ML050900177

SERP Worksheet for SDP-Related Findings

ML050900177
Person / Time
Site:	Arkansas Nuclear
Issue date:	03/18/2004
From:	- No Known Affiliation
To:	Office of Nuclear Reactor Regulation
References
FOIA/PA-2004-0277, IMC 0609
Download: ML050900177 (22)

Text

SERP Worksheet for SDP-Related Findings IMC 0609 Exhibit 4 of Att 1 SERP Date:

I hIr 004 Cornerstone Affected and Proposed Preliminary Results:

This finding affects the Mitigating Systems Cornerstone, because it affects the objective to ensure the availability, reliability, and capability of systems that respond to an external event (fire) to prevent undesirable consequences. Specifically, the licensee's ability to achieve and maintain hot shutdown conditions in the event of a fire in Fire Areas 98J and 99M is affected! by the lack of separation of redundant trains of safe shutdown systems in accordance with 10 CFR Part 50, Ap'peIidbix f[Seti6Wlll.G.2.

Licensee:

Facility/Location:

Entergy Operations, Inc.

Arkansas Nuclear One Docket No(s):

License No(s):

Inspection Report No:

50-313 and 50-368

, 0 51066 2001-06

_ Date of Exit Meeting: -

August 21, 2001-final exitiMeeting pending Issue Sponsor:

Meeting Members:

Issue Sponsor:

Technical Spokesperson:

Dwight Chamberlain Dwight Chamberlain NRR Probabilistic Safety Assessment Branch W R8 R~la sfs ac Program Spokesperson:

OE Representative:

NRR Inspection Program Branch Jennifer Dixon-Herrity A.

Brief Description of Issue ANO Unit 1 fire zones for the diesel generator corridor (Fire Zone 98J) and the north electrical switchgear (Fire Zone 99M) room did not meet separation requirements for electrical cables associated with redundant trains of safe shutdown equipment. In addition, the licensee did not have adequate procedures for the manual actions necessary to achieve safe shutdown (Section 1 R05.3 of Reference 1).

Information in this record was deleted in accordance with the Freedom of Information Act, exemptiQns

' FOIA- -

W 12 1

'V

B.

Statement of the Performance Deficiency As a method for complying with 10 CFR Part 50, Appendix R, Section III.G.2, the licensee credited the use of manual actions to locally operate equipment necessary for achieving and maintaining hot shutdown, in lieu of ensuring cables associated with that equipment were free of fire damage as required by 10 CFR Part 50, Appendix R, Section Ill.G.2. The licensee credited a symptom-based approach which relied on the operator's ability to detect each failure or mal-operation as it occurred and perform manual actions as necessary to mitigate the effects of the failure or mal-operation. Due to the number of-components -that may be affected asa rYesult of fire and uncertainty

_-----regarding the timing and syneigistic impact that potential failures may have on the operator's ability to accomplish required shutdown functions, the inspection team determined that the strategy for implementing manual actions to mitigate a postulated fire were inadequate (Reference 1).

C.

Significance Determination Basis

1.

Reactor Inspection for IE, MS, B cornerstones

a.

Phase 1 screening lores, anc ump ns The team determined that a SDP Phase 2 analysis using MC 0609 Appendix F was required because the issue involved fire protection defense in'depth function.-(Reference 2).

b.

Phase 2 Risk Evaluation Depending on the assumptions (made by the licensee and/or NRC staff), the results of the Phase 2 analysis could vary betweer le P

Region IV determined that a SDP Phase 3 analysis was required and submitt'ed TIA 01TIA1 I to NRR. (Reference 2)

The Phase 2 analysis was shown to be particularly sensitive to human recovery.

In addition, the baseline CDF changed significantly with revised heat release rates.

List dominant affected accident sequences by initiator, in order of contribution, and each sequence's numerical contribution.

The SDP Phase 2 results, using conservative assumptions, for the finding pertaining to Fire Zone 98J resulted in 7 yellow sequences, 16 white sequences, 9

and 5 green-next-to-white sequences. The SDP Phase 2 results for the finding pertainin to Fire Zone 99M resulted i

_iI1 Ill 7

vim Oft

_Optimistic assumptions (lower ignition frequency and additional credit for restoration of some functions) could result in a much lower significance determination for both fire zones. (Reference 2) 2

A table attached to the Phase 2 analysis summarizes the equipment affected in each fire zone. Multiple redundant trains of mitigating equipment were determined to be affected (main feedwater, high pressure injection, emergency AC power, and emergency feedwater). In reviewing the results of each sequence, it was concluded that the significance of the finding was attributed to a failure of emergency feedwater and feed and bleed capability, assuming no credit for operator recovery actions. (Reference 2)

List any pertinent assumptions under each initiator group (A risk analyst should review and verify that Phase 2 process was followed correctly and that the results are reasonable.)

A senior reactor analyst reviewed the Phase 2 results and determined that the assumptions involving the ignition frequency, operator recovery actions, fire severity factors, and fire suppression required detailed fire modeling of the affected areas and a human reliability analysis for the recovery actions. A complete discussion of the assumptions used in the Phase 2 analysis is provided in Reference 2.

