ML093000301
| ML093000301 | |
| Person / Time | |
|---|---|
| Site: | Comanche Peak  |
| Issue date: | 10/27/2009 |
| From: | Webb Patricia Walker NRC/RGN-IV/DRP/RPB-A |
| To: | Flores R Luminant Generation Co |
| References | |
| IR-09-004 | |
| Download: ML093000301 (50) | |
See also: IR 05000445/2009004
Text
UNITED STATES
NUC LE AR RE G UL AT O RY C O M M I S S I O N
R E GI ON I V
612 EAST LAMAR BLVD , SU I TE 400
AR LI N GTON , TEXAS 76011-4125
October 27, 2009
Rafael Flores, Senior Vice President
and Chief Nuclear Officer
Luminant Generation Company, LLC
Comanche Peak Steam Electric Station
P.O. Box 1002
Glen Rose, TX 76043
Subject: COMANCHE PEAK STEAM ELECTRIC STATION - NRC INTEGRATED
INSPECTION REPORT 05000445/2009004 AND 05000446/2009004
Dear Mr. Flores:
On September 19, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an
inspection at your Comanche Peak Steam Electric Station. The enclosed integrated inspection
report documents the inspection findings, which were discussed on October 1, 2009, with you
and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and
compliance with the Commissions rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed
personnel.
This report documents six NRC-identified findings of very low safety significance (Green).
These findings were determined to involve violations of NRC requirements. However, because
of the very low safety significance and because they are entered into your corrective action
program, the NRC is treating these findings as noncited violations, consistent with
Section VI.A.1 of the NRC Enforcement Policy. If you contest the noncited violations or the
significance of the noncited violations, you should provide a response within 30 days of the date
of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory
Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the
Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E. Lamar Blvd,
Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, U.S. Nuclear
Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the
Comanche Peak Steam Electric Station facility. In addition, if you disagree with the
characterization of any finding in this report, you should provide a response within 30 days of
the date of this inspection report, with the basis for your disagreement, to the Regional
Administrator, Region IV, and the NRC Resident Inspector at the Comanche Peak Steam
Electric Station. The information you provide will be considered in accordance with Inspection
Manual Chapter 0305.
Luminant Generation Company, LLC -2-
In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, and its
enclosure, will be available electronically for public inspection in the NRC Public Document
Room or from the Publicly Available Records component of NRCs document system (ADAMS).
ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the
Public Electronic Reading Room).
Sincerely,
/RA/
Wayne C. Walker, Chief
Project Branch A
Division of Reactor Projects
Docket: 50-445: 50-446
Enclosure:
NRC Inspection Report 05000445/2009004 and 005000446/2009004
w/Attachment 1: Supplemental Information
w/Attachment 2: Results of the Staffs Review of Manual Actions in the Licensing Basis
cc w/Enclosure:
Mike Blevins, Chief Operating Officer
Luminant Generation Company LLC
Comanche Peak Steam Electric Station
P.O. Box 1002
Glen Rose, TX 76043
Mr. Fred W. Madden, Director
Regulatory Affairs
Luminant Generation Company LLC
P.O. Box 1002
Glen Rose, TX 76043
Timothy P. Matthews, Esq.
Morgan Lewis
1111 Pennsylvania Avenue, NW
Washington, DC 20004
County Judge
P.O. Box 851
Glen Rose, TX 76043
Luminant Generation Company, LLC -3-
Mr. Richard A. Ratliff, Chief
Bureau of Radiation Control
Texas Department of Health
P.O. Box 149347, Mail Code 2835
Austin, TX 78714-9347
Environmental and Natural
Resources Policy Director
Office of the Governor
P.O. Box 12428
Austin, TX 78711-3189
Mr. Brian Almon
Public Utility Commission
William B. Travis Building
P.O. Box 13326
Austin, TX 78711-3326
Ms. Susan M. Jablonski
Office of Permitting, Remediation
and Registration
Texas Commission on
Environmental Quality
MC-122
P.O. Box 13087
Austin, TX 78711-3087
Anthony Jones
Chief Boiler Inspector
Texas Department of Licensing
and Regulation
Boiler Division
E.O. Thompson State Office Building
P.O. Box 12157
Austin, TX 78711
Chief, Technological Hazards
Branch
FEMA Region VI
800 North Loop 288
Federal Regional Center
Denton, TX 76209
Luminant Generation Company, LLC -4-
Electronic distribution by RIV:
Regional Administrator (Elmo.Collins@nrc.gov)
Deputy Regional Administrator (Chuck.Casto@nrc.gov)
DRP Director (Dwight.Chamberlain@nrc.gov)
DRP Deputy Director (Anton.Vegel@nrc.gov)
DRS Director (Roy.Caniano@nrc.gov)
DRS Deputy Director (Troy.Pruett@nrc.gov)
Senior Resident Inspector (John.Kramer@nrc.gov)
Resident Inspector (Brian.Tindell@nrc.gov)
Senior Project Engineer (Bob.Hagar@nrc.gov)
Branch Chief, DRP/A (Wayne.Walker@nrc.gov)
CP Site Secretary (Sue.Sanner@nrc.gov)
Public Affairs Officer (Victor.Dricks@nrc.gov)
Branch Chief, DRS/TSB (Michael.Hay@nrc.gov)
RITS Coordinator (Marisa.Herrera@nrc.gov)
Regional Counsel (Karla.Fuller@nrc.gov)
Congressional Affairs Officer (Jenny.Weil@nrc.gov)
OEMail Resource
OEDO RIV Coordinator (Leigh.Trocine@nrc.gov)
ROPreports
File located:R:\_REACTORS\_CPSES\CP 2009004 RP-JGK.doc ML#093000301
SUNSI Rev Compl. ;Yes No ADAMS ;Yes No Reviewer Initials
Publicly Avail ;Yes No Sensitive Yes ; No Sens. Type Initials
SRI:DRP/A RI/DRP/A C:DRS/OB C:DRS/PSB1 C:DRS/PSB2
JKramer BTindell RLantz MShannon GWerner
/RA/ /RA/ /RA/ /RA/ /RA/
10/26/09 10/26/09 10/19/09 10/20/09 10/20/09
C:DRS/EB1 C:DRS/EB2 C:DRP/A C:DRP/A
RLKellar NOKeefe WWalker RHagar
/RA/ /RA/ /RA/ /RA/
10/19/09 10/19/09 10/27/09 10/27/09
OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket: 50-445, 50-446
Report: 05000445/2009004 and 05000446/2009004
Licensee: Luminant Generation Company LLC
Facility: Comanche Peak Steam Electric Station, Units 1 and 2
Location: FM-56, Glen Rose, Texas
Dates: June 21 through September 19, 2009
Inspectors: J. Kramer, Senior Resident Inspector
B. Tindell, Resident Inspector
P. Elkmann, Senior Emergency Preparedness Inspector
R. Hagar, Senior Project Engineer
J. Mateychick, Senior Reactor Inspector
Approved By: Wayne Walker, Chief, Project Branch A
Division of Reactor Projects
-1- Enclosure
SUMMARY OF FINDINGS
IR 05000445/2009004, 05000446/2009004; 06/21/2009 - 09/19/2009; Comanche Peak Steam
Electric Station, Units 1 and 2, Fire Protection, Flood Protection Measures, Plant Modifications,
Other Activities.
The report covered a 3-month period of inspection by resident inspectors and announced
baseline inspections by region based inspectors. Six Green noncited violations were identified.
The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using
Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the
significance determination process does not apply may be Green or be assigned a severity level
after NRC management review. The NRC's program for overseeing the safe operation of
commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,
Revision 4, dated December 2006.
A. NRC-Identified Findings and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Green. The inspectors identified a Green noncited violation of License
Condition 2.G for the failure of the licensee to seal a penetration in the Unit 2
train B safety chiller electrical cabinet. As a result, the equipment was vulnerable
to water damage from a fire sprinkler activation during a postulated fire on the
redundant train. The licensee entered the finding into their corrective action
program as Smart Form SMF-2009-001069-00.
The finding was more than minor because it was associated with the protection
against external events attribute of the Mitigating Systems cornerstone and
adversely affected the cornerstone objective, in that, it decreased the reliability of
the redundant safety chiller train in case of fire on the Unit 2 train A safety chiller.
Using NRC Manual Chapter 0609, the inspectors determined that a Phase 3
analysis was required. Based on the senior reactor analyst's significance
determination process Phase 3 analysis, this finding was determined to have
very low safety significance. The finding did not have a crosscutting aspect
because it was not representative of current licensee performance
(Section 1R05).
- Green. The inspectors identified a Green noncited violation of 10 CFR Part 50,
Appendix B, Criterion III, for the failure of the licensee to follow the design basis
and seal electrical penetration conduits in the containment spray pump rooms.
As a result, the water from a pipe break in the valve isolation tank rooms would
flow into the conduits in the containment spray pump room and could cause a
train of residual heat removal, safety injection, and containment spray equipment
to become inoperable. The licensee entered the finding into their corrective
action program as Smart Form SMF-2009-000926-00.
The finding was more than minor because it was associated with the design
control attribute of the Mitigating Systems cornerstone and adversely affected the
cornerstone objective to ensure the capability of systems that respond to events.
Using NRC Manual Chapter 0609, the inspectors determined that a Phase 3
analysis was required. Based on the senior reactor analyst's significance
-2- Enclosure
determination process Phase 3 analysis, this finding was determined to have
very low safety significance. The finding did not have a crosscutting aspect
because it was not representative of current licensee performance
(Section 1R06).
- Green. The inspectors identified a Green noncited violation of Technical
Specification 5.4.1.a for failure to comply with the work control procedure which
requires that all transient equipment be tracked. Specifically, the licensee placed
a floating dock in the service water intake structure for maintenance activities and
did not track the dock in Maximo, the licensees computer program for tracking
work. As a result, the dock remained in place significantly longer than allowed
without doing an engineering evaluation for the effects, potentially reducing the
reliability of the service water pumps in case of a fire or flood. The licensee
entered the finding into their corrective action program as Smart Form
SMF-2009-001548-00.
The finding was more than minor because it was associated with the protection
against external factors attribute of the Mitigating Systems cornerstone, and
adversely affected the objective, in that, the reliability of the service water system
was reduced in the cases of a fire or the probable maximum flood. The
inspectors determined that because the fire scenario did not reflect the dominant
risk of the finding, the flooding scenario would be used for the significance
determination process. Using NRC Manual Chapter 0609, Attachment 4, Phase
1 - Initial Screening and Characterization of Findings, the finding was
determined to be of very low safety significance because the performance
deficiency did not cause the loss of any safety function. This finding has a
human performance crosscutting aspect associated with resources, in that the
licensee failed to provide adequate training for personnel H.2b] (Section 1R18).
- Green. The inspectors identified a noncited violation of Technical
Specification 5.4.1.d for the failure to maintain adequate written procedures
covering fire protection program implementation. Specifically,
Procedure ABN-803A, Response to a Fire in the Control Room or Cable
Spreading Room, Revision 8, which is used to perform an alternative shutdown
from outside of the control room, failed to assure that the train A charging pump,
relied on for achieving postfire safe shutdown, would not be damaged because of
a loss of suction. During an alternative shutdown, operators must use the train A
charging pump for the reactivity control and reactor coolant makeup functions by
providing borated water from the refueling water storage tank. The licensee
entered the finding into their corrective action program as Smart Form
SMF-2009-004453-00.
Failure to ensure that Procedure ABN-803 contained sufficient instructions to
ensure that the credited train A centrifugal charging pump would be available
following a postulated control room abandonment was a performance deficiency.
This finding was more than minor because it was associated with the protection
against external factors attribute of the Mitigating Systems cornerstone, and
affected the cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to external events (such as fire) to prevent
undesirable consequences. Based on the senior reactor analyst's significance
-3- Enclosure
determination process Phase 3 analysis, this finding was determined to have
very low safety significance. The finding did not have a crosscutting aspect
because it was not representative of current licensee performance
(Section 4OA5.4).
- Green. The inspectors identified a noncited violation of Unit 1 License
Condition 2.G and Unit 2 License Condition 2.G. Specifically, the licensee failed
to ensure that one train of the equipment required to achieve and maintain safe
hot shutdown conditions remained free from fire damage as specified in the
approved fire protection program. The inspectors identified that the licensee
relied upon local manual actions to mitigate the effects of potential fire damage
rather than provide the physical separation or protection required in the approved
fire protection program. The licensee entered the finding into their corrective
action program as Smart Form SMF-2009-004454-00.
Failure to ensure that one train of the systems required for hot shutdown is free
from fire damage was a performance deficiency. This finding was more than
minor because it was associated with the protection against external factors
attribute of the Mitigating Systems cornerstone, and affected the cornerstone
objective to ensure the availability, reliability, and capability of systems that
respond to external events (such as fire) to prevent undesirable consequences.
