IR 05000244/2015008

IR 05000244/2015008; 09/14/2015 - 10/01/2015; R.E. Ginna Nuclear Power Plant; Triennial Fire Protection Inspection

ML15322A180
Person / Time
Site:	Ginna
Issue date:	11/17/2015
From:	Ray Lorson Division of Reactor Safety I
To:	Joseph Pacher Exelon Generation Co, Ginna
References
EA-15-211 IR 2015008
Download: ML15322A180 (29)

Text

ber 17, 2015

SUBJECT:

R.E. GINNA NUCLEAR POWER PLANT - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000244/2015008 AND EXERCISE OF ENFORCEMENT DISCRETION

Dear Mr. Pacher:

On October 1, 2015, the U.S. Nuclear Regulatory Commission (NRC) completed a triennial fire protection inspection at your R.E. Ginna Nuclear Power Plant, LLC (Ginna). The enclosed inspection report documents the inspection results, which were discussed on October 1, 2015, with Mr. Joseph E. Pacher, Site Vice President and other members of your staff. On October 29, 2015, the team conducted a final exit with members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations, and with the conditions of your license. The inspectors reviewed selected procedures and records, observed activities, and interviewed station personnel. The inspectors also reviewed mitigation strategies for addressing large fires and explosions.

One licensee-identified issue of substantial safety significance (Yellow) was determined to be a violation of NRC requirements. The NRC determined this issue warranted enforcement discretion because it satisfied the criteria established in NRC Enforcement Policy Section 9.1,

"Enforcement Discretion for Certain Fire Protection Issues (10 CFR 50.48)," and NRC Inspection Manual Chapter (IMC) 0305, "Operating Reactor Assessment Program,"

Section 11.05(b), "Treatment of Items Associated with Enforcement Discretion." The Regional Administrator, Region I, was consulted regarding enforcement discretion for this issue.

In addition, two NRC-identified issues of very low safety significance (Green) were also determined to be violations of NRC requirements. The NRC determined that these issues also warranted enforcement discretion in accordance with Enforcement Policy Section 9.1 and IMC 0305, Section 11.05(b). If you contest any violation in this report, you should provide a written response within 30 days of the date of this inspection report with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington D.C. 20555-0001; with copies to the Regional Administrator, Region I; the Director, Office of Enforcement; and the NRC Resident Inspectors at Ginna.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390 of the NRC's

"Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records System (PARS) component of the NRC's document system, Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Raymond K. Lorson, Director Division of Reactor Safety Docket No: 050-244 License No: DPR-18

Enclosure:

Inspection Report 05000244/2015008 w/Attachment: Supplemental Information

REGION I==

Docket No: 50-244 License No: DPR-18 Report No: 05000244/2015008 Licensee: Exelon Generation Company, LLC Facility: R.E. Ginna Nuclear Power Plant, LLC Location: Ontario, New York Dates: September 14, 2015, through October 1, 2015 Inspectors: J. Richmond, Senior Reactor Inspector (Team Leader)

W. Cook, Senior Reactor Analyst L. Dumont, Reactor Inspector S. Galbreath, Reactor Inspector Observers: H. Roth, Fire Prevention and Control, Homeland Security and Emergency Services Division, State of New York Approved by: John F. Rogge, Chief Engineering Branch 3 Division of Reactor Safety i Enclosure

SUMMARY OF FINDINGS

IR 05000244/2015008; 09/14/2015 - 10/01/2015; R.E. Ginna Nuclear Power Plant; Triennial

Fire Protection Inspection.

This report covered a 2 week on-site triennial fire protection team inspection by specialist inspectors. The significance of most issues is indicated by their color (Green, White, Yellow,

Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process." The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 5, dated February 201

NRC Identified and Self-Revealing Findings

No Findings were identified for assessment.

Other Findings

A licensee-identified issue of substantial safety significance was reviewed by the inspectors.

Exelon entered this deficiency into its corrective action program and subsequently corrected the condition. The NRC exercised discretion and did not issue a violation for this issue as described in Section 4OA3 of this report.

ii

REPORT DETAILS

Background This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure (IP) 71111.05T, "Fire Protection." The objective of the inspection was to assess whether Exelon Generation Company, LLC (Exelon) had implemented an adequate fire protection program and whether post-fire safe shutdown capabilities had been established and were properly maintained at R.E. Ginna Nuclear Power Plant, LLC (Ginna).

