IR 05000482/2011007

IR 05000482-11-007; Wolf Creek Generating Station; 10/17/2011 - 12/12/2011; Wolf Creek Generating Station, NRC Triennial Fire Inspection Report

ML11361A427
Person / Time
Site:	Wolf Creek
Issue date:	12/27/2011
From:	Geoffrey Miller NRC/RGN-IV/DRS/EB-2
To:	Matthew Sunseri Wolf Creek
Pick G
References
IR-11-007
Download: ML11361A427 (49)

Text

UNITE D S TATE S NUC LEAR RE GULATOR Y C OMMI S SI ON ber 27, 2011

SUBJECT:

WOLF CREEK GENERATING STATION - NRC TRIENNIAL FIRE INSPECTION REPORT (05000482/2011007)

Dear Mr. Sunseri:

On December 12, 2011, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Wolf Creek facility. The enclosed inspection report documents the inspection results, which were discussed in an exit meeting on December 12, 2011, with Mr. G. Sen, Regulatory Affairs Manager, and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed personnel.

Four NRC-identified findings of very low safety significance (Green) were identified during this inspection. Three of these findings were determined to involve violations of NRC requirements.

Further, two licensee-identified violations, which were determined to have very low safety significance, are listed in this report. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2 of the NRC Enforcement Policy.

If you contest any non-cited violation in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN.: Document Control Desk, Washington, D.C. 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Senior Resident Inspector at the Wolf Creek Generating Station. If you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at Wolf Creek. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

Wolf Creek Nuclear Operating Corp. -2-In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

John Mateychick for Geoffrey Miller, Chief Engineering Branch 2 Division of Reactor Safety Docket: 50-482 License: NPF-42

Enclosure:

Inspection Report No. 05000482/2011007 w/Attachment: Supplemental Information

REGION IV==

Docket: 50-482 License: NPF-42 Report Nos.: 05000482/2011007 Licensee: Wolf Creek Nuclear Operating Corporation Facility: Wolf Creek Generating Station Location: 1550 Oxen Lane NE Burlington, Kansas Dates: October 17 to December 12, 2011 Team Leader: G. Pick, Senior Reactor Inspector, Engineering Branch 2 Inspectors: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 S. Alferink, Reactor Inspector, Engineering Branch 2 B. Correll, Reactor Inspector, Engineering Branch 2 Approved By: Geoffrey Miller, Chief Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY OF FINDINGS

IR 05000482/2011007; 10/17 - 12/12/2011; Wolf Creek Nuclear Operating Corporation; Wolf

Creek Generating Station; Triennial Fire Protection Team Inspection This report covered a 2 week onsite triennial fire protection team inspection by specialist inspectors from Region IV. Four Green findings, three of which were non-cited violations, were identified. The significance of most findings is indicated by their color (Green, White, Yellow,

Red) using Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a finding because the licensee was not fully testing the isolation function of local transfer switches located at motor control center breakers for individual components. As a result, the licensee was not performing periodic verifications to confirm that local control circuits would be isolated from the effects of fire damage caused by a control room fire. The licensee documented this deficiency in Condition Report 045434.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. Specifically, the licensee failed to ensure that component specific transfer switch testing procedures verified proper circuit isolation from the control room in the event of a control room fire.

The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post-fire safe shutdown. Using Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, the team determined that the finding constituted a low degradation of the safe shutdown area since the control room isolation feature is expected to display nearly the same level of effectiveness and reliability as it would had the degradation not been present. This finding screened as having very low safety significance (Green). Since the failure to test the isolation function had not been verified since initial installation, the team determined that this failure did not reflect current performance (Section 1R05.05.1).

Green.

The team identified a non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the team identified two examples where the licensee failed to maintain an alternative shutdown procedure that ensured operators would prevent overfilling the pressurizer and steam generators, respectively. The licensee documented this deficiency in Condition Report 045442.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the significance of this finding using Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because the performance deficiency affected fire protection defense-in-depth strategies involving post-fire safe shutdown systems. A senior reactor analyst performed a Phase 3 evaluation and determined this finding had very low risk significance based upon a bounding analysis (Green). This finding did not reflect current licensee performance (Section 1R05.05.2).

Green.

The team identified a non-cited violation of License Condition 2.C(5)because the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to properly analyze for fire damage in the form of shorts-to-ground related to the residual heat removal Train B refueling water storage tank suction valve and the pressurizer power-operated relief valves. Certain postulated shorts-to-ground could spuriously actuate these valves such that safe shutdown would be impacted. The licensee documented these deficiencies in Condition Reports 044912 and 045452, respectively.

The failure to protect the residual heat removal Train B suction cables and the pressurizer power operated relief valve cables against all modes of cable failure during post-fire safe shutdown circuit analysis was a performance deficiency. The performance deficiency was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team used Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because the performance deficiency affected fire protection defense-in-depth strategies involving post-fire safe shutdown. The team categorized the finding as having a high degradation rating because the post-fire safe shutdown analysis was not complete. Because the Phase 1 screening criteria were not met, the team performed a Phase 2 analysis. The team walked down the affected fire area for each example as part of the Phase 2 quantitative screening.

The team identified fire ignition sources and targets, and specific fire growth and damage scenario combinations for each example. The sum of the conditional core damage frequencies for the fire scenarios was 5.15E-7/year, which bounded the total change in core damage frequency associated with this performance deficiency.

This performance deficiency had a cross-cutting aspect in the area of human performance associated with decision making because the licensee did not use conservative assumptions during their design review process. Specifically, the licensee did not follow industry guidance related to performing a circuit analysis

H.1(b) (Section 1R05.06).

Green.

The team identified a non-cited violation of License Condition 2.C(5)because the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to provide an adequate procedure for performing cold shutdown repairs required for post-fire safe shutdown. The licensee documented the deficiencies in Condition Reports 045397 and 045417.

The failure to ensure that Procedure OFN RP-017A, Hot Standby to Cold Shutdown from Outside the Control Room Due To Fire, Revision 0, could be implemented as written was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. The finding was evaluated for safety significance using NRC Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process. Since the finding was related to the ability to achieve and maintain cold shutdown, the finding screened to Green in Phase 1.

