IR 05000313/2016009

NRC Triennial Fire Protection Inspection Report 05000313/2016009 and 05000368/2016009, June 6, 2016 Through June 24, 2016

ML16218A299
Person / Time
Site:	Arkansas Nuclear
Issue date:	08/04/2016
From:	Greg Werner NRC/RGN-IV/DRS/EB-2
To:	Warren C Entergy Operations
References
IR 2016009
Download: ML16218A299 (49)

Text

UNITED STATES ust 4, 2016

SUBJECT:

ARKANSAS NUCLEAR ONE - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT (05000313/2016009 AND 05000368/2016009)

Dear Mr. Warren:

On June 24, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Arkansas Nuclear One, Units 1 and 2, and discussed the results of this inspection with Mr. B. Gordon, Acting General Manager, and other members of your staff. The NRC team documented the results of this inspection in the enclosed inspection report.

The NRC team documented four violations of very low safety significance (Green). Three of these findings involved violations of NRC requirements; one of these violations was determined to be Severity Level IV (SL-IV) under the traditional enforcement process. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of the violations in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Senior Resident Inspector at Arkansas Nuclear One.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC Senior Resident Inspector at Arkansas Nuclear One.

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) 2.390, Public Inspections, Exemptions, Requests for Withholding, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/Samuel T. Graves Acting for/

Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6

Enclosure:

Inspection Report 05000313/2016009; 05000368/2016009 w/Attachment:

Supplemental Information

REGION IV==

Docket: 05000313, 05000368 License: DPR-51; NPF-6 Report Nos.: 05000313/2016009 and 05000368/2016009 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Units 1 and 2 Location: Junction of Hwy. 64 West and Hwy. 333 South Russellville, Arkansas Dates: June 6 through June 24, 2016 Team Leader: N. Okonkwo, Reactor Inspector, Engineering Branch 2 Team: S. Alferink, Reactor Inspector, Engineering Branch 2 S. Makor, Reactor Inspector, Engineering Branch 2 J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 G. Pick, Senior Reactor Inspector, Engineering Branch 2 R. Deese, Senior Reactor Analyst, Plant Support Branch 2 Accompanying H. Barrett, Senior Fire Protection Engineer, Office of Nuclear Reactor Personnel: Regulation, Division of Risk Assessment Approved By: Gregory E. Werner Chief, Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY

IR 05000313/2016009; 0500368/2016009; 06/06/2016 - 06/24/2016; Arkansas Nuclear One;

Triennial Fire Protection Team Inspection The report covers a two-week triennial fire protection team inspection by specialist inspectors from Region IV. Four violations, which were non-cited violations, were documented. The significance of inspection findings is indicated by their color (i.e., Green, White, Yellow, or Red)and determined using Inspection Manual Chapter (IMC) 0609, Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using IMC 0310,

Aspects within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 6.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of License Conditions 2.C.(8),

Fire Protection, for Unit 1; License Condition 2.C.(3)(b), Fire Protection, for Unit 2; and the technical requirements manuals because the licensee did not properly test all portions of the underground fire piping. Specifically, the licensee did not determine the flow rates through two headers that provided water to the ring header supplying the Unit 2 auxiliary building as designed. The licensee entered this violation into their corrective action program as Condition Report CR-ANO-C-2016-02613 and initiated actions to conduct a flow test of the headers.

The failure to implement an adequate procedure to test underground fire piping was a performance deficiency. Specifically, the licensee did not test two headers included and designed as part of their underground fire piping to demonstrate that no faults had occurred.

This performance deficiency was more than minor because it was associated with the protection against external factors attribute (fire) and adversely affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to test two underground fire piping headers failed to demonstrate the capability to deliver adequate flow and pressure to the fire suppression systems as designed. The finding was screened in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. Because the finding affected fixed fire protection systems or the ability to confine a fire, the team reviewed the finding using IMC 0609, Appendix F,

Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. The finding was screened as a Green finding of very low safety significance in accordance with Task 1.4.7, Fire Water Supply, Question A. Although the licensee failed to test all portions of the underground fire piping in accordance with their license and technical requirements manual, the team determined that at least 50 percent of required fire water capacity would be available based on the testing that is done. As a result, the finding was determined to be of very low safety significance (Green).

The team determined that this finding did not have a cross-cutting aspect since it did not reflect current performance. Specifically, the licensee had not flow tested all underground fire piping headers since initial installation. (Section 1R05.03.b)

Green.

