IR 05000498/2008008
| ML082520793 | |
| Person / Time | |
|---|---|
| Site: | South Texas  |
| Issue date: | 09/05/2008 |
| From: | O'Keefe N NRC/RGN-II/DRS/EB2 |
| To: | Halpin E South Texas |
| References | |
| EA-08-243 IR-08-008 | |
| Download: ML082520793 (30) | |
Text
September 5, 2008
SUBJECT:
SOUTH TEXAS PROJECT ELECTRIC GENERATING STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000498/2008008 AND 05000499/2008008 AND EXERCISE OF ENFORCEMENT DISCR,,,,,ETION
Dear Mr. Halpin:
On July 24, 2008, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your South Texas Project Electric Generating Station, Units 1 and 2. The enclosed report documents the inspection findings, which were discussed in a debrief meeting at the end of the onsite inspection on June 19, 2008, with Mr. J. Sheppard, President and CEO, and other members of your staff, and again in an exit meeting conducted on July 24, 2008, with Mr. T.
Powell, Vice President of Engineering, and other members of your staff.
During this triennial fire protection inspection, the inspection team examined activities conducted under your license related to safety and compliance with the Commissions rules and regulations and the conditions of your license. The inspection consisted of selected examination of procedures and records, observations of activities and installed plant systems, and interviews with personnel.
On the basis of the results of this inspection, no findings of significance were identified.
The licensee identified a violation of License Condition 2.E, "Fire Protection," for failure to ensure that redundant trains of safe shutdown systems in the same fire area were free of fire damage. Specifically, the licensee identified that the fire protection program relied upon local manual actions to mitigate the effects of potential fire damage to equipment required to achieve and maintain safe hot shutdown conditions, rather than ensuring one train of the required equipment was free from fire damage as specified in the approved fire protection program. The team determined that the manual actions were reasonable and feasible using the guidance in Inspection Procedure 71111.05T, so these manual actions are considered an acceptable compensatory measure until final resolution of this issue. Based on the review of procedures and plant walkdowns, the team concluded that this finding has very low safety significance. The licensees current activities addressing non-compliances involving operator manual actions meet all the criteria contained in Enforcement Guidance Memorandum (EGM) 07-004, Enforcement Discretion For Post-Fire Manual Actions Used As Compensatory Measures For Fire Induced Circuit Failures, dated June 30, 2007. Since all the criteria were met, the NRC is exercising UNITED STATES NUCLEAR REGULATORY COMMISSION R E GI ON I V 612 EAST LAMAR BLVD, SUITE 400 ARLINGTON, TEXAS 76011-4125
STP Nuclear Operating Company-2-
enforcement discretion under Section VII.B.6 of the NRC Enforcement Policy for this issue (EA-08-243).
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Neil OKeefe, Chief
Engineering Branch 2
Division of Reactor Safety
Dockets: 50-498; 50-499 Licenses: NPF-76; NPF-80
Enclosure:
NRC Inspection Report 05000498/2008008 and 05000499/2008008 w/Attachment: Supplemental Information
REGION IV==
Dockets:
05000498, 05000499
License:
Report:
05000498/2008008 and 05000499/2008008
Licensee:
South Texas Project Nuclear Operating Company
Facility:
South Texas Project Electric Generating Station, Units 1 and 2
Location:
FM 521 - 8 miles west of Wadsworth
Wadsworth, Texas 77483
Dates:
June 2 through July 24, 2008
Team Leader:
J. Mateychick, Senior Reactor Inspector, Engineering Branch 2
Inspectors:
P. Qualls, Reactor Inspector, Engineering Branch 2
B. Correll, Reactor Inspector, Engineering Branch 2
R. Mullikin, Reactor Inspector, Engineering Branch 2
Accompanying Personnel:
K. Sullivan, Consultant (Brookhaven National Laboratory)
Approved By:
Neil OKeefe, Chief Engineering Branch 2 Division of Reactor Safety
-- 2 --
Enclosure
SUMMARY OF FINDINGS
IR 05000498/2008008, 05000499/2008008; 06/02/08 - 07/24/08; South Texas Project Electric
Generating Station, Units 1 and 2; Triennial Fire Protection Inspection
The report covered a two week period of inspection by region-based inspectors and a contractor.
