IR 05000280/2015008

IR 05000280/2015008, 05000281/2015008; on March 09-13, 2015 and 23-27, 2015; Surry Power Station, Units 1 and 2; Triennial Fire Protection Inspection

ML15188A511
Person / Time
Site:	Surry
Issue date:	07/06/2015
From:	Scott Shaeffer NRC/RGN-II/DRS/EB2
To:	Heacock D Virginia Electric & Power Co (VEPCO)
References
IR 2015008
Download: ML15188A511 (47)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION uly 6, 2015

SUBJECT:

SURRY POWER STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT NOS. 05000280/2015008 AND 05000281/2015008

Dear Mr. Heacock:

On May 15, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Surry Power Station, Units 1 and 2. The enclosed inspection report documents the inspection results, which were discussed with you and other members of your staff on May 29, 2015.

During this inspection, the NRC staff examined activities conducted under your license as they relate to public health and safety to confirm compliance with the Commission's rules and regulations, and with the conditions of your license. Within these areas, the inspection consisted of selected examination of procedures and representative records, observations of activities, and interviews with personnel.

Based on the results of this inspection, the NRC has identified three findings that were evaluated under the risk significance determination process as having very low safety significance (Green); and one finding that was determined to be Severity Level IV under the traditional enforcement process. These findings involved violations of NRC requirements. The NRC is treating these as non-cited violations (NCV) consistent with Section 2.3.2 of the Enforcement Policy. These NCVs are described in the subject inspection report. If you contest the violations, or the significance of these NCVs, you should provide a response within 30 days of the date of this inspection report, with the basis of your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Surry Power Station.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). To the extent possible, your response should not include any personal privacy or proprietary, information so that it can be made available to the Public without redaction.

Sincerely,

/RA/

Scott M. Shaeffer, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37

Enclosure:

Inspection Report 05000280/2015008 and 05000281/2015008 w/Attachment: Supplementary Information

REGION II==

Docket Nos.: 50-280, 50-281 License Nos.: DPR-32, DPR-37 Report Nos.: 05000280/2015008 and 05000281/2015008 Licensee: Virginia Electric and Power Company Facility: Surry Power Station, Units 1 and 2 Location: 5850 Hog Island Road Surry, VA 23883 Dates: March 09 - March 13, 2015 March 23 - March 27, 2015 Inspectors: David A. Jones, Senior Reactor Inspector (Lead Inspector)

Gerald R. Wiseman, Senior Reactor Inspector Philipp J. Braaten, Reactor Inspector Denise Terry-Ward, Construction Inspector Approved by: Scott M. Shaeffer, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000280/2015008, 05000281/2015008; March 09 - March 13 and March 23 - March 27, 2015; Surry Power Station, Units 1 and 2; Triennial Fire Protection Inspection This report covers an announced two-week triennial fire protection inspection by a team of four Region II inspectors. Inspectors identified three non-cited violations (NCVs) of very low safety significance and one Severity Level IV NCV. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using IMC 0609, Significance Determination Process, dated 06/12/11. Cross-cutting aspects are determined using IMC 0310, Components within the Cross Cutting Areas, dated 12/04/14.

All violations of NRC requirements are dispositioned in accordance with the NRC s Enforcement Policy, dated 07/09/2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process Revision 5.

Cornerstone: Mitigating Systems

• Green: The inspectors identified a Green non-cited violation (NCV) of Surrys Operating License, Condition 3.I, Fire Protection, for the licensees failure to ensure a functional alternate safe shutdown flow path during an Appendix R fire. The licensee entered this issue into their corrective action program as condition report (CR) 580928.

The licensees failure to ensure a functional alternate shutdown system alignment during an Appendix R fire event was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone. Specifically, Surry failed to implement appropriate corrective actions to mitigate the spurious closure and subsequent damage of more than one motor operated valve as identified in an engineering evaluation. The failure to re-open credited Appendix R MOV(s) would result in the loss of secondary heat removal and/or RCS make-up capability during Appendix R fire events. The finding was screened in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process, and determined to be of low safety significance (Green). A Region II senior risk analyst performed a bounding phase 3 analysis that determined the finding represented an increase in core damage frequency of < 1 E-6 /year. No cross cutting aspect was assigned because the performance deficiency did not occur within the last three years. (Section 1R05.05.01)

• Green: The inspectors identified a Green NCV of 10 CFR 50.55(a) for the licensees failure to implement in-service testing (IST) and in-service inspections (ISI) for charging cross-tie components. The licensee entered this issue into their corrective action program as CRs 581385 and 581386.

The licensee failed to scope the charging cross-tie manual isolation valves and piping into the ISI and IST programs. This was a performance deficiency that resulted in the subsequent failure to perform ISI and IST activities required by the ASME OM Code-2004 and 10 CFR 50.55a(f) and (g). The performance deficiency was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone. Specifically, the sites failure to perform required inspections and testing for charging cross-tie components, since 1989, resulted in a lack of reasonable assurance that the charging cross-tie function could perform its required function. The finding was screened in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process, and determined to be of low safety significance (Green) because it did not affect the ability to reach and maintain a stable plant condition within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. No cross cutting aspect was assigned because the performance deficiency did not occur within the last three years. (Section 1R05.05.02)

• Green: The inspectors identified a Green NCV of Surrys Operating License,

Condition 3.I, Fire Protection, for design control deficiencies in the fire protection program. The licensee entered this issue into their corrective action program as condition report CRs 581390.

The licensees failure to adequately implement the design control requirements in the fire protection program as required by Topical Report, DOM-QA-1, Dominion Nuclear Facility Quality Assurance Program Description, Section 3.2, Design Control Program was a performance deficiency. The finding was more than minor because it was associated with the design control attribute and affected the Mitigating Systems cornerstone. Specifically, design control deficiencies resulted in a lack of assurance that the design control requirements were being adequately implemented within the fire protection program. The finding was screened in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process, and determined to be of low safety significance (Green)because it finding did not affect the ability to reach and maintain a stable plant condition within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. No cross cutting aspect was assigned because the performance deficiency did not occur within the last three years. (Section 1R05.11.02)

Other Findings

• Green: The inspectors identified a Green NCV of 10 CFR 50.59 and 10 CFR 50.71(e) for the licensees failure to perform 50.59 evaluations; and failure to update the UFSAR for plant changes associated with reactor coolant pump (RCP) seal cooling during fire events. The licensee entered this issue into their corrective action program as condition report CRs 5813388.

The licensees revision of fire safe shut down procedures; and the installation of a different reactor coolant pump seal package without completing the required 50.59 evaluations was a performance deficiency. Additionally, the licensees failure to update the UFSAR as required by 10 CFR 50.71(e) was a performance deficiency.

The UFSAR did not adequately describe the charging cross-tie function; and did not adequately describe the fire protection programs procedural isolation of the RCP seals for the entire duration of an Appendix R event. In accordance with the Reactor Oversight Process, the performance deficiencies were more than minor because they were associated with the design control attribute of the Mitigating Systems Cornerstone. The performance deficiencies were also assessed using traditional enforcement because the NRCs ability to perform its regulatory function such as, license amendment reviews and inspections was affected. The finding was screened in accordance with NRC IMC 0609, Appendix F, Fire Protection Significance Determination Process, and determined to be of low safety significance (Green) because it did not affect the ability to reach and maintain a stable plant condition within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. No cross cutting aspect was assigned because these performance deficiencies did not occur within the last three years. (Section 1R05.11.01)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R05 Fire Protection (Triennial)

This report documents the results of a triennial fire protection inspection of the Surry Power Station, Units 1 and 2. The inspection was conducted in accordance with the guidance provided in NRC Inspection Procedure (IP) 71111.05T, Fire Protection (Triennial), dated January 31, 2013. Section 71111.05-02 of the IP specifies a minimum sample size of three FAs and one B.5.b mitigating strategy for addressing large fires and explosions. This inspection fulfilled the requirements of the procedure by selecting a sample of three fire areas (FA) and one mitigating strategy from Section B.5.b of NRC Order EA-02-026, Order for Interim Safeguards and Security Compensatory Measures (commonly referred to as B.5.b), as well as the storage, maintenance, and testing of B.5.b mitigating equipment.

