IR 05000454/2004005: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (StriderTol Bot change) |
||
Line 1: | Line 1: | ||
{{IR-Nav| site = 05000454 | year = 2004 | report number = 005 | {{Adams | ||
| number = ML042310332 | |||
| issue date = 08/18/2004 | |||
| title = IR 05000454-04-005(DRS); 05000455-04-005(DRS); 06/21/2004 - 07/09/2004; Byron Station, Units 1 and 2; Fire Protection Triennial Baseline Inspection | |||
| author name = Lara J | |||
| author affiliation = NRC/RGN-III/DRS/EEB | |||
| addressee name = Crane C | |||
| addressee affiliation = Exelon Generation Co, LLC | |||
| docket = 05000454, 05000455 | |||
| license number = NPF-037, NPF-066 | |||
| contact person = | |||
| document report number = IR-04-005 | |||
| document type = Inspection Report, Letter | |||
| page count = 41 | |||
}} | |||
{{IR-Nav| site = 05000454 | year = 2004 | report number = 005 }} | |||
=Text= | |||
{{#Wiki_filter:ust 18, 2004 | |||
==SUBJECT:== | |||
BYRON STATION, UNITS 1 AND 2 NRC INSPECTION REPORT 05000454/2004005(DRS); | |||
05000455/2004005(DRS) | |||
==Dear Mr. Crane:== | |||
On July 9, 2004, the NRC completed an inspection at your Byron Station, Units 1 and 2. The enclosed report documents the inspection findings which were discussed on July 9, 2004, with Mr. S. Kuczynski and other members of your staff. | |||
The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. | |||
The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. Specifically, this triennial inspection focused on the Byron Station fire protection program for selected risk-significant fire areas. | |||
Based on the results of this inspection, three NRC-identified findings of very low safety significance involving violations of NRC requirements were identified. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these three findings as Non-Cited Violations (NCVs) consistent with Section VI.A of the NRC Enforcement Policy. If you contest the subject or severity of any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, NRC - RIII, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the Byron facility. In accordance with 10 CFR Part 2.390 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). | |||
ADAMS is accessible from the NRC Web site at http://www.nrc.gov/NRC/ADAMS/index.html (the Public Electronic Reading Room). | |||
Sincerely, | |||
/RA/ | |||
Julio F. Lara, Chief Electrical Engineering Branch Division of Reactor Safety Docket Nos. 50-454; 50-455 License Nos. NPF-37; NPF-66 Enclosure: Inspection Report 05000454/2004005(DRS); | |||
05000455/2004005(DRS) | |||
cc w/encl: Site Vice President - Byron Station Plant Manager - Byron Station Regulatory Assurance Manager - Byron Station Chief Operating Officer Senior Vice President - Nuclear Services Vice President - Mid-West Operations Support Vice President - Licensing and Regulatory Affairs Director Licensing Manager Licensing - Braidwood and Byron Senior Counsel, Nuclear Document Control Desk - Licensing Assistant Attorney General Illinois Department of Nuclear Safety State Liaison Officer, State of Illinois State Liaison Officer, State of Wisconsin Chairman, Illinois Commerce Commission | |||
=SUMMARY OF FINDINGS= | |||
IR 05000454/2004005(DRS); 05000455/2004005(DRS); 06/21/2004 - 07/09/2004; Byron | |||
Station, Units 1 and 2; Fire Protection Triennial Baseline Inspection. | |||
This report covers an announced triennial fire protection baseline inspection. The inspection was conducted by Region III inspectors. Three Green findings associated with three Non-Cited Violations were identified. The significance of most findings is indicated by their color (Green, | |||
White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000. | |||
A. Inspector-Identified and Self-Revealed Findings | |||
===Cornerstone: Mitigating Systems=== | |||
: '''Green.''' | |||
The inspectors identified the lack of a smoke detector on the ceiling of the Auxiliary Building 426' general area, Fire Zone 11.6-0, in the beam pocket north of beam 7AB253, located outside of the Radwaste Evaporator Rooms. The failure to have adequate detector placement in this area is a Non-Cited Violation of the Byron operating license, which required detectors to be installed in accordance with National Fire Protection Association (NFPA) standard 72-E. The licensee initiated a corrective action to install adequate detection in the area. | |||
The finding was greater than minor because it affected the mitigating systems cornerstone attribute of protection against external factors (fire). As a result of the inadequate detector placement, detection of a fire north of beam 7AB253 could be delayed. The finding was of very low safety significance because of the low fire ignition frequency in this location. (Section 1R05.2) | |||
: '''Green.''' | |||
A finding of very low safety significance was identified by the inspectors for failure to have adequate procedures to achieve cold shutdown conditions within 72 hours following a fire. The inspectors found that the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted pressurizer power operated relief valve (PORV) power source. Once identified, the licensee initiated corrective actions to evaluate and take appropriate corrective actions to restore a faulted pressurizer PORV power source. | |||
This finding was more than minor because a deficiency in the procedures for transition to cold shutdown from outside of the control room could have delayed cold shutdown. | |||
A delay in achieving cold shutdown following a fire that required shutdown from outside of the control room could have an adverse impact on safety. The finding was of very low safety significance because the finding only involved the ability to achieve cold shutdown and did not affect the ability to achieve and maintain hot standby. This issue was a violation of the licensees operating licenses as identified in 10 CFR Part 50, | |||
Appendix R, Section III.L.3, because the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted pressurizer PORV power source. (Section 1R05.8) | |||
: '''Green.''' | |||
The inspectors identified that permanent fire loading added during a modification to install a work station for Radiation Protection personnel at Byron Station Unit 2 Auxiliary Building EL. 401', was not added to the total fire loading for the fire zone. | |||
The design change process considered fire loading less than 1000 BTUs/sq. ft. to be negligible, creating the potential to lose track of the cumulative fire loading for a given fire zone. The failure to revise the fire loading calculation to account for additional permanent fire loading in a fire zone is a Non-Cited Violation of 10 CFR Part 50, | |||
Appendix B, Criterion III, Design Control. The licensee's Quality Assurance Manual states that Quality Assurance design control requirements are applicable to fire protection. The licensee initiated a corrective action to ensure that the design control processes would account for all increases in permanent fire loading. | |||
The finding was greater than minor because if left uncorrected, it would become a more significant safety concern as it could affect the ability of systems designed to cope with a fire in a given fire zone, if the cumulative fire loading exceeded allowable values. The finding was of very low safety significance because the heat load added by this modification did not exceed the allowance for the area. (Section 1R05.10) | |||
===Licensee-Identified Violations=== | |||
None. | |||
=REPORT DETAILS= | |||
===Summary of Plant Status=== | |||
Units 1 and 2 were operated at or near full power throughout the inspection period. | |||
==REACTOR SAFETY== | |||
Cornerstones: Initiating Events and Mitigating Systems {{a|1R05}} | |||
==1R05 Fire Protection== | |||
{{IP sample|IP=IP 71111.05}} | |||
The purpose of this inspection was to review the Byron Stations Fire Protection Program (FPP) for selected risk-significant fire areas. Emphasis was placed on verifying that the post-fire safe shutdown capability and the fire protection features were maintained free of fire damage to ensure that at least one post-fire safe shutdown success path was available. The inspection was performed using a risk-informed approach for selecting the fire areas and attributes to be inspected. The inspectors used the Byron Stations Individual Plant Examination of External Events (IPEEE) to choose several risk-significant areas for detailed inspection and review. The fire areas chosen for review during this inspection were: | |||
Fire Zone Description of Fire Area Reviewed 5.5-1 U-1 Auxiliary Electrical Equipment Room (AEER)11.5-0 Auxiliary Building General Area 401' 11.6-0 Auxiliary Building General Area 426' 11.6C-0 Auxiliary Building 426' For each of these fire areas, the inspectors focused on the fire protection features, the systems and equipment necessary to achieve and maintain safe shutdown conditions, determination of licensee commitments, and changes to the FPP. | |||
===.1 Systems Required to Achieve and Maintain Post-Fire Safe Shutdown=== | |||
The guidelines established by Branch Technical Position (BTP) Chemical Engineering Branch (CMEB) 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1),required the licensee to provide fire protection features that were capable of limiting fire damage to structures, systems, and components (SSCs) important to safe shutdown. | |||
The SSCs that were necessary to achieve and maintain post-fire safe shutdown were required to be protected by fire protection features that were capable of limiting fire damage to the SSCs so that: | |||
* One train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) was free of fire damage; and | |||
* Systems necessary to achieve and maintain cold shutdown from either the control room or emergency control station(s) can be repaired within 72 hours. | |||
====a. Inspection Scope==== | |||
The inspectors reviewed the plant systems required to achieve and maintain post-fire safe shutdown to determine if the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for each fire zone selected for review. Specifically, the review was performed to determine the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and support system functions. This review included the fire protection safe shutdown analysis. | |||
The inspectors reviewed the updated final safety analysis report (UFSAR), fire protection report (FPR), safe shutdown analysis, NRC safety evaluation reports (SER),and NRC supplemental safety evaluation reports (SSER) to determine the licensing basis. | |||
====b. Findings==== | |||
No findings of significance were identified. | |||
===.2 Fire Protection of Safe Shutdown Capability=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraphs (2), required separation of cables and equipment and associated circuits of redundant trains. If the guidelines cannot be met, then alternative or dedicated shutdown capability and its associated circuits, independent of cables, systems or components in the area, room, or zone under consideration should be provided. | |||
====a. Inspection Scope==== | |||
For each of the selected fire areas, the inspectors reviewed the licensees safe shutdown analysis to ensure that at least one post-fire safe shutdown success path was available in the event of a fire. The inspectors also evaluated the adequacy of fire suppression and detection systems, fire area barriers, penetration seals, and fire doors to ensure that at least one train of safe shutdown equipment was free of fire damage. | |||
To do this, the inspectors observed the material condition and configuration of the installed fire detection and suppression systems, and fire barriers. In addition, the inspectors reviewed license documentation, such as deviations, detector placement drawings, fire hose station drawings, smoke removal plans, fire hazard analysis (FHA),safe shutdown analysis, and National Fire Protection Association (NFPA) codes to verify that the fire barrier installations met license commitments. | |||
====b. Findings==== | |||
===.1 Failure to Install a Smoke Detector in Accordance with NFPA 72-E=== | |||
=====Introduction:===== | |||
The inspectors identified a Non-Cited Violation (NCV) of the Byron Station Operating License having very low safety significance (Green) for failing to install a smoke detector in the beam pocket north of Beam 7AB253. This area is located on the 426 level of the auxiliary building in the walkway outside of the Radwaste Evaporator Rooms. | |||
=====Description:===== | |||
The inspectors identified the lack of a smoke detector in the beam pocket north of Beam 7AB253, which is located in the walkway outside of the Radwaste Evaporator Rooms on the 426 level of the auxiliary building. The area lacking smoke/fire detection was an L shaped area approximately 22 feet long by 12 feet wide and 12 feet long by 10 feet wide. This area was partitioned by a beam approximately 2-1/2' deep and the nearest smoke detector was located approximately 13' away from this beam. Within this L shaped beam pocket there were three other beams (approximately 12" to 18 deep) further dividing this area into smaller beam pockets that could cause further delay in detecting a fire in this area. The nearest smoke detector was located approximately 47' from the farthest end of this L shaped area. The lack of a smoke detector in this area would result in delayed detection of a fire affecting one train of safety related and non-safety related cables that are routed through this area. | |||
=====Analysis:===== | |||
The inspectors determined that failing to install a detector in the subject beam pocket was a performance deficiency warranting a significance evaluation. The inspectors concluded that the finding was greater than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on June 20, 2003. The finding involved the attribute of protection against external factors (fire) and could have affected the mitigating systems objective of ensuring the availability of systems that respond to initiating events. Smoke from a fire in that area could accumulate in the ceiling areas and delay detection of the fire. This delay in detection would also delay any subsequent manual fire suppression activities. | |||
The inspectors completed a significance determination of this issue using IMC 0609, Significance Determination Process (SDP), dated April 21, 2003, Appendix F, Fire Protection Significance Determination Process, dated May 28, 2004. The inspectors assigned a degradation rating of moderate because the lack of a smoke detector would impact performance of fire detection in this location. However, the fire protection element impacted by the finding is still expected to provide some substantial defense-in-depth benefit due to fire detectors located in the adjacent areas. Considering the duration factor of greater than 30 days (duration factor=1.0) and generic fire area fire frequencies in PWR auxiliary buildings, the inspectors determined that a Phase 2 evaluation was necessary to determine the significance of this issue. The area lacking a smoke detector contained only Division 21 safety related cables and the redundant cables were at a sufficient distance away. The inspectors reviewed the equipment and manual actions credited for post-fire safe shutdown operations to ensure that in case of a fire in this area, there was redundant equipment available or the manual actions were feasible. The inspectors could not develop fire damage state scenarios because: | |||
: (1) there were no in-situ ignition sources; | |||
: (2) this area was normally a passageway where the licensee does not store transient combustible material; and | |||
