IR 05000416/2011007

IR 05000416-11-007; on 4/4/2011 - 8/30/2011; Entergy Operations, Inc.; Grand Gulf Nuclear Station: Triennial Fire Protection Team Inspection

ML112650258
Person / Time
Site:	Grand Gulf
Issue date:	09/22/2011
From:	O'Keefe N NRC/RGN-IV/DRS/EB-2
To:	Mike Perito Entergy Operations
References
IR-11-007
Download: ML112650258 (42)

Text

UNITED STATES NUC LE AR RE G ULATO RY C O M M I S S I O N ber 22, 2011

SUBJECT:

GRAND GULF NUCLEAR STATION- NRC TRIENNIAL FIRE INSPECTION REPORT 05000416/2011007

Dear Mr. Perito:

On August 30, 2011, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Grand Gulf Nuclear Station. The enclosed inspection report documents the inspection results, which were discussed in a debrief meeting on April 21, 2011, with Mr. D. Wiles, Engineering Director, and other members of your staff. Following additional in-office review, an exit meeting was conducted on August 30, 2011, with Mr. M. Perito, Vice President Operations, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, the NRC has identified four findings that required further evaluation under the risk significance determination process to characterize their safety significance. Violations were associated with the four findings.

The findings were found to have very low safety significance (Green) and the violations associated with these findings are being treated as noncited violations, consistent with the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C.

20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Senior Resident Inspector at the Grand Gulf Nuclear Station.

If you contest the violations or the significance of the noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C.

20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission,

Entergy Operations, Inc. -2-Region IV, 612 E. Lamar Blvd, Suite 400, Arlington, Texas 76011-4125; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the facility. In addition, if you disagree with the cross-cutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at the facility.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response, if you choose to provide one, will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not include any personal privacy or proprietary, information so that it can be made available to the Public without redaction.

Sincerely,

/RA/

Neil OKeefe, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-416 License No. NPF-29 Enclosure: Inspection Report No. 05000416/2011007 w/Attachment:

Distribution via listserv for Grand Gulf

Entergy Operations, Inc. -3-Electronic distribution by RIV:

Regional Administrator (Elmo.Collins@nrc.gov )

Deputy Regional Administrator (Art.Howell@nrc.gov )

DRP Director (Kriss.Kennedy@nrc.gov )

DRS Director (Anton.Vegel@nrc.gov )

DRS Deputy Director (Tom.Blount@nrc.gov )

Senior Resident Inspector (Rich.Smith@nrc.gov )

Resident Inspector (Blake.Rice@nrc.gov )

Branch Chief, DRP/C (Vincent.Gaddy@nrc.gov )

Senior Project Engineer, DRP/C (Bob.Hagar@nrc.gov )

Project Engineer, DRP/C (Rayomand.Kumana@nrc.gov )

Project Engineer, DRP/C (Jonathan.Braisted@nrc.gov )

GG Administrative Assistant (Alley.Farrell@nrc.gov )

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov )

Project Manager (Alan.Wang@nrc.gov )

Acting Branch Chief, DRS/TSB (Dale.Powers@nrc.gov )

RITS Coordinator (Marisa.Herrera@nrc.gov )

Regional Counsel (Karla.Fuller@nrc.gov )

RES\DRA\FRB MarkHenry.Salley@nrc.gov Congressional Affairs Officer (Jenny.Weil@nrc.gov )

RIV/ETA: OEDO (John.McHale@nrc.gov )

DRS/TSB STA (Dale.Powers@nrc.gov )

R:\REACTORS\GG 2011007 rpt-JMM ADAMS ML ADAMS: No 7 Yes 7 SUNSI Review Complete Reviewer Initials: JMM 7 Publicly Available 7 Non-Sensitive Non-publicly Available Sensitive SRI:DRS/EB2 RI:DRS/EB2 RI:DRS/EB2 RI:DRS/EB2 SRA:DRS J. Mateychick B. Correll N. Okonkwo E. Uribe D. Loveless

/RA/ /RA/ /RA/ /RA/ /RA/

9/1/11 9/6/11 9/6/11 9/1/11 9/8/11 C:DRS/EB2 C:DRP\C C:DRS/EB 2 N. OKeefe V. Gaddy N. OKeefe

/RA/ /RA/ /RA/

9/12/11 9/15/11 9/22/11 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-416 License: NPF-29 Report Nos.: 05000416/2011007 Licensee: Entergy Operations, Inc.

Facility: Grand Gulf Nuclear Station Location: 7003 Baldhill Road Port Gibson, MS 39150 Dates: April 4, 2011 through August 30, 2011 Team Leader: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 Inspectors: B. Correll, Reactor Inspector, Engineering Branch 2 N. Okonkwo, Reactor Inspector, Engineering Branch 2 E. Uribe, Reactor Inspector, Engineering Branch 2 Approved By: Neil OKeefe, Chief Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

IR; 05000416/2011007; April 4, 2011 - August 30, 2011; Entergy Operations, Inc.; Grand Gulf

Nuclear Station: Triennial Fire Protection Team Inspection.

The report covered a triennial fire protection team inspection by specialist inspectors from Region IV. Four Green findings, which were noncited violations (NCVs), were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a noncited violation of License Condition 2.C(41), Fire Protection Program, for failing to ensure that the postfire safe shutdown procedure for fires requiring control room evacuation could be performed within the critical times required by the approved fire protection program. Specifically, two crews of operators simulating performance of Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 036, did not give priority to the required safe shutdown components which are protected against fire damage and did not complete the equipment alignments within the times required by the thermal-hydraulic analysis. The team confirmed at the end of each walkdown that the operators involved did not know what the credited shutdown equipment was for a postfire safe shutdown or the critical time limits to be met. The team also confirmed that the licensee had not performed timed walkdowns to validate that the procedure would complete the required actions for postfire safe shutdown within the times required by the thermal-hydraulic analysis. The licensee entered this into their corrective action program as CR-GGN-2011-02721, implemented compensatory measures to focus the operators priority on the required safe shutdown components and implemented a procedure revision.

