ML033320398
| ML033320398 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 11/28/2003 |
| From: | Marschall C NRC/RGN-IV/DRS/EMB |
| To: | Randolph G Union Electric Co |
| References | |
| FOIA/PA-2004-0277 IR-03-007 | |
| Download: ML033320398 (27) | |
See also: IR 05000483/2003007
Text
November 28, 2003
Garry L. Randolph, Senior Vice
President and Chief Nuclear Officer
Union Electric Company
P.O. Box 620
Fulton, MO 65251
SUBJECT: CALLAWAY PLANT - NRC TRIENNIAL FIRE PROTECTION INSPECTION
REPORT 05000483/2003-007
Dear Mr. Randolph:
On October 21, 2003, the Nuclear Regulatory Commission (NRC) completed an inspection at
your Callaway Plant. This included onsite inspection from September 22 through October 2,
2003, as well as, in-office review from October 6-21, 2003. The enclosed report documents the
inspection findings, which were discussed on October 21, 2003, with Mr. R. Affolter and other
members of your staff.
This triennial fire protection inspection examined activities conducted under your license as they
relate to safety and compliance with the Commissions rules and regulations and with the
conditions of your license. Within these areas, the inspection consisted of selected
examination of procedures and representative records, observations of activities, and interviews
with personnel.
Based on the results of this inspection, the NRC has identified two findings that were evaluated
under the risk significance determination process. One finding was determined to have very
low safety significance (Green). The other finding is at least Green, but requires additional
evaluation to determine the safety significance. The latter finding does not present an
immediate safety concern because the procedure was corrected during the inspection. The
NRC has also determined that violations are associated with each of these findings. One
violation is being treated as a noncited violation, consistent with Section VI.A of the
Enforcement Policy. The other violation will be dispositioned once a significance determination
has been completed. These violations are described in the subject inspection report. If you
contest the violation or significance of these noncited violations, you should provide a response
within 30 days of the date of this inspection report, with the basis for your denial, to the
U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC
20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission,
Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011; the Director, Office of
Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the
NRC Resident Inspector at the Callaway Plant facility.
Union Electric Company -2-
During the inspection, several examples of an apparent violation of 10 CFR Part 50,
Appendix R,Section III.G.2 were identified. These circuit vulnerabilities could, under certain
postulated fire scenarios, adversely affect the ability to achieve and maintain a safe shutdown
of the facility. It is the NRCs understanding that you do not consider these vulnerabilities to be
violations of NRC requirements. In order to allow the industry to develop an acceptable
approach to resolving this issue that the NRC can endorse, the NRC will defer any enforcement
action relative to these matters while the staff evaluates NEIs proposed resolution methodology
and you have time to implement the resolution methodology, once approved, provided you take
adequate compensatory measures for the identified vulnerabilities.
In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its
enclosure, and your response (if any) will be available electronically for public inspection in the
NRC Public Document Room or from the Publicly Available Records (PARS) component of
NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/ RPM for
Charles S. Marschall, Chief
Engineering and Maintenance Branch
Division of Reactor Safety
Docket: 50-483
License: NPF-30
Enclosure:
NRC Inspection Report 05000483/2003-007
cc w/enclosure:
Professional Nuclear Consulting, Inc.
19041 Raines Drive
Derwood, MD 20855
John ONeill, Esq.
Shaw, Pittman, Potts & Trowbridge
2300 N. Street, N.W.
Washington, DC 20037
Mark A. Reidmeyer, Regional
Regulatory Affairs Supervisor
Regulatory Affairs
AmerenUE
P.O. Box 620
Fulton, MO 65251
Union Electric Company -3-
Manager - Electric Department
Missouri Public Service Commission
301 W. High
P.O. Box 360
Jefferson City, MO 65102
Ronald A. Kucera, Deputy Director
for Public Policy
Department of Natural Resources
P.O. Box 176
Jefferson City, MO 65102
Rick A. Muench, President and
Chief Executive Officer
Wolf Creek Nuclear Operating Corporation
P.O. Box 411
Burlington, KS 66839
Dan I. Bolef, President
Kay Drey, Representative
Board of Directors Coalition
for the Environment
6267 Delmar Boulevard
University City, MO 63130
Chris R. Younie, Manager
Quality Assurance
AmerenUE
P.O. Box 620
Fulton, MO 65251
Jerry Uhlmann, Director
State Emergency Management Agency
P.O. Box 116
Jefferson City, MO 65102-0116
Scott Clardy, Director
Section for Environmental Public Health
P.O. Box 570
Jefferson City, MO 65102-0570
Keith D. Young, Manager
Regulatory Affairs
AmerenUE
P.O. Box 620
Fulton, MO 65251
Union Electric Company -4-
David E. Shafer
Superintendent, Licensing
Regulatory Affairs
AmerenUE
P.O. Box 66149, MC 470
St. Louis, MO 63166-6149
Union Electric Company -5-
Electronic distribution by RIV:
Regional Administrator (BSM1)
DRP Director (ATH)
DRS Director (DDC)
Senior Resident Inspector (MSP)
Branch Chief, DRP/B (DNG)
Senior Project Engineer, DRP/B (RAK1)
Staff Chief, DRP/TSS (PHH)
RITS Coordinator (NBH)
J. Clark (JAC), OEDO RIV Coordinator
CWY Site Secretary (DVY)
ADAMS: * Yes * No Initials: ______
- Publicly Available * Non-Publicly Available * Sensitive * Non-Sensitive
SRI:EMB TL:EMB RI:EMB C:EMB C:PBB C: EMB
NFOKeefe/lmb RLNease TAMcConnell CSMarschall DNGraves CSMarschall
/RA/ /RA/ /RA/ NA /RA/ /RA/by RPM
11/25/03 11/25/03 11/25/03 11/26/03 11/28/03
OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax
ENCLOSURE
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket: 50-483
License: NPF-30
Report No.: 50-483/2003-007
Licensee: Union Electric Company
Facility: Callaway Plant
Location: Junction Highway CC and Highway O
Fulton, Missouri
Dates: September 22 - October 21, 2003
Inspectors: N. OKeefe, Senior Reactor Inspector, Engineering and Maintenance Branch
R. Nease, Team Leader, Engineering and Maintenance Branch
T. McConnell, Reactor Inspector, Engineering and Maintenance Branch
Contractor: R. Deem, Brookhaven National Laboratory
Approved By: Charles S. Marschall, Chief
Engineering and Maintenance Branch
-2-
SUMMARY OF FINDINGS
IR 05000483-007; 09/22/2003 - 10/21/2003; Callaway Plant. Triennial Fire Protection
Inspection
The inspection was conducted by three region-based engineering and maintenance inspectors
and one contractor. One Green noncited violation and one violation with a potential safety
significance greater than Green were identified. The significance of findings is indicated by
their color (green, white, yellow, red) using Inspection Manual Chapter 0609, Significance
Determination Process." The NRCs program for overseeing the safe operation of commercial
nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3,
dated July 2000.
