ML040090220

Inspector Post-Inspection Debrief to Region II DRS Managers Regarding Harris Triennial Fire Protection Inspection

ML040090220
Person / Time
Site:	Harris
Issue date:	12/23/2002
From:	Christensen H, Fillion P, Hagar R, Ogle C, Payne D, Schln R, Necota Staples, Wiseman G NRC/RGN-II
To:
References
FOIA/PA-2003-0358 IR-02-011
Download: ML040090220 (6)

Text

HI December 23, 2002 INSPECTION

SUMMARY

- TRIENNIAL FIRE PROTECTION INSPECTION AT SHEARON HARRIS Report Number: 50-400/02-11 Onsite Inspection Dates: 10/21-25, 11/4-8, and .12/16-20 Inspection Team: Robert Schin (team lead, operations, audits/assessments); Gerry Wiseman (fire protection - first two weeks only); Paul Fillion (electrical); Charles Payne (operations - third week only); Robert Hagar (operations - third week only); Shakur Walker (electrical - third week only)

Accompanying Personnel: Harold Christensen (end of inspection & exit meeting); Charles Ogle (end of inspection); Necota Staples (inspector training - first two' weeks only)

Scope: Routine Triennial Fire Protection Inspection, per IP 71111.05, focusing on selected fire areas/zones listed below. Also, walkdown of all local manual operator actions needed for hot shutdown for selected fire areas and also for new Auxiliary Control Panel room fire area (corrective action'for Thermolag wall White finding) using checklist from DRAFT NRC Rev. to IP 71111.05. This involved about 72 operator actions. Selected fire areas/zones included:

- 1. Fire Area 1-A-BAL, Fire Zone 1-A-4-CHLR; Auxiliary Building 261 ft. level,

- including both trains of chillers and AFW flow control valves. ;Fire barriers in this zone include' a 'no intervening combustible materials zone' with fire break materials wrapped around intervening cable trays, and much Hemyc wrap A fire in this area or the other areas below would involve shutdown from the control room.

-2. Fire Area 1-A-BAL, Fire Zone 1-A-4-COM-E; Auxiliary Building 261 ft. level,

-including both trains'of 480V MCCs-(MCC IA-355A and MCC 1B-355B). Fire barriers in this zone include a partial height radiant heat wall and much Hemyc wrap.

3. Fire'Area 1-A-EPA;' Auxiliary Building 261 ft. level, including electrical penetration room and pressurizer heater' panels. Fire barriers in this zone include much Hemyc wrap.-

4.' Fire Area 1-A-BATB; Auxiliary Building 286 ft. level, 'B' train battery room.

The inspection findings involved two main types of issues:

1) spurious actuations of equipment relied upon for safe shutdown that could result from fire-induced hot shorts in unprotected control cables (mainly MOVs)

2) operator actions, to prevent or respond ;to spurious actuations, that would not work.

Findings included:

1. For a fire in In fire zones 1-A-4-CHLR [Safe Shutdown Analysis (SSA) areas 1-A-BAL-B-BI & B2)] and 1-A-EPA:

MOV 1CS-165 (VCT outlet to CSIPs) control cables not protected from spurious actuation - closure of this MOV would stop all charging/safety injection pump( CSIP) suction and damage the running CSIP. Also, no operator action in SSA or AOP-036.

Also, this condition was affected by ESR 01-00087 (Jan 2002), which changed CSIP mini-flow to go to VCT versus to the CSIP suction: The ESR failed to recognize this condition. Also, the control power cable for MOV 2-CC-V169 (CC flow to RCP seals) runs unprotected through the same fire areas and in the same cable tray. Consequently, all RCP seal cooling could be lost.

2. For a fire in fire zone 1-A-BAL-C:

MOV 1CC-251 (CCW to RCP seals) control cables not protected from spurious actuation

- closure of this MOV would stop CCW to all RCP seals and could result in loss of all RCP seal cooling (charging to RCP seals was not protected for this fire). Also, no operator action in SSA or AOP-036.

