ML110760579
| ML110760579 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 03/17/2011 |
| From: | Anton Vegel Division of Reactor Safety IV |
| To: | O'Grady B Nebraska Public Power District (NPPD) |
| References | |
| EA-11-024 IR-10-006 | |
| Download: ML110760579 (55) | |
See also: IR 05000298/2010006
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
REGION IV
612 EAST LAMAR BLVD, SUITE 400
ARLINGTON, TEXAS 76011-4125
March 17, 2011
EA 11-024
Brian J. O'Grady, Vice President-Nuclear
and Chief Nuclear Officer
Nebraska Public Power District
Cooper Nuclear Station
72676 648A Avenue
Brownville, NE 68321
SUBJECT: COOPER NUCLEAR STATION - NRC TRIENNIAL FIRE PROTECTION
INSPECTION REPORT 05000298/2010006; PRELIMINARY WHITE FINDING
Dear Mr. O'Grady:
On November 5,2010, the U.S. Nuclear Regulatory Commission (NRC) completed an
inspection at the Cooper Nuclear Station. The enclosed inspection report documents the
inspection results, which were discussed in an exit meeting on March 14, 2011, with
Mr. D. Buman, Director of Engineering, and other members of your staff.
During this inspection, the NRC staff examined activities conducted under your license as they
relate to public health and safety and compliance with the Commission's rules and regulations
and with the conditions of your license. Within these areas, the inspection consisted of selected
examination of procedures and representative records, observations of activities, and interviews
with personnel.
Based on the results of this inspection, the NRC has identified two findings that were evaluated
for risk under the Significance Determination Process. Violations were associated with each of
the findings.
The attached report discusses a finding that was preliminarily determined to be a White finding,
a finding with low-to-moderate increased safety significance which may require additional NRC
inspections. This finding was assessed based on the best available information, including
influential assumptions, using the applicable Significance Determination Process (SOP). As
described in Section 1R05.01 of the attached report, this finding involves the failure to verify that
procedure steps to safely shutdown the plant in the event of a fire would actually reposition
three motor operated valves to the required positions and the concurrent failure to address a
previous finding that involved the same procedure steps. This finding has preliminary low-to-
moderate safety significance because it involves llJultiple fire areas and risk factors that were
not dependent on specific fire damage. The scenarios of concern involve larger fires in specific
areas of the piant which trigger operators to implement fire response procedures to place the
plant in a safe shutdown condition. Since performing some of those actions using the
Nebraska Public Power District 2-
procedures as not have aligned three valves to their required positions, this would
challenge the operators' ability to establish adequate core cooling. This finding does not
represent an immediate safety concern because your staff promptly changed the procedures to
!ocally reposition position the valves.
This finding is also an apparent violation of NRC requirements and is being considered for
escalated enforcement action in accordance with the NRC Enforcement Policy. The current
Enforcement Policy is included on the NRC's web site at .:..:.==~..:....:...:...=:...~.;::..::..:-==c:::=c::...
In accordance with Inspection Manual Chapter 0609, we intend to complete our evaluation
using the best available information and issue our final determination of safety significance
within 90 days of this letter. The significance determination process encourages an open dialog
between the staff and the licensee; however the dialogue should not impact the timeliness of the
staff's final determination. Before we make a final decision on this matter, we will hold a
Regulatory Conference to provide you an opportunity to present to the NRC your perspectives
on the facts and assumptions used by the NRC to arrive at the finding and assess its
significance. The Regulatory Conference should be held within 30 days of the receipt of this
letter and we encourage you to submit supporting documentation at least one week prior to the
conference in an effort to make the conference more efficient and effective. This Regulatory
Conference will be open for public observation.
At the Regulatory Conference, in addition to providing your perspectives on the finding and the
significance, please be prepared to discuss (1) the cause(s) for the performance deficiency, (2)
corrective actions taken or planned for the performance deficiency, and (3) the reasons why
your corrective actions for Violation 05000298/2008008-01, a finding with low-to-moderate
safety significance, were not adequate to verify that the procedure would have worked as
intended.
Please contact Neil O'Keefe at (817) 860-8137 within 10 days of receipt of this letter to schedule
a date for the Regulatory Conference. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision. The final resolution of
this matter will be conveyed in separate correspondence.
Because the NRC has not made a final determination for this matter, no Notice of Violation is
being issued for this inspection finding at this time. In addition, please be advised that the
characterization of the apparent violation described in the enclosed inspection report may
change as a result of further NRC review.
Based on the results of this inspection, the NRC has also identified one additional issue that
was evaluated under the risk significance determination process as having very low safety
significance (Green). The finding was determined to involve a violation of NRC requirements.
However, because it was entered into your corrective action program, the NRC is treating the
finding as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy.
The NCV is described in the subject inspection report. If you contest the noncited violation or
the significance of the noncited violation, you should provide a response within 30 days of the
date of this inspection report, with the basis for your denial, to the Nuclear Regulatory
Commission, ATIN: Document Control Desk, Washington DC 20555-0001, with copies to: (1)
the Regional Administrator, Region IV; (2) the Director, Office of Enforcement, U. S. Nuclear
Regulatory Commission, Washington, DC 20555-0001; and (3) the NRC Resident Inspector at
Nebraska Public Power District -3-
Cooper Nuclear Station. addition, if you disagree with the characterization of any finding in
this report, you should provide a response within 30 days of the date of this inspection report,
with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC
Resident Inspector at Cooper Nuclear Station. The information you provide wil! be considered
in accordance with Inspection Manual Chapter 0305.
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its
enclosure(s), and your response, if you choose to provide one, will be made available
electronically for public inspection in the NRC Public Document Room or from the NRC's
document system (ADAMS), accessible from the NRC Web site at ~~:::".,,",-:c.:~.~~=,,::::~=~;:L.
To the extent possible, your response should not include any personal privacy
or proprietary, information so that it can be made available to the Public without redaction.
Sincerely,
Anton Vegel, D T -
Division of Reactor Safety
Docket No. 50-298
License No. DPR-46
Enclosure: Inspection Report No. 05000298/2010006
w/Attachments: Supplemental Information
Final Significance Determination Summary
cc w/enclosure:
Distribution via ListServ for CNS
U COMMISSION
Docket: 50-298
License: DPR-46
Report Nos.: 05000298/2010006
Licensee: Nebraska Public Power District
Facility: Cooper Nuclear Station
Location: 72676 648A Avenue
Brownville, NE 68321
Dates: October 18, 2010 through March 14, 2011
Team Leader: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2
Inspectors: S. Alferink, Reactor Inspector, Engineering Branch 2
E. Uribe, Reactor Inspector, Engineering Branch 2
J. Watkins, Reactor Inspector, Engineering Branch 2
G. George, Reactor Inspector, Engineering Branch 1
Approved By: Anton Vegel, Director
n;\I;",jnn
1-01'1
nf RQ<:>f'tnr <::<:>fQt\l
v I V l V I I V I 1 ' ...... c..tVLVI "-'-Alw]
-1- Enclosure
SUMMARY
IR 05000298/2010006; October 18,2010 - March 14, 2011, Nebraska Public Power District;
Cooper Nuclear Station: Triennial Fire Protection Team Inspection.
This report covers a two week fire protection team inspection, follow-up inspection and
significance determination effort by specialist inspectors from Region IV. One finding was
identified with an associated apparent violation, vvhich was preliminary determined to have low-
to-moderate safety significance (White). Two Green findings, which were noncited violations
(NCVs), were also identified. The significance of most findings is indicated by their color
(Green, White, Yellow, Red) using Inspection Manual Chapter 0609, "Significance
Determination Process." Findings for which the significance determination process (SOP) does
not apply may be Green or be assigned a severity level after NRC management review. The
crosscutting aspects, where applicable, were determined using Inspection Manual Chapter 0310, "Components Within the Cross Cutting Areas." The NRC's program for overseeing the
safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor
Oversight Process," Revision 4, dated December 2006.
A. NRC-Identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
.. Apparent Violation. An apparent violation of 10 CFR Part 50, Appendix B, Criterion
V, "Instructions, Procedures, and Drawings," and Criterion XVI, "Corrective Action,"
with a preliminary white significance, was identified for failure to ensure that some
steps contained in Emergency Procedures at Cooper Nuclear Station would work as
written and the concurrent failure to assure that a condition adverse to quality was
promptly identified and corrected, respectively. Specifically, steps in Emergency
Procedure 5.4 POST-FIRE, "Post-Fire Operational Information," and Emergency
Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside Control Room,"
intended to reposition motor operated valves from the motor starter cabinet, would
not have worked as written because the steps were not appropriate for the
configuration of three valve motor starters. This finding was entered into the
licensee's corrective action program under Condition Reports CR-CNS-201 0-08193
and CR-CNS-2010-08242, however the licensee failed to adequately correct the
procedure and the procedure remained unworkabie.
The failure to verify that procedure steps needed to safely shutdown the plant in the
event of a fire would actually reposition motor operated valves to the required
positions and the simultaneous failure to address the previous finding that the same
procedure steps would not work as written, was a performance deficiency. This
finding was more than minor safety significance because it impacted the Mitigating
Systems cornerstone objective to ensure the availability, reliability, and capability of
systems that respond to external events (such as fire) to prevent undesirable
consequences. This finding affected both the procedure quality and protection
against external factors (such as fires) attributes of this cornerstone objective. This
finding was determined to have a preliminary lovv-to-moderate safety significance
(White) during a Phase 3 evaluation using best available information. This problem,
-2- Enclosure
which has existed since 1997, involves risk factors that were not dependent on
specific fire damage. The scenarios of concern involve larger fires in specific areas
of the plant which trigger operators to implement fire response procedures to place
the plant in a safe shutdown condition. Since some of those actions could not be
completed using the procedures as written, this would challenge the operators' ability
to establish adequate core cooling. This finding had a crosscutting aspect in the
Corrective Action Program component, under the Problem Identification and
Resolution area (P.1 (c) - Evaluation), because the licensee failed to properly
evaluate the circuit operation or conduct verification tests to ensure that corrective
actions for a previous violation would reliably position the three valves. Upon
identification of this issue, both emergency procedures were revised to assure
correct valve alignment by manually operating the valve locally. Therefore, this
finding does not represent a current safety concern. (Section 1R05.1)
- Green. A noncited violation of 10 CFR 50.65(a)(2) was identified for the failure to
monitor the performance of the emergency lighting system against the established
performance criteria. The licensee included the emergency lighting system in the
Maintenance Rule program and specified that the emergency light batteries must be
capable of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of operation, as required by 10 CFR Part 50, Appendix R, Section
iii.J. The team identified that the licensee did not perform tests that demonstrated
the capability of the emergency lights to last for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; therefore, the licensee failed
to monitor the performance of the emergency lights against the established
performance criteria. This finding was entered into the licensee's corrective action
program under Condition Reports CR-CNS-201 0-08014 and CR-CNS-2010-08250.
The failure to monitor the performance of the emergency lighting system against the
performance criteria stated in the Maintenance Rule program was a performance
deficiency. The performance deficiency was more than minor because it was
associated with the protection against external events (fire) attribute of the Mitigating
Systems Cornerstone and it adversely affected the cornerstone objective of ensuring
the availability, reliability, and capability of systems that respond to initiating events
to prevent undesirable consequences. Specifically, the failure to ensure that
emergency lights would last for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> could adversely affect the ability of operators
to perform all of the manual actions required to support safe shutdown in the event of
a fire. The significance of this finding was evaluated using Inspection Manual
Chapter 0609, Appendix F, "Fire Protection Significance Determination Process,"
because the performance deficiency affected fire protection defense-in-depth
strategies invoiving post fire safe shutdown systems. The finding was assigned a
low degradation rating since the finding minimally impacted the performance and
reliability of the fire protection program element. Specifically, the team determined
that the licensee's preventive maintenance strategy provided reasonable assurance
that the emergency lights would last sufficiently long for the operators to perform the
most time-critical manual actions required to support safe shutdown in the event of a
fire. The team also noted that operators were required to obtain and carry
flashlights. Therefore, the finding screened as having very low safety significance
(Green). This finding had a crosscutting aspect in the area of Human Performance
associated with Decision Making because the licensee failed to identify possible
unintended consequences of the decision to change the maintenance program for
the emergency lights. Specifically, the licensee failed to identify that deleting
-3- Enclosure
light testing impacted
(Section 1 R05.B)
B. Licensee-Identified Violations
None
-4- Enclosure
REPORT DETAILS
i. REACTOR SAFETY
Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity
1ROS Fire Protection (71111.0STTP)
This report presents the results of a triennial fire protection inspection conducted in
accordance with NRC Inspection Procedure 71111.0STTP, "Fire Protection-NFPA
Transition Period (Triennial)," at Cooper Nuclear Station. The licensee committed to
adopt a risk informed fire protection program in accordance with National Fire Protection
Association Standard 80S (NFPA-80S), but had not yet completed the program
transition. The inspection team evaluated the implementation of the approved fire
protection program in selected risk-significant areas, with an emphasis on the
procedures, equipment, fire barriers, and systems that ensure the post-fire capability to
safely shut the plant down.
Inspection Procedure 71111.0STTP requires selecting three to five fire areas for review.
The inspection team used the fire hazards analysis section of the Cooper Nuclear
Station Individual Plant Examination of External Events to select the following five
risk-significant fire zones (inspection samples) for review:
- Fire Area I / Fire Zone 2A Control Rod Drive Units - North
Reactor Building Elevation 903' 6"
- Fire Area I / Fire Zone SB Reactor Motor Generator Set Area
Reactor Building Elevation 976' 0"
- Fire Area II I Fire Zone 3A Switchgear Room 1F
Reactor Building Elevation 931' 6"
- Fire Area IX / Fire Zones 14A Diesel Generator 1A Room
Diesel Generator Building Elevation 903' 6"
- Fire Area IX / Fire Zones 14C Diesel Oil Day Tank Room
Diesel Generator Building Elevation 903' 6"
The inspection team evaluated the licensee's fire protection program using the
applicable requirements, which included plant Technical Specifications, Operating
License Condition 2.C.(S); NRC safety evaluations; 10 CFR S0.48; Branch Technical
Position 9.S-1; and 10 CFR SO, Appendix R. The team also reviewed related documents
that included the Final Safety Analysis Report (FSAR), Section 9.S; the fire hazards
analysis; and the post-fire safe shutdown analysis.