: (3) the only in-situ combustible materials were IEEE-383 qualified cables sufficiently high above the floor that a transient combustible fire would not adversely affect the cables. Therefore, this finding was considered to be of very low safety significance (Green). The finding was assigned to the mitigating systems cornerstones for both Units. | |||
=====Enforcement:===== | |||
Byron Station Operating License Section 2.C.6 states, in part, that The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensees Fire Protection Report, and as approved in the SER dated February 1987 through Supplement No. 8. The Byron SER stated that fire detectors are installed in accordance with the provisions of National Fire Protection Association (NFPA) standard 72E. In addition, Byron Safety Evaluation Report Supplement (SSER) 5 stated that the fire detection system will be in conformance with NFPA standard No. 72E, and Section C.6.a.(3) of BTP CMEB 9.5-1. | |||
Section 4-3.7.3.6 of NFPA 72E-1984 stated, If the beams exceed 18 inches in depth and are more than 8 feet on centers each bay shall be treated as a separate area requiring at least one detector. Contrary to the above, this beam pocket was more than 18 inches in depth and more than 8 feet on center from the next beam pocket and there was no detector in the beam pocket north of beam 7AB253. Consequently, detection of a fire in this area would be delayed. On June 24, 2004, the licensee entered the issue into its corrective action program as Issue Report (IR) 231480 and planned to install a detector at the location. Because this violation was of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. | |||
(NCV 05000454/2004005-01; 05000455/2004005-01). | |||
===.3 Post-Fire Safe Shutdown Circuit Analysis=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1), required that SSCs important to safe shutdown be provided with fire protection features capable of limiting fire damage to ensure that one train of systems necessary to achieve and maintain hot shutdown conditions remained free of fire damage. Options for providing this level of fire protection were delineated in BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (2). Where the protection of systems whose function was required for hot shutdown did not satisfy BTP CMEB 9.5-1, Section C.5.b, Paragraph (2), an alternative or dedicated shutdown capability and its associated circuits, were required to be provided that was independent of the cables, systems, and components in the area. For such areas, BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (3),specifically required the alternative or dedicated shutdown capability to be physically and electrically independent of the specific fire areas and capable of accommodating post-fire conditions where offsite power was available and where offsite power was not available for 72 hours. | |||
====a. Inspection Scope==== | |||
On a sample basis, the inspectors investigated the adequacy of separation provided for the power and control cabling of redundant trains of shutdown equipment. This investigation focused on the cabling of selected components in systems important for safe shutdown. The purpose of this review was to determine if a single exposure fire, in one of the fire areas selected for this inspection, could prevent the proper operation of both safe shutdown trains. | |||
The team reviewed the licensees fuse/breaker coordination analysis for the 125 Vdc systems required for post-fire safe shutdown. The purpose of this review was to verify that selective coordination exists between branch circuit protective devices (fuses, breakers, relays, etc.) and the bus feeder breaker/fuse to ensure that in the event of a fire-induced short circuit, the fault is isolated before the feeder device trips. | |||
====b. Findings==== | |||
===.1 Assumption of a Single Spurious Operation in a Fire Area=== | |||
=====Introduction:===== | |||
An unresolved item (URI 05000454/2004005-02; 05000455/2004005-02)was identified regarding the licensees assumption of a single spurious operation in a fire area in performing the safe shutdown analysis. | |||
=====Description:===== | |||
Section 2.4 of the FPR described the licensees method and assumptions for performing the safe shutdown analysis for the plant. The licensees guidelines included the position that it was necessary to consider only a single spurious operation per fire area. The licensee stated that this position was also documented in NRCs SSER 5, which stated that for each fire zone, the applicants analysis assumed all equipment and circuits located in the fire zone were unavailable and one spurious actuation resulted from the fire. | |||
The inspectors reviewed one example of the application of this assumption involving a fire on the 426' level of the auxiliary building. For this fire, Division 11 systems and components were assumed to be unavailable because the cables for that division are located in the fire area. As a result, Division 12 systems and components were credited for safe shutdown. The inspectors identified that all four Division 12 auxiliary feedwater system (AF) isolation valves (AF013E through H) also have control cables in this fire area that are not protected and can be affected by the fire. These valves are normally open motor-operated valves. The licensees analysis determined that one spurious operation causing a single valve to close would not impact safe shutdown because three other AF flowpaths/steam generators would be available. | |||
The inspectors determined that the control cables for these four valves were in close proximity to each other. Three of the four were routed in the same cable tray and the fourth was in an adjacent tray. The inspectors reviewed the conductors within the cables and determined that fire damage could result in the valve failing as is (open) or could result in the valve failing in the closed position due to intra-cable hot shorts. The inspectors were concerned that the fire damage to the control cables could result in all four valves closing which would impact safe shutdown. | |||
The inspectors reviewed Procedure BOP FR-1, Fire Response Guidelines, for a fire in this area. The procedure highlighted to operators that these four AF valves may spuriously close; however no specific actions were directed to prevent or mitigate the valve closures. The procedure instructed operators to locally operate the valve using its handwheel as time and access would permit. However, this operation would require hours to complete. | |||
The inspectors also noted that the application of the assumption of a single spurious operation per fire area was used throughout the safe shutdown analysis, not just in the example reviewed by the inspectors. Therefore, other safe shutdown systems may be susceptible to more than one spurious operation which could also impact safe shutdown. The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1) [10 CFR Part 50, Appendix R, Section III.G.1] | |||
required that fire protection features shall be provided for structures, systems, and components important to safe shutdown. These features should be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage. The inspectors were concerned that the systems necessary to achieve and maintain hot shutdown conditions were not free of fire damage since no fire protection features were provided due to the application of the assumption of a single spurious operation per fire area. This issue will remain unresolved pending further technical review and risk analysis by RIII and NRR regarding the impact of assuming a single spurious actuation per fire area. | |||
===.2 Adequacy of Safe Shutdown Procedures to Address Draining of the RWST=== | |||
=====Introduction:===== | |||
An unresolved item (URI 05000454/2004005-03; 05000455/2004005-03)was identified involving the adequacy of alternate safe shutdown procedures for a fire in the auxiliary electric equipment room or the control room. This item will remain unresolved pending NRC review of associated circuits issues. | |||
=====Description:===== | |||
The SSD analysis for a fire in the Unit 1 AEER (fire zone 5.5-1) stated that both low pressure safety injection (LPSI) containment sump supply isolation valves, 1SI8811A and 1SI8811B had cables in the fire zone. The effect of a spurious opening of one of the valves would drain the refueling water storage tank (RWST) to the containment sump. The licensees analysis assumed that the tank could fully drain to the sump in approximately 49 minutes. For a fire in this area, diagnostic indication including RWST level and containment sump level indication would not be available. | |||
The SSD analysis stated that existing emergency procedures were in place to proceed to cold shutdown if the spurious opening of the valve occurred, using the water in the sump and the emergency core cooling system (ECCS) pumps and flowpaths. | |||
The inspectors reviewed procedures BOP FR-1, Fire Response Guidelines, and 1BEP ES-1.3, Transfer to Cold Leg Recirculation, Unit 1," to determine how SSD would be achieved in the event that the RWST drained to the containment sump, assuming a fire in the AEER. BOP FR-1 attachment 35 addressed operator actions required for a fire in this area. A table listing valves that may spuriously operate was provided in step 13 of the attachment. The instructions were to send an operator to open the breaker for SI8811A/B and verify the valve position locally. The information that the RWST inventory can drain to the sump was provided in the same instruction but no further procedural guidance was provided to use the sump and ECCS pumps to maintain hot standby and proceed to cold shutdown. The licensee stated that the operators will react in accordance with their training on emergency procedures and will use the procedures for cold leg injection using the residual heat removal (RH) and charging (CV) systems. | |||
The inspectors noted that the neither the RH system or the containment sump were listed as systems/components in the SSD analysis as required for achieving and maintaining hot standby. The RH system was credited only for achieving cold shutdown. For the scenario involving the draindown of the RWST to the containment sump, the RH system and the containment sump would be required to maintain hot standby. | |||
The licensee informed the inspectors that in this situation operators would use 1BEP ES-1.3 to maintain SSD. The inspectors found that the procedure relied upon the use of indications and controls in the control room that would not be available assuming a fire in the auxiliary electric equipment room. The procedure was written to operate equipment from the control room. In this fire scenario, most control and indication functions would be lost and equipment would be required to be operated locally and manually. For example, the procedure instructed operators to verify adequate containment sump level using level indicators 1LI-PC006 and 1LI-PC007. These instruments would not be available during this postulated fire. The licensee stated that instead of proceeding to the Response Not Obtained section of the procedure, when the specified level instruments could not be verified, the operators would use alternate information to meet the intent of the step. | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (3) [10 CFR Part 50, Appendix R, Section III.L.3] required that the shutdown capability for specific fire areas may be unique for each such area, or it may be one unique combination of systems for all such areas. In either case, the alternative shutdown capability shall be independent of the specific fire area(s). In addition, procedures shall be in effect to implement the alternative shutdown capability. The inspectors were concerned that for a fire in the AEER or the control room, the systems and equipment relied upon to achieve and maintain post-fire safe shutdown conditions were not analyzed and not independent of the fire areas. In addition, the procedures in effect to implement the alternative shutdown capability may be inadequate because the fire specific procedure did not direct the operator to use cold leg injection and the EOP directed the operators to use equipment which may not be available due to fire damage. This item will remain open pending NRC review of associated circuits issues. | |||
The licensee initiated IR 00234512 which acknowledged that the emergency procedures were written for use in other events than fire and may contain steps or reference equipment that may not be available during a fire. However, the licensee did not consider the procedure guidance to be inadequate and the review of BOP FR-1 and BEP ES-1.3 for improvements was considered to be an enhancement. | |||
===.4 Alternative Shutdown Capability=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1), required the licensee to provide fire protection features that were capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions remained free of fire damage. Specific design features for ensuring this capability were provided in BTP CMEB 9.5-1, Section C.5.b, Paragraph (2). Where compliance with the separation criteria of BTP CMEB 9.5-1, Section C.5.b, Paragraphs | |||
: (1) and | |||
: (2) could not be met, BTP CMEB 9.5-1, Section C.5.b, Paragraph | |||
: (3) and Section C.5.c, required an alternative or dedicated shutdown capability be provided that was independent of the specific fire area under consideration. Additionally, alternative or dedicated shutdown capability must be able to achieve and maintain hot standby conditions and achieve cold shutdown conditions within 72 hours and maintain cold shutdown conditions thereafter. During the post-fire safe shutdown, the reactor coolant process variables must remain within those predicted for a loss of normal AC power, and the fission product boundary integrity must not be affected (i.e., no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary). | |||
====a. Inspection Scope==== | |||
The inspectors reviewed the licensees systems required to achieve alternative safe shutdown to determine if the licencee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions. The inspectors also focused on the adequacy of the systems to perform reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support system functions. | |||
====b. Findings==== | |||
===1. Alternative Shutdown Using the Remote Shutdown Panel=== | |||
=====Introduction:===== | |||
The inspectors identified an unresolved item (URI 05000454/2004005-04; 05000455/2004005-04) concerning the alternative shutdown method using the remote shutdown panel (RSP). Specifically, the inspectors identified that the remote shutdown panel appeared to be credited for safe shutdown in the licensing bases and was not electrically isolated from the control room. Additionally, the inspectors identified the lack of periodic control switch testing on the remote shutdown panels (RSPs). The inspectors were concerned that the lack of periodic control switch testing on the RSPs could adversely affect the ability of the operators to operate safe shutdown equipment in the manner the operator expected during a control room fire and, as a result, impact safe shutdown capability. This issue is an unresolved item pending further licensee and NRC review. | |||
=====Description:===== | |||
During this inspection, the inspectors evaluated whether the licensee conducted periodic operational tests of the alternative shutdown transfer capability and the instrumentation and control functions. In addition, the inspectors were to determine whether these tests were adequate to show that if called upon, the alternative shutdown capability would function appropriately upon transfer. | |||