A. NRC-Identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Green. The licensee did not recognize that the halon system protecting both
engineered safety feature switchgear rooms was rendered inoperable and,
therefore, failed to take the required compensatory action when the control room
emergency ventilation and isolation system was in operation. Two ventilation
dampers in parallel through the common fire wall between these rooms open
when this system starts. The team identified that these dampers do not
automatically shut when the halon system actuates. The halon system would not
be capable of reaching the required concentration to suppress a fire because
halon would be allowed to escape under these conditions. License Condition
2.C.(5)(c) requires that the licensee implement and maintain in effect all
provisions of the approved fire protection program as described in the
Standardized Nuclear Unit Power Plant System Final Safety Analysis Report.
Updated Final Safety Analysis Report, Table 9.5.1-2, "Halon Systems," requires
that when this halon system is inoperable, the licensee shall establish a
continuous fire watch with backup fire suppression capability in the affected
area. Contrary to this, on numerous occasions throughout the operating life of
the plant, the team found that the licensee had failed to post a continuous fire
watch whenever the vital switchgear room halon system was rendered
inoperable due to testing of the control room ventilation system. This violation of
License Condition 2.C.(5)(c) will be treated as a noncited violation, consistent
with Section VI.A of the Enforcement Policy. This issue was in the licensees
corrective action program under Callaway Action Request 200307189.
This finding was greater than minor because it involved the potential degradation
of a fire protection feature protecting the electrical distribution equipment
powering both trains of mitigating systems. This finding is of very low safety
significance because the fire ignition frequency in the rooms affected is low, the
remaining fire detection and suppression capability are unaffected, and sufficient
accident mitigation equipment was available. (Section 1R05.9)
-3-
- TBD. The alarm response procedure for responding to smoke in the control
room outside supply duct was inadequate because it did not direct operators to
isolate outside air makeup upon receipt of the alarm. This alarm does not cause
an automatic isolation of the control room, so operators must recognize the
condition and take manual action to prevent losing control room habitability.
Failure to have a procedure, required by Technical Specification 5.4.1.a and
Regulatory Guide 1.33, that provided appropriate response actions for abnormal
or alarm conditions was a violation. This issue was entered into the licensees
corrective action program under Callaway Action Request 200306977.
This finding is unresolved pending completion of a significance determination.
This issue was more than minor because failure to isolate the control room
ventilation could lead to unnecessary evacuation, which would result in a plant
transient and disabling much of the mitigation equipment that would otherwise be
available. This issue is being treated as an unresolved item pending completion
of a significance determination. (Section 1R05.9)
B. Licensee-Identified Violations
Violations of very low safety significance, which were identified by the licensee have
been reviewed by the inspectors. Corrective actions taken or planned by the licensee
have been entered into the licensees corrective action program. These violations and
corrective actions are listed in Section 4OA7 of this report.
Report Details
1. REACTOR SAFETY
1R05 Fire Protection
The purpose of this inspection was to review the Callaway Plant fire protection program
for selected risk-significant fire areas. Emphasis was placed on verification of the
licensees post-fire safe shutdown capability. The inspection was performed in
accordance with the NRC regulatory oversight process using a risk-informed approach
for selecting the fire areas and attributes to be inspected. The team leader and a
Region IV senior reactor analyst used the Callaway Individual Plant Examination for
External Events to choose several risk-significant areas for detailed inspection and
review. Inspection Procedure 71111.05 requires selecting three to five fire areas for
review. The three fire areas reviewed during this inspection were:
- C-9, Train A engineered safety feature switchgear room
- A-18, north electrical penetration room
- A-21, north control room ventilation equipment room
For each of these fire areas, the inspection was focused on the fire protection features,
the systems and equipment necessary to achieve and maintain safe shutdown
conditions, determination of license commitments, and changes to the fire protection
program.
Documents reviewed by the team are listed in the attachment.
