ML040050066
| ML040050066 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 12/12/2003 |
| From: | Chamberlain D Division of Reactor Safety IV |
| To: | Anderson C Entergy Operations |
| References | |
| EA-03-016, FOIA/PA-2003-0358 | |
| Download: ML040050066 (11) | |
See also: IR 05000313/2001006
Text
town REG ('
UNITED STATES
o \\1
{
°
.
NUCLEAR REGULATORY COMMISSION
REGION IV
Q~!I4O
il
611 RYAN PLAZA DRIVE, SUITE 400
'4 5 o'@ ,<iot
ARLINGTON, TEXAS 76011-4005
[j
l
jp
Craig G. Anderson, Vice President,
Operations
Arkansas Nuclear One
Entergy Operations, Inc.
1448 S.R. 333
Russellville, Arkansas 72801-0967
SUBJECT:
ARKANSAS NUCLEAR ONE - NRC TRIENNIAL FIRE PROTECTION
INSPECTION REPORT 50-313/01-06; 50-368/01-06 - PRELIMINARY
GREATER THAN GREEN FINDING
Dear Mr. Anderson:
On August 20, 2001, the NRC issued the subject triennial fire protection report, which
discussed a finding concerning the acceptability of your use of operator actions to remotely
operate equipment necessary for achieving and maintaining hot shutdown, in lieu of providing
protection to the cables associated with that equipment, as a method of complying with
10 CFR Part 50, Appendix R, Section III.G.2. This finding was unresolved pending further NRC
review of your licensing basis and determination of the risk significance of the finding. By letter
dated April 5, 2002, in response to your backfit claim, the NRC informed you that this finding
was not a backfit, and reclassified the unresolved item as an apparent violation, pending NRC's
assessment of the risk.
Using the Significance Determination Process described in NRC Inspection Manual
Chapter 0609, this finding was preliminarily determined to be greater than green (i.e., a finding
whose safety significance is greater than very low), which may result in additional NRC
inspection and potentially other NRC action. As indicated in the enclosed Significance
Determination Process Phase 3 Summary, the significance of this finding may be greater than
GREEN (very low) due to the number of safe shutdown components that may be affected as a
result of fire (e.g., main feedwater, high pressure injection, emergency AC power, and
emergency feedwater) and the uncertainty regarding the timing and synergistic impact that
potential failures may have on the operator's ability to accomplish required shutdown functions
in time to prevent core damage. Specifically, the significance of the finding was attributed to a
failure of emergency feedwater and feed and bleed capability, assuming no credit for operator
recovery actions.
In discussions held with your risk analysts, there appear to be some differences between your
risk analysis and the significance determination performed by the NRC. These differences
include the method for determining fire duration and severity, heat release rates, the fire ignition
frequency, and operator recovery of critical shutdown functions. Your analysts used the FIVE
(fire-induced vulnerability evaluation developed by the Electric Power Resource Institute)
methodology, whereas NRC analysts used the CFAST model to assess fire duration and fire
severity. The NRC analysts assumed higher heat release rates (200-500 KW vs.70-200 KW).
§2,
SK.
Entergy Operations, Inc.
-2-
Consequently, in the NRC analysis, the time to reach critical temperatures was quicker;
therefore, the likelihood for success of manual suppression capabilities was reduced. In
addition, the heat release rates used by the NRC analysts resulted in an increased likelihood
that both the emergency feedwater and high pressure injection functions would be affected by a
fire. Finally, the NRC considered the added risk from other fire areas affected by this finding
which may warrant an increase in the final significance of the finding. A more detailed
discussion of the NRC's risk determination is included in the enclosure.
By letter dated February 3, 2003, you provided additional technical information that you
requested be considered prior to our making a final decision on the risk significance of this
finding. In addition, you indicated that you may have updated information, and requested the
opportunity to review the NRC's risk evaluation, in order to permit the inclusion of this updated
information. The additional information in Attachment 1 to your letter, included a list of cables
whose failure temperatures appear to be 700 degrees, F, the layout of ignition sources in Fire
Zone 99M, and raceway locations in Fire Zone 99M. On response to your request of
February 3, 2003, to review the NRC's risk evaluation, a summary of the NRC's Phase 3
significance determination is enclosed.