The failure to provide an adequate procedure to implement the requirements of the approved fire protection program for a fire in the control room is a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Because the finding involved control room evacuation, a Phase 3 SDP risk assessment was performed by a senior reactor analyst. The scenario impacted operators being ready to emergency depressurize the reactor and reflood using a residual heat removal pump. Because a bounding change to core damage frequency was 4.13 x 10-7, and the finding was not significant with respect to large, early release frequency, this finding is of very low safety significance (Green). The finding did not have a crosscutting aspect since the primary cause did not fit any crosscutting aspects.

(Section 1R5.5.b.1)

Green.

The team identified a noncited violation of License Condition 2.C(41), Fire Protection Program, for failing to assure that equipment relied upon for safe shutdown following a fire in the control room was protected against fire damage.

Specifically, Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel,

Revision 036, relied on the automatic operation of and indications from the load shedding and sequencing system. The team identified that this system was not isolated from potential damage due to a fire in the control room and the procedure did not adequately address the potential that fire damage to the system could effect the postfire safe shutdown capability by spuriously starting or stopping electric loads.

The licensee entered this into their corrective action program as CR-GGN-2011-02721.

The failure to assure that equipment required to successfully implement the safe shutdown procedure for a fire in the control room was protected against fire damage is a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involved control room evacuation, a Phase 3 SDP risk assessment was performed by a senior reactor analyst. Because a bounding change to core damage frequency was 1.97 x 10-8, and the finding was not significant with respect to large, early release frequency, this finding was determined to have very low safety significance (Green). The finding did not have a crosscutting aspect since it was not indicative of current performance, in that the licensee had established the current procedure more than three years prior to this finding. (Section 1R5.5.b.2)

Green.

The team identified a noncited violation of 10 CFR 50, Appendix B,

Criterion XVI, Corrective Action, for failure to take timely corrective action to modify the control circuits for 33 motor operated valves that are relied upon during safe shutdown due to fire. Noncited violation NCV 05000416/2008006-04, Failure to Ensure That Damage to Motor-Operated Valve Circuits Would Not Prevent Safe Shutdown, documented the licensees inadequate review of Information Notice 92-18, Potential for Loss of Remote Shutdown Capability During Control Room Fire.

The licensee failed to develop modification packages such that motor operated valve control circuit modifications could be implemented during the fall 2010 refueling outage. As a result, 33 motor operated valves associated with safe shutdown equipment continue to remain susceptible to potential damage during spurious operation due to circuit hot shorts. The licensee has maintained a fire watch as a compensatory measure. The licensee entered this into their corrective action program as CR-GGN-2011-02779.

The failure to take timely corrective actions to address the potential for fire induced hot shorts to impact the ability to safely shutdown the plant following a fire is a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involved control room evacuation, a Phase 3 SDP risk assessment was performed by a senior reactor analyst. Because a bounding change to core damage frequency was 9.58 x 10-7, and the finding was not significant with respect to large, early release frequency, this finding was determined to have very low safety significance (Green).

The finding had a crosscutting aspect in the area of Human Performance associated with Decision Making, because the licensee failed to demonstrate that nuclear safety is an overriding priority. Specifically, the licensee did not promptly initiate control circuit reviews and implement modifications required for corrective actions after the licensees inadequate evaluation of Information Notice 92-18 was identified in the 2008 violation. H.1(a) (Section 1R5.6)

Green.

The team identified a noncited violation of 10 CFR 50, Appendix B,

Criterion XVI, for inadequate corrective actions to address the potential for fire induced hot shorts to impact the ability to trip a control rod group as described in Information Notice 2007-07. The licensees evaluation of Information Notice 2007-07 stated in part, provisions have been included in 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, to trip the proper reactor protective system breakers to ensure that the reactor scram occurs. The team noted that Procedure 05-1-02-II-1 contained a conditional statement for the operator to determine if opening the reactor protective system breakers is required. The procedure did not provide assurance that all control rod groups insert since the control room indications to be utilized by the operator were not identified and confirmed to be reliable during fires requiring control room evacuation. The licensee entered this finding into its corrective action program under CR-GGN-2011-02780, implemented compensatory measures to ensure the operators de-energized the reactor protection system, and implemented a procedure change.

The failure to take adequate corrective actions to address the potential for fire induced hot shorts to impact the ability to safely shutdown the plant following a fire is a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Since the finding involved control room evacuation, a Phase 3 SDP risk assessment was performed by a senior reactor analyst. Because a bounding change to core damage frequency was 9.58 x 10-7, and the finding was not significant with respect to large, early release frequency, this finding was determined to have very low safety significance (Green). The finding did not have a crosscutting aspect since it was not indicative of current performance. The licensee had incorrectly assessed the applicability of Information Notice 2007-07 more than three years prior to this finding.

(Section 4OA2.b)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at the Grand Gulf Nuclear Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas, with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the postfire capability to safely shut down the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for review. The inspection team used the fire hazards analysis section of the Grand Gulf Nuclear Station Individual Plant Examination of External Events to select the following three risk-significant fire areas (inspection samples) for review:

• Fire Area 1 - Auxiliary Building Corridors, Elevation 93 ft (Fire Zone A101)

• Fire Area 6 - Auxiliary Building Corridors, Elevation 119 ft (Fire Zones A201 and A211)

• Fire Area 36 - Control Building, Division III Switchgear Room (Fire Zone C210)

The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C(41), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Final Safety Analysis Report (UFSAR), Section 9.5; the fire hazards analysis; and the postfire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Three fire area samples and two B.5.b samples were completed.

.1 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the postfire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the provisions of the safe shutdown analysis. For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees

method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one postfire safe shutdown success path remained free of fire damage in the event of a fire. In addition, the team verified that the licensee met applicable license commitments.

b. Findings

No findings were identified.