.1 Systems Required to Achieve and Maintain Post-Fire Safe Shutdown
a. Inspection Scope
The team reviewed the functional requirements identified by the licensee as necessary
for achieving and maintaining hot shutdown conditions to ensure that at least one post-
fire safe shutdown success path was available in the event of a fire in each of the
selected areas. The team reviewed piping and instrumentation diagrams of systems
credited in accomplishing safe shutdown functions to independently verify whether the
licensee's shutdown methodology had properly identified the required components. The
team focused on the following functions that must be available to achieve and maintain
post-fire safe shutdown conditions:
- Reactivity control capable of achieving and maintaining cold shutdown reactivity
conditions,
- Reactor coolant makeup capable of maintaining the reactor coolant inventory,
- Reactor heat removal capable of achieving and maintaining decay heat removal,
and
-2-
- Supporting systems capable of providing all other services necessary to permit
extended operation of equipment necessary to achieve and maintain hot
shutdown conditions.
A review was also conducted to ensure that all required electrical components in the
selected systems were included in the licensees safe shutdown analysis. The team
identified the systems required for each of the primary safety functions necessary to
shut down the reactor. These systems were then evaluated to identify the systems that
interfaced with the fire areas inspected and were the most risk significant systems
required for reaching both hot and cold shutdown conditions. The systems selected for
review were the chemical and volume control, reactor coolant, and the safety injection.
b. Findings
No findings of significance were identified.
.2 Fire Protection of Safe Shutdown Capability and Post-fire Safe Shutdown Circuit
Analysis
a. Inspection Scope
The team reviewed licensee documentation to verify that at least one post-fire safe
shutdown success path was free of fire damage in the event of a fire in the selected fire
areas. Specifically, the team examined the separation of safe shutdown cables,
equipment, and components within the same fire areas. The team reviewed, on a
sample basis, the analysis of electrical protective devices (e.g., circuit breakers, fuses,
relays), coordination, and adequacy of electrical protection provided for nonessential
cables, which share a common enclosure (e.g., cable trays) with cables of equipment
required to achieve and maintain safe shutdown conditions. Additionally, the team
reviewed the protection of diagnostic instrumentation required for safe shutdown for
fires in the selected areas. The team reviewed the licensee's methodology for meeting
the requirements of 10 CFR 50.48, and the bases for the NRC's acceptance of this
methodology as documented in NRC safety evaluation reports. In addition, the team
reviewed license documentation, such as, the Updated Final Safety Evaluation Report,
submittals made to the NRC by the licensee in support of the NRC's review of their fire
protection program, and deviations from NRC regulations to verify that the licensee met
license commitments.
b. Findings
Introduction. The scope of Inspection Procedure 71111.05 has been temporarily
reduced to stop requiring inspectors to address fire-induced circuit failure of associated
circuits as a direct line of inquiry, nor to require developing associated circuit inspection
findings. This was being done in order to allow the industry to develop an approach
acceptable to the NRC for resolving this issue. However, during the course of this
inspection, a number of associated circuit vulnerabilities were incidentally identified.
These circuit vulnerabilities could, under certain postulated fire scenarios, adversely
affect the ability to achieve and maintain safe shutdown of the facility.
-3-
Description. Appendix R,Section III.G.1 of 10 CFR Part 50, requires that one train of
systems needed to achieve and maintain hot shutdown conditions must be free of fire
damage.Section III.G.2 states that cables or equipment, including associated non-
safety-related circuits that could prevent operation or cause mal-operation due to fire
damage of redundant trains of systems necessary to achieve and maintain hot
shutdown conditions, must be protected. The Callaway Updated Final Safety Analysis
Report allows either free of fire damage, or a diverse means will be provided. The
team identified some associated circuit issues that are neither protected from fire
damage nor provided with a diverse means of providing the function. Specific examples
of equipment or associated cables located within the fire areas reviewed by the team
that could affect the safe shutdown process included:
Fire Area A-21 - possible loss-of-seal water injection capability to any one of the
four reactor coolant pumps, which could lead to seal failure; and inability to
isolate any one of the four main steam isolation valves or main feedwater
isolation valves, which cool lead to overcooling of the reactor coolant system.
Fire Area A-18 - loss of thermal barrier cooling to any one of four reactor coolant
pumps, which could lead to seal failure; spurious opening of a pressurizer spray
valve or the pressurizer auxiliary spray valve, which could lead to uncontrolled
depressurization and overfilling the reactor coolant system; spurious opening of
a containment emergency recirculation sump isolation valve that could divert
water from the refueling water storage tank to the containment sump and make it
unavailable for coolant inventory control; spurious opening of a reactor head vent
flow path, causing a loss-of-coolant and uncontrolled depressurization; and
spurious closing of either steam admission valves to the turbine driven auxiliary
feedwater pump, making it unavailable for decay heat removal.
Fire Area C-9 - spurious closure of a volume control tank outlet valve, causing a
loss of charging, affecting reactor coolant inventory control and reactor coolant
pump seal cooling.
Analysis. This finding is unresolved pending additional action by the NRC. See below.
Enforcement. Failure to either protect these associated circuits from spurious operation
or otherwise prevent them from affecting safe shutdown is an apparent violation of
Appendix R,Section III.G.2. In accordance with the NRC Enforcement Manual,
Section 8.1.7.1.a, this apparent violation will be treated as an unresolved item pending
development of an industry method to resolve these types of issues; Unresolved
Item 05000483/2003007-01, Failure to Protect Associated Circuits. The determination
of the safety significance and disposition of this apparent violation will be performed
after the NRC develops additional guidance for addressing associated circuit issues.
This issue is in the licensees corrective action program under Callaway Action
Request 200307232. This Callaway action request included an action to evaluate
whether any specific compensatory actions were needed.