The inspection identified no findings of significance. The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609,
"Significance Determination Process." Findings for which the significance determination process does not apply may be green or be assigned a severity level after NRC management review.
The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.
NRC-Identified and Self-Revealing Findings
No findings of significance were identified.
Licensee-Identified Violations
None.
REPORT DETAILS
REACTOR SAFETY
1R05 Fire Protection The inspection team evaluated the implementation of the approved fire protection
program for the South Texas Project Electric Generating Station, Units 1 and 2, in selected risk-significant areas. The team emphasized verifying the ability of the licensee to maintain post-fire safe shutdown capability. The team used the fire analysis section of the Probabilistic Risk Analysis for the South Texas Project Electric Generating Station to choose risk-significant areas for detailed inspection and review. Inspection Procedure 71111.05T, "Fire Protection (Triennial)," requires selecting three to five fire areas for review. The risk-significant areas selected for detailed inspection and review included:
Fire Area 1:
Relay Cabinet Area of Control Room (Z032), Control Room (Z034), and Watch Supervisors Office (Z083)
Fire Area 2:
Mechanical & Electrical Auxiliary Building Elevations 10' & 21'; Channel II Distribution Room (Z001), Channel II Battery Room (Z002), Channel I Distribution Room (Z003), Train A Engineered Safety Features (ESF)
Switchgear Room (Z004), Train A Heating, Ventilating and Air Conditioning (HVAC) Equipment Room & Cleanup Unit (Z005), Train A Electrical Penetration Area (Z006), Train A Power Cable Vault (Z010),
Train A Equipment Room (Z013), Corridor at Elevation 10' (Z016), Train A Electrical Chase (Z027), Corridor at Elevation 21' (Z028), Emergency Switchgear Room (Z029), Non-radioactive Pipe Chase (Z030), Halon Storage Room (Z037), Channel I Battery Room (Z084), Train A Electrical Chase (Z111), Train A Component Cooling Water (CCW) Pump & Chiller Room (Z128) and Tendon Gallery (Z200)
Fire Area 31: Train B Cable Spreading/Power Cable Room and the Cable Room on Elevation 60' (Z047)
For each of these fire areas (samples), the team focused on fire protection features, systems and equipment necessary to achieve and maintain safe shutdown conditions, and licensing basis commitments. Since Units 1 and 2 are essentially identical, the teams review focused on Unit 1. The team completed three inspection samples.
Documents reviewed by the team are listed in the attachment.
.1 Shutdown From Outside Main Control Room
a. Inspection Scope
In the event of a fire in Fire Area 1, which consists of the main control room (Fire Zone Z034), the relay cabinet area (Fire Zone Z032), and the watch supervisors office (Fire Zone Z083), operators may be forced to abandon the main control room and implement an alterative shutdown capability. Therefore, the team reviewed licensee documentation describing the methodology for achieving and maintaining post-fire safe shutdown
conditions from outside the main control room. The teams review focused on verification that the licensees credited method of accomplishing required shutdown functions would remain available in the event of a fire.
The objectives of this evaluation were to:
- Verify that the licensee's shutdown methodology correctly identified the components and systems necessary to achieve and maintain a safe shutdown condition.
- Verify that safe shutdown can be achieved and maintained with or without the availability of off-site power.
To assure the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions, piping and instrumentation diagrams were reviewed and compared to the list of safe shutdown equipment documented in the licensee's fire safe shutdown analysis and the referenced supporting calculations. In addition, plant drawings, operating procedures, operator lesson plans, and other relevant documents were reviewed to verify the flow paths and operational characteristics of systems relied on to accomplish required safe shutdown functions. The team focused on the following functions that must be available to achieve and maintain safe shutdown conditions:
- Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,
- Reactor coolant makeup capable of maintaining the reactor coolant inventory,
- Reactor heat removal capable of achieving and maintaining decay heat removal, and
- Supporting systems capable of providing other services necessary to permit extended operation of equipment necessary to achieve and maintain hot shutdown conditions.