The following fire areas (FAs) and/or fire zones (FZs) were selected for detailed review based on prior inspection results and risk insights from the Ginna Individual Plant Examination of External Events (IPEEE):

Fire Areas and Fire Zones

• Fire Zone IBN-1, Intermediate Building North, Elevation (Elev.) 253 foot

• Fire Zone AHR, Control Building Complex - Air Handling Room (AHR) Elev. 253 foot

• Fire Area EDG1B, 1B Emergency Diesel Generator (EDG) Room, including the 1B EDG Cable Vault. Elev. 253 foot Inspection of these FAs/FZs fulfilled the inspection procedure requirement to inspect a minimum of three samples.

The inspection team evaluated Exelon's fire protection program (FPP) against applicable requirements which included Technical Specifications, Operating License Condition 2.C.(3),

NRC Safety Evaluation Reports, Title 10 of Code of Federal Regulations (CFR) 50.48, 10 CFR Part 50 Appendix R, and Branch Technical Position (BTP) Auxiliary and Power Conversion Systems Branch (APCSB) 9.5-1 and Appendix A. The team also reviewed related documents that included the Updated Final Safety Analysis Report (UFSAR), Sections 7.4.4 and 9.5.1, fire protection plan, fire hazards analysis (FHA), and post-fire safe shutdown analyses.

The team evaluated aspects of two mitigating strategies for responding to large fires and explosions, which are required by Operating License Condition 2.C.(8) and 10 CFR 50.54(hh)(2). The team's review included Nuclear Energy Institute (NEI) 06-12, "B.5.b Phases 2 & 3 Submittal Guidance." Inspection of these strategies fulfills the inspection procedure requirement to inspect a minimum of one sample.

Specific documents reviewed by the team are listed in the attachment to this report.

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection (IP 71111.05T)

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the FHA, post-fire safe shutdown analyses, and supporting drawings and documents to verify whether the safe shutdown capabilities were properly protected from fire damage. The team evaluated equipment and cable separation to determine whether the applicable separation requirements of Appendix R,Section III.G and the Ginna design and licensing bases were maintained for the credited safe shutdown equipment and their supporting power, control, and instrumentation cables. The team's review included an assessment of the adequacy of the selected systems for reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and associated support system functions.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected FAs to evaluate whether the material conditions of the FA boundaries were adequate for the fire hazards in the area.

The team compared the FA boundaries, including walls, ceilings, floors, fire doors, fire dampers, penetration seals, electrical raceway and conduit fire barriers, and redundant equipment fire barriers and radiant energy heat barriers to design and licensing basis requirements, industry standards, and the Ginna FPP, as approved by the NRC, to identify any potential degradation or non-conformances.

The team reviewed selected engineering evaluations and qualification records for a sample of penetration seals to determine whether the fill material was properly installed and whether the as-left configuration satisfied design requirements for the intended fire rating. The team also reviewed similar records for selected fire protection wraps to verify whether the material and configuration was appropriate for the required fire rating and conformed to the engineering design.

The team also reviewed recent inspection and functional test records for fire dampers, and the inspection records for penetration seals and fire barriers, to verify whether the inspection and testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified. In addition, the team reviewed recent results for Halon fire damper functionality tests to verify whether the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team evaluated manual and automatic fire suppression and detection systems in the selected FAs to determine whether they were installed, tested, maintained, and operated in accordance with NRC requirements, National Fire Protection Association (NFPA)codes of record, and the Ginna FPP, as approved by the NRC. The team also assessed whether the capabilities of suppression systems were adequate to control and/or extinguish fires associated with the hazards in the selected areas.

The team reviewed the as-built capability of the fire water supply system to verify whether the design and licensing basis and NFPA code of record requirements were satisfied, and to assess whether those capabilities were adequate for the hazards involved. The team reviewed the fire water system hydraulic analyses to assess the adequacy of a single fire water pump to supply the largest single hydraulic load on the fire water system plus concurrent fire hose usage. The team evaluated the fire pump performance tests to assess the adequacy of the test acceptance criteria for pump minimum discharge pressure at the required flow rate, to verify whether the criteria was adequate to ensure that the design basis and hydraulic analysis requirements were satisfied. The team also evaluated the underground fire loop flow tests to verify whether the tests adequately demonstrated that the flow distribution circuits were able to meet design basis requirements. In addition, the team reviewed recent pump and loop flow test results to verify whether the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

The team reviewed initial discharge testing, design specifications, vendor requirements, modifications and engineering evaluations, and routine functional testing for a sample of Halon suppression systems. The team walked down accessible portions of the Halon system, including storage tanks and supply systems, to independently assess the material condition, operational lineup, and availability of the systems. The team also reviewed and walked down the associated fire fighting strategies and Halon system operating procedures.