The team inspected three risk-significant FAs to evaluate implementation of the fire protection program (FPP) as described in Surrys Updated Final Safety Analysis Report (UFSAR) and Appendix R Fire Protection Report (FPR). The sample FAs were chosen based on:

• a review of available risk information as analyzed by a senior reactor analyst (SRA)from Region II

• a review of previous inspection results

• plant walk-downs of FAs

• consideration of relational characteristics of combustible material to targets

• the location of equipment needed to achieve and maintain safe shutdown (SSD) of the reactor.

For each of the selected fire areas, the inspectors evaluated the licensees FPP against the applicable design bases documents and NRC. Design bases documents reviewed by the team are listed in the Attachment to this report. The FAs chosen were identified as follows:

Fire Area 4, Unit 2 emergency switchgear room (ESGR) and relay room

Fire Area 5, Unit 1 and 2 main control rooms (MCRs)

Fire Area Fire Area 17, Auxiliary Building (2 - 0 Elevation)

In selecting a B.5.b mitigating strategy sample, the inspectors reviewed licensee submittal letters, safety evaluation reports (SERs), licensee commitments, B.5.b implementing procedures, and previous NRC inspection reports (IRs). The B.5.b mitigating strategy that was chosen was make-up to the refueling water storage tank.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The inspectors reviewed applicable portions of Surry Power Station (SPS) Units 1 and 2 post-fire safe shutdown analysis (SSA) described in the SPS Appendix R Fire Protection Report, Rev. 35. The inspectors also reviewed Fire Contingency Action (FCA) fire response procedures, fire annunciator response procedures, abnormal operating procedures (AOPs), and standard operating procedures (SOPs). Piping and instrumentation drawings (P&IDs), applicable electrical one-line drawings, component cable routing information, the SPS UFSAR, and other supporting documents were also referenced. The teams objective was to verify that post-fire SSD could be achieved and maintained either from the main control room (MCR) or Auxiliary Shutdown Panel for a postulated fire in the MCR (FA 5), Unit 2 ESGR (FA 4), or the 2 Elevation of the Auxiliary Building (FA 17). The inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring instrumentation, and support system functions.

For the selected FAs, the inspectors performed physical walk-downs to observe:

(1) the material condition of fire protection systems and equipment;

(2) the storage of permanent and transient combustibles;

(3) the proximity of fire hazards to cables relied on, and

(4) the licensees implementation of procedures and processes for limiting fire hazards, housekeeping practices, and compensatory measures for inoperable or degraded fire protection systems and credited fire barriers.

Methodology Cable routing information by FA was reviewed for a selected sample of SSD components to verify that the associated cables would not be damaged by a fire in the selected fire areas, or that the licensees analysis determined that the fire damage would not prohibit safe plant shutdown. The inspectors reviewed the SPS FPR for the selected FAs and compared it to the FCA procedures, emergency procedures, and abnormal procedures to verify that cables and equipment credited for post-fire SSD in the FPR and applicable procedures were adequately protected from fire damage in accordance with the requirements of 10 CFR 50, Appendix R, Section III.G, Fire Protection of Safe Shutdown Capability. In cases where local operator manual actions (OMAs) were credited in lieu of cable protection of SSD equipment, the inspectors reviewed the OMAs to verify that the OMAs were feasible utilizing the guidance of NRC IP 71111.05T, paragraph 02.02.j.2. A list of SSD components examined for cable routing are included in the to this report.

Operational Implementation The inspectors reviewed applicable sections of FCA procedures, emergency procedures, and abnormal procedures to verify that the shutdown methodology properly identified the systems and components necessary to achieve and maintain SSD conditions. The inspectors performed a walk-through of the FCA procedure steps to ensure the implementation and human factors adequacy of the procedures. The inspectors verified that licensee personnel credited for procedure implementation had procedures available, were trained on implementation, and were available in the event a fire occurred. The inspectors also reviewed selected operator actions to verify that the operators could reasonably be expected to perform the specific actions within the time required to maintain plant parameters within specified limits.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

For the selected FAs, the inspectors evaluated the adequacy of fire barrier walls, ceilings, floors, mechanical and electrical penetration seals, cable tray fire stops, fire doors, and fire dampers. The inspectors walked down accessible portions of the selected FAs to observe material condition of the passive barriers and to identify any potential degradation or non-conformance. The inspectors reviewed the design of selected masonry block walls and fire doors to confirm that appropriate materials and construction methods were used to assure that the respective fire barriers met their intended design function. In addition, the inspectors compared the installed configurations to the approved construction details and supporting fire endurance test data to assure the respective fire barriers met license commitments to Appendix A to BTP APCSB 9.5-1. Also, a sample of completed surveillance and maintenance procedures for selected fire doors, fire dampers, and penetration seals were reviewed to ensure that these passive fire barriers were being properly inspected and maintained.

The fire protection features included in the review are listed in the Attachment to this report.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The inspectors performed in-plant observations of the material condition and operational lineup of fire water storage tanks, the recently installed diesel-driven fire pump, the electric motor-driven fire pump, and the fire protection water supply distribution piping which included manual fire hose and standpipe systems. Using operating and valve alignment procedures as well as engineering drawings, the inspectors examined selected fire pumps and accessible portions of the fire main piping system to evaluate the operational status of the sites active fire protection system. The inspectors reviewed periodic surveillance and operability flow test data for the fire pumps and fire main loop to assess whether the test program was sufficient to validate proper operation of the fire protection water supply system in accordance with its design requirements. Additionally, the inspectors verified that fire-induced failures of electrical power supplies or control circuits for the common fire protection water delivery and supply components would not render the system inoperable during a fire event.

The inspectors reviewed vendor equipment specifications and drawings, and engineering calculations to verify that the sites smoke detection methods were appropriate for the types of fire hazards that existed in the selected FAs. The inspectors reviewed the design and installation of fire suppression systems in the selected FAs to verify that the systems met the required code and license requirements. This assessment was accomplished through the review of system vendor drawings, calculations, and code requirements. The inspectors assessed the manually actuated Halon system and associated smoke detection systems for FA-4. The inspectors reviewed the testing and maintenance requirements of the FPP and Technical Requirements Manual (TRM); completed periodic surveillance testing; and maintenance program procedures for the fire detection, suppression, standpipe, and fire hoses to determine if the test program was sufficient to maintain the applicable design requirements.

The inspectors performed walk-downs of the selected fire areas to verify that the hose stations were adequately located, that the hoses were of the appropriate length, and that the hose stations were not obstructed. The team verified that the installed locations of the hose stations and extinguishers were consistent with the locations that were depicted in the sites fire fighting plans and drawings.

The inspectors assessed the condition of fire fighting and smoke control equipment located at fire brigade staging and dress out areas. The inspectors reviewed documentation for selected members of the fire brigade to verify conformance with medical and training requirements. The inspectors reviewed the fire brigades drill planning schedule; and drill critique records for announced, unannounced, and off-site fire department drills for the past two years to verify adequacy of the sites training of fire brigade members. Additionally, mutual aid agreements with local outside fire departments were also reviewed to verify that they were being maintained. Specific documents reviewed by the inspectors are listed in the Attachment to this report.

b. Findings

No findings were identified.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The inspectors reviewed heating, ventilation, and air conditioning (HVAC) system drawings; fire contingency action procedures; and configuration drawings of electrical raceways and SSD components) to verify that the effects of water, drainage, heat, hot gasses, and inter-area migration of smoke would not inhibit credited SSD operator actions. The documents reviewed are listed in the Attachment to this report.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capabilities

a. Inspection Scope

Methodology The team reviewed the licensees FPP as described in UFSAR Section 9.10.1, the SSA, FCAs, P&IDs, electrical drawings, and other supporting documents for postulated fires in fire areas 4, 5, and 17. The reviews focused on ensuring that the required functions for post-fire SSD and the corresponding equipment necessary to perform those functions were included in the procedures. The review included assessing whether hot and cold shutdown from outside the MCR could be implemented, and that transfer of control from the MCR to the dedicated shutdown control stations could be accomplished. This review also included verification that shutdown from outside the MCR could be performed both with and without the availability of offsite power.