The inspectors noted that for a fire or any other condition that would require the evacuation of the main control room (MCR), as identified in 0BOA PRI-5, Control Room Inaccessibility Unit 0, the operators would implement 1BOA PRI-5, Control Room Inaccessibility Unit 1, and 2BOA PRI-5, Control Room Inaccessibility Unit 2. These two procedures provided the necessary operator actions to place the plant in a cold shutdown condition from the RSPs and, if the proper response was not obtained at an RSP, by utilizing the Fire Hazards Panel (FHP) instrumentation and performing manual operator actions. | |||
The inspectors observed that the FHPs provided the necessary safe shutdown instrumentation and the Normal/Fire transfer switches which if operated would defeat/isolate the associated MCR indication from the FHPs. The inspectors acknowledged that the FHPs indicators were the credited safe shutdown instrumentation to be used in the event that specific fire scenarios rendered the MCR and the RSP instrumentation unavailable. The inspectors concluded that the FHPs safe shutdown instrumentation was electrically independent from the MCR and the RSP. | |||
The inspectors reviewed the FHPs periodic test procedures 1BOSR XFP-Q1 and 2BOSR XFP-Q1. These two procedures provided a quarterly channel check of the FHPs safe shutdown instrumentation loops without manipulating the FHPs Normal/Fire transfer switches and verified the availability of the FHPs power sources. The inspectors also reviewed the FHPs periodic test procedures 1BOSR XFP-R1 and 2BOSR XFP-R1. These two procedures provided an 18 month channel check and verified that the Normal/Fire transfer switches operated properly. The inspectors concluded that the tests provided adequate periodic testing for the FHPs. | |||
The inspectors observed that both the Unit 1 and Unit 2 RSPs were physically located in the auxiliary building on the 383'-0" elevation. Both RSPs provided instrumentation and control switches for equipment used for safe shutdown. The inspectors also noted in the licensees Fire Protection Report (FPR), Amendment 20, dated December 2002, Section 2.4.2.3, Control Room (Fire Zone 2.1-0), that upon the occurrence of a design basis MCR fire, both units would be shutdown, and the MCR would be evacuated. The inspectors noted that following evacuation of the MCR, the primary control location for both units would become the RSPs. The inspectors also observed that the FPR stated that the use of controls at the Unit 1 and Unit 2 RSPs would be credited. Further discussions with the licensee and the inspectors review of the associated RSPs documentation revealed that most circuits for the RSPs were not electrically independent from the MCR. As a result, the inspectors concluded that the RSPs safe shutdown instrumentation and control switches were not electrically independent from the MCR. | |||
The inspectors reviewed the RSPs periodic test procedure BOSR PL-R1, Remote Shutdown Panel Control Power Check. The procedure verified that the proper transfer of control power occurred when the Local/Remote transfer switches were operated at the RSPs. The procedure did not test any of the other RSP control switches or pushbuttons. The licensee stated that no formal periodic testing of the other RSPs control switches were required since the safe shutdown strategy did not credit control of equipment from the RSP. The license further stated that the safe shutdown strategy relied instead upon local manual operation of equipment. The inspectors concluded that local operation of safe shutdown equipment at the RSPs was performed using procedures 1(2)BOA PRI-5 and other procedures referenced from 1(2)BOA PRI-5. If the RSPs control switches did not function properly, the operators would perform the manual actions listed in the response not obtained (RNO) column of the procedure. The licensee indicated that the use of the directions in the RNO section of the procedure was the credited safe shutdown strategy. | |||
In addition to the current SSD analysis for a fire in the control room which appeared to credit operation of equipment from the RSP for safe shutdown, the inspectors reviewed Byron SSERs 3 and 5 which discussed the alternative shutdown capability. These SSERs provided the following information concerning the remote shutdown panels: | |||
The design of the panels includes the capability to electrically isolate the instrumentation indications and control functions for the shutdown systems from the control room. The auxiliary feedwater system, main steam atmospheric relief valves, and chemical and volume control system (charging pump and letdown line) can be manually controlled from the panels to achieve and maintain hot shutdown independent of the control room. Initiation of the residual heat removal system for achieving cold shutdown is performed at local locations. | |||
Support system functions are initiated either at the remote shutdown panels or at local locations. | |||
Based on the information in the SSERs and the safe shutdown analysis for a control room fire, the inspectors determined that the RSPs were most likely credited for alternative shutdown and were assumed to be electrically isolated from the control room. | |||
In contrast to this, the licensee stated that the panels were not electrically isolated and were not credited for safe shutdown. The inspectors requested that the licensee provide any additional information, including revisions to the safe shutdown analysis, and any adverse to safe shutdown evaluations for the revisions, to determine when the alternative shutdown strategy changed from crediting an electrically isolated RSP to using local manual operator actions. The inspectors planned to review the information provided to determine if the licensee was in compliance with the licensing basis as established in the FPR and SSERs 3 and 5. | |||
The inspectors were concerned that the RSPs control switches may not operate safe shutdown equipment in the manner the operator expected since the RSPs control switches were not periodically tested to verify proper equipment operation. The inspectors did not consider the licensees position that the 1(2)BOA PRI-5 procedures RNO use of operator manual actions provided sufficient justification for not periodically testing the control switches at the RSPs. In response to the inspectors concerns, the licensee initiated Issue Report (IR) Number 00231542, Consider Testing of RSP Switches. This issues involving the RSP, including electrical isolation, crediting of the controls for SSD and periodic testing will be considered an URI pending the licensee completing further reviews of this issue and subsequent NRC evaluation. | |||
===.5 Operational Implementation of Alternate Shutdown Capability=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (2)(d), required that the process monitoring function should be capable of providing direct readings of the process variables necessary to perform and control the functions necessary to achieve reactivity control, reactor coolant makeup, and decay heat removal. | |||
====a. Inspection Scope==== | |||
The inspectors performed a review of the safe shutdown analysis for areas utilizing alternative shutdown. The inspectors reviewed Procedure BOA PRI-5, Control Room Inaccessibility, which was the procedure for performing a plant alternative shutdown from outside the control room. The inspectors verified that operators could reasonably be expected to perform the procedure actions and that equipment labeling was consistent with the procedure. | |||
The inspectors review of the adequacy of communications and emergency lighting associated with these procedures are documented in Sections 1R05.6 and 1R05.7 of this report. | |||
====b. Findings==== | |||
No findings of significance were identified. See Section 1R05.4 for issues related to the alternative shutdown capability. | |||
===.6 Communications=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.g, Lighting and Communication, Paragraph (4), required that a portable communications system be provided for use by the fire brigade and other operations personnel required to achieve safe plant shutdown. This system should not interfere with the communications capabilities of the plant security force. Fixed repeaters installed to permit use of portable radio communication units should be protected from exposure to fire damage. | |||
====a. Inspection Scope==== | |||
The inspectors reviewed the adequacy of the communication system to support plant personnel in the performance of alternative safe shutdown functions and fire brigade duties. | |||
====b. Findings==== | |||
No findings of significance were identified. | |||
===.7 Emergency Lighting=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.g, Lighting and Communication, Paragraph (1), required that fixed self-contained lighting consisting of fluorescent or sealed-beam units with individual eight-hour minimum battery power supplies should be provided in areas that must be manned for safe shutdown and for access and egress routes to and from all fire areas. | |||
====a. Inspection Scope==== | |||
The inspectors performed a walkdown of a sample of the actions defined in plant procedures used to control local equipment operations. As part of the walkdowns, the inspectors verified that sufficient emergency lighting existed for access and egress to areas and for performing necessary equipment operations. | |||
====b. Findings==== | |||
No findings of significance were identified. | |||
===.8 Cold Shutdown Repairs=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (5), required that equipment and systems comprising the means to achieve and maintain cold shutdown conditions should not be damaged by fire; or the fire damage to such equipment and systems should be limited so that the systems can be made operable and cold shutdown achieved within 72 hours. | |||
Materials for such repairs shall be readily available onsite, and procedures shall be in effect to implement such repairs. | |||
====a. Inspection Scope==== | |||
The inspectors reviewed the licensees procedures to determine if any repairs were required to achieve cold shutdown. The inspectors determined that the licensee did require repair of some equipment to reach cold shutdown based on the safe shutdown methods used. | |||
====b. Findings==== | |||
===.1 Faulted Pressurizer PORV Power Source Restoration Directions Inadequate=== | |||
=====Introduction:===== | |||
The inspectors identified a NCV of very low safety significance (Green) for the failure to have adequate procedures to achieve cold shutdown conditions within 72 hours following a fire. The inspectors found that the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted pressurizer power operated relief valve (PORV) power source. Restoration of the pressurizer PORV power source was essential in assuring that pressurizer pressure could be reduced to allow initiation of the residual heat removal system for decay heat removal in sufficient time to ensure that cold shutdown could be achieved within 72 hours of plant shutdown. A delay in achieving cold shutdown following a fire that required shutdown from outside of the control room was considered a credible impact on safety. | |||
=====Description:===== | |||
The inspectors reviewed the Byron/Braidwood calculation BYR98-293/ | |||
BRW98-1287-E, dated October 1, 2001. The purpose of the calculation was to evaluate the 125Vdc and 120Vac circuits that supplied safe shutdown equipment for adequate coordination such that a fire induced fault would not impact the shutdown capability of the plant. The calculations Section 7.2, Conclusion/Recommendation, stated, in part, of the 125Vdc circuits fed by Distribution Panels 1/2DC05EA and 1/2DC06EA, all installed breakers meet both acceptance criteria except the circuits supplying DC Fuse Panels 1/2DC10J and 1/2DC11J. For these circuits, the calculation recommended that the installed THED 70A breaker be replaced by a THED 100A breaker which meets both acceptance criteria. The inspectors observed that DC Fuse Panels 1/2DC10J and 1/2DC11J were the power sources for the solenoid operated valves (SOVs) which operated/controlled pressurizer PORVs 1/2RY455A and 1/2RY456. | |||
The inspectors noted that prior to this inspection this calculation was reviewed by the NRC during the Braidwood Stations Fire Protection Triennial Inspection, as documented in Inspection Report 50-456/03-05(DRS); 50-457/03-05(DRS) dated August 21, 2003. | |||
During that inspection, a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion XVI, was identified concerning this calculation, where the licensee failed to assess and resolve recommendations to correct conditions adverse to quality as noted in the conclusion section of the calculation. The violation had a very low safety significance (Green) and was considered greater than minor because if potential breaker coordination deficiencies were not corrected in a timely manner, the undersized breaker may fail to clear a load fault and may trip the upstream motor control center (MCC) feed breaker resulting in the loss of the entire associated MCC. The calculation stated that in lieu of further extensive and detailed analysis, some circuit breaker changes were recommended for circuits where coordination could not be ensured. The violation was considered NRC-identified because the licensee had failed to implement any corrective measures since the calculation was issued in October 2001. | |||
During this inspection, the inspectors reviewed the calculations minor Revision 0A dated June 18, 2004. The purpose of this revision was to provide a more detailed analysis of the Byron Station circuits identified in the calculations Revision 0, where electrical coordination could not be demonstrated or was indeterminate. The minor Revision 0A was to establish that either coordination existed between upstream and downstream protective devices, or that a loss of power to a device would not preclude operation of a safe shutdown function. In minor Revision 0As, Section 6, Calculations, Items 6.1, 6.3, 6.5, and 6.7, the calculation evaluated the pressurizer PORVs SOV power sources for 1RY455A (DC Fuse Panel 1DC10J), 1RY456 (DC Fuse Panel 1DC11J), 2RY455A (DC Fuse Panel 2DC10J) and 2RY456 (DC Fuse Panel 2DC11J), respectively. The minor Revision 0As analysis for these safe shutdown components was to show that a loss of power to the device would not preclude operation of the safe shutdown function. | |||
The pressurizer PORVs are air operated valves (AOVs), which are normally closed and require air to open. Upon loss of air, the pressurizer PORVs fail closed. The pneumatic control circuit for the pressurizer PORVs consists of instrument air from an accumulator in series with two SOVs. Both SOVs are normally de-energized in the closed position. | |||
The required post-fire safe shutdown position for the pressurizer PORVs to achieve hot shutdown conditions is closed. For cooldown to cold shutdown conditions, one pressurizer PORV (1/2RY455A or 1/2RY456) is required to be periodically opened in order to reduce reactor coolant system pressure. In minor Revision 0A, the analysis stated that for an open (faulted) upstream breaker, that a manual action can be performed to reclose the 70 Amp circuit breaker in the Distribution Panels. This would restore power to the pressurizer PORVs SOVs. | |||
