senior reactor analyst performed a bounding analysis using values from NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, September 2005, for the fire ignition frequencies and non-suppression probabilities. Since the change in core damage frequency was demonstrated to be less than 1E-4, the senior reactor analyst concluded that the finding was not of high safety significance (Red). Therefore, this finding qualifies for enforcement discretion using section 9.1 of the Enforcement Policy, Enforcement Discretion for Certain Fire Protection Issues (10 CFR 50.48).

The finding did not have a cross-cutting aspect because it was not indicative of current performance since the performance deficiency existed for more than three years.

Enforcement.

Technical Specification 5.4.1.d requires that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to this requirement, from March 16, 2006, to May 4, 2012, the licensee failed to establish, implement, and maintain written procedures covering fire protection program implementation. Specifically, the team identified three examples involving: 1) potential overfilling of the pressurizer; 2) potential draindown of the refueling water storage tank; and 3) potential overfilling of the steam generators, where the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant in the event of a control room fire.

Because the licensee committed to adopting National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, and has committed to changing their fire protection program license basis to comply with 10 CFR 50.48(c) by submitting a license amendment request to the NRC, this violation is eligible for enforcement discretion as described in Section 9.1 of the Enforcement Policy, Enforcement Discretion for Certain Fire Protection Issues (10 CFR 50.48). Under this interim Enforcement Policy, the NRC will normally not take enforcement action for a violation of 10 CFR 50.48(b) (or the requirements in a fire protection license condition) involving a problem in an area such as engineering, design, implementing procedures, or installation if the violation is documented in an inspection report and meets all of the following criteria:

• The licensee identified the violation as a result of a voluntary initiative to adopt the risk-informed, performance-based fire protection program under 10 CFR 50.48(c), or, if the NRC identified the violation, the NRC found it likely that the licensee would have identified the violation in light of the defined scope, thoroughness, and schedule of its transition to 10 CFR 50.48(c).

• The licensee corrected the violation or will correct the violation after completing its transition to 10 CFR 50.48(c). Also, the licensee took immediate corrective action or compensatory measures or both within a reasonable time commensurate with the risk significance of the issue following identification; this action should involve expanding the initiative, as necessary, to identify other issues caused by similar root causes.

• Routine licensee efforts, such as normal surveillance or quality assurance activities, were not likely to have previously identified the violation.

• The violation was not willful.

• The violation is not associated with a finding of high safety significance.

Specifically, the team determined that the licensee:

(1) would have identified the violation in light of the defined scope, thoroughness, and schedule of its transition to 10 CFR 50.48(c) because the licensee had performed a new thermal hydraulic analysis and developed a new alternative shutdown procedure for the transition to NFPA-805;

(2) the licensee will correct the violation after completing its transition to 10 CFR 50.48(c) and took immediate corrective action or compensatory measures or both within a reasonable time commensurate with the risk significance of the issue following identification. The licensee entered these issues into their corrective action program as CARS 201203377 and implemented appropriate compensatory measures,

(3) routine licensee efforts (such as normal surveillance or quality assurance activities), were not likely to have previously identified the violation;

(4) the violation was not willful; and

(5) the team determined that this violation was not of high safety significance (Red).

Since all the criteria for enforcement discretion were met, the NRC is exercising enforcement discretion for this issue.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. The team reviewed the circuits associated with the following components:

• BBPCV455A and 456A, Pressurizer Power-Operated Relief Valves.

• BBHV8000A and 8000B, Pressurizer Power-Operated Relief Block Valves.

• ADLV0079BA and 79BB, Hotwell Makeup Control Valves.

• ALHV0005, 0007, 0009, and 0011, Auxiliary Feedwater Pumps Discharge Valves.

For this sample, the team reviewed electrical elementary and block diagrams and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. The team also reviewed circuit coordination studies for the safety-related 4160 volt emergency bus.

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkthrough of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed a sample of design change packages and program change evaluations (Generic Letter 86 -10 evaluations) which were determined to impact fire protection and post-fire safe shutdown performed since the last triennial inspection, to determine that the changes did not constitute an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team performed a review of the licensees Control of Combustible Materials Procedure, APA-ZZ-00741, Revision 23, to determine the requirements for storage and handling of combustible materials. The team reviewed Procedure APA-ZZ-00742, Control of Ignition Sources, Revision 22, to determine the licensees method of control of ignition sources such as welding, cutting, grinding and open flame work. The team performed walkdowns to determine if the requirements were being met.

b. Findings

No findings were identified.

.13 B.5.b Inspection Activities

a. Inspection Scope

The team reviewed implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with loss of large areas of the plant resulting from explosions or fire as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026, dated February 25, 2002, and 10 CFR 50.54(hh)(2).

The team reviewed the strategies to verify that they continued to maintain and implement procedures, maintain and test equipment necessary to properly implement the strategies, and ensure station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of transportation of portable equipment with associated attachments. The team assessed the offsite ability to obtain fuel for the portable pump and foam used for firefighting efforts. The team completed one sample by reviewing the Filling Spent Fuel Pool - External Strategy with Portable Pump strategy described in Procedure EC Supp Guide, Emergency Coordinator Supplemental Guideline, Revision 11.

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire

protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. In addition the team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team also evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. D. Neterer, Plant Director, and other members of the licensee staff at an exit meeting on May 3, 2012. The licensee acknowledged the findings presented.

The inspectors asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Hall

Manager, Engineering Systems

D. Neterer

Plant Director

J. Bollinger

Engineer

L. Eitel

Supervisor, Balance of Plant Systems Engineering

L. Graessle

Director, Plant Support

L. Kanuckel

Manager, Engineering Design

M. Covey

Assistant Manager, Operations

M. Fletcher

Regulatory Affairs

N. Turner

Coordinator, Emergency Preparedness

R. McCann

Engineer

R. Wink

Supervisor, Regulatory Affairs

S. Cantrell

Fire Protection Program Engineer

S. Petzel

Engineer, Regulatory Affairs

S. Sandbothe

Manager, Regulatory Affairs

NRC

D. Dumbacher, Senior Resident Inspector

T. Hartman, Senior Resident Inspector

Z. Hollcraft, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None.

Opened and Closed

05000483/2012007-01 FIN Failure to Establish Preventive Maintenance for Equipment Used to Achieve Post-Fire Safe Shutdown (1R05.05)

Closed

None.

- 2 -