.2 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

.3 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed walkdowns of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps and carbon dioxide supply systems) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pump flow and pressure tests to verify that the pumps met their design requirements. The team also reviewed a sample of carbon dioxide suppression functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact postfire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for fire fighting.

The team observed an unannounced fire drill, conducted on April 7, 2011, and the subsequent drill critique using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly. The team observed fire brigade members fight a simulated fire in the Control Building, located in the lower cable spreading room. The team verified that the licensee identified problems; openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient firefighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings were identified.

.4 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown which are located in the same fire area would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train)

• Adequate drainage is provided in areas protected by water suppression systems

b. Findings

No findings were identified.

.5 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

Plant walkdowns were conducted to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems needed for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that the licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown are trained and available onsite at all times, exclusive of those assigned as fire brigade members. The team reviewed operator manual actions to ensure that they could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for a fire in the control room.

Two simulated walkdowns of the postfire safe shutdown procedure with licensed and non-licensed operators was performed to determine the adequacy of the procedure on April 6 and 19, 2011. The team observed time critical actions including performing the reactor trip, closure of main steam isolation valves, isolating circuits from the control room, restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also observed the control room simulator operated with the plant systems configured to simulate the operation of systems observed during the two walkdowns to evaluate the plant response.

The team reviewed the periodic testing of the alternative shutdown transfer capability as well as instrumentation and control functions to verify that the tests are adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

===.1

Introduction.

The team identified a violation of License Condition 2.C(41), Fire===

Protection Program, for failing to ensure that postfire safe shutdown for fires requiring control room evacuation could be performed within the critical times required by the approved fire protection program.

Description.

The licensees approved fire protection program established the credited postfire safe shutdown method. The reactor would be tripped and the main steam isolation valves closed. Six safety relief valves (SRVs) would be used to depressurize the reactor pressure vessel (RPV). One residual heat removal (RHR) pump would be aligned to provide low pressure injection. Water level in the RPV would drop below the top of active fuel briefly until injection flow established RPV coolant inventory control and decay heat removal. The final safety analysis report, Appendix 9C, Analysis of Safe Shutdown In the Event of a Major Fire, provided a thermal-hydraulic analysis for the postfire safe shutdown methodology. The analysis established that the SRVs must be opened when water level decreases to the top of the core, which would be as early as 18 minutes after the reactor trip. The RHR system must be aligned to initiate low pressure injunction flow when the RPV pressure drops below the shutoff head of the RHR pump 22.5 minutes after the reactor trip.

Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 036, implemented the postfire safe shutdown for fires requiring control room evacuation.

The procedure was written for control room evacuation for any reason, not just due to fire. The procedure was credited to implement the postfire safe shutdown strategy.

The team performed two walkdowns with operators simulating performance of the procedure due to a fire in the control room. Operators simulating performance of Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 036, did not complete the equipment alignments within the times required by the thermal-hydraulic analysis. The team confirmed at the end of each walkdown, that the operators involved did not know what the credited shutdown equipment was for a postfire safe shutdown or the critical time limits to be met. In both cases, operators spent time trying to align equipment that was not protected from fire damage.

Specifically, the team noted that the procedure did not tell operators to skip steps that involved non-fire protected equipment or provide critical completion times.

The team also confirmed that the licensee had not performed timed walkdown to validate that the operators would be able to complete the required actions for postfire safe shutdown within the times required by the thermal-hydraulic analysis.

To help assess the significance, the licensee duplicated the plant response using the control room simulator using the operator action times observed during the walkdown performed on April 19, 2011. The simulator reached the low water level requiring the opening of the six SRVs at 19 minutes and 15 seconds versus the conservative 18 minutes in the thermal-hydraulic analysis. During walkdowns, the operator had not

simulated opening the six SRVs until 25 minutes and 49 seconds into the event. This delayed the initiation of low pressure injection flow until approximately 27 minutes versus the 22 minute target in the thermal-hydraulic analysis. The simulator results indicated the operator action times observed would increase the time water level was below the top of active fuel (TAF), result in a lower water level below TAF, and delay the recovery of water level to above TAF.

The licensee entered this into their corrective action program as CR-GGN-2011-02721, implemented compensatory measures to focus the operators priority on the required safe shutdown components, and implemented a procedure revision.

Analysis.

The failure to provide an adequate procedure to implement the requirements of the approved fire protection program for a fire in the control room was a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. However, the Assumptions and Limitations section of Appendix F states that findings involving control room evacuation are not explicitly treated in Appendix F; therefore, a Phase 3 significance determination risk assessment was performed by a senior reactor analyst.

The analyst calculated the frequency with which a postulated fire would result in abandonment of the main control room. From the licensees Individual Plant Evaluation for External Events, the fire ignition frequency for the main control room was estimated at 9.50 x 10-3/year. In accordance with Appendix F, the probability that a fire would grow to damage equipment is 10 percent. In addition, the analyst assumed (based on industry standard) that any postulated fire could burn for approximately 20 minutes before control room abandonment would be required and that it would take operators 2 minutes to detect it. In accordance with Appendix F, 8, the probability of manual suppression in a continuously manned space, given 18 minutes time to damage was 1.30 x 10-2. A simple product of these three values results in a control room abandonment frequency of 1.24 x 10-5/year.

The analyst noted that the procedure utilized the non-fire protected reactor core isolation cooling (RCIC) system as a primary cooling source. The analyst calculated the fire-induced failure rate of the system by using the ratio of 7 cabinets containing RCIC system components with the 58 total cabinets in the main control room. The analyst used the Standardized Plant Analysis Risk Model for Grand Gulf, Revision 8.15, to quantify the stochastic failure probability of the RCIC system. The total failure probability of the RCIC system, given main control room abandonment was determined to be 1.46 x 10-6. This value was provided for both the baseline and the current case. Attempting to use the RCIC system or other high pressure water sources following a postulated fire leading to control room abandonment is not a performance deficiency. However, the credited safe shutdown equipment to perform

an emergency depressurization and initiate Division 1 low pressure injection must be aligned within the analyzed time limits since successful operation of the RCIC system or other high pressure water sources is not assured due to potential fire damage.