Attach appliocke Phs2 Worsheets See Referenqgk List any confirmatory checks made using licensee risk Information, SPAR model results, or-other source of xisk Insights.

1.

A Revision 3i SPAR model has not been developed for ANO Unit 1.

2.

ANO Calculation 95-E-0066-01, Revision 2, uANO-2 IPEEE P2 Values"

3.

ANO Calculation 95-E-0066-02, Revision 2, ANO-1 IPEEE P2 Values"

4.

ANO Unit 1 and Unit 2 IPEEE

5.

ANO Fire Hazards Analysis

6.

ANO White Paper regarding ignition source frequencies

7.

ANO Calculation 02-E-0004-01, "Zone 99-M PSA Analysis for Operator Action SDP"

8.

ANO Calculation 02-E-0004-02, Zone 98-J PSA Analysis for Operator Action SDP"

9.

NRC Memorandum from E. W. Weiss to M. Reinhart, "Fire Hazard Analysis for Fire Zone 98-J, Emergency Diesel Generator Corridor and Fire Zone.99-M, North Electrical Switchgear Room, Arkansas Nuclear One, Unit 1 (TAC No. MB2872)," dated May 28, 2002

10.

NRC Memorandum from E. W. Weiss to M. Reinhart, "Supplemental Fire Modeling for Fire Zone 98-J, Emergency Diesel Generator Corridor and Fire Zone 99-M, North Electrical Switchgear Room, Arkansas Nuclear One, Unit 1 (TAC No. MB2872)," dated July 18, 2002

11.

ANO Unit 1 and Unit 2 Updated Safety Analysis Reports Note any differences and an evaluation of their effect on this determination.

• 3

1.

The licensee used lower heat release rates (70-200 KW) in assessing the potential for fire damage in the affected fire zones. The licensee also utilized the FIVE methodology for the derivation of the fire duration and severity. Because the time to reach critical temperatures was more than 20 minutes, the licensee assumed that manual fire suppression would be successful. However, the licensee's PSA analysts did not credit manual suppression capability in the determination of the CCDP results. The lower heat release rate also resulted in a determination by the licensee that a fire in Fire Zone 99-M would not simultaneously affect the EPAI and HPI functions. Source documents used by the licensee included the EPRI Fire PRA Implementation Guide (EPRI TR-1 05928), Methods of Quantitative Fire Hazards Analysis (EPRI TR-!

and EPRI Report SU-105928, "Supplemental to EPRI Fire Implementation Guide (TR-105928)." (Reference 7)

2.

The NRC used higher heat release rates (200-500 KW) and the CFAST model to assess fire duration and fire severity. Consequently, the time to reach critical temperatures was quicker and the likelihood for success of manual suppression capabilities was reduced. Additionally, the heat releasdetes vep suluin anrncreaske lihood that both the EFW and H~l fI ctio__ould^i affected by Nfire in Zone 99-M. Several additigr2ourie dvcuuliitP wefrelisted ih the fire hazards analysis completed by NRR. (References 10 and 11)

c.

Phase 3 Analysis (if necessary)

Concisely address each of the analysis aspects that follow.

PRA tools used:

1.

NRR completed a fire hazards analysis using the CFAST model.

(References 10 and 11)

2.

NRR requested that the licensee provide additional information involving the ignition frequencies and the CCDP for a fire with and without operator recovery actions. (References 7, 8, and 9)

3.

INEEUEXT-99-0041, uRevision of the 1994 ASP HRA Methodology (Draft)," January 1999, was used to complete a human reliability screening analysis for the manual operator actions. (Reference 13).

4.

A qualitative assessment of similarly affected areas was completed.

Based on the assessment, the analysts determined that the added risk from the remaining fire areas may warrant an increase in the final SDP result from:

(Reference 14)

Affected sequences:

A>

4

Multiple redundant trains of mitigating equipment were determined to be affected (main feedwater, high pressure injection, emergency AC power, and emergency feedwater). In reviewing the results of each sequence, it was concluded that the significance of the finding was attributed to a failure of emergency feedwater, and feed and bleed capability, assuming no credit for operator recovery actions.

Influential assumptions:

1.

The human error probability for successful recovery of failed equipment due to the symptomatic operator response to a fire in the affected areas and the large number of operator-actions. (Reference 13)

2.

The heat release rate associated with the fire and corresponding failure probability associated with manual fire suppression. (References 7, 10, and 11)

Sensitivity of results to each influential assumption:

1.

Lowering the human error probability directly impacts the CCDP portion of the

_ calcultion. Several sensitiiysanalyses were completed using a

wie si ectFilm f bEP values. Adlditionally, the NRC analysts noted tj~I~he LepeeklTFA values were derived for a non-fire event.

Therefore, the NRC analysts increased the base HEP values for the affected recovery actions; The net increase in the CDF can then be attributed to the failure to provide adequate alternate shutdown.

procedures for a fire. in Zone 99-M.

2.

A reduction in the heat release rate would extend the time required to reach critical temperatures. An extension in the time to reach critical temperatures to beyond 20 minutes would result in fewer affected components and lower the failure probability for manual fire suppression.