Before we make a final decision regarding the significance of this finding, we are providing you
the opportunity to present to the NRC your perspectives concerning the facts and assumptions
used by the NRC in its significance determination at a Regulatory Conference or through the
submittal to the NRC in writing. In addition, you may present any new technical information that
you deem pertinent to the significance determination of the finding. If you chose to request a
Regulatory Conference, it should be held within 30 days of the receipt of this letter and we
encourage you to submit supporting documentation at least one week prior to the conference in
an effort to make the conference more efficient and effective. If a Regulatory Conference is
held, it will be open for public observation. If you decide to submit only a written response, such
submittal should be sent to the NRC within 30 days of the receipt of this letter.
This finding does not represent a current safety concern, because the licensee posted fire
watches in all fire areas affected by this finding, in accordance with their fire protection
program.
The finding is also an apparent violation of NRC requirements and is being considered for
escalated enforcement action in accordance with the "General Statement of Policy and
Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1 600. The current
Enforcement Policy is included on the NRC's website at www.nrc.gov/OE.
Please contact Charles Marschall at 817-860-8185 within 10 business days of the date of this
receipt of this letter to notify the NRC of your intentions. If we have not heard from you
within 10 days, we will continue with our significance determination and enforcement
decision and you will be advised by separate correspondence of the results of our
deliberations on this matter.
Since the NRC has not made a final determination in this matter, no Notice of Violation is
being issued for these inspection findings at this time. In addition, please be advised that
the characterization of the apparent violation may change as a result of further NRC review.
Entergy Operations, Inc.
-3-
In accordance with 10 CFR 2.790 of the NRC's uRules of Practice," a copy of this letter and
its enclosures will be available electronically for public inspection in the NRC Public
Document Room or from the Publicly Available Records (PARS) component of NRC's
document system (ADAMS). ADAMS is accessible from the NRC Web site at
XXXXXXXXXXXXX(the Public Electronic Reading Room).
Sincerely,
Dwight D. Chamberlain, Director
Division of Reactor Safety
Dockets: 50-313
50-368
Licenses: DPR-51
NPF-6
Enclosure: SDP Phase 3 Summary
cc:
Executive Vice President
& Chief Operating Officer
Entergy Operations, Inc.
P.O. Box 31995
Jackson, Mississippi 39286-1995
Vice President
Operations Support
Entergy Operations, Inc.
P.O. Box 31995
Jackson, Mississippi 39286-1995
Manager, Washington Nuclear Operations
ABB Combustion Engineering Nuclear
Power
12300 Twinbrook Parkway, Suite 330
Rockville, Maryland 20852
County Judge of Pope County
Pope County Courthouse
100 West Main Street
Russeliville, Arkansas 72801
Entergy Operations, Inc.
-4-
Winston & Strawn
1400 L Street, N.W.
Washington, DC 20005-3502
Bernard Bevill
Radiation Control Team Leader
Division of Radiation Control and
Emergency Management
4815 West Markham Street, Mail Slot 30
Little Rock, Arkansas 72205-3867
Mike Schoppman
Framatome ANP, Inc.
Suite 705
1911 North Fort Myer Drive
Rosslyn, Virginia 22209
Entergy Operations, Inc.
-5-
Electronic distribution by RIV:
Regional Administrator (EWM)
DRP Director (ATH)
DRS Director (DDC)
Senior Resident Inspector (RLB3)
Branch Chief, DRP/D (US)
Senior Project Engineer, DRP/D (JAC)
Staff Chief, DRP/TSS (PHH)
RITS Coordinator (NBH)
Only inspection reports to the following:
Scott Morris (SAMI1)
ANO Site Secretary (VLH)
KEYBOARD(TYPE IN ARCHIVED LOCATION AND NAME OF FILE)
[SRI-EMBase/m
- EMBC,
r
-s. C PBDWM.J
krlV
ACGESa JBCNnRR
D:DRhSambeain
[RLNeasellmb jCSMarschall
LJSmith
GFSanborn
JHannon
DDChamberlain
OFFICIAL RECORD COPY
T=Telephone
E=E-mail
F=Fax
Entergy Operations, Inc.