The team verified that required shutdown functions were adequately isolated from the main control room and were capable of being controlled from the remote shutdown panel. As part of this review, the capability to transfer control from the main control room to the remote shutdown panel was reviewed to ensure that, once actuated, the isolation transfer scheme provided an adequate level of electrical isolation so that required shutdown functions would not be adversely affected as a result of fire damage in the main control room.
b. Findings
No findings of significance were identified.
.2 Protection of Safe Shutdown Capabilities
a. Inspection Scope
The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the fire safe shutdown analysis to verify
that the shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the fire areas selected for review. The team also reviewed and observed walkdowns of the procedures for achieving and maintaining safe shutdown in the event of a fire to verify that the fire safe shutdown analysis provisions were properly implemented. The team focused on the functions required to achieve and maintain post-fire safe shutdown conditions.
For each of the selected fire areas, the team reviewed the adequacy of separation and protection provided for redundant trains of cables and equipment required to achieve and maintain hot shutdown conditions. The results of this evaluation were then compared to the licensees methodology for meeting the requirements of 10 CFR 50.48, as described in the approved fire protection program.
On a sample basis, the team verified that systems and equipment identified by the licensee as being required to achieve and maintain hot shutdown conditions would remain free of fire damage in the event of a fire in the selected fire areas. Specifically, the team examined the adequacy of electrical independence, physical separation, and fire protection features provided for cables and equipment needed to assure the operation of systems that are relied on to achieve and maintain hot shutdown conditions in the event of a fire. The evaluation included a review of cable routing data for a sample of components. The specific components selected for review are listed in the attachment.
b. Findings
Introduction.
The licensee identified a violation of License Condition 2.E, "Fire Protection," for failure to ensure that redundant trains of safe shutdown systems in the same fire area were free of fire damage. Specifically, the licensee identified that, in some cases, the fire protection program relied upon local manual actions to mitigate the effects of potential fire damage to equipment required to achieve and maintain safe hot shutdown conditions, rather than ensuring one train of required equipment was free from fire damage as specified in the approved fire protection program.
Description.
For fire areas which do not require evacuation of the main control room, the approved fire protection program requires that one train of equipment needed to achieve and maintain hot shutdown must be free from fire damage. The team noted that the approved fire protection program allows local manual actions to respond to spurious operations of other equipment (i.e., not required equipment) that could impact safe shutdown.
The team conducted walkdowns with licensee operations personnel of Procedure 0POP04-ZO-0009, Safe Shutdown Fire Response, Revision 6. The team found that, in some cases, the fire protection program, as implemented, relied on the use of local manual actions to align and control equipment required to achieve and maintain hot shutdown instead of assuring that one train was free from fire damage. This issue had been previously identified by the licensee and entered into the corrective action program as Condition Report 06-11246.
For fires in Fire Areas 03, 31, 32 and 65, the licensee manually positions motor operated valves MOV-112B (Volume Control Tank Isolation) and MOV-112C (Refueling Water Storage Tank Suction). For a fire in Fire Area 32, the licensee also manually positions
valve MOV-0025 (Loop Charging Isolation). For fires in Fire Areas 03 and 27, the licensee de-energizes air operated valve HCV-0218 (Seal Water to Reactor Coolant Pumps) to fail it in the desired position. The team reviewed the status of the licensees efforts to resolve this issue. The licensee was addressing these cases through a combination of reanalysis, plant modifications, and planned deviation requests.
Analysis.
Failure to ensure that one train of the systems required for hot shutdown would remain free from fire damage was a performance deficiency. The team determined that this finding was more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.