Specific documents reviewed by the team are listed in the attachment. Five fire area
inspection samples were completed. Also, one B.S.b strategy review sample was
completed.
-S- Enclosure
.1 Protection of Safe Shutdown Capabilities
a. Inspection Scope
The team reviewed the piping and instrumentation diagrams, safe shutdown equipment
list, safe shutdown design basis documents, and the post fire safe shutdown analysis to
verify that the licensee properly identified the components and systems necessary to
achieve and maintain safe shutdown conditions for fires in the selected fire areas. The
team observed walkdowns of the procedures used for achieving and maintaining safe
shutdown in the event of a fire to verify that the procedures properly implemented the
safe shutdown analysis provisions.
For each of the selected fire areas, the team reviewed the separation of redundant safe
shutdown cables, equipment, and components located within the same fire area. The
team also reviewed the licensee's method for meeting the requirements of 10 CFR
50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R,
Section III.G. Specifically, the team evaluated whether at least one post-fire safe
shutdown success path would remain free of fire damage in the event of a fire. In
addition, the team verified that the licensee met applicable license commitments.
b. Findings
Introduction. An apparent violation of 10 CFR Part 50, Appendix B, Criterion Vand
Criterion XVI, with a preliminary White significance, was identified for the repeated
failure to ensure that some steps contained in emergency procedures at Cooper Nuclear
Station would work as written. Specifically, steps in Emergency Procedure 5.4 POST-
FIRE, "Post Fire Operational Information," and Emergency Procedure 5.4 FIRE-SID,
"Fire Induced Shutdown From Outside Control Room," intended to reposition motor
operated valves at the motor starter cabinet, would not have worked as written because
the steps were not appropriate for the configuration of the motor starters.
Description. Post-fire safe shutdown strategies at the Cooper Nuclear Station require
equipment operations to be performed in accordance with one of two emergency
procedures. For most fire areas, plant shutdown is performed using Emergency
Procedure 5.4 POST-FIRE, "Post-Fire Operational Information," Revision 37, in
conjunction with other plant procedures. For areas where fires might necessitate
evacuation of the control room, alternative shutdown is performed using Emergency
Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside the Control Room,"
Revision 38.
The team performed a walkthrough of Emergency Procedure 5.4 POST-FIRE for
selected fire areas by observing plant operators simulate actions required by the
procedure. This procedure required operators to reposition multiple motor-operated
valves (MOVs) from each valve's motor starter cabinet. The procedure steps direct
operators to open the motor starter cabinet, remove the control power fuses, then press
designated contactors for a specified amount of time to reposition the valve to the
required position.
-6- Enclosure
The team was concerned that some of the procedure steps might not be reliably
performed by the operators because bulky electrical safety gloves might not allow
access to recessed contactors. When the licensee attempted to demonstrate their
method, they identified that it would not work for one type of contactor. The internal
configuration of the contactor would not complete the power circuit by depressing it. The
manufacturer describes the design as having "direct magnet drive with positive pull-in of
contactors." Since control power was removed by pulling fuses before operating the
contactors, the magnet system would not engage the power contacts to the valve motor.
The inspectors noted that the operator performing the procedure steps would have no
indication that the valve(s) did not reposition. Because the procedures do not
specifically require checking the valve positions for most fire locations, the failure to
reposition would not be readily apparent.
The three valves with this type of contactor were residual heat removal (RHR) system
valves RHR-MO-25A and RHR-MO-25B, Train A and B Inboard Injection Isolation
Valves, and reactor recirculation (RR) system valve RR-MO-53A, Reactor Recirculation
A Pump Discharge Valve. The procedural deficiency in Emergency Procedure
5.4 POST-FIRE impacted the response to fires in 11 fire areas, each involving one
valve. One of the valves, RHR-MO-25B, is operated in the same manner during
alternative shutdown in accordance with Emergency Procedure 5.4 FIRE-SID, which
contained the same procedural deficiency, for fires in two additional fire areas. The 13
affected fire areas are listed below:
Fire Area
CB-A Control Building Reactor Protection System Room 1A, Seal Water
Pump Area, and Hallway
CB-A-1 Control Building Division 1 Switchgear Room and Battery Room
CB-B Control Building Division 2 Switchgear Room and Battery Room
CB-C Control Building Reactor Protection System Room 1B
CB-D Control Room, Cable Spreading Room, Cable Expansion Room,
and Auxiliary Relay Room
RB-DI (SE) Reactor Building RHR Pump B/HPCI Pump Room
RB-Di (SW) Reactor Building South/Southwest 903, Southwest Quad 889 and
859, and RHR Heat Exchanger Room B
RB-FN Reactor Building 903, Northeast Corner
RB-J Reactor Building Critical Switchgear Room 1F
RB-K Reactor Building Critical Switchgear Room 1G
RB-M Reactor Building North/Northwest 931 and RHR Heat Exchanger
Room A
RB-N Reactor Building South/Southwest 931 and RHR Heat Exchanger
Room B
TB-A Turbine Building (multiple areas)
Opening either valve RHR-MO-25A or valve RHR-MO-25B is necessary to establish
alternative shutdown cooling. Alternative shutdown cooling involves using a train of
RHR to take suction from the suppression pool, inject the low pressure water to flood the
reactor vessel, and recirculate the water through the safety relief valves (SRVs) back to
the suppression pool. Establishing alternative shutdown cooling can be very time-
sensitive. If high-pressure coolant injection (HPCI) is not available, the licensee
-7- Enclosure
provided calculations that show that core damage can occur in as little as 15 minutes
after valve RHR-MO-258 fails to open.
Valve RR-MO-53A is the discharge isolation valve for Reactor Recirculation Pump 1-A.
This valve is only required for cold shutdown. For some fire areas, the normal shutdown
cooling mode of RHR system operation was credited in the fire safe shutdown analysis
to be available. In shutdown cooling mode, the RHR system takes suction from the
suction pipe of reactor recirculation system loop "A". The reactor coolant is then cooled
and returned to a reactor recirculation loop discharge pipe. The failure to close either
valve RR-MO-53A or RR-MO-43A would result in a short circuit of the shutdown cooling
flow, bypassing the reactor vessel. The cool down from hot shutdown conditions and the
transition to normal shutdown cooling allows time to close either valve RR-MO-53A or
RR-MO-43A using local manual operation.
In 2004, a related but separate violation (NCV 05000298/2004008-01) was issued for
failure to protect cables from fire damage for MOVs required to be available for post fire
safe shutdown. The licensee committed to adopt a risk-informed fire protection program
in accordance with 10 CFR 50.48(c) and NFPA-805, and planned to address the 2004
violation through their NFPA-805 conversion. To be able to delay correcting the 2004
violation, the licensee was required to verify that the compensatory measures for the
violation (the operator manual actions) were adequate to ensure safety, in this case to
be able to safely shut the plant down in the event of a fire.
Inspection Report 05000298/2004008 noted reliability concerns with the method of
operating the MOVs. These included the fact that the contactors were not labeled to
ailow operators to know which contactors the procedure instructed them to operate, no
indication was available at the motor starter cabinet for the operator to know the valves
had reached their required position, and valve position was not verified locally at the
valves. As part of corrective action, the licensee installed "open" and "closed" labels
near contactors in the motor starter cabinets.
In 2007, inspectors identified that some of the operator manual actions used as
compensatory measures for the 2004 violation would not have repositioned 10 of the
MOVs. The procedures did not account for the fact that these 10 MOVs had different
motor starter circuits than most valves. Despite installing labels following the 2004
violation, the licensee failed to recognize that these 10 MOVs had a more complex
circuit design which required two or three contactors to be operated at the same time,
while the procedures only required operating one "open" or one "close" contactor. A
White finding with an associated violation (Violation 05000298/2008008-01, EA 07-204)
was issued for having an inadequate procedure and failing to verify that the procedure
would work.
Inspection Report 05000298/2008007 again documented the reliability concerns that
there were no valve position indications at the MOV motor starter cabinets, and the
procedures did not direct local valve position checks. Additional reliability concerns were
also documented concerning the adequacy of the procedures and the instrumentation
available to diagnose the failure of an MOV to reposition.
The licensee took corrective actions to change and verify the procedures to address the
2008 finding; however the licensee's efforts again failed to identify details of the
-8- Enclosure
electrical design which would result in the procedure steps not repositioning three
MOVs.
Analysis. The failure to verify that procedure steps needed to safely shutdown the plant
in the event of a fire would actually reposition motor operated valves to the required
positions, and to address a previous finding that the same procedure steps would not
work as written, was a performance deficiency. This performance deficiency is of more
than minor safety significance because it impacted the Mitigating Systems cornerstone
objective to ensure the availability, reliability, and capability of systems that respond to
external events (such as fire) to prevent undesirable consequences. This finding
affected both the procedure quality and protection against external factors (such as fires)
attributes of this cornerstone objective.
The significance determination process (SOP) Phase 1 Screening Worksheet (Manual
Chapter 0609, Attachment 4), Table 3b directs the user to Manual Chapter 0609,
Appendix F, "Fire Protection Significance Determination Process," because it affected
fire protection defense-in-depth strategies involving post fire safe shutdown systems.
However, the Assumptions and Limitations section of Appendix F states that finings
involving multiple fire areas are beyond the scope of Appendix F, and findings involving
control room evacuation are not explicitly treated in Appendix F. Therefore, a Phase 3
analysis was performed.
The license claimed that the issue involved a performance deficiency that only
impacted cold shutdown, and therefore should be screened as Green during a Phase
1 SOP. The NRC concluded that this finding cannot be screened out because the
complexity of the issue (e.g., multiple fire areas affected) precludes simple screening,
and because the plant conditions and system dependencies prevent a conclusion
that only cold shutdown is affected.
Manual Chapter 0308 describes the basis for Appendix F screening out issues involving
only cold shutdown as follows:
The second question screens findings to green that impact only the ability of the
plant to achieve cold shutdown. This is consistent with the common risk analysis
practice of defining hot shutdown as success. That is, both fire PRAs
[probabilistic risk assessments] and Internal Events PRAs typically assume that
achieving a safe and stable hot shutdown state constitutes success and the end
state for accident sequence analyses. Note that this screening step applies only
to findings against 10CFR50 Appendix R, Section III.G.1.b. All other regulatory
provisions are considered to involve, in part or in whole, measures provided for
preservation and protection of the post-fire hot shutdown capability and will not
be screened in this step (e.g., fire prevention, fire suppression, fire brigade, fire
barriers, etc.).
The licensee's fire safe shutdown strategy and implementing procedures for the
scenarios of concern direct operators to proceed to cold shutdown within a few hours.
Operation in hot shutdown and cold shutdown rely on the suppression pool with limited
capability for cooling the suppression pool. This strategy is too complex to allow simple
risk screening for this finding.
- 9- Enclosure
A risk analysis was performed previously for the 2008 procedural problems that affected
ten valves, including the three valves addressed by this performance deficiency. This
was documented in Inspection Report 05000298/2008008 (EA 07-204). In both the
2008 and current cases, valves RHR-MOV-25A, RHR-MOV-25B, and RHR-MOV-53A
were incapable of being remotely operated from the motor starter as prescribed by
Procedures 5.4 POST-FIRE and 5.4 FIRE-SID. Therefore, the linked event tree model
developed for the risk estimate performed in 2008 was used to assess the significance
of the current issue for these three valves.
Fires that do not require control room evacuation are addressed in Procedure
5.4 POST-FIRE. For fire areas that do not involve control room evacuation, the analyst
concluded that the risk for the current finding is less than 1.0E-7 (this is unchanged from
2008 evaluation).
The risk attributable to post fire remote shutdown (control room abandonment
sequences) results predominantly from the failure of Valve RHR-MOV-25B to open as
described in Procedure 5.4 FIRE-SID. This is the credited train and the only procedural
means for initiating alternative shutdown cooling during the recovery actions. Changes
were made to Procedure 5.4 FIRE-SID subsequent to the 2008 issue which were
credited in the current analysis and resulted in a decrease in the risk significance of the
subject valves.
The non-recovery probability was decreased by a factor of 78 for the current finding
because of changes that were made to Procedure 5.4 FIRE-SID. These changes in
Attachment 1 of the procedure directed the operator at the remote shutdown panel to
close SRVs if RHR injection was not observed to be successful and stabilize conditions
using high pressure injection. Also, it directed operators to delay securing HPCI (if it
was running) until RHR injection is confirmed. Additionally, Attachment 2 to the
procedure directed the reactor building operator to open valve RHR-MOV-25B manually
if the valve did not operate. However, there is limited instrumentation available at the
remote shutdown panel to be able to recognize and diagnose that the valve did not
open, and no available indications at the motor starter cabinet. Therefore, the operator
who might be able to diagnose the failure of RHR-MO-25B did not have a procedure with
the critical recovery step, and the operator with the correct recovery step in his
procedure did not have the capability to know whether it was needed.
Using the linked event tree model and a period of exposure of one year, the analyst
calculated the f..CDF to be 2.0E-6/yr for postulated fires leading to the abandonment of
the main control room. The analyst concluded that the performance deficiency was of
low to moderate significance (White).
A more detailed description to the Phase 3 analysis is attached to this report.
The NRC expects that licensees will ensure that issues potentially impacting nuclear
safety are promptly identified, fully evaluated, and that actions are taken to address
safety issues in a timely manner, commensurate with their significance. Additionally, the
NRC expects that for significant problems, licensees will conduct effectiveness reviews
of corrective actions to ensure that the problems are resolved. Because the licensee
- 10- Enclosure
failed to properly evaluate the circuit operation or conduct verification tests to ensure that
corrective actions for a previous violation would reliably position the three valves, the
team concluded that this finding has a crosscutting aspect in the Corrective Action
Program component, under the Problem Identification and Resolution area (P.1 (c) -
Evaluation).