The analyst noted that during the timed scenario on the plant-specific simulator, the subject performance deficiency resulted in reactor vessel water level being below 2/3 core coverage for 70 seconds and had a minimum water level of 85 inches above bottom of active fuel. As documented in the Updated Final Safety Analysis Report, Figure 6.3-64, following a postulated steam line break inside the containment, reactor vessel water level would be below 2/3 core coverage for 115 seconds with a minimum water level well below the bottom of active fuel. Updated Final Safety Analysis Report, Section 15.6.5.3.3, Results, states, The temperature and pressure transients resulting as a consequence of this accident are insufficient to cause perforation of the fuel cladding. Therefore, the analyst assumed that performance of the procedure, exactly as timed, would not have resulted in core damage.

Using the SPAR-H human reliability method, the analyst calculated the probability of failure to depressurize the reactor prior to core damage as 2.9 x 10-2 for the baseline case with adequate procedures. However, given the performance deficiency, the procedure was considered to be poor and the analyst assumed that the time available to follow the control room abandonment procedure was barely adequate to accomplish the reactor depressurization. As a result of these changes, the probability of failure to depressurize the reactor prior to core damage increased to 2.59 x 10-1. Additionally, the analyst assumed that the industry accepted probability of failure to properly perform a remote shutdown given a main control room abandonment (0.1) was appropriate for evaluation of both the baseline and case scenarios.

Given the above documented assumptions, the analyst hand calculated the change in core damage frequency (4.13 x 10-7). In accordance with NRC Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, because Grand Gulf has a Mark III containment and the dominant core damage sequences do not include intersystem loss of coolant accidents, small-break loss of coolant accidents or station blackouts, this finding is not significant with respect to the large, early release frequency. Because the change in core damage frequency was less than 1 x 10-6, and the finding was not significant with respect to large, early release frequency, this finding is of very low safety significance (Green).

During the 2008 fire protection triennial inspection, operators successfully simulated performance of Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 033. In 2008, the team verified that the minimum number of available operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable plant shutdown time requirements. Specifically, the simulated completion times recorded during the procedure walk-through were compared to the analytical values verifying that the procedure could be implemented as intended. Therefore, the team concluded that operators were less familiar with the safe shutdown analysis and procedure objectives, which was the primary contributing cause for slower performance. The finding did not have a crosscutting aspect since this primary cause did not fit any crosscutting aspects.

Enforcement.

License Condition 2.C(41), Fire Protection Program, requires the licensee to implement and maintain in effect all provisions of the approved Fire Protection Program as described in Revision 5 to the Updated Final Safety Analysis Report (UFSAR). UFSAR Section 7.4.1.5, Alternate Shutdown System, described the Division 1 components with the capability to be operated from outside of control room with circuits isolated from fire damage in the control room. UFSAR Appendix 9C, Analysis of Safe Shutdown In the Event of a Major Fire, provided a thermal-hydraulic analysis of the postfire safe shutdown methodology and established the limiting time available for aligning the required equipment.

Contrary to the above, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically the licensee failed to provide an adequate procedure to assure operators would be able to perform a safe shutdown following a fire in the control room in accordance with the approved fire protection program. Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 036 failed to direct the operators to align the required equipment within the limited time available using equipment that was protected from fire damage to establish reactor pressure vessel coolant inventory control and decay heat removal.

Because this violation was of very low safety significance and it was entered into the licensees corrective action program, this violation is being treated as a non-cited violation (NCV), consistent with the Enforcement Policy and is identified as NCV 05000416/2011007-01, Failure To Provide An Adequate Alternative Shutdown Procedure.

===.2

Introduction.

The team identified a violation of License Condition 2.C(41), Fire===

Protection Program, for failing to assure that equipment required for safe shutdown following a fire in the control room was protected against fire damage.

Description.

The licensees approved fire protection program provided alternative shutdown capability to allow safe shutdown for a fire requiring control room evacuation. Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 036, was the procedure implementing the postfire safe shutdown for fires requiring control room evacuation. The inspectors identified that the procedure assumed that the load shedding and sequencing (LSS) system either successfully started and loaded the diesel generator or was de-energized. The procedure stated in step 1.10.1 of the purpose/discussion section that the LSS was not a safe shutdown component, could not be relied upon to perform its automatic functions, and would not prevent operators from manually starting and loading the diesel generator if de-energized. The team identified that the licensee was relying on the LSS to function properly even though it was not isolated from potential damage due to a fire in the control room. The team concluded that the procedure did not provide steps to adequately address the potential impact of fire damage to the LSS on the postfire safe shutdown.

The procedure directed the operator that was locally starting and loading a diesel generator to perform steps based on indications on the diesels LSS panel. The procedure also directed the operator to align the 125 VDC power supply on the LSS panel and verify load shedding and sequencing occurred. The procedure did not provide the operators instructions for starting the diesel generator and loading the

equipment required for the postfire safe shutdown without the LSS. For example, starting and loading the diesel generator without first shedding the large loads on the electrical bus could potentially damage the required diesel generator.

The team also identified that the procedure did not address potential failure modes of the LSS during the shutdown. For example, if fire damage initiated an automatic start of the diesel generator but failed to load the respective standby service water pump, the diesel generator could be damaged before operators reach the procedure step where operation of the standby service water pump is verified. The team was also concerned that spurious initiation of the LSS after powering safe shutdown loads from the diesel generator could disrupt operation of the equipment required for decay heat removal. The licensee entered this into their corrective action program as CR-GGN-2011-02721.

Analysis.

The failure to assure that equipment required to successfully implement the safe shutdown procedure for a fire in the control room was protected against fire damage was a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems.