The team used the guidance in Inspection Procedure 71111.05T to assess whether the manual actions could be reliably completed. Walkthroughs of the manual actions specified for the fire areas selected as samples for the inspection were conducted with qualified plant operators. The operators were able to perform all actions using the current plant procedures. The team determined that the sample of manual actions were reasonable and feasible in accordance with the guidance in Inspection Procedure 71111.05T, and are therefore an acceptable compensatory measure until final resolution of this issue. Therefore, this finding does not present an immediate safety concern.
The team initiated an evaluation of this finding using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. However, Appendix F is intended to support the assessment of known issues only in the context of an individual fire area and is not appropriate for this finding due to the multiple components and fire areas involved. The team evaluated this finding using Manual Chapter 0609, Appendix M, Significance Determination Process Using Qualitative Criteria. One attribute considered in Appendix M is The likelihood that the licensees recovery actions would successfully mitigate the performance deficiency. The teams evaluation of the manual actions determined they could be successfully performed using the current plant procedures and post-fire safe shutdown could be achieved. Therefore, based on the review of procedures and plant walkdowns, the team concluded that this finding has very low safety significance.
Enforcement:
License Condition 2.E for Unit 1 requires that the licensee must implement and maintain in effect the approved fire protection program. The approved fire protection program requires that one train of equipment needed for establishing and maintaining hot shutdown must be free from fire damage. NRC Safety Evaluation Report (NUREG-0871)
Supplement 2 concluded: The applicants safe shutdown and fire hazards analysis demonstrates that systems needed for hot and cold shutdown are redundant and that at least one of the redundant systems needed for safe hot and cold shutdown would be free of fire damage (except for the control room area) because of separation, fire barriers, and fire detection and suppression, or a combination of these. It also states: The safe shutdown analysis also included the component cabling and support equipment needed to achieve and maintain hot and cold conditions.
Contrary to the above, the licensee failed to properly implement and maintain in effect the approved fire protection program. Specifically, cables required for operation of some
components in the credited safe shutdown train were not protected from fire damage.
The licensee relied on the use of local operator manual actions to operate some components required to achieve and maintain safe hot shutdown conditions in lieu of protecting the train of equipment from fire damage in Fire Areas 03, 27, 31, 32 and 65.
The use of local operator manual actions in lieu of protecting one train of equipment required for safe shutdown is being addressed as an industry-wide issue by the NRC.
This violation is being addressed in accordance with Enforcement Guidance Memorandum (EGM) 07-004, Enforcement Discretion For Post-Fire Manual Actions Used As Compensatory Measures For Fire Induced Circuit Failures, dated June 30, 2007. The team determined that the licensees corrective actions addressing non-compliances involving operator manual actions satisfied the criteria contained in EGM-07-004. Therefore, the NRC is exercising enforcement discretion under Section VII.B.6 of the NRC Enforcement Policy for this issue (EA-08-243),in accordance with EGM 07-004.
.3 Passive Fire Protection
a. Inspection Scope
.
For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, fire doors, electrical raceway fire barriers and fire rated electrical cables. The team observed the material condition and configuration of the installed barriers, seals, doors, and cables. The team compared the installed configurations to the approved construction details and supporting fire tests. In addition, the team reviewed license documentation such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association (NFPA) codes to verify that fire protection features met license commitments.
b. Findings
No findings of significance were identified.
.4 Active Fire Protection
a. Inspection Scope
For the selected fire areas, the team evaluated the adequacy of fire suppression and detection systems. The team observed the material condition and configuration of the installed fire detection and suppression systems. The team reviewed design documents and supporting calculations. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association codes to verify that fire suppression and detection systems met license commitments.