This performance deficiency had a cross-cutting aspect in the area of human performance associated with resources because the licensee did not prepare an accurate and up-to-date procedure that assured nuclear safety. Specifically, personnel did not verify that the steps in the revised procedure could be performed as written and that the components had proper labeling H.2(c) (Section 1R05.10).

Licensee-Identified Violations

Violations of very low safety significance that were identified by the licensee have been reviewed by the team. Corrective actions taken or planned by the licensee have been entered into the corrective action program. These violations and their corrective action tracking numbers are listed in Section 4OA7 of this report.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection Triennial, at the Wolf Creek facility. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas, with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for review. The team used the fire hazards analysis section of the Wolf Creek Individual Plant Examination of External Events to select the following three risk-significant fire areas (inspection samples) for review:

• Fire Area A-22 Train A Control Room Air Conditioning Unit

• Fire Area A-27 Reactor Trip Switchgear Room

• Fire Area C-10 South Electrical Chase - 2000 Elevation The team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C(5), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Final Safety Analysis Report, Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Three inspection samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, post-fire safe shutdown equipment list, post-fire safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions in response to fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the post-fire safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant post-fire safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the method used to meet the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one

post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met applicable license commitments.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, fire penetrations, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the design configuration. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the design configuration.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified that the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team walked down accessible portions of the detection and suppression systems in the selected fire areas. The team also walked down major system support equipment in other areas (e.g., fire pumps and Halon supply systems) to assess the material condition of these systems and components.

The team reviewed the electric fire pump flow and pressure tests to verify that the pump met its design requirements. The team verified that corrective actions for Non-cited Violation 05000482/2008010-02, Failure to Ensure a Fire Pump Would Automatically Start for One Fire Area, were completed. The team reviewed the testing of the flow characteristics (Hazen-Williams coefficient) of the fire protection piping used to monitor for system degradation. The team also reviewed the Halon suppression functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for fire fighting.

The team observed an unannounced fire drill, conducted on November 2, 2011, and the subsequent drill critique. The team used the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly. The team observed fire brigade members fight a simulated fire in the fuel handling building, located in the radiological controlled area. The team verified that licensee personnel: identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient firefighting equipment was transported to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) smoke removal operations;

(7) utilization of pre-planned strategies;

(8) adherence to the pre-planned drill scenario; and

(9) drill objectives.

b. Findings

No findings were identified.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train).

• Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the post-fire safe shutdown analysis, operating procedures, piping and instrumentation diagrams, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the post-fire safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support system functions.

The team also verified that the systems and components credited for post-fire safe shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team verified that sufficient personnel to perform post-fire safe shutdown actions were trained and available onsite at all times, exclusive of those assigned as fire brigade members.

A walkthrough of the post-fire safe shutdown procedure with licensed and non-licensed operators was performed to determine the adequacy of the procedure. The team verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits (i.e., those expected to occur in response to a loss of offsite power). Time critical actions that were verified included restoring electrical power, establishing control at the auxiliary shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team reviewed manual actions to ensure that they had been properly reviewed and approved and that the actions could be implemented in accordance with plant procedures in the time necessary to support the post-fire safe shutdown method for each fire area.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

===.1

Introduction.

The team identified a Green finding because the licensee was not fully===

testing the isolation function of local transfer switches located at motor control centers for individual components. As a result, the licensee was not performing periodic verifications to confirm that local control circuits would be isolated from the effects of fire damage caused by a control room fire. The licensee documented this deficiency in Condition Report 045434.

Description.

In the event the control room must be evacuated, the operators transfer control of post-fire safe shutdown equipment to the auxiliary shutdown panel and other locations in the plant. Alignment for alternative shutdown operation is accomplished via a series of transfer switches to

(1) transfer control of selected equipment to the auxiliary shutdown panel,

(2) reposition selected components to the desired post-fire safe shutdown position, and

(3) isolate the control room portions of the circuits. The isolation function of the transfer switches was required only for control room evacuation because of a fire. The isolation function was designed to ensure that fire damage will not prevent local operation of equipment needed to achieve safe shutdown of the plant.

Procedure AP 10-100, Fire Protection Program, Revision 16, described the approved fire protection program. This procedure specified that the approved fire protection program required several items needed to maintain post-fire safe shutdown capability.

Specifically, the approved fire protection program:

(1) specified that a combination of systems, procedures, and personnel ensured post-fire safe shutdown capability (Step 4.8.1) and

(2) established an alternate shutdown procedure for transitioning the reactor to hot standby for a fire in the control room (Step 6.6.2).

The team determined that Safety Evaluation Report Supplement 5, Section 9.5.1.5, Alternate Shutdown, described nine isolation switches related to post-fire safe shutdown components not located on the auxiliary shutdown panel. The supplemental safety evaluation report described that the isolation switches had to be manipulated to ensure components were isolated from the effects of fire damage from a control room fire and ensure post-fire safe shutdown of the plant.

The team determined that Procedure STN RP-001, Remote Shutdown Norm/Iso Switch Test, Revision 12, and Procedure STN RP-002H, Essential Service Water to Train B to CCW (component cooling water) Heat Exchanger B Isolation Switch Test, Revision 0,tested the transfer switches located on local components other than the auxiliary shutdown panel but did not verify the isolation function. The team determined that the other procedures that tested the transfer function at the motor control centers would need to be reviewed to determine the extent of condition.

The team reviewed several equipment schematics and determined that these testing procedures did not ensure that all necessary contacts have operated (opened) to isolate the control room portions of the circuit. The licensee used Electroswitch Series 24 switches. The team determined a possible failure mode could exist such that a deck of contacts would not rotate properly causing all contacts on the associated deck to fail to operate. The team identified a performance deficiency because the test procedures failed to identify that all decks of contacts have operated and ensured isolation from the control room in the event of a fire.

The team determined that the licensee had self-identified the need to correct this condition in June 2010. Specifically, the licensee reviewed industry operating experience related to a failure to appropriately test the isolation function of auxiliary shutdown panel transfer switches. Following review of this industry information, the licensee documented in Condition Report 026253 that the transfer switch testing procedures, Procedure STN RP-001, Auxiliary Shutdown Panel Control Switch Test, Revision 19B and the series of Procedures STN RP-002A through J should be revised to ensure all isolation switch contacts move to the required position when the isolation hand switches are actuated and that all control room and automatic functions return to normal when the isolation hand switches are returned to the normal position.