However, the Assumptions and Limitations section of Appendix F states that findings involving control room evacuation are not explicitly treated in Appendix F; therefore, a Phase 3 significance determination risk assessment was performed by a senior reactor analyst.

As discussed in Section 1R05.05.b.1, the analyst calculated the main control room abandonment frequency to be 1.24 x 10-5/year. The analyst developed an event tree to model the potential failure modes for the subject performance deficiency. The following three core damage sequences were identified:

1. Main control room abandonment with loss of offsite power followed by a failure of

the LSS to automatically start loads

2. Main control room abandonment with loss of offsite power followed by a failure of

the emergency diesel to automatically start and operators fail to manually strip loads from the bus and load the diesel generator

3. Main control room abandonment with loss of offsite power followed by a failure of

the LSS to strip loads from the bus and operators fail to manually strip loads from the bus and load the diesel generator

The parameter development and source for each of the failures in these sequences were quantified and documented in the following table:

Parameter Partial Values Probability Source Abandonment 1.24 x 10-5 /year Section Frequency 1R05.05.b.1 3.56 x 10-2 Calculated Consequential 1.0 x 10-3 SPAR Model Fire-Induced 3.45 x 10-2 Cabinet Ratio Stochastic 9.84 x 10-5 SPAR Model Load Sequence 3.75 x 10-2 Calculated Failure Fire-Induced 3.45 x 10-2 Cabinet Ratio Random 3.0 x 10-3 SPAR Model Manual Load 1.1 x 10-2 SPAR-H Failure Load Strip 3.75 x 10-2 Calculated Failure Fire-Induced 3.45 x 10-2 Cabinet Ratio Random 3.0 x 10-3 SPAR Model Manual Strip 2.2 x 10-2 SPAR-H Failure As a bounding assumption, the analyst assumed that all failures led to core damage.

The resulting quantification of the three sequences resulted in a change in core damage frequency of 1.97 x 10-8. Therefore, the subject finding is of very low safety significance (Green).

The finding did not have a crosscutting aspect since it was not indicative of current performance, in that the licensee had established the current procedure more than three years prior to this finding.

Enforcement.

License Condition 2.C(41), Fire Protection Program, requires the licensee to implement and maintain in effect all provisions of the approved Fire Protection Program as described in Revision 5 to the Updated Final Safety Analysis Report (UFSAR). UFSAR Section 7.4.1.5, Alternate Shutdown System, described the Division 1 components with the capability to be operated from outside of control

room with circuits isolated from fire damage in the control room. UFSAR Table 9.5-12, Fire Protection Program Comparison With Appendix R to 10 CFR 50, stated the approved fire protection program meets the intent of Section III.L of Appendix R to 10 CFR 50, Alternative and dedicated shutdown capability.Section III.L.3 requires the alternative shutdown capability to be independent of the specific fire area of concern (i.e. the control room).

Contrary to the above, the licensee failed to implement and maintain in effect all the provisions of the approved fire protection program. Specifically, the licensee failed to assure that equipment required for safe shutdown following a fire in the control room was protected against fire damage. Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, Revision 036, directs operators to rely on the load shedding and sequencing system, which was not a credited safe shutdown component and was not isolated from potential circuit damage due to a fire in the control room.

Because this violation was of very low safety significance and it was entered into the licensees corrective action program, this violation is being treated as an NCV, consistent with the Enforcement Policy and is identified as NCV 05000416/2011007-02, Failure To Assure Equipment Required For Postfire Safe Shutdown Was Protected Against Fire Damage.

.6 Circuit Analysis

a. Inspection Scope

The team reviewed the post fire safe shutdown analysis to verify that the licensee identified circuits that could impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified cables and equipment required to achieve and maintain safe shutdown conditions in the event of a fire in the selected fire areas. The team verified that cables associated with safe shutdown-related equipment were protected from the adverse effects of fire damage or were analyzed to show that fire induced cable faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The team evaluated cables for selected components from the residual heat removal systems. For the sample of components selected, the team reviewed process and instrumentation diagrams, electrical schematics, and wiring diagrams to identify power, control, and instrumentation cables necessary to support safe shutdown equipment operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place to satisfy the requirements specified in the fire protection license basis.

Since the licensee utilized thermoset cables for most applications, the team reviewed the following cable failure modes for selected required and associated circuits:

• Spurious actuations resulting from any combination of conductors within a single multiconductor cable;

• A maximum of two cables considered where multiple individual cables may be damaged by the same fire;

• The vulnerability of three phase power cables resulting from three phase proper polarity hot shorts for decay heat removal system isolation valves at high-pressure to low-pressure interfaces.

On a sample basis, the team reviewed the adequacy of circuit protective coordination for safe shutdown power sources for the safety related electrical bus 15AA. The team reviewed the licensees evaluation of potential multiple spurious operations and reviewed the compensatory measures associated with these multiple spurious operation concerns. The team reviewed the remote shutdown transfer switch testing methodology to ensure that the testing procedure would identify circumstances where the control room would not be isolated. The licensee provided a spare transfer switch for disassembly and the team was able to inspect the internal workings of the transfer switch to identify any credible failure modes.

Specific components reviewed by the team were:

• E12-F027A, RHR A Injection Shutoff Valve

• E12-F028A, RHR A Containment Spray Valve

• E12-F042A, Low Pressure Coolant Injection A Injection Valve

• E12-C002A, RHR Pump A

• Electrical Bus 15AA The team also conducted a follow-up review of corrective actions from the previous fire protection inspection. The team reviewed NCV 05000416/2008006-04, Failure to Ensure That Damage to Motor-Operated Valve Circuits Would Not Prevent Safe Shutdown, to assess the licensees corrective actions following the violation from 2008.

b. Findings

Introduction.

