The team identified an unresolved item concerning the possible failure to implement the approved
fire protection program. Specifically, the team identified that the licensees
fire protection program relied upon local manual actions to mitigate the effects of potential fire damage to equipment required to achieve and maintain safe hot shutdown conditions, rather than ensuring one train of the required equipment was free from fire damage as specified in the approved
fire protection program. Description. The team reviewed a sample of three fire areas in Unit 1, which do not require evacuation of the main control room during the shutdown. The team reviewed the approved
fire protection program as defined in License Condition 2.G and determined that one train of equipment required to achieve and maintain hot shutdown is required to be free from fire damage. The team noted that the approved
fire protection program allows local manual actions to respond to spurious operations of equipment other than that required for
safe shutdown which could impact the
safe shutdown. The team conducted walkdowns with licensee operations personnel of Procedures ABN-804A, Response To a Fire In The Safeguards Building, Revision 5, and ABN-806A, Response To a Fire In The Electrical and Control Buildings, Revision 5. The team found that the
fire protection program, as implemented, relied on the use of local manual actions to align and control equipment required to achieve and maintain hot shutdown instead of assuring that one train was free from fire damage. This approach expanded the use of local
operator manual actions outside of the control room beyond the response to spurious operations allowed in the approved
fire protection program. The team concluded that the licensees
fire protection program, as implemented, provided less physical separation and protection from the affects of fire than the approved program required, and is inherently less reliable than ensuring that one train of the required systems are free from fire damage. An example of this concern is the licensees treatment of air-operated valves (
AOVs) in the charging and
auxiliary feedwater systems, which are required to perform the
reactor coolant inventory control and
decay heat removal functions, respectively. The licensee did not designate the instrument air system as a required support system and ensure it would remain free of fire damage, so air may not be available to operate these
AOVs. Consistent with this approach, the licensee did not protect the circuits required to operate these
AOVs from fire damage. These
AOVs are required to be
operable from the control room to reach and maintain hot shutdown. Instead, the licensee relied on local manual actions outside of the control room to de-energize the
AOVs to their failed positions, and in the case of the turbine driven
auxiliary feedwater pump, to then control the turbine manually. Additional local manual actions are required to position other valves to compensate for the loss of control of the
AOVs. This issue was discussed extensively with the license and the Office of Nuclear Reactor Regulation, and the staff has concluded that the NRC did not approve manual actions in lieu of protection for equipment required for
safe shutdown. The licensee disagreed with the teams interpretation of the
fire protection program requirements and believed the program complies with their license condition. Analysis. Failure to ensure that one train of the systems required for hot shutdown is free from fire damage was a performance deficiency. The team determined that this finding was more than minor because it is associated with the Protection Against External Factors attribute of the
Mitigating Systems cornerstone and could affect the availability, reliability, and capability of systems that respond to fire events to prevent undesirable consequences. The team initiated an evaluation of this finding using the
significance determination process in Manual Chapter 0609, Appendix F, Fire Protection
Significance Determination Process, because it affected fire protection defense-in-depth strategies involving post fire
safe shutdown systems. However, additional analysis, to be performed by a senior reactor analyst, is needed to determine the safety significance of this issue. Additional information will be required from the licensee concerning the extent of the condition in order to assess the significance. The team used the guidance in
Inspection Procedure 71111.05T to assess whether the manual actions could be reliability completed. Walkthroughs of the manual actions specified for the fire areas selected as samples for the inspection were conducted with qualified plant operators. These operators were able to perform all actions using the current plant procedures. The team determined that the sample of manual actions were reasonable and feasible in accordance with the guidance in
Inspection Procedure 71111.05T, and are therefore an acceptable compensatory measure. Therefore, this finding does not present an immediate safety concern. Enforcement: The approved
fire protection program, as defined in License Condition 2.G for Unit 1, requires one train of equipment needed for establishing and maintaining hot shutdown to be free from fire damage. The team was concerned that the licensee failed to properly implement the approved
fire protection program. Specifically, the licensee relied on the use of local
operator manual actions to operate components required to achieve and maintain safe hot shutdown conditions in lieu of protecting one train of equipment required for
safe shutdown. The team was concerned that the licensees
fire protection program, as implemented, may have provided less physical separation and protection from the affects of fire than required by the approved
fire protection program. Pending completion of additional analyses to determine the extent of condition and the safety significance of this finding, this issue is being treated as an unresolved item:
URI 05000445;446/2008006-02, Unapproved Local Manual Actions For Hot Shutdown