Based on the senior reactor analyst's significance determination process Phase 3
analysis, this finding was determined to have very low safety significance. The
finding did not have a crosscutting aspect because it was not representative of
current licensee performance (Section 4OA5.5).
- Green. The inspectors identified a noncited violation of Technical
Specification 5.4.1.d for the failure to maintain adequate written procedures
covering fire protection program implementation. Specifically, during operator
walkthroughs, the inspectors identified that Procedure ABN-803A, Response to
a Fire in the Control Room or Cable Spreading Room, Revision 8, used to
perform an alternative shutdown from outside of the control room, had two
examples of critical actions that could not be completed in the time required by
the postfire safe shutdown analysis. The steps to respond to a potential spurious
opening of the train A power-operated relief valve and a potential loss of station
service water cooling to the emergency diesel generator were not completed
within the maximum allowable times specified in the procedure. As a
compensatory measure, the licensee issued night orders to alert operators of
these procedural concerns. The licensee entered the finding into their corrective
action program as Smart Form SMF-2009-004455-00.
Failure to provide adequate procedural guidance to implement the requirements
of the approved fire protection program was a performance deficiency. This
finding was more than minor because it was associated with the protection
against external factors attribute of the Mitigating Systems cornerstone, and
affected the cornerstone objective to ensure the availability, reliability, and
capability of systems that respond to external events (such as fire) to prevent
undesirable consequences. Based on the senior reactor analyst's significance
determination process Phase 3 analysis, this finding was determined to have
very low safety significance. The finding did not have a crosscutting aspect
-4- Enclosure
because it was not representative of current licensee performance
(Section 4OA5.6).
B. Licensee-Identified Violations
None
-5- Enclosure
REPORT DETAILS
Summary of Plant Status
Comanche Peak Steam Electric Station Unit 1 operated at approximately 100 percent power for
the entire reporting period.
Comanche Peak Steam Electric Station Unit 2 operated at approximately 100 percent power for
the entire reporting period.
1. REACTOR SAFETY
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, and
1R01 Adverse Weather Protection (71111.01)
.1 Readiness to Cope with External Flooding
a. Inspection Scope
The inspectors evaluated the design, material condition, and procedures for coping with
the design basis probable maximum flood. The evaluation included a review to check
for deviations from the descriptions provided in the Final Safety Analysis Report for
features intended to mitigate the potential for flooding from external factors. As part of
this evaluation, the inspectors checked that the roofs did not contain obstructions or
obvious loose items that could clog drains in the event of heavy precipitation.
Additionally, the inspectors performed a walkdown of the protected area to identify any
modification to the site that would inhibit site drainage during a probable maximum
precipitation event or allow water ingress past a barrier. The inspectors also reviewed
the abnormal operating procedure for mitigating the design basis flood to ensure it could
be implemented as written.
These activities constitute completion of one external flooding sample as defined in
Inspection Procedure 71111.01-05.
b. Findings
No findings of significance were identified.
1R04 Equipment Alignments (71111.04)
Partial Equipment Walkdowns
a. Inspection Scope
The inspectors performed partial system walkdowns of the following risk-significant
systems:
- July 13, 2009, Unit 2, uninterruptible power supply heating, ventilation, and
cooling systems
-6- Enclosure
- July 16, 2009, Unit 2, diesel generator 2-01 while the turbine driven auxiliary
feeedwater pump was unavailable for maintenance
- July 29, 2009, Unit 1, diesel generator 1-01 while diesel generator 1-02 was
unavailable for maintenance
- August 19, 2009, Unit 1, safety injection train B while train A was unavailable for
maintenance
The inspectors selected these systems based on their risk significance relative to the
reactor safety cornerstones at the time they were inspected. The inspectors attempted
to identify any discrepancies that could affect the function of the system and, therefore,
potentially increase risk. The inspectors reviewed applicable operating procedures,
system diagrams, Final Safety Analysis Report, technical specification requirements,
outstanding work orders, Smart Forms, and the impact of ongoing work activities on
redundant trains of equipment in order to identify conditions that could have rendered
the systems incapable of performing their intended functions. The inspectors also
walked down accessible portions of the systems to verify system components and
support equipment were aligned correctly and operable. The inspectors examined the
material condition of the components and observed operating parameters of equipment
to verify that there were no obvious deficiencies. The inspectors also verified that the
licensee had properly identified and resolved equipment alignment problems that could
cause initiating events or impact the capability of mitigating systems or barriers and
entered them into the corrective action program with the appropriate significance
characterization.
These activities constituted completion of four partial system walkdown samples as
defined in Inspection Procedure 71111.04-05.
b. Findings
No findings of significance were identified.
1R05 Fire Protection (71111.05)
Quarterly Fire Inspection Tours
a. Inspection Scope
The inspectors conducted fire protection walkdowns in the following risk-significant plant
areas:
- August 11, 2009, fire zone 1SC7, Unit 1, turbine driven auxiliary feedwater pump
room
- September 10, 2009, fire area EN, Unit 1 cable spreading room
- September 10, 2009, fire area EM, Unit 2 cable spreading room
- September 10, 2009, fire zone AA154, Unit 2, safety chillers
-7- Enclosure
The inspectors reviewed areas to assess if licensee personnel had implemented a fire
protection program that adequately controlled combustibles and ignition sources within
the plant; effectively maintained fire detection and suppression capability; maintained
passive fire protection features in good material condition; and had implemented
adequate compensatory measures for out of service, degraded or inoperable fire
protection equipment, systems, or features, in accordance with the licensees fire plan.
The inspectors selected fire areas based on their overall contribution to internal fire risk
as documented in the plants Individual Plant Examination of External Events with later
additional insights, their potential to affect equipment that could initiate or mitigate a plant
transient, or their impact on the plants ability to respond to a security event. Using the
documents listed in the attachment, the inspectors verified that fire hoses and
extinguishers were in their designated locations and available for immediate use, that
fire detectors and sprinklers were unobstructed, that transient material loading was
within the analyzed limits, and fire doors, dampers, and penetration seals appeared to
be in satisfactory condition. Specific documents reviewed during this inspection are
listed in the attachment.
These activities constituted completion of four quarterly fire-protection inspection
samples as defined in Inspection Procedure 71111.05-05.
b. Findings
Introduction. The inspectors identified a Green noncited violation of License Condition
2.G for the failure of the licensee to seal a penetration in the Unit 2 train B safety chiller
electrical cabinet. As a result, the equipment was vulnerable to water damage from a
fire sprinkler activation during a postulated fire on the redundant train.
Description. On February 26, 2009, while performing a walkdown of the Unit 2 safety
chillers, the inspectors discovered an unsealed penetration on the top of a cabinet that
contained electrical equipment for the Unit 2 train B safety chiller. The redundant train A
safety chiller is separated from train B by a partial height wall and a water curtain. The
water curtain consists of a group of fast acting fire sprinklers above the wall. With a
train A safety chiller fire and a water curtain actuation, the water curtain spray would
reach the electrical cabinet for the train B chiller. The cabinet was designed so the spray
would not enter the cabinet and wet electrical equipment.
The inspectors observed sprinkler locations, the location of the unsealed penetration,
and the electrical equipment inside of the cabinet. The inspectors concluded that if a fire
occurred on the train A safety chiller, it was reasonable that water would enter the
cabinet and short control power to the train B safety chiller, which would then render
both safety chillers inoperable.
The inspectors determined, through a review of the licensees basic cause evaluation,
that the unsealed penetration in the cabinet was likely created during construction
because no work history that could have caused the hole could be found. The
inspectors walked down a sample of other electrical enclosures and no other unsealed
cabinet penetrations were found. The inspectors concluded that this performance
deficiency was not representative of current licensee performance.
-8- Enclosure
Analysis. The licensees failure to seal a penetration in equipment was a performance
deficiency, which resulted in redundant equipment that was vulnerable to water damage.
The finding was more than minor because it was associated with the protection against
external events attribute of the Mitigating Systems cornerstone and adversely affected
the cornerstone objective, in that, it decreased the reliability of the Unit 2 train B safety
chiller train in case of fire in the Unit 2 train A safety chiller. The inspectors determined
that NRC Manual Chapter 0609, Appendix F, Fire Protection Significance Determination
Process, was not applicable for assessing the significance of this finding and that a
Phase 3 analysis was required.
A senior reactor analyst performed a bounding Phase 3 significance determination to
evaluate the fire protection finding. First, the analyst identified an approximate
frequency for a chiller fire from the NRC Manual Chapter 0609, Appendix F,
Attachment 4, Fire Ignition Source Mapping Information: Fire Frequency, Counting
Instructions, Applicable Fire Severity Characteristics, and Applicable Manual Fire
Suppression Curves. The analyst selected the most conservative fire initiation
frequency for a chiller component that was listed in the table. The frequency was
6.5 x 10-4/year and was for large electric motors (greater than 100 horsepower). There
were no other significant fire initiation contributors in the room. The analyst used the
Comanche Peak SPAR model, Revision 3.50, dated May 27, 2009, to calculate the
conditional core damage probability for a bounding event that included a fire, plant trip
and failure of both chillers. The analyst used a cutset truncation of 1.0 x 10-13 and
assumed a duration of 1 year. The conditional core damage probability was 5.8 x 10-5.
The approximate bounding delta core damage frequency (CDF), assuming a zero
baseline and giving no credit for fire mitigation or consideration that the alternate chiller
might not fail from sprinkler spray, was a product of the conditional core damage
probability and the fire initiating frequency:
CDF = 6.5 x 10-4 * 5.8 x 10-5 = 3.8 x 10-8
Since the calculated CDF was less than 1 x 10-6, the finding was of very low safety
significance (Green). Since the CDF was less than 1 x 10-7, the analyst determined
that there was not a significant contributor to the large early release frequency.
The inspector determined that no crosscutting component is associated with this finding
because it is not representative of current licensee performance.
Enforcement. The Unit 2 Facility Operating License Condition 2.G. states, Luminant
Generation Company LLC shall implement and maintain in effect all provisions of the
approved fire protection program as described in the Final Safety Analysis Report
through Amendment 87. Comanche Peak Final Safety Analysis Report Section 13.3B,
CPSES Fire Protection Program, Amendment 101, states, CPSES is committed to
meeting the requirements of the Fire Protection Report. Comanche Peak Fire
Protection Report, Revision 25, Deviation 1b (2) states Equipment is provided with
spray shields and penetrations into the equipment are sealed to protect against water
damage due to sprinkler actuation. Contrary to the above, on February 26, 2009, a
Unit 2 train B safety chiller electrical equipment cabinet penetration was not sealed to
protect against water damage due to sprinkler actuation. Since the violation was of very
low safety significance and was documented in the licensees corrective action program
as Smart Form SMF-2009-000714-00, it is being treated as a noncited violation,
-9- Enclosure
consistent with Section VI.A.1 of the NRC Enforcement Policy:
NCV 05000446/2009004-01, Failure to Seal Electrical Enclosure.
1R06 Flood Protection Measures (71111.06)
a. Inspection Scope
The inspectors reviewed selected risk important plant design features to protect the plant
and its safety related equipment from internal flooding events. The inspectors reviewed
flood analysis, design documents, engineering calculations, and the Final Safety
Analysis Report. Specific documents reviewed during this inspection are listed in the
attachment. To verify proper wall penetration seals were in place, on March 15, 2009,
the inspectors walked down the Unit 2 containment spray pump rooms.
These activities constitute completion of one flood protection measures inspection
sample as defined by IP 71111.06-05.
b. Findings
Introduction. The inspectors identified a Green noncited violation of 10 CFR Part 50,
Appendix B, Criterion III, for the failure of the licensee to follow the design basis and seal
electrical penetration conduits in the Unit 2 containment spray pump rooms. As a result,
the water from a pipe break in the valve isolation tank rooms would flow into the conduits
in the containment spray pump room and could cause a train of residual heat removal,
safety injection, and containment spray equipment to become inoperable.
Description. On March 15, 2009, the inspectors performed a walkdown of the Unit 2
containment spray pump rooms and did not observe sealant in the electrical
penetrations between the containment spray pump rooms (Rooms 51 and 54) and the
valve isolation tank rooms (Rooms 63 and 65). The inspectors informed the licensee
about the observation and the possible breach of a fire barrier. The licensee inspected
the penetrations and determined that the penetrations were not sealed. The licensee
reviewed the fire protection requirements for the penetrations and determined that the
penetrations went through a wall that was a non-rated fire barrier and there was not a
need to seal the penetrations for fire protection. However, the licensee determined that
the wall penetrations were credited in the building flooding analysis. The licensee
performed a walkdown of the Unit 1 penetrations and found them to be correctly sealed.