Contributions of greatest uncertainty factors and impact on assumptions:

An uncertainty analysis was not completed. Descriptions of the influential factors affecting the analysis are described above. The reference documents also include additional assumptions and limitations.

Previous similar analyses: N/A Proposed preliminary or final color:

A wide spectrum of sensitivity analyses were completed by requesting that the licensee calculate CODP values which corresponded to various combinations of HEPs. The analysts determine at the calculated increase in CDF for Fire Zone 99-M was in the range of The analyst qualitatively determined that an additional increase in 6h-CDF was warranted due the existence of additional fire zones at the facility which also credited the use of 5'

CE-* 5 operator recovery actions. The increase in the CDF from these additional fire zones warranted a proposed significance determination d

o (References 14 and 15)

D.

Proposed Enforcer7enf D

c.

l-istorlcal-p'recedent.' None E.

Determination of Follow-up Review For White findings propose whether HQ RR and/orE) should review final determination letter before 'issuanceginI euetroclir0lFi~

HQ should review the final determination letter before issuance.

F.

References

1.

NRC Inspection Report 50-313; 368/01-06 dated August 20,2001 (ML012330501)

2.

Task Interface Agreement - Request for Risk Determination of Fire Protection Findings at Arkansas Nuclear One, Unit 1 (01 TIAl 1), dated September 10, 2001 (ML012530361)

3.

ANO Calculation 95-E-0066-01, Revision 2, "ANOe2 IPEEE P2 Values"

4.

ANO Calculation 95-E-0066-02, Revision 2, ANO-1 IPEEE P2 Valuese

5.

ANO Unit 1 and Unit 2 IPEEE 6

6.

ANO FIRE Hazards Analysis

7.

ANO White Paper regarding Ignition Source Frequencies

8.

ANO Calculation 02-E-0004-01, "Zone 99-M PSA Analysis for Operator Action SDP"

9.

ANO Calculation 02-E-0004-02, Zone 98-J PSA Analysis for Operator Action SDP"

10.

NRC Memorandum from E. W. Weiss to M. Reinhart, "Fire Hazard Analysis for Fire Zone 98-J, Emergency Diesel Generator Corridor and Fire Zone 99-M, North Electrical Switchgear Room, Arkansas Nuclear One,-Unit 1 (TAC No. MB272),`.r dted May 28,2002 (ML012330501)

11.

NRC Memorandum from E. W. Weiss to M. Reinhart, "Supplemental Fire Modeling for Fire Zone 98-J, Emergency Diesel Generator Corridor and Fire Zone 99-M, North Electrical Switchgear Room, Arkansas Nuclear One, Unit 1 (TAC No. MB2872),/ dated July 18, 2002 (ML021990405)

12.

ANO Unit I and Unit 2 Updated Safety Analysis Reports

13.

NRC analyst human

?4eninAnalysiRIV q,\\DRS\\PRA\\ANO\\99M FIRE ANALYSIS\\FIRE HRL3 l

n RA FIR

14.

NRC analyst qualitative assessment of-remaining fire zones.in Unit 1 and Unit 2 (RIV S:\\DRS\\PRA\\_ANO\\99M FIRE ANALYSIS\\ANO MATRIX.WPD)

15.

NRC analyst sensitivity analysis for Fire Zone 99-M (RIV S:\\DRS\\PRA\\_ANO\\99M FIRE ANALYSIS\\SENSITIVITY ANALYSIS.WPD and RIV S:\\DRS\\PRA\\_ANO\\99M FIRE ANALYSIS\\ANO SDP CALC DATA.XLS) 7

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 611 RYAN PLAZA DRIVE, SUITE 400

'1' ARLINGTON, TEXAS 76011-4005 EA 03-016

-Jeffrey.S.Forbes,.Site'Vic President Arkansas Nuclear One Entergy Operations, Inc.

1448 S.R. 333 Russellville, AR 72801-0967

SUBJECT:

ARKANSAS NUCLEAR ONE, UNIT 1 - FINAL SIGNIFICANCE DETERMINATION FOR A WHITE FINDING AND NOTICE OF VIOLATION (NRC INSPECTION REPORT NO. 50-313/01 -06;368/01-06)

Dear Mr. Forbes:

The purpose of this'letter is to provide you with the final results of our significance deterrnination for an inspection finding involving your stdff's failure to provide adequate protectior of safe shUtdown capability. This preliminary greater than green finding was identified in the subject inspection report as unresolved item 50-313;368/0106-02. In a letter dated April 15, 2002, we provided Arkansas Nuclear One management with the results of our backfit panel which determined that for Fire Zones 98J (Unit 1 diesel generator corridor) and 99M (Unit 1 north electrical switchgear room), Arkansas Nuclear One staff had implemented a fire protection strategy that did not meet 10 CFR Part 50, Appendix R, Section III.G.2.