The team walked down accessible portions of the detection and water suppression systems in selected areas and major portions of the fire water supply system, including motor and diesel driven fire pumps, interviewed system and program engineers, and reviewed selected condition reports (CRs) to independently assess the material condition of the systems and components. In addition, the team reviewed recent test results for the fire detection and suppression systems for the selected FAs to verify whether the testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed Exelon's fire fighting strategies (i.e., pre-fire plans) and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. The team independently inspected the fire brigade equipment, including personnel protective gear (e.g., turnout gear) and smoke removal equipment, to determine operational readiness for fire fighting.

In addition, the team reviewed Exelon's fire brigade equipment inventory and inspection procedure and recent inspection and inventory results to verify whether adequate equipment was available, and whether any potential material deficiencies were identified.

b. Findings

No findings were identified.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed document reviews and plant walkdowns to determine whether redundant trains of systems required for hot shutdown, located in the same or adjacent FAs, were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team evaluated whether:

• A fire in one of the selected FAs would not release smoke, heat, or hot gases that could cause unintended activation of suppression systems in adjacent FAs which could potentially damage all redundant safe shutdown trains;

• A fire suppression system rupture, inadvertent actuation, or actuation due to a fire, in one of the selected fire areas, could not directly damage all redundant trains (e.g. sprinkler caused flooding of other than the locally affected train); and

• Adequate drainage was provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Post-Fire Safe Shutdown Capability - Normal and Alternative

a. Inspection Scope

The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the UFSAR, and other supporting documents for the selected fire areas to verify whether Exelon had properly identified the systems and components necessary to achieve and maintain post-fire safe shutdown conditions. The team evaluated selected systems and components credited by the safe shutdown analysis for reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support system functions to assess the adequacy of Exelon's alternative shutdown methodology. The team also assessed whether alternative post-fire shutdown could be performed both with and without the availability of off-site power. The team walked down selected plant configurations to verify whether they were consistent with the assumptions and descriptions in the safe shutdown and fire hazards analyses. In addition, the team evaluated whether the systems and components credited for use during post-fire safe shutdown would remain free from fire damage.

The team reviewed the training program for licensed and non-licensed operators to verify whether it included alternative shutdown capability. The team also verified whether personnel required for post-fire safe shutdown, using either the normal or alternative shutdown methods, were trained and available on-site at all times, exclusive of those assigned as fire brigade members.

The team reviewed the adequacy of procedures utilized for post-fire shutdown and performed an independent walk through of procedure steps (i.e., a procedure tabletop)to assess the adequacy of implementation and human factors within the procedures.

The team also evaluated the time required to perform specific actions to verify whether operators could reasonably be expected to perform those actions within sufficient time to maintain plant parameters within specified limits.

Specific procedures reviewed for normal and alternative post-fire shutdown included:

• ER-FIRE.0, Control Room Response to Fire Alarms and Reports;

• ER-FIRE.1, Alternate Shutdown for Control Complex Fire;

• ER-FIRE.6, Response to Fire in EDG "B" Vault;

• FRP-11.0, Fire Response Plan for Intermediate Bldg. Clean Side Basement;

• FRP-16.0, Fire Response Plan for Air Handling Room; and

• FRP-25.0, Fire Response Plan for EDG Room "B" and Vault.

The team reviewed selected operator manual actions to verify whether they had been properly reviewed and approved and whether the actions could be implemented in accordance with plant procedures in the time necessary to support the safe shutdown method for each fire area. The team also reviewed the periodic testing of the alternative shutdown transfer and isolation capability, and instrumentation and control functions, to evaluate whether the tests were adequate to ensure the functionality of the alternative shutdown capability.

1. Alternative Shutdown Procedure Deficiencies for Postulated Spurious Operations

Introduction:

The team identified a violation of very low safety significance (Green) of Ginna Operating License Condition 2.C.(3) for failure to implement and maintain all aspects of the approved FPP. Specifically, Exelon had not implemented an adequate alternative shutdown procedure, as required by Appendix R,Section III.L.3 and the approved FPP. The post-fire operating procedures did not ensure that postulated fire-damage to cables associated with "A" EDG auxiliary equipment would be mitigated prior to an adverse impact to the "A" EDG.

Description:

480VAC Motor Control Center "H" (MCC-H), located in the "A" EDG room, supplied power to essential support equipment for the "A" EDG, such as the "A" fuel oil transfer pump and "A" EDG room cooling. In addition, MCC-H supplied the "B" EDG air start compressor and MOV-4670 (an essential service water motor operated valve (MOV)). Exelon's safe shutdown analysis, DA-EE-2000-066, "Appendix R Conformance Analysis," identified that the cables for the later two circuits (i.e., "B" air start compressor and MOV-4670) were routed from the "A" EDG room through the "B" EDG room.