The inspectors determined that Design Basis Document DBD-ME-002, Penetration
Seals, Revision 8, establishes the design basis for penetration seals and that
Section 5.1.2 documents that pressure rated barriers are determined by reviewing
Calculation 2-FP-0001, Barrier Functional List. Calculation 2-FP-0001, Attachment 1
provided a listing of the functional barrier requirements of the Unit 2 penetrations and
documented that the penetrations will have a pressure rating of 150 inches of water.
The inspectors determined that the penetrations did not meet the pressure rating
requirement.
The inspectors discussed the missing penetration seals with the licensee and
determined the seals were most likely not sealed during the initial construction
timeframe. The inspectors concluded that this finding was not representative of current
licensee performance.
- 10 - Enclosure
Analysis. The licensees failure to seal the electrical penetrations is a performance
deficiency and, as a result, water from a pipe break in the valve isolation tank rooms
would flow into the conduits in the containment spray pump room and could cause a
train of residual heat removal, safety injection, and containment spray equipment to
become inoperable. The finding was more than minor because the performance
deficiency was associated with the design control attribute of the mitigating systems
cornerstone and adversely affected the cornerstone objective to ensure the capability of
systems that respond to events. Using NRC Inspection Chapter 0609, the inspectors
determined that a Phase 3 analysis was required.
A senior reactor analyst performed a Phase 3 significance determination to evaluate the
flooding concern. First, the analyst identified the approximate frequency for a break of
the affected system piping. Using Comanche Peak Internal Flooding Analysis - Flood
Zone Scenario Frequency Screening, Table 4.1.1-3, dated October 17, 2005, the
analyst determined the estimated break frequency as 1.8 x 10-5/year for each affected
room. The analyst used the Comanche Peak SPAR model, Revision 3.50, dated May
27, 2009, to calculate the conditional core damage probability (CCDP) for a bounding
event that included a failure of the piping, a plant trip and the failure of one train of
residual heat removal coincident with a failure of one train of safety injection. All other
initiating events were set to false. The analyst used a cutset truncation of 1.0 x 10-13 and
assumed an exposure interval of 1 year. The CCDP for that event was 6.4 x 10-7. For a
flood in one room, the approximate delta core damage frequency (CDF) was a product
of the flood frequency and the calculated CCDP: CDF/room = 1.8 x 10-5 * 6.4 x 10-7 =
1.2 x 10-11. Assuming a based CDF of 0.0, the total CDF was calculated as:
CDF/room * 2 rooms = 1.2 x 10-11 * 2 = 2.4 x 10-11
Since the calculated CDF was less than 1 x 10-6, the finding was of very low safety
significance (Green). Since the CDF was less than 1 x 10-7, the analyst determined
that there was not a significant contributor to the large early release frequency.
The inspector determined that no crosscutting component isassociated with this finding
because it is not representative of current licensee performance.
Enforcement. The inspectors determined that 10 CFR Part 50, Appendix B, Criterion III,
requires, in part, that measures shall be established to assure that the design basis for
safety related functions of structures, systems, and components are correctly translated
into specifications, drawings, procedures and instructions. Design Basis Document
DBD-ME-002, Penetration Seals, Revision 8, Section 5.1.2 documents, in part, that
pressure rated barriers are determined by reviewing Calculation 2-FP-0001, Barrier
Functional List. Calculation 2-FP-0001, Attachment 1 provides a listing of the functional
barrier requirements of the Unit 2 penetrations and on page 3 documented that the
containment spray pump room to electrical chase 780 penetration will have a pressure
rating of 150 inches of water. Contrary to the above, the licensee failed to seal the
penetration and provide the appropriate design pressure rating. As a result, a pipe
break and flood in the valve isolation tank room could cause a train of residual heat
removal, safety injection, and containment spray equipment to become inoperable.
Since the violation was of very low safety significance and was documented in the
licensees corrective action program as Smart Form SMF-2009-000926-00, it is being
- 11 - Enclosure
treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement
Policy: NRC 05000446/2009004-02, Failure to Seal Electrical Penetrations.
1R11 Licensed Operator Requalification Program (71111.11)
.1 Quarterly Licensed Operator Requalification Program Inspection
a. Inspection Scope
On August 31, 2009, the inspectors observed a crew of licensed operators in the plants
simulator to verify that operator performance was adequate, evaluators were identifying
and documenting crew performance problems, and training was being conducted in
accordance with licensee procedures. The inspectors evaluated the following areas:
- Licensed operator performance
- Crews clarity and formality of communications
- Crews ability to take timely actions in the conservative direction
- Crews prioritization, interpretation, and verification of annunciator alarms
- Crews correct use and implementation of abnormal and emergency procedures
- Control board manipulations
- Oversight and direction from supervisors
- Crews ability to implement appropriate emergency plan actions and notifications
The inspectors compared the crews performance in these areas to pre-established
operator action expectations and successful critical task completion requirements.
These activities constituted completion of one quarterly licensed operator requalification
program sample as defined in Inspection Procedure 71111.11.
b. Findings
No findings of significance were identified.
1R12 Maintenance Effectiveness (71111.12)
a. Inspection Scope
The inspectors evaluated the following risk significant systems, components, and
degraded performance issues:
- Unit 1 flow path for emergency boration
- Unit 1 diesel generator 1-02
The inspectors reviewed events where ineffective equipment maintenance has resulted
in valid or invalid automatic actuations of engineered safeguards systems and
independently verified the licensee's actions to address system performance or condition
problems in terms of the following:
- Implementing appropriate work practices
- Identifying and addressing common cause failures
- Scoping of systems in accordance with 10 CFR 50.65(b)
- 12 - Enclosure
- Characterizing system reliability issues for performance
- Charging unavailability for performance
- Trending key parameters for condition monitoring
- Ensuring proper classification in accordance with 10 CFR 50.65(a)(1) or (a)(2)
The inspectors verified appropriate performance criteria for structures, systems, and
components classified as having an adequate demonstration of performance through
preventive maintenance, as described in 10 CFR 50.65(a)(2), or as requiring the
establishment of appropriate and adequate goals and corrective actions for systems
classified as not having adequate performance, as described in 10 CFR 50.65(a)(1).
The inspectors assessed performance issues with respect to the reliability, availability,
and condition monitoring of the system. In addition, the inspectors verified that
maintenance effectiveness issues were entered into the corrective action program with
the appropriate significance characterization. Specific documents reviewed during this
inspection are listed in the attachment.
These activities constituted completion of two quarterly maintenance effectiveness
samples as defined in Inspection Procedure 71111.12-05.
b. Findings
No findings of significance were identified.
1R13 Maintenance Risk Assessments and Emergent Work Control (71111.13)
a. Inspection Scope
The inspectors reviewed licensee personnel's evaluation and management of plant risk
for the maintenance and emergent work activities affecting risk-significant and
safety-related equipment listed below to verify that the appropriate risk assessments
were performed prior to removing equipment for work:
- July 30, 2009, Unit 1, diesel generator 1-02 maintenance and severe
thunderstorm warning
- August 13, 2009, Unit 1, motor driven auxiliary feedwater pump 1-01 and residual
heat removal pump 1-01 concurrent outages
- August 21, 2009, Unit 1 turbine driven auxiliary feedwater pump inoperable but
available during testing
- August 28, 2009, Unit 2, motor driven auxiliary feedwater pump 2-01 and turbine
driven auxiliary feedwater pump 2-01 inoperability during pump discharge check
valve reverse flow testing
The inspectors selected these activities based on potential risk significance relative to
the reactor safety cornerstones. As applicable for each activity, the inspectors verified
that licensee personnel performed risk assessments as required by 10 CFR 50.65(a)(4)
and that the assessments were accurate and complete. When licensee personnel
performed emergent work, the inspectors verified that the licensee personnel promptly
- 13 - Enclosure
assessed and managed plant risk. The inspectors reviewed the scope of maintenance
work, discussed the results of the assessment with the licensee's probabilistic risk
analyst or shift technical advisor, and verified plant conditions were consistent with the
risk assessment. The inspectors also reviewed the technical specification requirements
and inspected portions of redundant safety systems, when applicable, to verify risk
analysis assumptions were valid and applicable requirements were met.
These activities constituted completion of four maintenance risk assessments and
emergent work control inspection samples as defined in Inspection
Procedure 71111.13-05.
b. Findings
No findings of significance were identified.
1R15 Operability Evaluations (71111.15)
a. Inspection Scope
The inspectors reviewed the following issues:
- SMF-2009-003309-00, Unit 2, safety injection 2-01 voiding
- SMF-2009-003767-00, Unit 1, diesel generator 1-02 with water identified in the
cylinder head water during engine roll
- SMF-2009-003927-00, hot flux channel factor relaxed axial offset control
testing
The inspectors selected these potential operability issues based on the risk-significance
of the associated components and systems. The inspectors evaluated the technical
adequacy of the evaluations to ensure that technical specification operability was
properly justified and the subject component or system remained available such that no
unrecognized increase in risk occurred. The inspectors compared the operability and
design criteria in the appropriate sections of the technical specifications and Final Safety
Analysis Report to the licensees evaluations, to determine whether the components or
systems were operable. Where compensatory measures were required to maintain
operability, the inspectors determined whether the measures in place would function as
intended and were properly controlled. The inspectors determined, where appropriate,
compliance with bounding limitations associated with the evaluations. Additionally, the
inspectors reviewed a sampling of corrective action documents to verify that the licensee
was identifying and correcting any deficiencies associated with operability evaluations.
Specific documents reviewed during this inspection are listed in the attachment.
These activities constituted completion of four operability evaluation inspection samples
as defined in Inspection Procedure 71111.15-05.
- 14 - Enclosure
b. Findings
No findings of significance were identified.
1R18 Plant Modifications (71111.18)
a. Inspection Scope
To verify that the safety functions of important safety systems were not degraded, the
inspectors reviewed the temporary modification that involved placing a floating dock in
the service water intake structure.
The inspectors reviewed the temporary modification and the associated safety
evaluation screening against the system design bases documentation, including the
Final Safety Analysis Report and the technical specifications, and verified that the
modification did not adversely affect the system operability/availability. The inspectors
also verified that the installation and restoration were consistent with the modification
documents and that configuration control was adequate. Additionally, the inspectors
verified that the temporary modification was identified on control room drawings,
appropriate tags were placed on the affected equipment, and licensee personnel
evaluated the combined effects on mitigating systems and the integrity of radiological
barriers.
These activities constitute completion of one sample for temporary plant modifications as
defined in Inspection Procedure 71111.18-05.
b. Findings
Introduction. The inspectors identified a Green noncited violation of Technical
Specification 5.4.1.a for failure to comply with the work control procedure which requires
that all transient equipment be tracked. Specifically, the licensee placed a floating dock
in the service water intake structure (SWIS) for maintenance activities and did not track
the dock in Maximo, the licensees computer program for tracking work. As a result, the
licensee left the dock remained in place significantly longer than allowed without
completing an engineering evaluation for the effects, thereby potentially reducing the
reliability of the service water pumps in case of a fire or flood.
Description. The inspectors reviewed the licensees process to control the installation of
a floating dock inside the service water intake structure. The licensee uses Maximo, an
electronic work control process, to ensure that transient equipment is tracked and only
allowed to remain in place for less than 90 days or evaluated as a permanent change.
However, the inspectors noted that the licensee failed to track the floating dock in the
service water intake structure and left the equipment in place for 244 days, before
removing it on April 27, 2008.
The licensee had installed the dock on August 27, 2007, for use as a diving platform to
support pump bay cleaning as preventative maintenance every three years. The
evaluation related to the temporary floating dock, FDA-1999-001657-01-01, states, The
SWIS is a highly sensitive fire area. Because of this sensitivity, and the fact that the
floating deck consists of a very large quantity of combustible plastic, the use of the
floating dock is restricted under the Fire Protection Program. The dock is to be installed
- 15 - Enclosure
temporarily for use only during times of need, as discussed above. The Comanche
Peak Fire Protection Report, Revision 25, in Deviation 1a for having all redundant
service water equipment in one fire area, states in part, that, A fire caused by transient
combustibles is mitigated because the area is designated No Storage area. The area
is below the pumps is sensitive because it can affect all four trains of service water.
However, because of the distance to the targets, and because the dock was floating in
water, the inspectors concluded that a fire of the floating dock would have a very low
probability of failing redundant service water equipment.