Enforcement. Title 10 of the Code of Federal Regulations, Part 50, Appendix S,
Criterion V, "Instructions, Procedures, and Drawings," requires, in part, that activities
affecting quality shall be prescribed by documented instructions, procedures, or
drawings, of a type appropriate to the circumstances and shall be accomplished in
accordance with these instructions, procedures, or drawings.
Title 10 of the Code of Federal Regulations, Part 50, Appendix S, Criterion XVI requires,
in part:
Measures shall be established to assure that conditions adverse to quality, such
as failures, malfunctions, deficiencies, deviations, defective material and
equipment, and nonconformances are promptly identified and corrected. In the
case of Significant conditions adverse to quality, the measures shall assure that
the cause of the condition is determined and corrective action taken to preclude
repetition.
Emergency Procedure 5.4 POST-FIRE, "Post-Fire Operational Information," Revision
37, and Emergency Procedure 5.4 FIRE-SID, "Fire Induced Shutdown From Outside the
Control Room," Revision 38, were designated as quality-related procedures used to
implement operator actions to safely shutdown the plant in response to a fire. Violation
05000298/2008008-01 (EA 07-204) documented a significant condition adverse to
quality in that steps in Emergency Procedure 5.4 POST-FIRE and Emergency
Procedure 5.4 FIRE-SID would not achieve and maintain a safe shutdown condition in
the event of certain fires.
Contrary to the above, between July 1997 and November, 2010, the licensee failed to
ensure that activities affecting quality were prescribed by documented procedures
appropriate to the circumstances, and to assure that a significant condition adverse to
quality was promptly corrected. Specifically, Emergency Procedure 5.4 POST-FIRE and
Emergency Procedure 5.4 FIRE-SID were changed in 1997 to add steps that were
inappropriate to the circumstances because they would not work as written to reposition
three motor operated valves needed to establish core cooling. The licensee failed to
properly verify and validate procedure steps when the procedure changes were made
and on multiple occasions between July 1997 and November 2010, including verification
and validation actions performed in response to Violation 05000298/2008008-01 ..
In addition, contrary to the above, between July 2008 and November 2010, the licensee
failed to identify, correct, and preclude repetition of a Significant condition adverse to
quality. Specifically, Violation 05000298/2008008-01 identified a significant condition
adverse to quality in that Emergency Procedure 5.4 POST-FIRE and Emergency
Procedure 5.4 FIRE-SID would not work as written and the licensee had failed to verify
and validate procedure steps to ensure that they would work to accomplish the
necessary tasks. While addressing that violation, the licensee failed to perform sufficient
- 11 - Enclosure
circuits to identify and correct a problem with valves RHR-MOV-25A, RHR-MOV-25B,
and RHR-MOV-53A.
The licensee entered this issue into their corrective action program as Condition
Reports CR-CNS-2010-08193 and CR-CNS-2010-08242. This violation is being treated
as an apparent violation (AV) , consistent with the Enforcement Policy: AV
05000298/2010006-01, Inadequate Post-Fire Safe Shutdown Procedures.
Because the licensee failed to correct this condition as part of Violation
05000298/2008008-01, and because Violation 05000298/2008008-01 did not receive
enforcement discretion, this finding was not appropriate for enforcement discretion .
.2 Passive Fire Protection
a. Inspection Scope
The team walked down accessible portions of the selected fire areas to observe the
material condition and configuration of the installed fire area boundaries (including walls,
fire doors, and fire dampers) and verify that the electrical raceway fire barriers were
appropriate for the fire hazards in the area. The team compared the installed
configurations to the approved construction details, supporting fire tests, and applicable
license commitments.
The team reviewed installation, repair, and qualification records for a sample of
penetration seals to ensure that the fill material possessed an appropriate fire rating and
that the installation met the engineering design. The team also reviewed similar records
for the rated fire wraps to ensure the material possessed an appropriate fire rating and
that the installation met the engineering design.
b. Findings
No findings were identified .
.3 Active Fire Protection
a. Inspection Scope
The team reviewed the design, maintenance, testing, and operation of the fire detection
and suppression systems in the selected fire areas. The team verified that the manual
and automatic detection and suppression systems were installed, tested, and maintained
in accordance with the National Fire Protection Association code of record or approved
deviations, and that each suppression system was appropriate for the hazards in the
selected fire areas.
The team performed a walkdown of accessible portions of the detection and suppression
systems in the selected fire areas. The team also performed a walkdown of major
system support equipment in other areas (e.g., fire pumps) to assess the material
condition of these systems and components.
The team reviewed the electric and diesel fire pump flow and pressure tests to verify that
- 12 - Enclosure
the pumps met their design requirements. The team also reviewed high pressure
carbon dioxide suppression system functional tests and inspections to verify that the
system capability met the design requirements.
The team assessed the fire brigade capabilities by reviewing training, qualification, and
drill critique records. The team also reviewed pre-fire plans and smoke removal plans
for the selected fire areas to determine if appropriate information was provided to fire
brigade members and plant operators to identify safe shutdown equipment and
instrumentation, and to facilitate suppression of a fire that could impact post-fire safe
shutdown capability. In addition, the team inspected fire brigade equipment to determine
operational readiness for fire fighting.
The team observed an unannounced fire drill, conducted on November 1, 2010, and the
subsequent drill critique using the guidance contained in Inspection
Procedure 71111.05AQ, "Fire Protection Annual/Quarterly." The team observed fire
brigade members fight a simulated fire in the Reactor Building, located in a switchgear
room. The team verified that the licensee identified problems, openly discussed them in
a self-critical manner at the drill debrief, and identified appropriate corrective actions.
Specific attributes evaluated were: (1) proper wearing of turnout gear and self-contained
breathing apparatus; (2) proper use and layout of fire hoses; (3) employment of
appropriate fire fighting techniques; (4) sufficient fire fighting equipment was brought to
the scene; (5) effectiveness of fire brigade leader communications, command, and
control; (6) search for victims and propagation of the fire into other areas; (7) smoke
removal operations; (8) utilization of pre-planned strategies; (9) adherence to the pre-
planned drill scenario; and (10) drill objectives.
b. Findings
No findings were identified .
.4 Protection From Damage From Fire Suppression Activities
a. Inspection Scope
The team performed plant walkdowns and document reviews to verify that redundant
trains of systems required for hot shutdown, which are located in the same fire area,
would not be subject to damage from fire suppression activities or from the rupture or
inadvertent operation of fire suppression systems. Specifically, the team verified that:
- A fire in one of the selected fire areas would not directly, through production of
smoke, heat, or hot gases, cause activation of suppression systems that could
potentially damage all redundant safe shutdown trains.
- A fire in one of the selected fire areas or the inadvertent actuation or rupture of a
fire suppression system would not directly cause damage to all redundant trains.
- Adequate drainage was provided in areas protected by water suppression
systems.
b. Findings
- 13 - Enclosure
No findings were identified,
,5 Alternative Shutdown Capability
a, Inspection Scope
Review of Methodology
The team reviewed the safe shutdown analysis, operating procedures, piping and
instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and
other supporting documents to verify that hot and cold shutdown could be achieved and
maintained from outside the control room for fires that require evacuation of the control
room, with or without offsite power available,
Plant walkdowns were conducted to verify that the plant configuration was consistent
with the description contained in the safe shutdown and fire hazards analyses, The
team focused on ensuring the adequacy of systems selected for reactivity control,
reactor coolant makeup, reactor decay heat removal, process monitoring
instrumentation, and support systems functions.
The team also verified that the systems and components credited for shutdown would
remain free from fire damage. Finally, the team verified that the transfer of control from
the control room to the alternative shutdown location would not be affected by
fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for
alternative shutdown controi circuits).
Review of Operational Implementation
The team verified that licensed and non-licensed operators received training on
alternative shutdown procedures. The team also verified that sufficient personnel to
perform a safe shutdown were trained and available onsite at all times, exclusive of
those assigned as fire brigade members.
A walkthrough of the post fire safe shutdown procedure with licensed and non-licensed
operators was performed to determine the adequacy of the procedure, The team
verified that the operators could be reasonably expected to perform specific actions
within the time required to maintain plant parameters within specified limits. Time critical
actions that were verified included restoring electrical power, establishing control at the
remote shutdown and local shutdown panels, establishing reactor coolant makeup, and
establishing decay heat removal.
The team reviewed manual actions to ensure that they had been properly reviewed and
approved and that the actions could be implemented in accordance with plant
procedures in the time necessary to support the safe shutdown method for each fire
area.
The team also reviewed the periodic testing of the alternative shutdown transfer
capability and instrumentation and control functions to verify that the tests are adequate
to demonstrate the functionality of the alternative shutdown capability,
- 14 - Enclosure
b. Findings
No findings were identified.
.6 Circuit Analysis
a. I nSl2ection SCOl2e
This segment of inspection is suspended for plants in transition to a risk-informed fire
protection program in accordance with NFPA 805. Therefore, the team did not evaluate
this area.
b. Findings
No findings were identified .
.7 Communications
a. Insl2ection Scol2e
The team inspected the contents of designated emergency storage lockers and
reviewed the alternative shutdown procedure to verify that portable radio
communications and fixed emergency communications systems were available,
operable, and adequate for the performance of designated activities. The team verified
the capability of the communication systems to support the operators in the conduct and
coordination of their required actions. The team also verified that the design and
location of communications equipment such as repeaters and transmitters would not
cause a loss of communications during a fire. The team discussed system design,
testing, and maintenance with the system engineer.
The team reviewed the licensee's response to Condition Report CR-CNS-201 0-07848.
The team verified the licensee properly implemented the Maintenance Rule program
with respect to the communications systems required for alternative shutdown.
b. Findings
No findings were identified.
a. Insl2ection Scol2e
The team reviewed the portion of the emergency lighting system required for alternative
shutdown to verify that it was adequate to support the performance of manual actions
required to achieve and maintain hot shutdown conditions and to illuminate access and
egress routes to the areas where manual actions would be required. The team
evaluated the locations and positioning of the emergency lights during a walkthrough of
the alternative shutdown procedure.
- 15 - Enclosure
The team verified that the licensee installed emergency lights with an 8-hour capacity,
maintained the emergency light batteries in accordance with manufacturer
recommendations, and tested and performed maintenance in accordance with piant
procedures and industry practices. The team also verified the licensee properly
implemented the Maintenance Rule program with respect to the emergency lighting
systems required for alternative shutdown.
The team identified several concerns with the adequacy of the emergency lights during
the walkthrough of the alternative shutdown procedure. In response to these concerns,
the licensee performed blackout tests to demonstrate the adequacy of the installed
emergency lights. The team observed blackout tests in the following areas:
- Control Building Corridor, 903' Elevation
- Control Building Basement, 881' Elevation
- Diesel Generator 2 Room
b. Findings
Introduction. The team identified a Green noncited violation of 10 CFR 50.65(a)(2) for
the failure to monitor the performance of the emergency lighting system against the
established performance criteria.
Description. During the inspection, the team reviewed the licensee's maintenance
program for the emergency lighting system. The team determined that the licensee did
not perform tests that demonstrated the capability of the emergency lights to last 8
hours. Instead, the licensee replaced each emergency light battery at a prescribed
frequency. The licensee previously demonstrated the capability of the emergency lights
to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> via the performance of internal resistance measurements. In 2008, the
licensee modified their maintenance program to remove the internal resistance
measurements and rely upon the prescribed replacement strategy.
The team also reviewed the licensee's implementation of their Maintenance Rule
program with respect to the emergency lighting system. The licensee included the
emergency lighting system into the Maintenance Rule program and included a
performance criterion for the emergency light batteries to support 8-hours of operation,
as required by 10 CFR Part 50, Appendix R, Section III.J.
Since the licensee did not perform tests that demonstrated the capability of the
emergency lights to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the team determined that the licensee failed to monitor
the performance of the emergency lights against the established performance criteria.
Analysis. The failure to monitor the performance of the emergency lighting system
against the performance criteria stated in the Maintenance Rule program was a
performance deficiency. The performance deficiency was more than minor because it
was associated with the protection against external events (fire) attribute of the
Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of
ensuring the availability, reliability, and capability of systems that respond to initiating
events to prevent undesirable consequences. Specifically, the failure of the emergency
lights to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> could adversely affect the ability of operators to perform the manual
actions required to support safe shutdown in the event of a fire.
- 16 - Enclosure
The significance of this finding was evaluated using Manual Chapter 0609, Appendix F,
"Fire Protection Significance Determination Process," because the performance
deficiency affected fire protection defense-in-depth strategies involving post-fire safe
shutdown systems. The team assigned the performance deficiency to the Post-fire Safe
Shutdown category since it affected systems or functions relied upon for post-fire safe
shutdown.
The finding was assigned a low degradation rating since the finding minimally impacted
the performance and reliability of the fire protection program element. Specifically, the
team determined that the licensee's preventive maintenance strategy provided
reasonable assurance that the emergency lights would last sufficiently long for the
operators to perform the most time critical manual actions required to support safe
shutdown in the event of a fire. The team also noted that operators were required to
obtain and carry flashlights. Therefore, the finding screened as having very low safety
significance (Green).
The NRC expects that licensee decisions demonstrate that nuclear safety is an
overriding priority and to conduct effectiveness reviews of safety-significant decisions to
identify possible unintended consequences. Because the licensee failed to identify that
deleting emergency light testing impacted Maintenance Rule performance monitoring,
the team concluded that this finding had a crosscutting aspect in the area of human
performance associated with decision making. Specifically, the licensee failed to identify
possible unintended consequences of the decision to change the maintenance program
for the emergency lights. [H.1 (b)]
Enforcement. Title 10 of the Code of Federal Regulations, Part 50, Section 65,
Paragraph (a)(1), requires, in part, that licensees shall monitor the performance or
conditions of structures, systems, or components (SSCs) within the scope of the
maintenance rule as defined by 10 CFR 50.65 (b), against licensee established goals, in
a manner sufficient to provide reasonable assurance that such SSCs are capable of
fulfilling their intended functions.