Specifically, in lieu of ensuring that redundant trains of equipment and cables necessary for achieving hot shutdown were free of fire damage (as required by Section Il.G.2), Arkansas Nuclear One staff credited local remote operator actions for mitigating the effects of fire damage. For these fire zones, the NRC had not approved the use of manual actions for complying with 10 CFR Part 50, Appendix R, Section IllI.G.2. 'Furthermore, your staff's strategy and procedures for using manual actions was not adequate to ensure the plant could be safely shutdown in the event of a fire in either of these fire zones. In the April 15, 2002 letter we re-characterized the finding as an apparent violation pending determination of its significance.

The finding was subsequently assessed using a Phase IlIl significance determination process, and was preliminarily determined to have a significance of greater than very low (greater than green). The bases for and the process used in reaching this preliminary significance determination was described in our letter to Mr. Craig G. Anderson, Vice President, Operations, Arkansas Nuclear One, dated March 25, 2003. At Arkansas Nuclear One management's request, we conducted a regulatory conference on July 10, 2003. During this conference, Arkansas Nuclear One management and staff provided the results of a fire model analysis which indicated the extent of fire damage that could occur in the event of a fire in the fire zones affected by the finding. In addition, Arkansas Nuclear One management and staff presented their assessment of the significance of the finding. Subsequent to the regulatory conference,

Entergy Operations, Inc. we requested additional information from Arkansas Nuclear One staff which was provided to us in letters dated August 11, 2003, and November 21, 2003. In our final assessment of the risk of this finding, we considered the additional information provided to us at the regulatory conference and in these letters.

The NRC has concluded that the finding has low to moderate increased importance to safety (white). A detailed discussion of the basis for this conclusion is presented in Enclosure 2. You have 30 calendar days from the date of this letter to appeal the NRC staff's determination of significance for the identified white finding. -Such appeals-will be considered to have-mer only.'-

-if they meet the-criteria given in NRC 'lnsp-etiff Manual Chapter 0609, Attachment 2.

In addition, the NRC has determined that this finding is also a violation of 10 CFR Part 50, Section III.G.2, and is cited in the enclosed Notice of Violation (Enclosure 1). The circumstances surrounding the Violation were described in detail in the subject inspection report and in our letter to Mr. Craig G. Anderson, Vice President, Operations, dated April 15, 2002. In accordance with the NRC Enforcement Policy, NUREG-1 600, the Notice of Violation is considered escalated enforcement action because it is associated with a white finding.

In the short term, we believe it is appropriate for you to continue compensatory measures for all fire zones affected by this finding. Your potential options for long term action for this matter may include: (1) Implementing plant modifications to restore compliance with 10 CFR Part 50, Appendix R, Section lll.G.2 or Section 'll.G.3; or(2)requesting an exemption to -

• 10 CFR Part 50, Appendix-R Sectiofi 1Il.G.-, which includes justification adequate for the NRC to reach a safety conclusion on the exemption request.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice of Violation when preparing your response. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements.

Because plant performance for this issue has been determined to be In the regulatory response band, we will use the NRC Action Matrix to determine the most appropriate NRC response for this finding. We will notify you, by separate correspondence, of that determination.

In accordance with 10 CFR 2.390 of the NRC's 'Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at hftt://www.nrc.aov/readina-rm/adams.html (the Public Electronic Reading Room).

Sincerely, Bruce S. Mallett Regional Administrator

Entergy Operations, Inc. Dockets: 50-313; 50-368 Licenses: DPR-51; NPF-6

Enclosures:

1. Notice of Violation

2. Evaluation of Safety Significance, Arkansas Nuclear One Fire Zone 99-M, Unit 1 4KV Switchgear Room 1A4 cc w/enclosures:

-Senior Vice President

& Chief Operating Officer Entergy Operations, Inc.

P.O. Box 31995 Jackson, MS 39286-1995 Vice President Operations Support Entergy Operations, Inc.

P.O. Box 31995 Jackson, MS 39286-1995 Manager Washington Nuclear Operations ABB Combustion Engineering Nuclear Power 12300 Twinbrook Parkway, Suite 330 Rockville, MD 20852 County Judge of Pope County Pope County Courthouse 100 West Main Street Russeliville, AR 72801 Winston & Strawn 1400 L Street, N.W.

Washington, DC 20005-3502 Bernard Bevill Radiation Control Team Leader Division of Radiation Control and Emergency Management Arkansas Department of Health 4815 West Markham Street, Mail Slot 30 Little Rock, AR 72205-3867

Entergy Operations, Inc. Mike Schoppman Framatome ANP, Inc.

Suite 705 1911 North Fort Myer Drive Rosslyn, VA 22209

Entergy Operations, Inc.