The inspectors questioned the licensee about potential for the floating dock to damage
equipment in the service water intake structure during a probable maximum flood. The
licensee evaluated the concern and determined that the dock would impact non-safety
equipment and potentially crush it during the flood. The foreign material caused by this
event had a potential for entering all four service water pumps which would affect the
reliability of the pumps in both units. The inspectors concluded that although non-safety
related equipment could be damaged during the flood, there was a very small likelihood
that the foreign material would cause all of the pumps to fail simultaneously.
The licensee conducted a cause evaluation for the performance deficiency and
concluded that the cause was due to planning personnel transferring to a new role
without adequate training. The inspectors reviewed the evaluation and concluded that
the failure to provide adequate training was the most significant contributor to the
performance deficiency.
Analysis. The licensees failure to track the floating dock in the service water intake
structure was a performance deficiency and resulted in transient equipment remaining in
the plant for an extended period of time. As a result, the service water systems
reliability could have been reduced, in that the dock increased the exposure of system
components to flood and fire damage. The finding was more than minor because it was
associated with the protection against external factors attribute of the Mitigating Systems
cornerstone, and adversely affected the objective, in that the reliability of the service
water system could have been reduced in the cases of a fire or the probable maximum
flood. The inspectors determined that because the fire scenario did not reflect the
dominant risk of the finding, the flooding scenario would be used for the significance
determination process. Using NRC Manual Chapter 0609, Attachment 4, Phase 1 -
Initial Screening and Characterization of Findings, the finding was determined to be of
very low safety significance because the performance deficiency did not cause the loss
of any safety function. This finding has a human performance crosscutting aspect
associated with resources because the licensee failed to provide adequate training for
personnel H.2b].
Enforcement. Technical Specification 5.4.1.a requires, in part, that written procedures
shall be established, implemented, and maintained covering the applicable procedures
recommended in Regulatory Guide 1.33, Revision 2, Appendix A. Regulatory Guide 1.33, Appendix A, Item 9.e., requires, in part, procedures for the control of maintenance,
repair, replacement, and modification work. Procedure STA-606, Control of
Maintenance and Work Activities, Revision 29, Step 6.1.6 requires, in part, that transient
equipment shall be tracked in Maximo to ensure the requirements of Procedure STA-602
Temporary Modifications and Transient Equipment Placements are satisfied. Contrary
to the above from August 27, 2007 to April 27, 2008, the licensee failed to track the
- 16 - Enclosure
floating dock in Maximo to ensure the transient equipment placement requirements were
satisfied. Since the violation was of very low safety significance and was documented in
the licensees corrective action program as Smart Form SMF-2009-001548-00, it is
being treated as a noncited violation, consistent with Section VI.A.1 of the NRC
Enforcement Policy: NCV 05000445/2009004-03; 05000446/2009004-03, Failure to
Control Transient Equipment.
1R19 Postmaintenance Testing (71111.19)
a. Inspection Scope
The inspectors reviewed the following postmaintenance activities to verify that
procedures and test activities were adequate to ensure system operability and functional
capability:
- July 21, 2009, control room air conditioning unit X-04 testing following oil heater
replacement
- July 30, 2009, diesel generator 1-02 testing following diesel generator cylinder
head replacement
- August 13, 2009, valve 1-PV-2453B, motor driven auxiliary feedwater pump 1-01
discharge to steam generator 1-02 flow control valve, diagnostic testing following
valve refurbishment
- August 19, 2009, safety injection train A testing following maintenance on valve
1-8922A, safety injection pump 1-01 discharge check valve
- September 1, 2009, safety injection pump 2-02 testing following 6.9 kV breaker
replacement
- September 2, 2009, diesel generator 2-02 testing following a maintenance
activity to measure crank shaft deflection
The inspectors selected these activities based upon the structure, system, or
component's ability to affect risk. The inspectors evaluated the activities to ensure the
testing was adequate for the maintenance performed, the acceptance criteria were clear,
and the test ensured equipment operational readiness.
The inspectors evaluated the activities against technical specifications, the Final Safety
Analysis Report, 10 CFR Part 50 requirements, licensee procedures, and various NRC
generic communications to ensure that the test results adequately ensured that the
equipment met the licensing basis and design requirements. In addition, the inspectors
reviewed corrective action documents associated with postmaintenance tests to
determine whether the licensee was identifying problems and entering them into the
corrective action program and that the problems were being corrected commensurate
with their importance to safety. Specific documents reviewed during this inspection are
listed in the attachment.
These activities constituted completion of six postmaintenance testing inspection
samples as defined in Inspection Procedure 71111.19-05.
- 17 - Enclosure
b. Findings
No findings of significance were identified.
1R22 Surveillance Testing (71111.22)
a. Inspection Scope
The inspectors reviewed the Final Safety Analysis Report, procedure requirements,
technical specifications, and corrective action documents to ensure that the surveillance
activities listed below demonstrated that the systems, structures, and/or components
tested were capable of performing their intended safety functions:
Pump or Valve Inservice Test
- August 28, 2009, turbine driven auxiliary feedwater pump discharge to steam
generators check valve testing in accordance with OPT-530B, AFW Check Valve
Reverse Flow Test, Revision 2
Routine Surveillance Testing
- August 12, 2009, diesel generator 1-01 monthly test in accordance with
Procedure OPT-214A, Diesel Generator Operability Test, Revision 19
- September 9, 2009, Unit 2, Channel 0548, steam generator narrow range level
channel operational test in accordance with procedure INC-7332B, Analog
Channel Operational Test and Channel Calibration Steam Generator Narrow
Range Level, Loop 4, Protection Set III, Channel 0548, Revision 1
Reactor Coolant System Leakage Detection Surveillance Testing
- August 3 through 14, 2009, unit 1 reactor coolant leakage calculations performed
in accordance with Procedure OPT-303, Reactor Coolant System Water
Inventory, Revision 13
Containment Isolation Valve Test
- September 16, 2009, local leak rate test for penetration 2-MIII-0022 performed
on March 31, 2008, in accordance with OPT-825B, Appendix J LLRT for
Penetration 2-MIII-0022, Revision 1
The inspectors either witnessed or reviewed test data to verify that the significant
surveillance test attributes were adequate to address the following:
- Preconditioning
- Evaluation of testing impact on the plant
- Acceptance criteria
- Test equipment
- Procedures
- Jumper/lifted lead controls
- Test data
- 18 - Enclosure
- Testing frequency and method demonstrated technical specification operability
- Test equipment removal
- Restoration of plant systems
- Fulfillment of ASME Code requirements
- Updating of performance indicator data
- Reference setting data
- Annunciators and alarms setpoints
Specific documents reviewed during this inspection are listed in the attachment.
These activities constituted completion of five surveillance testing inspection samples
(one in-service test sample, two routine surveillance testing samples, one reactor
coolant system leakage test, and one containment isolation valve test) as defined in
Inspection Procedure 71111.22-05.
b. Findings
No findings of significance were identified.
1EP6 Drill Evaluation (71114.06)
a. Inspection Scope
On August 12, 2009, the inspectors evaluated the conduct of a licensee emergency drill
to identify any weaknesses and deficiencies in classification, notification, and protective
action recommendation development activities. The inspectors observed emergency
response operations in the simulator and technical support center to determine whether
the event classification, notifications, and protective action recommendations were
performed in accordance with procedures. The inspectors also compared any inspector-
observed weakness with those identified by the licensee staff in order to evaluate the
critique and to verify whether the licensee staff was properly identifying weaknesses and
entering them into the corrective action program. As part of the inspection, the
inspectors reviewed the drill package and other documents listed in the attachment.
These activities constituted completion one emergency preparedness drill sample as
defined in Inspection Procedure 71114.06-05.
b. Findings
No findings of significance were identified.
4OA1 Performance Indicator Verification (71151)
.1 Data Submission Issue
a. Inspection Scope
The inspectors performed a review of the data submitted by the licensee for the second
quarter 2009 performance indicators for any obvious inconsistencies prior to its public
release in accordance with NRC Inspection Manual Chapter 0608, Performance
Indicator Program.
- 19 - Enclosure
This review was performed as part of the inspectors normal plant status activities and,
as such, did not constitute a separate inspection sample.
b. Findings
No findings of significance were identified.
.2 Mitigating Systems Performance Index - Emergency ac Power System (MS06)
a. Inspection Scope
The inspectors sampled licensee submittals for the Mitigating Systems Performance
Index - Emergency ac Power System performance indicator for Units 1 and 2 for the
period from the third quarter 2008 through the second quarter 2009. To determine the
accuracy of the performance indicator data reported during those periods, the inspectors
used definitions and guidance contained in Nuclear Energy Institute Document 99-02,
Regulatory Assessment Performance Indicator Guideline, Revision 5. The inspectors
reviewed the licensees operator narrative logs, mitigating systems performance index
derivation reports, issue reports, event reports and NRC integrated inspection reports for
the period of the third quarter 2008 through the second quarter 2009 to validate the
accuracy of the submittals. The inspectors reviewed the mitigating systems performance
index component risk coefficient to determine if it had changed by more than 25 percent
in value since the previous inspection, and if so, that the change was in accordance with
applicable Nuclear Energy Institute guidance. The inspectors also reviewed the
licensees issue report database to determine if any problems had been identified with
the performance indicator data collected or transmitted for this indicator and none were
identified. Specific documents reviewed are described in the attachment to this report.
These activities constitute completion of two mitigating systems performance index
emergency ac power system samples as defined in Inspection Procedure 71151-05.
b. Findings
No findings of significance were identified.
.3 Mitigating Systems Performance Index - High Pressure Injection Systems (MS07)
a. Inspection Scope
The inspectors sampled licensee submittals for the Mitigating Systems Performance
Index - High Pressure Injection Systems performance indicator for Units 1 and 2 for the
period from the third quarter 2008 through the second quarter 2009. To determine the
accuracy of the performance indicator data reported during those periods, the inspectors
used definitions and guidance contained in Nuclear Energy Institute Document 99-02,
Regulatory Assessment Performance Indicator Guideline, Revision 5. The inspectors
reviewed the licensees operator narrative logs, issue reports, mitigating systems
performance index derivation reports, event reports and NRC integrated inspection
reports for the period of the third quarter 2008 through the second quarter 2009 to
validate the accuracy of the submittals. The inspectors reviewed the mitigating systems
performance index component risk coefficient to determine if it had changed by more
- 20 - Enclosure
than 25 percent in value since the previous inspection, and if so, that the change was in
accordance with applicable Nuclear Energy Institute guidance. The inspectors also
reviewed the licensees issue report database to determine if any problems had been
identified with the performance indicator data collected or transmitted for this indicator
and none were identified. Specific documents reviewed are described in the attachment
to this report.
These activities constitute completion of two mitigating systems performance index high
pressure injection system samples as defined in Inspection Procedure 71151-05.
b. Findings
No findings of significance were identified.
.4 Mitigating Systems Performance Index - Heat Removal System (MS08)
a. Inspection Scope
The inspectors sampled licensee submittals for the Mitigating Systems Performance
Index - Heat Removal System performance indicator for Units 1 and 2 for the period
from the third quarter 2008 through the second quarter 2009. To determine the accuracy
of the performance indicator data reported during those periods, the inspectors used
definitions and guidance contained in Nuclear Energy Institute Document 99-02,
Regulatory Assessment Performance Indicator Guideline, Revision 5. The inspectors
reviewed the licensees operator narrative logs, issue reports, event reports, mitigating
systems performance index derivation reports, and NRC integrated inspection reports for
the period of the third quarter 2008 through the second quarter 2009 to validate the
accuracy of the submittals. The inspectors reviewed the Mitigating Systems
Performance Index component risk coefficient to determine if it had changed by more
than 25 percent in value since the previous inspection, and if so, that the change was in
accordance with applicable Nuclear Energy Institute guidance. The inspectors also
reviewed the licensees issue report database to determine if any problems had been
identified with the performance indicator data collected or transmitted for this indicator
and none were identified. Specific documents reviewed are described in the attachment
to this report.
These activities constitute completion of two mitigating systems performance index heat
removal system samples as defined in Inspection Procedure 71151-05.
b. Findings
No findings of significance were identified.
4OA2 Identification and Resolution of Problems (71152)
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency
Preparedness, Public Radiation Safety, Occupational Radiation Safety, and
- 21 - Enclosure
.1 Routine Review of Identification and Resolution of Problems
a. Inspection Scope
As part of the various baseline inspection procedures discussed in previous sections of
this report, the inspectors routinely reviewed issues during baseline inspection activities
and plant status reviews to verify that they were being entered into the licensees
corrective action program at an appropriate threshold, that adequate attention was being
given to timely corrective actions, and that adverse trends were identified and
addressed. The inspectors reviewed attributes that included: the complete and
accurate identification of the problem; the timely correction, commensurate with the
safety significance; the evaluation and disposition of performance issues, generic
implications, common causes, contributing factors, root causes, extent of condition
reviews, and previous occurrences reviews; and the classification, prioritization, focus,
and timeliness of corrective actions. Minor issues entered into the licensees corrective
action program because of the inspectors observations are included in the attached list
of documents reviewed.