Title 10 of the Code of Federal Regulations, Part 50, Section 65, Paragraph (a)(2)
states, in part, that monitoring as specified in 10 CFR 50.65 (a)(1) is not required where
it has been demonstrated that the performance or condition of a SSC is being effectively
controlled through the performance of appropriate preventive maintenance, such that the
SSC remains capable of performing its intended function.
The licensee's Maintenance Rule program included the emergency lighting system and
established a performance criterion that the emergency lighting system batteries support
8-hours of operation, as required by 10 CFR Part 50, Appendix R, Section IILJ.
Contrary to the above, from October 3, 2008 to November 5, 2010, the licensee failed to
demonstrate that the performance of the emergency lighting system was effectively
controlled through the performance of appropriate preventive maintenance and did not
smonitor the emergency lighting system against licensee established goals. Specifically,
the licensee failed to demonstrate that the emergency lighting system remained capable
of providing 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of illumination for post-fire safe shutdown.
- 17 - Enclosure
The licensee entered this issue into their corrective action program as Condition
Reports CR-CNS-2010-08014 and CR-CNS-2010-08250. Because this violation was of
very low safety significance and it was entered into the licensee's corrective action
program, this violation is being treated as a noncited violation, consistent with the
Enforcement Policy: NCV 05000298/2010006-03, Failure to Monitor the Performance of
the Emergency Lights Against the Maintenance Rule Criteria .
.9 Cold Shutdown Repairs
a. Inspection Scope
The team verified that the licensee identified repairs needed to reach and maintain cold
shutdown and had dedicated repair procedures, equipment, and materials to accomplish
these repairs. Using these procedures, the team evaluated whether these components
could be repaired in time to bring the plant to cold shutdown within the time frames
specified in the design and licensing bases. The team verified that the repair equipment,
components, tools, and materials needed for the repairs were available and accessible
on site.
b. Findings
No findings were identified .
. 10 Compensatory Measures
a. Inspection Scope
The team verified that compensatory measures were implemented for out-of-service,
degraded, or inoperable fire protection and postfire safe shutdown equipment, systems,
or features (e.g., detection and suppression systems and equipment; passive fire
barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The
team also verified that the short-term compensatory measures compensated for the
degraded function or feature until appropriate corrective action could be taken and that
the licensee was effective in returning the equipment to service in a reasonable period of
time.
b. Findings
A finding related to this review was documented in Section 1R05.01. No additional
findings were identified .
. 11 B.5.b Inspection Activities
a. Inspection Scope
The team reviewed the licensee's implementation of guidance and strategies intended to
maintain or restore core, containment, and spent fuel pool cooling capabilities under the
circumstances associated with loss of large areas of the plant due to explosions or fire
as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026,
dated February 25: 2002 and 10 CFR 50.54(hh)(2).
- 18 - Enclosure
The team reviewed a licensee's strategy to verify that they continued to maintain and
implement procedures, maintain and test equipment necessary to properly implement
the strategy, and to ensure that station personnel are knowledgeable and capable of
implementing the procedure. The team performed a visual inspection of portable
equipment used to implement the strategy to ensure availability and material readiness
of the equipment, including the adequacy of portable pump trailer hitch attachments, and
verify the availability of onsite vehicles capable of towing the portable pump. The team
assessed the offsite ability to obtain fuel for the portable pump, and foam used for
firefighting efforts. The team reviewed the following strategy as an inspection sample:
- 5.3 Alt-Strategy, "Alternative Core Cooling Mitigating Strategies," Revision 023,
Attachment 4, "Manual Operation of RCIC [reactor core isolation cooling]."
b. Findings
No findings were identified.
4. OTHER ACTIVITIES [OA]
40A2 Identification and Resolution of Problems
Corrective Actions for Fire Protection Deficiencies
a. Inspection Scope
The team selected a sample of condition reports associated with the licensee's fire
protection program to verify that the licensee had an appropriate threshold for identifying
deficiencies. In addition, the team reviewed the corrective actions proposed and
imolemented to verifv that thev were effective in correctina irlentifierl rlefir.ienr.ie!=: The
- " - - - - - ~.1 - ~ .- - - - - _. - - . _. - - - . - - -- - '.;;I - _. - ** _ *.* - - - - ** _ . _ ** _. - - * * * * --
team also evaluated the quality of recent engineering evaluations through a review of
condition reports, calculations, and other documents during the inspection.
b. Findings
Findings related to this review are documented in Sections 1R05.01 and 1R05.05. No
additional findings were identified.
- 19 - Enclosure
40A6 Meetings, Including Exit
Exit Meeting Summary
The team presented the inspection results to Mr. D. Willis, General Manager, Plant
Operations, and other members of the licensee staff at a debrief meeting on November
5, 2010. The licensee acknowledged the findings presented.
The team presented the inspection results to Mr. D. Suman, Director of Engineering, and
other members of the licensee staff at an exit meeting on March 14, 2011. The licensee
acknowledged the findings presented.
The inspectors confirmed that proprietary material examined during the inspection had
been returned.
ATTACHMENTS: SUPPLEMENTAL INFORMATION
FINAL SIGNIFICANCE DETERMINATION SUMMARY
- 20 - Enclosure
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
licensee Personnel
J. Aldana, Security Coordinator
R. Alexander, Electrical Superintendent
J. Austin, System Engineering Manager
1. Barker, Quality Assurance Manager
J. Bebb, Security Manager
S. Bebb, Administrative Services Manager
M. Bergmeier, Operation Support Group Supervisor
K. Billesbach, Materials, Purchasing and Contracts Manager
D. Buman, Director of Engineering
K. Cardy, Fire Protection Engineer
G. Chinn, Contractor
L. Deuhirst, Corrective Actions and Assessments Manager
R. Dyer, Engineering Support Program Engineer
J. Dykstra, Electrical Engineering Program Supervisor
R. Estrada, Design Engineering Manager
J. Flaherty, Senior Staff licensing Engineer
J Gage, Reactor Operator
R. Gauchat, Security Training Supervisor
1. Hattovy, Engineering Support Manager
D. Jones, Safety Coordinator
1. Kahland, Reactor Operator
C. Long, Engineering Specialist
D. McGargill, Non-licensed Operator
1. Mue!!er, Senior Reactor Operator
K. Newcomb, Fire Marshal
D. Oshlo, Information Technology Manager
R. Penfield, Operations Manager
D. Seylock, Training Manager
J. Shrader, Fire Safety Lead, Nebraska Public Power District
D. Van Der Kap, licensing Manager
M. Van Winkle, Electrical Design Supervisor
D. Weniger, Valves Program Engineer
D. Willis, General Manager, Plant Operations
A. Zaremba, Director of Nuclear Safety Assessment
NRC personnel
M. Chambers, Resident Inspector
S. Vaughn, NRR/DIRS/IPAB
J. Bowen, NRR/DIRS/IRIB
D. Loveless, Senior Reactor Analyst, RIV/DRS
M. Runyan, Senior Reactor Analyst, RIV/DRS
A-1 Attachment 1
UST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
05000298/2009006-01 AV Inadequate Post-Fire Safe Shutdown Procedures
(Section 1R05.01)
Opened and Closed
05000298/2009006-02 NCV Failure to Correct a Condition Adverse to Quality
Related to Post-Fire Safe Shutdown
(Section 1R05.05)
Closed None
UST OF ACRONYMS
ADAMS Agencywide Documents Access and Management System
BWR Boiling Water Reactor
CR Condition Report
CFR Code of Federal Regulations
DRS Division of Reactor Safety
FSAR Final Safety Analysis Report
HPCi High Pressure Coolant Injection
LPSI Low Pressure Safety Injection
MOV Motor Operated Valve
NCV Noncited Violation
NFPA National Fire Protection Association
NRC Nuclear Regulatory Commission
PAR Publicly Available Records
PRA Probabilistic Risk Assessment
RCIC Reactor Core Isolation Cooling
RHR Residu'al Heat Removal
SDP Significance Determination Process
SRV Safety/Relief Valve
A-2 Attachment 1
LIST OF DOCUMENTS REVIEWED
CALCULATIONS
Number Title Revision
NEDC 01-030 HPCI Room Heatup During Appendix R Shutdown from 2
Alternative Shutdown Panel
NEDC 09-080 Multiple Spurious Operation Expert Panel Results 0
NEDC 85-081 Pressure Drop in Steam Line to the HPCI Turbine OCi
NEDC 94-034H Containment Analysis for Appendix R - Shutdown from 2
Alternative Shutdown Room
NEDC 95-003 Determination of Allowable Operating Parameters for 23
CONDITION REPORTS (CRs)
CR-CNS-2004-03595 CR-CNS-2004-05511 CR-CNS-2006-03138
CR-CNS-2007 -01248 CR-CNS-2007 -04155 CR-CNS-2007 -07065
C R -C N S-2008-05653 CR-CNS-2008-5751 CR-CNS-2008-05766
CR-CNS-2007 -08253 CR-CNS-2010-02387 CR-CNS-2010-03500
CR-CNS-2010-05023 CR-CNS-2010-05269 CR-CNS-2010-05855
CR-CNS-2010-05856 CR-CNS-2010-06942 CR-CNS-2010-06184
CR-CNS-2010-06236 CR-CNS-2010-06245 CR-CNS-2010-06258
CR-CNS-2010-06264 CR-CNS-2010-06441 CR-CNS-2010-06775
CR-CNS-2010-06942 CR-CNS-201 0-0701 0 CR-CNS-2010-07527
CR-CNS-2010-07527 CR-CNS-2010-07553 CR-CNS-2010-07553
CR-CNS-2010-07757* CR-CNS-2010-07762* CR-CNS-2010-07776*
CR-CNS-2010-07803* CR-CNS-2010-07813* CR-CNS-2010-07823*
CR-CNS-201 0-07831 * CR-CNS-2010-07839* CR-CNS-2010-07847*
CR-CNS-2010-07848* CR-CNS-2010-07857* CR-CNS-2010-07859*
CR-CNS-201 0-07861 * CR-CNS-201 0-07914 * CR-CNS-2010-08163*
CR-CNS-2010-08165* CR-CNS-2010-08166* CR-CNS-2010-08167*
I CR-CNS-201 0-08201 * I CR-CNS-201 0-08221 * I CR-CNS-2010-08250*
A-3 Attachment 1
[ CR-CNS-2010-08253*
- Condition Report initiated due to inspection activities.