-4-
.3 Alternative Safe Shutdown Capability
a. Inspection Scope
The team reviewed the licensees alternative shutdown methodology to determine if the
licensee properly identified the components and systems necessary to achieve and
maintain safe shutdown conditions from the remote shutdown panel and alternative
shutdown locations for a fire in the units control room. The team focused on the
adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor
heat removal, process monitoring and support system functions. The team verified that
hot and cold shutdown from outside the control room can be achieved and maintained
with off-site power available or not available. The team verified that the transfer of
control from the control room to the alternative locations has been demonstrated and not
affected by fire-induced circuit faults by reviewing the provision of separate fuses for
alternative shutdown control circuits.
b. Findings
Findings from this review are discussed in Section 1R05.4. No additional findings of
significance were identified.
.4 Operational Implementation of Alternate Shutdown Capability
a. Inspection Scope
The team performed walkdowns of the actions defined in Procedure OTO-ZZ-00001,
Control Room Inaccesibility, Revision 19, with licensed and non-licensed operators.
Procedure OTO-ZZ-00001 provided instructions for performing an alternative shutdown
from the remote shutdown panel and for manipulating equipment locally in the plant.
The team verified that the number of available operators could reasonably be expected
to perform the procedure actions within the applicable plant shutdown time
requirements, and that equipment labeling was consistent with the procedure. Also, the
team verified that the licensee had adequate tools and equipment to successfully
perform the procedure as intended. The team also reviewed records for training
conducted on this procedure.
b. Findings
Introduction. An unresolved item was identified to assess the safety significance of the
licensee not completing some manual actions for shutting down the plant from outside
the control room within the times required in the Callaway Safety Evaulation Report
during a timed walk-through.
Discussion. The team conducted a walk-through of Procedure OTO-ZZ-00001 with
qualified licensed and non-licensed operators. Each operator performed the actions of a
specific watchstation to which the individuals were typically assigned. Procedure steps
were simulated, and completion times were noted. The team noted that the operators
were familiar with the procedure and the actions assigned, and were able to perform the
-5-
required actions smoothly. However, some of the required actions intended to assure a
safe shutdown condition was achieved took longer than the time required in the safety
evaluation report.
The team attempted to determine whether the performance goals of 10 CFR Part 50,
Appendix R, III.L.2, for a fire safe shutdown were being met based on the actual
performance times. However, the licensee was unable to provide documentation, which
demonstrated that the alternate shutdown actions and required times satisfied these
performance goals. Therefore, the team requested information on several important
thermal hydraulic parameters. This information was used to construct a rough thermal
hydraulic time line to evaluate performance criteria in the shutdown procedures. There
were six instances where one or both criteria were exceeded, as shown below:
Required Action Safety Evaluation Report Calculation Measured
Time Required Minimum Time Completion Time
Establish auxiliary 5 min 17 min 9:06 min
feedwater flow
Open two steam 5 min 9:30 min
generator power
operated relief valves
Isolate letdown 5 min 61 min 8:05 min
Isolate pressurizer 5 min 7 min 8:05 and 9:00 min
power operated relief
valves
Isolate auxiliary 20 min not in procedure
pressurizer spray
As an example, the safety evaluation report required that operators establish auxiliary
feedwater flow to two steam generators and begin bleeding steam through two steam
generator power-operated relief valves within 5 minutes of initiating a control room
evacuation in order to establish a method of core decay heat removal. During the walk-
through conducted by the team, these actions took over 9 minutes to complete.
However, preliminary calculations performed at the teams request indicated that as
many as 17 minutes were available before the steam generators would boil dry. The
technical basis for the time requirements listed could not be determined during the
inspection. Therefore, additional information is required to establish the significance of
the actual time needed to complete the above actions. The other actions above either
establish similar required states or prevent conditions that could cause the licensee to
fail to meet the required performance goals.
Analysis. This finding is unresolved pending review of additional information to be
provided by the licensee. See below.
Enforcement. Failure to meet the required action times from the safety evaluation report
was an apparent violation of License Condition 2.C. Failure to meet the other
(calculated) times needs to be further evaluated for possible failure to meet the
acceptance criteria of Appendix R,Section III.L.2. The licensee stated that they would
-6-
perform a formal timing and validation of the procedure in accordance with station
procedures, using several operations crews, to precisely determine how long it takes to
complete each critical action. This issue was not an immediate safety concern because
the times to complete the actions were reasonable compared to the reference times
discussed above. In the case of isolation the auxiliary pressurizer spray, indications
were available to allow diagnosis of a problem and corrective actions.
The significance of not meeting the times required in the safety evaluation report could
not be determined based on the information available. Additional analysis by the
licensee was needed to evaluate the significance, as well as, to verify the calculated
times, in order to place this issue into context for safety significance and enforcement.
Additionally, the inspectors will consider the licensees timing and validation
methodology, and compare the results with the results of the teams walkthrough. This
finding is identified as Unresolved Item 05000483/2003007-02, Failure to Perform
Alternative Shutdown Manual Actions Within Required Times, pending this additional
information from the licensee. This issue was being tracked in the licensees corrective
action program under Callaway Action Request 200307160.
.5 Communications
a. Inspection Scope
The team reviewed the communications required to implement the alternative shutdown
Procedure OTO-ZZ-00001, Control Room Inaccessibility, Revision 19. The plant radio
system was to be used by operations personnel to perform an alternative shutdown
outside of the control room. The team reviewed the design of the radio system to
(1) ensure the radio system was sufficient to support alternative shutdown operator
actions, and (2) ensure that damage from a control room fire will not impact the
performance of the rest of the system.
b. Findings
No findings of significance were identified.
a. Inspection Scope
The team reviewed the adequacy of emergency lighting for performing actions required
in Procedure OTO-ZZ-00001, Control Room Inaccessibility, Revision 19, which
included access and egress routes. The team reviewed test procedures and test data to
verify that the individual battery operated units were able to supply light for the required
8-hour period. The following specific documents were reviewed:
Callaway Plant Procedure OTS-QD-00001,Emergency Light Tests, Revision 11
Callaway Preventive Maintenance Procedure PM-17,Annual Service of Fire
Protection Emergency Lighting, dated 7/22/03
-7-
Union Electric Company, Callaway Plant Fire Protection Emergency Battery
Lights White Paper dated 04/30/96
b. Findings
No findings of significance were identified.