The team identified a violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, for failure to take timely corrective action from a previous violation to ensure that safe shutdown equipment would remain operable following a fire. The licensee failed to take timely corrective actions to modify control circuits for 33 motor operated valves that are relied upon during safe shutdown due to fire.

Description.

The team reviewed the corrective actions from previous violation NCV 05000416/2008006-04, Failure to Ensure That Damage to Motor-Operated Valve Circuits Would Not Prevent Safe Shutdown, involving inadequate review of Information Notice 92-18, Potential for Loss of Remote Shutdown Capability During Control Room Fire. The team was concerned that the licensee had not been timely in correcting the condition adverse to fire protection. Following the 2008 violation, the licensee failed to take prompt corrective actions such that motor operated valve control circuit modifications could be implemented during the fall 2010 refueling outage. As a result, 33 motor operated valves associated with safe shutdown equipment remained susceptible to potential damage during spurious operation due to fire damage to circuits.

Normally the control circuits for a motor operated valve stop the movement of the valve in the opened or closed position due to actuation of a torque switch or limit switch in the circuit. Fire damage had the potential to operate a valve without those devices being capable of stopping the motor. Under such conditions, the valve motor would not de-energize and the motor would apply its full stall thrust to the valve and its operator. This higher than normal thrust had the potential to damage some valves by either creating system leakage or making the valve incapable of being repositioned as required for postfire safe shutdown. The concern was specific to control room fires.

Because of the licensees internal processes and scheduling of the circuit reviews, the corrective actions (modification package development) had not progressed to the point where these modification packages were ready to be implemented during the subsequent refueling outage in the fall of 2010. At the time of the inspection, the licensee had not implemented any circuit modifications for the 33 safe shutdown components. The licensee was maintaining a roving fire watch in Fire Area 50, which included the control room and adjacent spaces, as a compensatory measure to detect and extinguish any fire before it would progress to a size requiring control room evacuation. By the time of this inspection, the licensee had completed 19 of the 33 modifications packages, and was developing an implementation schedule. Based on this finding, the licensee stated that they intend to have all 33 circuit modification packages implemented before the end of the next refueling outage in February 2012.

The licensee entered this into their corrective action program as CR-GGN-2011-02779.

Section 7.2 of Inspection Manual Part 9900, Operability Determinations & Functionality Assessments For Resolution of Degraded or Nonconforming Conditions Adverse To Quality or Safety, states, in part, that "In determining whether the licensee is making reasonable efforts to complete corrective actions promptly, the NRC will consider safety significance, the effects on operability, the significance of the degradation, and what is necessary to implement the corrective action. The NRC may also consider the time needed for design, review, approval, or procurement of the repair or modification; the availability of specialized equipment to perform the repair or modification; and whether the plant must be in hot or cold shutdown to implement the actions. If the licensee does not resolve the degraded or nonconforming condition at the first available opportunity or does not appropriately justify a longer completion schedule, the staff would conclude that corrective action has not been timely and would consider taking enforcement action."

In applying this guidance to this issue, the staff concluded that:

• The systems affected by the non-conforming condition and the compensatory measures are systems required to be operable by technical specifications. These systems are also required to be operable to meet License Condition 2.C(41), Fire Protection Program, and the safe shutdown requirements of the approved fire protection program.

• The non-conforming condition was more significant based on the reliance on compensatory actions (i.e., fire watches) to ensure the operability of the affected systems for postfire safe shutdown.

• Scheduling the modifications for completion in the second refueling outage following identification of the issue appeared to be reasonable based on the proximity of the

first outage to the date of identification and the time needed for design and procurement activities.

• Delay of the modifications to the third refueling outage, rather than scheduling a work window sooner, did not appear to have adequately considered the factors described in Part 9900. Further, the delays in design of the modifications appeared to be the result of factors within the control of the licensee, given proper priority.

Based on the above, the staff has concluded that corrective action for this non-conforming condition was not timely commensurate with the safety significance of the condition.

Analysis.

The failure to take timely corrective action to address the potential for fire induced hot shorts to impact the ability to safely shutdown the plant following a fire is a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems. However, the Assumptions and Limitations section of Appendix F states that findings involving control room evacuation are not explicitly treated in Appendix F; therefore, a Phase 3 significance determination risk assessment was performed by a senior reactor analyst.

As discussed in Section 1R05.05.b.1, the analyst calculated the main control room abandonment frequency to be 1.24 x 10-5/year. The analyst noted that the cabling associated with all 33 valves were contained in five main control room cabinets. Given that there were a total of 58 cabinets in the Grand Gulf main control room, the analyst calculated that 8.6 percent of control room fires would potentially impact these 33 components. Therefore, the probability that a main control room fire would impact any of the 33 valves and required a control room abandonment over a 1-year period was 1.06 x 10-6. The analyst assumed that the baseline conditional core damage probability for a main control room abandonment was 0.1 as accepted by the industry during the Individual Plant Evaluation of External Events. As a bounding assumption, the analyst assumed that the failure of any component would cause the postulated fire to lead to core damage. Therefore the change in core damage frequency was bounded by 9.58 x 10-7. The analyst noted that one control room cabinet contained only one reactor water cleanup isolation valve that was affected by the performance deficiency. For this specific case, the failure of five additional valves would be required for the reactor water cleanup system to affect the remote shutdown. This specific case reduced the calculated risk by 20 percent. In accordance with NRC Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, because Grand Gulf has a Mark III containment and the dominant core damage sequences do not include intersystem loss of coolant accidents, small-break loss of coolant accidents or station blackouts, this finding is not significant with respect to the large, early release frequency. Because the change in core damage frequency was less than 1 x 10-6, and the finding was not significant with respect to large, early release frequency, this finding is of very low safety significance (Green).

The finding had a crosscutting aspect in the area of Human Performance, Decision Making, in that the licensee failed to demonstrate that nuclear safety is an overriding priority. Specifically, the licensee did not make risk-significant decisions using a systematic process to ensure safety is maintained in that the licensee did not promptly initiate control circuit reviews and implement modifications required for corrective actions in response to the 2008 violation. H.1(a)

Enforcement.