.5-Electronic distribution by RIV:

Regional Administrator (BSM1)

DRP Director (ATH)

DRS Director (DDC)

Senior Resident Inspector (RWD)

Branch Chief, DRP/D (JAC)

Senior Project Engineer, DRP/D (NLS)

Staff Chief, DRPITSS (PHH)

RITS Coordinator (KEG)

-Rebecca-Tadesse,- OEDO RIV Coordinator (RXT)

ANO Site Secretary (VLH)

OEMAIL Jennifer Dixon-Herrity, OE Rani Franovich, NRR Victor Dricks Bill Maier ADAMS: C Yes 0 No Initials:

0 PubliclyAvailable 0 Non-PubliclyAvailable 0

Sensitive 0 Non-Sensitive R:Vano\\2004\\an2001-06 final Itr.wpd RNeaseilh LSmith JClark TPruett ATHowell IRA]

03/09/2004 03/ /2004 03/ /2004 03/

/2004 l 03/

/2004 D;-ERS9N

. ^1-. 19.MGES51jt.-!:,=ri~ flC XZ~

E RD R>

J 6!!8 >

ll DDChamberlain GSanborn KSmith JDixon-Herrity DCoe I

1 /2004 I /

/2004 1/

/2004

/2004

/2004

]

lITSchiltz JHannon DDChamberlaln TPGwynn BSMallett

/ /2004 1 /2004 J /2004 1 /2004

/

/2004 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

ENCLOSURE 1 NOTICE OF VIOLATION Entergy Operations, Inc.

Docket No. 50-313 Arkansas Nuclear One License No. DPR-51 EA-03-01 6 During an NRC inspection conducted June 11 - 22, 2001, and July 2 - 13, 2001, a violation of NRC requirements was identified. In accordance with the 'General Statement of Policy and Procedure for NRC -Enforcement Actions,' NUREG-1 600, the violation is listed below: a 10 CFR 50.48, 'Fire protection,' Section (b) states, "Appendix R to this part establishes fire protection features required to satisfy Criterion 3 of Appendix A to this part with respect to certain generic issues for nuclear power plants licensed to operate before January 1, 1979.... With respect to all other fire protection features covered by Appendix R, all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III.G, III.J, and IlI.O."

10 CFR Part 50, Appendix R, Paragraph III.G.2 states, 'Except as provided for in paragraph G.3 of this section, where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts,

-open circuits, or shorts to ground, of redundant trains of systemsnecessaryto achieve and maintain hot shutdown conditions are located within th-esame fire zone outside of primary containment, one of the foll6wing means of ensuring that one of the redundant trains is free of fire damage shall be provided:

a.

Separation of cables and equipment and associated non-safety circuits of redundant trains by a fire barrier having a 3-hour rating. Structural steel forming a part of or supporting such fire barriers shall be protected to provide fire resistance equivalent to that required of the barrier;

b.

Separation of cables and equipment and associated non-safety circuits of redundant trains by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards. In addition, fire detectors and an automatic fire suppression system shall be installed in the fire area; or

c.

Enclosure of cable and equipment and associated non-safety circuits of one redundant train in a fire barrier having a 1-hour rating. In addition, fire detectors and an automatic fire suppression system shall be installed in the fire area....

10 CFR Part 50, Appendix R, Paragraph III.G.3 states, "Alternative or dedicated shutdown capability and its associated circuits, independent of cables, systems or components in the area, room or zone under consideration, shall be provided:

a.

Where the protection of systems whose function is required for hot shutdown does not satisfy the requirement. of paragraph G.2 of this section; or...

Enclosure Contrary to this requirement, in Fire Areas 98J and 99M in Arkansas Nuclear One, Unit 1, the licensee failed to ensure that cables and equipment of redundant trains of systems necessary to achieve and maintain hot shutdown conditions were free of fire damage by one of the means specified in 10 CFR Part 50, Appendix R, Paragraph II.G.2, or by alternative means specified in 10 CFR Part 50, Appendix R, Paragraph Il.G.3.

This violation is associated with a white significance determination process finding

-(50-313;368/0106-02).-

Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Incorporated is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555 with a copy to the Regional Administrator, Region IV, and a copy to the NRC Resident Inspector at the facility that Is the subject of this Notice of Violation (Notice), within 30 days of the date of the letter transmitting this Notice. This reply should be clearly marked as a 'Reply to a Notice of Violation" and should include: (1) the reason for the violation, or, if contested, the basis for disputing the violation or severity level, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken to avoid further violations, and (4) the'date when full compliance will be achieved. Your response may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time-specified in this Notice, an order---

ora Demand-forlnforfnation may le issued as to why the license should not be modified, suspended, or revoked,:or why such other action as may be proper should not be taken.

Where good cause is shown, consideration will be given to extending the response time.

If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001.

Because your response will be made available electronically for public inspection In the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the public without redaction. ADAMS is accessible from the NRC Web site at httQ://www.nrc.qov/readinp-rm/Vadams.html (the Public Electronic Reading Room). If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Enclosure Dated this _th day of March 2004 Enclosure

ENCLOSURE 2 Evaluation of Safety Significance Arkansas Nuclear One Fire Zone 99-M Unit 1 4KV Switchgear Room 1A4 Summary of Conclusions On August 20, 2001, the NRC issued Inspection Report 50-313/01-06; 50-368/01 -06, which discussed a finding concerning the acceptability of the licensee's use of operator actions to remotely operate equipment necessary for achieving and maintaining hot shutdown, in lieu of

- providing protection to cables.associated with that-equipment,-asa metho-d-of-omplying-wil-th_._ __

10 CFR Part 50, Appendix R, Section III.G.2.

In a letter dated March 25, 2003, (ML0308500610) the NRC informed the licensee that the increase in core damage frequency was preliminarily determined to be in the range of 7E-6/year to 2E-5/year. During the regulatory conference conducted on July 10, 2003, the licensee provided the results of their safety significance determination. The licensee concluded that the increase in core damage frequency was approximately 4.9E-7/year.