DA-EE-2000-066 determined that a fire in the "B" EDG room or "B" cable vault could result in de-energizing MCC-H due to a lack of coordination between the MCC-C supply breaker to MCC-H and the associated load breakers on MCC-H. As a result, the analysis postulated that a fire in the "B" EDG room or vault could result in a loss of MCC-H and, without operator action, a subsequent loss of the "A" EDG, due to a loss of fuel oil makeup to the "A" day tank.

Fire response procedure FRP-25.0, "Diesel Generator Room B and Vault,"

1, "Affected Equipment," contained a "comment/operator action" column for affected equipment and provided the following operator guidance:

• Loss of A-EDG and MCC-H due to lack of breaker coordination causing tripping of the MCC-H feeder breaker on MCC-C resolved by "Response Not Obtained" actions included in existing emergency operating procedures.

• It may be necessary to locally re-close the MCC-C feeder breaker to MCC-H.

• Loss of MCC-H affects credited "A" EDG room cooling, "A" fuel oil transfer pump, and "A" day tank level transmitter.

The team determined that the guidance in FRP-25.0 did not constitute step by step operating instructions and was inadequate for the following reasons:

• No operator actions existed in any emergency operating procedure for this issue.

• No other procedure contained any operator guidance for this issue.

• FRP-25.0 did not identify which MCC-H circuits would be faulted by fire damage.

• FRP-25.0 did not provide any guidance to clear the fault on MCC-H before attempting to re-energize it.

• No evaluation of EDG run time existed for a loss of the fuel oil transfer pump, to determine the time available for operators to diagnose and recover from a loss of MCC-H.

In addition, the team noted that FRP-25.0 was a fire response plan intended to be implemented by the five person fire brigade while ER-FIRE.6, "Response to Fire in D/G B Vault," was a continuous use control room operating procedure. However, the team identified that ER-FIRE.6 was narrowly focused on a loss of service water due to a fire in the "B" EDG cable vault and did not address other operator actions that may be needed for a fire in the "B" vault.

In response to this issue, Exelon evaluated the available EDG run time based on the nominal fuel oil volume in a day tank and expected post-fire electrical loads and determined that, without a fuel oil transfer pump, an EDG would have sufficient fuel for approximately 2.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />. In addition, Exelon reviewed alarm response procedures and operator actions for the expected panel trouble alarms associated with a loss of MCC-H.

Exelon concluded that operators would have sufficient time to diagnose and troubleshoot the loss of MCC-H and recover it prior to a loss of the "A" EDG. Exelon also noted that additional technical help would be available to the operators within one hour from the Technical Support Center. Exelon entered this deficiency into its corrective action program (CAP) as CR 02563623.

Analysis:

Failure to provide an adequate post-fire safe shutdown operating procedure to ensure the integrity of alternating current (AC) power availability was a performance deficiency (PD). This PD was more than minor because it was associated with the Protection Against External Factors (e.g., fire) attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability and reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

The team performed a Phase 1 Significance Determination Process (SDP) screening, in accordance with NRC Inspection Manual Chapter (IMC) 0609, Appendix F, "Fire Protection Significance Determination Process." This deficiency affected the post-fire safe shutdown category because Exelon's fire response procedures were degraded.

This issue was screened to very low safety significance (Green) because it was assigned a low degradation rating. The team determined this issue had a low degradation rating because the procedural deficiencies could be compensated by operator experience and system familiarity within sufficient time to maintain functionality of the "A" EDG.

Cross-cutting aspects are not applicable to issues involving enforcement discretion.

Enforcement:

Ginna License Condition 2.C.(3), in part, required Exelon to implement and maintain in effect all fire protection features described in licensee submittals and as approved by the NRC. The Ginna FPP stated that the requirements of Appendix R,Section III.L were applicable for areas where alternative shutdown capability was selected and the "B" EDG Room and Vault was designated as an alternative shutdown area. Appendix R,Section III.L.3 required procedures to be in effect to implement the alternative shutdown capability.

Contrary to the above, from 1983 (original Appendix R analysis) until present, Exelon had not implemented an adequate alternative shutdown procedure. Specifically, FRP-25.0 did not contain adequate instructions to ensure that postulated fire-damage to cables associated with "A" EDG auxiliary equipment, which were routed through the "B" EDG cable vault, would be mitigated prior to an adverse impact to the "A" EDG. As a consequence, an operator would have to recognize, diagnose, and correct a loss of power to MCC-H in sufficient time to prevent a loss of the "A" EDG. Exelon entered this deficiency into its CAP as CR 02563623.