10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that conditions adverse to quality are promptly identified and corrected. License Condition 2.C(41), Fire Protection Program, requires the licensee to implement and maintain in effect all provisions of the approved Fire Protection Program as described in Revision 5 to the Updated Final Safety Analysis Report. Table 9.5-1, of the UFSAR described that the fire protection quality assurance program would address problems in the 10 CFR Part 50, Appendix B, Corrective Action Program. Contrary to the above, the licensee did not promptly correct a condition adverse to quality, in that the licensee delayed extent of condition reviews and implementing modifications beyond the first refueling outage when corrective actions could have reasonably been implemented.

Because this violation was of very low safety significance and it was entered into the licensees corrective action program, this violation is being treated as a noncited violation, consistent with the Enforcement Policy: NCV 05000416/2011007-03, Failure to Take Timely Corrective Actions to Protect Safe Shutdown Equipment From Fire Damage.

.7 Communications

a. Inspection Scope

The team inspected the contents of designated emergency equipment storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems remained available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with engineering personnel.

The team reviewed the adequacy of the communication system to support plant personnel in the performance of alternative postfire safe shutdown functions and fire brigade duties. The review verified that the licensee established and maintained in working order primary and backup communications. Further, the team evaluated the environmental impacts such as ambient noise levels, coverage patterns, and clarity of reception. The team verified that the electrical power supplies and cable routing for the phone system would allow the system to remain functional following a fire in the control room and other fire areas.

b. Findings

No findings were identified.

.8 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkthrough of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices. The team also reviewed the location of the emergency lights for a sample of areas to determine the adequacy of emergency lighting during control room evacuation events.

b. Findings

No findings were identified.

.9 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed the licensee's safe shutdown analysis and Procedure 05-1-02-II-1, "Shutdown from the Remote Shutdown Panel," Revision 36, to determine whether repairs were required to achieve cold shutdown. The licensee identified two repairs that were potentially required in order to reach cold shutdown based on the safe shutdown methodology implemented.

The team verified that the licensee had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in the design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and postfire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings were identified.

.11 B.5.b Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with loss of large areas of the plant due to explosions or fire as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026, dated February 25, 2002 and 10 CFR 50.54(hh)(2).

The team reviewed licensees strategies to verify that they continued to maintain and implement procedures, maintain and test equipment necessary to properly implement the strategies, and ensure station personnel are knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure availability and material readiness of the equipment, including the adequacy of diesel engine driven fire pumps. The team assessed the offsite ability to obtain fuel for the portable pump, and foam used for firefighting efforts. The team selected two sample strategies and performed walkthroughs of the implementing procedures with station personnel. The inspection samples were:

• Emergency Procedure Alternate Strategy, 05-S-01 Strategy, Attachment IV, "Spent Fuel Pool Cooling for Makeup/Spray System, Revision 7

• Emergency Procedure Alternate Strategy, 05-S-01 Strategy, Attachment X, "Hydrogen Igniter Alternate Power, Revision 7

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. In addition, the team reviewed the corrective actions proposed and implemented to verify that they were or would be effective in correcting identified deficiencies. The team also evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

Introduction.

The team identified a violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Actions, for inadequate corrective actions to address the potential for fire induced hot shorts to impact the ability to trip some control rods as described in Information Notice 2007-07.

Description.

The team reviewed the licensees evaluation of Information Notice 2007-07 as documented in LO-NOE-2007-00094. The licensees evaluation stated in part, provisions have been included in 05-1-02-II-1, Shutdown from the Remote Shutdown Panel to trip the proper reactor protective system (RPS) breakers to ensure that the reactor scram occurs. The team determined that Procedure 05-1-02-II-1 contained a conditional statement for the operator to determine if opening the RPS breakers was required. This did not provide assurance that all control rod groups would have been inserted since the control room indications utilized by the operator were not identified and confirmed to be reliable during fires requiring control room evacuation.

Operator actuation to manually scram the reactor from inside the control room was the method normally used to perform a postfire safe shutdown for a fire requiring control room evacuation. However, potential fire damage can occur prior to the decision to evacuate the control room and the manual scram. Therefore, all systems relied upon for postfire safe shutdown must be evaluated for the potential effects of fire damage.

At the Grand Gulf Nuclear Station, the control rods were divided into four control rod groups. The tripping of each control rod group was controlled by separate circuits within the RPS system. The system design had two trip logic channels functioning in a 1 out of 2 taken twice arrangement. This design required that one trip logic be satisfied in both trip logic channels before the control rod group will scram. The RPS circuits have a fail-safe design in that the circuits are normally energized and the loss of power will initiate a scram.

As described in Information Notice 2007-07, the potential exists for fire damage to cause hot shorts in combinations of circuits which would prevent one of the trip logic channels from de-energizing. This would result in one control rod group not inserting. To accomplish alternative safe shutdown for a control room evacuation due to fire, the licensee relied upon using safety relief valves to depressurize the reactor vessel. The reactor vessel would then be reflooded with low pressure injection using a residual heat removal pump. By design, the negative reactivity added by all four rod groups during a scram was needed to provide adequate shutdown margin to offset the positive void and temperature reactivity that would have been added by the cold water being injected.

One of the four rod groups remaining in the fully out position would place the reactor outside of its design basis. The team identified that the Grand Gulf Nuclear Station was susceptible to this failure mode due to possible fire damage in five cabinets in the main control room. The licensee entered this finding into its corrective action program under CR-GGN-2011-02780.

Analysis.

The failure to take adequate corrective actions to address the potential for fire induced hot shorts to impact the ability to trip some control rods following a fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the reactor safety mitigating systems cornerstone attribute for protection against external events (fire), and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, Assumptions and Limitations section of Appendix F states that findings involving control room evacuation are not explicitly treated in Appendix F; therefore, a Phase 3 significance determination risk assessment was performed by a senior reactor analyst.