These routine reviews for the identification and resolution of problems did not constitute
any additional inspection samples. Instead, by procedure, they were considered an
integral part of the inspections performed during the quarter and documented in
Section 1 of this report.
b. Findings
No findings of significance were identified.
.2 Daily Corrective Action Program Reviews
a. Inspection Scope
In order to assist with the identification of repetitive equipment failures and specific
human performance issues for follow-up, the inspectors performed a daily screening of
items entered into the licensees corrective action program. The inspectors
accomplished this through review of the stations daily corrective action documents.
The inspectors performed these daily reviews as part of their daily plant status
monitoring activities, so these reviews and did not constitute any separate inspection
samples.
b. Findings
No findings of significance were identified.
.3 Semi-Annual Trend Review
a. Inspection Scope
The inspectors performed a review of the licensees corrective action program and
associated documents to identify trends that could indicate the existence of a more
significant safety issue. The inspectors focused their review on repetitive equipment
- 22 - Enclosure
issues, but also considered the results of daily corrective action item screening
discussed in Section 4OA2.2, above, licensee trending efforts, and licensee human
performance results. The inspectors nominally considered the 6-month period of the
second and third quarter 2009, although some examples expanded beyond those dates
where the scope of the trend warranted.
The inspectors also included issues documented outside the normal corrective action
program in major equipment problem lists, repetitive and/or rework maintenance lists,
departmental problem/challenges lists, system health reports, quality assurance
audit/surveillance reports, self-assessment reports, and maintenance rule assessments.
The inspectors compared and contrasted their results with the results contained in the
licensees corrective action program trending reports. Corrective actions associated with
a sample of the issues identified in the licensees trending reports were reviewed for
adequacy.
These activities constitute completion of one semi-annual trend inspection sample as
defined in Inspection Procedure 71152-05.
b. Findings
No findings of significance were identified.
.4 Selected Issue Follow-up Inspection
a. Inspection Scope
The inspectors completed a review of the licensees actions with regard to reactivity
management. The inspectors attended a reactivity management team meeting. The
inspectors discussed reactivity management with the program owner and reviewed
corrective action documents associated with reactivity management. Specific
documents reviewed during this inspection are listed in the attachment.
These activities constitute completion of one in-depth problem identification and
resolution sample as defined in IP 71152-05.
b. Findings
No findings of significance were identified.
4OA5 Other Activities
.1 Quarterly Resident Inspector Observations of Security Personnel and Activities
a. Inspection Scope
During the inspection period, the inspectors performed observations of security force
personnel and activities to ensure that the activities were consistent with the licensees
security procedures and regulatory requirements relating to nuclear plant security.
These observations took place during both normal and off-normal plant working hours.
- 23 - Enclosure
These quarterly resident inspector observations of security force personnel and activities
did not constitute any additional inspection samples. Rather, they were considered an
integral part of the inspectors normal plant status review and inspection activities.
b. Findings
No findings of significance were identified.
.2 Temporary Instruction 2515/175, Emergency Response Organization, Drill/Exercise
Performance Indicator, Program Review
a. Inspection Scope
The inspectors performed Temporary Instruction 2515/175, ensured the completeness of
Attachment 1, and forwarded the data to NRC Headquarters.
b. Findings
No findings of significance were identified.
.3 Institute of Nuclear Power Operations Plant Assessment Report Review
a. Inspection Scope
The inspectors reviewed the final report for the Institute of Nuclear Power Operations
plant assessment for the Comanche Peak Steam Electric Station conducted in
June 2008. The inspectors reviewed the report to ensure that issues identified were
consistent with the NRC perspectives of licensee performance and to verify if any
significant issues were identified that required further NRC follow-up.
b. Findings
No findings of significance were identified.
.4 (Closed) Unresolved Item 05000445/2008006-01; 05000446/2008006-01, Inadequate
Postfire Safe Shutdown Procedure
Introduction. The inspectors identified a noncited violation of Technical
Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire
protection program implementation. Specifically, Procedure ABN-803A, Response to a
Fire in the Control Room or Cable Spreading Room, Revision 8, which is used to
perform an alternate shutdown from outside of the control room, failed to assure that the
charging pump relied on for achieving postfire safe shutdown would not be damaged
because of a loss of suction. During an alternate shutdown, operators use the charging
pump for the reactivity control and reactor coolant makeup functions by providing
borated water from the refueling water storage tank.
Description. During normal plant operations, the chemical and volume control system
provides a continuous feed (charging and seal injection) and bleed (letdown and seal
- 24 - Enclosure
leak-off) for the reactor coolant system. Normally one centrifugal charging pump is in
operation.
In the event of fire in the control room or cable spreading room, operators accomplish
inventory makeup using the train A centrifugal charging pump with the refueling water
storage tank as a source of borated water makeup. Procedure ABN-803A included
steps to establish a suction path from the refueling water storage tank to the charging
pumps. However, the inspectors determined that, if the charging pump credited for safe
shutdown was running at the time of the fire, a spurious closure of one of the two
series-connected volume control tank outlet valves prior to opening one of the refueling
water storage tank outlet valves would result in a loss of suction and damage to the
credited charging pump.
Valves 1-LCV-0112D and 1-LCV-0112E, refueling water storage tank to charging pump
suction, are motor-operated valves connected in parallel to the suction of the charging
pumps. Each valve is controlled from a switch on Panel CB-06 in the control room.
Prior to evacuating the control room and establishing control at the remote shutdown
panel, Procedure ABN-803A, Section 2.3, Step 4(g) directed operators to open
Valves 1-LCV-0112D and 1-LCV-0112E. However, these actions are not credited
because they were not approved by the NRC, since the time available to perform actions
prior to evacuating the control room may be very limited. From a review of related wiring
diagrams, the inspectors determined that the occurrence of a single short to ground for
each valve could preclude the success of this step. In addition, Procedure ABN-803A
includes a back-up action outside the control room to ensure Valve 1-LCV-112E is open;
however, the inspectors determined operators did not complete this step for at least
20 minutes during a walk-through of the procedure. The licensee has entered this issue
into their corrective action program as Smart Form SMF-2009-004453-00.
Analysis. The inspectors determined that, in the event of a postulated fire in the control
room or cable spreading room, the train A centrifugal charging pump may fail from lack
of an open suction path. If the train A pump was running at the time of the fire, a
spurious closure of either volume control tank outlet valves, prior to operators opening
one of the refueling water storage tank outlet valves, would result in a loss of suction and
damage to the pump. The inspectors determined that the failure to ensure that
Procedure ABN-803 contained sufficient instructions to ensure that the train A centrifugal
charging pump would be available following a postulated control room abandonment
was a performance deficiency. This deficiency was more than minor because it was
associated with the protection against external factors attribute of the Mitigating Systems
cornerstone, and affected the cornerstone objective to ensure the availability, reliability,
and capability of systems that respond to external events (such as fire) to prevent
undesirable consequences.
The inspectors evaluated the deficiency using NRC Inspection Manual Chapter 0609,
Appendix F, Fire Protection Significance Determination Process. However, the
deficiency required a Phase 3 evaluation because Manual Chapter 0308, Attachment 3,
Appendix F, Technical Basis for Fire Protection Significance Determination Process for
at Power Operations, states that Manual Chapter 0609, Appendix F, does not include
explicit treatment of fires in the control room.
- 25 - Enclosure
The senior reactor analyst used the fire ignition frequency for the control room (FIFCR)
and the cable spreading room (FIFCSR) listed in the Comanche Peak Steam Electric
Station Individual Plant Examination of External Events for Severe Accident
Vulnerabilities, as the best available information. The analyst multiplied the fire initiation
frequencies by an appropriate severity factor (SF) and a nonsuppression probability. For
the control room, the nonsuppression probability was developed to indicate the chance
that operators failed to extinguish the fire within 20 minutes, assuming 2-minute
detection, leading to abandonment of the control room (NPCRE). For the cable spreading
room, the nonsuppression probability included the probability that the automatic halon
system failed (NPCS-A) and the probability that the fire brigade failed to manually
suppress the fire prior to damage that required abandonment of the control room
(NPCS-M). The resulting control room and cable spreading room evacuation frequencies
(EVAC) were calculated as follows:
Postulated Control Room Fire
EVAC = (FIFCR * SF * NPCRE)
= (1.9 x 10-2/year * 0.1 * 1.3 x 10-2)
= 2.5 x 10-5/year
Postulated Cable Spreading Room Fire
EVAC = (FIFCSR * SF * NPCS-A * NPCS-M)
= (3.2 x 10-3/year * 0.1 * 5.0 x 10-2 * 2.4 x 10-1)
= 3.8 x 10-6/year
The control room has 116 panels for Unit 1 and common equipment, each unit cable
spreading room has 99 electrical panels. The circuitry for the volume control tank valves
are located in 6 different panels in the control room, one which contains cabling for both
valves, and 2 termination cabinets in the cable spreading room. Additionally, at least
one smart short would have to occur in the cabinet to fail the valve closed. The analyst
estimated the probability of this short to be 0.6 using accepted industry values. Finally,
as stated above, the performance deficiency will only impact risk if the train A pump is
operating at the time of the postulated fire. This represents a 0.5 probability that one of
two centrifugal charging pumps is running (PPUMP).
The resulting probability that a control room fire would affect the panels and/or cabinets
of interest (PCR-Affected) is the fraction 5/116 multiplied by the probability of having a single
smart short in the cabinet plus the fraction 1/116 multiplied by the probability of having
one of two smart shorts in the cabinet (3.3 x 10-2). Likewise, the probability that a cable
spreading room fire would affect the panels and/or cabinets of interest (PCSR-Affected) is the
fraction 2/99 multiplied by the probability of having a smart short in the cabinet
or 1.2 x 10-2. The intersections of postulated fires in either fire area that affect either of
the subject valves, while the train A pump is running, and leading to control room
abandonment (intersection) were calculated as follows:
- 26 - Enclosure
Postulated Control Room Fire
intersection = PCR-Affected * PPUMP * EVAC
= 3.3 x 10-2 * 0.5 * 2.5 x 10-5/year
= 4.1 x 10-7/year
Postulated Cable Spreading Room Fire
intersection = PAffected * PPUMP * EVAC
= 1.2 x 10-2 * 0.5 * 3.8 x 10-6/year
= 2.3 x 10-8/year
The analyst determined the delta conditional core damage probability (CCDP) by
subtracting the base case conditional core damage probability for a control room
abandonment (0.1) from the bounding fire damage conditional core damage probability
(1.0) for a value of 0.9. The bounding delta conditional core damage frequencies
(CDF) for a 1-year exposure (EXP), representing the current assessment period, were
calculated by multiplying the frequencies of occurrence by the delta conditional core
damage probability as follows:
Postulated Control Room Fire
CDF = intersection * CCDP * EXP
= 4.1 x 10-7/year * 0.9 * 1 year
= 3.7 x 10-7
Postulated Cable Spreading Room Fire
CDF = intersection * CCDP * EXP
= 2.3 x 10-8/year * 0.9 * 1 year
= 2.1 x 10-8
Because postulated fire ignition frequencies for the control room and the cable spreading
room are independent from each other, the total CDF can be determined by simple
addition of the two probabilities above (3.9 x 10-7).
In accordance with Manual Chapter 0609, Appendix A, Attachment 1, step 2.2.6,
Screen for the Potential Risk Contribution Due to Large Early Release Frequency
(LERF), the finding was screened for its potential risk contribution to the large, early
release frequency because the total CDF was greater than 1 x 10-7. The analyst
evaluated the affect of the finding on the large, early release frequency in accordance
with Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance
Determination Process. Given that Comanche Peak has a large, dry containment and
that control room abandonment sequences do not include steam generator tube ruptures
or intersystem loss of coolant accidents, the analyst determined that this finding was not
significant with respect to the large-early release frequency. Therefore, the analyst
determined this finding was of very low risk significance (Green).
Enforcement. Technical Specification 5.4.1.d states that written procedures shall be
established, implemented, and maintained covering fire protection program
implementation. Procedure ABN-803A, Revision 8, implements this requirement for fires
- 27 - Enclosure
requiring the control room to be evacuated. Contrary to the above, the licensee failed to
provide adequate procedures for implementing the fire protection program. Specifically,
the procedural guidance for implementing the postfire safe shutdown strategy would fail
to prevent damage to the credited centrifugal charging pump if it was in operation at the
time of a fire requiring an evacuation of the control room.