Even though the licensee recognized that their transfer switch testing did not effectively verify isolation from the control room, other licensee organizations decided not to implement the design. Consequently, the licensee opted to not modify the testing procedures and closed Condition Report 026253 with no further action taken for these recommendations. The team determined that this was a missed opportunity to correct this long-standing failure to verify that the transfer switches isolated the control room.

The approved fire protection program specified

(1) that all active and passive fire protection features designed to maintain at least one train of post-fire safe shutdown components remained free of fire damage following a fire (Step 2.1) and

(2) that a combination of systems, procedures, and personnel provided for post-fire safe shutdown capability and testing (Step 4.8.1). The team determined that the procedure did not list any test procedures related to testing the transfer switches nor did the procedure discuss the need to test the isolation function even though the program required that all active and passive fire protection features be tested.

The team determined that Technical Specification Amendment 15, dated February 24, 1988, allowed the licensee to remove the fire protection program requirements from the Technical Specifications, with the exception of the fire brigade, remote shutdown panel testing, and fire protection audit requirements. The team determined that this Technical Specification amendment specified that testing of the auxiliary shutdown panel switches clearly included the fire protection isolation function as well as other reasons for an uninhabitable control room.

As specified in Technical Specifications, the licensee conducted transfer/isolation switch testing at the auxiliary shutdown panel using Procedure STS RP-004. The team verified that this procedure properly tested the transfer and isolation functions of the transfer switches located on the auxiliary shutdown panel. From review of the testing requirements contained in the Technical Specification Surveillance Requirement 3.3.4.2 bases, the team determined that the specification focused on control room abandonment without discussing the added requirements related to isolation of post-fire safe shutdown circuits. The team determined the failure to list Procedure STS RP-004, Procedure STN RP-001, and the Procedures STN-002A through J within the body of Procedure AP 10-100 a performance deficiency. The team determined the failure to list the transfer/isolation switch procedures resulted in a minor violation. The team further determined this minor violation was related to inadequate control of transfer switch testing in the approved fire protection program and was a contributing factor to the above described finding.

Analysis.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. Specifically, the licensee failed to ensure that component specific transfer switch testing procedures verified proper circuit isolation from the control room in the event of a control room fire. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post-fire safe shutdown. Using Appendix F, 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, the team determined that the finding constituted a low degradation of the safe shutdown area since the control room isolation feature is expected to display nearly the same level of effectiveness and reliability as it would had the degradation not been present. This finding had very low safety significance (Green). Since the failure to test the isolation function had not been verified since initial installation, the team determined that this failure did not reflect current performance

Enforcement.

No violation of NRC requirements was identified for failure to test the isolation function of the transfer switches. The licensee documented this deficiency in their corrective action program as Condition Report 045434. Because this finding did not involve a violation of regulatory requirements and had very low safety significance (Green), it is identified as a finding: FIN 05000482/2011007-01, Failure to Verify Isolation of Associated Circuits on Isolation Switches.

===.2

Introduction.

The team identified a Green non-cited violation of Technical===

Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the team identified two examples where the licensee failed to maintain an alternative shutdown procedure that ensured operators would prevent overfilling the pressurizer and steam generators, respectively. The licensee documented this deficiency in Condition Report 045442.

Description.

Operations personnel used Procedure OFN RP-017, Control Room Evacuation, Revision 39, to shut down the reactor at the auxiliary shutdown panel and other control stations outside of the control room in the event a control room fire required evacuation of the control room. This procedure provided alternative methods to maintain several post-fire safe shutdown functions, including reactor coolant inventory and decay heat removal. The procedure controlled reactor coolant inventory by maintaining the pressurizer level and pressure within prescribed limits and controlled decay heat removal by using auxiliary feedwater flow to two of the four steam generators.

The team performed a timed walkthrough of the alternative shutdown procedure. Based on the timed walkdown results, the team identified two alternative shutdown scenarios where the procedure failed to provide operators with appropriate guidance. The first scenario failed to ensure operators controlled make-up water flow in order to prevent overfilling the pressurizer. In the second scenario, the procedure failed to have operators control auxiliary feedwater flow for decay heat removal and prevent overfilling the steam generators.

Scenario 1: Potential Overfilling of the Pressurizer The first example involved a control room fire with the spurious actuation of a single pressurizer power-operated relief valve. In this scenario, the open pressurizer power-operated relief valve rapidly depressurizes the reactor coolant system and a safety injection signal occurs approximately 40 seconds after the reactor trip. The safety injection signal causes both safety-related charging pumps to start and both boron injection tank outlet valves to open.

Based on the timed walkdown, the team determined that operators would stop the Train B charging pump in 7 minutes, restart the Train B charging pump in 26 minutes, and would be available to stop the Train A charging pump at some point after 26 minutes. Using these times, the licensee determined that the pressurizer would reach 100 percent indicated level at 31 minutes and go solid at 34 minutes.

The alternative shutdown procedure provided instructions for operators to control pressurizer level by throttling charging flow through the Train B boron injection tank outlet valve. The team determined that this action would not be successful since the safety injection signal opens the boron injection tank outlet valves for both trains in separate flow paths. Further, the the alternative shutdown procedure did not provide instructions for operators to deenergize and close the Train A boron injection tank outlet valve. The team concluded that the operators might not recognize the need to take these actions prior to the pressurizer overfilling. The licensee implemented a fire watch as compensatory action.

The team reviewed Calculation SA-08-006, RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire, Revision 2, which contained the thermal-hydraulic analysis for a control room fire. This calculation analyzed the plant response to a set of spurious actuations. The team noted that this calculation failed to examine any detrimental effects that could occur from an inadvertent safety injection cause by fire-induced spurious actuation.

Scenario 2: Potential Overfilling of the Steam Generators The second example involved a control room fire with the failure to close the main steam isolation valves prior to evacuating the control room. In this scenario, the open main steam isolation valves provided steam to the turbine-driven main feedwater pumps, which continue to inject feedwater into the steam generators. The licensee determined that the steam generators could overfill in 3 minutes with main feedwater injecting. The loss of heat removal capability with all steam generators no longer steaming would negatively impact the ability to remove decay heat. Also, overflow into the main steam lines could also disable the turbine-driven auxiliary feedwater pump once water flowed down the steam supply line. The licensee relied upon the turbine-driven auxiliary feedwater pump for post-fire safe shutdown decay heat removal.