The inspectors noted that for a fire which would require the evacuation of the main control room (MCR), the operators would initiate 1BOA PRI-5, Control Room Inaccessibility Unit 1, and 2BOA PRI-5, Control Room Inaccessibility Unit 2. These two procedures (i.e., 1(2)BOA PRI-5) directed the operator actions necessary to take the station to cold shutdown. The inspectors review of 1(2)BOA PRI-5 found that the procedures did not provide sufficient direction to restore a faulted pressurizer PORV power source. Restoration of the pressurizer PORV power source was essential to assure that pressurizer pressure could be reduced to allow initiation of the residual heat removal system for decay heat removal. The inspectors concluded that the licensees procedures (i.e., 1(2)BOA PRI-5) did not assure that cold shutdown conditions could be achieved within 72 hours for an area required to have alternate or dedicated shutdown capability. | |||
=====Analysis:===== | |||
The inspectors determined that failing to provide adequate procedures to achieve cold shutdown conditions within 72 hours following a fire is a performance deficiency warranting a significance evaluation in accordance with IMC 0612, "Power Reactor Inspection Reports," Appendix B, "Issue Disposition Screening," issued on June 20, 2003. The inspectors determined that the finding was more than minor because if left uncorrected, would become a more significant safety concern. In addition, the finding involved the attribute of protection against external factors (fire) and could have affected the mitigating systems objective of ensuring the availability of systems that respond to initiating events to prevent undesirable consequences. The failure to provide adequate procedures for implementing the alternative shutdown capability could result in delaying or preventing achieving cold shutdown conditions following a fire. | |||
The inspectors completed a significance determination of this issue using IMC 0609, Significance Determination Process (SDP), dated April 21, 2003, Appendix F, Fire Protection Significance Determination Process, dated May 28, 2004. The inspectors assigned a degradation rating of moderate because a delay in restoring the PORV could potentially result in the inability to achieve cold shutdown conditions within 72 hours. | |||
Since the finding only affects the ability to reach and maintain cold shutdown conditions, this finding was considered to be of very low safety significance (Green). The finding was assigned to the mitigating systems cornerstones for both Units. | |||
=====Enforcement:===== | |||
The Byron Station Operating Licenses, NPF-37 and NPF-66, Sections 2.C.(6) and 2E, respectively, required, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensees fire protection report. The fire protection report, which contained Appendix 5.7, Appendix R - Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979, stated, in part, with exceptions not relevant here, that the Byron Station complies with the requirements of 10 CFR Part 50, Appendix R, Section III.L, Alternative and Dedicated Shutdown Capability, Section 3, which requires, in part, that procedures be in effect to implement the capability to achieve cold shutdown conditions within 72 hours for fire areas required to have an alternate or dedicated shutdown capability. | |||
Contrary to the above, on July 9, 2004, the inspectors found that the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted PORV power source to assure that pressurizer pressure could be reduced to allow initiation of the residual heat removal system for decay heat removal. As such, the licensees procedures did not assure that cold shutdown conditions could be achieved within 72 hours for an area required to have alternate or dedicated shutdown capability. | |||
The inspectors considered this a violation of the License Condition [10 CFR Part 50, Appendix R, Section III.L.3]. In response to the inspectors concerns, the licensee initiated corrective actions to evaluate and take appropriate corrective actions to restore a faulted PORV power source. This violation is associated with a finding that is characterized by the SDP as having very low risk significance (Green) and is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy. This violation was entered into the licensees corrective action program as IR00234859, Post-Fire Safe Shutdown Action to Restore 1RY455A. (NCV 05000454/2004005-05; 05000455/2004005-05). | |||
===.9 Fire Barriers and Fire Zone/Room Penetration Seals=== | |||
The guidelines established by BTP CMEB 9.5-1, Section C.5.a, Building Design, Paragraph (3), required that penetration seal designs be qualified by tests that are comparable to tests used to rate fire barriers. | |||
====a. Inspection Scope==== | |||
The inspectors performed a visual inspection of selected barriers to ensure that the barrier installations were adequate to ensure the barrier met the requirements of BTP CMEB 9.5-1. | |||
====b. Findings==== | |||
No findings of significance were identified. | |||
===.10 Fire Protection Systems, Features and Equipment=== | |||
The guidelines established by BTP CMEB 9.5-1 required that fire protection systems, features and equipment, specifically the passive fire protection features and fire detection system, were designed in accordance with Sections C.5.a and C.6.a. | |||
====a. Inspection Scope==== | |||
The inspectors reviewed the material condition, operations lineup, operational effectiveness, and design of fire detection systems, fire suppression systems, manual fire fighting equipment, fire brigade capability, and passive fire protection features. The inspectors reviewed deviations, detector placement drawings, fire hose station drawings, and the FHA to ensure that selected fire detection systems, portable fire extinguishers, and hose stations were installed in accordance with their design, and that their design was adequate given the current equipment layout and plant configuration. | |||
====b. Findings==== | |||
===.1 Design Control of Fire Loading Calculation Changes=== | |||
=====Introduction:===== | |||
The inspectors identified a NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green), for failing to control and track the total fire loading in a fire zone. | |||
=====Description:===== | |||
The inspectors identified that the design change process at Byron, which was governed by a corporate Exelon procedure CC-AA-209, Fire Protection Program Configuration Change Review, Revision 1, considered a change adding fire loading less than 1000 BTUs/sq. ft. to be negligible and did not require an update to the fire loading calculation. This process created the potential to lose track of the cumulative fire loading for a given fire zone. A fire protection report update and the combustible loading calculation were revised only if a design change added combustible loading in any zone greater than 1000 BTUs/sq. ft. In general, any plant modification that added combustible loading less than 1000 BTUs/sq.ft. could be unaccounted for in the total fire loading for the area. A modification performed in 1997 to install a permanent work station for Radiation Protection (RP) Personnel at Byron Station Auxiliary Building, Elevation 401' was an example identified by the inspectors to support this finding. | |||
=====Analysis:===== | |||
The inspectors determined that performing a plant modification without proper engineering design change controls was a performance deficiency warranting a significance evaluation. In accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on June 20, 2003, the inspectors determined that the finding was more than minor because if left uncorrected, it would become a more significant safety concern. The finding involved the attribute of protection against external factors (fire) and could have affected the mitigating systems objective of ensuring the availability of systems that respond to initiating events to prevent undesirable consequences. Since the design change process did not have provisions to account for the addition of permanent fire loading less than 1000 BTUs/ | |||
sq. ft. for an area, multiple additions could eventually exceed the allowance provided for unrecognized or transient combustibles for the area and potentially affect the ability of systems designed to cope with a fire in that area. | |||
The inspectors completed a significance determination of this issue using IMC 0609, SDP, Appendix F, dated May 28, 2004. The finding affected the Fire Prevention and Administrative Controls category and the plant combustible material controls program element. The inspectors assigned a degradation rating of low because the finding did not result in exceeding the fire loading allowance for the area. The fire loading contributed by the fixed combustibles from the RP work station at 401' level of the Auxiliary Building amounted to approximately 16 percent of the allowance. The allowance for this area was the equivalent BTUs from two 55 gallon drums of lube oil. | |||
Therefore, the finding was considered to be of very low safety significance (Green). The finding was assigned to the mitigating systems cornerstones for both units at Byron. | |||
=====Enforcement:===== | |||
The Quality Assurance (QA) Manual for Exelon Generation Company, LLC QA Topical Report (QATR) NO-AA-10, Revision 72, dated March 8, 2004, Chapter 2, Section 2.1 states that, The QAP is based upon 10CFR50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants. QATR NO-AA-10 Appendix G, Section 2.1.2, Fire Protection, states that QATR chapters that are applicable to the Fire Protection area are 1 through 7, 10, 11, and 14 through 18. | |||
QATR NO-AA-10, Chapter 3, Design Control, establishes the requirement and control measure for assuring design bases and regulatory requirements are correctly translated into design documents in accordance with 10 CFR Part 50, Appendix B, Criterion III, Design Control. Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures shall be established for the identification and control of design interfaces and for coordination among participating design organizations. These measures shall include the establishment of procedures among participating design organizations for the review, approval, release, distribution, and revision of documents involving design interfaces. Contrary to the above, the licensee failed to establish adequate procedures for revising design documents. Specifically, the licensee failed to revise the fire loading calculation to include the fire loading added by the RP work station due to the deficiency in the design control procedure. | |||
This violation is associated with an inspection finding that is characterized by the SDP as having very low safety significance (Green) and is being treated as a NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. This violation was entered into the licensees corrective action program as IR 234085. (NCV 05000454/2004005-06; 05000455/2004005-06). | |||
===.11 Compensatory Measures=== | |||
====a. Inspection Scope==== | |||
The inspectors conducted a review to verify that adequate compensatory measures were put in place by the licencee for out-of-service, degraded or inoperable fire protection and post-fire safe shutdown equipment, systems, or features. The inspectors also verified that short term compensatory measures were adequate to compensate for a degraded function or feature until appropriate corrective actions were taken. | |||
====b. Findings==== | |||
No findings of significance were identified. | |||
==OTHER ACTIVITIES (OA)== | |||
{{a|4OA2}} | |||
==4OA2 Identification and Resolution of Problems== | |||
{{IP sample|IP=IP 71152}} | |||
The guidelines established by BTP CMEB 9.5-1, Section C.4, Quality Assurance (QA) | |||
Program, Paragraph H, required that measures should be established to ensure that conditions adverse to fire protection, such as failures, malfunctions, deficiencies, deviations, defective components, uncontrolled combustible material and nonconformance, are promptly identified, reported, and corrected. | |||
====a. Inspection Scope==== | |||
The inspectors reviewed a selected sample of condition reports associated with Byrons Fire Protection Program to verify that the licencee had an appropriate threshold for identifying issues. The inspectors evaluated the effectiveness of corrective actions for the identified issues. | |||
====b. Findings==== | |||
No findings of significance were identified. | |||
{{a|4OA6}} | |||
==4OA6 Meetings== | |||
===.1 Exit Meeting=== | |||
The inspectors presented the inspection results to Mr. S. Kuczynski and other members of licensee management at the conclusion of the inspection on July 9. 2004. The licensee acknowledged the findings presented. No proprietary information was identified. | |||
ATTACHMENT: | |||
=SUPPLEMENTAL INFORMATION= | |||
==KEY POINTS OF CONTACT== | |||
Licensee | |||
: [[contact::B. Adams]], Byron Engineering Manager | |||
: [[contact::K. Ainger]], Exelon Corporate Licensing | |||
: [[contact::F. Beutler]], Byron Engineering | |||
: [[contact::D. Brindle]], Byron Engineering | |||
: [[contact::B. Grundmann]], Byron Regulatory Assurance Manager | |||
: [[contact::S. Kuczynski]], Byron Site Vice President | |||
: [[contact::B. Ledger]], Byron Engineering | |||
: [[contact::V. Naschansky]], Byron Electrical Engineering Supervisor | |||
: [[contact::G. ODonnell]], Braidwood Fire Protection | |||
: [[contact::R. Randels]], Byron Design Engineering Manager | |||
: [[contact::D. Robinson]], Byron Engineering | |||
: [[contact::A. Sereika]], Byron Engineering | |||
: [[contact::S. Stimac]], Byron Operations Manager | |||
: [[contact::P. Thorngren]], Byron Acting Fire Marshall | |||
Nuclear Regulatory Commission | |||
: [[contact::R. Caniano]], Deputy Director, Division of Reactor Safety | |||
: [[contact::J. Lara]], Branch Chief, Electrical Engineering Branch, DRS | |||
: [[contact::R. Skowkowski]], Senior Resident Inspector | |||
: [[contact::P. Snyder]], Resident Inspector | |||
: [[contact::T. Tongue]], Project Engineer, Division of Reactor Projects | |||
A1 Attachment | |||
==LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED== | |||
===Opened and Closed=== | |||
: 05000454/2004005-01 NCV Failure to Install Fire Detector in Accordance With | |||
: 05000455/2004005-01 NFPA 72E (Section 1R05.2) | |||
: 05000454/2004005-05 NCV Faulted Pressurize PORV Power Source Restoration | |||
: 05000455/2004005-05 Directions Inadequate (Section 1R05.8) | |||
: 05000454/2004005-06 NCV Design Control of Fire Loading Calculations | |||
: 05000455/2004005-06 (Section 1R05.10) | |||
===Opened=== | |||
: 05000454/2004005-02 URI Assumption of a Single Spurious Operation in a Fire | |||
: 05000455/2004005-02 Area (Section 1R05.3b.1) | |||
: 05000454/2004005-03 URI Adequacy of Safe Shutdown Procedures to Address | |||
: 05000455/2004005-03 Draining of the RWST (Section 1R05.3b.2) | |||
: 05000454/2004005-04 URI Alternative Shutdown Using the Remote Shutdown | |||
: 05000455/2004005-04 Panel (Section 1R05.4) | |||
===Discussed=== | |||
None. | |||
==LIST OF DOCUMENTS REVIEWED== | |||
}} |
Latest revision as of 18:41, 16 March 2020
ML042310332 | |
Person / Time | |
---|---|
Site: | Byron |
Issue date: | 08/18/2004 |
From: | Julio Lara NRC/RGN-III/DRS/EEB |
To: | Crane C Exelon Generation Co |
References | |
IR-04-005 | |
Download: ML042310332 (41) | |
Text
ust 18, 2004
SUBJECT:
BYRON STATION, UNITS 1 AND 2 NRC INSPECTION REPORT 05000454/2004005(DRS);
Dear Mr. Crane:
On July 9, 2004, the NRC completed an inspection at your Byron Station, Units 1 and 2. The enclosed report documents the inspection findings which were discussed on July 9, 2004, with Mr. S. Kuczynski and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. Specifically, this triennial inspection focused on the Byron Station fire protection program for selected risk-significant fire areas.