Exelon was in transition to NFPA 805 and, therefore, this NRC-identified issue was evaluated in accordance with the criteria established in NRC Enforcement Policy Section 9.1, "Enforcement Discretion for Certain Fire Protection Issues (10 CFR 50.48),"

and IMC 0305, "Operating Reactor Assessment Program," Section 11.05, "Treatment of Items Associated with Enforcement Discretion." Because all the criteria were satisfied, the NRC exercised enforcement discretion and did not issue a violation for this issue.

2. Spurious Operation of Pressurizer Power Operated Relief Valves not Analyzed

Introduction:

The team identified a violation of very low safety significance (Green) of Ginna Operating License Condition 2.C.(3) for failure to implement and maintain all aspects of the approved FPP. Specifically, Exelon's safe shutdown methodology postulated spurious operation of the pressurizer Power Operated Relief Valves (PORVs), but had not analyzed the effect of the spurious operations. As a result, Exelon had not adequately determined whether pressurizer level would remain within the indicated range during alternative shutdown operations, as required by Appendix R,Section III.L and the approved FPP.

Description:

The team reviewed the safe shutdown methodology for a fire in Area AHR (control complex) to evaluate whether spurious operation of pressurizer PORVs could have an adverse effect on achieving hot shutdown.

In March 2006, DA-ME-2000-075, "Pressurizer, Volume Control Tank, and Refueling Water Storage Tank Evaluations for Appendix R," determined by calculation that, during an alternative shutdown scenario, charging flow must be re-established within 36 minutes to maintain pressurizer level in the indicated range. The calculation assumed a reactor coolant system (RCS) leakage value at the design basis limit established by Technical Specifications and normal reactor coolant pump seal leakage.

The calculation also assumed that the PORVs remained closed.

In October 2006, Memorandum DBCOR 2006-0057, "Appendix R Time Critical Tasks Validation for Extended Power Uprate (EPU)," stated that the time available to restore a charging pump would be reduced from 36 minutes to 23.9 minutes based on a change to pressurizer no load level program. A-601.10, "Time Critical Action Management Program," was also revised to reflect 23.9 minutes as the required completion time to re-establish charging. However, Exelon was not able to provide the inspection team with any explicit evaluation, calculation, or analysis to support the 23.9 minute value. Based on the described change to the pressurizer no load level program, the team concluded that the EPU evaluation also probably assumed that the PORVs remained closed during the evaluated fire scenario.

The team identified that Exelon's safe shutdown analysis for a control complex fire postulated spurious operation of the PORVs. The analysis also stated that the PORVs would fail in their desired safe shutdown position when de-energized by a step in ER-FIRE.1, "Alternate Shutdown for Control Complex Fire." Therefore, the team concluded that Exelon had non-conservatively determined the time available to re-establish charging during an alternative fire scenario because their calculation had incorrectly assumed that the PORVs would remain closed prior to being de-energized.

Although ER-FIRE.1 did contain an early step to de-energize the PORV circuits from outside the control complex following control room abandonment, Exelon's Time Critical Action Management Program (i.e., A-601.10) did not identify, control, or validate that operator action. The team performed a tabletop walk through of ER-FIRE.1 with a senior reactor operator and concluded that the step to de-energize the PORVs could be performed within approximately 5 minutes of abandoning the control room. To evaluate the significance of this issue, the team considered the following items:

• The 5 minute tabletop estimate has never been validated.

• The step would be performed by the Shift Manager, who was not always in the control room. The tabletop estimate did not include any travel time.

• Exelon's time critical action program typically validated the time needed to re-establish charging between 19 to 20 minutes.

The team concluded that if a single PORV spuriously opened for a 5 minute period concurrent with the assumed RCS leakage in DA-ME-2000-075, then the pressurizer level would probably not remain in the indicated range, as required by Exelon's FPP.

In response to this issue, Exelon evaluated the impact of an open PORV for a 5 minute period and determined that operators would have 28 minutes to re-establish charging based on a more restrictive administrative limit of 0.5 gpm for RCS leakage in-place of the design basis Technical Specifications limit of 11 gpm used in DA-ME-2000-075.

Exelon concluded that DA-ME-2000-075 required revision to add an assumption for spurious opening of a PORV and A-601.10 required revision to add a time critical operator action to de-energize the PORVs. Exelon entered this issue into their CAP as CRs 02563631 and 02563632. The team reviewed S-12.4, "RCS Leakage Surveillance Record Instructions," and concluded that application of the more restrictive RCS leakage in determining available time was reasonable.