The team identified a non-cited violation of License Condition 2.C.(3)(b), Fire Protection, for use of an inadequate procedure as a compensatory measure. Specifically, a procedure for providing temporary cooling to the safety parameter display system room when the normal room cooler is unavailable did not adequately address the impact of the temporary configuration on the ability to maintain safe and stable plant conditions for fires that require shutdown from outside the control room. The temporary room cooler did not have a power supply assured to remain available during a shutdown from outside the control room. The licensee entered this violation into their corrective action program as Condition Reports CR-ANO-2-2016-02143 and CR-ANO-C-2016-02638. In response to this issue, the licensee developed a thermal analysis of the safety parameter display system room temperature during this scenario and confirmed that the maximum room temperature would not challenge the operation to the safety parameter display system.

The failure to provide an adequate procedure for use as a compensatory measure was a performance deficiency. The performance deficiency was more than minor because it was associated with the Mitigating Systems cornerstone attribute of procedure quality and adversely affected the associated cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. Specifically, loss of cooling to the safety parameter display system room could adversely affect the availability, reliability, and capability of the safety parameter display system which is required to respond to a fire resulting in the evacuation of the Unit 2 control room. A senior reactor analyst performed a detailed risk evaluation of this finding because IMC 0609, Appendix F, does not include explicit treatment of fires in the control room. An evaluation of the survivability of the safety parameter display system compared to the best estimate of the heatup of the room housing its equipment demonstrated that the safety parameter display system would survive with high probability until the plant reached a safe and stable condition for the postulated fires. As a result, the finding was determined to be of very low safety significance (Green). This finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago. (Section 1R05.10.b)

Green.

The team identified a non-cited violation of License Condition 2.C(3)(b),

Fire Protection, for the failure to establish an appropriate monitoring program in accordance with National Fire Protection Association Standard 805, Section 2.6.

Specifically, the licensee failed to set the action level for the availability of some plant components to ensure that the assumptions in the engineering analysis remained valid and also failed to establish a monitoring plan for the concurrent unavailability of one set of two components. The licensee entered the issues into their corrective action program as Condition Reports CR-ANO-2-2016-02355 and was in the process of developing corrective actions to address the monitoring of the components and work with industry organizations and Office of Nuclear Reactor Regulation to determine long-term resolution.

The failure to adequately monitor unavailability of the plant components to ensure that the assumptions in the engineering analysis remained valid was a performance deficiency. The performance deficiency was more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could adversely affect the acceptable level of availability of the components which are used to respond to fire initiating events, in that the action levels for availability in the monitoring program were greater than the assumptions in the fire probabilistic risk assessment. The finding was screened in accordance with Inspection IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. Because the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire, the team reviewed the finding using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. The finding was screened as a Green finding of very low safety significance in accordance with Step 1.3, Ability to Achieve Safe Shutdown,

B Question. Based on the criteria in Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, dated February 28, 2005, the finding was assigned a low degradation rating. Using Table A2.3, the inspectors assigned the low degradation rating because the issue involved monitoring of components that did not appreciably degrade below acceptable levels during the exposure period. This finding had a cross-cutting aspect associated with change management within the human performance area since leaders did not use a systematic process (e.g., assigning an overall owner) for evaluating and implementing change during the development of the monitoring program for the fire probabilistic risk assessment model for Unit 2 (H.3). (Section 1R05.13b)

• SL-IV. The team identified two examples of a Severity Level IV non-cited violation of License Condition 2.C(3)(b), Fire Protection, for the licensees failure to properly implement their risk-informed fire protection program and accurately capture component ignition frequencies in their fire probabilistic risk assessment. Specifically, the component ignition frequencies for air compressors and ventilation equipment were found to be lower than expected because the licensee misapplied the guidance in NUREG/CR-6850. The licensee entered this issue into their corrective action program as Condition Reports CR ANO-C-2016-2600, CR-ANO-C-2016-2528, and CR-ANO-2-2016-02356, with the intent to perform an extent of condition relating to other potential components that are misclassified in the fire ignition frequency analysis, correct the fire Ignition frequency report and the associated Fire Probabilistic Risk Assessment model calculations to incorporate the correct ignition frequency and the appropriate scenarios.

The licensees failure to adequately implement the prescribed guidance in NUREG/CR-6850 to estimate the ignition frequencies for their risk-informed fire protection program was a performance deficiency. The performance deficiency was minor because the answer to all the IMC 0612, Appendix B, more than minor questions was No. The team determined that this issue was a traditional enforcement violation because it impacted the regulatory process when the only NRC-approved framework for conversion to NFPA 805 was not fully followed.

The NRC determined that this violation was associated with a minor performance deficiency.