Since the violation was of very low safety significance and was documented in the
licensees corrective action program as Smart Form SMF-2009-004453-00, it is being
treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement
Policy: NCV 05000445/2009004-04; 00500446/2009004-04, Inadequate Postfire Safe
Shutdown Procedure.
.5 (Closed) Unresolved Item 05000445/2008006-02; 05000446/2008006-02, Unapproved
Local Manual Actions For Hot Shutdown
Introduction. The inspectors identified a Green noncited violation of Unit 1 License
Condition 2.G and Unit 2 License Condition 2.G. Specifically, the licensee failed to
ensure that one train of the equipment required to achieve and maintain safe hot
shutdown conditions remained free from fire damage as specified in the approved fire
protection program. The licensee relied upon local manual actions to mitigate the effects
of potential fire damage rather than provide the physical separation or protection
required in the approved fire protection program.
Description. The inspectors reviewed a sample of three fire areas in Unit 1, which do not
require evacuation of the control room during the shutdown. The inspectors reviewed
the approved fire protection program as defined in License Condition 2.G and
determined that one train of equipment required to achieve and maintain hot shutdown is
required to be free from fire damage. The inspectors noted that the approved fire
protection program allows local manual actions to respond to spurious operations of
other equipment that could impact the safe shutdown but do not directly perform the
required safe shutdown functions.
The inspectors conducted walkdowns with operations personnel of
Procedure ABN-804A, Response To a Fire In The Safeguards Building,
Revision 5, and Procedure ABN-806A, Response To a Fire In The Electrical and
Control Buildings, Revision 5. The inspectors found that the fire protection program, as
implemented, relied on the use of local manual actions to align and control equipment
required to achieve and maintain hot shutdown resulting from potential fire damage
instead of assuring that one train was free from fire damage. This approach expanded
the use of local operator manual actions outside of the control room beyond the
response to spurious operations allowed in the approved fire protection program.
The inspectors concluded that the licensees fire protection program, as implemented,
provided less physical separation and protection from the affects of fire than the
approved program required, and was inherently less reliable than ensuring that one train
of the required systems remained free from fire damage.
An example of this concern was the licensees treatment of air-operated valves in the
charging and auxiliary feedwater systems, which were required to perform the reactor
coolant inventory control and decay heat removal functions, respectively. The licensee
did not designate the instrument air system as a required support system and ensure it
- 28 - Enclosure
would remain free of fire damage, so air may not be available to operate these
air-operated valves. Consistent with this approach, the licensee did not protect the
circuits required to operate these air-operated valves from fire damage. These
air-operated valves are normally controlled from the control room to reach and maintain
hot shutdown. For postfire safe shutdown, the licensee did not assure the ability to
control these valves from the control room by protecting valve control circuits or the air
supply. Instead, the licensee relies on local manual actions outside of the control room
to de-energize the air-operated valves to their failed positions, and in the case of the
turbine-driven auxiliary feedwater pump, to then control the turbine manually. The
licensee also assigns an equipment operator to control flow to the steam generators by
throttling other manual valves as directed by the control room operators via radio to
compensate for the loss of control of the air-operated valves.
The licensee disagreed with the inspectors interpretation of the fire protection program
requirements and believed the current program complies with their license condition.
The licensee submitted the basis for their position in Luminant letter CP-200800962,
TXX-08105, dated July 24, 2008. This issue was discussed with the license and the
Office of Nuclear Reactor Regulation, and the staff has concluded that the NRC did not
approve manual actions in lieu of protection for equipment required for safe shutdown
(refer to Attachment 2 of this report).
Comanche Peak Unit 1 License Condition 2.G states:
Luminant Generation Company LLC shall implement and maintain in effect all
provisions of the approved fire protection program as described in the Final
Safety Analysis Report through Amendment 78 and as approved in the SER
(NUREG-0797) and its supplements through SSER 24.
In Supplemental Safety Evaluation Report 12, the NRC staff documented the review of
the AFire Protection of the Safe Shutdown Capability@ against the guidelines of Standard
Review Plan Section 9.5.1, Position C.5.b. The NRC staff concluded:
AThe applicant's analysis indicates that at least one of the redundant trains
needed for safe shutdown would be free of fire damage by providing separation,
fire barriers, and/or alternative shutdown capability;@
and
AAssociated circuits whose fire-induced spurious operation could affect shutdown
were identified to determine those components whose maloperation could affect
safe shutdown. These spurious operations are terminated by operator actions.
The applicant identified these operator actions and allowed the operator sufficient
time to perform these actions. On the basis of its evaluation, the staff concludes
that these operator actions will terminate spurious operations that could affect
plant shutdown.@ (Emphasis added)
The manual actions discussed related to spurious actuations resulting from damage to
associated circuits. The NRC staff did not discuss or approve any deviations from the
requirements for physical separation or protection specified in the standard review plan
to allow the use of local operator manual actions to operate components necessary to
- 29 - Enclosure
achieve or maintain hot shutdown. The licensee has entered this issue into their
corrective action program as Smart Form SMF-2009-004454-00.
Analysis. Failure to ensure that one train of the systems required for hot shutdown was
free from fire damage was a performance deficiency. The inspectors determined that
this finding was more than minor because it is associated with the protection against
external factors attribute of the Mitigating Systems cornerstone, and affected the
cornerstone objective to ensure the availability, reliability, and capability of systems that
respond to external events (such as fire) to prevent undesirable consequences.
The inspectors initiated an evaluation of this finding using the significance determination
process in Manual Chapter 0609, Appendix F, Fire Protection Significance
Determination Process, because it affected fire protection defense-in-depth strategies
involving postfire safe shutdown systems. Additional information was required from the
licensee concerning the scope of components identified as requiring manual actions, the
fire areas where the manual actions were required and the routing of the cables of
interest within those fire areas for Unit 1. Thirty-three components required to achieve
and maintain hot shutdown were identified for further evaluation. Plant walkdowns were
performed in 12 fire areas to identify fire scenarios that could potentially damage the
cables of interest for these 33 valves credited for establishing and maintaining hot
shutdown.
Using the methodology in Manual Chapter 0609, Appendix F, the plant walkdown results
identified seven fire scenarios in three fire areas with the potential to damage cables for
eleven valves required to establish and maintain hot shutdown. Since the issue involved
multiple fire areas, a modified Phase 2 analysis was developed to access the risk due to
the seven fire scenarios. The analysis was reviewed by a senior reactor analyst, who
confirmed the issue resulted in a total delta core damage frequency of 3.7 x 10-7 and that
the issue had very low safety significance.
Enforcement. The Unit 1 License Condition 2.G states, Luminant Generation Company
LLC shall implement and maintain in effect all provisions of the approved fire protection
program as described in the Final Safety Analysis Report through Amendment 78 and as
approved in the SER (NUREG-0797) and its supplements through SSER 24. In
Supplemental Safety Evaluation Report 12, the NRC staff concluded from review of the
AFire Protection of the Safe Shutdown Capability@ against the guidelines of Standard
Review Plan Section 9.5.1, Position C.5.b, AThe applicant's analysis indicates that at
least one of the redundant trains needed for safe shutdown would be free of fire damage
by providing separation, fire barriers, and/or alternative shutdown capability.
Contrary to the above, the licensee failed to properly implement the approved fire
protection program. Specifically, the licensee did not assure that one train of equipment
required to achieve and maintain safe hot shutdown conditions remained free from fire
damage. The fire protection program, as implemented, relied on the use of local
operator manual actions to operate components required to achieve and maintain safe
hot shutdown conditions resulting from potential fire damage thus providing less physical
separation and protection from the affects of fire than required by the approved fire
protection program.
- 30 - Enclosure
Since the violation was of very low safety significance and was documented in the
licensees corrective action program as Smart Form SMF-2009-004454-00, it is being
treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement
Policy: NCV 05000445/2009004-05; 00500446/2009004-05, Failure to Assure that One
Train of Equipment is Free From Fire Damage.
.6 (Closed) Unresolved Item 05000445/2008006-03; 05000446/2008006-03, Inadequate
Alternative Shutdown Procedure
Introduction. The inspectors identified a Green noncited violation of Technical
Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire
protection program implementation. Specifically, Procedure ABN-803A, Response to a
Fire in the Control Room or Cable Spreading Room, that is used to perform an alternate
shutdown, had two examples of critical actions that could not be completed in the time
required by the postfire safe shutdown analysis. The licensee documented this
deficiency in Smart Form SMF-2009-004455.
Description. Technical Specification 5.4.1.d states that written procedures shall be
established, implemented, and maintained covering fire protection program
implementation. Alternate shutdown at the Comanche Peak Steam Electric Station
requires operators to safely shutdown the plant in accordance with Procedure ABN-803A
for Unit 1 for fire in the control room or cable spreading room requiring evacuation of the
control room.
The inspectors performed a walkthrough of Procedure ABN-803A for a simulated fire in
either the control room or cable spreading room that required operators to shutdown the
plant using manual actions and controls at the remote shutdown panel.
Procedure ABN-803A, Attachment 13 specified the maximum allowable times to
complete certain actions. The inspectors noted during the timed walkthrough by
operators that the following actions could not be performed within the required times.
Example 1 - Spurious Opening of the Train A Power-Operated Relief Valve
A fire in either the control room or cable spreading room could result in a
power-operated relief valve spuriously opening. To close the trains A and B
power-operated relief valves, a relief reactor operator would, in accordance with
Procedure ABN-803A, Attachment 2, transfer control of the power-operated relief valves
from the control room to the remote shutdown panel. When this is accomplished, the fire
induced hot short would be isolated and the power-operated relief valve would return to
its closed position. According to Attachment 13 of Procedure ABN-803A, operators must
complete this action within 5 minutes to avoid empting the pressurizer.
Procedure ABN-803A, Attachment 2, step D instructed the relief reactor operator to
transfer control of 46 switches at the transfer panel from the control room to the remote
shutdown panel. The inspectors timed the completion of all 46 transfer switches to be 7
minutes and 24 seconds. The inspectors estimated that the transfer of the train A
power-operated relief valve would occur at approximately 6 minutes. Attachment 2,
step C, stated that the transfer of the 46 switches cannot be started until communication
has been established with the reactor operator at the remote shutdown panel.
- 31 - Enclosure
The inspectors determined from the walkthrough that the reactor operator performing
Attachment 1 would not reach the remote shutdown panel until 4 minutes and
26 seconds after the reactor was tripped. Thus, the relief reactor operator could not
procedurally start the transfer switch process until 4 minutes and 26 seconds, which
delayed these actions. The inspectors estimated that the train A power-operated relief
valve would not be closed until 10 minutes and 26 seconds after the reactor trip, which
exceeded the 5 minute requirement in Procedure ABN-803A.
Example 2 - Loss of Station Service Water Cooling to the Emergency Diesel Generators
A fire in either the control room or cable spreading room could result in a loss-of-offsite
power with the subsequent automatic start of both emergency diesel generators. In
addition, the fire could also cause damage to the circuits of the station service water
system resulting in the loss of cooling to the emergency diesel generators.
Procedure ABN-803A, Attachment 1, step F, instructs the reactor operator to initiate
station service water at the remote shutdown panel if it is not operating. The inspectors
timed the completion of this step at 12 minutes and 7 seconds. Attachment 13 states
that station service water must be initiated within 7 minutes.
In Procedure ABN-803A, Attachment 2, step F, the relief reactor operator transfers the
train A emergency diesel generator controls to LOCAL. If the emergency diesel
generator had undergone an emergency start from standby, the automatic high
temperature trip would be bypassed. The relief reactor operator should recognize at this
step that station service water cooling was not available and shut down the running
emergency diesel generator at 9 minutes and 45 seconds.
The licensee provided the inspectors Evaluation 2003-000404-01-00, which analyzed
the effects of the loss of station service water cooling on emergency diesel water jacket
water temperature. The analysis determined that during the summer, if the emergency
diesel generator emergency starts from standby with a load of 6.3 MW, the time to
failure of the emergency diesel generator would be 4 minutes and 4 seconds. The time
to failure without cooling water under the expected load during postfire safe shutdown
has not been specifically analyzed.
Fire damage resulting in the automatic starting of the credited emergency diesel
generator without starting the required station service water cooling could result in the
loss of the electrical power supply credited for postfire safe shutdown since the
procedure removes offsite power.
Analysis. The inspectors and a senior reactor analyst evaluated each example of the
violation as described below.
Example 1 - Spurious Opening of the Train A Power-Operated Relief Valve
In the event of a postulated fire in the control room or cable spreading room, a
pressurizer power-operated relief valve may spuriously open from fire damage.