Analysis:

Failure to analyze the effects of spurious operation of a PORV was a PD.

Specifically, Exelon's safe shutdown methodology postulated spurious operation of the PORVs, but had not analyzed the effect of the spurious operations. Exelon's safe shutdown analysis assumed operators had 23.9 minutes after a fire induced plant trip to re-establish the reactor coolant makeup (i.e., charging), but non-conservatively assumed that the PORVs remained closed. In addition, Exelon relied upon a non-time critical operator manual action to de-energize the PORV circuits from outside the control room after control room abandonment.

This PD was more than minor because it was similar to Example 3.k of IMC 0612, Appendix E, "Examples of Minor Issues," which determined that calculation errors would be more than minor if, as a result of the errors, there was reasonable doubt of the operability of the component. For this issue, the team had a reasonable doubt as to whether operators had sufficient time to re-establish charging to maintain pressurizer level within the indicated range. In addition, this issue was associated with the Protection Against External Factors (e.g., fire) attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability and reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

The team performed an SDP Phase 1 screening, in accordance with IMC 0609, Appendix F. This deficiency affected the post-fire safe shutdown category because Exelon's safe shutdown analysis was incomplete. This issue was screened to very low safety significance (Green) because it was assigned a low degradation rating. The team determined this issue had a low degradation rating because Exelon's subsequent evaluation determined that the performance goals of Appendix R,Section III.L.2 were still satisfied, based on more restrictive administrative limits for RCS leakage than the Technical Specifications limits assumed in the original calculation. In addition, Exelon evaluated this issue with Ginna's fire probabilistic risk assessment (PRA) analysis and determined that the change in core damage frequency (CDF) attributed to this issue was in the low E-7 range. A Region I Senior Reactor Analyst reviewed Exelon's evaluation and concluded that the risk estimate was bounded by conservative assumptions and that this issue was of very low safety significance (Green).

Cross-cutting aspects are not applicable to issues involving enforcement discretion.

Enforcement:

Ginna License Condition 2.C.(3), in part, required Exelon to implement and maintain in effect all fire protection features described in licensee submittals and as approved by the NRC. The Ginna FPP stated that the requirements of Appendix R,Section III.L were applicable for areas where alternative shutdown capability was selected and the control complex was designated as an alternative shutdown area.

Appendix R,Section III.L.2 performance goals stated that pressurizer level shall remain within the indicated range.

Contrary to the above, from March 2006 until present, Exelon had not adequately determined that pressurizer level would remain within the indicated range during alternative shutdown operations. Specifically, DA-EE-2000-066 determined that a fire in the control complex could result in spurious opening of a PORV until completion of an operator action outside of the control complex to de-energize the circuit. However, calculation DA-ME-2000-075 determined the time available for operators to re-establish charging following control room abandonment but assumed that the PORVs remained free of fire damage and did not spuriously open. Exelon entered this deficiency into its CAP as CRs 02563631 and 02563632.

Exelon was in transition to NFPA 805 and, therefore, this NRC-identified issue was evaluated in accordance with the criteria established in NRC Enforcement Policy Section 9.1 and IMC 0305, Section 11.05. Because all the criteria were satisfied, the NRC exercised enforcement discretion and did not issue a violation for this issue.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed Exelon's post-fire safe shutdown analysis for the selected FAs to determine whether the analysis identified both required and associated electrical circuits and cables for the systems and components necessary to achieve and maintain safe shutdown. The team reviewed electrical schematics and cable routing data for power, control, and instrument cables associated with selected components. Specifically, the team evaluated the selected circuits and cables to determine whether they were (a)adequately protected from potential fire damage, or

(b) analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown, or

(c) analyzed to show that potential damage could be mitigated with approved operator manual actions, in order to verify whether fire-induced faults could adversely impact safe shutdown capabilities. The team's evaluations considered credible fire scenarios, cable insulation attributes, cable failure modes, cable routing, and common power supply or electrical bus configurations.

In addition, the team reviewed cable raceway drawings and cable routing databases for a sample of components required for post-fire safe shutdown to determine whether those cables were routed as described in the safe shutdown analysis. The team also reviewed equipment important to safe shutdown, but not part of the success path, to assess whether Exelon's safe shutdown methodologies were appropriate, conformed to design and licensing basis requirements, and appropriately considered the guidance in NRC Regulatory Guide 1.189, "Fire Protection for Nuclear Power Plants," Revision 2.