Based on the results of this inspection, three NRC-identified findings of very low safety significance involving violations of NRC requirements were identified. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these three findings as Non-Cited Violations (NCVs) consistent with Section VI.A of the NRC Enforcement Policy. If you contest the subject or severity of any NCV in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, NRC - RIII, 2443 Warrenville Road, Suite 210, Lisle, IL 60532-4352; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the Byron facility. In accordance with 10 CFR Part 2.390 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS).
ADAMS is accessible from the NRC Web site at http://www.nrc.gov/NRC/ADAMS/index.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Julio F. Lara, Chief Electrical Engineering Branch Division of Reactor Safety Docket Nos. 50-454; 50-455 License Nos. NPF-37; NPF-66 Enclosure: Inspection Report 05000454/2004005(DRS);
cc w/encl: Site Vice President - Byron Station Plant Manager - Byron Station Regulatory Assurance Manager - Byron Station Chief Operating Officer Senior Vice President - Nuclear Services Vice President - Mid-West Operations Support Vice President - Licensing and Regulatory Affairs Director Licensing Manager Licensing - Braidwood and Byron Senior Counsel, Nuclear Document Control Desk - Licensing Assistant Attorney General Illinois Department of Nuclear Safety State Liaison Officer, State of Illinois State Liaison Officer, State of Wisconsin Chairman, Illinois Commerce Commission
SUMMARY OF FINDINGS
IR 05000454/2004005(DRS); 05000455/2004005(DRS); 06/21/2004 - 07/09/2004; Byron
Station, Units 1 and 2; Fire Protection Triennial Baseline Inspection.
This report covers an announced triennial fire protection baseline inspection. The inspection was conducted by Region III inspectors. Three Green findings associated with three Non-Cited Violations were identified. The significance of most findings is indicated by their color (Green,
White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.
A. Inspector-Identified and Self-Revealed Findings
Cornerstone: Mitigating Systems
- Green.
The inspectors identified the lack of a smoke detector on the ceiling of the Auxiliary Building 426' general area, Fire Zone 11.6-0, in the beam pocket north of beam 7AB253, located outside of the Radwaste Evaporator Rooms. The failure to have adequate detector placement in this area is a Non-Cited Violation of the Byron operating license, which required detectors to be installed in accordance with National Fire Protection Association (NFPA) standard 72-E. The licensee initiated a corrective action to install adequate detection in the area.
The finding was greater than minor because it affected the mitigating systems cornerstone attribute of protection against external factors (fire). As a result of the inadequate detector placement, detection of a fire north of beam 7AB253 could be delayed. The finding was of very low safety significance because of the low fire ignition frequency in this location. (Section 1R05.2)
- Green.
A finding of very low safety significance was identified by the inspectors for failure to have adequate procedures to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a fire. The inspectors found that the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted pressurizer power operated relief valve (PORV) power source. Once identified, the licensee initiated corrective actions to evaluate and take appropriate corrective actions to restore a faulted pressurizer PORV power source.
This finding was more than minor because a deficiency in the procedures for transition to cold shutdown from outside of the control room could have delayed cold shutdown.
A delay in achieving cold shutdown following a fire that required shutdown from outside of the control room could have an adverse impact on safety. The finding was of very low safety significance because the finding only involved the ability to achieve cold shutdown and did not affect the ability to achieve and maintain hot standby. This issue was a violation of the licensees operating licenses as identified in 10 CFR Part 50,
Appendix R,Section III.L.3, because the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted pressurizer PORV power source. (Section 1R05.8)
- Green.
The inspectors identified that permanent fire loading added during a modification to install a work station for Radiation Protection personnel at Byron Station Unit 2 Auxiliary Building EL. 401', was not added to the total fire loading for the fire zone.
The design change process considered fire loading less than 1000 BTUs/sq. ft. to be negligible, creating the potential to lose track of the cumulative fire loading for a given fire zone. The failure to revise the fire loading calculation to account for additional permanent fire loading in a fire zone is a Non-Cited Violation of 10 CFR Part 50,
Appendix B, Criterion III, Design Control. The licensee's Quality Assurance Manual states that Quality Assurance design control requirements are applicable to fire protection. The licensee initiated a corrective action to ensure that the design control processes would account for all increases in permanent fire loading.
The finding was greater than minor because if left uncorrected, it would become a more significant safety concern as it could affect the ability of systems designed to cope with a fire in a given fire zone, if the cumulative fire loading exceeded allowable values. The finding was of very low safety significance because the heat load added by this modification did not exceed the allowance for the area. (Section 1R05.10)
Licensee-Identified Violations
None.
REPORT DETAILS
Summary of Plant Status
Units 1 and 2 were operated at or near full power throughout the inspection period.
REACTOR SAFETY
Cornerstones: Initiating Events and Mitigating Systems
1R05 Fire Protection
The purpose of this inspection was to review the Byron Stations Fire Protection Program (FPP) for selected risk-significant fire areas. Emphasis was placed on verifying that the post-fire safe shutdown capability and the fire protection features were maintained free of fire damage to ensure that at least one post-fire safe shutdown success path was available. The inspection was performed using a risk-informed approach for selecting the fire areas and attributes to be inspected. The inspectors used the Byron Stations Individual Plant Examination of External Events (IPEEE) to choose several risk-significant areas for detailed inspection and review. The fire areas chosen for review during this inspection were:
Fire Zone Description of Fire Area Reviewed 5.5-1 U-1 Auxiliary Electrical Equipment Room (AEER)11.5-0 Auxiliary Building General Area 401' 11.6-0 Auxiliary Building General Area 426' 11.6C-0 Auxiliary Building 426' For each of these fire areas, the inspectors focused on the fire protection features, the systems and equipment necessary to achieve and maintain safe shutdown conditions, determination of licensee commitments, and changes to the FPP.
.1 Systems Required to Achieve and Maintain Post-Fire Safe Shutdown
The guidelines established by Branch Technical Position (BTP) Chemical Engineering Branch (CMEB) 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1),required the licensee to provide fire protection features that were capable of limiting fire damage to structures, systems, and components (SSCs) important to safe shutdown.
The SSCs that were necessary to achieve and maintain post-fire safe shutdown were required to be protected by fire protection features that were capable of limiting fire damage to the SSCs so that:
- One train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) was free of fire damage; and
- Systems necessary to achieve and maintain cold shutdown from either the control room or emergency control station(s) can be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
a. Inspection Scope
The inspectors reviewed the plant systems required to achieve and maintain post-fire safe shutdown to determine if the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for each fire zone selected for review. Specifically, the review was performed to determine the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and support system functions. This review included the fire protection safe shutdown analysis.
The inspectors reviewed the updated final safety analysis report (UFSAR), fire protection report (FPR), safe shutdown analysis, NRC safety evaluation reports (SER),and NRC supplemental safety evaluation reports (SSER) to determine the licensing basis.
b. Findings
No findings of significance were identified.
.2 Fire Protection of Safe Shutdown Capability
The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraphs (2), required separation of cables and equipment and associated circuits of redundant trains. If the guidelines cannot be met, then alternative or dedicated shutdown capability and its associated circuits, independent of cables, systems or components in the area, room, or zone under consideration should be provided.
a. Inspection Scope
For each of the selected fire areas, the inspectors reviewed the licensees safe shutdown analysis to ensure that at least one post-fire safe shutdown success path was available in the event of a fire. The inspectors also evaluated the adequacy of fire suppression and detection systems, fire area barriers, penetration seals, and fire doors to ensure that at least one train of safe shutdown equipment was free of fire damage.
To do this, the inspectors observed the material condition and configuration of the installed fire detection and suppression systems, and fire barriers. In addition, the inspectors reviewed license documentation, such as deviations, detector placement drawings, fire hose station drawings, smoke removal plans, fire hazard analysis (FHA),safe shutdown analysis, and National Fire Protection Association (NFPA) codes to verify that the fire barrier installations met license commitments.
b. Findings
.1 Failure to Install a Smoke Detector in Accordance with NFPA 72-E
Introduction:
The inspectors identified a Non-Cited Violation (NCV) of the Byron Station Operating License having very low safety significance (Green) for failing to install a smoke detector in the beam pocket north of Beam 7AB253. This area is located on the 426 level of the auxiliary building in the walkway outside of the Radwaste Evaporator Rooms.
Description:
The inspectors identified the lack of a smoke detector in the beam pocket north of Beam 7AB253, which is located in the walkway outside of the Radwaste Evaporator Rooms on the 426 level of the auxiliary building. The area lacking smoke/fire detection was an L shaped area approximately 22 feet long by 12 feet wide and 12 feet long by 10 feet wide. This area was partitioned by a beam approximately 2-1/2' deep and the nearest smoke detector was located approximately 13' away from this beam. Within this L shaped beam pocket there were three other beams (approximately 12" to 18 deep) further dividing this area into smaller beam pockets that could cause further delay in detecting a fire in this area. The nearest smoke detector was located approximately 47' from the farthest end of this L shaped area. The lack of a smoke detector in this area would result in delayed detection of a fire affecting one train of safety related and non-safety related cables that are routed through this area.
Analysis:
The inspectors determined that failing to install a detector in the subject beam pocket was a performance deficiency warranting a significance evaluation. The inspectors concluded that the finding was greater than minor in accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on June 20, 2003. The finding involved the attribute of protection against external factors (fire) and could have affected the mitigating systems objective of ensuring the availability of systems that respond to initiating events. Smoke from a fire in that area could accumulate in the ceiling areas and delay detection of the fire. This delay in detection would also delay any subsequent manual fire suppression activities.