.7 Cold Shutdown Repairs
a. Inspection Scope
The team reviewed equipment operations and capability to determine if any repairs were
required in order to achieve cold shutdown. The team noted that the licensee did not
require the repair of equipment to reach cold shutdown based on the safe shutdown
methodology implemented.
b. Findings
No findings of significance were identified.
.8 Compensatory Measures
a. Inspection Scope
The team verified, by sampling, that adequate compensatory measures were put in
place by the licensee for out-of-service, degraded, or inoperable fire protection features
and post-fire safe shutdown equipment, and systems.
b. Findings
Introduction. A Green noncited violation was identified for failure to take required
compensatory actions when operation of the control room emergency ventilation and
isolation system (CREVIS) rendered the engineered safety features switchgear room
halon inoperable.
Description. The team identified that the licensee failed to recognize that the halon
system protecting both engineered safety feature switchgear rooms was rendered
inoperable when the CREVIS was in operation. Two ventilation dampers in parallel
through the common fire wall separating these rooms open when CREVIS starts. The
team identified that these dampers do not automatically shut when the halon system
actuates. The halon system would not be capable of reaching the required
concentration to suppress a fire in either switchgear room under these conditions
because halon would be allowed to escape. The team determined that CREVIS was
required by a technical specification surveillance to be run for 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> on a monthly
periodicity.
-8-
Updated Final Safety Analysis Report, Table 9.5.1-2, "Halon Systems," requires that
when this halon system was inoperable, the licensee shall establish a continuous fire
watch with backup fire suppression capability in the affected area within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This
requirement should have been implemented during each monthly CREVIS surveillance,
as well as any other time the system was run for longer than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. However, the
licensee stated that, since this issue was not recognized, it was not their practice to
implement this compensatory measure during CREVIS operation. This issue was in the
licensees corrective action program under Callaway Action Request 200307189.
Analysis. This finding is of very low safety significance because the fire ignition
frequency in the rooms affected was low, the remaining fire detection and suppression
capability were unaffected, and sufficient accident mitigation equipment remained
available. This finding affected only the fixed fire suppression equipment, and did not
impact the manual firefighting capability. Despite the open dampers in the 3-hour fire
barrier, the team concluded that the integrity of the fire barrier would be maintained
because the separate fire dampers in these ducts remained unaffected by this findings,
and should function normally. Therefore, the redundant train of engineered safety
feature switchgear would remain available. This finding was more than minor because it
involved the potential degradation of a fire protection feature protecting the electrical
distribution equipment powering both trains of mitigating systems, affecting the
Mitigating System Cornerstone.
Enforcement. The team found that testing of the control room ventilation system
rendered the halon system in both of the vital switchgear rooms inoperable. Union
Electric Company, Docket No. Stn 50-483, Callaway Plant, Unit 1, Facility Operating
License, Condition 2.C.(5)(c), states, "The licensee shall implement and maintain in
effect all provisions of the approved fire protection program as described in the
Standardized Nuclear Unit Power Plant System (SNUPPS) Final Safety Analysis Report
for the facility through Revision 15, the Callaway Plant site addendum through
Revision 8, and as approved in the Safety Evaluation Report through Supplement 4,
subject to provision "d" below." Final Safety Analysis Report, Table 9.5.1-2, (Sheet 4),
System 4, "Halon Systems," required that when in Condition "a" where one or more
halon systems was inoperable in areas containing redundant systems or components,
the licensee was required by Action "a" to "Establish a continuous fire watch with backup
fire suppression capability in the affected area." Contrary to this requirement, on
numerous occasions throughout the operating life of the plant, the team found that
licensee had failed to post a continuous fire watch whenever the vital switchgear rooms
halon system was rendered inoperable due to testing of the control room ventilation
system. This is a violation of License Condition 2.C.(5)(c); Noncited
Violation 50-483/0307-03, Failure to Take Required Compensatory Actions.
.9 Fire Protection Systems, Features and Equipment
a. Inspection Scope
For the selected fire areas, the team evaluated the adequacy of fire protection features
(e.g., detection and suppression systems, or passive fire barrier features), such as, fire
suppression and detection systems, fire area barriers, penetration seals, and fire doors.
-9-
The team observed the material condition and configuration of the installed fire detection
and suppression systems, fire barriers, and construction details and supporting fire tests
for the installed fire barriers. In addition, the team reviewed license documentation,
such as, NRC safety evaluation reports and deviations from NRC regulations and the
National Fire Protection Association codes to verify that fire protection features met
license commitments.
The team walked down the areas to verify that the detection and suppression system
location drawings agreed with the as-installed configurations. The team reviewed the
original suppression systems specifications, the hydraulic calculations for the pre-action
water systems, and the carbon dioxide system design calculations. The team reviewed
the periodic testing performed on the automatic halon total flooding system including the
interfacing fire detection systems and ventilation system dampers. The team also
reviewed the original testing performed to confirm that the design concentration of halon
was sufficient.
b. Findings
Introduction. An apparent violation was identified for an inadequate smoke alarm
response procedure. This issue was being tracked as an unresolved item pending
significance determination.