The team also observed an announced site fire brigade drill and the subsequent drill critique using the guidance in Inspection Procedure 71111.05AQ. The fire brigade simulated fighting an electrical cable fire in Room 301B, in the Train B Electrical Auxiliary Building Cable Spreading Room/Power Cable Area. Team members observed the fire brigade simulate fire-fighting activities in the plant. The inspectors verified that the licensee staff identified problems, openly discussed them in a self-critical manner at the
drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:
- (1) proper wearing of turnout gear and self-contained breathing apparatus; (2)proper use and layout of fire hoses;
- (3) employment of appropriate fire fighting techniques;
- (4) sufficient fire fighting equipment was brought to the scene; (5)effectiveness of fire brigade leader communications, command, and control;
- (6) search for victims and propagation of the fire into other plant areas;
- (7) smoke removal operations;
- (8) utilization of pre-planned strategies;
- (9) adherence to the pre-planned drill scenario; and
- (10) drill objectives.
b. Findings
Introduction:
The team identified an unresolved item associated with License Condition 2.E for Unit 1 concerning failure to adequately implement the approved fire protection program. Specifically, the team noted the possibility that the licensees fire protection program may not have ensured a reliable fire protection water supply for the fixed and manual fire suppression systems credited as part of the fire protection program defense-in-depth approach.
Description:
The fire suppression water supply system has three, 100 percent capacity, diesel-engine driven fire water pumps (PA0121, 0221, 0421) located in the fire pump house. One fire pump is required to supply water for fixed water suppression systems and fire hoses. Each pump will start automatically when low pressure is sensed in the pump discharge header. Each pump can also be started manually via control switches located in the Unit 1 main control room and the fire pump house. All three pumps discharge into a common header that supplies an underground piping ring main system.
The team determined that the cables for control room manual pump starting could be damaged by a fire between the control room and the fire pump house. Such damage could result in loss of both automatic pump starting and manual start from the control room. A short to ground on a single cable would prevent the automatic starting of its respective pump. The team also determined that the cables for all three fire pumps are routed in the same cable trays. Therefore, all three cables might be exposed to potential damage by a single fire. Cables N0FP1C1SC, N0FP01C2SB and N0FP01C3SB, are routed together in the same cable trays through nine fire areas (Fire Areas 01, 03, 04, 31, 34, 61, 65, 67, and 70). No water would be available for fire suppression until at least one pump was manually started in the pump house if these cables were all damaged.
Analysis.
Failure to ensure a reliable fire protection water supply for the fixed and manual fire suppression systems credited as part of the fire protection program was potentially a performance deficiency. The team determined that this finding may be more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.
The team initiated an evaluation of this finding using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it has the potential to affect fire protection defense-in-depth strategies in the fire protection program. However, since the issue involved multiple fire areas, additional analysis to be performed by a senior reactor analyst is needed to determine the safety significance of this issue. The licensee has entered this issue into their corrective action program as Condition Report 08-9589.
Enforcement:
License Condition 2.E requires the licensee to implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and the Fire Hazards Analysis Report. The overall fire protection program provides a defense-in-depth approach to fire protection that considers prevention, detection, containment and suppression of fires along with maintaining the plant's ability to perform and maintain post-fire safe shutdown.
The team was concerned that a water supply for fire suppression may not have been assured for all fire areas. Most fire areas rely on water for fire suppression via automatic fixed suppression systems, manually actuated fixed suppression systems, or manual hose streams. Specifically, in multiple fire areas, a single fire could damage cables associated with all three fire pumps and prevent the automatic starting of the fire pumps.
This condition would impact the licensees ability to rapidly suppress fires in these safety related areas of the plant.
Pending completion of additional analyses to determine if a credible fire scenario exists for this concern and to determine the safety significance of this finding, this issue is being treated as an unresolved item: URI 05000498/2008008-01, Potential Fire Damage to the Fire Suppression Water Supply System.
.5 Protection From Damage From Fire Suppression Activities
a. Inspection Scope
For the sample areas, the team verified that the required trains of systems relied upon for hot shutdown would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems including the effects of flooding. The team verified the results of evaluations in the licensees Fire Hazards Analysis Report.
b. Findings
No findings of significance were identified.