The Senior Reactor Analysts (SRAs) and fire protection engineers in Region IV and the Office of Nuclear Reactor Regulation reviewed the following documents and evaluations provided by the ANO staff:

1. -

uPost-Fire Manual Action Feasibility Assessment: A.Phase 3 Significance Determination Process (SDP) Evaluation at Arkansas Nuclear One Unit 1," dated July 3, 2003 (ML0318909200);

2.

Information provided to the NRC during the July 10, 2003, Regulatory Conference (ML031990085);

3.

Information provided by letter dated August 11, 2003, "Request for Additional Information Regarding the July 10, 2003, Fire Protection Regulatory Conference," (ML0323104630); and

4.

Information provided by letter dated November 21, 2003, "Request for Additional Information Regarding the July 10, 2003, Fire Protection Regulatory Conference," (ML0334906860).

Based on this review, the SRAs and fire protection engineers determined that the licensee (1) inappropriately used the CFAST model in their assessment of the extent of fire damage; (2) did not properly evaluate execution errors in the human reliability estimation model; (3) used questionable assumptions In the human reliability analysis; and (4) made several questionable assumptions in calculating the core damage frequency. These factors resulted in the licensee developing a lower estimate of the increase in core damage frequency than Is realistic. A more realistic reconsideration of these factors would result in a finding of low to moderate increased importance to safety (white).

Enclosure

.1 s Determination of Safety Sianificance The SRAs and fire protection engineers identified areas of uncertainty and questionable assumptions during the review of the licensee's significance evaluation. These areas are:

(1) the fire growth behavior model; (2) the core damage frequency calculational methodology; (3) the human reliability estimation model, and (4) human reliability analysis assumptions. The SRAs determined that these areas, each of which is discussed below, would increase the safety significance of the finding over the estimate provided by the licensee.

Fire Growth Behavior Model The licensee's CFAST (Consolidated Fire and Smoke Transport) modeling of fire growth behavior for fire scenarios affecting cable trays located in Fire Zone 99-M was based on a fire source ignition at a height of 8 feet above the floor, which Is representative of a fire on top of the switchgear cabinets. The SRAs and fire protection engineers found that several of the licensee's fire modeling assumptions were incorrect.

The licensee did not include air entrainment into the compartment for the fire scenarios with fire doors fully open, resulting in a more limited combustion process. For each open door fire scenario, the buoyancy of the fire plume would draw air from below the burning tray and would not result in a sharp fire decay as predicted by the licensee's fire modeling. The licensee's fire modeling analysis showed the peak heat release rates and hot gas layer temperatures to be.-

decreasing rapidly in-alllire scenarios. Since air entrainment in all directions would be expected for a worst case fire scenario Involving an elevated cable tray fire in Fire Zone 99-M, the non-consideration of this assumption in the licensee's CFAST model would lead to an under-prediction of fire growth behavior. Using the licensee's CFAST model, the NRC's fire protection engineers adjusted only the air entrainment parameter and concluded in the case of an elevated cable tray fire in Fire Zone 99-M case, an increased hot gas layer temperature which would cause damage to redundant safe shutdown cables would be expected within approximately one hour.

The SRAs and fire protection engineers found additional examples of incorrect assumptions in the licensee's fire model which also resulted in the licensee under-predicting fire damage end states. For example, in their CFAST model, the licensee used lower heat release rates for modeling an energetic fire resulting from electrical faults in a switchgear cabinet (500 kW versus 1,000 kW); and assumed a higher threshold cable damage temperature (700 OF versus 625 'F) for thermoset cables. Extensive cable fire test data have shown that there are several different types of thermoset cables which have different failure cable thresholds. A review of this fire test data shows that cable damage at 625 'F within 30 minutes is a reasonable bounding estimate of the failure threshold of cross-linked polyethylene (XLPE) insulated thermoset cables. (

Reference:

Appendix F-Fire Protection Significance Determination Process, Draft Revision 2.3a, October 14, 2003).

In addition, the licensee incorrectly used the CFAST code to model an explosive or energetic fire resulting from electrical faults in a switchgear cabinet. The CFAST code is a two zone model, capable of predicting the environment in a multi-compartment structure subject to a Enclosure steady and non-steady state fire growth. Using the CFAST code to model explosive fires for an immediate heat release is beyond it's capabilities and limitations, and results in an under-prediction of fire growth behavior.