Inspectors determined that, by following Attachment 2 of Procedure ABN-803A,
operators would not be able to close the open valve in a timely manner. This could
result in the emptying of the pressurizer before level control could be established
following a postulated control room abandonment. Failure to provide adequate
- 32 - Enclosure
procedural guidance to implement the requirements of the approved fire protection
program was a performance deficiency. The inspectors determined that this deficiency
was more than minor because it is associated with the protection against external factors
attribute of the Mitigating Systems cornerstone and could affect the availability, reliability,
and capability of systems that respond to external events (such as fire) to prevent
undesirable consequences.
The inspectors evaluated the deficiency using NRC Inspection Manual Chapter 0609,
Appendix F, Fire Protection Significance Determination Process. However, the
deficiency required a Phase 3 evaluation because Manual Chapter 0308, Attachment 3,
Appendix F, Technical Basis for Fire Protection Significance Determination Process for
at Power Operations, states that Manual Chapter 0609, Appendix F, does not include
explicit treatment of fires in the control room.
As documented in Section 4OA5.4 of this inspection report, the analyst determined that
the control room abandonment frequencies were 2.5 x 10-5/year for postulated control
room fires and 3.8 x 10-6/year for postulated cable spreading room fires.
The controls and cabling for the power-operated relief valve are located in three different
panels in the control room, one which contains cabling for both valves, and two
termination cabinets in the cable spreading room. Additionally, at least one smart short
would have to occur in the cabinet to fail a single valve open. The analyst estimated the
conditional probability of this short to be 0.6 using accepted industry values.
The resulting probability that a control room fire would affect the panels and/or cabinets
of interest (PCR-Affected) is the fraction 2/116 multiplied by the probability of having a single
smart short in the cabinet plus the fraction 1/116 multiplied by the probability of having
one of two smart shorts in the cabinet (1.8 x 10-2). Likewise, the probability that a cable
spreading room fire would affect the panels and/or cabinets of interest (PCSR-Affected) is the
fraction 2/99 multiplied by the probability of having a smart short in the cabinet
or 1.2 x 10-2. The intersections of postulated fires in either fire area that affect either of
the subject valves leading to control room abandonment (intersection) were calculated as
follows:
Postulated Control Room Fire
intersection = PCR-Affected * EVAC
= 1.8 x 10-2 * 2.5 x 10-5/year
= 4.3 x 10-7/year
Postulated Cable Spreading Room Fire
intersection = PCSR-Affected * EVAC
= 1.2 x 10-2 * 3.8 x 10-6/year
= 4.7 x 10-8/year
As documented in Section 4OA5.4 of this inspection report, the analyst determined that
the bounding delta conditional core damage probability for control room abandonment
scenarios was 0.9. Therefore, the bounding CDFs for an exposure period of 1 year
were calculated as follows:
- 33 - Enclosure
Postulated Control Room Fire
CDF = intersection * CCDP * EXP
= 4.3 x 10-7/year * 0.9 * 1 year
= 3.9 x 10-7
Postulated Cable Spreading Room Fire
CDF = intersection * CCDP * EXP
= 4.7 x 10-8/year * 0.9 * 1 year
= 4.2 x 10-8
Because postulated fire ignition frequencies for the control room and the cable spreading
room are independent from each other, the total CDF can be determined by simple
addition of the two probabilities above (4.3 x 10-7). As documented in Section 4OA5.4,
the analyst determined that this finding was not significant with respect to the large-early
release frequency. Therefore, the analyst determined that this finding was of very low
risk significance (Green).
Example 2 - Loss of Station Service Water Cooling to the Emergency Diesel Generators
In the event of a postulated fire in the control room or cable spreading room, an
automatic start of the train A emergency diesel generator could occur coincident with a
fire-induced failure to provide cooling to the diesel via the station service water system.
The inspectors determined that, by following Procedure ABN-803A, Attachment 1,
operators would not be able to initiate station service water cooling in a timely manner.
This could result in the failure of the electrical power supply credited following a
postulated control room abandonment, namely the train A emergency diesel generator.
Failure to provide adequate procedural guidance to implement the requirements of the
approved fire protection program was a performance deficiency. The inspectors
determined that this deficiency was more than minor because it is associated with the
protection against external factors attribute of the Mitigating Systems cornerstone and
could affect the availability, reliability, and capability of systems that respond to external
events (such as fire) to prevent undesirable consequences.
The inspectors evaluated the deficiency using NRC Inspection Manual Chapter 0609,
Appendix F, Fire Protection Significance Determination Process. However, the
deficiency required a Phase 3 evaluation because Manual Chapter 0308, Attachment 3,
Appendix F, Technical Basis for Fire Protection Significance Determination Process for
at Power Operations, states that Manual Chapter 0609, Appendix F, does not include
explicit treatment of fires in the control room.
As documented in Section 4OA5.4 of this inspection report, the analyst determined that
the control room abandonment frequencies were 2.5 x 10-5/year for postulated control
room fires and 3.8 x 10-6/year for postulated cable spreading room fires.
The controls and cabling for the power-operated relief are located in three different
panels in the control room, one which contains cabling for both valves, and two
termination cabinets in the cable spreading room. Additionally, at least one smart short
would have to occur in the cabinet to fail a single valve open. The analyst estimated the
conditional probability of this short to be 0.6 using accepted industry values.
- 34 - Enclosure
The resulting probability that a control room fire would affect the panels and/or cabinets
of interest (PCR-Affected) is the fraction 2/116 multiplied by the probability of having a single
smart short in the cabinet plus the fraction 1/116 multiplied by the probability of having
one of two smart shorts in the cabinet (1.8 x 10-2). Likewise, the probability that a cable
spreading room fire would affect the panels and/or cabinets of interest (PCSR-Affected) is the
fraction 2/99 multiplied by the probability of having a smart short in the cabinet
or 1.2 x 10-2. The intersections of postulated fires in either fire area that affect either of
the subject valves leading to control room abandonment (intersection) were calculated as
follows:
Postulated Control Room Fire
intersection = PCR-Affected * EVAC
= 1.8 x 10-2 * 2.5 x 10-5/year
= 4.3 x 10-7/year
Postulated Cable Spreading Room Fire
intersection = PCSR-Affected * EVAC
= 1.2 x 10-2 * 3.8 x 10-6/year
= 4.7 x 10-8/year
As documented in Section 4OA5.4 of this inspection report, the analyst determined that
the bounding delta conditional core damage probability for control room abandonment
scenarios was 0.9. Therefore, the bounding CDFs for an exposure period of 1 year
were calculated as follows:
Postulated Control Room Fire
CDF = intersection * CCDP * EXP
= 4.3 x 10-7/year * 0.9 * 1 year
= 3.9 x 10-7
Postulated Cable Spreading Room Fire
CDF = intersection * CCDP * EXP
= 4.7 x 10-8/year * 0.9 * 1 year
= 4.2 x 10-8
Because postulated fire ignition frequencies for the control room and the cable spreading
room are independent from each other, the total CDF can be determined by simple
addition of the two probabilities above (4.3 x 10-7). As documented in Section 4OA5.4,
the analyst determined that this finding was not significant with respect to the large-early
release frequency. Therefore, the analyst determined that this finding was of very low
risk significance (Green).
As a compensatory measure, the licensee issued night orders to alert operators of these
procedural concerns and has entered these issues into their corrective action program
as Smart Form SMF-2009-004455-00.
- 35 - Enclosure
Enforcement. Technical Specification 5.4.1.d states that written procedures shall be
established, implemented, and maintained covering fire protection program
implementation. Procedure ABN-803A, Revision 8 implemented the requirements for
fires when the control room must be evacuated. The maximum times for operators to
align the systems used for hot shutdown and to respond to spurious actuations because
of fire damage were listed in Engineering Report ENR-2005-000316-01-00,
Thermal/Hydraulic Analysis of the Fire Safe Shutdown Scenario, Revision 0.
Contrary to the above, the licensee failed to provide adequate procedural guidance for
implementing their fire protection program. Specifically, for postfire safe shutdown
operations the license provided inadequate procedural guidance for the timely
(1) closure of a spuriously open power-operated relief valve and (2) securing the
emergency diesel generator without service water cooling available to prevent potential
damage. This finding could impact the ability to control reactor coolant system inventory
and pressure and assure an electrical power supply to support the safe shutdown
operations.
Since the violation was of very low safety significance and was documented in the
licensees corrective action program as Smart Form SMF-2009-004455-00, it is being
treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement
Policy: NCV 05000445/2009004-06; 00500446/2009004-06, Inadequate Alternative
Shutdown Procedure.
4OA6 Meetings
Exit Meeting Summary
On August 18, 2009, the inspector presented the results of the fire protection triennial
inspection unresolved items closeout to Mr. M. Lucas, Site Vice President, and other
members of the licensee staff. The licensee acknowledged the information presented.
On October 1, 2009, the inspectors presented the resident inspection results to
Mr. R. Flores, Senior Vice President and Chief Nuclear Officer, and other members of
the licensee staff. The licensee acknowledged the issues presented. The inspectors
acknowledged review of proprietary material during the inspection. No proprietary
information has been included in the report.