.6 Alternative Shutdown Capability
a. Inspection Scope
The team reviewed the alternative shutdown methodology to determine if the licensee properly identified the components, systems, and instrumentation necessary to achieve and maintain safe shutdown conditions from the auxiliary shutdown panel and alternative shutdown locations. The team focused on the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and support system functions. The team verified that hot and cold shutdown from outside the control room could be achieved and maintained with offsite power available or not available. The team verified that the transfer of control from the control room to the alternative locations would not be affected by fire-induced circuit faults by reviewing the provision of separate fuses for alternative shutdown control circuits.
The team also reviewed the operational implementation of the licensee's alternative shutdown methodology. Team members observed walk-throughs of the control room evacuation procedures with both licensed and non-licensed operators. The team observed operators simulating performance of Procedure 0POP04-ZO-0001, Control Room Evacuation, which provided instructions for performing an alternative shutdown from the remote shutdown panel and for manipulating equipment in the plant. The team verified that the minimum number of available operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable plant shutdown time requirements and that equipment labeling was consistent with the procedure. Also, the team verified that procedures, tools, dosimetry, keys, lighting, and communications equipment were available and adequate to support successfully performing the procedure as intended. The team reviewed records for operator training conducted on this procedure.
b. Findings
No findings of significance were identified.
.7 Circuit Analyses
a. Inspection Scope
The team reviewed the licensees post-fire safe shutdown analysis to verify that the licensee had identified circuits that may impact the ability to achieve and maintain safe shutdown. On a sample basis, the team verified that cables for equipment required to achieve and maintain hot shutdown conditions in the event of fire in selected fire zones had been properly identified. In addition, the team verified that these cables had either been adequately protected from fire damage, the potentially adverse effects of fire damage mitigated with approved manual operator actions, or analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. In order to accomplish this, the team reviewed electrical schematics and cable routing data for power and control cables associated with each of the selected components. On a sample basis, the team also verified the adequacy of fusing provided for items controlled from the remote shutdown panel and the accuracy of cable information included in the licensees computerized database (ACCESS).
In addition, on a sample basis, the adequacy of circuit protective coordination for safe shutdown power sources was evaluated. The specific power sources selected for review include: 13.8 kV Switchgear 1F, 4160VAC Switchgear E1A, 480VAC ESF Load Center E1A1, and 480VAC MCC E1A1. Also, on a sample basis, the adequacy of electrical protection provided for non-essential cables that share a common enclosure with cables of required shutdown equipment was reviewed to ensure that the non-essential cables are protected to preclude common enclosure concerns.
b. Findings
Introduction:
The team identified an unresolved item associated with License Condition 2.E concerning a potential failure to adequately implement the approved fire protection program. Specifically, the team identified that the licensees fire protection program may not have ensured that the charging pump relied on for achieving post-fire safe shutdown would not be damaged because of a loss of suction. During a post-fire safe shutdown, the charging pump would be necessary to support the reactivity control and reactor coolant makeup functions by providing the reactor coolant system borated water from the refueling water storage tank. The team identified that fire damage to unprotected cables for either of the motor operated valves in the normal suction path had the potential to cause the associated valve to close, which could damage the running pump.
Description.
During normal plant operations, the chemical and volume control system operates to allow a continuous feed (charging and seal injection) and bleed (letdown and seal leak-off) for the reactor coolant system. Normally one centrifugal charging pump is in operation.
In the event of fire, inventory makeup is intended to be accomplished using a centrifugal charging pump by switching to the refueling water storage tank as a source of borated water. Procedure 0POP04-ZO-0009, Safe Shutdown Fire Response, included steps to swap the suction path from the normal suction source to the refueling water storage tank without securing the running charging pump. However, the team determined that if the charging pump credited for safe shutdown was running at the time of the fire, a spurious closure of either one of the two series-connected volume control tank outlet valves (1-MOV-112B or 1-MOV-113A) could result in a loss of suction and damage to the credited charging pump.