DRAWINGS
Number Title Revision
14EK-0144 Diesel Engine Generator Schematic Diagram N22
85B-70008 Sheet
Wiring Diagram WD-12, 13, & 14 F.v.R Starter NOO
159
Ruskin Model NIBD23 3 Hour Type C - U.L. Labeled
0709-003 B
Horizontal Fire Damper 1 X 1
Ruskin Model NIBD23 3 Hour Type A - U.L. Labeled
0717-005 N01
Horizontal Fire Damper
Ruskin Model NIBD23 3 Hour Type C - U.L. Labeled
00735-001 0
Horizontal Fire Damper 1 X 1
Flow Diagram - Circulating, Screen Wash and Service I
2006 Sheet 1 N76
Water Systems
Flow Diagram - Reactor Building - Closed Cooling
2031 Sheet 2 N65
Water System
Flow Diagram - Reactor Building - Service Water
2036 Sheet 1 N98
System
Flow Diagram, Reactor Buiding Floor & Roof Drain N49
2038 Sheet 1
Systems .-.~---
Flow Diagram, Reactor Buiding Floor & Roof Drain
2038 Sheet 2 N03
Systems
2040 Sheet 1 Flow Diagram - Residual Heat Removal System N80
2042 Flow Diagram - Reactor Building - Main Steam System N85
2045 Sheet 1 Flow Diagram - Core Spray System N58
2016 Sheet 1C Flow Diagram - Fire Protection - Reactor Building N03
Fire Protection System - Flow Diagram For Pumphouse
2016 Sheet 2 N30
and Storage Tanks
2016 Sheet 4 Halon and Cardox System Flow Diagram N04
Reactor Building-Main Steam System-Cooper Nuclear
2041 N23
Station
2629-1 8" MS-1 & 10" MS-1 Main Steam N17
Auxiliary One Line Diagram Motor Control Center Z,
3002 Sheet 1 Switchgear Bus 1A, 1B, 1E, And Critical Switchgear N44
I Bus 1F, And 1G
A-4 Attachment 1
Auxiliarl One Line Diagram Motor Control Center C, D,
3004 Sheet 3 N22
H, J, DG1, And DG2
3012 Sheet 1 Main Three Line Diagram N08 I
3012 Sheet 2 Main Three Line Diagram N06
3012 Sheet 3 Main Three Line Diagram N19
3012 Sheet 4 Main Three Line Diagram N13
3012 Sheet 5 Main Three Line Diagram N15
3012 Sheet 6 Main Three Line Diagram N17
3012 Sheet 7 Main Three Line Diagram N08
3012 Sheet 8 Main Three Line Diagram N07
3012 Sheet 8a Main Three Line Diagram N05
3012 Sheet 9 Main Three Line Diagram N09
3012 Sheet 10 Main Three Line Diagram N11
I 3012 Sheet 12 Electrode Boiler Switchgear Main Three Line Diagram N03
3019 Sheet 3 4160V Switchgear Elementary Diagrams N36
3020 Sheet 4 4160V Switchgear Elementary Diagrams N20
3020 Sheet 8 4160V Switchgear Elementary Diagrams N32
3020 Sheet 9 4160V Switchgear Elementary Diagrams N22
3020 Sheet 4 4160V Switchgear Elementary Diagrams N20
4160V Switchgear Elementary Diagrams
3024 Sheet 8 N32
Lighting Plan
3045 Sheet 14 Control Elementary Diagrams N48
3058 D.C. One Line Diagram N53
3058 Sheet 1 D.C. One Line Diagram N53
3059, Sheet 1 D.C. Panel Schedules Cooper Nuclear Station 36
3065 Sheet 17 Control Elementary Diagrams N44
3065 Sheet 17a Control Elementary Diagram N11
3177 Outdoor Grounding Plans And Details N02
3251 Sheet 11 4160V Switchgear Connection Wiring Diagram N20
480V Motor Control Center R Connection Wiring
3253 Sheet R-1 N15
I Diagram
A-5 Attachment 1
3257, Sheet 71 Alternative Shutdown ADS Panel Internal Connections N06
3700 Sheet 16 Annunciator Elementary Ladder Diagram N05
3720 Sheet 1 Multiplexer Input Wiring ANN-MUX-10 N04
3726 Sheet 1 Multiplexer Input Wiring ANN-MUX-16 N03
3727 Sheet 1 Multiplexer Input Wiring ANN-MUX-17 N05
Annunciator Loop Diagram ANN-MUX-01 Devices
3751 Sheet 7 NOO
Sheet No. 6B
3757 Sheet 1 Annunciator Loop Diagram ANN-MUX-07 N01
3766 Sheet 1 Annunciator Loop Diagram ANN-MUX-16 N02
3767 Sheet 1 Annunciator Loop Diagram ANN-MUX-17 N04
Horizontal Drawout M/C Switchgear Device And
0133C8690 Sheet 15 1-17-1973
Harness Identification
0223R0558 Sheet 32 Power And Control Circuits Line-Up 08 Units 1 And 2 N22
Piping Isometric - Wet Sprinkler System Electrical
453200226 Trays In North East Corner Reactor Building - Floor N04
Elevation 903'-6" I
454016108 Contract E69-20 Fire Protection System N10
454016113 Contract E69-20 Fire Protection System N01
454016115 Contract E69-20 Fire Protection System N01
f"'~~.~~~. r::c" "" r::;~~ n~~.~_.; __ C' .. _._~ h..A A
454016116 vUlllI Clvl !::U;:1-':'U I-II 0 r I UlOvllU11 u Y:::'lOIII l'iU'"t
Nebraska Public Power District Contract Number
454016126 N04
E-69-20
115D6011, Sheet 1 Local Rack 25-50 NOO
729E720BB High Pressure Coolant Injection System N03
730E149BB, Sheet 1 Functional Control Diagram N05
730E149BB, Sheet 2 Main Steam Line Isolation Valve Control System Logic N04
791 E253 Sheet 1 Automatic Blowdown System Elementary Diagram N30
791 E253 Sheet 2 Automatic Blowdown System Elementary Diagram N27
791 E253 Sheet 3 Automatic Blowdown System Elementary Diagram N11
Elementary Diagram Reactor Core Isolation Cooling
791 E264 Sheet 7 N15
System (13-113)
...,,, ... ""..., ... C'L... __ '" ~ Cooper Nuclear Station-HPCI System-Elementary ....1""1"\
l'i 1;:1
11;:1IE':'1 I, ullOOlU
I Diagram
A-6 Attachment 1
Elementary Diagram Primary Containment Isolation
791 E266 Sheet 12 N12
System (16-23)
791E514 Sheet 1 Connection Diagram Panel 9-21 N23
791 E514 Sheet 2 Connection Diagram Panel 9-21 N01
944E689 Sheet 1 Elementary Diagram (Mod) Low-Low Set N13
CNS-EO-105 Sheet 1 EO Configuration Detail GE/PCI Pressure Switch N01
EO Configuration Detail, GE/PCI Pressure Switch
CNS-EO-i05 Sheet 2 N01
Tabulation Sheet
932'-6" Reactor Building - North Wall Critical
CNS-FP-146 N06
Switchgear Room 1G Fire area Boundary Drawing
Fire Area Boundary Drawing Diesel Generator Room
CNS-FP-170 N05
"1" South Wall
Fire Area Boundary Drawing Diesel Generator Room
CNS-FP-171 N05
"2" North Wall
Fire Protection Pre-Fire Plan Reactor Building First I
CNS-FP-215 N04
Floor Elevation 903'-6"
Fire Protection Pre-Fire Plan Reactor Building Critical
CNS-FP-216 N03
Switchgear Room 1F Elevation 932'-6"
Fire Protection Pre-Fire Plan Reactor Building MG Set
CNS-FP-221 N05
Area Elevation 976'-0"
Fire Protection Pre-Fire Plan Diesel Generator Building
CNS-FP-236 N05
D.G. # 1 Elevations 917'-6" and 903'-6" I I
CNS-FP-285 Sheet 1 CNS Fire Barrier Penetration Seal Details N04
Safe Shut Down Component Locations & Emergency
CNS-EE-186 4
Route Lighting, 903'-6" Diesel Generator Building
CNS-LRP-3, Sheet 4 Local Rack 25-50 Structure NOO
CNS-LRP-3, Sheet 8 Local Rack 25-50 Structure N01
CNS-LRP-3, Sheet 9 Local Rack 25-50 Structure N02
E0223R0558, Sheet Power And Control Circuits Line-Up 09 Units 1 And 2
N23
33 Lighting Plan Sheet 2
Integrated Control Circuit Diagram CS-MOV-M012A
E501 Sheet 17A N01
Core Spray Inboard Injection Valve
E501 Sheet 17B Integrated Control Circuit Diagram RHR-MOV-M025A N02
Integrated Control Circuit Diagram RHR-MOV-M027 A
E501 Sheet 17C N02
RHR Loop A Injection Outboard Isolation
Integrated Control Circuit Diagram RHR-MOV-M018
E501 Sheet 2'),A I\In1
I RHR Suction Cooling Inboard Isolation Valve
A-7 Attachment 1
Integrated Control Circuit Diagram SW-MOV-M089A
E50i Sheet 26A N01
RHR Heat Exchanger A Service Water Outlet
Integrated Control Circuit Diagram RCIC-MOV-M021
I E501 Sheet 29C
RCIC Injection
N01
E501 Sheet 30 Motor Operated Valves Connection Diagrams N08
Integrated Control Circuit Diagram RHR-MOV-M017
E501 SHEET30C N01
RHR Shutdown Cooling Supply Outboard isolation
Integrated Control Circuit Diagram HPCI-MOV-M058
E501 Sheet 33A N01
HPCI Pump Suction From Suppression Pool
E501 Sheet 44 Motor Operated Valves Connection Diagrams N02
Integrated Control Circuit Diagram RHR-MOV-M025B
E501 Sheet 45A N02
RHR Loop B Injection Inboard Isolation
Integrated Control Circuit Diagram SW-MOV-M089B
E501 Sheet 48A N02
RHR Heat Exchanger B Service Water Outlet
E507 Sheet 24 Connection Wiring Diagram Reactor Building N08
E507 Sheet 29 Connection Wiring Diagrams Reactor Building N03
Reactor Building Terminal Box 242 Connection Wiring
I E507 Sheet 235 Diagram
N01
G5-262-743 Sheet 1 Emergency Diesel Generator No.1 Electrical Schematic N23
G5-262-746 Sheet 2 Emergency Diesel Generator No.1 Electrical Schematic N18
G5-262-746 Sheet 3 Emergency Diesel Generator No.1 Electrical Schematic N23
G5-262-746 Sheet 4 Emergency Diesel Generator No.1 Electrical Schematic N12
Emergency Diesel Generator No.1 Internal Wiring
G5-262-746 Sheet 5 N19
Diagram
Emergency Diesel Generator No.1 Control Panel Wiring
G5-262-746 Sheet 6 N16
Diagram
X2629-200 MS-1 Main Steam N06
FP08-01-FP-SD-61 A&B FP10-01-NO APPDX R FP10-01-FP-SD-533
LIGHT CEILING TILE
FP10-02-FP-HT-3 FLOODED FP1 0-01-FC9ASDG1 OOF FP1 0-01-EE-LTG-APP R
FP10-02-6.FP.302 FP10-01-COMP RM TILES FP10-01-FP-PNL-CAS
FP1 0-01-RW BLDG HORNS FP1 0-01-CORE BORES FP10-01-SWP RM HALON
FP10-01-EE-LTG-R18 BULB FP10-02-FP-HT-12 FP1 0-02-FP-HT-15
FAIL IMPAIRED INACCESSABLE
FP10-01-APPDX R F\f\J FP1 0-01-VVVV FALSE ALRM FP1 n-n1-FP A'pP R
I OVERFILL I AHU1
A-8 Attachment 1
PREVENTIVE MAINTENANCE TASKS
14624836 14624889 [4663722 [4663770 14712840 [4713833
PROCEDURES
Number Title Revision
Ad min istrative
Conduct of the Condition Report Process 67
Procedure 0.5
Administrative
Operating Experience Program 21
Procedure 0.10
Administrative
CNS Fire Protection Plan 60
Procedure 0.23
Administrative
Hot Work 42
Procedure 0.39
Administrative
Fire Watches and Fire Impairments 6
Procedure 0.39.1
Emergency
Procedure 5.3ALT- Alternative Core Cooling Mitigating Strategies 23
STRATEGY
Emergency
Procedure 5.4FIRE- Fire Induced Shutdown From Outside Control Room 38
Emergency
Procedure 5.4POST- Post-Fire Operational Information 36 and 37
FIRE
Maintenance
Appendix RISSO Lighting Functional Test 20
Procedure IS.EE.302
Maintenance
3M Interam E-5A Fire Wrap Fire Resistive Assembly 12
Procedure 7.3.21.7
Non-TS Surveillance
Fire Detection System Tri-Annual Test (Group 1) 15
Procedure 15.FP.303
Non-TS Surveillance
Critical Switchgear Room Duct Wrap Visual Inspection 2
Procedure 15.FP.652
3.9 ASME OM Code Testing Of Pumps and Valves 25
(""t. * * _ __ =11.,- __ -.._ A ........ ,.... .. Ii.-. 'r 1._ r":._ " .. :1. ,... ~ ..' '-' _ r A"' ....... " ...... '"
I f'\U'::> Tram
. "._ I \ A A
I .::>UI Vt:::IIIC:lII(;t::: IVIi::H1UC:lI v C:llve '"-II (;Ull ,"-onnnUity f'\;:'U-f'\U;:' I I
A-9 Attachment 1
Procedure Panel
6.ADS.202
Surveillance
1ST Closure Test of HPCI-CV-10CV and RCIC-CV-
Procedure 7
10CV
6.CSCSA04
Surveillance
Annual Testing of Fire Pumps 30
Procedure 6.FP.102
Surveillance Fire Damper Assembly Examination (Fire Protection
Procedure 6.FP.203 System 18 Month Examination)
o and 9
Surveillance
Operations Power Block Sprinkler System Testing 17
Procedure 6.FP.301
Surveillance
Automatic Deluge and Pre-Action Systems Testing 19
Procedure 6.FP.302
Surveillance
Fire Detection System Circuitry Operability 7
Procedure 6.FP.304
Surveillance
Fire Barrier/Fire Wall Visual Examination 12
Procedure 6.FP.606
Surveillance
Calibration Procedure for HPCI Pressure
Procedure 8
Instrumentation
6.HPC1.306
Surveillance
Procedure HPCI Turbine Trip and Initiation Logic Functional Test 7
6.HPC1.311
Surveillance
Safety Valve and Relief Vaive Position indication '13
Procedure
Operability Check And LLS Logic Test
6.SRV.303
Surveillance
Diesel Generator C02 Operability Teat (DIV 1) 10
Procedure 6.1 FP.301
Surveillance
Fire Detection System 184 Day Examination 9
Procedure 6.1 FP.302
Surveillance
High Pressure C02 Cylinder Examination (DIV 1) 12
Procedure 6.1 FP.601
Surveillance Safe Shutdown BBESI Emergency Lighting Unit
14
Procedure 7.3.12.2 Examination and Maintenance
Surveillance
Appendix RISBO Lighting Functional Test 20
Procedure 15.EE.302
Surveillance
Fire Detection System Tri-Annual Test (Group 3) 10
Procedure 15.FP.305
I System Operating I Communication Systems 41
A-10 Attachment 1
MISCELLANEOUS DOCUMENTS
Number Title Revision
COR002-18-02 OPS-Reactor Core Isolation Cooling 17
Cutler-Hammer Instructions For Size 1 Or 2 Type B Thermal June 1998
Overload Relay, 3 Pole, Ambient Compensated Or
Non-Compensated I.L.16954A
Design Criteria Fire Protection Systems May 10, 2010
Document 11
Engineering Evaluation of Critical Switchgear Rooms 1F and 1G 0
Evaluation Number Fire Barrier Separation
EE 09-031
Evaluation Number Appendix R MOV Overthrust Evaluation 0
EE 04-046
Engineering I Ruskin Manufacturing Company - Site Storage and 2
Procedure Number Handling of NIED-23 Curtain Type Fire Dampers
E-510
EODP.2.210 Electroswitch Series 24 (3 Sheets On EO 10
Certification of Model 2421 OB Switch)
Letter LOA8200158 Fire Protection Rule 10 CFR 50, Appendix R June 28, 1982
Letter LOA83001 09 Fire Protection Rule 10 CFR 50, Appendix R, March 18,
Preliminary Supplemental Response (Revised) 1983
Nebraska Public Response to Appendix A to Branch Technical December 17,
Power District Letter Position APCB 9.5-1 Guidelines for Fire Protection 1976
for Nuclear Power Plants
Nebraska Public Revisions and Additional Information Fire Protection April 6, 1977
Power District Letter Review
~~ebraska Public Fire Protection Rule 10 CFR 50, Appendix R, June 02, 1983
Power District Letter Preliminary Supplemental Response (Revision 2)
NRC Letter K. R. Goller, NRC, to Nebraska Public Power District November 29,
1977
NRC Letter G. Lear, NRC, to Nebraska Public Power District February 24,
1978
NRC Letter T. Ippolito, NRC, to Nebraska Public Power District May 23,1979
NRC Letter T. ippolito, NRC, to Nebraska Public Power District September 18,
A-11 Attachment 1
NRC Letter Ippolito, NRC, to Nebraska Public Power District November 21,
I 1980 I
NRC Letter D. Vassallo, NRC, to Nebraska Public Power District April 29, 1983
NRC Letter D. Vassallo, NRC, to Nebraska Public Power District September 21,
1983
NRC Letter D. Eisenhut, NRC, to Nebraska Public Power District September 21,
1983
NRC Letter Safety Evaluation For Appendix R to 10 CFR Part April 16, 1984
50, Items II.G.3 and III.L, Alternative or Dedicated
Shutdown Capability
NRC Letter Outstanding Fire Protection Modifications August 21,
1985
NRC Letter W. Long, NRC, to Nebraska Public Power District April 10, 1986
NRC Letter W. Long, NRC, to Nebraska Public Power District September 9,
1986
NRC Letter Cooper Nuclear Station - Amendment No. 126 to November 7,
Facility Operation License No. DPR-46 1988
NRC Letter Cooper Nuclear Station - Amendment No. 127 to February 3,
Facility Operation License No. DPR-46 1989
NRC Letter Revocation Of Exemption From 10 CFR Part 50, August 15,
Appendix R - Cooper Nuclear Station 1995
NRC Letter Conversion To Improved Technical Specifications July 31, 1998
For The Cooper Nuclear Station - Amendment No.