Description. The alarm response procedure for responding to smoke in the control
room outside supply duct was inadequate because it did not direct isolating outside air
makeup upon receipt of the alarm. The team determined that this alarm does not cause
an automatic isolation of the control room, so operators must recognize the condition
and take manual action to prevent losing control room habitability. However, the alarm
response procedure directed that operators search the control building for a source of
the fire, which would be misleading if the smoke were coming from outside the building.
This misdirected search for the source of the smoke could allow smoke to build up to
the point where control room habitability would be jeopardized. This issue was entered
into the licensees corrective action program under Callaway Action
Request 200306977.
Analysis. Loss of control room habitability could cause operators to evacuate the control
room. This action would necessitate manually tripping the plant, establishing control of
the plant at the alternate shutdown panel, and manually operating the plant with limited
control and indication equipment. This represented an inappropriate response to a fire
outside the plant. A Phase 1 significance determination process required that a Phase 3
significance determination process be performed by senior reactor analysts. However,
this analysis was not complete at the time of this report. This issue is unresolved
pending completion of a significance determination process. This issue was more than
minor because failure to isolate the control room ventilation could lead to unnecessary
evacuation, which would result in a plant transient and disabling much of the mitigation
equipment that would otherwise be available, affecting the Initiating Events and
Mitigating Systems Cornerstones.
-10-
Enforcement. Alarm Response Procedure OTA-KC-00008, window 119/157, Auxiliary
Building Control Building Supply Air Supply Alarm, Revision 9, a procedure required by
Technical Specification 5.4.1.a and Regulatory Guide 1.33, was determined to be
inadequate because it did not contain steps to secure outside makeup to ensure control
room habitability when smoke was detected in this duct. This violation existed since the
plant began operation. This apparent violation will be treated as Unresolved
Item 5000483/2003007-04, Inadequate Smoke Alarm Response Procedure for Control
Room Supply, pending determination by the NRC of the significance of the finding. This
finding did not present an immediate safety concern because the licensee corrected the
procedure promptly during the inspection.
4. OTHER ACTIVITIES (OA)
4OA5 Other
(Closed) Unresolved Item 05000483/2001007-01: Control Room Halon Bank
Operability Questions
An unresolved item was identified in NRC Inspection Report 50-483/2001-07, dated
May 1, 2002, for further evaluation of the licensing basis of the control room halon
system. Specifically, inspectors questioned the acceptance criteria for determining the
operability of the control room halon system in Administrative Procedure APA-ZZ-00703
(95 percent of the full charge weight of 110 pounds).
The team reviewed NRC Inspection Reports 50-483/84-41 (dated September 7, 1984)
and 50-483/84-49 (dated October 16, 1984). In Inspection Report 50-483/84-41, the
NRC documented that the licensee's halon pre-operational test in the control room
resulted in a halon concentration in the upper 5 feet that did not meet National Fire
Protection Association Code 12A-1975. A fully charged 110 pound halon bottle was
discharged during this test. At that time, the NRC agreed that the licensee would add a
second bottle of halon which would discharge immediately following the first bottle, and
that no further halon testing was necessary. This open item was closed in NRC
Inspection Report 50-483/84-49, with no further discussion of the control room halon
system.
In October 18, 1984, the NRC issued the Callaway Facility Operating License NPF-30
together with the Callaway Technical Specifications (Revision 1 of NUREG-1058,
"Technical Specifications, Callaway Plant, Unit 1, Appendix 'A' to License No. NFP-30").
The technical specifications included operability requirements for the control room halon
system. Technical Specification Surveillance Requirement 4.7.10.3, stated that halon
systems shall be demonstrated operable every 6 months by verifying the halon tanks to
be at least 95 percent of full charge weight. In 1989, the NRC, at the licensee's request,
removed this specification from the technical specifications, and placed this requirement
(95 percent of full charge weight) in Administrative Procedure APA-ZZ-00703.
The team concluded that the NRC was aware that the concentration of halon in the
upper 5 feet of the control room halon trench did not meet the National Fire Protection
Association Code 12A. In addition, in issuing the technical specifications, the NRC
-11-
approved the acceptance criteria for operability of the control room halon system as
95 percent of the full charge weight of 110 pounds. Therefore Unresolved
Item 50-483/0107-01 is closed.
4OA6 Exit Meeting
On October 21, 2003, the team presented the inspection results to Mr. R. Affolter and
other members of his staff, who acknowledged the findings. The team confirmed that
proprietary information was not provided or examined during the inspection.
4OA7 Licensee-Identified Violations
The following violation of very low safety significance (Green) was identified by the
licensee and is a violation of NRC requirements, which meet the criteria of Section VI of
the NRC Enforcement Policy, NUREG-1600, for being dispositioned as an noncited
violation.
- Union Electric Company, Docket No. Stn 50-483, Callaway Plant, Unit 1, Facility
Operating License, Condition 2.C.(5)(c), requires that the licensee shall
implement and maintain in effect all provisions of the approved fire protection
program as described in the SNUPPS Final Safety Analysis Report, the Callaway
Plant site addendum, and as approved in the Safety Evaluation Report.
Callaway Plant Final Safety Analysis Report, Site Addendum, Appendix 9.5A,
Section C.8, requires that non-conformances, which affect fire protection are
controlled by the Operating Quality Assurance Manual. The Operating Quality
Assurance Manual, Section 16.1, states, "Measures shall be established to
assure that conditions adverse to quality are promptly identified, reported, and
corrected." Contrary to this, in 1994, the licensee failed to correct a condition
adverse to quality. Specifically, the licensee failed to revise the fire hazards
analysis and the fire pre-plans to address the potential failure of the condensate
storage tank level transmitters because of fire damage, potentially preventing
automatic swap-over of auxiliary feedwater pump suction from the condensate
storage tank to emergency service water. This is a violation of License
Condition 2.C.(5)(c). The licensee identified this failure to correct a condition
adverse to quality in SA01-NE-008, "Self-Assessment Report, Post-Fire Safe
Shutdown, Electrical Fire Hazards Analysis," and in Callaway Action
Requests 200107132 and 20017174. This finding is of very low safety
significance because alarms in the control room would alert the operators to the
low condensate storage tank level in time to manually switch auxiliary feedwater
pump suction from the condensate storage tank to emergency service water.