The post-fire safe shutdown strategy developed by the fire protection program was intended to assure the availability of only one charging pump in fourteen fire areas. The team identified thirteen of these fire areas (Fire Areas 03, 04, 20, 24, 25, 26, 27, 31, 32, 33, 34, 65 and 67) also contain unprotected cables that had the potential to spuriously close at least one of the volume control tank outlet valves (MOV-112B or MOV-113A)due to fire damage. Instructions in Procedure 0POP04-ZO-0009 for each of these fire areas direct the control room operators to place the control switches for both centrifugal charging pumps to the pull-to-lock position to secure the pumps and prevent potential restarting until their suction is aligned to the refueling water storage tank. The team determined that the assumed success of this action was based on an unverified assumption that circuit damage would not occur prior to 10 minutes after control room operators decided to enter Procedure 0POP04-ZO-0009.
Entry into Procedure 0POP04-ZO-0009 is based on satisfying criteria provided on the Conditional Information Page of Procedure 0POP04-ZO-0008, Fire/Explosion. The entry conditions for Procedure 0POP04-ZO-0008 are:
- (1) Verbal report of a fire or an explosion from a person at the scene, or
- (2) Alarm on the Fire Protection Computer with confirmation of an actual fire in the affected area by an operator dispatched to the fire area. Step 6.0 of Procedure 0POP04-ZO-0008 states, Station the STA (Shift Technical Advisor) in the affected unit to monitor the Conditional Information Page (CIP) until fire is out or transition to Procedure 0POP04-ZO-0009, Safe Shutdown Fire. The procedures would create a time delay between the start of a fire and the decision to initiate a plant shutdown. The team was concerned that fire damage to unprotected cables could spuriously close a volume control tank outlet valve prior to the control room operators
securing the credited centrifugal charging pump in accordance with Procedure 0POP04-ZO-0009.
Analysis.
Failure to ensure that the charging pump relied upon for achieving post-fire safe shutdown would not be damaged because of a fire-induced loss of suction was potentially a performance deficiency. The team determined that this finding may be more than minor because it is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences.
The team initiated an evaluation of this finding using the Significance Determination Process in Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected post-fire safe shutdown strategies in the fire protection program. However, since the issue involves multiple fire areas, additional analysis to be performed by a senior reactor analyst is needed to determine the safety significance of this issue. The licensee has entered this issue into their corrective action program as Condition Report 08-10023.
Enforcement:
License Condition 2.E requires the licensee to implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and the Fire Hazards Analysis Report. The overall fire protection program provides a defense-in-depth approach to fire protection that considers prevention, detection, containment and suppression of fires along with maintaining the plant's ability to perform and maintain post-fire safe shutdown. The team was concerned that the charging pump necessary to support the reactivity control and reactor coolant makeup functions during post-fire safe shutdown may not be adequately protected against potential fire damage in some fire areas.
Pending completion of additional analyses to determine if a credible fire scenario exists for this concern and to determine the safety significance of this finding, this issue is being treated as an unresolved item: URI 05000498;499/2008008-02, Potential Loss of Centrifugal Charging Pump Suction Due to Fire Damage.
.8 Communications
a. Inspection Scope
The team verified through inspection of the contents of designated emergency storage lockers and review of emergency control station alternative shutdown procedures, that the portable communication equipment are available, operable, and adequate for alternative shutdown procedure performance. The team considered communication issues, such as ambient noise levels, clarity of reception, reliability, and coverage patterns. The team considered communication requirements during post-fire safe shutdown procedure walkdowns with operators.
b. Findings
No findings of significance were identified.
.9 Emergency Lighting
a. Inspection Scope
The team reviewed emergency lighting systems required to support plant personnel in the performance of safe shutdown functions to verify it was adequate for the manual actions required to achieve and maintain hot shutdown conditions, and for illuminating access and egress routes to the areas where manual actions are required.
b. Findings
No findings of significance were identified.
.10 Cold Shutdown Repairs
a. Inspection Scope
The team reviewed licensee procedures to determine whether repairs were required to achieve cold shutdown and to verify that the repair material was available on the site.