- 36 - Enclosure
ATTACHMENT 1
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee Personnel
R. Flores, Senior Vice President and Chief Nuclear Officer
M. Lucas, Site Vice President
S. Bradley, Manager, Radiation Protection
D. Fuller, Manager, Emergency Preparedness
T. Hope, Manager, Nuclear Licensing
D. Kross, Plant Manager
F. Madden, Director, Oversight and Regulatory Affairs
B. Mays, Director, Site Engineering
B. Patrick, Director, Maintenance
M. Pearson, Director, Performance Improvement
S. Sewell, Director, Operations
K. Tate, Manager, Security
D. Wilder, Manager, Plant Support
NRC Personnel
J. Kramer, Senior Resident Inspector
B. Tindell, Resident Inspector
LIST OF ITEMS OPENED AND CLOSED
Opened and Closed
05000446/2009004-01 NCV Failure to Seal Electrical Enclosure (Section 1R05)05000446/2009004-02 NCV Failure to Seal Electrical Penetrations (Section 1R06)05000445/2009004-03
NCV Failure to Control Transient Equipment (Section 1R18)05000446/2009004-03
05000445/2009004-04 Inadequate Postfire Safe Shutdown Procedure
NCV 05000446/2009004-04 (Section 4OA5.4)05000445/2009004-05 Failure to Assure That One Train of Equipment Is Free
NCV 05000446/2009004-05 From Fire Damage (Section 4OA5.5)05000445/2009004-06 NCV Inadequate Alternative Shutdown Procedure
A1-1 Attachment 1
Opened and Closed
05000446/2009004-06 (Section 4OA5.6)
Closed
URI Inadequate Postfire Safe Shutdown Procedure
05000445/2008006-02
URI Unapproved Local Manual Actions For Hot Shutdown
05000445/2008006-04
URI Inadequate Alternative Shutdown Procedure
LIST OF DOCUMENTS REVIEWED
Section 1RO5: Fire Protection
PROCEDURES
NUMBER TITLE REVISION
ABN-901 Fire Protection System Alarms or Malfunctions 8
FPI-510 Electrical and Control Building Chiller Pump Rooms 3
ABN-805B Response to Fire in the Auxiliary Building or the Fuel 4
Building
ABN-806B Response to Fire in the Electrical and Control Building 3
SMART FORMS
SMF-2009-001001-00 SMF-2009-000720-00 SMF-2009-000714-00
Section 1R12: Maintenance Effectiveness
SMART FORMS
SMF-2009-004780-00
A1-2 Attachment 1
OTHER DOCUMENTS
Maintenance Rule Review Panel meetings 04-0226, 06-0321, & 09-0909
EVAL-2005-003441-06
Section 1R15: Operability Evaluations
PROCEDURES
NUMBER TITLE REVISION
MSM-C0-3831 Emergency Diesel Engine Cylinder Head Maintenance 3
WORK ORDERS
3756843 3770269
SMART FORMS
SMF-2009-003342-00 SMF-2009-003309-00 SMF-2009-004117-00
Section 1R18: Plant Modifications
PROCEDURES
NUMBER TITLE REVISION
STA-602 Temporary Modifications and Transient Equipment 16
STA-606 Control of Maintenance and Work Activities 29
10 CFR 50.59 Resource Manual 3
SMART FORMS
SMF-1999-001657-00 SMF-2009-001548-00 SMF-2008-003987-00 SMF-2009-001773-00
WORK ORDERS
2-07-173391-00
A1-3 Attachment 1
Section 1R19: Postmaintenance Testing
PROCEDURES
NUMBER TITLE REVISION
MSM-P0-3343 Emergency Diesel Engine Crankshaft Deflection and 2
Thrust Measurements
MSE-G0-6300 Breaker Enhancement Removal, Enhancement and 0
Installation
SOP-630A 6900 V Switchgear 14
IONC-210 Instrumentation Tubing and Supports Installation and 4
Rework
INC-2031 Valve Calibration Using Viper Control Valve Diagnostic 0
System
INC-2012 Valve Calibration Fisher Controls Type 657 Air-to-Close 4
Valve Actuators
MSM-C0-6604 Fisher Diaphragm Actuator Maintenance (Type 657, Sizes 4
30 - 60)
MSG-1060 Electrical Terminations (Wire Sizes 26 awg thru 10 awg) 1
MSE-G0-1212 Low Voltage Insulating Material Installation 4
OPT-204A SI System 13
WORK ORDERS
367376 397278 3766683 3665095
SMART FORMS
SMF-2009-004117-00
A1-4 Attachment 1
Section 1R22: Surveillance Testing
PROCEDURES
NUMBER TITLE REVISION
TDM-804A Equipment Data Tank Height VS Volume 2
OPT-303 Reactor Coolant System Water Inventory 13
INC-7332B Analog Channel Operational Test and Channel Calibration 1
Steam Generator Narrow Range Level
WORK ORDERS
3749480 3749478 3749476 3749474
SMART FORMS
SMF-2009-003905-00 SMF-2009-004038-00 SMF-2009-004058-00 SMF-2009-004630-00
Section 1EP6: Drill Evaluation
SMART FORMS
SMF-2009-004095-00 SMF-2009-004096-00 SMF-2009-004099-00 SMF-2009-004100-00
SMF-2009-004102-00 SMF-2009-004103-00
Section 4OA1: Performance Indicator Verification
SMART FORMS
SMF-2008-003132-00
Section 4OA2: Identification and Resolution of Problems
PROCEDURES
NUMBER TITLE REVISION
OPT-308 Estimated Critical Condition Calculation 8
A1-5 Attachment 1
Section 4OA5: Other Activities
DRAWINGS
NUMBER TITLE REVISION
M1-0202 Flow Diagram Main Steam Reheat and Steam Dump CP-33
M1-0202, Sheet 03 Flow Diagram Main Steam Reheat and Steam Dump CP-2
M1-0206 Flow Diagram Auxiliary Feedwater System CP-20
M1-0206, Sheet 01 Flow Diagram Auxiliary Feedwater Trains CP-14
M1-0253 Flow Diagram Chemical and Volume Control System CP-21
M1-0253, Sheet A Flow Diagram Chemical and Volume Control System CP-10
M1-0255 Flow Diagram Chemical and Volume Control System CP-27
Volume Control Tank Loop
M1-0255, Sheet 01 Flow Diagram Chemical and Volume Control System CP-23
Charging and Positive Pump Trains
M1-0229, Sheet A Flow Diagram Component Cooling Water System CP-21
M1-0229, Sheet B Flow Diagram Component Cooling Water System CP-25
2323-EI-0601-11 Safeguard Building Cable Tray Segments Elevation 4
790-6
2323-EI-0603-11 Safeguard Building Cable Tray Segments Elevation 4
852-6
2323-EI-0713-12 Auxiliary and Electrical Control Buildings Cable Tray 6
Segments Elevation 790-6 & 792-0
2323-EI-0716-12 Electrical Equipment Area Cable Tray Segments 4
Elevation 810-6
2323-EI-0717-12 Auxiliary and Electrical Control Buildings Cable Tray 4
Segments Elevation 832-0
2323-EI-0603-11 Safeguard Building Cable Tray Segments Elevation 4
852-6
PROCEDURES
NUMBER TITLE REVISION
ABN-803A Response To a Fire In The Control Room or Cable Spreading 8
Room
ABN-804A Response To a Fire In The Safeguards Building 5
A1-6 Attachment 1
NUMBER TITLE REVISION
Response to Fire in the Auxiliary Building or the Fuel Building
ABN-805A 5
ABN-806A Response To a Fire In The Electrical and Control Buildings 5
SOP-304A Auxiliary Feedwater System 16
MISCELLANEOUS DOCUMENTS
NUMBER TITLE REVISION /
DATE
CPSES Fire Protection Report 3, 6, and 27
License Number Luminant Generation Company LLC, Docket Number Amendment
NPF-87 50-445, Comanche Peak Steam Electric Station, Unit 139
Number 1, Facility Operating License
FSAR Section 9.5.1 Fire Protection Program Amendments
78 & 87
50000445/87-22 NRC Inspection Report January 11,
1988
50000445/8839, NRC Inspection Report June 24, 1988
50000446/8833
NUREG-0797 Safety Evaluation Report Related to the Operation July 1981
Comanche Peak Steam Electric Station
NUREG-0797 Safety Evaluation Report Related to the Operation Supplements
Comanche Peak Steam Electric Station 12, 21, 23, 25,
26, and 27
A1-7 Attachment 1
ATTACHMENT 2
RESULTS OF THE STAFF'S REVIEW OF MANUAL ACTIONS IN THE LICENSING BASIS
Background
On July 24, 2008, Luminant Power submitted letter serial CP-200800962, TXX-08105, entitled
Comanche Peak Licensing Basis on Use of Manual Actions for Fire Protection. This was
submitted in response to the NRC's issuance of Unresolved Item 05000445/2008006-02;
05000446/2008006-02, Unapproved Local Manual Actions for Hot Shutdown. This letter
requested that the staff consider information provided in the attachment of the letter in the
resolution of Unresolved Item 05000445/2008006-02; 05000446/2008006-02.
The following discussion addresses how the staff considered the licensee's information and
provides the staff's conclusions.
NRC Staff Review
The NRC agreed to review the issues discussed in the licensee's letter. The lead inspector and
a senior reactor analyst visited the site to discuss the licensee's information and the NRC
understanding of their licensing basis. In addition, conference calls were held with licensee
management on July 14 and 29, 2009. As discussed in Section 4OA5 of this report, the staff
has confirmed that the unresolved item was associated with a violation of NRC requirements.
The basis for this conclusion is expanded upon here.
The licensee's letter documented why they believed that the NRC approved manual actions
within the fire protection program. Inspections had previously attempted to resolve this same
question, but had been unable to resolve the meaning of unclear references that interconnected
multiple documents. However, during the 2008 triennial fire protection inspection, it became
apparent that the proper issue that needed to be resolved related to whether the licensee met
the requirements for protecting and separating components identified by the licensee as
required to achieve and maintain a hot shutdown condition in the event of a fire. These required
components must be protected and separated so that they remain free of fire damage. The
manual actions of concern could only be assessed in the context of whether or not they were
intended to restore redundant trains of required equipment because of inadequate protection
and separation.
The staff's review of the documents that comprise the approved fire protection program are
specified in License Condition 2.G, which states:
Luminant Generation Company LLC shall implement and maintain in effect all the
provisions of the approved fire protection program as described in the Final Safety
Analysis Report through Amendment 78 and as approved in the SER (safety evaluation
report) (NUREG-0797) and its supplements through SSER (supplemental safety
evaluation report) 24, subject to the following provision:
Luminant Generation Company LLC may make changes to the approved fire protection
program without prior approval of the Commission only if those changes would not
adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.
In each of the documents that comprise the fire protection program defined by the license
condition that were submitted by the then-applicant, the applicant described that one of the
three methods that listed in 10 CFR 50, Appendix R, Section III.G.2 would be used to satisfy the
NRC-required separation and protection schemes when more than one train of redundant
A2-1 Attachment 2
equipment was located in the same fire area, unless another method was justified. The staff
concluded that such a justification for an alternate method of compliance would necessarily
require a specific request for the staff to approve a deviation from the existing separation and
protection requirements. The staff's review concluded that there were no deviations requested
to substitute manual actions for recovering the use of required equipment that was susceptible
to fire damage, and therefore no justification was provided to the NRC for approval.
The staff also noted that for each section of the Fire Hazards Analysis dealing with a fire area
where more than one of the redundant trains needed for safe shutdown had cables located in
that area, the licensee stated that: One set of the redundant equipment and components within
the area is protected by one of the means provided in Section II-4.5. This statement reiterated
on an area by area basis that the applicant met the NRC's separation requirements.
The staff reviewed the NRC Safety Evaluation Report, which provided the bases for the NRC's
decisions concerning the acceptability of the fire protection program. Supplement 12 concluded
that: The applicant's analysis indicates that at least one of the redundant trains needed for
safe shutdown would be free of fire damage by providing separation, fire barriers, and/or
alternative shutdown capability. The safety evaluation report does not mention any exceptions
to this conclusion.
The staff reviewed the licensee's contention that the NRC had reviewed the applicant's use of
manual actions. The staff was able to confirm that the NRC had reviewed and approved a
specific set of manual actions. These were clearly documented in the fire protection program
documents. However, these manual actions related to addressing possible spurious operation
caused by fire damage to equipment that was not required to achieve and maintain hot
shutdown. The NRC verified that manual actions involving non-required equipment that could
prevent required equipment from achieving or maintaining hot shutdown could be performed
within sufficient time to ensure the functioning of the required systems. In some cases, this
review involved manual actions that were required to be performed locally in the same area as
the postulated fire. Because these manual actions involved non-required components, manual
actions that could be demonstrated to be reliably performed were determined by the NRC to be
acceptable. Supplement 12 stated:
Associated circuits whose fire-induced spurious operation could affect shutdown were
identified to determine those components whose maloperation could affect safe
shutdown. These spurious operations are terminated by operator actions. The applicant
identified these operator actions and allowed sufficient time to perform these actions.
On the basis of its evaluation, the staff concludes that these operator actions will
terminate spurious operations that could affect plant shutdown.
The licensee verbally reported that the NRC conducted onsite inspections into the details of
manual actions beyond these examples. Both the licensee and the staff were unable to locate
documentation concerning the scope or results of such reviews. In discussions with the
licensee, it was apparent that the licensee's procedures and analyses had not documented the
purpose for each manual action in the fire response procedures. Inspection guidance caused
them to focus on whether the manual actions were reasonable and feasible, not specifically why
the manual actions were needed. Fire response procedures can be expected to have
acceptable operator manual actions, including: actions to implement the approved alternative
shutdown strategy (i.e. control room evacuation); actions to control the plant so as to achieve
and maintain a shutdown to hot standby condition; actions intended for property protection and
good operating practice (e.g. securing equipment that is not being used for safe shutdown); and
actions to address possible spurious operation caused by fire damage to equipment that was
not required to achieve and maintain hot shutdown. However, while actions to restore
A2-2 Attachment 2
equipment required for safe shutdown to hot standby are not acceptable, these actions can be
challenging to differentiate from the acceptable actions.
The licensee was required to identify the list of equipment required for safe shutdown. In
Comanche Peak's case, the Safe Shutdown Equipment List is not typical of other sites;
Comanche Peak's documents listed the required equipment at the system or function level,
rather than at the component level. Lists identifying individual components located in each fire
area and requiring manual actions based on the location of a fire did not differentiate between
components being operated to restore required safe shutdown functions and those being
operated in response to spurious operations. This added a significant challenge to identification
of unacceptable manual actions that were intended to restore equipment that was actually
required to have been protected from fire damage. Following issuance of Unresolved Item
05000445; 446/2008006-02, inspectors requested that the licensee provide the purpose for the
operator manual actions specified in fire response procedures where inspectors could not
confirm the purpose. The licensee's response provided the first clear indication that some of
these manual actions were intended to restore required equipment that the licensee had
previously recognized was not protected from fire damage.
The inspectors also noted that the most challenging statement in the licensing basis
documentation to place in context was a statement in the Fire Protection Report,
Section III-3.1.1, which listed assumptions used in the fire analyses methodology description. It
stated:
Manual operations are allowed to achieve hot standby following a reactor trip and to
maintain hot standby conditions.
The licensee contended that this statement allows the use of manual actions. The staff's review
of the Safety Evaluation Report found that this part of the Fire Protection Report is not
discussed. However, operators are allowed to perform manual actions to operate plant
equipment in the normal manner to achieve and maintain hot standby, whether the need arose
from a fire or some other reason. This statement does not specifically discuss using manual
operations to restore equipment that was required to achieve and maintain hot standby that was
damaged by fire and not available to be operated by the normal means. This statement does
not directly address separation or protection of equipment. Therefore, the staff concluded that
this statement does not have relevance to the requirements to separate and protect required
equipment.
For completeness, the staff also considered whether the licensee may have made a change to
the approved fire protection program under the belief that such changes were permissible under
with the provisions in License Condition 2.G. The licensee clearly stated that the manual
actions in question were not made as part of a change to the fire protection program as
originally submitted for approval.
A2-3 Attachment 2