The inspectors completed a significance determination of this issue using IMC 0609, Significance Determination Process (SDP), dated April 21, 2003, Appendix F, Fire Protection Significance Determination Process, dated May 28, 2004. The inspectors assigned a degradation rating of moderate because the lack of a smoke detector would impact performance of fire detection in this location. However, the fire protection element impacted by the finding is still expected to provide some substantial defense-in-depth benefit due to fire detectors located in the adjacent areas. Considering the duration factor of greater than 30 days (duration factor=1.0) and generic fire area fire frequencies in PWR auxiliary buildings, the inspectors determined that a Phase 2 evaluation was necessary to determine the significance of this issue. The area lacking a smoke detector contained only Division 21 safety related cables and the redundant cables were at a sufficient distance away. The inspectors reviewed the equipment and manual actions credited for post-fire safe shutdown operations to ensure that in case of a fire in this area, there was redundant equipment available or the manual actions were feasible. The inspectors could not develop fire damage state scenarios because:
- (1) there were no in-situ ignition sources;
- (2) this area was normally a passageway where the licensee does not store transient combustible material; and
- (3) the only in-situ combustible materials were IEEE-383 qualified cables sufficiently high above the floor that a transient combustible fire would not adversely affect the cables. Therefore, this finding was considered to be of very low safety significance (Green). The finding was assigned to the mitigating systems cornerstones for both Units.
Enforcement:
Byron Station Operating License Section 2.C.6 states, in part, that The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensees Fire Protection Report, and as approved in the SER dated February 1987 through Supplement No. 8. The Byron SER stated that fire detectors are installed in accordance with the provisions of National Fire Protection Association (NFPA) standard 72E. In addition, Byron Safety Evaluation Report Supplement (SSER) 5 stated that the fire detection system will be in conformance with NFPA standard No. 72E, and Section C.6.a.(3) of BTP CMEB 9.5-1.
Section 4-3.7.3.6 of NFPA 72E-1984 stated, If the beams exceed 18 inches in depth and are more than 8 feet on centers each bay shall be treated as a separate area requiring at least one detector. Contrary to the above, this beam pocket was more than 18 inches in depth and more than 8 feet on center from the next beam pocket and there was no detector in the beam pocket north of beam 7AB253. Consequently, detection of a fire in this area would be delayed. On June 24, 2004, the licensee entered the issue into its corrective action program as Issue Report (IR) 231480 and planned to install a detector at the location. Because this violation was of very low safety significance (Green) and was entered into the licensees corrective action program, this violation is being treated as a NCV consistent with Section VI.A.1 of the NRC Enforcement Policy.
(NCV 05000454/2004005-01; 05000455/2004005-01).
.3 Post-Fire Safe Shutdown Circuit Analysis
The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1), required that SSCs important to safe shutdown be provided with fire protection features capable of limiting fire damage to ensure that one train of systems necessary to achieve and maintain hot shutdown conditions remained free of fire damage. Options for providing this level of fire protection were delineated in BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (2). Where the protection of systems whose function was required for hot shutdown did not satisfy BTP CMEB 9.5-1, Section C.5.b, Paragraph (2), an alternative or dedicated shutdown capability and its associated circuits, were required to be provided that was independent of the cables, systems, and components in the area. For such areas, BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (3),specifically required the alternative or dedicated shutdown capability to be physically and electrically independent of the specific fire areas and capable of accommodating post-fire conditions where offsite power was available and where offsite power was not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
a. Inspection Scope
On a sample basis, the inspectors investigated the adequacy of separation provided for the power and control cabling of redundant trains of shutdown equipment. This investigation focused on the cabling of selected components in systems important for safe shutdown. The purpose of this review was to determine if a single exposure fire, in one of the fire areas selected for this inspection, could prevent the proper operation of both safe shutdown trains.
The team reviewed the licensees fuse/breaker coordination analysis for the 125 Vdc systems required for post-fire safe shutdown. The purpose of this review was to verify that selective coordination exists between branch circuit protective devices (fuses, breakers, relays, etc.) and the bus feeder breaker/fuse to ensure that in the event of a fire-induced short circuit, the fault is isolated before the feeder device trips.
b. Findings
.1 Assumption of a Single Spurious Operation in a Fire Area
Introduction:
An unresolved item (URI 05000454/2004005-02; 05000455/2004005-02)was identified regarding the licensees assumption of a single spurious operation in a fire area in performing the safe shutdown analysis.
Description:
Section 2.4 of the FPR described the licensees method and assumptions for performing the safe shutdown analysis for the plant. The licensees guidelines included the position that it was necessary to consider only a single spurious operation per fire area. The licensee stated that this position was also documented in NRCs SSER 5, which stated that for each fire zone, the applicants analysis assumed all equipment and circuits located in the fire zone were unavailable and one spurious actuation resulted from the fire.
The inspectors reviewed one example of the application of this assumption involving a fire on the 426' level of the auxiliary building. For this fire, Division 11 systems and components were assumed to be unavailable because the cables for that division are located in the fire area. As a result, Division 12 systems and components were credited for safe shutdown. The inspectors identified that all four Division 12 auxiliary feedwater system (AF) isolation valves (AF013E through H) also have control cables in this fire area that are not protected and can be affected by the fire. These valves are normally open motor-operated valves. The licensees analysis determined that one spurious operation causing a single valve to close would not impact safe shutdown because three other AF flowpaths/steam generators would be available.
The inspectors determined that the control cables for these four valves were in close proximity to each other. Three of the four were routed in the same cable tray and the fourth was in an adjacent tray. The inspectors reviewed the conductors within the cables and determined that fire damage could result in the valve failing as is (open) or could result in the valve failing in the closed position due to intra-cable hot shorts. The inspectors were concerned that the fire damage to the control cables could result in all four valves closing which would impact safe shutdown.
The inspectors reviewed Procedure BOP FR-1, Fire Response Guidelines, for a fire in this area. The procedure highlighted to operators that these four AF valves may spuriously close; however no specific actions were directed to prevent or mitigate the valve closures. The procedure instructed operators to locally operate the valve using its handwheel as time and access would permit. However, this operation would require hours to complete.
The inspectors also noted that the application of the assumption of a single spurious operation per fire area was used throughout the safe shutdown analysis, not just in the example reviewed by the inspectors. Therefore, other safe shutdown systems may be susceptible to more than one spurious operation which could also impact safe shutdown. The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1) [10 CFR Part 50, Appendix R,Section III.G.1]
required that fire protection features shall be provided for structures, systems, and components important to safe shutdown. These features should be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage. The inspectors were concerned that the systems necessary to achieve and maintain hot shutdown conditions were not free of fire damage since no fire protection features were provided due to the application of the assumption of a single spurious operation per fire area. This issue will remain unresolved pending further technical review and risk analysis by RIII and NRR regarding the impact of assuming a single spurious actuation per fire area.
.2 Adequacy of Safe Shutdown Procedures to Address Draining of the RWST
Introduction:
An unresolved item (URI 05000454/2004005-03; 05000455/2004005-03)was identified involving the adequacy of alternate safe shutdown procedures for a fire in the auxiliary electric equipment room or the control room. This item will remain unresolved pending NRC review of associated circuits issues.
Description:
The SSD analysis for a fire in the Unit 1 AEER (fire zone 5.5-1) stated that both low pressure safety injection (LPSI) containment sump supply isolation valves, 1SI8811A and 1SI8811B had cables in the fire zone. The effect of a spurious opening of one of the valves would drain the refueling water storage tank (RWST) to the containment sump. The licensees analysis assumed that the tank could fully drain to the sump in approximately 49 minutes. For a fire in this area, diagnostic indication including RWST level and containment sump level indication would not be available.
The SSD analysis stated that existing emergency procedures were in place to proceed to cold shutdown if the spurious opening of the valve occurred, using the water in the sump and the emergency core cooling system (ECCS) pumps and flowpaths.
The inspectors reviewed procedures BOP FR-1, Fire Response Guidelines, and 1BEP ES-1.3, Transfer to Cold Leg Recirculation, Unit 1," to determine how SSD would be achieved in the event that the RWST drained to the containment sump, assuming a fire in the AEER. BOP FR-1 attachment 35 addressed operator actions required for a fire in this area. A table listing valves that may spuriously operate was provided in step 13 of the attachment. The instructions were to send an operator to open the breaker for SI8811A/B and verify the valve position locally. The information that the RWST inventory can drain to the sump was provided in the same instruction but no further procedural guidance was provided to use the sump and ECCS pumps to maintain hot standby and proceed to cold shutdown. The licensee stated that the operators will react in accordance with their training on emergency procedures and will use the procedures for cold leg injection using the residual heat removal (RH) and charging (CV) systems.
The inspectors noted that the neither the RH system or the containment sump were listed as systems/components in the SSD analysis as required for achieving and maintaining hot standby. The RH system was credited only for achieving cold shutdown. For the scenario involving the draindown of the RWST to the containment sump, the RH system and the containment sump would be required to maintain hot standby.
The licensee informed the inspectors that in this situation operators would use 1BEP ES-1.3 to maintain SSD. The inspectors found that the procedure relied upon the use of indications and controls in the control room that would not be available assuming a fire in the auxiliary electric equipment room. The procedure was written to operate equipment from the control room. In this fire scenario, most control and indication functions would be lost and equipment would be required to be operated locally and manually. For example, the procedure instructed operators to verify adequate containment sump level using level indicators 1LI-PC006 and 1LI-PC007. These instruments would not be available during this postulated fire. The licensee stated that instead of proceeding to the Response Not Obtained section of the procedure, when the specified level instruments could not be verified, the operators would use alternate information to meet the intent of the step.
The guidelines established by BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (3) [10 CFR Part 50, Appendix R,Section III.L.3] required that the shutdown capability for specific fire areas may be unique for each such area, or it may be one unique combination of systems for all such areas. In either case, the alternative shutdown capability shall be independent of the specific fire area(s). In addition, procedures shall be in effect to implement the alternative shutdown capability. The inspectors were concerned that for a fire in the AEER or the control room, the systems and equipment relied upon to achieve and maintain post-fire safe shutdown conditions were not analyzed and not independent of the fire areas. In addition, the procedures in effect to implement the alternative shutdown capability may be inadequate because the fire specific procedure did not direct the operator to use cold leg injection and the EOP directed the operators to use equipment which may not be available due to fire damage. This item will remain open pending NRC review of associated circuits issues.
The licensee initiated IR 00234512 which acknowledged that the emergency procedures were written for use in other events than fire and may contain steps or reference equipment that may not be available during a fire. However, the licensee did not consider the procedure guidance to be inadequate and the review of BOP FR-1 and BEP ES-1.3 for improvements was considered to be an enhancement.
.4 Alternative Shutdown Capability
The guidelines established by BTP CMEB 9.5-1, Section C.5.b, Safe Shutdown Capability, Paragraph (1), required the licensee to provide fire protection features that were capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions remained free of fire damage. Specific design features for ensuring this capability were provided in BTP CMEB 9.5-1, Section C.5.b, Paragraph (2). Where compliance with the separation criteria of BTP CMEB 9.5-1, Section C.5.b, Paragraphs
- (1) and
- (2) could not be met, BTP CMEB 9.5-1, Section C.5.b, Paragraph
- (3) and Section C.5.c, required an alternative or dedicated shutdown capability be provided that was independent of the specific fire area under consideration. Additionally, alternative or dedicated shutdown capability must be able to achieve and maintain hot standby conditions and achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and maintain cold shutdown conditions thereafter. During the post-fire safe shutdown, the reactor coolant process variables must remain within those predicted for a loss of normal AC power, and the fission product boundary integrity must not be affected (i.e., no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary).
a. Inspection Scope
The inspectors reviewed the licensees systems required to achieve alternative safe shutdown to determine if the licencee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions. The inspectors also focused on the adequacy of the systems to perform reactor pressure control, reactivity control, reactor coolant makeup, decay heat removal, process monitoring, and support system functions.
b. Findings
1. Alternative Shutdown Using the Remote Shutdown Panel
Introduction:
The inspectors identified an unresolved item (URI 05000454/2004005-04; 05000455/2004005-04) concerning the alternative shutdown method using the remote shutdown panel (RSP). Specifically, the inspectors identified that the remote shutdown panel appeared to be credited for safe shutdown in the licensing bases and was not electrically isolated from the control room. Additionally, the inspectors identified the lack of periodic control switch testing on the remote shutdown panels (RSPs). The inspectors were concerned that the lack of periodic control switch testing on the RSPs could adversely affect the ability of the operators to operate safe shutdown equipment in the manner the operator expected during a control room fire and, as a result, impact safe shutdown capability. This issue is an unresolved item pending further licensee and NRC review.