The alternative shutdown procedure directed operators to close the main steam isolation valves from the control room. The procedure also directed the operators to perform a backup local action to ensure the main steam isolation valves were closed by unplugging amphenol connectors on the valves. Since the main feedwater pumps were turbine-driven, closing the main steam isolation valves would stop the main feedwater pumps.

Based on the timed walkdown, the team determined that operators would be able to complete the backup action to close the main steam isolation valves and stop the main feedwater pumps at 22 minutes.

The team determined that Calculation SA-08-006 analyzed the plant response to several spurious actuations that included the main steam isolation valves remaining open. The team noted that the two scenarios involving the main steam isolation valves remaining open indicated that main feedwater stopped immediately. The team determined Calculation XX-E-013, Post-Fire Safe Shutdown (PFSSD) Analysis, Revision 2, provided the assumptions used in the thermal-hydraulic analysis in Calculation SA-08-006. Assumption 3-A-4 stated that a loss of automatic functions was assumed for control room fire scenarios.

The team discussed the thermal-hydraulic analysis with the responsible engineer and determined that the analysis assumed that the main feedwater pumps stopped on the feedwater isolation signal from a reactor trip and low Tavg signal. The team noted that this was an automatic actuation signal and was inconsistent with the assumptions of the approved fire protection program discussed in Calculation XX-E-013.

The team reviewed the fire protection licensing basis and concluded the approved fire protection program did not credit main steam isolation valve closure from the control room. The licensing basis stated, in part, With regards to control room evacuation, the only operation that is allowed prior to leaving the control room is a reactor scram. All other actions required for hot shutdown must be accomplished from outside the control room. The licensee implemented a fire watch as compensatory action.

In addition, the team determined that reenergization of two solenoids resulting from fire damage (e.g., hot shorts) could cause each main steam isolation valve to reopen and render the manual action ineffective. Generic Letter 86-10, Implementation of Fire Protection Requirements, Item 3.8.4, provided guidelines related to actions being taken in the control room prior to evacuation. Specifically, for any additional control room actions deemed necessary prior to evacuation, a demonstration of the capability of performing such actions would have to be provided. Additionally, assurance would have to be provided that such actions could not be negated by subsequent spurious actuation signals resulting from the postulated fire. Consequently, since fire damage could result in spurious actuation signals negating the main steam isolation valve closure, the team had concerns that any Generic Letter 86-10 evaluation that approved taking additional control room actions would be adverse to the existing approved fire protection program.

Analysis.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated the significance of this finding using Manual Chapter 0609, Appendix F, because the performance deficiency affected fire protection defense-in-depth strategies involving post-fire safe shutdown systems. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since the performance deficiency involved alternative shutdown scenarios that led to control

room evacuation. The analyst performed a bounding evaluation for each example separately to determine an upper limit for the change in core damage frequency.

The senior reactor analyst assigned a generic fire ignition frequency for the control room (FIFCR), which was slightly higher than the value in Calculation AN-95-029, Control Room Fire Analysis, Revision 1. The analyst multiplied the fire ignition frequency by a severity factor (SF) and by a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes assuming a 2 minute detection that required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FEVAC) that could be utilized was:

FEVAC = FIFCR

• SF

• NPCRE

= 1.09E-2/year

• 0.1

• 1.30E-2

= 1.42E-5/year Using this generic control room evacuation frequency, the analyst determined the potential for evacuating the control room in response to a fire affecting cabinets that contained the circuits related to the pressurizer power-operated relief valves and the steam generators separately.

Scenario 1: Potential Overfilling of the Pressurizer The control room has a total of 103 cabinets. The analyst determined that a single fire in five of these cabinets could lead to the spurious opening of a pressurizer power-operated relief valve. Therefore, a bounding change in core damage frequency for a control room fire that leads to evacuation and the spurious opening of a pressurizer power-operated relief valve (FEVAC+PORV) was determined to be:

FEVAC+PORV = FEVAC

• 5/103

= 1.42E-5/year

• 5/103

= 6.88E-7/year This frequency was considered to be bounding since it assumed:

• A fire in the applicable cabinets would create a short that caused the pressurizer power-operated relief valve to spuriously open,

• The conditional core damage probability given a control room fire with evacuation and the spurious opening of a power-operated relief valve was equal to one, and

• The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

Scenario 2: Potential Overfilling of the Steam Generators The control room has a total of 103 cabinets. The analyst determined that operators were trained and directed by the alternative shutdown procedure to attempt to close the main steam isolation valves prior to evacuating the control room. The analyst also noted that the thermal-hydraulic analysis showed that the plant conditions would be met to get a feedwater isolation signal from the reactor trip with a low Tavg signal.

The analyst determined that a single fire in one cabinet could prevent the operators from closing the main steam isolation valves from the control room. The analyst also determined that a single fire in two other cabinets could prevent the main steam and feedwater isolation signals from actuating. Therefore, a bounding change in core damage frequency for a control room fire that leads to evacuation and the overfilling of the steam generators (FEVAC+SG) was determined to be:

FEVAC+SG = FEVAC

• 3/103

= 1.42E-5/year

• 3/103

= 4.14E-7/year This frequency was considered to be bounding since it assumed:

• A fire in the applicable cabinets would cause the main feedwater pumps to continue injecting water into the steam generators resulting in overfilling the steam generators,

• The conditional core damage probability given a control room fire with evacuation and overfilling the steam generators was equal to one, and

• The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

The total control room evacuation frequency (FEVAC-Tot) related to this deficiency is the sum of the evacuation frequencies related to overfilling of the pressurizer and overfilling of the steam generators:

FEVAC-Tot = FEVAC+PORV + FEVAC+SG

= 6.88E-7/year + 4.14E-7/year

= 1.09E-6/year The analyst determined a delta conditional core damage probability (CCDP) by subtracting the generic control room evacuation conditional core damage probability (CCDPgeneric ) from the bounding conditional core damage probability (CCDPbound). The bounding conditional core damage probability assumed that both fires resulted in core damage.