178 To Facility Operating License No. DPR-46
OTH015-92-02 Lesson Plan Post Fire Shutdown Outside The 09
Control Room Procedures (5.4POST-FIRE,
5.4FIRE-S/D,5.1ASD)
Siemens-Allis DC DC Contactors Special Purpose 2 Pole, 600V Max No Date
Contactors AC or DC Operated Paaes 147 And 148
Siemens Overload Manufactures Data Thermal Overload Relays Type April 1997
2 Sheets 3UA59
Siemens Overload Manufacture's Data On Bimetallic Thermally No Date
4 Sheets Delayed Overload Relays Type 3UA5, 3UA6 Class
10
Southwest Research NPPD PO# 4500092806 Williams Fire Pump Diesel July 29,2008
Institute Oil Test Summary Report
Southwest Research NPPD PO# 4500100440 Williams Fire Pump Diesel Revision 1
Institute Oil Analytical Test Report May 11,2009
Southwest Research NPPD PO# 4500102145 Williams Fire Pump Diesel May 18, 2010
Institute Oil Analvtical Test Report
I Technical Publication I Electroswltch Senes 24 Instrument and Control I February 1998 I
A-12 Attachment 1
24-1 Switches For Power Industry and Heavy Duty
Industrial Applications
Technical Fire Protection Systems July 29, 2010
Requirements
Manual Section 3.11
Technical Alternative Shutdown System Amendment
Specification 3.3.3.2 233
Updated Safety Alternative Shutdown Capability July 24, 2001
Analysis Report
Section VII-18
Updated Safety Fire Protection System January 08.
Analysis Report 2004
Section X-9
Updated Safety Appendix R Safe Shutdown January 29,
Analysis Report 2003
Section X-18
Updated Safety Fire Protection Program April 16, 2010
Analysis Report
Section XIII-1 0
VM-1730 Emergency Lighting 1
Westinghouse Starter Manufactures Data Sheets Showing 460 VAC A201, April 1984
Information A211, A251 Size 2 Magnetic Contactor Non-
Reversing Or Reversing I. L. 16961 A
257HA354AC GE Design Specification, Sheet 2 2
790523 Amendment No. 56 to Facility Operating License No. 001
4605196 Sample Fuel Oil And Send For Analysis For Williams July 29, 2008
B.5.b Credited Pump
4625867 Sample Fuel Oil And Send For Analysis For Williams April 29, 2009
B.5.b Credited Pump
4664953 Sample Fuel Oil And Send For Analysis For Williams May 03,2010
B.5.b Credited Pump
1ST Reference/Acceptance Limits Data File 205
SYSTEM TRAINING MANUALS
Number Title Revision
COR002-11-02 High Pressure Coolant Injection 26
COR002-19-02 Reactor Equipment Cooling 20
,..,,, /"\,.., n __ :-I .. _I I I_,-L r"\ ____ **._1 ,..,..,
I r\t:::'IUUdl
""r"\n/"\(v~ ("\."-".1. ____
nt:dl r\t:IIIUVdl "y:stt:::rll L.t
A-13 Attachment 1
WORK ORDERS
4704976 4704973 4705129 4636801 4704980 4705274 4704985 4704986
4705369 4541652 4680341 4600849 4601469 4625865 4627329 4629553
4634534 4636434 4643635 4648115 4649842 4656140 4659221 4659685
4662049 4664951 4688234 4691445 4694802 4702636 4704770 4711699
4712867 4713861
A-14 Attachment 1
FINAL SIGNIFICANCE DETERMINATION SUMMARY
COOPER TRIENNIAL FIRE PROTECTION ISSUE
Significance Determination Basis
a. Phase 1 Screening Logic, Results, and Assumptions
In accordance with NRC Inspection Manual Chapter 0612, Appendix B, "Issue
Screening," the issue was determined to be more than minor because it was
associated with the equipment performance attribute and affected the mitigating
systems cornerstone objective to ensure the availability, reliability, or function of a
system or train in a mitigating system in that 3 motor-operated valves would not have
functioned following a postulated fire in multiple fire zones. The following summarizes
the valves and fire areas affected:
- Valves Affected
RHR-MO-25A Residual Heat Removal (RHR) A Inboard Injection Valve
RHR-MO-25B RHR B Inboard Injection Valve
RR-MO-53A Reactor Recirculation Pump A Discharge Valve
- Fire Areas Affected
CB-A-1 Control Building Division 1 Switchgear Room and Battery Room
CB-B Control Building Division 2 Switchgear Room and Battery Room
CB-C Control Building Reactor Protection System Room 1B
CB-D Control Room, Cable Spreading Room, Cable Expansion Room,
and Auxiliary Relay Room
RB-DI (SW) Reactor Building South/Southwest 903, Southwest Quad 889 and
859, and RHR Heat Exchanger Room B
RB-DI (SE) Reactor Building RHR Pump B/HPCI Pump Room
RB-J Reactor Building Critical Switchgear Room 1F RB-K Reactor
Building Critical Switchgear Room 1G
RB-M Reactor Building North/Northwest 931 and RHR Heat
ExchangerRoom
RB-N Reactor Building South/Southwest 931 and RHR Heat
Exchanger Room B
TB-A Turbine Building (multiple areas)
The significance determination process (SDP) Phase 1 Screening Worksheet
(Manual Chapter 0609, Attachment 4), Table 3b directs the user to Manual Chapter
0609, Appendix F, "Fire Protection Significance Determination Process," because it
affected fire protection defense-in-depth strategies involving post fire safe shutdown
systems. However, Manual Chapter 0308, Attachment 3, Appendix F, "Technical
Basis for Fire Protection Significance Determination Process for at Power
Operations," states that Manual Chapter 0609, Appendix F, does not include explicit
B-1 Attachment 2
treatment of fires in the main control room. The Phase 2 process can be utilized in
the treatment of main control room fires, but it is recommended that additional
guidance be sought in the conduct of such an analysis.
b. Phase 2 Risk Estimation
Based on the complexity and scope of the subject finding and the significance of the
finding to main control room fires, the analyst determined that a Phase 2 estimation
was not appropriate.
c. Phase 3 Analysis
A risk analysis was performed previously of a similar problem that affected the three
valves addressed by this performance deficiency. This was documented in EA 07-204,
Report Number 05000298/2008008, dated June 13, 2008. In both cases, Valves RHR-
MOV-25A, RHR-MOV-25B, and RHR-MOV-53A were incapable of being remotely
operated from the motor starter as prescribed by Procedure 5.4FIRE-S/O. The risk
estimate performed in 2008 as it pertains to these three valves (the 2008 Phase 3 also
included several other valves) remains valid for the current situation. However, changes
were made to Procedure 5.4FIRE-SID subsequent to the 2008 issue. These changes
were credited in the current analysis and resulted in a decrease in the risk significance of
the subject valves. Text from the 2008 risk analysis is shown in italics throughout this
document.
In accordance with Manual Chapter 0609, Appendix A, the analyst performed a Phase 3
analysis using input from the Nebraska Public Power District, "Individual Plant
Examination for External Events (IPEEE) Report- 10 CFR 50. 54 (f) Cooper Nuclear
Station, NRC Docket No. 50-298, License No. DPR-46, dated October 30, 1996, the
JJ
Standardized Plant Analysis Risk (SPAR) Model for Cooper, Revision 3.31, dated
September 2007, licensee input (see documents reviewed list in Enclosure 3), a
probabilistic risk assessment using a linked event tree model created by the analyst for
evaluating main control room evacuation scenarios, and appropriate hand calculations.
[Note: The SPAR model used in the 2008 analysis has been superseded by newer
versions. However, the risk result gained from the portion of the analysis that
used this model (non-alternative shutdown scenarios) was not significant to the
current risk estimate. Virtually all of the risk associated with the current issue
results from the alternative shutdown scenarios for which a specific SPAR model
was created. Therefore, the use of the older mode! has no consequence.]
Assumptions:
1. For fire zones that do not have the possibility for a fire to require the main
control room to be abandoned, the ignition frequency identified in the
IPEEE is an appropriate value.
2. The fire ignition frequency for the main control room (PF1F) is best
quantified by the licensee's revised value of 6.88 x 10- 3/yr.
B-2 Attachment 2
3. Of the original 64 fire scenarios evaluated, 18 were determined to be
redundant and were eliminated, 41 of the remaining (documented in Table
1) were identified as the predominant sequences associated with fires that
did not result in control room abandonment. [Note: the current issue did
not include all of the fire scenarios from the 2008 issue, but all of the
current fire scenarios are included in the 2008 compilation]
4. The baseline conditional core damage probability for a control room
evacuation at the Cooper Nuclear Station is best represented by the creation
of a probabilistic risk assessment tool previously created by the analyst using
a linked event tree method. The primary event tree used in this model is
displayed as Figure 1 in the Attachment. The baseline conditional core
damage probability as calculated by the linked event tree model was
1.14 x 10- 1, which is similar to the generic industry value of 0.1.
5. The analyst used an event tree, RECOVERY-PA TH, shown in Figure 2 in the
Attachment, to evaluate the likelihood of operator recovery via either
restoration of HPCI or manually opening Valve RHR-MO-258. The resulting
non-recovery probability was 7. 9 x 10-2 . [Note: This value was adjusted to
1.01 E-3 in the current analysis based on improvements made to
Procedure 5.4FIRE-SID.]
6. The risk related to a failure of Valve RHR-MO-258 to open following an
evacuation of the main control room was evaluated using the analyst's linked
event tree model. The conditional core damage probability calculated by the
linked event tree model was 1.19 x 10- 1 .
7. Any fire in the main control room that is large enough to grow and that goes
unsuppressed for 20 minutes will lead to a control room evacuation.
8. Any fire that is unsuppressed by automatic or manual means in the auxiliary
relay room, the cable spreading room, the cable expansion room or
Area R8-FN will result in a main control room evacuation.
9. The Cooper SPAR model, Revision 3.31, represents an appropriate tool for
evaluation of the core damage probabilities associated with postulated fires
that do not result in main control room evacuation.
10. All postulated fires in this analysis resulted in a reactor scram. In addition,
the postulated fire in Fire Area R8-K resulted in a loss-of-offsite power.
11. Valves RHR-MO-25A and RHR-MO-258 are low pressure coolant injection
system isolation valves. These valves can prevent one method of decay heat
removal in the shutdown cooling mode of operation.
12. For Valves RHR-MO-25A and RHR-MO-258, the subject performance
deficiency only applies to the portion of the post fire procedures that direct the
transition into shutdown cooling.
8-3 Attachment 2
13. Valve RHR-MO-25B must opened from the motor-control center for operators
to initiate alternative shutdown cooling from the alternative shutdown panel
following a main control room evacuation.
14. Valve RHR-MO-53A is the discharge isolation valve for Reactor Recirculation
Pump 1-A. The failure to close either this valve or Valve RR-MO-43A would
result in a short circuit of the shutdown cooling flow to the reactor vessel. The
performance deficiency did not apply to Valve RR-MO-43A.
15. The exposure time used for evaluating this finding should be determined in
accordance with Inspection Manual Chapter 0609, Appendix A, Attachment 2,
"Site Specific Risk-Informed Inspection Notebook Usage Rules. Given that
JJ
the performance deficiency was known to have existed for many years, the
analyst used the 1-year of the current assessment cycle as the exposure
period.
16. Based on fire damage and/or procedures, equipment affected by a postulated
fire in a given fire zone is unavailable for use as safe shutdown equipment.
17. The performance deficiency would have resulted in each of the demanded
valves failing to respond fol/owing a postulated fire.
18. In accordance with the requirements of Procedure 5.4POST-FIRE, operators
would perform the post-fire actions directed by the procedure following a fire in
an applicable fire zone. Therefore, the size and duration of the fire would not
be relevant to the failures caused by the performance deficiency.
19. Given Assumption 18, severity factors and probabilities of 17017-
suppression were not addressed for postulated fires that did not result in
main control room evacuation.
Postulated Fires Not Involving Main Control Room Evacuation:
The risk significance from fires not involving control room evacuation was determined to be
insignificant for the current finding. This was estimated by referring to the 2008 risk
evaluation. Text in italics is from the 2008 report and Table 1 is reproduced for the fire
areas that involve RHR-MOV-25A, RHR-MOV-258, or RHR-MOV-53A.
The senior reactor analyst used the SPAR model for Cooper Nuclear Station to estimate
the change in risk, associated with fires in each of the associated fire scenarios (Table 1,
Items 1 - 41) that was caused by the finding. Average unavailability for test and
maintenance of modeled equipment was assumed, and a cutset truncation of
a
1. x 10- 13 was used. For each fire zone, the analyst calculated a baseline conditional
core damage probability consistent with Assumptions 9, 10, 25 [now 17] and 26 [now
18].
8-4 Attachment 2
For areas where the postulated fire resulted in a reactor scram, the frequency of the
transient initiator, IE-TRANS, was set to 1.0. All other initiators were set to the house
event "FALSE," indicating that these events would not occur at the same time as a
reactor scram. Likewise, for Fire Area RB-K, the frequency of the loss-of-offsite power
initiator, IE-LOOP, was set to 1.0 while other initiators were set to the house event
"FALSE."
With input from the detailed IPEEE notebooks, maintained by the licensee, the analyst
was able to better assess the fire damage in each zone. This resulted in a more realistic
evaluation of the baseline fire risk for the zone, and lowering the change in risk for each
example.