Description:
During this inspection, the inspectors evaluated whether the licensee conducted periodic operational tests of the alternative shutdown transfer capability and the instrumentation and control functions. In addition, the inspectors were to determine whether these tests were adequate to show that if called upon, the alternative shutdown capability would function appropriately upon transfer.
The inspectors noted that for a fire or any other condition that would require the evacuation of the main control room (MCR), as identified in 0BOA PRI-5, Control Room Inaccessibility Unit 0, the operators would implement 1BOA PRI-5, Control Room Inaccessibility Unit 1, and 2BOA PRI-5, Control Room Inaccessibility Unit 2. These two procedures provided the necessary operator actions to place the plant in a cold shutdown condition from the RSPs and, if the proper response was not obtained at an RSP, by utilizing the Fire Hazards Panel (FHP) instrumentation and performing manual operator actions.
The inspectors observed that the FHPs provided the necessary safe shutdown instrumentation and the Normal/Fire transfer switches which if operated would defeat/isolate the associated MCR indication from the FHPs. The inspectors acknowledged that the FHPs indicators were the credited safe shutdown instrumentation to be used in the event that specific fire scenarios rendered the MCR and the RSP instrumentation unavailable. The inspectors concluded that the FHPs safe shutdown instrumentation was electrically independent from the MCR and the RSP.
The inspectors reviewed the FHPs periodic test procedures 1BOSR XFP-Q1 and 2BOSR XFP-Q1. These two procedures provided a quarterly channel check of the FHPs safe shutdown instrumentation loops without manipulating the FHPs Normal/Fire transfer switches and verified the availability of the FHPs power sources. The inspectors also reviewed the FHPs periodic test procedures 1BOSR XFP-R1 and 2BOSR XFP-R1. These two procedures provided an 18 month channel check and verified that the Normal/Fire transfer switches operated properly. The inspectors concluded that the tests provided adequate periodic testing for the FHPs.
The inspectors observed that both the Unit 1 and Unit 2 RSPs were physically located in the auxiliary building on the 383'-0" elevation. Both RSPs provided instrumentation and control switches for equipment used for safe shutdown. The inspectors also noted in the licensees Fire Protection Report (FPR), Amendment 20, dated December 2002, Section 2.4.2.3, Control Room (Fire Zone 2.1-0), that upon the occurrence of a design basis MCR fire, both units would be shutdown, and the MCR would be evacuated. The inspectors noted that following evacuation of the MCR, the primary control location for both units would become the RSPs. The inspectors also observed that the FPR stated that the use of controls at the Unit 1 and Unit 2 RSPs would be credited. Further discussions with the licensee and the inspectors review of the associated RSPs documentation revealed that most circuits for the RSPs were not electrically independent from the MCR. As a result, the inspectors concluded that the RSPs safe shutdown instrumentation and control switches were not electrically independent from the MCR.
The inspectors reviewed the RSPs periodic test procedure BOSR PL-R1, Remote Shutdown Panel Control Power Check. The procedure verified that the proper transfer of control power occurred when the Local/Remote transfer switches were operated at the RSPs. The procedure did not test any of the other RSP control switches or pushbuttons. The licensee stated that no formal periodic testing of the other RSPs control switches were required since the safe shutdown strategy did not credit control of equipment from the RSP. The license further stated that the safe shutdown strategy relied instead upon local manual operation of equipment. The inspectors concluded that local operation of safe shutdown equipment at the RSPs was performed using procedures 1(2)BOA PRI-5 and other procedures referenced from 1(2)BOA PRI-5. If the RSPs control switches did not function properly, the operators would perform the manual actions listed in the response not obtained (RNO) column of the procedure. The licensee indicated that the use of the directions in the RNO section of the procedure was the credited safe shutdown strategy.
In addition to the current SSD analysis for a fire in the control room which appeared to credit operation of equipment from the RSP for safe shutdown, the inspectors reviewed Byron SSERs 3 and 5 which discussed the alternative shutdown capability. These SSERs provided the following information concerning the remote shutdown panels:
The design of the panels includes the capability to electrically isolate the instrumentation indications and control functions for the shutdown systems from the control room. The auxiliary feedwater system, main steam atmospheric relief valves, and chemical and volume control system (charging pump and letdown line) can be manually controlled from the panels to achieve and maintain hot shutdown independent of the control room. Initiation of the residual heat removal system for achieving cold shutdown is performed at local locations.
Support system functions are initiated either at the remote shutdown panels or at local locations.
Based on the information in the SSERs and the safe shutdown analysis for a control room fire, the inspectors determined that the RSPs were most likely credited for alternative shutdown and were assumed to be electrically isolated from the control room.
In contrast to this, the licensee stated that the panels were not electrically isolated and were not credited for safe shutdown. The inspectors requested that the licensee provide any additional information, including revisions to the safe shutdown analysis, and any adverse to safe shutdown evaluations for the revisions, to determine when the alternative shutdown strategy changed from crediting an electrically isolated RSP to using local manual operator actions. The inspectors planned to review the information provided to determine if the licensee was in compliance with the licensing basis as established in the FPR and SSERs 3 and 5.
The inspectors were concerned that the RSPs control switches may not operate safe shutdown equipment in the manner the operator expected since the RSPs control switches were not periodically tested to verify proper equipment operation. The inspectors did not consider the licensees position that the 1(2)BOA PRI-5 procedures RNO use of operator manual actions provided sufficient justification for not periodically testing the control switches at the RSPs. In response to the inspectors concerns, the licensee initiated Issue Report (IR) Number 00231542, Consider Testing of RSP Switches. This issues involving the RSP, including electrical isolation, crediting of the controls for SSD and periodic testing will be considered an URI pending the licensee completing further reviews of this issue and subsequent NRC evaluation.
.5 Operational Implementation of Alternate Shutdown Capability
The guidelines established by BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (2)(d), required that the process monitoring function should be capable of providing direct readings of the process variables necessary to perform and control the functions necessary to achieve reactivity control, reactor coolant makeup, and decay heat removal.
a. Inspection Scope
The inspectors performed a review of the safe shutdown analysis for areas utilizing alternative shutdown. The inspectors reviewed Procedure BOA PRI-5, Control Room Inaccessibility, which was the procedure for performing a plant alternative shutdown from outside the control room. The inspectors verified that operators could reasonably be expected to perform the procedure actions and that equipment labeling was consistent with the procedure.
The inspectors review of the adequacy of communications and emergency lighting associated with these procedures are documented in Sections 1R05.6 and 1R05.7 of this report.
b. Findings
No findings of significance were identified. See Section 1R05.4 for issues related to the alternative shutdown capability.
.6 Communications
The guidelines established by BTP CMEB 9.5-1, Section C.5.g, Lighting and Communication, Paragraph (4), required that a portable communications system be provided for use by the fire brigade and other operations personnel required to achieve safe plant shutdown. This system should not interfere with the communications capabilities of the plant security force. Fixed repeaters installed to permit use of portable radio communication units should be protected from exposure to fire damage.
a. Inspection Scope
The inspectors reviewed the adequacy of the communication system to support plant personnel in the performance of alternative safe shutdown functions and fire brigade duties.
b. Findings
No findings of significance were identified.
.7 Emergency Lighting
The guidelines established by BTP CMEB 9.5-1, Section C.5.g, Lighting and Communication, Paragraph (1), required that fixed self-contained lighting consisting of fluorescent or sealed-beam units with individual eight-hour minimum battery power supplies should be provided in areas that must be manned for safe shutdown and for access and egress routes to and from all fire areas.
a. Inspection Scope
The inspectors performed a walkdown of a sample of the actions defined in plant procedures used to control local equipment operations. As part of the walkdowns, the inspectors verified that sufficient emergency lighting existed for access and egress to areas and for performing necessary equipment operations.
b. Findings
No findings of significance were identified.
.8 Cold Shutdown Repairs
The guidelines established by BTP CMEB 9.5-1, Section C.5.c, Alternative or Dedicated Shutdown Capability, Paragraph (5), required that equipment and systems comprising the means to achieve and maintain cold shutdown conditions should not be damaged by fire; or the fire damage to such equipment and systems should be limited so that the systems can be made operable and cold shutdown achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
Materials for such repairs shall be readily available onsite, and procedures shall be in effect to implement such repairs.
a. Inspection Scope
The inspectors reviewed the licensees procedures to determine if any repairs were required to achieve cold shutdown. The inspectors determined that the licensee did require repair of some equipment to reach cold shutdown based on the safe shutdown methods used.
b. Findings
.1 Faulted Pressurizer PORV Power Source Restoration Directions Inadequate
Introduction:
The inspectors identified a NCV of very low safety significance (Green) for the failure to have adequate procedures to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a fire. The inspectors found that the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted pressurizer power operated relief valve (PORV) power source. Restoration of the pressurizer PORV power source was essential in assuring that pressurizer pressure could be reduced to allow initiation of the residual heat removal system for decay heat removal in sufficient time to ensure that cold shutdown could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of plant shutdown. A delay in achieving cold shutdown following a fire that required shutdown from outside of the control room was considered a credible impact on safety.
Description:
The inspectors reviewed the Byron/Braidwood calculation BYR98-293/
BRW98-1287-E, dated October 1, 2001. The purpose of the calculation was to evaluate the 125Vdc and 120Vac circuits that supplied safe shutdown equipment for adequate coordination such that a fire induced fault would not impact the shutdown capability of the plant. The calculations Section 7.2, Conclusion/Recommendation, stated, in part, of the 125Vdc circuits fed by Distribution Panels 1/2DC05EA and 1/2DC06EA, all installed breakers meet both acceptance criteria except the circuits supplying DC Fuse Panels 1/2DC10J and 1/2DC11J. For these circuits, the calculation recommended that the installed THED 70A breaker be replaced by a THED 100A breaker which meets both acceptance criteria. The inspectors observed that DC Fuse Panels 1/2DC10J and 1/2DC11J were the power sources for the solenoid operated valves (SOVs) which operated/controlled pressurizer PORVs 1/2RY455A and 1/2RY456.
The inspectors noted that prior to this inspection this calculation was reviewed by the NRC during the Braidwood Stations Fire Protection Triennial Inspection, as documented in Inspection Report 50-456/03-05(DRS); 50-457/03-05(DRS) dated August 21, 2003.
During that inspection, a Non-Cited Violation of 10 CFR Part 50, Appendix B, Criterion XVI, was identified concerning this calculation, where the licensee failed to assess and resolve recommendations to correct conditions adverse to quality as noted in the conclusion section of the calculation. The violation had a very low safety significance (Green) and was considered greater than minor because if potential breaker coordination deficiencies were not corrected in a timely manner, the undersized breaker may fail to clear a load fault and may trip the upstream motor control center (MCC) feed breaker resulting in the loss of the entire associated MCC. The calculation stated that in lieu of further extensive and detailed analysis, some circuit breaker changes were recommended for circuits where coordination could not be ensured. The violation was considered NRC-identified because the licensee had failed to implement any corrective measures since the calculation was issued in October 2001.
During this inspection, the inspectors reviewed the calculations minor Revision 0A dated June 18, 2004. The purpose of this revision was to provide a more detailed analysis of the Byron Station circuits identified in the calculations Revision 0, where electrical coordination could not be demonstrated or was indeterminate. The minor Revision 0A was to establish that either coordination existed between upstream and downstream protective devices, or that a loss of power to a device would not preclude operation of a safe shutdown function. In minor Revision 0As, Section 6, Calculations, Items 6.1, 6.3, 6.5, and 6.7, the calculation evaluated the pressurizer PORVs SOV power sources for 1RY455A (DC Fuse Panel 1DC10J), 1RY456 (DC Fuse Panel 1DC11J), 2RY455A (DC Fuse Panel 2DC10J) and 2RY456 (DC Fuse Panel 2DC11J), respectively. The minor Revision 0As analysis for these safe shutdown components was to show that a loss of power to the device would not preclude operation of the safe shutdown function.
The pressurizer PORVs are air operated valves (AOVs), which are normally closed and require air to open. Upon loss of air, the pressurizer PORVs fail closed. The pneumatic control circuit for the pressurizer PORVs consists of instrument air from an accumulator in series with two SOVs. Both SOVs are normally de-energized in the closed position.