Recent data collected from actual fire events have shown that fires caused by energetic electric faults in switchgear cabinets have led to extensive damage to cable trays, melting and vaporizing of equipment, and destruction of surrounding metal cabinets as a result of explosion, arcing, smoke, and ionized gases. The damage to electrical equipment and subsequent component maloperation occurred rapidly. See NRC report, "Operating Experience A-s-s.sment En eticFaultsin 4.16k\\toi3 Si tdgeararOLusjuctsTiatiCaused Fires in Nuclear Power Plants 1986-2001," (ML021290358). This operating experience assessment provides additional evidence for the findings in NUREG/CR-6738, "Risk Methods Insights Gained From Fire Incidents," (ML012600378). See the following quote from the operating experience assessment:

".. current fire risk modeling of energetic electrical faults in 4.16 kV to 13.8 kV switchgear does not address the following characteristics of energetic fires: (1) the fire bypasses the typical fire initiation and growth stages; (2) a fire inside an electrical panel can propagate outside the panel; (3) the fire may result in failed initial fire suppression attempts; (4) smoke propagation outside the fire area affects operator response; (5) the fire may be longer than the 10 to 30 minutes typically analyzed; and (6) the plant material condition and independent failures may influence the chain of events.

"These events demonstrate that fires fromenergetic electrical faults contain more energy than assumed in fire risk models as evidenced by explosions, arcing, smoke, ionized gases, and melting and vaporizing of equipment. The energy release exceeds heat release rates (HRRs) assumed in fire risk models, possibly by a factor of 1000.

Lower HRR values currently used may explain why current fire risk models have not identified the potential larger effects of fires from energetic electrical faults which may include the following: (1) bypass of the fire initiation and growth stages, (2) propagation of the fire to other equipment and across vertical fire barrers, (3) ac power system designs that may be vulnerable to an station black out, (4) failed fire suppression attempts with dry chemicals and the need to use water, (5) longer restoration time to recover, and (6) unexpected challenges and distractions to the operator from fire-induced failures."

Based on the above discussion, the SRAs and fire protection engineers concluded that using correct modeling inputs and using an appropriate fire model for fires from energetic electric faults in switchgear cabinets would result in an increase in the core damage frequency estimates for each evaluated scenario. The licensee's under-prediction of fire damage contributes to the uncertainty associated with estimating the time to fire damage states.

Furthermore, precise modeling of this issue would likely result in less optimistic times for executing feasible manual actions required for achieving safe shutdown of the plant in the postulated scenarios.

Enclosure Core Damage Frequency Calculational Methodology The licensee's calculational methodology for estimating the core damage frequency value included an additional term to credit the explosion factor for the energetic fire scenarios.

However, this term was applied independently of the fire severity factor that was already included in the fire risk equation used in determining the core damage frequency estimate. The use of the explosion factor term resulted in "double counting" the credit for the fire severity effects of the fire scenario and lowered the core damage frequency estimatesfor-the overall

-significance analysis.--The-removalof-the explosive-fact6oteirm from the calcuilatioi-aI

-methodology Wulid ieilit in an increase in the core damage frequency estimates for each evaluated scenario.

The SRAs and fire protection engineers noted that the licensee credited manual suppression probability in one of the fire scenarios where the estimated time to fire damage to primary equipment targets was significantly shorter than the expected time for fire brigade arrival and response. This resulted in a lower failure probability estimate for manual suppression being used in the licensee's calculational methodology. In addition, the SRAs and fire protection engineers also noted that there were uncertainties in the actual number of electrical cabinets and switchgear rooms used in the derivation of weighting factors for the fire ignition source frequency estimates. The resolution of these uncertainties would result in an increase in the core damage frequency estimates for each evaluated scenario.

The licefsee's SDP analysis estimated the total increase In the Unit 1 core damage frequency was approximately 4.9E-7lyear. The estimate was derived from a calculation of the increase in core damage frequency for fire scenarios in Fire Zone 99-M (2.2E-7/year) and a qualitative assessment of core damage frequency increases due to fires in Fire Zone lOON (2.2E-7/year) and Fire Zone 104S (4.4E-8/year). Although not mentioned in the licensee's SDP analysis, there were 7 other fire zones In Unit 1 for which the licensee credits the use of manual operator actions in lieu of meeting the physical protection requirements of 10 CFR Part 50, Appendix R, Section III.G.2. If quantified, each of the fire zones would result in an increase in the core damage frequency.

Human Reliability Estimation Model The licensee utilized EPRI TR-000259, "An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment," to determine the human reliability estimates of operator actions in the postulated fire scenarios. The SRAs noted that the principal use of the EPRI TR-000259 methodology was for developing human error probability estimates for human actions in "internal event" sequences which required recovery actions to be completed in the main control room. The application of the methodology to assess cognitive and execution errors for fire events which required operator actions outside the control room is not consistent with the intended purpose of the document.

The SRAs acknowledged that the EPRI TR-000259 methodology may be adapted to evaluate error probability estimates for human actions in ex-control room activities. Notwithstanding the Enclosure possibility to modify the methodology, the SRAs and fire protection engineers determined that the licensee's SDP analysis derived optimistic human error probabilities for scenarios that relied on operations personnel to implement the provisions of their previous fire procedures. The analysis did not fully consider the negative effects of inadequate procedures, spurious actuations, unreliable instrumentation, and an unpredictable scenario affecting the ability of operations personnel to respond to a fire in Fire Zone 99-M. The resolution of the modeling concerns would result in less optimistic human error probabilities and an increase in the core damage frequencies for each evaluated scenario.