Plant walkdowns were performed to verify that the plant configuration was consistent with that described in the SSA. These inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring instrumentation and support systems functions. The team reviewed the systems and components credited for use during this shutdown method to verify that they would remain free from fire damage.

Operational Implementation The team reviewed the training lesson plans for licensed and non-licensed operators to verify that the training reinforced the shutdown methodology in the SSA and FCAs for the selected FAs. The team also reviewed shift turnover logs and shift manning to verify that personnel required for SSD using the alternative shutdown systems and procedures were available on-site, exclusive of those assigned as fire brigade members.

The team reviewed the adequacy of procedures utilized for post-fire SSD and performed a walk-through of procedure steps to ensure the implementation and human factors adequacy of the procedures. The team also reviewed selected operator actions to verify that the operators could reasonably be expected to perform the specific actions within the time required to maintain plant parameters within specified limits.

Time critical actions reviewed included: isolating RCS high/low interface valves, re-establishing RCS makeup flow, manning the alternate shutdown location. The team reviewed and walked down applicable sections of the following fire response procedures:

• 0-FCA-1.00, Limiting MCR Fire

• 2-FCA-4.00, Limiting ESGR Number 2 Fire

• 0-FCA-8.00, Limiting Auxiliary Building Fire

• 0-FCA-11.00, Remote Monitoring

• 0-FCA-14.00, Establishing Stable RCS Makeup Flowpaths

• 0-FCA-17.00, Limiting Fire Cooldown The team also reviewed the periodic test procedures and test records of the alternative shutdown transfer capability, and instrumentation and control functions, to ensure the tests were adequate to verify the functionality of the alternative shutdown capability.

Electrical schematics were reviewed to verify that circuits for SSD equipment, which could be damaged due to fire, were isolated by disconnect switches and by swapping power supplies for selected Motor Control Centers (MCCs). In addition, the team reviewed wiring diagrams for instrumentation located on the dedicated shutdown control stations to verify that necessary process monitoring was available as required by 10 CFR 50, Appendix R, Section III.L.

b.

.01 Findings

Introduction:

The inspectors identified a Green NCV of Surrys Operating License, Condition 3.I, Fire Protection, for the licensees failure to ensure a functional alternate shutdown system alignment during an Appendix R fire event.

Description:

Surry was required to meet the requirements of 10 CFR 50 Appendix R, Section III.G.3 for several fire areas which included the Unit 1 and 2 emergency switchgear and relay rooms (ESGR) and the Unit 1 and 2 cable vault and tunnels (CVT).

For these fire areas, Surry was required to implement an alternative shutdown strategy that was free of fire damage. 10 CFR 50, Appendix R, Section 3.G, required that one train of systems necessary to achieve and maintain hot shutdown conditions be free of fire damage. Surrys alternate shutdown strategy credited auxiliary feedwater (AFW)and chemical and volume control (CVCS) cross-ties which allowed component(s) of the opposite unit to fulfill the shutdown requirements of the fire-affected unit. The AFW cross-tie was credited for secondary heat removal, and the CVCS cross-tie was credited for reactor coolant system (RCS) make-up. The AFW and CVCS cross-tie capability to mitigate an Appendix R fire event was stated in an NRC supplemental safety evaluation report (SSER), dated November 18, 1982. The SSER stated that Surry would develop alternate shutdown procedures to ensure that charging pump discharge and AFW discharge valves would open or remain open to achieve safe shutdown conditions.

Surrys current Appendix R Report stated that the CVCS cross-tie flow path included normally open C charging pump discharge motor operated valves (MOV) (2286C and 2287C) and that these valves were subject to spurious closure during fire events. The success of the charging cross-tie was predicated on at least one of these valves being open because the cross-tie piping was connected to the C charging pumps downstream piping. In a letter to the NRC, dated May 19, 1981, Surry stated that valves 2286C and 2287C could be adversely impacted by a fire in the CVT. The letter stated the breakers for the MOVs were approximately ten feet apart and that control cables for both valves could be impacted by fire. Surry determined that the charging cross-tie could be placed in service by manually opening one of the MOVs. An operator manual action (OMA)was developed that directed operators to open the motor control center (MCC) breakers; and, to locally open the MOV using the handwheel, as required. The guidance for the OMA was provided in procedure 0-FCA-14.00, Establishing Stable RCS Makeup Flowpaths. The team noted that the procedural steps were sequenced such that the MOV circuits would remain energized for a significant amount of time after the initiation of a fire.

In 1999, the licensee completed an engineering evaluation (ET CME-99-0005) to determine if Appendix R MOVs would be damaged by an electrical hot short that bypassed control switches. Surrys evaluation was prompted by Information Notice 92-18, Potential for Loss of Remote Shutdown Capability During a Control Room Fire that was issued by the NRC. The engineering evaluation concluded that Surrys Appendix R MOVs were subject to damage such that subsequent manual re-alignment of the valves could not be credited. During this same time period (1999), the licensee revised their Appendix R Report to include the following statements:

• IN 92-18 identified a condition in which valve operator damage could occur due to a spurious valve operation. Table 3-3 includes contingency actions where appropriate for a single valve which spuriously operates to failure; and

• it is conservatively assumed that any one MOV which could potentially exceed its nominal rating as a result of spurious operation cannot be repositioned.

The team was unable to review the bases for the statements because the licensee could not locate the associated revision records. The licensee did not provide any evaluations, such as a circuit analysis or fire modeling analysis, during the inspection to support the stated assumption that only a single MOV would be adversely affected by fire damage.

Also, the team determined that the assertion that any one MOV could exceed its nominal rating was in direct conflict with the licensees engineering evaluation - which had determined that all Appendix R MOVs were susceptible to damage. The inspectors concluded that the licensees revisions to the Appendix R Report were inadequate to address the vulnerabilities that were revealed in the engineering evaluation. Since approximately 1999, Surrys Appendix R Report has stipulated that contingency actions were required for the spurious actuation and failure of only one MOV.

The inspectors identified that the cables for MOVs 2286C and 2287C were co-located in the ESGR which invalidated the licensees assumption that only one MOV would be impacted. In the ESGR, the cables were located in stacked cable trays (C10 and C11)that were approximately one foot apart. It was estimated that both cables would be adversely impacted by a high energy arc fault at 4KV Bus 2J. The team determined that fire damage to conductors (#43, 51, and 52) could result in hot shorts that result in the spurious closure of the MOVs. In addition, the team determined that a hot short would exist downstream, or bypass, the torque and limit switches of the MOVs. In a fire event, spurious closure of the MOVs would result in valve damage such that operators would be unable to manually open the valves as directed by the sites fire safe shutdown (FSSD) procedures. The team also identified that in the CVT these cables were approximately 5 feet apart at their closest point. The inspection team determined that a credible fire in the ESGR or the CVT could result in the spurious closure and damage of MOVs 2286C and 2287C. Additionally, in 2003, the NRC was informed by Surry (Letter, dated 07/10/2003) that three charging flow paths were available to maintain adequate RCS inventory during fire events. The three flow paths were normal charging, high head safety injection (HHSI), and alternate HHSI. The letter did not state that the availability of the flow paths was predicated on the availability of two flow paths that included MOVs 2286C and 2287C.

On both Units, the licensees Appendix R Report credited six MOVs (151A through F)for the AFW cross-tie function. The success of the AFW cross-tie relied on one of the six valves being in the open position. The inspectors noted that a previously issued NRC inspection report (Surry Power Station - NRC Triennial Fire Protection Inspection Report 50-280/03-07 and 50-281/03-07, dated March 31, 2003) stated that unprotected control cables for these six MOVs were routed through Unit 1s ESGR. Based on this information, and a subsequent review of AFW cable routing documentation, the team determined that the deficiency described above was also applicable to the AFW cross-tie flow path. The deficiencies for the charging cross-tie and AFW cross-tie were applicable to Units 1 and 2. The issue was entered into the licensees corrective action program as condition report (CR) 580928.