Significance Determination Process
Phase 3 Summary
A.
Overview of Issue
The installed configurations of equipment and cabling in the ANO Unit 1 diesel
generator corridor (Fire Zone 98J) and the north electrical switchgear room (Fire Zone
99M) did not ensure that cables associated with redundant trains of safe shutdown
equipment was free of fire damage as required by 10 CFR Part 50, Appendix R, Section
III.G. In lieu of providing this protection from fire damage, the licensee credited manual
actions to remotely operate equipment necessary for achieving and maintaining hot
shutdown. In addition, the licensee did not have adequate procedures for the manual
actions necessary to achieve safe shutdown.. The licensee credited a symptom-based
approach which relied on the operator's ability to detect each failure or mis-operation as
it occurred and then perform manual actions as necessary to mitigate the effects. Due
to the number of components that may be affected as a result of fire and uncertainty
regarding the timing and synergistic impact that potential failures may have on the
operator's ability to accomplish required shutdown functions, the NRC determined that
the strategy for implementing manual actions to mitigate a postulated fire were
inadequate.
B.
Results of Phase 3 Risk Analysis
A Phase 2 risk analysis using NRC Manual Chapter 0609, "Significance Determination
Process," Appendix F, 'Determining Potential Risk Significance of Fire Protection and
Post-fire Safe Shutdown Inspection Findings," was required, because the issue involved
fire protection defense in depth. Depending on the assumptions, the results of the
Phase 2 analysis varied between very low safety significance and high safety
significance. Therefore, a Phase 3 analysis was required.
The NRC's senior reactor analyst reviewed the licensee's risk analysis, which was
performed using the Fire-Induced Vulnerability Evaluation (FIVE) methodology
developed by the Electric Power Research Institute (EPRI) for the determining fire
duration and severity. The licensee's analysis resulted in an increased time for reaching
temperatures at which cables could be damaged. Because the time to reach critical
temperatures was more than 20 minutes, the licensee assumed that manual fire
suppression would be successful. However, the licensee did not credit manual
suppression capability in the determination of the conditional core damage probability
(CCDP) results. In addition, the licensee's risk analysts used heat release rates of
70-200 KW in assessing the potential for fire damage in the affected fire zones, which
resulted in a determination by the licensee that a fire in Fire Zone 99-M would not
simultaneously affect the emergency feedwater (EFW) and high pressure injection (HPI)
functions. Source documents used by the licensee included EPRI TR-105928, EPRI
Fire PRA Implementation Guide," EPRI TR-10043, "Methods of Quantitative Fire
Hazards Analysis," and EPRI Report SU-105928, "Supplemental to EPRI Fire
Implementation Guide (TR-105928)."
Entergy Operations, Inc.
-2-
The NRC risk analyst used higher heat release rates:t200-500 KW) o assess the
potential for fire duration and severity. As a result, the time to reaisu critical
temperatures was quicker and the likelihood for success of manual suppression
capabilities was reduced. Additionally, the higher heat release rates resulted in an
increased likelihood that both the EFW and HPI functions would be affected by a fire in
Zone 99-M.
The NRC utilized the CFAST model to develop a fire hazards analysis, using as input,
licensee-provided information concerning the ignition frequencies and the CCDP for a
fire with and without operator recovery actions. A human reliability screening analysis
for the manual operator actions was performed using INEEUEXT-99-0041, 'Revision of
the 1994 ASP HRA Methodology (Draft)," dated January 1999. The NRC risk analyst
also completed a qualitative assessment of similarly affected fire areas, in which they
determined that the added risk from the other similarly-affected fire areas may warrant
an increase in the final significance determination process result.