Human Reliability Analysis Assumptions The licensee's human reliability analysis did not fully integrate several key assumptions, such as, operator responses, the timing of required actions, shift staffing, and the accessibility of plant equipment. These conditions apply to both the as-found procedures (symptomatic operator response) and the new procedures (tactical operator response). However, the SRAs determined that the affect on the as-found procedures was more significant.

The licensee's simulator was used to evaluate the ability of operations personnel to respond to a fire in Fire Zone 99-M. The use of the simulator Implies that a degree of fidelity and predictability exists in evaluating the response of plant systems to a fire. Because fire scenarios are unpredictable, the SRAs and fire protection engineers determined that it would be difficult to specify when plant components, indications,-and controls would be rendered inoperable, actuate to a non'-conservative position, or provide ani erroneous Indication.

Consequently, the use of data from simulator exercises to reflect a reduced likelihood that operations personnel will fail to Implement critical tasks resulted in lower human error probabilities. The resolution of this issue would likely result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario.

The SRAs and fire protection engineers noted that the time available to execute successful actions was dependent on the plant response to a fire In Fire Zone 99-M. More time would be available if automatic actuations occurred at the onset of the event. If automatic actuations were successful then a longer duration for completing recovery actions for subsequent failures would be reasonable. However, some fire scenarios would involve conditions where automatic actuations of equipment have failed, and operations personnel would be required to perform manual actions outside of the main control room. The time durations available for successful recovery actions in these scenarios would be short, and these short time windows may challenge the time frames assumed in the licensee's thermal hydraulic analyses. By not evaluating scenarios where automatic actuations failed at the onset of the event, the licensee derived lower human error probabilities. The resolution of this issue would likely result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario.

The licensee's SDP analysis specified that there were 4 licensed operators, 1 shift engineer, 2 auxiliary operators, and 1 waste control operator. The licensee's SDP analysis assumed that sufficient staffing was available to complete all of the required actions. The SRAs and Fire Protection Engineers noted that: (1) a fire in Fire Zone 99-M would require several ex-control Enclosure room equipment manipulations, (2) one licensed operator and the shift engineer would likely be involved in implementation of the emergency response organization procedures, and (3) one auxiliary operator and the waste control operator would be assigned to the fire brigade. The remaining personnel available to operate plant equipment would be 1 auxiliary operator and 2 licensed operators. The SRAs had previously compared the actions described in the licensee's alternate shutdown procedures to the actions required for a fire in Fire Zone 99-M and determined that most of the actions described in the alternate shutdown procedures would need to be completed. The SRAs noted that 4 operators were required to implement the alternate shutdown procedures; however, only 3 operators would be available for operating A

pant quipnt uring afen Fire-Zone 99-M.-The-resolution of the inconsistency in the --

staffing levels between the alternate shutdown procedures and the previous procedures for a.

fire in Fire Zone 99-M would result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario.

The licensee's SDP analysis specified that the accessibility for the steam admission valve from Steam Generator A to the 7A emergency feedwater turbine was difficult, in that an operator would need to climb over several pipes to reach the valve. Given the timing of events and the added stress from responding to a plant fire, access to this valve could be delayed or an operator could be injured attempting to gain access to the valve location. Additionally, the licensee's SDP analysis identified that breakers would need to be operated In areas adjacent to the affected Fire Zone 99-M. The SRAs noted that the fire brigade's path to the fire area was through the adjacent switchgear room or through the adjacent diesel generator corridor. In either case, the opening of one of both of the doors to Fire Zone 99-M would permit smoke to escape into the areas which would be-used by operations personnel for access to perform manual actions. Operations personnel dispatched to perform manual actions would not have donned breathing apparatus, and could have difficulty manipulating circuit breakers due to decreased visibility due to smoke from Fire Zone 99-M, and obstructed access from fire fighting equipment. Furthermore, additional decision-making by operations personnel would be required to choose access via an unaffected direction, delaying manual actions. The resolution of the accessibility to plant equipment would likely result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario.

Conclusions The licensee's risk analysis did not fully evaluate several areas of uncertainty and questionable assumptions involving: (1) the fire growth behavior model; (2) the core damage frequency calculational methodology; (3) the human reliability estimation model; and (4) human reliability analysis assumptions. A more detailed quantitative analysis addressing these uncertainties would result in an increase in the core damage frequency associated with the failure to provide protection to cables and equipment necessary to achieve and maintain hot shutdown.

__~

01A Enclosure The NRC's original Phase 3 SDP assessment determined that the range of estimated core damage frequencies was between 7E-6/year and 2E-5/year. The additional information provided in the licensee's SDP analysis was useful in determining that the finding should not be characterized as having greater than low to moderate safety significance (greater than white).

The SRAs determined that a more detailed quantification of the uncertainties identified in the licensee's SDP analysis, as discussed above, would provide results that are consistent with the original NRC Phase 3 SDP analysis. The licensee's input data used in the derivation of human error probabilities, the identification of affected plant equipment, and fire modeling assumptions; combined with the reviews completed by NRC analysts, provided sufficient information to conclude that the finding should be characterized as having low to moderate safety significance

..~~~~~~~

Enclosure