Analysis:

The licensees failure to ensure a functional alternate shutdown system alignment during an Appendix R fire event was a performance deficiency. Specifically, Surry failed to implement appropriate corrective actions to mitigate the spurious closure and subsequent damage of more than one CVCS MOV (or AFW MOV) as identified in an engineering evaluation. The failure to re-open credited Appendix R MOV(s) would result in the loss of secondary heat removal and/or RCS make-up capability during Appendix R fire events. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. Specifically, the sites alternate shutdown strategy failed to provide reasonable assurance that the RCS make-up (or AFW) flow path would be available because the credited MOVs were not free of fire damage. The finding was screened in accordance with NRC IMC 0609, Significance Determination Process, dated June 2, 2011; Attachment 4, Initial Characterization of Findings, dated June 19, 2012, which determined that an IMC 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, review was required as the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire.

Using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013, the inspectors determined that the finding required a Phase 2 Quantitative Screening Approach based on a Yes answer for section 1.4.5 Question C. To satisfy the quantitative screening analysis requirement, a bounding phase 3 analysis was performed by a Region II senior risk analyst using the guidance of NRC IMC 0609 Attachment F and associated attachments. Fire scenarios which could impact Unit 2 AFW and CVCS MOVs were identified in the Surry Unit 2 ESGR and the Unit 2 Cable Vault and Tunnel. This bounding analysis assumed that inter-cable hot shorts which bypassed their respective MOVs torque and limit switch controls would close the MOV and cause damage which would render the MOV incapable of being opened manually subsequent to the hot short closure.

Other analysis assumptions included:

• a one year exposure period

• conditional core damage probability of 1.0 with no recovery considered

• thermoset cable damage criteria

• two MOV inter-cable hot shorts (2-CH-MOV-2286C and 2-CH-MOV-2287C) would fail the charging cross-tie flowpath from Unit 1 and six inter-cable hot shorts (MOVs 151 A through F) would fail the AFW cross-tie flowpath from Unit 1

• only transient combustible fire scenarios were identified which could damage both 2-CH-MOV-2286C and 2-CH-MOV-2287C in the cable vault and cable tunnel

• high energy arc fault and thermal fire scenarios were credible in the four east most vertical sections of the 2J 4kV Switchgear Fire modelling was performed using the NUREG1805 spreadsheets and the time to damage for the credible scenarios exceeded the actuation time of the respective gaseous suppression systems so the analysis assumed a probability of non-suppression of 5.0 E-2, and the ignition frequency and hot short probability used NRC IMC 0609 Appendix f values.

The dominant sequence was a thermal fire in the 2J 4kV switchgear which was postulated to lead to damage to both 2-CH-MOV-2286C and 2-CH-MOV-2287C control cables located in C10 and C11 cable trays, failure of the ESGR Halon system, inter-cable hot shorts of the 2 charging MOVs at ten minutes leading to a failure of the Unit 1 charging cross-tie strategy and subsequent core damage due to loss of inventory control. The risk was mitigated by the control cable locations, the gaseous suppression systems, and the probability of multiple inter-cable hot shorts. The bounding phase 3 analysis determined that the finding represented an increase in core damage frequency of < 1 E-6 /year, a GREEN finding of very low safety significance. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specify, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements.

The licensees UFSAR states, in part, that Surrys fire protection program satisfies the regulatory criteria set forth in 10 CFR 50, Appendix R, Section III.L.

Section III.L of Appendix R provides requirements to be met by alternative shutdown methods.Section III.L.1 specifies, in part, that the alternative shutdown capability for a specific fire area shall be able to

(a) achieve and maintain subcritical reactivity conditions in the reactor;

(b) maintain reactor coolant inventory; and

(c) achieve and maintain hot standby conditions.

Contrary to the above, since 1992, the licensee failed to provide an alternative shutdown capability to maintain reactor coolant inventory; and to achieve and maintain hot standby conditions. Specifically, Surrys RCS make-up flow path would be isolated by fire induced damage to MOVs 2286C and 2287C. Surrys letter (dated May 19, 1981) to the NRC documented the necessity of manually re-opening MOV 2286C or 2287C if both valves were subjected to fire damage. The sites engineering evaluation determined that these MOVs would be damaged if spuriously operated during a fire event. MOV damage would result in a non-recoverable RCS make-up flow path.

Because the finding is of very low safety significance (Green) and it was entered into the licensees CAP as CR 580928, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000280, 281/2015008-01, Failure to Ensure a Functional Alternate Shutdown System Alignment during Appendix R Fire Events.

.02 Findings

Introduction:

The inspectors identified a Green NCV of 10 CFR 50.55(a) for the licensees failure to implement in-service testing and in-service inspections for charging cross-tie components.

Description:

In 1989, Surry completed the installation of a chemical and volume control systems (CVCS) cross-tie to comply with fire protection licensing requirements. The design change (DC 79-67) package stated the modification was implemented as a category one quality assurance activity. This designation was consistent with a discussion of the modification in Surrys letter to the NRC (Fire Protection Modifications, dated October 29, 1980.) The cross-connect contained a three-inch diameter pipe (3-CH-252-1502) that included a four-inch manual isolation valve (1-CH-728 and 2-CH-447)at each end of the pipe. Surrys current code of record for the in-service inspection (ISI)and in-service testing (IST) programs was the 2004 Edition, of the ASME Operations and Maintenance (OM) Code. The sites in-service inspection (ISI) classification drawings (11548-FM-088B-5 & 11548-FM-088B-5) listed the valves as ISI Class 2 and the pipe as non-classed; and the sites IST program document (Plan-IST Program Basis Interval 5, Rev. 5) stated that the valves were not included in the program. In 2004, the licensee identified that the valves had not been cycled since 1989. Since October 27, 2004, the licensee cycled the valves on a refueling outage periodicity.

The valves had a safety-related function to remain closed during design bases accidents to maintain the integrity of the RCS boundary; and the valves had a function to open, and remain open, during fire events to meet Technical Specification (TS) 3.2.B.2. The TS stated that the reactor shall not be critical unless one charging pump from the opposite unit was available. The TS bases stated that, In the event the operating units charging pumps become inoperable, this permits the opposite units charging pump to be used to bring the disabled unit to cold shutdown conditions. Surrys procedure ET-S-00-0308, Maintenance Rule Scoping and Performance Criteria Matrix, Rev. 12, stated the cross-tie function was safety-related. In 1989, as previously stated, the cross-tie piping was installed as a category one quality assurance activity. In 1996, Surry downgraded the cross-connect piping to non-quality assurance (NSQ) status as documented in an equipment data system change request (EDSCR-R960039.) The team noted that the licensee used Regulatory Guide (RG) 1.26, Quality Group Classifications and Standards for Water-, Steam-, and Radioactive-Waste-Containing Components of Nuclear Power Plants Rev. 3 to classify components. Surrys ISI classification boundary drawing (11548-CBM-088B-5) included specific sections of RG 1.26 as the bases for classifying components in the ISI program. The team determined that the cross-tie pipe was required to be included in the ISI program because RG 1.26 stated, in part, that important to safety components, such as piping and valves, that are designed for reactor shutdown should be classified as quality Group B. The declassification of the component resulted in the sites failure to perform required ISI evaluations to assess the pipe for degradation mechanisms that could adversely affect the capability of the pipe to provide the required flow.

As previously stated, the charging cross-tie valves were not included in Surrys IST program. The team determined that the cross-tie valves were required to be included in the licensees IST program because the valve functions met the IST scoping criteria thats stated in Subsection ISTA-1100 of the ASME OM Code-2004. Valves that perform the following functions were required to be scoped into the IST program: pumps and valves that are required to perform a specific function in shutting down the reactor to the safe shutdown condition, in maintaining the safe shutdown condition, or in mitigating the consequences of an accident.