3. For a fire in fire zone 1-A-4-COME (SSA area 1-A4-BAL-B-B5) certain cables inside 480V MCC 1-A35-SA that were relied upon for SSD could be affected by a fire near the MCC:

a. MOV ICS-169 (CSIP suction x-conn) control cables inside the MCC not protected from spurious actuation - closure of this MOV would stop all suction and damage SSD CSIP B. Procedure steps in AOP-36 not adequate to assure prompt de-energizing of the MCC for a fire adjacent to the MCC.

b. MOV ICS-214 (CSIP mini-flow isolation) control cables inside the MCC not protected from spurious actuation - closure of this MOV would stop mini-flow from all CSIPs. Procedure steps in AOP-36 not adequate to assure prompt de-energizing of the MCC for a fire adjacent to the MCC.

c. MOV 1CS-218 (CSIP discharge x-conn) control cables inside and above the MCC not protected from spurious actuation - closure of this MOV would stop charging flow from SSD CSIP B. Procedure steps in AOP-36 not adequate to assure prompt de-energizing of the MCC for a fire adjacent to the MCC. Also, AOP-36 stated wrong breaker location (on another MCC).

d. MOV 1CS-219 (CSIP discharge x-conn) control cables inside and above the MCC not protected from spurious actuation - closure of this MOV would stop charging flow from SSD CSIP B. No operator action in SSA or AOP-036.

4. For a fire in fire zone 1-A-4-COME (SSA area 1-A4-BAL-B-B4) certain cables inside 480V MCC 1-B35-SB that were relied upon for SSD could be affected by the fire near the MCC:

a. MOV 1CS-168 (CSIP suction x-conn) control cables inside the MCC not protected

-~ ~fr-o-mspurious actUttid-h - closure of this MOV would stop all suction and damage SSD CSIP A. No operator action in SSA or AOP-036.

b. -MOV-1CSv166-(VCT outlet) control cables-inside'and above the MCC not protected from spurious actuation - closure of this MOV would stop all suction and damage any running CSIP.' No operator action in SSA or AOP-036. Also, this condition was affected by ESR 01-00087, which failed to recognize this condition.

5. For a fire in 1-A-ACP, AOP-36 steps 2.C and 14.A (which involved removing fuses from xfer panel 1B) presented excessive challenges to operators and consequently represented an inadequate Drocedure. The licensee'had not ensured that all SSD auxiliary operators (AOs) could perform'the steps. Challenges included:

a. smoke from the fire that would pass around a fire door about 15 feet away; the door would be opened by the fire brigade to attack the fire while procedure steps were to be performed

b. entering an energized electrical cabinet that was about 15 inches wide inside (some AOs were wider and would not fit);

c. using a metal screwdriver to remove a fuse cover inside the cabinet, about seven ft. above the floor, with poor visibility, and very close to energized electrical equipment (a personnel hazard and difficult to do);

d. finding an uncontrolled step stool (for short AOs);

e. poor labeling on cabinet doors and on fuses NOTE: This finding involves inadequate corrective action for the previous White finding on the ACP room Thermo-Lag wall.

6. For a fire in fire areas 1-A-BAL-B or 1-A-ACP, there were insufficient AOs to perform

'local manual SSD actions required for hot shutdown (i.e. AOP-36 was inadequate).

There were too many AOP-036 contingency actions, to respond to potential spurious

'actuations that could occur'due'to unprotected cables, for one operator to perform. The licensee operated the plant with four AOs; three were assigned to the fire brigade and one was assigned to perform all of the.SSD actions outside of the control room. In addition, this one AO would have to handle any local manual actions that could be needed if a LOOP or plant trip occurred (these conditions could occur due to the fire - the licensee had not performed analysis to assure that they would not occur). Example actions that could not be performed included:

If the charging flow control air-operated valve failed (due to loss of non-safety instrument air or due to loss of the unprotected control wire because of the fire) then the SSD AO was to locally manually throttle the FCV bypass valve and remain at the valve in constant communication with the control room.,AOs said they would use a sound-powered

I telephone headset. Subsequent contingency actions then could not be performed, including:

a. locally manually closing a steam generator PORV that could stick open during a fire in fire area 1-A-BAL-B

b. locally manually controlling auxiliary feedwater flow if the flow control valves failed during a fire in fire area 1-A-ACP

7. For a fire in fire zone 1-A4-BAL-B, AOP-036 directs operators to take CSIP suction from the boric acid tank (BAT) using gravity feed if the BA transfer pumps and BAT level indication were lost. However, charging volume needed for RCS cool down would have emptied the BAT and damaged the CSIP. Consequently, this was an inadequate procedure step.