CCDP = CCDPbound - CCDPgeneric

= 1.0 - 0.1

= 0.9 The analyst determined a bounding delta core damage frequency (CDF) for this performance deficiency by multiplying the total control room evacuation frequency by the delta conditional core damage probability.

CDF = CCDP

• FEVAC-Tot

= 0.9

• 1.09E-6/year

= 9.9E-7/year The analyst determined resulting delta core damage frequency of 9.9E-7/year was bounding because the delta conditional core damage probability would likely have a lower value based on realistic conditions.

In accordance with the guidance in Manual Chapter 0609, Appendix H, the senior risk analyst screened the performance deficiency related to each example for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/year. Given that Wolf Creek has a large, dry containment and that control room evacuation sequences do not include steam generator tube ruptures or intersystem loss of coolant accidents, the analyst determined that this example was not significant with respect to large early release frequency. The analyst concluded this finding was of very low risk significance (Green).

This finding did not have a cross-cutting aspect since it was not indicative of current licensee performance.

Enforcement.

Technical Specification 5.4.1.d requires that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to the above, from June 4, 1985, to November 4, 2011, the licensee failed to implement and maintain written procedures covering fire protection program implementation. Specifically, the team identified two examples where the licensee failed to maintain an alternative shutdown procedure that ensured operators would prevent overfilling the pressurizer and steam generators, respectively.

The licensee entered these deficiencies into their corrective action program as Condition Report 045442. Because this violation was of very low safety significance and the deficiencies entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy:

NCV 05000482/2011007-02, Inadequate Alternative Shutdown Procedure.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The team focused on the cables of selected components from the reactor coolant system, refueling water storage tank, containment sump, essential service water, and chemical volume and control system. For the sample of components selected, the team reviewed electrical elementary and block diagrams and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. The team also reviewed circuit coordination studies for the safety related 4160 volt emergency bus.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C(5)because the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to properly analyze for fire damage in the form of shorts-to-ground related to the residual heat removal Train B refueling water storage tank suction valve and the pressurizer power-operated relief valves. Certain postulated shorts-to-ground could spuriously actuate these valves such that safe shutdown would be impacted. The licensee documented these deficiencies in Condition Reports 044912 and 045452, respectively.

Description.

The licensee conducted a circuit analysis to identify circuit vulnerabilities created by fire damage affecting post-fire safe shutdown components. The team independently assessed the licensees circuit analysis of several components. The team identified two examples where the licensee failed to properly evaluate fire damage in the form of shorts-to-ground. The affected components included Valve BNHV8812B, refueling water storage tank to residual heat removal Pump B suction valve, and Valves BBPCV0455A and BBPCV0456A, pressurizer power-operated relief valves.

Example 1: Potential to Drain Refueling Water Storage Tank to the Containment Sump The refueling water storage tank supplies make-up water to the suction of the centrifugal charging pumps as part of the post-fire safe shutdown procedures. Also, the refueling water storage tank provides make-up water to the centrifugal charging pumps and residual heat removal pumps for a loss of coolant accident. As part of this design basis event response for a loss of coolant accident, Valve EJHV8811B, containment recirculation sump isolation valve, is designed to open on Low-Low refueling water

storage tank level. Once Valve EJHV8811B fully opens, a circuit interlock will provide a close signal to Valve BNHV8812B.

The team determined from review of the valve circuits that a hot short could spuriously open Valve EJHV8811B. Further, fire damage that caused shorts to ground could prevent Valve BNHV8812B from closing. With both valves open simultaneously, the contents of the refueling water storage tank would gravity drain to the containment sump. This transfer would eliminate the make-up water supply to the centrifugal charging pumps from the refueling water storage tank relied upon during post-fire safe shutdown. The licensee confirmed that the control cables for both of these valves were routed through Fire Area A-16 and are assumed to burn because of a single fire.

The licensee had completed a post-fire safe shutdown circuit analysis for Change Package 012307, PFSSD - Cable Reroute to Resolve RWST [refueling water storage tank] Draindown, in November 2007. As a result of their review, the licensee rerouted certain cables to prevent fire damage from causing spurious actuations. During the independent circuit analysis for the modification, the team determined that the licensee had evaluated for hot shorts but failed to analyze for shorts to ground and open circuits for the circuit associated with Valve BNHV8812B. Consequently, a fire in Fire Area A-16 could result in draining the refueling water storage tank to the containment sump while the refueling water storage tank provided the make-up water supply to the reactor coolant system. The licensee documented this deficiency in Condition Report 044912.

As an interim corrective action, the licensee revised Procedure OFN KC-016, Fire Response, to direct operators to manually close Valve BNHV8812B early in the procedure. The team determined that this interim compensatory measure was feasible and could be accomplished within the required 28 minutes. This interim compensatory action will ensure sufficient water inventory remains in the refueling water storage tank to support transition to cold shutdown.

Example 2: Failure to Analyze the Effects of Grounds on the Pressurizer Power-Operated Relief Valve By letter dated March 9, 2011, the NRC approved License Amendment No. 193 that changed the categorization of the pressurizer power-operated relief valves and block valves to non-high/low pressure interface valves. Changing the categorization allowed the licensee to consider a single hot short rather than two hot shorts when evaluating the possible circuit failures. Since a portion of the defense-in-depth basis for this declassification included a circuit modification to the power-operated relief valve circuits, the team selected these valve circuits for additional review. Change Package 012944, Power-Operated Relief Valve BBPCV0455A and BBPCV0456A Circuit Modifications, modified the control circuit by adding contacts that isolated the positive and negative sides of the actuation relays and solenoids. The modification prevented a single hot short from causing Valves BBPCV0455A and BBPCV0456A from spuriously opening and provided the operators the capability to close the power-operated relief valves from the control room.

The team identified that the licensee limited the failure modes review to a single hot short without considering the hot short coincident with other types of fire damage (i.e.,

open circuits or shorts to ground) to cables in the cable tray. The team postulated a fire that would cause a single inter-cable hot short combined with fire damage creating

multiple grounds of remaining cables in the cable tray. With this fire damage present, the pressurizer power-operated relief valve solenoid would energize and the operators would be unable to close the pressurizer power-operated relief valve from the control room. The pressurizer block valves can normally be used to isolate a pressurizer power-operated relief valves; however, the pressurizer block valve cables were routed above the pressurizer power-operated relief valve cables in the fire areas and would be subject to the same fire damage caused by the same fire.