The NRC analyst determined that multiple redundant trains of mitigating equipment
(main feedwater, high pressure injection, emergency AC power, and emergency
feedwater) could potentially be affected by a fire in Fire Zone 99M. In reviewing the
results of each accident sequence, it was concluded that the significance of the finding
was primarily attributed to a failure of emergency feedwater and feed and bleed
capability, assuming no credit for operator recovery actions.
The more significant influential assumptions involved: (1) the human error probability for
successful recovery of failed equipment due to the symptomatic operator response to a
fire in the affected areas and the large number of operator actions, and (2) the heat
release rate associated with the fire and corresponding failure probability associated
with manual fire suppression.
Lowering the human error probability directly impacted the core damage frequency
(CDF) calculation; therefore, several sensitivity analyses were completed using a wide
spectrum of hunian error probability (HEP) values. Additionally, the NRC analyst noted
that the licensee's human reliability analysis (HRA) values were derived for a non-fire
event; therefore, increased the base HEP values for the affected recovery actions. The
net increase in the CDF was attributed to the failure to provide adequate alternate
shutdown procedures given a fire in Zone 99-M.
A reduction in the heat release rate would extend the time required to reach critical
temperatures. An extension in the time to reach critical temperatures to beyond
20 minutes could result in fewer affected components and lower the failure probability
for manual fire suppression. Nevertheless, the NRC risk analyst determined that a
reduction in the heat release rate was not appropriate given the data collected from
industry events which involved energetic switchgear fires.
The sensitivity analyses were completed using licensee-calculated CCDP values which
corresponded to various combinations of HEPs. The NRC analyst determined that the
calculated increase in CDF for Fire Zone 99-M was in the range of<7E-6/year to
2E-5/year.tThe analyst qualitatively determined that an additional increase in the CDF
Entergy Operations, Inc.
-3-
was warranted due the existence of additional fire zones at the facility which also
credited the use of operator recovery actions. The increase in the CDF frpm these
additional fire zones warranted a proposed significance determination of"Yellow:
C.
Human Reliability Screening Analysis
The team determined that the licensee had not implemented appropriate procedural
controls for a fire in Fire Zones 99-M (north electrical switchgear room) and 98-J (diesel
generator corridor). Specifically, the licensee relied solely on a symptomatic response
to a fire in these areas. For example, if a control room operator became aware of a loss
of feedwater condition, then operators would respond by aligning EFW from either the
control room or locally. This approach differed from other alternate shutdown areas of
the plant. For these areas, specific procedural guidance (Procedure 1203.002,
"Alternate Shutdown") existed to direct the operators to isolate and then restore
potentially affected components.
The following four broad classes of operator actions were evaluated:
1.
Manual alignment of EFW to the steam generators.
2.
Restoration of service water to the affected diesel generators.
3.
Isolation of letdown flow and inventory control.
4.
Local start of an diesel generators without DC control power.
For each of the above classes, an operator would be required to successfully diagnose
the system failure, determine the appropriate procedure, and then take the appropriate
series of operator actions to mitigate the failure. There were several complicating
factors in completing the analysis because the operator actions would be required
during or following a major fire. Specifically, the fire could result in: (1) inaccurate
indications associated with critical plant parameters, (2) spurious actuation of plant
equipment which could be detrimental to the event, (3) failure of plant equipment to
respond automatically, (4) inability to remotely operate plant equipment from the main
control room, and (5) previously implemented operator actions could become
over-ridden by subsequent operator actions through the use of multiple procedures in
lieu of a single prioritized procedure.
An "Extreme Stress" classification was used for each class of operator actions. This
level of stress is likely to occur when the onset of the stressor is sudden and the
stressing situation persists for long periods.
An "Available, But Poor" classification was used for the procedural actions necessary to
recover failed or degraded mitigating equipment. This classification is used for
conditions where a procedure is available but inadequate. This classification level was
chosen because the licensee planned to utilize symptomatic operator response to fire-
damaged equipment, in lieu of having a pre-planned shutdown procedure. If properly
diagnosed, procedures existed for operators to implement the individual system
Entergy Operations, Inc.