Consistent with guidance in the Reactor Accident Sequence Precursor Handbook,
including NRC document, "Common-Cause Failure Analysis in Event Assessment,
(June 2007), " the baseline established for the fire zone, and Assumptions 22 through 26,
[now 15 through 19] the analyst modeled the resulting condition following a postulated
fire in each fire zone by adjusting the appropriate basic events in the SPAR model. Both
the baseline and conditional values for each fire zone are documented in Table 1.
As shown in Table 1, the analyst calculated a chanf',e in core damage frequency (IlCDF)
associated with these 41 fire scenarios of 2.9 x 1(J /yr. [Note: This result included fire
areas not affected by the current finding.]
The analyst evaluated the licensee's qualitative reviews of the 13 fire scenarios that were
impacted by the failure of the HPCI turbine to trip. In these scenarios, HPCI floods the
steam lines and prevents further injection by either HPCI or reactor core isolation cooling
system. Qualitatively, not all fires will grow to a size that causes a loss of the trip function
due to spatial separation. Additionally, not al/ unsuppressed fires would cause a failure of
the HPCI trip function. Finally, no operator recovery was credited in these evaluations.
Given that these qualitative factors would all tend to decrease the significance of the
finding, the analyst believed that the total change in risk would be significantly lower than
the 2.9 x 10-6/yr documented above. Based on analyst judgment and an assessment of
the evidence provided by the licensee, an occurrence factor of O. 1 was applied to the 13
fire scenarios. This resulted in a total IlCDF of 7.8 x 1Q-7/y r. Therefore, the analyst
determined that this value was the best estimate of the safety significance for these 41 fire
scenarios.
From Table 1, the total risk associated with fire areas that involve Valves RHR-MOV-25A,
RHR-MOV-25B, or RHR-MOV-53A is 5.5E-7. As noted above, in the 2008 analysis, there
were qualitative reasons for lowering this risk estimate. Also, because the previous
evaluation included the contribution from several other valves that affected the same fire
areas, the risk attributable to the current evaluation is lower. For these reasons, the analyst
concluded that the risk for the current finding is less than 1.0E-7 for fire areas that do not
involve control room evacuation.
B-5 Attachment 2
--
TABLE 1
Postulated Fires Not Involving Main Control Room Evacuation
Fire Estimated
Area/Shutdown Area/- Scenario Scenario Ignition Base CCDP Case CCDP delta-CDF Function Al'fected
Zone Number Description Frequency
Strate~IY Contribution
RHRA
RBC-CF 1C 1 Pump Room
2.94E-03 B.B2E-07 B.i5E-05 2.37E.07
2 MCC K 3.02E-03 2.76E-05 1.2BE-04 3.03E-07
3 MCCQ 3.93E-03 2.76E-05 1.2BE-04 3.95E-07
4 MCCR 3.43E-03 2.76E-05 1.2BE-04 3.44E-*07
5 MCC RB 1.62E-03 1.12E-03 1.21 E-03 1.46E-07
6 MCC S 2.23E-03 1.12E-03 1.21 E-03 2.01 E-07 Shut HPCI-MO-14,
7 MCCY 3.B3E-03 1.12E-03 1.21 E-03 3.45E-*07 HPCI-MO-16,
B Panel AA3 9.9BE-04 2.76e-05 1.2BE-04 1.00E-07 RHR-MO-921,
2AJ2C 9 Panel BB3 9.9BE-04 1.12E-03 1.21 E-03 B.9BE-OB RWCU-MO-1B and
RCIC Starter 5.27E-06 1.02E-07 MS-MO-77
10 1.32E-03 8.27E-05
Rack
11 250V Div 1 Rack 5. 1OE-04 2.76E-05 1.2BE-04 5.12E-OB
12 250V Div 2 Rack 2.09E-04 1.12E-03 1.21 E-03 1.BBE-OB
13 ASD Panels 3.02E-04 1.12E-03 1.21 E-03 2.72E-OB
CB-A 14 6.74E-03 7.64E-04 7.64E-04 O.OOE+OO
15 1.36E-03 2.61 E-06 2.61 E-06 O.OOE+OO
16 RPS Room 1A 4.15E-03 1.75E-07 1.75E-07 O.OOE+OO Open RHR-MO-25B
17 2.42E03 3.57E-04 3.5BE-04 4.B4E-10 and RHR-MO-67
Hallway (used B.74E-OB
1B 1.09E-02 2.05E-05 2.B5E-05
~-
CB corridor)
8-6 Attachment 2
--
--Fire Estimated
Area/- Scenario Scenario Ignition
Area/Sh utdown Number Description Base CCDP Case CCDP delta-CDF Function Affected
Strategy Zone Frequency Contribution
DC Switchgear
Open RHR-MO-17,
BH 19 Room 1A 4.27E-03 3.49E-03 3.49E-04 1.2BE-*09
RHR-MO-25B, and
CB-A'I RHR-MO-67
BE 20 Battery Room 2.25E-03 8.74E-06 1.03E-05 3.51 E-*09
1A
-- DC Switchgear
8G 21 Room 1B 4.27E-03 1.82E-03 1.83E-03 3.42E-OB
CB-B Open RHR-MO-25A
8F 22 Battery Room 2.25E-03 4.81 E-06 5.73E-06 2.07E-09
1B --
8B 23 4.15E-03 1.75E-07 1.77E-07 5.81 E-12 Open RHR-MO-17,
CB-C RPS Room 1A RHR-MO-25A, and
8C 24 4.15E-03 1.75E-07 1.77E-07 5.81 E-12 RHR-MO-67
_.
RHR Heat
Shut HPCI-MO-14
RB-DI (SW) 2D 25 Exchanger 6.70E-04 8.66E-05 8.68E-05 1.27E-10
and RR-MO-53A
Room B
RHR B/HPCI Shut HPCI-MO-14
RB-DI (SE) 1D/1 E 26 4.28E-03 6.48E-05 1.44E-04 3.37E-07
Pump Room and RR-MO-53A
Open RHR-MO-17,
Switchgear
RB-J 3A 27 3.71 E-03 5.28E-05 5.28E-05 O.OOE+OO RHR-MO-2EiB, and
Room iF RHR-MO-67
Switchgear 1.77E-02
RB-L 3B 28 3.71E-03 1.77E-02 O.OOE+OO Open RHR-MO-25A
Room 1G
RB Elevation
3C/3DI 29
932 1.13E-02 7.06E-06 8.99E-06 2.18E.08
3E Open RHR-MO-17
RB-M
and RHR-MO-25B
RHR Hx Room 6.70E-04 7.06E-06 8.99E-06 1.29E-09
2B 30 A --
3C/3D Reactor Building
RB-N 31 1.13E-02 1.22E-05 1.38E-05 1.81 E-08 Open RHR-MO-25A
13E Elevation 932
RHR Heat
2D 32 Exchanger 6.70E-04 1.22E-05 1.38E-05 1.07E-09
Room B
8-7 Attachment 2
Firea
Area/Shutdown
Strate(
Area/-
Zone
Scenario
Number
Scenario
Description
Ignition
Frequency
Estimated
delta-CDF
Contribution
Function
TB-A Condenser Pit
110 33 3.10E-03 4.83E-06 6.20E-06 4.25E-09
Area
Reactor
11E 34 Feedwater 6.25E-03 4.83E-06 6.20E-06 8.56E-*09
Pump Area
11 L 35 Pipe Chase 6.70E-04 4.83E-06 6.20E-06 9.18E-10
Condenser and 4.83E-06
12C 36 Heater Bay Area 3.27E-03 6.20E-06 4.48E-09
Open RHR-M017,
RHR-MO-25A, and
RHR-MO-67
120 37 TB Floor 9033 3.45E-03 4.83E-06 6.20E-06 4.73E-09
Operating Floor
13A 38 5.76E-03 4.83E-06 6.20E-06 7.89E-09
Non-critical
Switchgear
13B 39 3.79E-03 4.83E-06 6.20E-06 5.19E-09
Room
13C 40 Electric Shop 8.56E-04 4.83E-06 6.20E-06 1.17E-09
130 41 I&C Shop 8.90E-04 4.83E-06 6.20E-06 1.22E-09
Total Estimated .6COF for 41 Postulated Fire Scenarios 1291E-06
8-8 Attachment 2
Post-Fire Remote Shutdown Calculations:
Note: The risk attributable to post-fire remote shutdown (control room abandonment
sequences) results predominantly from the inability to operate Valve RHR-MOV-258 as
described in Procedure 5.4FIRE-SID. This is the credited train and the only procedural
means for initiating shutdown cooling during the recovery actions. The additional risk
contribution from RHR-MOV-25A and RHR-MOV-53A is negligible.
As documented in Assumptions 4, 5, and 6, the analyst created a linked event tree model,
using the Systems Analysis Programs for Hand-on Integrated Reliability Evaluation
(SAPHIRE) software provided by the Idaho National Laboratory, to evaluate the risks related
to fire-induced main control room abandonment at the Cooper Nuclear Station. This linked
event tree was used to evaluate the increased risk from the subject performance deficiency
during the response to postulated fires in the main control room, the auxiliary relay room, the
cable spreading room, the cable expansion room or Fire Area RB-FN. The primary event
tree used in this model is displayed as Figure 1 in the Attachment.
As documented in Assumption 5, the analyst used an event tree to evaluate the
likelihood of operator recovery via either restoration of l-IPCI or manually opening
Valve RHR-MO-25B. The resulting non-recover; probability was 1.01 E-3. The
derivation of this result is discussed below. This result applied only to sequences
where HPCI provides injection flow. In cases where HPCI fails or is not available,
there is much less time available to recover from the failure. For this case, a SPAR-
H evaluation was performed, and is discussed below.
Note: In the 2008 analysis, the non-recovery probability for HPCI success
sequences was determined to be 7.9E-2. This non-recovery probability was
decreased by a factor of 78 for the current finding because of changes that were
made to Procedure 5.4FIRE-SID. These changes directed operators to close SRVs if
RHR injection was not observed to be successful. Also, it directed operators to delay
securing HPCI until RHR injection is confirmed.
In the 2008 analysis, recovery credit was only applied to sequences that contained
an early success (lack of failure or unavailability) of HPCI. This is because with the
use of HPCI, a considerable amount of decay heat is removed prior to the point of
attempting to open RHR-MOV-258 in Procedure 5.4FIRE-S/D, and ample time is
available to diagnose the failure and manually open the valve prior to fuel damage.
Also, HPCI can be re-initiated in theSe cases to maintain reactor parameters, and the
new procedures instruct operators to keep HPCI online until low-pressure injection is
confirmed. However, if HPCI is out of service for maintenance or experiences a
failure, the only success path is to establish RHR low pressure injection and the time
available is very limited. According to the licensee's MAAP analysis, incipient core
damage will occur 15 minutes after RHR-MOV-258 fails to open unless it is opened
(manually) by that time. For early HPCI failures, it is assumed in this analysis
(consistent with the 2008 analysis) that there is enough time to reach the step in
Procedure 5.4FIRE-S/D where RHR-MOV-258 is opened. If it fails to open (1.2E-2 in
the base case, 1.0 in the condition case), operators have 15 minutes to diagnose the
situation (injection failure) and develop a strategy that includes visually checking the
position of RHR-MOV-258 and opening it manually to at least 23 hand wheel turns to
gei sufficieni fiow io prevent core damage.
The analyst considered whether changes to Procedure 5.4FIRE-S/O subsequent to
8-9 Attachment 2
the 2008 risk analysis could allow some recovery credit to be applied to sequences
involving early HPCI failure in the current analysis. One possible reason to do this is
that the revised procedure directs the operator at the alternative shutdown panel to
close SRVs in the event that RHR injection cannot be verified. This would have the
effect of delaying the depletion of water inventory in the core. However, the
diagnosis of this situation would likely take a long time. The operator at the
alternative shutdown panel would be difficult to determine quickly, whether low
pressure injection was successful because of a lack of direct indication (total RHR
flow is displayed, but the effect of successful injection would only be a slight increase
in the total RHR flow rate until Valve RHR-MO-34B is throttled closed to divert the
flow that was previously directed to the suppression pool). The reactor level
indication would likely be the first indication of unsuccessful injection, but a lowering
level could well be misinterpreted as a shrink from the injection of colder water. Also,
if the operator used the alternative method prescribed in the procedure, which is used
when nitrogen pressure is determined to be reliably available, he is directed to use
SRVs to maintain pressure within a band of 150-200 psig. This could result in
masking the lowering level from a lack of injection. For these reasons, the analyst
determined that recovery for early HPCI failure sequences would be challenging.
A SPAR-H evaluation was performed to estimate a non-recovery probability for HPCI
failure sequences. AI! non-nomina! PSFs are shown in the following table:
Diagnosis (nominal =1.0E-2) Action (nominal = 1.0E-3)
Available Time Barely Adequate (2/3 Time Required (10)
nominal) (10)
Stress High (2) High (2)
Complexity Moderate (2) Nominal
ExperiencelTraining Nominal High (0.5)
Procedures Poor (5) Nominal
Ergonomics Nominal 50% Poor, 50% nominal-(5.5)
Total PSF Product 200 55
HEP 0.67 0.05
Total HEP 0.72
The licensee's thermal-hydraulic analysis indicated that approximately 15 minutes of
time would be available to open RHR-MOV-25B enough turns to provide adequate
core flow after the step in the procedure to open RHR-MOV-25B failed. The analyst
assumed that a nominal time to diagnose the problem is 15 minutes and the nominal
time to close the valve is 5 minutes. The available 15 minutes was partitioned with
10 minutes for diagnosis and 5 minutes for action. This explains the selection of the
factors above for available time for both diagnosis and action.