The licensee did not implement any modifications to protect the circuits for the pressurizer power-operated relief valve block valves nor did they instruct operators to close the block valves. Consequently, if a pressurizer power-operated relief valve spuriously opened because of fire damage, operators would not have the ability to isolate the power-operated relief valves. This unisolable path would result in a loss of reactor coolant inventory and loss of pressure control that exceeded the plant response to a loss of normal ac power. The team identified areas in the plant with cables routed for both the pressurizer power-operated relief and block valves that could be damaged during a fire.

For both of the circuit issues, the team determined that the licensee did not follow the guidelines contained in NEI 00-01, Guidance for Post-Fire Safe Shutdown Circuit Analysis, Revision 2 and Regulatory Guide 1.189, Fire Protection for Nuclear Power Plants, Revision 2, Section 5.3. Section 5.3 identifies that licensees should consider circuit faults in at least two adjacent, external cables and all interactions within the target cable. Specifically, the licensee did not correctly account for the interactions among cables for all types of fire damage. This failure requires a hot short combined with a short to ground of the target cable and a short to ground on one additional cable. The licensee implemented a fire watch as a compensatory measure for the deficiencies.

Analysis.

The failure to protect the residual heat removal Train B suction cables and the pressurizer power operated relief valve cables against all modes of cable failure during post-fire safe shutdown circuit analysis was a performance deficiency. The performance deficiency was more than minor because it was associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team used Manual Chapter 0609, Appendix F, because the performance deficiency affected fire protection defense-in-depth strategies involving post-fire safe shutdown.

The team categorized the finding as having a high degradation rating because the post-fire safe shutdown analysis was not complete for circuits whose maloperation could impact the ability to achieve and maintain safe shutdown conditions. Because the Phase 1 screening criteria were not met, the team performed a Phase 2 analysis.

The team walked down the affected fire areas for each example as part of the Phase 2 quantitative screening. The team identified fire ignition sources and targets, and specific fire growth and damage scenario combinations for each example. The team determined that the largest potential ignition sources in the fire areas could not form a hot gas layer in any of the associated fire areas sufficient to impact the protected cable raceways or their supports. The team used the Predicting Hot Gas Layer Temperature in a Room Fire with Forced Ventilation spreadsheet contained in NUREG-1805, Fire Dynamics

Tools (FDT) Quantitative Fire Hazard Analysis Methods for the U.S. Nuclear Regulatory Commission Fire Protection Inspection Program.

Example 1: Potential to Drain Refueling Water Storage Tank to the Containment Sump The team determined during the walk down that the zone of influence for any single fire source would affect the cables for either one or the other component. However, because no single fire source could damage both cables simultaneously, this example had very low safety consequence (Green). This finding did not have a cross-cutting aspect since it was not indicative of current licensee performance.

Example 2: Failure to Analyze the Effects of Grounds on the Pressurizer Power-Operated Relief Valve The team performed a Phase 2 evaluation to determine an upper limit for the change in core damage frequency. The team identified four credible fire scenarios that could result in core damage under certain conservative assumptions. The pertinent parameters and results of these scenarios are summarized in Table 1, Phase 2 Evaluation Results.

B provides a more detailed discussion of the Phase 2 evaluation.

Table 1: Phase 2 Evaluation Results Source Fire Heat Probability Scenario Ignition Severity Probability of Description Ignition Releas of a Hot CCDF Number Source Factor Non-Suppression (Fire Area) Frequency e Rate Short Relay RP-333 Panel 6.00E-5/yr 200 kW 0.9 0.35 0.02 3.78E-7/yr (A-16)

Relay RP-333 Panel 6.00E-5/yr 650 kW 0.1 0.35 0.02 4.20E-8/yr (A-16)

Security SK194B Panel 6.00E-5/yr 200 kW 0.1 0.35 0.02 4.20E-8/yr (A-16)600V MCC NG01B 6.00E-5/yr 200 kW 0.1 0.44 0.02 5.28E-8/yr (A-18)

Total 5.15E-7/yr In each of these scenarios, the conditional core damage frequency (CCDF) bounds the change in core damage frequency. The team calculated the conditional core damage probability using the following equation:

CCDF = FIF x SF x PNon Suppression x PHot Short where: FIF denotes the fire ignition frequency SF denotes the severity factor PNon Suppression denotes the non-suppression probability PHot Short denotes the probability of a hot short

The sum of the conditional core damage frequencies for each of the fire scenarios of 5.15E-7/year bounded the total change in core damage frequency associated with this performance deficiency.

In accordance with the guidance in Manual Chapter 0609, Appendix H, the senior risk analyst screened the performance deficiency related to each example for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/year. Given that Wolf Creek has a large, dry containment and that control room evacuation sequences do not include steam generator tube ruptures or intersystem loss of coolant accidents, the analyst determined that this example was not significant with respect to large early release frequency. The analyst determined this example was of very low risk significance (Green).

This example of the performance deficiency had a cross-cutting aspect in the area of human performance associated with decision making because the licensee did not use conservative assumptions during their design review process. Specifically, they did not follow all industry guidance related to performing a circuit analysis H.1(b).

Enforcement.

License Condition 2.C(5) states that the licensee shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek site addendum through Revision 15, as approved in the SER through Supplement 5, Amendment No. 191, and Amendment No. 193. Final Safety Analysis Report, Appendix 9.5B was replaced by Calculation XX-E-013. Calculation XX-E-013, Section 4, requires, in part, that cables or equipment of redundant trains of systems necessary to achieve and maintain hot standby, which could prevent operation or cause mal-operation due to hot shorts, open circuits, or shorts to ground, be free of fire damage.

Contrary to the above, in November 2007, and July 2010, the licensee failed to maintain all provisions of the approved fire protection program in two instances. Specifically, Change Package 012307 failed to assess shorts to ground for Valve BNHV8812B to ensure the component was free of fire damage; and Change Package 012944 failed to assess a hot short combined with multiple grounds on Valves BBPVC0455A and BBPCV0456A to ensure the equipment was free of fire damage. The licensee documented these deficiencies in Condition Reports 044912 and 045452, respectively.