-4-
recovery actions. However, there may be dependencies between the procedures which
are not accounted for. Specifically, to recover AC power, the operators may need to
open the individual breakers on various switchgear. This activity could affect other
operator actions that may be required to restore mitigating systems. A single
pre-planned procedure would account for the dependencies between procedures such
that subsequent recovery actions do not adversely affect previously-performed required
recovery actions.
A "Barely Adequate Time" classification was used for diagnosing a loss of flow to the
steam generators and establishing EFW flow. This classification level was chosen
based on the potential for indications and controls not being available in the control
room. The timing associated with initiating EFW flow is dependent on operator actions
to secure reactor coolant pumps. In addition, the flow rate to the steam generators must
be controlled to prevent over-cooling and shrinkage of the reactor coolant system.
A "Barely Adequate Time" classification was used for diagnosing a loss of service water
to the diesel generators, and for securing the affected diesel generators. The diesel
generators without service water flow must be secured within 7 minutes to prevent
overheating and mechanical damage. The failure to secure the diesel generators could
potentially prevent recovery of an emergency AC power source.
A "Barely Adequate Time" classification was used for diagnosing the failure of letdown
to isolate, and taking manual action to secure letdown. If letdown is isolated within 4
minutes, then inventory control may not be required for 40 minutes. The failure to
isolate letdown directly impacts the time available to initiate inventory control.
A "Highly Complex" classification was used for a jocal start of the diesel generators
without DC power. This procedure is infrequently performed, requires a high degree of
skill, and includes multiple steps to complete.
A "Moderately Complex" classification was used for a local manual start of an EFW
pump and for local manual control of EFW flow to a steam generator. This activity is
infrequently performed and would require constant communication with personnel
monitoring important plant parameters to ensure the appropriate heat removal rate was
maintained.
Limited personnel would be available during the first hour following a fire. Two
individuals would be available for field operations (1 main control room reactor operator
and 1 auxiliary operator). The remaining personnel would be assigned other functions.
Specifically, the shift manager would be assigned emergency response organization
duties, the control room supervisor and one reactor operator would remain in the main
control room, the waste control operator and 1 auxiliary operator would be assigned to
the fire brigade. The shift engineer would be available to provide assistance where
necessary, but cannotioperat6nequipment. A Unit 2 operator could be dispatched to
start the alternate diesel generator; however, the licensee did not credit the use of Unit 2
operators in the performance of Unit 1 plant manipulations.
Entergy Operations, Inc.
-5-
The analyst determined that 1 operator would need to be dedicated to the restoration of
EFW and the operation of the EFW flow control valves. The remaining operator would
be required to complete all other evolutions (Isolate letdown, local start of the diesel
generator, and all breaker manipulations). In contrast, the alternate shutdown
procedure requires four operators, as a minimum, for successful completion. The
analyst determined that the majority of actions specified in the alternate shutdown
Drocedure could potentially be required for a major fire in Fire Areas 99-M or 98-J.
Recovery Action
Diagnosis
Action Failure Probability
Task Failure Probability
Failure
Without Formal
Probability
Dependence
Without
With
Without
With
Procedure
Procedure
Procedure
Procedure
Establish
0.5
0.5
0.1
1.0
0.6
emergency
Secure diesel
0.5
0.25
0.05
0.75
0.55
generator without
Local diesel
0.05
0.125
0.025
0.18
0.075
generator start
Isolate Letdown
0.5
0.25
0.05
0.75
0.55
and Inventory
Control
D.