Additionally, the inspection team noted the following deficiencies associated with testing and inspection of the charging cross-tie components:

• Surrys procedure CM-AA-FPA-102, Fire Protection and Fire Safe Shutdown Review and Preparation Process and Design Change Process Systems, Attachment 22, Rev. 5, stated, in part, that components required for fire protection and/or Appendix R would be designated as non-quality assurance (NSQ) unless the component provided a safety-related function; and that such components typically have compensatory measures. The team noted that the sites Maintenance Rule (MR) program listed the charging cross-tie function as safety-related. Additionally, the team noted that for a non-functional cross-tie that the TS 3.2.C.3 had a seven day action statement, and that Technical Requirements Manual, Table 3.7.9-1 required hourly fire watches for specified areas of the plant.

Therefore, in accordance with procedure CM-AA-FPA-102, the cross-tie should not have been classified as NSQ. Additionally, the team noted the guidance in procedure CM-AA-FPA-102 was not consistent with RG 1.26.

• Surrys IST procedures were inadequate because the scoping criteria inappropriately allowed the exclusion of components credited during fire events:

o The sites IST program document, Plan: IST Program Basis Interval 5, excluded pumps and valves whose only safety function [was] predicated on plant shutdown and recovery from a fire per commitments made as a result of 10 CFR 50, Appendix R o The Dominion, Nuclear Fleet, Administrative Procedure, ER-AA-IST-100, ASME IST Program - General Requirements stated that, For IST, shutting down the reactor [was] intended to mean during accidents as described in the site safety analysis report.

• Surrys UFSAR, Section 9.1.3.3, Leakage Provisions, stated, in part, that all chemical and volume control system valves and piping for radioactive services were designed to permit essentially zero leakage. The site has not performed any activities since 1989 to validate this statement for the cross-tie.

• Surry implemented a surveillance procedure in 2004 to operate the valves on a refueling outage periodicity. The inspectors noted that foreign material could be transported into the cross-tie during this surveillance activity.

• Surrys UFSAR, Section 9.1.5, CVCS System - Tests and Inspections, stated that Most components are in use regularly during power operation; therefore, assurance of the availability and performance of the system and equipment was provided. The team discovered that the capability of the cross-tie to deliver the required flow had not been demonstrated since 1989.

• The inspectors noted that no TS surveillance requirement was established for the cross-tie piping and valves.

Analysis:

The licensee failed to scope the charging cross-tie manual isolation valves and piping into the ISI and IST programs. This was a performance deficiency that resulted in the subsequent failure to perform ISI and IST activities required by the ASME OM Code-2004 and 10 CFR 50.55a(f) and (g). The performance deficiency is more than minor because it was associated with the equipment performance attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. Specifically, the failure to perform required inspections and testing (ISI and IST) since 1989 resulted in a lack of reasonable assurance that the charging cross-tie function could perform its required function. The finding was screened in accordance with NRC IMC 0609, Significance Determination Process, dated June 2, 2011; Attachment 4, Initial Characterization of Findings, dated June 19, 2012, which determined that an IMC 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, review was required as the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire. Using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013, the inspectors determined the finding to be of low safety significance (Green) because it did not affect the ability to reach and maintain a stable plant condition within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. This determination was based on the sites fire safe shutdown procedures that direct operators to isolate reactor coolant pumps seals at the beginning of a fire event - which reduces the required RCS make-up flow requirement during the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

10 CFR 50.55a(f)(4) states, in part, Throughout the service life of a boiling- or pressurized-water-cooled nuclear power facility, pumps and valves, which are classified as ASME Code Class 1, Class 2, and Class 3 must meet the IST requirements set forth in the ASME OM Code. The ASME OM Code is incorporated by reference in 10 CFR 50.55a(b)(3).

10 CFR 50.55a(g)(4) states, in part, Throughout the service life of a boiling - or pressurized-water-cooled nuclear power facility, components that are classified as ASME Code Class 1, Class 2, and Class 3 must meet the in-service inspection requirements set forth in the ASME BPV Code,Section XI. The ASME BPV Code is incorporated by reference in 10 CFR 50.55a(b)(2).

Contrary to this requirement, since 1989, the licensee failed to meet the ISI and IST requirements set forth in the ASME BPV Code,Section XI and the ASME OM Code for the charging cross-tie components. Specifically, the licensee failed to scope the charging cross-tie components into the ISI and IST programs which resulted in the failure to perform the required inspections and tests. Because the finding is of very low safety significance (Green) and it was entered into the licensees CAP as CRs 581385 and 531386, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000280, 281/2015008-02, Failure to Implement In-service Testing and In-service Inspections for Charging Cross-tie Components.

.06 Circuit Analyses

a. Inspection Scope

Methodology The inspectors reviewed applicable portions of the SSA described in the SPS Appendix R Fire Protection Report, Rev. 35, post-fire procedures, operator training material, and applicable information to gain an understanding of the licensees SSD strategy. The inspectors reviewed credited components specified in the FPR for meeting the SSD function. The inspectors reviewed cable routing drawings, electrical one-line diagrams, elementary and wiring diagram drawings, Appendix R Block Diagrams, cable schedules, cable tray section drawings, electrical penetration and conduit plan drawings, interconnection diagrams and panelboard schedules, for credited components to determine if these components would be impacted by a fire within the chosen FAs. In instances where questions arose regarding potential fire induced circuit failures to cables, the inspectors performed a more detailed review by evaluating the credited resolution(s). The inspectors reviewed the licensees single spurious evaluations (circuit analysis) specified in the SPS FPR to determine if the sample list of components challenged the assumptions made in the current analysis. The inspectors reviewed the licensees electrical coordination study to determine if power supplies were susceptible to fire damage, which would potentially affect the credited components for the FAs chosen for review. The inspectors also reviewed other supporting documents to verify that post-fire SSD could be achieved and maintained either from the main control room (MCR) or Auxiliary Shutdown Panel for a postulated fire in the MCR (FA 5), Unit 2 ESGR (FA 4), or 2 Elevation of the Auxiliary, Fuel, and Decontamination Building (FA 17). The specific components and documents reviewed are listed in the Attachment.

b. Findings

See Section 1R05.05.01.

.07 Communications

a. Inspection Scope

The team reviewed the plant communications systems that would be relied upon to support safe shutdown, fire event notification, and fire brigade fire fighting activities. The team reviewed communication system drawings and performed walkdowns to ensure the system would remain operable during a fire event. The team also verified the alternate power source would be capable of maintaining the communication system in the event of a loss of offsite power. Portable radio vendor documentation was reviewed to verify that battery endurance was sufficient to combat a plant fire.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the adequacy of the emergency lighting units (ELUs) used to support plant personnel during post-fire safe shutdown for the selected FAs. The team performed plant walkdowns and observed the placement and coverage area of fixed 8-hour battery pack emergency lights throughout the selected FAs to evaluate their adequacy for illuminating access and egress pathways; and for illuminating SSD equipment or instrumentation. The team observed a test verification of the emergency lighting adequacy in the Auxiliary Building lower level and ingress/egress pathway to verify equipment functionality. The team verified installed lights were aimed as referenced in plant specific drawings.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed the licensees SSA to determine if any repairs were necessary to achieve cold shutdown. Dedicated Shutdown Procedures 0-ECM-1401-04, Emergency Installation of Component Cooling Water Motors, and 0-ECM-1410-02, Emergency Power to Residual Heat Removal Motors, described methods for repairing equipment, following a fire, and established the equipment needed to bring the Unit from hot standby to cold shutdown. The team inspected the fire damage repair kits and inventoried their contents in accordance with station procedure 0-EPM-2303-01, RHR/CC Appendix R Equipment Inspection (Warehouse), and verified that repair kits necessary to restore the Component Cooling Water Pumps along with their associated indications, and bulk cable reels were tagged and stored on-site for the sole purpose of damage control measures.