Because this violation was of very low safety significance and it was entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the Enforcement Policy: NCV 05000482/2011007-03, Failure to Ensure Post-Fire Safe Shutdown Components Remain Free of Fire Damage.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and

coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkthrough of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team evaluated whether the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team reviewed whether the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C(5)because the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to provide an adequate procedure for performing cold shutdown repairs required for post-fire safe shutdown. The licensee documented the deficiencies in Condition Reports 045397, 045399, 045401, and 045417.

Description.

The team reviewed a sample of repairs required for achieving and maintaining cold shutdown that required personnel to lift leads and/or install jumpers. A

walkthrough of Procedure OFN RP-017A, Hot Standby to Cold Shutdown from Outside the Control Room Due To Fire, Revision 0, with plant personnel identified the following deficiencies.

• Attachment A, Steps A3 and A4, required installation of jumpers. The procedure did not identify the location of the jumpers. Operators performing the walkthrough did not know the storage location; consequently, the operator referred to the inventory control surveillance procedure, Procedure STN GP-009, Emergency Equipment Verification, Revision 57, to identify the location of the jumpers. After locating the jumpers, the team determined that jumper labeled J-1 in Step A-4 was missing.

• Attachment A, Steps A6 and A7, required installation of jumpers from a Temporary Term and Control Box without specifying the equipment location. The team verified that Procedure STN GP-009 identified the storage location. The team determined the equipment descriptions in Procedure OFN RP-017A, in Procedure STN GP-009, and on the equipment were different. Further, the team determined that the inventory control procedure did not verify that Jumpers J-1 and J-10 were attached to the Temporary Term and Control Box.

The licensee entered these issues into their corrective action program as Condition Reports 045397 and 045417.

From additional discussions, the team determined that the licensee had recently excerpted Procedure RP-017A from a different procedure. The licensee had not walked down and verified that all portions of the procedure could be accomplished as written.

The licensee was implementing actions to address the labeling deficiencies and was performing an apparent cause evaluation to determine the permanent corrective actions.

The inspectors determined that the most likely cause for this deficiency related to poor labeling and a dependence of the licensee on skill-of-the craft. The licensee had initiated actions to improve the human factors and usability of the procedure.

Analysis.

The failure to ensure that Procedure OFN RP-017A could be implemented as written is a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. The finding was evaluated for safety significance using NRC Inspection Manual Chapter 0609, Appendix F. Since the finding was related to the ability to achieve and maintain cold shutdown, the finding had very low safety significance (Green) from the Phase 1 evaluation.

This performance deficiency had a cross-cutting aspect in the area of human performance associated with resources because the licensee did not prepare an accurate and up-to-date procedure that assured nuclear safety. Specifically, personnel did not verify that the steps in the revised procedure could be performed as written and that the components had proper labeling H.2(c).

Enforcement.

License Condition 2.C(5) states that the licensee shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek site

addendum through Revision 15, as approved in the SER through Supplement 5, Amendment No. 191, and Amendment No. 193. Appendix 9.5E of the Updated Safety Analysis Report provides a design comparison to 10 CFR 50 Appendix R, Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979.

Section III.L.5 specifies that fire damage to equipment and systems necessary to achieve cold shutdown shall be limited so that the systems can be made operable and cold shutdown can be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Materials for such repairs shall be readily available on site and procedures shall be in effect to implement such repairs.

Contrary to the above, since January 2009, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to provide an adequate procedure for performing cold shutdown repairs required for post-fire safe shutdown since Procedure OFN RP-017A could not be performed as written. The licensee documented these deficiencies in Condition Reports 045397, 045399, 045401, and 045417. Because this violation was of very low safety significance and it was entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 0500482/2011007-04, Procedure Inadequacies Related to Cold Shutdown Repairs.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings were identified.

.11 B.5.b Inspection Activities

a. Inspection Scope

The team reviewed implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with loss of large areas of the plant resulting from explosions or fire as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026, dated February 25, 2002, and 10 CFR 50.54(hh)(2).

The team reviewed the strategies to verify that the licensee continued to maintain and implement procedures and maintain and test equipment necessary to properly implement the strategies, and ensure station personnel are knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable

equipment used to implement the strategies to ensure the availability and material readiness of the equipment, including the fire truck. The team assessed the ability to obtain fuel for the fire truck and foam used for firefighting efforts. The strategies selected for this inspection sample included:

• Spent fuel pool makeup via the fire protection standpipe, the fire truck, and the 4-inch drain connection

• Refueling water storage tank makeup via the fire protection hydrant and fire truck

• Steam generator depressurization and fill The team covered the three samples listed, which included their variations.

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection. In addition the team reviewed the corrective actions implemented for previous noncompliances to verify that they were effective in correcting identified deficiencies.

The specific noncompliances reviewed included:

Non-cited Title Violation 2005008-003 Failure to Ensure Redundant Safe Shutdown Systems Located in the Same Fire Area Are Free of Fire Damage 2008002-009 Failure to Reestablish Timely Seal Cooling for the Reactor Coolant Pumps 2008002-010 Failure to Analyze Motor-Operated Valve Circuits 2008010-002 Failure to Ensure a Fire Pump Would Automatically Start for One Fire Area 2008010-005 Operator Actions Affect the Ability to Operate Post Fire Safe Shutdown Equipment 2008010-006 Failure to Evaluate Changes to the Approved Fire Protection Program 2009004-008 Changes to the Approved Fire Protection Program May Not Meet NRC Acceptance Criteria

Non-cited Title Violation 2009005-016 Operator Actions May Create the Potential for Secondary Fires

b. Findings and Observations

No findings were identified. The licensee had taken appropriate corrective actions for each of the above non-cited violations. The team determined that the licensee had established appropriate interim compensatory measures.