The team verified that the licensee had procedures and pre-staged equipment necessary to perform the repairs, as required by procedure. The team also evaluated whether cold shutdown could be achieved within the required time using the licensee's procedures and repair methods.
b. Findings
No findings of significance were identified.
.11 Compensatory Measures
a. Inspection Scope
The team reviewed the licensees program for providing compensatory measures in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems or features.
The team reviewed the Procedures 0PGP03-ZF-001, Fire Protection Program, and 0PGP03-ZF-0018, Fire Protection System Operability Requirements. The team also reviewed the current fire impairment log and assessed a sample of fire impairments to determine whether the procedures adequately controlled compensatory measures for fire protection systems, equipment and features (e.g., detection and suppression systems and equipment, and passive fire barriers).
The team reviewed Procedures 0PGP03-ZA-0090, Work Process Program, and 0PGP03-ZA-0091, Configuration Risk Management Program, to determine whether the procedures adequately controlled compensatory measures for out-of-service, degraded, or inoperable post-fire safe shutdown equipment, systems or features.
b. Findings
No findings of significance were identified.
OTHER ACTIVITIES
4OA2 Problem Identification and Resolution
a. Inspection Scope
The team reviewed a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. In addition the team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies.
b. Findings
No findings of significance were identified.
4OA6 Management Meetings
Debrief Meeting Summary
On June 19, 2008, the team leader presented the inspection results to Mr. J. Sheppard, President and CEO, and other members of licensee management. The team confirmed that they destroyed or returned all proprietary information to the licensee that the team had reviewed during the inspection.
Exit Meeting Summary
The team leader presented the inspection results to Mr. T. Powell, and other members of licensee management at the conclusion of the inspection in a conference call on July 24, 2008. The team leader confirmed that no additional proprietary information was handled after the June 19 debrief.
ATTACHMENT:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
- C. Bowman, General Manager Oversight
- W. Bullard, Manager, Health Physics
- K. Coates, Plant General Manager
- R. Dunn Jr., Supervisor, Configuration Control and Analysis
- R. Engen, Manager, Maintenance Engineering
- T. Frawley, Manager, Plant Protection
- R. Gangluff, Manager, Chemistry, Environmental and Health Physics
- C. Grantom, Manager, PRA
- W. Harrison, Senior Engineer, Licensing Staff Specialist
- S. Head, Manager, Licensing
- G. Hildebrant, Manager, Operations, Unit 2
- K. House, Manager, Design Engineering
- G. Janak, Manager, Operations, Unit 1
- B. Jenewein, Manager, Testing and Programs Engineering
- A. McGalliard, Manager, Performance Improvement
- L. Meier, Supervisor, Emergency Preparedness
- J. Mertink, Manager, Operations
- H. Murray, Manager, Maintenance
- M. Murray, Manager, Systems Engineering
- T. Powell, Vice President of Engineering
- M. Reddix, Manager, Security
- D. Rencurrel, Vice President, Engineering
- J. Rocha, Engineer, Systems Engineering
- M. Ruvalcaba, Supervisor, Systems Engineering
- R. Savage, Engineer, Licensing Staff Specialist
- J. Sheppard, President and CEO
- W. Sotos, Supervisor, Design Engineering
- K. Taplett, Senior Engineer, Licensing Staff Specialist
- D. Turkasz, Manager, NSSS Work Window
- T. Walker, Manager, Quality
- B. Wiegand, Engineering
- D. Wiegand, Engineering
- C. Younger, Test Engineering Supervisor
- D. Zink, Acting Supervisor, Plant Engineering
NRC
- J. Dixon, Senior Resident Inspector
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
Closed
None
Discussed
None
- 05000498/2008008-01 URI Potential Fire Damage to the Fire Suppression Water Supply System (Section 1R05.4)
- 05000498;499/2008008-02 URI Potential Loss of Centrifugal Charging Pump Suction Due to Fire Damage (Section 1R05.7)