The team also verified that testing and repair equipment had been calibrated in accordance with station procedures. The team also verified that additional portable lighting was available and assessed the expiration date of the associated batteries.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

(1) Compensatory Measures for Degraded Fire Protection Components The team reviewed administrative controls for out-of-service, degraded and/or inoperable fire protection features (e.g. detection and suppression systems and passive fire barriers) to verify the adequacy of FPP interim compensatory measures.

(2) Operator Manual Actions as Compensatory Measures for Safe Shutdown This portion of the inspection procedure was not applicable because the selected fire areas were licensed in accordance with Appendix R,Section III.G.3. Section 1R05.05 assessed alternative shutdown operator manual actions.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection scope

The inspectors reviewed a sample of FPP changes to determine if the changes to the FPP were in accordance with the fire protection license condition and had no adverse effect on the ability to achieve SSD. The reviewed modifications included the following:

replacement of the ESGR Room Halon panel; replacement of the diesel driven fire pump; replacement of reactor coolant pump seals; and FSSD procedure revisions that implemented a strategy to isolate reactor coolant pump seal cooling at the onset of fire events for specified fire areas. Design change documents reviewed by the inspectors are listed in the Attachment.

b.

.01 Findings

Introduction:

The inspectors identified a violation of 10 CFR 50.59 and 10 CFR 50.71(e)for the licensees failure to perform 50.59 evaluations; and failure to update the UFSAR for plant changes associated with RCP seal cooling during fire events.

Description:

Surrys fire protection program included an alternate safe shutdown strategy (10 CFR 50, Appendix R) that credited a cross-tie which allowed a charging pump from the opposite unit to fulfill the shutdown requirements of the fire-affected unit.

The purpose of the charging cross-tie was to provide reactor coolant pump (RCP) seal cooling and reactor coolant system (RCS) inventory control for the fire-affected unit.

This function was required by Surrys Technical Specification (TS), 3.2.B.2. The charging cross-tie function, if implemented in a timely manner, would maintain RCP seal cooling during fire events for specified fire areas that utilized the alternate safe shutdown strategy; such as the main control rooms, the emergency switchgear rooms, and the cable vault and tunnels. In 2004, Surry was issued an NRC White violation (NRC Inspection Report 2004008, dated 09/15/2004) because Surrys procedures would not have precluded an extended loss of reactor coolant pump seal injection flow or a reactor coolant pump seal loss of coolant accident under certain fire scenarios. In 2005, as a corrective action, Surry revised their alternate safe shutdown strategy to isolate RCP seal cooling at the beginning of a fire event. The site revised applicable procedures to direct operators to isolate charging flow to the RCP seals; to isolate component cooling water (CCW) to the thermal barrier heat exchangers; and removed steps that had previously established RCP seal cooling via the charging cross-tie. The new strategy resulted in the RCP seals being exposed to high temperatures until cold shutdown conditions could be achieved; approximately 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> as stated by the sites cold shutdown calculation. As a result of the revised strategy, a RCS leakage rate of 63 gallons per minute (approximately 21 gpm per RCP) was assumed for the duration of an Appendix R fire event.

The inspection team identified that the licensee failed to perform the required 10 CFR 50.59 evaluation for the FSSD procedure changes that directed isolating the RCP seals at the onset of a fire event. Industry Guidance Document, NEI 96-07, Guidelines for 10 CFR 50.59 Evaluations, states that changes to the fire protection program should be evaluated for impacts on other design functions and 50.59 should be applied to the non-fire protection related efforts of the change. The licensees completed screen (Procedure VPAP-3001, Attachment 3) failed to identify that the strategy to isolate the RCP seals at the onset of an Appendix R fire event adversely affected a UFSAR described design function. The inspection team determined that the procedure change conflicted with the UFSAR which stated in several sections that seal cooling would be maintained by the CVCS or CCW systems. Additionally, the completed Safety Review /

Regulatory Screen failed to recognize that the proposed change impacted Technical Specification 3.2.B.2. The TS stated that the reactor shall not be critical unless one charging pump from the opposite unit was available. The availability of a charging pump from the opposite unit was for the purpose of providing RCP seal cooling and RCS inventory control.

During 2009 - 2012, the licensee modified the Westinghouse RCPs by installing a different seal package. Surry installed Flowserve N9000 seals that had been qualified in Byron Jackson pumps for Combustion Engineering (CE) plants. The licensees modification package (SU-09-0002, RCP Seal Replacement) assessed seal performance for an eight hour duration; this duration was based on station blackout requirements. Surry credited an RCS leakage rate of 4.5 gpm (approximately 1.5 gpm per RCP) for the N9000 seals during loss of seal cooling events. The inspection team identified that the licensee failed to perform the required 10 CFR 50.59 evaluation for the modifications. The team determined that the licensees Screen (procedure DNAP-3004 - Attachment 4) failed to identify that the modification adversely affected the Design Bases Limits for a Fission Product Barrier. The inspection team identified that the modification package was inadequate because the licensee failed to assess RCP seal performance for the Appendix R duration of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The sites 2005 FSSD procedure changes (previously discussed) necessitated that seal performance be evaluated for this extended time period. The inspection team determined that the fire protection programs required review of the modification was inadequate because it failed to identify that the seal performance had not been assessed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The team determined there was a reasonable likelihood that the modification would have required NRC review and approval prior to installation and crediting of the Flowserve N9000 seals for an Appendix R duration of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The inspection team determined that the licensee also failed to adequately update the UFSAR when the fire safe shutdown procedures were revised in 2005. The team determined that the pre-planned isolation of all RCP seal cooling during certain fire events was a change to facility operations that required an update of the UFSAR.

Isolating RCP seal cooling during fire events affected RCP design requirements associated with maintaining RCS integrity. Surry procedure, CM-AA-400, 10 CFR 50.59 and 10 CFR 72.48 - Changes, Tests, and Experiments, Rev.4, required that the licensee update the UFSAR when procedure changes result in the need to update existing UFSAR information. The team determined that the flowing UFSAR sections did not accurately describe the charging cross-tie:

• UFSAR Section 9.10.3 provided general functional requirements for safe shutdown during fire events. Section 9.10.3.2 stated that charging pumps provide makeup through the normal charging path, the RCP seal injection path, or both. The section did not describe the isolation of RCP seal cooling.

• UFSAR, Section 9.1.3.1, discussed the availability and reliability of the charging system and the charging cross-connect. The section did not discuss the procedural limitation on using the charging cross-tie for RCP seal cooling during certain fire events.

• UFSAR, Table 9.1-2, did not list the charging pumps as being shared by both units.

• UFSAR, Figure 9.1-1, is a CVCS control system flow diagram that did not include the charging cross-tie components.

• The UFSAR did not discuss the safety-related function of the charging cross-tie manual isolation valves (1-CH-728 and 2-CH-447).

Analysis:

(a) The licensees failure to document the required evaluations as required by 10 CFR 50.59(d)(1) was a performance deficiency. The failure to perform and document a 50.59 evaluation was determined to be more than minor in accordance with the guidance in the NRC Enforcement Manual for traditional enforcement violations, because there was a reasonable likelihood that the change could require Commission review and approval prior to implementation. The failure constitutes a violation of 10 CFR 50.59, which impacts the regulatory process and therefore, was evaluated through the traditional enforcement process.

(b) The licensees failure to update the UFSAR as required by procedure 10 CFR 50.71(e) was also a performance deficiency. This performance deficiency was considered as traditional enforcement, because not having an adequately updated UFSAR hinders the licensees ability to perform adequate 10 CFR 50.59 evaluations and can impact the NRCs ability to perform its regulatory function such as, license amendment reviews and inspections. In accordance with the Reactor Oversight Process, the performance deficiencies were more than minor because they were associated with the design control attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage). Specifically, the licensee did not fully demonstrate that the availability, reliability, and capability of the RCP seals to be maintained throughout the duration of an Appendix R fire event. The finding was screened in accordance with NRC IMC 0609, Significance Determination Process, dated June 2, 2011; Attachment 4, Initial Characterization of Findings, dated June 19, 2012, which determined that an IMC 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, review was required as the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire.