4OA3 Followup of Events and Notices of Enforcement Discretion

.1 (Closed) Licensee Event Report 05000482/2008-009-00: Inadequate Compensatory

Actions for a Fire Area The licensee initiated this licensee event report because they failed to establish an hourly fire watch in a timely manner, as required by their fire protection program. NRC identified during a triennial fire protection inspection that removing control power affected a number of components in the credited post-fire safe shutdown train (refer to Non-cited Violation 05000482/2008010-005). The licensee attributed the root cause for this failure to establish the hourly fire watch to an established practice of removing control power; consequently, the personnel failed to consider the need to establish compensatory measures for the identified inadequate post-fire safe shutdown response capability. The licensee documented this deficiency in Condition Report 2008-05172.

This licensee-identified finding involved a violation of License Condition 2.C(5). The enforcement aspects of the violation are discussed in Section 4OA7. No additional issues were identified during this review. This licensee event report is closed.

.2 (Closed) Licensee Event Reports 05000482/2009-003-00 and 05000482/2009-003-01:

Post-Fire Safe Shutdown Issue during Postulated Control Room Fire On August 9, 2009, the licensee identified that a valve used in the alternative shutdown procedure could not be closed within the minute assumed in the thermal-hydraulic analysis. The licensee determined that the Train A residual heat removal pump suction from the refueling water storage tank valve would take 8 minutes to close. The licensee concluded that the additional time required to close this valve could cause operators to exceed the amount of time available to establish charging. The team performed a timed walkdown of the alternative shutdown procedure. The team determined that operators were able to close the valves in approximately 17 minutes. This length of time exceeded the 10 minute requirement specified in the fire protection licensing basis, but was within the 28 minutes analyzed in the thermal hydraulic analysis.

This failure to comply with License Condition 2.C(5) constitutes a violation of minor significance that is not subject to enforcement action in accordance with the NRCs Enforcement Policy. These licensee event reports are closed.

.3 (Closed) Licensee Event Report 05000482/2010-013-00: Potential Safe Shutdown

Unanalyzed Condition Identified during Post-Fire Safe Shutdown Circuit Analysis

On November 18, 2010, the licensee identified three examples where the alternative shutdown capability was not independent of the control room. A control room fire could adversely affect post-fire safe shutdown in the following instances:

• Certain fuses installed in the exciter/voltage regulator cabinet could fail. If the fuses failed prior to flashing the field, the diesel generator would not be capable of generating voltage and no power would be available to supply the post-fire safe shutdown equipment.

• Energized cables associated with the reactor head vent could cause the spurious actuation of the pressurizer power-operated relief valves. The spurious opening of a pressurizer power-operated relief valve for longer than the analyzed time could lead to a significant depressurization of the reactor coolant system and voiding that challenges natural circulation.

• Dampers in the essential service water and emergency diesel generator rooms could fail and cause the room temperature to exceed the maximum design temperature or drop below the minimum design temperature.

The licensee implemented compensatory measures and is developing modifications to resolve the underlying circuit issues.

This licensee-identified finding involved a violation of License Condition 2.C(5). The enforcement aspects of the violation are discussed in Section 4OA7. No additional issues were identified during this review. This licensee event report is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the preliminary inspection results to Mr. M. Sunseri, President and Chief Executive Officer, and other members of the licensee staff at the conclusion of the onsite inspection on November 4, 2011.

The team presented the inspection results to Mr. G. Sen, Regulatory Affairs Manager, and other members of your staff at an exit meeting on December 12, 2011. The licensee acknowledged the findings presented.

The team asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

4OA7 Licensee-Identified Violations

The following violations of very low safety significance (Green) were identified by the licensee and are violations of NRC requirements that meet the criteria of the NRC Enforcement Policy for being dispositioned as non-cited violations.

• Licensee Event Report 05000482/2008-009-00 described a failure to establish a 1-hour fire watch compensatory measure in Fire Area A-27 related to a circuit issue. This was a violation of License Condition 2.C(5) and

Procedure AP 10-104, Breach Authorization, Revision 25A. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. This finding was associated with fire prevention and administrative controls category. It was determined to be of very low safety significance since it involved a low degradation of the fire protection program.

This issue was entered into the corrective action program as Condition Report 2008-05172. This violation is also discussed in Section 4OA3.1

• Licensee Event Report 05000482/2010-013-00 described three examples where the alternative shutdown capability was not independent of the control room.

This was a violation of License Condition 2.C(5). The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. A bounding Phase 3 evaluation concluded that this issue had very low safety significance (Green) since each example was associated with a fire in 1 of the 103 control room cabinets. This issue was entered into the corrective action program as Condition Reports 030350 and 031408. This violation is also discussed in Section 4OA3.4.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Bodenhammer, Operations Support

M. Brinkmeyer, Fire Protection Engineer

R. Clemens, Vice President Engineering

D. Dixon, Electrical Engineer

K. Fredrickson, Licensing Engineer

B. Fox, Fire Protection Engineer

D. Garbe, Fire Protection Engineer

J. Hinterweger, Fire Protection Training

R. Hobby, Licensing Engineer

D. Hooper, Supervisor Licensing

J. Keating, Operations Support

K. Nelson, Safety Analysis Engineer

E. Ray, Manager Quality Assurance

W. Selbe, Fire Protection Consultant

R. Smith, Plant Manager

A. Stull, Vice President and Chief Administrative Officer

M. Sunseri, President and Chief Executive Officer

J. Sutter, Fire Protection Supervisor

R. Zyduck, Manager Design Engineering

NRC personnel

C. Long, Senior Resident Inspector

C. Peabody, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000482/2011007-01 FIN Failure to Verify Isolation of Associated Circuits on Isolation Switches (Section 1R05.05.1)

05000482/2011007-02 NCV Inadequate Alternative Shutdown Procedure (Section 1R05.05.2)

05000482/2011007-03 NCV Failure to Ensure Post-Fire Safe Shutdown Components Remain Free of Fire Damage (Section 1R05.06)

05000482/2011007-04 NCV Procedure Inadequacies Related to Cold Shutdown Repairs (Section 1R05.10)

Attachment A

Closed

05000482/2008-009-00 LER Inadequate Compensatory Actions for a Fire Area (Section 4OA3.1)

05000482/2009-003-00 LER Post-Fire Safe Shutdown Issue during Postulated Control Room and 01 Fire (Section 4OA3.2)

05000482/2010-013-00 LER Potential Safe Shutdown Unanalyzed Condition Identified during Post-Fire Safe Shutdown Circuit Analysis (Section 4OA3.4)