As discussed in Section 1R05.05.b.1, the analyst calculated the main control room abandonment frequency to be 1.24 x 10-5/year. The analyst noted that the cabling and components associated with the reactor protection system were contained in five main control room cabinets. Given that there were a total of 58 cabinets in the Grand Gulf main control room, the analyst calculated that 8.6 percent of control room fires would potentially impact the reactor protection system. Therefore, the probability that a main control room fire would impact the reactor protection system and require a control room abandonment over a 1-year period was 1.06 x 10-6. The analyst assumed that the baseline conditional core damage probability for a main control room abandonment was 0.1 as accepted by the industry during the Individual Plant Evaluation of External Events.

As a bounding assumption, the analyst assumed that any fire-induced impact to the reactor protection system would cause the postulated fire to lead to core damage.

Therefore the change in core damage frequency was bounded by 9.58 x 10-7. The analyst noted that this was a bounding value because the fire-induced impact on the reactor protection system would require two hot shorts in any one of the four control rod groups to cause a failure to scram. In accordance with NRC Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, because Grand Gulf has a Mark III containment and the dominant core damage sequences do not include intersystem loss of coolant accidents, small-break loss of coolant accidents or station blackouts, this finding is not significant with respect to the large, early release frequency. Because the change in core damage frequency was less than 1 x 10-6, and

the finding was not significant with respect to large, early release frequency, this finding is of very low safety significance (Green).

The finding did not have a crosscutting aspect since it was not indicative of current performance, in that the licensee had incorrectly assessed the applicability of Information Notice 2007-07 more than three years prior to this finding.

Enforcement.

10 CFR 50, Appendix B, Criterion XVI, requires, in part, that conditions adverse to quality are promptly identified and corrected. License Condition 2.C(41), Fire Protection Program, requires the licensee to implement and maintain in effect all provisions of the approved Fire Protection Program as described in Revision 5 to the Updated Final Safety Analysis Report. Table 9.5-1 of the UFSAR described that the fire protection quality assurance program would address problems in the 10 CFR Part 50, Appendix B, Corrective Action Program. Contrary to the above, the licensee failed to adequately review industry operating experience and implement effective corrective actions for potential fire damage to equipment required for postfire safe shutdown. Specifically, the licensee did not recognize the potential effects of fire damage to circuits required to insert all control rods to accomplish the reactivity control function necessary to achieve postfire safe shutdown were applicable to Grand Gulf Nuclear Station, and as a result, failed to provide actions in procedures to ensure all control rods were inserted. The licensee implemented an immediate compensatory measure via a standing order that directed operators to open the RPS breakers upon evacuating the control room due to fire; therefore, this is not an immediate safety concern. Because this violation was of very low safety significance and it was entered into the licensees corrective action program, this violation is being treated as a noncited violation, consistent with the Enforcement Policy:

NCV 5000416/2011007-04, Inadequate Corrective Actions to Assure Postfire Safe Shutdown.

4OA6 Meetings, Including Exit

Meeting Summaries The team presented the inspection results to Mr. D. Wiles, Engineering Director, and other members of the licensee staff at an debrief meeting on April 21, 2011. The licensee acknowledged the findings presented.

The team presented the inspection results to Mr. M. Perito, Vice President Operations, and other members of the licensee staff at an exit meeting on August 30, 2011. The licensee acknowledged the findings presented.

The inspectors confirmed that proprietary material examined during the inspection had been returned.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

T. Barnett, Senior Project Manager, Corporate Engineering

J. Caery, Training Manager

D. Chipley, Design Engineering

D. Coulter, Senior Licensing Specialist

H. Farris, Assistant Operations Manager

J. Giles, Manager, Performance Improvement

P. Guardado, Corporate Programs Supervisor

K. Higginbotham, Planning, Scheduling and Outage Manager

T. Holcombe, Shift Manager, Operations

G. Lantz, Supervisor Large Components, Corporate Engineering

R. McNemar, Training, Fire Brigade

J. Miller, Operations Manager

L. Patterson, Manager, Engineering, Programs and Components

C. Perino, Licensing Manager

M. Perito, Vice President Operations

M. Rasch, Superintendant, Operations Training

T. Reno, System Engineer

M. Richey, Director, Nuclear Safety Assurance

J. Rodriquez, Engineering Supervisor, EP&C

G. Rolfson, Director, Corporate Engineering

P. Salgads, Operations Support

E. Sanders, Engineer, Corporate Programs

R. Scarbrough, Licensing Specialist

R. Sorrels, Fire Protection Engineer

D. Wiles, Engineering Director

C. Williams, Supervisor, Design Engineering

R. Wilson, Manager, Quality Assurance

NRC personnel

R. Smith, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

05000416/2011007-01 NCV Failure To Provide An Adequate Alternative Shutdown Procedure (Section 1R5.5.b.1)

-1- Attachment

05000416/2011007-02 NCV Failure To Assure Equipment Required For Postfire Safe Shutdown Was Protected Against Fire Damage (Section 1R5.5.b.2)

05000416/2011007-03 NCV Failure to Take Timely Corrective Actions to Protect Safe Shutdown Equipment From Fire Damage (Section 1R5.6)

05000416/2011007-04 NCV Inadequate Corrective Actions To Assure Postfire Safe Shutdown (Section 4OA2.b)

Closed

None LIST OF ACRONYMS ADAMS Agencywide Documents Access and Management System CR Condition Report CFR Code of Federal Regulations DRS Division of Reactor Safety FPIP Fire Protection Impairment Permits NCV Noncited Violation NFPA National Fire Protection Association NRC Nuclear Regulatory Commission PAR Publicly Available Records RHR Residual Heat Removal RPS Reactor Protection System SDP Significance Determination Process UFSAR Updated Final Safety Analysis Report