Using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013, the inspectors determined the finding to be of low safety significance (Green) because it did not affect the ability to reach and maintain a stable plant condition within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. This determination was based on consultation with NRC headquarter personnel and the Agencys ongoing evaluation of N9000 seal performance during an extended station blackout scenario. The team determined that no cross cutting aspect was applicable to these performance deficiencies because this finding was not indicative of current licensee performance.

The violations of 10 CFR 50.59 and 10 CFR 50.71e impacted the ability of the NRC to perform its regulatory oversight function; therefore, the issues were also dispositioned using traditional enforcement. This violation was determined to be a Severity Level (SL)

IV violation per Section 6.1.d.2 of the NRC Enforcement Policy, dated January 28, 2013, because the associated finding was evaluated by the SDP as having very low safety significance (i.e., Green finding).

Enforcement:

10 CFR 50.59 (d)(1) states, in part, that the licensee shall maintain records of changes in the facility made pursuant to paragraph

(c) of 10 CFR 50.59.

These records must include a written evaluation which provides the bases for the determination that the change does not require a license amendment pursuant to 10 CFR 50.59 (c)(2).

10 CFR 50.71(e) requires, in part, that the licensee shall update periodically, the final safety analysis report originally submitted as part of the application for the license, to assure that the information included in the report contains the latest information developed. The submittal shall include the effects of all changes made in the facility or procedures as described in the final safety analysis report and all safety analyses and evaluations performed by the licensee in support of conclusions that changes did not require a license amendment in accordance with 10 CFR 50.59(c)(2).

Contrary to the above, from 2005 through 2012, the licensee did not maintain records of changes in the facility made pursuant to paragraph

(c) of 10 CFR 50.59. Specifically, licensee did not complete written evaluations for the fire safe shutdown procedure revisions and the RCP seal replacement modifications to document the bases for not requiring a license amendment.

In addition, contrary to the above, from 2003 to present, the licensee failed to periodically update, the final safety analysis report originally submitted as part of the application for the license, to assure that the information included in the report contained the latest information developed. Specifically, the licensee did not update the UFSAR to include the effects of changes made to the facility and procedures as part of the modification that affected the RCP seals and the charging cross-tie.

Because these violations were determined to be SL IV violations and were entered into the licensees corrective action program as CR 581388, they are being treated as an NCV in accordance with Section 2.3.2 of the NRC Enforcement Policy. The violation is identified as: NCV 05000280, 281/2015008-03, Failure to Perform Required 50.59 Evaluations and Failure to Update the UFSAR for Plant Changes Associated with RCP Seal Cooling During Fire Events.

.02 Findings

Introduction:

The inspectors identified a Green NCV of 10 CFR 50.48 for multiple design control deficiencies in the Fire Protection Program.

Description:

The team identified the following fire protection design deficiencies:

1) The licensee failed to verify or check the adequacy of a fire protection program design calculation that assessed the capability to achieve cold shutdown conditions within the required 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Specifically, the licensee credited a calculation (SM-558, North Anna Power Station Appendix R Cooldown Results, dated 09/24/1987)that had not been updated since 1987. The team noted that the calculation should have been updated during plant modifications such as the four percent power uprate.

2) The licensee failed to verify the adequacy of a fire protection program design calculation that determined time requirements for the charging cross-tie operator manual action. For example, the team determined that the site failed to calculate the time requirement for a most limiting fire scenario. The site failed to consider the spurious operation of a component (i.e. CVCS letdown isolation valve) using the maximum time allowed for operators to isolate the flow path in applicable fire areas.

3) The licensee failed to implement adequate design control measures to ensure the reliable operation of the charging cross-tie. Specifically, the site failed to analyze effects of water hammer when placing the partially voided charging cross-tie pipe in service during fire events.

4) The licensee incorrectly translated docketed licensing in the sites Appendix R Report. In a letter dated November 30, 1984, the licensee requested exemptions (19 and 20) from the Agencys fire protection separation requirements (10 CFR Appendix R, III.G.2) for certain low voltage AC and 125vdc circuits. During the late 1990s, the licensee modified their Appendix R Report to state that the NRC had granted these exemptions which then became the basis for stating that circuits in conduits were not subject to fire damage. The team noted that the exemptions were not approved, but deemed not required in a NRC safety evaluation (dated February 25, 1988). The inspection team determined that the exemptions were deemed not required because

(1) the exemptions were associated with fire areas that the licensee had designated as meeting the requirements in 10 CFR Appendix R, III.G.3

- thus III.G.2 was not applicable; and

(2) for the circuits in question (pressurizer PORVs, SG PORVs, CVCS letdown valves, reactor vessel head vents, etc,) the licensee had committed to install the circuits in conduit, install isolation switches; and develop procedural guidance to utilize the isolation switches to de-energize the circuits during fire events.

5) The licensee failed to ensure that all of the fire protection time critical operator actions (TCOA) were translated into Procedure 0-DRP-049, Time Critical Operator Actions, Rev. 13. The stated purpose of the procedure was to provide a reference document for TCOAs. The team identified that the following TCOAs were not included in the procedure: SG PORVs, C charging pump MOV(s), and main condenser isolation valves.

6) The licensee failed to translate an operational requirement from the Appendix R Report into a fire safe shutdown procedure. Section 3.7.3 concluded that a fire in certain areas of the plant would cause spurious actuation of CO2 systems that would adversely affect the performance of OMAs. It was stated that breathing apparatus would be required for personnel access into these areas. The team identified that the licensee failed to translate this criteria into Procedure 2-FCA-4.00, Limiting ESGR Number 2 Fire, Rev. 25.

7) The licensee failed to ensure design inputs were correctly translated into drawings.

The team identified multiple drawing deficiencies that resulted in the initiation of seven condition reports being entered into the sites corrective action program (CRs 573557, 573671, 573822, 573823, 573925, 575126, 575167).

Analysis:

The licensees failure to adequately implement the design control requirements in the fire protection program as required by Topical Report, DOM-QA-1, Dominion Nuclear Facility Quality Assurance Program Description, Section 3.2, Design Control Program was a performance deficiency. The finding is more than minor because it is associated with the design control attribute and affected the Mitigating Systems cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to preclude undesirable consequences (i.e.

core damage). Specifically, the design control deficiencies resulted in a lack of assurance that design control requirements were being adequately implemented within the fire protection program. The finding was screened in accordance with NRC IMC 0609, Significance Determination Process, dated June 2, 2011; Attachment 4, Initial Characterization of Findings, dated June 19, 2012, which determined that an IMC 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, review was required as the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire. Using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013, the inspectors determined that the finding determined to be of low safety significance (Green) because it did not affect the ability to reach and maintain a stable plant condition within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of a fire event. The team determined that no cross cutting aspect was applicable to this performance deficiency because this finding was not indicative of current licensee performance.

Enforcement:

Surry Unit 1 Operating License DPR-32, and Surry Unit 2 Operating License DPR-37 Condition 3.I, specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the UFSAR and as approved in the SER dated September 19, 1979, and subsequent supplements.

The licensees UFSAR commits to the Fire Protection Program document and the associated administrative procedures. The Fire Protection Program procedure CM-AA-FPA-100, Fire Protection/Appendix R Program, Rev. 10, stated that all aspects of the fire protection program shall be implemented in accordance Topical Report DOM-QA-1, Dominion Nuclear Facility Quality Assurance Program

Description.

Topical Report DOM-QA-1, Section 3.2, Design Control Program, states, in part, that the design control program ensures design inputs are correctly translated into specifications, drawings, procedures, and instructions in sufficient detail to permit verification. The design process controls the selection and independent verification of items and activities consistent with their importance to safety, to ensure that they are suitable for their intended application. The design process includes provisions for performing appropriate reviews by nuclear management, operating and corporate safety review committees, and for required regulatory evaluations. Errors and deficiencies in design, including the design process, which could adversely affect quality structures, systems, and components, are documented and corrective action is taken.