Cable failure modes were reviewed for the following components:

• Pressurizer Power Operated Relief Valve (PORV, PCV-430)

• Pressurizer PORV Block Valve for PCV-430 (MOV-516)

• "B" Charging Pump (PCH01B)

• Standby Auxiliary Feedwater (SAFW) Pump "D" Suction Valve (MOV-9629B)

• Pressurizer Level (PI-420B)

• "A" Steam Generator Level (LI-460AA)

The team reviewed a sample of circuit breaker and fuse over-current protection coordination studies to determine whether equipment needed for post-fire safe shutdown activities could be adversely affected due to a lack of coordination that could result in a common power supply or common electrical bus concern. The team also evaluated whether coordination studies appropriately considered multiple faults due to fire. In addition, the team reviewed a sample of circuit breaker maintenance records, for components required for safe shutdown, to determine whether the breakers were properly maintained.

The team assessed the transfer of control from the control room to the alternative shutdown locations to determine whether it would be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team reviewed safe shutdown procedures, the safe shutdown analysis, and associated documents to verify whether an adequate method of communications would be available to plant operators following a fire. Specifically, the team evaluated whether plant telephones, page systems, and portable radios would be available for use and were properly maintained. During this review, the team considered the effects of ambient noise levels, clarity of reception, reliability, and coverage patterns. The team inspected selected emergency storage lockers to independently verify whether portable communication equipment was available for the fire brigade and plant operators. In addition, the team evaluated whether radio or phone repeaters, transmitters, and power supplies would be reasonably unaffected by a fire.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team walked down the emergency lights in the selected fire areas to independently evaluate the placement and coverage areas of the lights. The team assessed whether the lights provided adequate illumination on local equipment and instrumentation required for post-fire safe shutdown, to ensure local operations could be reliably performed under expected post-fire conditions. Emergency light placement was also evaluated to determine adequate illumination of local area access and egress pathways.

The team verified whether the emergency light batteries were rated for at least an 8-hour capacity. Preventive maintenance procedures, the vendor manual, completed surveillance tests, and battery replacement practices were also reviewed to evaluate whether the emergency lighting had been maintained in a manner that would ensure reliable operation.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed Exelon's dedicated repair procedures, for components which might be damaged by fire and were required to achieve post-fire cold shutdown. The team evaluated selected cold shutdown repairs to determine whether they could be achieved within the time frames assumed in the design and licensing bases. In addition, the team verified whether the necessary repair equipment, tools, and materials (e.g., pre-cut cables with prepared attachment lugs) were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified whether compensatory measures were in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment, passive fire barriers, pumps, valves, or electrical devices providing safe shutdown functions or capabilities). The team evaluated whether the short term compensatory measures adequately compensated for the degraded function or feature until appropriate corrective action could be taken and whether Exelon was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed recent changes to the approved fire protection program to assess whether those changes had an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed Exelon's procedures and programs for the control of ignition sources and transient combustibles to assess their effectiveness in preventing fires and in controlling combustible loading within limits established in the FHA. A sample of hot work and transient combustible control permits were reviewed to assess the adequacy of Exelon's FPP administrative controls. The team performed plant walkdowns to independently verify whether transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Large Fires and Explosions Mitigation Strategies

a. Inspection Scope

The team conducted a review of selected mitigation strategies intended to maintain or restore core decay heat removal and spent fuel pool cooling capabilities under the circumstances associated with the loss of large areas of the plant due to explosions and/or fires. The team assessed whether Exelon continued to meet the requirements of the Ginna Station Operating License and 10 CFR 50.54(hh)(2). The team reviewed two mitigation strategies:

• Manual operation of the turbine-driven auxiliary feedwater pump; and

• Makeup to the steam generators using the portable (B.5.b) pump.

The team's review included: a detailed assessment of the procedural guidance; a walk down of two mitigation strategies with a trained operator to assess the feasibility of the strategies and operator familiarity; maintenance and surveillance testing of selected strategy equipment; and an inventory check of selected strategy equipment to ensure the appropriateness of equipment storage and availability. The team also evaluated the adequacy of corrective actions associated with issues identified during previous inspections and recent self-assessments in this area. Specific documents reviewed by the team are listed in the attachment to this report.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems (IP 71152)

a. Inspection Scope

The team reviewed a sample of CRs associated with the FPP, post-fire safe shutdown issues, and mitigation strategy issues to determine whether Exelon was appropriately identifying, characterizing, and correcting problems associated with these areas and whether the planned or completed corrective actions were appropriate. The CRs reviewed are listed in the attachment.

b. Findings

No findings were identified.