ATTACHMENT
KEY POINTS OF CONTACT
Licensee
R. Affolter, Vice President, Nuclear
K. Barbour, System Engineer
K. Bruckerhoff, Fire Marschall/Emergency Preparedness Supervisor
L. Eitel, Fire Protection Engineer
M. Evans, Manager, Nuclear Engineering
E. Goss, System Engineer
L. Kanuckel, Superintendent, Quality Assurrance
J. Little, Safety Analysis Engineer
R. McCann, System Engineer
G. Olmstead, Assistant Operations Superintendent
S. Petzel, Regional Regulatory Affairs Engineer
R, Pohlman, System Engineer
M. Reidmeyer, Regional Regulatory Affairs Supervisor
K. Young, Manager, Regulatory Affairs
NRC
D. Loveless, Senior Reactor Analyst
P. Qualls, Office Nuclear Reactor Regulation
M. Salley, Office Nuclear Reactor Regulation
ITEMS OPENED AND CLOSED
Opened
05000483/2003007-01 URI Failure to protect associated circuits from fire
damage or provide diverse means to achieve safe
shutdown (Section 1R05.2)05000483/2003007-02 URI Failure to perform alternate shutdown manual
actions within the required times (Section 1R05.4)05000483/2003007-04 URI Alarm response procedure for smoke in control
room outside makeup duct was an inadequate
procedure (Section 1R05.9)
Opened and Closed
05000483/2003007-03 NCV Failure to take required compensatory actions
when CREVIS operation rendered the engineered
safety feature switchgear halon system inoperable
(Section 1R05.8)
-2-
Closed
05000483/2001007-01 URI Inoperable Control Room Halon Bank
DOCUMENTS REVIEWED
The following documents were selected and reviewed by the team to accomplish the objectives
and scope of the inspection and to support any findings:
Corrective Action Documents
Callaway Action Request 200107132, "SA01-NE-008 Finding - Fire Hazards Analysis
Inconsistency," dated 11/16/2001
Callaway Action Request 200107134, "SA01-NE-008 Finding - Fire Hazards Analysis on AFP
Pressure Transmitters," dated 11/16/2001
Callaway Action Request 200201889, Control Room Halon Bank Has Depressurized," dated
3/20/02
Union Electric Company Request for Resolution 16516, "Material Equivalency for Teledyne Big
Beam Module Emergency Light, Revision A, dated 08/09/99
Union Electric Company Request for Resolution 16731, Teledyne Emergency Battery Lights
with Three Lamps, Revision A, dated 06/03/96
Union Electric Company Request for Resolution 19214, Approve Use of Chairman Battery in
EBLs, Revision A, dated 11/02/98
Union Electric Company Request for Resolution 19638, "Change to Charging on Hot Area
Emergency Lights, Revision A, dated 03/15/99
Union Electric Company Request for Resolution 20817, Evaluate Fire Detector Spacing
Requirements," Revision A, dated 12/20/00
Union Electric Company Request for Resolution 21138, Evaluate Fire Rating of TCAFP
Blowout Panel," Revision A, dated 04/08/02
Union Electric Company Request for Resolution 22678, Design Basis of Control Room Cable
Trench Halon," Revision A, dated 09/23/03
Procedures
8.1.4.3, Callaway Design Criteria, Regulatory Guides and IEEE Standards, 05/03 OL-13
APA-ZZ-00701, Callaway Plant Nuclear Engineering, "Control of Fire Protection Impairments,"
06/12/02, Revision 9
-3-
APA-ZZ-00703, Callaway Plant Administrative Procedure Fire Protection Operability Criteria
and Surveillance Requirements, 08/21/01, Revision 13
APA-ZZ-00050, Halon Discharge Test for North Electrical Penetration Room Supplemental
Record to Pre-op Test Package CS-04KC02, 2/7/85
CS-04KC02, Union Electric Company Preoperational Test Procedure Fire Protection System
(Halon) Preoperational Test, 08/02/03, Revision 0
EE-002 Electrical Separation Criteria, 11/8/00, Revision 2
MSM-ZZ-FG002, Callaway Plant Maintenance Surveillance Procedure
Fire Damper Inspection and Drop Test, 08/15/03, Revision 3
MSM-KC-FW009, Callaway Plant Mechanical Surveillance Procedure, "Fire Hose Station
Inspection Outside RCA," 1/13/00, Revision 3
OSP-GK-0001A, Callaway Plant Operations Surveillance Procedure A Train Control Room
Filtration and Pressurization System Monthly Operability Verification, 02/26/03, Revision 3
OTN-GK-00001, Callaway Plant Normal Operating Procedure Control Building HVAC System,
02/19/03, Revision 11
OTS-QD-00001, Callaway Plant Procedure Emergency Light Tests, Revision 11
PM-17, Callaway Preventive Maintenance Procedure Annual Service of Fire Protection
Emergency Lighting, 07/22/03
SDP-KC-00001, "Requirements for and Duties of Compensatory Fire Watches," Revision 5
Calculations and Analyses
800 MHz Mobile Propagation Survey Log for Callaway Plant Power Block 4/18/96
Union Electric Company Callaway Plant Fire Protection Emergency Battery Lights White Paper
dated 04/30/96