Contrary to the above, since 1999, the licensee failed to ensure that design inputs were correctly translated into specifications, drawings, procedures, and instructions in sufficient detail to permit verification. Specifically, multiple examples of design deficiencies were identified in the fire protection program. Because the finding is of very low safety significance (Green) and it was entered into the licensees CAP as CR 581390, this violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000280, 281/2015008-04, Multiple Design Deficiencies in the Fire Protection Program.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The inspectors conducted tours of numerous plant areas that were important to reactor safety to verify the licensees implementation of fire protection requirements as described in procedures CM-AA-FPA-100, Fire Protection/Appendix R (Fire Safe Shutdown) Program, and CM-AA-FPA-101, Control of Combustible and Flammable Materials. The inspectors verified that the licensee had properly evaluated in-situ combustible fire loads, limited transient fire hazards, controlled hot-work activities, and maintained general housekeeping consistent with administrative control procedures and the FHA. For the selected FAs, the inspectors evaluated generic fire protection training; fire event history; the potential for fires or explosions; the combustible fire load characteristics; and the potential exposure fire severity to determine if adequate controls were in place to maintain general housekeeping consistent with the UFSAR, administrative procedures, and other FPP procedures. There were no hot work activities ongoing within the selected FAs during the inspection, therefore no observations were performed.

b. Findings

No findings were identified

.13 B.5.b Inspection Activities

a. Inspection Scope

The inspectors reviewed the licensees mitigation strategy related to the refueling water storage tank make up during large fires and explosions to verify that the measure was feasible, personnel were trained to implement the strategy, and equipment was properly staged and maintained. The inspectors requested and reviewed inventory and maintenance records of required equipment. Through discussions with plant staff, review of documentation, and plant walk-downs, the inspectors verified the engineering basis to establish reasonable assurance that the makeup capacity could be provided using the specified equipment and water sources. The inspectors reviewed the licensees capability to provide a reliable and available water source and the ability to provide the minimum fuel supply to the portable pumping equipment. The inspectors performed a walk-down of the storage and staging areas for the B.5.b equipment to verify that equipment identified for use in the current procedures were available, calibrated and maintained. In the presence of licensee staff, the inspectors conducted an independent audit and inventory of required equipment and a visual inspection of the dedicated credited power and water sources. The inspectors verified, by review of records and physical inspection, that B.5.b equipment was currently being properly stored, maintained, and tested in accordance with the licensees B.5.b program procedures.

b. Findings

No findings were identified.

02.04 Identification and Resolution of Problems

a. Inspection Scope

The inspectors verified that the licensee identified fire protection and post-fire SSD issues at an appropriate threshold and entered them into the corrective action program.

The inspectors reviewed a sample of selected issues to verify that the licensee had taken or planned appropriate corrective actions. The CRs were reviewed with regard to the attributes of timeliness and apparent cause determination to ensure that proposed corrective actions addressed the apparent cause, reportability and operability determination.

The inspectors also reviewed a sample of licensee independent audits, self-assessments, and system/program health report for thoroughness, completeness and conformance to FPP requirements. Specifically, fire protection system health reports and Dominion Nuclear Oversight Fire Protection Quality Assurance Program audit reports for 2012 through 2014 were reviewed.

b. Findings

No findings were identified.

Other Activities

4OA6 Meetings, Including Exit

On May 22, 2015, the lead inspector presented the inspection results to Mr. L. Lane, SPS Site Vice President and other members of the licensees staff. A preliminary exit was conducted on March 26, 2015 and additional inspection was performed in the RII office until May, 15, 2015. The lead inspector informed the licensee that proprietary information would not be included in this IR.

ATTACHMENT: SUPPPLEMENTARY INFORMATION

SUPPLEMENTARY INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Dillard, Appendix R Coordinator

B. Garber, Supervisor, Station Licensing

H. Martin, Supervisor/Project Manager Engineering Programs

J. Pollard, Licensing Engineer

J. Martin, Dominion - Fleet Appendix R Lead

NRC Personnel

C. Jones, Resident Inspector, Surry Power Station Units 1 & 2

P. McKenna, Senior Resident Inspector, Surry Power Station Units 1 & 2

M. Miller, Deputy Division Director, Division of Reactor Safety, Region II, NRC

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

05000280 & 281/2015008-01 NCV Failure to Ensure a Functional Alternate Shutdown System Alignment during Appendix R Fire Events Events (1R05.05.01)

05000280 & 281/2015008-02 NCV Failure to Implement In-service Testing and In-

service Inspections for Charging Cross-tie Components. (1R05.05.02)

05000280 & 281/2015008-03 NCV Failure to Perform Required 50.59 Evaluations and Failure to Update the UFSAR for Plant Changes Associated with RCP Seal Cooling During Fire Events (1R05.11.01)

05000280 & 281/2015008-04 NCV Multiple Design Deficiencies in the Fire Protection Program (1R05.11.02)

Discussed

None

LIST OF COMPONENTS REVIEWED Fire Barriers Masonry Block Wall - Unit 2 ESGR to Unit 1 ESGR Room Fire Damper Identification 2-VS-FDMP-3 - Battery Room 2A to Unit 2 ESGR 2-VS-FDMP-7 - Battery Room 2A to Unit 2 ESGR 2-VS-FDMP-15 - Unit 2 ESGR to Main Control Room 2-VS-FDMP-15A - Unit 2 ESGR to Main Control Room 2-VS-FDMP-121 - Unit 2 ESGR to MER # 3 Fire Door Identification Door 2-BS-DR-27 - Unit 2 ESGR to Cable Vault and Tunnel Door 2-BS-DR-20 - Unit 2 ESGR to Stairway Door 1-BS-DR-13 - Main Control Room to Unit 1 Turbine Building Door 2-BS-DR-19 - Unit 2 ESGR to MER # 3 Fire Barrier Penetration Seal Identification FP-PRN-1470 - Unit 2 ESGR to Unit 1 ESGR FP-PRN-1449 - Unit 2 ESGR to Unit 1 ESGR FP-PRN-1419 - Unit 2 ESGR to Unit 1 ESGR FP-PRN-1717 - Unit 2 ESGR to Unit 1 ESGR FP-PRN-1584 - Unit 2 ESGR to MER # 3 FP-PRN-1588 - Unit 2 ESGR to MER # 3 Cable Tray Fire Stops Identification Fire Stop Area 2C - Unit 2 ESGR 2J to Unit 2 Relay Room Fire Stop Area 2D - Unit 2 ESGR 2J to Unit 2 ESGR Room 2H Valves 2-CH-HCV-2137, Excess Letdown Flow Valve 2-CH-LCV-2460A, Letdown Isolation Valve 2-CH-MOV-2286C, C Charging Pump Discharge 2-CH-MOV-2287C, C Charging Pump Discharge 2-PCV-2455C, Pressure Relief Valve 2-PCV-2456, Pressure Relief Valve 2-LCV-2460A, High Pressure Letdown Stop Valve 2-RC-SOV-RC201A, Reactor Vent Valve Solenoid 2-RC-SOV-RC201B, Reactor Vent Valve Solenoid 2-RC-PVC-2456, Pressure Relief Valve Pump Motors 1-CC-P-1A, Component Cooling Pump 1A 1-CC-P-1B, Component Cooling Pump 1B 1-CC-P-1C, Component Cooling Pump 1C 1-FP-P-1, Motor-Driven Fire Pump 1-FP-P-2, Diesel-Driven Fire Pump 2-CH-P-1A, Charging Pump A 2-CH-P-1B, Charging Pump B

2-CH-P-1C, Charging Pump C 1-FP-P-1, Motor-Driven Fire Pump 1-FP-P-2, Diesel-Driven Fire Pump Process Instruments 2-MS-RV-201A, Power relief Valve A 2-MS-RV-201B, Power relief Valve B 2-MS-RV-201C, Power relief Valve C