B-10 Attachment 2
Stress would be high in both cases. For diagnosis, complexity was considered be
moderate because of the need to observe several indications while following a
procedure that only addresses successful operation of the equipment and that directs
further actions to be taken that are unrelated to diagnosing equipment failures. In
addition, procedures for diagnosis were considered to be poor because of a lack of
direction to the operator at the alternative shutdown panel to check the position of
RHR-MOV-25B if a reactor vessel rise is not observed. Although there is a
procedural step for the reactor building operator to check the valve position, it is
specifically prescribed for cable spreading room fires only, and it is not clear that he
would do this for other alternative shutdown fires unless directed by the operator at
the alternative shutdown panel. The analyst considered experience and training to
be high for MOV manual operations at the plant because it is a frequently performed
task. Ergonomics for action were divided half and half between poor and nominal
because it would take an unusually large force to open the valve against the full
shutoff head of the RHR pump. In addition, there is a somewhat unfavorable
geometry for this operation.
Procedure 5.4FIRE-S/D, Attachment 2, Step 1.20.7 instructs the reactor building operator to
verify that RHR-MOV-258 is open if the fire is in the cabie spreading room. If the valve is
observed to not be open, Step 1.20.8 instructs the operator to open the breaker and manually
open the valve. There is some uncertainty as to \,AJhether the operator \*'Vou!d proceed VJith
Step 1.20.8 (after correctly skipping Step 1.20.7) if the fire was not in the cable spreading
room. The analyst concluded that the text of Step 1.20.8 ("If the valve did not operate,
perform following .. ") is written in such a way that it presumes that the operator has performed
the valve position verification of Step 1.20.7. Therefore, if Step 1.20.7 is skipped, it would be
logical to mark Step 1.20.8 "N/A."
The analyst concluded that the recovery probability for cable spreading room fires would be
nominal because it involves a direct observation of the valve position, followed by a well-
trained and proceduralized evolution. Therefore, for cable spreading room fires, the non-
recovery probability was assigned a value of 1.1 E-2 (nominal SPAR-H value). Unlike the
value used for "action" in the SPAR-H tabulation above, in this case there would be extra time
available for the operator to open the valve manually because no time would be needed for
diagnosis. For all other fire areas that cause alternative shutdown, the non-recovery value of
0.72 was used as discussed above. The following table summarizes the recovery
assumptions:
Non-Recovery Value
HPCI Success 1.01 E-3
Early HPCI Failure
1.1 E-2
Cable Spreading Room
Early HPCI Failure
0.72
All Other ASD Areas
Using the linked event tree model described in Assumption 4, the analyst calculated the
Condition CDF as 7.79E-6/yr. The base CDF was 5.81 E-6/yr. With a one-year exposure
time, the delta-CDF is 2.0E-6/yr. Almost all of the risk (approximately 99%) resulted from
sequences that involve alternative shutdown fires (other than the cable spreading room) that
include early failures or unavailability of HPCI.
8-11 Attachment 2
dominant cutsets are shown below in Table 2.
Table2
Main Control Room Abandonment Sequences
Postulated Fire Sequence I Mitigating Functions Results
Auxiliary Relay Room 4-01- rly Failure of HPCI
re to Open MO-2SB 1.3 x 10-6/yr
Early Failure of HPCI
Main Control Room 3-01-12
Failure to Open MO-2SB 3.4 x 10*7/yr
4-31-1-1-1-1- Early Failure of HPCI
Auxiliary Relay Room 1.8 x 10*7/yr
12 Failure to Open MO-2SB
3-31-1-1-1-1- Early Failure of HPCI
Main Control Room 4.6 x 10-8/yr
12 Failure to Open MO-2SB
Early Failure of HPCI
Auxiliary Relay Room 4-01-03 3.4 x 10-8/yr
Failure to Open MO-2SB
The following text from the 2008 analysis discusses the derivation of the control room
abandonment frequency. This information was considered applicable to the current evaluation.
Control Room Abandonment Frequency
NUREGICR-2258, "Fire Risk Analysis for Nuclear Power Plants, provides that control room
JJ
evacuation would be required because of thick smoke if a fire went unsuppressed for 20
minutes. Given Assumption 6 and assuming that a fire takes 2 minutes to be detected by
automatic detection and/or by the operators, there are 18 minutes remaining in which to
suppress the fire prior to main control room evacuation being required. NRC Inspection
Manual Chapter 0609, Appendix F, Table 2.7.1, "Non-suppression Probability Values for
Manual Fire Fighting Based on Fire Duration (Time to Damage after Detection) and Fire
Type Category," provides a manual non-suppression probability (PNS) for the control room of
1.3 x 10-2 given 18 minutes from time of detection until time of equipment damage. This is a
reasonable approach, although fire modeling performed by the licensee indicated that 16
minutes was the expected time to abandon the main control room based on habitability.
In accordance with Inspection Manual Chapter 0609, Appendix F, Task 2.3.2, the
analyst used a severity factor of O. 1 for determining the probability that a postulated
fire would be self sustaining and grow to a size that could affect plant equipment.
Given these values, the analyst calculated the main control room evacuation
frequency for fires in the main control room (FE VA C) as foiiows:
= 6.88 x 1Q-3Iyr * 0.1 * 1.3 x 10-2
= 8.94 x 10*61yr
In accordance with Procedure 5. 4FIRE-SID, operators are directed to evacuate the
main control room and conduct a remote shutdown, if a fire in the main control room or
any of the four areas documented in Assumption 8, if plant equipment spuriously
actuates/de- energizes equiprner;t, or if instrutnentatioll becomes unreliable.
8-12 Attachment 2
Therefore, for all scenarios except a postulated fire in the main control room, the
probability of non- suppression by automatic or manual means are documented in
Table 3, below.
Table 3
Control Room Abandonment Frequency
Fire Area Ignition Severity Automatic Manual Abandonment
Frequency Suppression Suppression Frequency
(per year) (per year)
Main Control
6.88 x 10-3 0.1 none 1.3 x 10-2 8.94 X 10-6
Room
Auxiliary Relay
1.42 x 10-3 0.1 none 0.24 3.41 x 10-5
Room
Cable Expansion
1.69 x 10-4 0.1 2 x 10-2 0.24 8.11 x 10-8
Room
Cable Spreading
4.27 x 10-
3
1 0.1 5 x 10-2 0.24 5.12 x 10-6
Room 1
Reactor Building
1.43 x 10-
3
1 0.1 2 x 10- 2
0.24 6.86 x 10-7
903' (RB-FN)
Total MCR Abandonment: 4.89 x 10-5
The licensee's total control room abandonment frequency was 1.75 x 10-5 . For the main
control room fire, the licensee's calculations were more in-depth than the analyst's. The
remaining fire areas were assessed by the licensee using IPEEE data. However, the
following issues were noted with the licensee's [2008J assessment:
Kitchen fires were not inciuded in iicensee's evaiuation
This would tend to increase the ignition frequency
This might add more heat input than the electrical cabinet fires
modeled by the licensee
Habitability Forced Abandonment
Non-suppression probability did not account for fire brigade
response time or the expected time to damage.
Reduced risk based on 3 specific cabinets causing a loss of
ventilation early, when it should have increased the risk. Fire
modeling showed that fires in these cabinets could damage
nearby cables and cause ventilation damper(s) to close.
Risk Assessment Calculation ES-91 uses an abandonment value of
7
9.93 x 10- . However, the supporting calculation performed by EPM
IIC'ON ~ n? Av 1n- 6
LfVv\...# V.V"- I V .
B-13 Attachment 2
Equipment Failure Control Room Abandonment
Criteria for leaving the control room did not accurately reflect the
guidance that was procedura/ized.
- The evaluation of the Cable Expansion Room stated that the only fire source
was self-ignition of cables. This was modeled as a hot work fire, and it
included a probability that administrative controls for hot work and fire
watches would prevent such fires from getting large enough to require
control room abandonment. This is inappropriate for self-ignition of cables,
since there would not really be any fire watch present. Adjusting for this
would increase the risk in this area by two orders of magnitude.
The licensee concluded that fires in equipment in the four alternative
shutdown fire areas outside the main control room (see Assumption
8) would not result in control room abandonment without providing a
technical basis. The licensee's Appendix R analysis concluded that
fire damage in these rooms require main control room evacuation to
prevent core damage.
The analyst used the main control room abandonment frequencies documented in Table 3. In
addition, sensitivities were run using the licensee's values.
Recovery Following Failure of Valve RHR-MO-258 (HPCI success sequences only)
As noted above, the recovery value determined in the 2008 analysis was 7.9E-2. The
following table presents the revised split fractions based on the improvements to Procedure
5.4FIRE-S/D.
... .... 1 ...
I aDle~
Split Fractions for RECOVERY -PATH
Top Event How Assessed Failure Probability
LEVEL-DOWN SPAR-H (Diagnosis OnlY} 1.75E-4
SRV-STATUS SPAR-H (Diagnosis Onhl 1.75E-3
CLOSE-SRVS SPAR-H (Action Only) 4.38E-4
RESTORE-HPCI SPAR-H (Combined) 7.0E-4
OPEN-MO-258 SPAR-H (Combinedl 2.89E-1
Using the event tree in Figure 2 and the split fractions in Table 4, the analyst calculated a
combined non-recovery probability of 1.01 E-3.
The licensee's combined non-recovery probability was 4.0 x 10-3 . [Note: this value is
based on the licensee's evaluation before the aforementioned improvements were
made to the procedure]. The licensee used a similar approach to quantify this value.
However, the licensee assumed that operators would always shut the safety-relief valves
upon determining that reactor pressure vessel water level was decreasing. The analyst
assumed that some percentage of operators would continue to follow the procedure and
attempt to recover from the failed RHR valve or try alternative methods of low-pressure
injection. In addition, the analyst identified the following issues that impacted the licensee's
analysis:
8-14 Attachment 2
The inspectors determined that it would require 112 ft-fbs of force to manually
open Valve RHR-MO-25B. The analyst determined that this affected the
ergonomics of this recovery. Some operators may assume that the valve is on
the backseat when large forces are required to open it. Some operators might be
incapable of applying this force to a 2-foot diameter hand wheel.
The analyst noted that the following valves would be potential reasons for lack of
injection flow and/or may distract operators from diagnosis that Valve RHR-MO-
025B is closed:
RHR-81 B, RHR Loop B Injection Shutoff Valve, could be closed.
RHR-27CV, RHR Loop B Injection Line Testable Check Valve,
could be stuck closed.
RHR-MO-274B, Injection Line Testable Check Valve Bypass
Valve, could be opened as an alternative.
Operators could search for an alternative flow path.
The licensee's [2008J evaluation did not include sequences involving the failure of
the HPCI system shortly after main control room evacuation in their risk evaluation.
These sequences represented approximately 26 percent of the I'lCDF as calculated
by the analyst. These sequences are important for the following reasons:
Failure of HPClleads to the need for operators to rapidly depressurize
the reactor to establish alternative shutdown cooling. Decay heat will
be much higher than for sequences involving early HPCI success.
Also, depressurization under high decay heat and high temperature
result in greater water mass loss. This will significantly reduce the
time available for recovery actions.
HPCI success sequences provide long time frames available with
HPCI operating. This reduces decay heat, increases time for
recovery, and permits the establishment of an emergency response
organization. Those factors are not applicable to early HPCI failure
sequences.
The basis for operating HPCI was not well documented by the licensee. During
many of the extended sequences, suppression pool temperature went well above
the operating limits for HPCI cooling and remained high for extended periods of
time. The following facts were determined through inspection:
The design temperature for operating HPCI is 140'F based on
process flow providing oil cooling.
General Electric provided a transient operating temperature of 170'F
for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
8-15 Attachment 2
In the licensee's best case evaluation of the performance
deficiency, the suppression pool would remain above 150'F for
10.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
The licensee used a case-specific combined recovery in assessing the risk of this
performance deficiency. Most of the recoveries discussed by the licensee would
have been available with or without the performance deficiency. Therefore, these
should be in the baseline model and portions of the sequences subtracted from
the case evaluation. This is the approach used by the analyst in the linked event
trees model. The licensee stated during the regulatory conference that credit
should be given for diesel-driven fire water pump injection. This is one of the
licensee's alternative strategies. However, the inspectors determined, and the
licensee concurred, that this alternative method of injection requires that Valve
RHR-MO-258 be open. Therefore, no credit was given for this alternative
strategy.
Conclusions:
The analyst concluded that the performance deficiency was of low to moderate significance
(VVhite). Ill,S documented in Table 1, for a period of exposure of 1 year, the analyst determined
a best estimate .6.CDF for fire scenarios that did not require evacuation of the main control room
of less than 1.0E-7/yr. using both quantitative and qualitative techniques. Additionally, using the
linked event tree model described in Assumption 4 for a period of exposure of 1 year, the
analyst calculated the .6.CDF to be 2.0E-6/yr. for postulated fires leading to the abandonment of
the main control room. This resulted in a total best estimate .6.CDF of 2.0E-6/yr.
8-16 Attachment 2
Figure 1
-- --
Reactor Failure to Failure to Failure to Failure to Failure to Failure to
Shutdown from Establish AC Establish Level Establish Torus Properly Cool the Establish Reestablish HPCI
Alternate Power anci Pressure Cooling Reactor Shutdown Cooling Before CD
--
I
REMOTE_SD ASD-EPS ASD-HPSI ASD-SPC ASD-COOL ASD-SDC ASD-REHEAT # I END~STATE:~__
1 OK
2 OK
I 3 CD
4 OK
I 5 CD
6 OK
_.
[ 7 OK
I 8 CD
9 CD
10 OK
Depress Only
HPCI Recover Only
11 10K
I 12 I CD
13 CD
14 CD
15 CD
REMOTE-SO - 2008/06/11
A-1 Attachment 2
Figure
2
r-------,-------,-----------, I
Valve 258 Fails op. erators Fail to Operators I
Operators Fail to Operators Fail to ()perators Fail to
to Open Upon Diagnose Level Decide to Leave Close SRVs Reestablish I Open Valve 258
Demand Decrease SRVs Open Given Decision HPCI
MO-25B-FAI LEVEL-DOWN SRV-STATUS CLOSE-SRVS RESTORE-HP OPEN-MO-25 # END-STATES
'-------....L------t--
OK
2 OK
4 OK
6 OK
7 CD
8 i CD
I RECOVERY-PATH - Combine Multiple Recoveries 10 25B Failure 2008/06/11 Page 36
8-18 Attachment 2