8. Emergency lighting for local manual operator actions was not adequate. The licensee relied upon EDG-backed fluorescent lights but these did not satisfy the requirement for eight-hour battery backed lighting and the licensee had no NRC-approved exemption.

Also, some local manual operator actions did not have sufficient EDG-backed fluorescent lights.

9. For a fire in 1-A-BAL-B, AOP-036, Attachment 1, Step 1.B directs operators to open breakers for 3 MOVs on MCC 1-A-35-SA and 1 MOV on MCC 1-E12 which could be in the fire. Sending an operator into a fire represents an inadeguate Drocedural step.

Two URIs were identified for further NRC action:

1. Review of the credibility of spurious actuations resulting from a fire that could start in a 480V MCC. NOTE: Breakers for SSD MOVs are located in the MCC (alongside breakers for the non-SSD equipment) - these MOVs have a SSD function to remain open. The IPEEE assumes a bounding condition that the MCC is lost - the upstream power supply breaker trips. However, if spurious actuations of breakers located within MCC 1-A35-SA or MCC 1-B35-SB could occur due to the fire originating within the MCC, that would be a worse condition. Spurious closure of the MOVs could damage the SSD charging pump.

The licensee contends that spurious actuations due to a fire originating within the MCC are not credible - the breaker powering the MCC will trip first. The licensee further contends that they cannot design against this vulnerability (they contend that they must have SSD equipment and non-SSD equipment powered from the same MCC).

2. NRC rulemaking to allow licensees to change their fire protection plan, without NRC approval, to add operator actions for SSD instead of physically protecting cables from fire damage. Approximately 70 local manual SSD operator actions needed for hot shutdown following a fire in the areas inspected will be included in this URI.

Contributing factors to the above conditions included:

1. The SSA was not consistent with NRC requirements (SSA methodology relied on extensive use of operator actions for SSD. These actions lacked NRC approval and also

,b I lacked verification & validation similar to what the NRC would request prior to giving NRC approval.) The licensee had not walked down the operator actions.

2. AOP-36 and the SSA were not consistent. AOP actions and flowpaths deviated from those analyzed in the SSA.

3.

.~~. .i .v ..

Audits

.L.cens.e.

and assessments of SSD were s weak.

s la kig Corporate/independent audits were lacking.

Level of detail in SSD assessments was lacking. Licensee assessments apparently did not trace cable routings or walk down operator actions.

4. Training of SSD AOs was weak. The AOs received no general training on SSD and had JPMs for only three of approximately 72 local manual operator actions walked down by the NRC team.

5. SSD procedures included many weaknesses, including:

• Sequence of actions - cold shutdown actions were mixed in with hot shutdown actions.

• Wording of steps 2 & 6B, if followed literally, could inappropriately stop operators from using AOP-36 during a fire. One step directs operators to use AOP-36 when directed to do a plant cooldown. The other step directs operators to use the normal shutdown procedure if one train of shutdown equipment is available.

However, the following steps in AOP-36 include preventing or reacting to spurious actuations that may occur due to the fire.

• For a fire in 1-A-EPA or 1-A-BATB, AOP-36 included contingency actions for pumping water from the containment sump back into the RWST with an RHR pump. However, the valve lineup in the procedure would not work. Subsequent licensee review found that this contingency action was not needed.

• For a fire in 1-A-EPA, a cold shutdown repair procedure was not adequately planned. It relied on using some of the installed cables in the fire area and also relied on using alternate cables that were prestaged in 1-A-EPA. All of these cables could be damaged by the fire that they are supposed to mitigate.

Subsequent licensee review found that they did not need to rely on this cold shutdown repair procedure.

• Procedure steps did not always include locations of components, and operators had difficulty finding several components.

6. Labeling was poor - many labels on equipment and cabinets were missing or difficult to read.

Inspection Successes:

• Sufficient deficiencies were identified to spur a major licensee effort to improve their ability to safely shut down following a fire.

i

• The new NRC resident inspector digital camera was used successfully.

• The licensee was very responsive to NRC findings and comments.

Inspection Challenges:

• We do not have the personnel to routinely do as thorough an inspection, including tracing as many cables or walking down as many local manual operator actions.

NRR may want us to do more walkdowns of operator actions than we can do.