Sensitivity Analysis
A wide spectrum of sensitivity analyses were completed using the licensee's CCDP
values which corresponded to various combinations of HEPs. The NRC analyst
determined that the calculated jncrease in CDF for Fire Zone 99-M would, most likely,
be in the range of /E-6 to 2E-5 The analyst qualitatively determined that an additional
increase in the CDE was warranted due the existence of other fire zones at the facility in
which the licensee credited the use of operator recovery actions in lieu of meeting
10 CFR Part 50, Appendix R, Section III.G.2 separation. The increase in the CDF from
these additional fire zones warranted a proposed significance determination c 1 elloi ..
The licensee's HRA was completed for non-fire conditions. The dominate recovery
actions for a fire in Zone 99-M involved the establishment of EFW, the restoration of
electrical power, and the establishment of feed and bleed capability. The associated
non-fire human error probabilities for these recovery actions were 1.86E-1 for EFW,
1.OE-1 for electrical power, and 6E-3 for feed and bleed. The revised HRA estimate
from the licensee included HEP values of 2.6E-1 for EFW, 1 E-1 for electric power, and
3.2E-1 for feed and bleed.
The NRC analyst completed a simplified HRA screening analysis using
INEEUEXT-99-0041, "Revision of the 1994 ASP HRA Methodology (Draft)," January
1999. The HEP values, assuming that procedures were available but poor, were 1.0 for
Entergy Operations, Inc.
-6-
EFW, 7.5E-1 for electric power, and 7.5E-1 for feed and bleed. The HEP values using
the assumption that procedures were adequate were 6E-1 for EFW, 5.5E-1 for electric
power, and 5.5E-1 for feed and bleed.
The NRC analyst selected multiple combinations of NRC and licensee derived HEP
values for the sensitivity analysis. The range of results was typically between .7E-6/year
and 2E-5/year. -
E.
Qualitative Assessment of Other Fire Areas
A qualitative analysis of similarly-affected fire zones in Unit 1 and Unit 2 was performed
by the NRC analyst. The analyst compared 15 fire zones in Unit 1 which required
manual recovery actions for safe shutdown to Calculation 85-E-0053-47, 'Individual
Plant Examination of External Events/Fire," Revision 2, to determine which fire zones
were unscreened as part of the FIVE analysis. The analyst also compared the 21 fire
zones in Unit 2 which required manual recovery actions for safe shutdown to Calculation
85-E-0053-48, "Individual Plant Examination of External Events/Fire," Revision 2, to
determine which fire zones were unscreened as part of the FIVE analysis. Those fire
zones that did not screen out In the licensee's FIVE analysis were considered
further as described below.
The remaining fire zones affected by this finding were reviewed for the presence of
automatic suppression capability. The NRC's quantitative analysis of Fire Zones 98J
and 99M determined that the finding in Fire Zone 98-J was of low safety significance
partially due to the availability of automatic suppression capability. The analysis of Fire
Zone 99-M determined that the finding in Fire Zone 99M was of low to moderate or
substantial safety significance partially due to the lack of automatic suppression
capability. Based on this, the NRC analyst determined that for other fire zones
affected by this finding, the significance would be reduced for those having
automatic suppression.
The NRC analyst determined that Fire Zones 98-J and 99-M had ignition frequencies
between 2E-3 and 4E-3 and that both fire zones included multiple redundant trains of
safe shut down equipment. The analyst determined the significance of a fire in a
particular fire zone would be reduced if multiple redundant trains of equipment were not
affected, or if the fire zone had a relatively low ignition frequency (less than 1 E-3).
Accordingly, fire zones were qualitatively removed from further consideration if any of
the following conditions existed: the ignition frequency was less than 1 E-3, the affected
area had automatic suppression capability, or multiple redundant trains of safe
shutdown equipment were not affected by a postulated fire. The NRC analyst
qualitatively determined that 2 additional fire zones in Unit 1 (Fire Zones 104-S and
100-N) had either low to moderate or substantial safety significance. The analyst also
qualitatively determined that 4 fire zones in Unit 2 (Fire Zones 2100-Z, 2096-M,
2091-BB, and 2040-JJ) had low to moderate safety significance. Based on this, the
NRC determined that escalation of a quantitative result of low to moderate to substantial
safety significance may be warranted.