4OA3 Follow-Up of Events and Notices of Enforcement Discretion (IP 71153 - 1 Sample)

1. (Closed) Licensee Event Report (LER) 05000244/2014-002: Unanalyzed Condition due to postulated hot short fire event involving direct current (DC) control circuits affecting multiple fire areas

Introduction:

Exelon identified a violation of substantial safety significance (Yellow) of Ginna Operating License Condition 2.C.(3) for failure to implement and maintain all aspects of the approved FPP. Specifically, Exelon did not ensure that one train of equipment necessary to achieve and maintain post-fire safe shutdown would remain free of fire damage. This issue was evaluated by the team and determined to warrant enforcement discretion.

Description:

On March 13, 2014, during a review of industry operating experience, Exelon identified that the DC control circuits for the non-safety related circulating water pump discharge MOVs did not have adequate over-current protection. Exelon postulated that fire damage to the unprotected DC circuits could cause secondary fires in other fire areas and, as a consequence, adversely affect safe shutdown equipment.

Exelon determined the cause of the condition was an original design configuration that did not conform to the current fire protection standards. There was no actual safety consequence for this condition. Exelon entered this issue into their CAP as CR-2014-001346, implemented compensatory measures for the affected fire areas, and subsequently corrected this condition by the addition of fuses to the affected DC circuits.

The team reviewed the LER, the associated causal analysis, corrective actions, performed plant walk downs, and interviewed Exelon staff. The inspectors did not identify any new issues during the review of this LER. This LER is closed.

Analysis:

Failure to ensure that one train of equipment necessary to achieve and maintain safe shutdown would remain free of fire damage was a licensee-identified PD.

This PD was more than minor because it was associated with the Protection Against External Factors (e.g., fire) attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective to ensure the availability and reliability of systems that respond to initiating events to prevent undesirable consequences (i.e., core damage).

Exelon evaluated this issue with Ginna's fire PRA analysis and determined that the change in CDF attributed to this issue was estimated to be 4E-5 per reactor year. A review of the dominant scenarios indicated that the risk from a large early release was bounded by the core damage assessment. A Region I Senior Reactor Analyst reviewed Exelon's evaluation and concluded that the risk estimate was bounded by conservative assumptions and that this issue would be of no greater than substantial safety significance (Yellow).

Cross-cutting aspects are not applicable to issues involving enforcement discretion.

Enforcement:

Ginna License Condition 2.C.(3), in part, required Exelon to implement and maintain in effect all fire protection features described in licensee submittals and as approved by the NRC. The Ginna FPP required Exelon to maintain one train of equipment necessary to achieve and maintain safe shutdown free of fire damage.

Contrary to the above, from 1967 (original construction) until April 11, 2014, Exelon postulated that fire damage to unprotected DC circuits could have resulted in secondary fires and, as a consequence, adversely affected equipment necessary to achieve and maintain safe shutdown. Exelon entered this issue into their CAP as CR-2014-001346, and subsequently corrected the condition.

Exelon was in transition to NFPA 805 and, therefore, this licensee-identified issue was evaluated in accordance with the criteria established in NRC Enforcement Policy Section 9.1 and IMC 0305 Section 11.05. Because all the criteria were satisfied, the NRC exercised enforcement discretion and did not issue a violation for this issue.

4OA6 Meetings, including Exit

The team presented the inspection results to Mr. Joseph E. Pacher, Site Vice President, and other members of Exelon's staff on October 1, 2015. On October 29, 2015, the team presented additional inspection results for its review of LER 05000244/2014-002 via teleconference to Mr. Joseph E. Pacher, Site Vice President, and other members of Exelon's staff. The team verified that this report does not contain proprietary information.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Lovgren, Electrical Design Engineer

S. Rafaniello, Electrical System Engineer

F. Peterson, Supervisor Engineering Programs

M. McGraw, Safe Shutdown Engineer

M. Wendler, Fire Marshall

J. Koshak, Senior Reactor Operator

R. Fellows, Senior Reactor Operator

C. Bradshaw, Work Week Manager

C. Siverd, Regulatory Engineer

R. Cavedo, Exelon PRA Engineer

NRC Personnel

C. Cahill, Senior Reactor Analyst

N. Perry, Senior Resident Inspector, Ginna

J. Petch, Resident Inspector, Ginna

H. Barrett, Fire Protection Branch, Risk Assessment Division, Nuclear Reactor Regulation

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Closed

05000244/2014-002 LER Unanalyzed Condition due to Postulated Hot Short Fire Event Involving DC Control Circuits Affecting Multiple Fire Areas (Section 4OA3)