CMP 91-1060, Formal Safety Evaluation - Permanent Removal of Halon Systems in Six
Switchgear Rooms in Control Building, Revision B
Callaway License Condition Letter to NRR, North Electrical Penetration Room Halon System,
dated 02/21/85
Plant Drawings
A-2803, Bechtel Standardized Nuclear Unit Power Plant System (SNUPPS) Architectural
Drawing Fire Delineation Floor Plan, El 2026', Revision 7
-4-
E-2F3301, Bechtel SNUPPS Drawing Fire Detection/Protection System Control Building,
El-2000' and El 2016', Revision 11
E-2F3101, Bechtel SNUPPS Drawing Fire Detection/Protection System Control Building,
El-1974' and El 1984', Revision 4
A-2804, Bechtel SNUPPS Architectural Drawing Fire Delineation Floor Plan, El 2047',
Revision 20
A-2801, Bechtel SNUPPS Architectural Drawing Fire Delineation Floor Plan, El 1974',
Revision 1
A-2802, Bechtel SNUPPS Architectural Drawing Fire Delineation Floor Plan, El 2000',
Revision 10
E-23RP13, Callaway Plant Electrical Schematic Drawing Lock-Out Relay Contact Development
Sep. Grp. 6, Revision 2
E-2L9903, Bechtel SNUPPS Public Address System Riser Diagram, Revision 49
J-24001, Bechtel SNUPPS Control Room Equipment Arrangement, Revision 11
E-2R3321, Bechtel SNUPPS Raceway Plan Communication Corridor EL 2000', Revision 2
E-2R3212(Q), Bechtel SNUPPS Exposed Conduit Control Building EL 1984', Revision 19
E-2R3211(Q), Bechtel SNUPPS Raceway Plan Control Building EL 1984', Revision 4
E-21001(Q), Callaway Plant Main Single Line Diagram Electrical, Revision 10
E-0R3211(Q), Bechtel SNUPPS Raceway Plan Control Building EL 1974', Revision 8
E-23BB24, Callaway Plant Schematic Diagram Pressurizer Heater Backup Group B, Revision
1
E-23RP15(Q), Callaway Plant Electrical Schematic Drawing Lock-Out Relay Control Circuits
RP334/RP335, Revision 2
E-23RP11(Q), Callaway Plant Electrical Schematic Drawing Lock-Out Relay Contact
Development Sep. Grp. 2, Revision 1
E-23RP12(Q), Callaway Plant Electrical Schematic Drawing Lock-Out Relay Contact
Development Sep. Grp. 4, Revision 3
Miscellaneous Documents
NUREG 0830, Safety Evaluation Report related to the operation of Callaway Plant, Unit No. 1,
dated October 1981
-5-
NUREG 0830, Supplement No. 3, Safety Evaluation Report related to the operation of
Callaway Plant, Unit No. 1, dated October 1983
NUREG 0830, Supplement No. 4, Safety Evaluation Report related to the operation of
Callaway Plant, Unit No. 1, dated October 1984
NUREG-1058, "Technical Specifications, Callaway Plant, Unit No. 1, Appendix 'A' to License
No. NFP-30", Revision 1
Callaway Plant Individual Plant Examination of External Events
Letter to Mr. Harold R. Denton, Director, Office of Nuclear Reactor Regulation, USNRC from
Nicholas A. Petrick, Executive Director, Standardized Nuclear Unit Power Plant System, dated
February 1, 1984 (SLNRC 84-0013)
Letter to Mr. Harold R. Denton, Director, Office of Nuclear Reactor Regulation, USNRC from
Nicholas A. Petrick, Executive Director, Standardized Nuclear Unit Power Plant System, dated
February 1, 1984 (SLNRC 84-0014)
Letter to Mr. Harold R. Denton, Director, Office of Nuclear Reactor Regulation, USNRC from
Nicholas A. Petrick, Executive Director, Standardized Nuclear Unit Power Plant System, dated
February 24, 1984 (SLNRC 84-0037)
Letter to Mr. Harold R. Denton, Director, Office of Nuclear Reactor Regulation, USNRC from
Nicholas A. Petrick, Executive Director, Standardized Nuclear Unit Power Plant System, dated
August 23, 1984 (SLNRC 84-0109)
Letter to Mr. James G. Keppler, Regional Administrator, Region III, USNRC, from Donald R.
Schnell, Vice President, Union Electric Company, "Acceptability of Test Results for Control
Room Halon System (SKC07)," dated June 29, 1984 (ULNRC 857)
Letter to Mr. James G. Keppler, Regional Administrator, Region III, USNRC, from Donald R.
Schnell, Vice President, Union Electric Company, dated July 31, 1984 (ULNRC 893)
Memorandum to Harold R. Denton, Director, Office of Nuclear Reactor Regulation, USNRC
from James G. Keppler, Regional Administrator, Region III, USNRC, dated October 16, 1984
Minutes of August 22, 1984, Meeting with Kansas Gas and Electric and Union Electric
Company, issued by the USNRC on August 31, 1984
SA01-NE-008, "Self-Assessment Report, Post-Fire Safe Shutdown, Electrical Fire Hazards
Analysis," dated November 19, 2001
NRC Inspection Report No. 50-483/84-49(DRP), dated October 16, 1985
NRC Inspection Report No. 50-483/84-41(DRS), dated September 7, 1985
Callaway Plant Final Safety Analysis Report, Revision OL-13, dated May 23, 2003
-6-
Callaway Plant Final Safety Analysis Report, Site Addendum, Revision OL-13
Operating Quality Assurance Manual, Revision 23