The required post-fire safe shutdown position for the pressurizer PORVs to achieve hot shutdown conditions is closed. For cooldown to cold shutdown conditions, one pressurizer PORV (1/2RY455A or 1/2RY456) is required to be periodically opened in order to reduce reactor coolant system pressure. In minor Revision 0A, the analysis stated that for an open (faulted) upstream breaker, that a manual action can be performed to reclose the 70 Amp circuit breaker in the Distribution Panels. This would restore power to the pressurizer PORVs SOVs.
The inspectors noted that for a fire which would require the evacuation of the main control room (MCR), the operators would initiate 1BOA PRI-5, Control Room Inaccessibility Unit 1, and 2BOA PRI-5, Control Room Inaccessibility Unit 2. These two procedures (i.e., 1(2)BOA PRI-5) directed the operator actions necessary to take the station to cold shutdown. The inspectors review of 1(2)BOA PRI-5 found that the procedures did not provide sufficient direction to restore a faulted pressurizer PORV power source. Restoration of the pressurizer PORV power source was essential to assure that pressurizer pressure could be reduced to allow initiation of the residual heat removal system for decay heat removal. The inspectors concluded that the licensees procedures (i.e., 1(2)BOA PRI-5) did not assure that cold shutdown conditions could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for an area required to have alternate or dedicated shutdown capability.
Analysis:
The inspectors determined that failing to provide adequate procedures to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a fire is a performance deficiency warranting a significance evaluation in accordance with IMC 0612, "Power Reactor Inspection Reports," Appendix B, "Issue Disposition Screening," issued on June 20, 2003. The inspectors determined that the finding was more than minor because if left uncorrected, would become a more significant safety concern. In addition, the finding involved the attribute of protection against external factors (fire) and could have affected the mitigating systems objective of ensuring the availability of systems that respond to initiating events to prevent undesirable consequences. The failure to provide adequate procedures for implementing the alternative shutdown capability could result in delaying or preventing achieving cold shutdown conditions following a fire.
The inspectors completed a significance determination of this issue using IMC 0609, Significance Determination Process (SDP), dated April 21, 2003, Appendix F, Fire Protection Significance Determination Process, dated May 28, 2004. The inspectors assigned a degradation rating of moderate because a delay in restoring the PORV could potentially result in the inability to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
Since the finding only affects the ability to reach and maintain cold shutdown conditions, this finding was considered to be of very low safety significance (Green). The finding was assigned to the mitigating systems cornerstones for both Units.
Enforcement:
The Byron Station Operating Licenses, NPF-37 and NPF-66, Sections 2.C.(6) and 2E, respectively, required, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensees fire protection report. The fire protection report, which contained Appendix 5.7, Appendix R - Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979, stated, in part, with exceptions not relevant here, that the Byron Station complies with the requirements of 10 CFR Part 50, Appendix R, Section III.L, Alternative and Dedicated Shutdown Capability, Section 3, which requires, in part, that procedures be in effect to implement the capability to achieve cold shutdown conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for fire areas required to have an alternate or dedicated shutdown capability.
Contrary to the above, on July 9, 2004, the inspectors found that the procedures for shutdown from outside of the control room did not provide sufficient direction to restore a faulted PORV power source to assure that pressurizer pressure could be reduced to allow initiation of the residual heat removal system for decay heat removal. As such, the licensees procedures did not assure that cold shutdown conditions could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for an area required to have alternate or dedicated shutdown capability.
The inspectors considered this a violation of the License Condition [10 CFR Part 50, Appendix R,Section III.L.3]. In response to the inspectors concerns, the licensee initiated corrective actions to evaluate and take appropriate corrective actions to restore a faulted PORV power source. This violation is associated with a finding that is characterized by the SDP as having very low risk significance (Green) and is being treated as a NCV, consistent with Section VI.A.1 of the NRC Enforcement Policy. This violation was entered into the licensees corrective action program as IR00234859, Post-Fire Safe Shutdown Action to Restore 1RY455A. (NCV 05000454/2004005-05; 05000455/2004005-05).
.9 Fire Barriers and Fire Zone/Room Penetration Seals
The guidelines established by BTP CMEB 9.5-1, Section C.5.a, Building Design, Paragraph (3), required that penetration seal designs be qualified by tests that are comparable to tests used to rate fire barriers.
a. Inspection Scope
The inspectors performed a visual inspection of selected barriers to ensure that the barrier installations were adequate to ensure the barrier met the requirements of BTP CMEB 9.5-1.
b. Findings
No findings of significance were identified.
.10 Fire Protection Systems, Features and Equipment
The guidelines established by BTP CMEB 9.5-1 required that fire protection systems, features and equipment, specifically the passive fire protection features and fire detection system, were designed in accordance with Sections C.5.a and C.6.a.
a. Inspection Scope
The inspectors reviewed the material condition, operations lineup, operational effectiveness, and design of fire detection systems, fire suppression systems, manual fire fighting equipment, fire brigade capability, and passive fire protection features. The inspectors reviewed deviations, detector placement drawings, fire hose station drawings, and the FHA to ensure that selected fire detection systems, portable fire extinguishers, and hose stations were installed in accordance with their design, and that their design was adequate given the current equipment layout and plant configuration.
b. Findings
.1 Design Control of Fire Loading Calculation Changes
Introduction:
The inspectors identified a NCV of 10 CFR Part 50, Appendix B, Criterion III, Design Control, having very low safety significance (Green), for failing to control and track the total fire loading in a fire zone.
Description:
The inspectors identified that the design change process at Byron, which was governed by a corporate Exelon procedure CC-AA-209, Fire Protection Program Configuration Change Review, Revision 1, considered a change adding fire loading less than 1000 BTUs/sq. ft. to be negligible and did not require an update to the fire loading calculation. This process created the potential to lose track of the cumulative fire loading for a given fire zone. A fire protection report update and the combustible loading calculation were revised only if a design change added combustible loading in any zone greater than 1000 BTUs/sq. ft. In general, any plant modification that added combustible loading less than 1000 BTUs/sq.ft. could be unaccounted for in the total fire loading for the area. A modification performed in 1997 to install a permanent work station for Radiation Protection (RP) Personnel at Byron Station Auxiliary Building, Elevation 401' was an example identified by the inspectors to support this finding.
Analysis:
The inspectors determined that performing a plant modification without proper engineering design change controls was a performance deficiency warranting a significance evaluation. In accordance with IMC 0612, Power Reactor Inspection Reports, Appendix B, Issue Disposition Screening, issued on June 20, 2003, the inspectors determined that the finding was more than minor because if left uncorrected, it would become a more significant safety concern. The finding involved the attribute of protection against external factors (fire) and could have affected the mitigating systems objective of ensuring the availability of systems that respond to initiating events to prevent undesirable consequences. Since the design change process did not have provisions to account for the addition of permanent fire loading less than 1000 BTUs/
sq. ft. for an area, multiple additions could eventually exceed the allowance provided for unrecognized or transient combustibles for the area and potentially affect the ability of systems designed to cope with a fire in that area.
The inspectors completed a significance determination of this issue using IMC 0609, SDP, Appendix F, dated May 28, 2004. The finding affected the Fire Prevention and Administrative Controls category and the plant combustible material controls program element. The inspectors assigned a degradation rating of low because the finding did not result in exceeding the fire loading allowance for the area. The fire loading contributed by the fixed combustibles from the RP work station at 401' level of the Auxiliary Building amounted to approximately 16 percent of the allowance. The allowance for this area was the equivalent BTUs from two 55 gallon drums of lube oil.
Therefore, the finding was considered to be of very low safety significance (Green). The finding was assigned to the mitigating systems cornerstones for both units at Byron.
Enforcement:
The Quality Assurance (QA) Manual for Exelon Generation Company, LLC QA Topical Report (QATR) NO-AA-10, Revision 72, dated March 8, 2004, Chapter 2, Section 2.1 states that, The QAP is based upon 10CFR50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants. QATR NO-AA-10 Appendix G, Section 2.1.2, Fire Protection, states that QATR chapters that are applicable to the Fire Protection area are 1 through 7, 10, 11, and 14 through 18.
QATR NO-AA-10, Chapter 3, Design Control, establishes the requirement and control measure for assuring design bases and regulatory requirements are correctly translated into design documents in accordance with 10 CFR Part 50, Appendix B, Criterion III, Design Control. Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in part, that measures shall be established for the identification and control of design interfaces and for coordination among participating design organizations. These measures shall include the establishment of procedures among participating design organizations for the review, approval, release, distribution, and revision of documents involving design interfaces. Contrary to the above, the licensee failed to establish adequate procedures for revising design documents. Specifically, the licensee failed to revise the fire loading calculation to include the fire loading added by the RP work station due to the deficiency in the design control procedure.
This violation is associated with an inspection finding that is characterized by the SDP as having very low safety significance (Green) and is being treated as a NCV consistent with Section VI.A.1 of the NRC Enforcement Policy. This violation was entered into the licensees corrective action program as IR 234085. (NCV 05000454/2004005-06; 05000455/2004005-06).
.11 Compensatory Measures
a. Inspection Scope
The inspectors conducted a review to verify that adequate compensatory measures were put in place by the licencee for out-of-service, degraded or inoperable fire protection and post-fire safe shutdown equipment, systems, or features. The inspectors also verified that short term compensatory measures were adequate to compensate for a degraded function or feature until appropriate corrective actions were taken.
b. Findings
No findings of significance were identified.
OTHER ACTIVITIES (OA)
4OA2 Identification and Resolution of Problems
The guidelines established by BTP CMEB 9.5-1, Section C.4, Quality Assurance (QA)
Program, Paragraph H, required that measures should be established to ensure that conditions adverse to fire protection, such as failures, malfunctions, deficiencies, deviations, defective components, uncontrolled combustible material and nonconformance, are promptly identified, reported, and corrected.
a. Inspection Scope
The inspectors reviewed a selected sample of condition reports associated with Byrons Fire Protection Program to verify that the licencee had an appropriate threshold for identifying issues. The inspectors evaluated the effectiveness of corrective actions for the identified issues.
b. Findings
No findings of significance were identified.
4OA6 Meetings
.1 Exit Meeting
The inspectors presented the inspection results to Mr. S. Kuczynski and other members of licensee management at the conclusion of the inspection on July 9. 2004. The licensee acknowledged the findings presented. No proprietary information was identified.
ATTACHMENT:
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee
- B. Adams, Byron Engineering Manager
- K. Ainger, Exelon Corporate Licensing
- F. Beutler, Byron Engineering
- D. Brindle, Byron Engineering
- B. Grundmann, Byron Regulatory Assurance Manager
- S. Kuczynski, Byron Site Vice President
- B. Ledger, Byron Engineering
- V. Naschansky, Byron Electrical Engineering Supervisor
- G. ODonnell, Braidwood Fire Protection
- R. Randels, Byron Design Engineering Manager
- D. Robinson, Byron Engineering
- A. Sereika, Byron Engineering
- S. Stimac, Byron Operations Manager
- P. Thorngren, Byron Acting Fire Marshall
Nuclear Regulatory Commission
- R. Caniano, Deputy Director, Division of Reactor Safety
- R. Skowkowski, Senior Resident Inspector
- P. Snyder, Resident Inspector
- T. Tongue, Project Engineer, Division of Reactor Projects
A1 Attachment
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened and Closed
- 05000454/2004005-01 NCV Failure to Install Fire Detector in Accordance With
- 05000455/2004005-01 NFPA 72E (Section 1R05.2)
- 05000454/2004005-05 NCV Faulted Pressurize PORV Power Source Restoration
- 05000455/2004005-05 Directions Inadequate (Section 1R05.8)
- 05000454/2004005-06 NCV Design Control of Fire Loading Calculations
- 05000455/2004005-06 (Section 1R05.10)
Opened
- 05000454/2004005-02 URI Assumption of a Single Spurious Operation in a Fire
- 05000455/2004005-02 Area (Section 1R05.3b.1)
- 05000454/2004005-03 URI Adequacy of Safe Shutdown Procedures to Address
- 05000455/2004005-03 Draining of the RWST (Section 1R05.3b.2)
- 05000454/2004005-04 URI Alternative Shutdown Using the Remote Shutdown
- 05000455/2004005-04 Panel (Section 1R05.4)
Discussed
None.