The team determined that this violation was a Severity Level IV in the traditional enforcement process when comparing it to the violation examples in Section 6.1, Reactor Operations, of the NRC Enforcement Policy, specifically noting it was similar to Example 6.1.d.4 for failing to adequately assess the baseline risk of plant operations associated with implementation of a risk-informed program (NFPA 805) such that the program was implemented inappropriately. The finding did not have a cross-cutting aspect because traditional enforcement violations are not assessed for cross-cutting aspects.

(Section 1R05.14b)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection team inspection conducted at Arkansas Nuclear One in accordance with NRC Inspection Procedure 71111.05XT, Fire Protection - NFPA 805 (Triennial), dated January 31, 2013. This inspection procedure provides specific inspection guidance for plants that have transitioned to a risk-informed, performance-based fire protection program. The team reviewed the licensees Unit 2 fire protection program against the requirements NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition, as incorporated by 10 CFR 50.48(c). The NFPA 805 standard establishes a comprehensive set of requirements for fire protection programs at nuclear power plants. The standard incorporates both deterministic and risk-informed, performance-based concepts. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the plant can achieve and maintain a safe and stable condition.

Inspection Procedure 71111.05XT requires the selection of two fire areas and one or more mitigating strategies for review. The team used the fire hazards analysis section of the Arkansas Nuclear One NFPA 805 fire probabilistic risk assessment to select the following four risk-significant fire areas (inspection samples) for review:

Fire Area (Unit 2) Description Category G Zone 2098-C (Core Protection Calculator Performance-Based Zone 2098-L (Cable Spreading Room) Performance-Based Zone 2199-G (Control Room) Performance-Based JJ Zone 2109-U (Corridor and Motor Control Center) Performance-Based HH Zone 2073 (Access Area, Pump Room, Tank Room, Waste Gas Equipment Area, Passage Performance-Based Way and Motor Control Center)

L Zone TKVLT (Emergency Diesel Generator Tank Performance-Based Oil Vault)

Since this was the first triennial inspection following NRC approval of the risk-informed, performance-based fire protection program, the team reviewed samples of the implementation items required to be completed in accordance with Operating License Condition 2.C.(3)(b). The team also reviewed samples of the plant modifications credited to support the approved fire protection program.

The team evaluated the licensees fire protection program using the applicable requirements, which included the plant Technical Specifications, Operating License Condition 2.C.(3)(b), NRC safety evaluations, 10 CFR 50.48, and NFPA 805. The team also reviewed related documents that included the final safety analysis report, Section 9.5; the nuclear safety capability assessment; and the fire safety analysis.

Specific documents reviewed by the team are listed in the attachment.

Four fire area inspection samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the nuclear safety capability assessment, piping and instrumentation diagrams, and fire response procedures to verify that a safe shutdown success path, free of fire damage, would be available to meet the nuclear safety goals, objectives, and performance criteria in the event of a fire under any plant operational mode or configuration.

The team reviewed applicable sections of the fire response procedures for the selected fire areas and their associated fire scenarios to verify that the shutdown methodology properly identified the components and systems necessary to achieve and maintain safe and stable plant conditions. The team performed a walkdown of the procedure to verify that recovery actions credited to achieve the nuclear safety performance criteria were feasible. The team evaluated the feasibility of the recovery actions against the criteria established in the licensees fire protection program as approved in the safety evaluation report. Specifically, the team verified that licensee personnel credited for procedure implementation had procedures available, were trained on implementation, and were available in the event a fire occurred. The team also verified that the operators could reasonably be expected to perform the recovery actions within the time required to maintain plant parameters within specified limits.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetrations and openings to verify the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

The team also reviewed completed surveillance and maintenance records for selected fire dampers, fire doors, and fire barrier seals to verify whether the inspection and testing was adequately conducted, the acceptance criteria were met, and any potential performance degradation was identified.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas and the major system support equipment in other areas (e.g., fire pumps, Halon supply systems, and hose stations) to assess the material condition, design, and operational lineup, operational availability, and operational effectiveness of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements. The team also reviewed the suppression system functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify the success path necessary to achieve and maintain the nuclear safety performance criteria and to facilitate suppression of a fire that could impact the ability to achieve and maintain safe and stable plant conditions.

In addition, the team inspected fire brigade equipment to determine operational readiness for firefighting.

The team observed an unannounced fire drill and subsequent drill critique on June 21, 2016, using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly, dated September 30, 2010. The team observed fire brigade members fight a simulated fire in the Unit 2 intake structure area. The team verified that the licensee-identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate firefighting techniques;

(4) sufficient firefighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

Introduction.

The team identified a non-cited violation of License Conditions 2.C.(8),

Fire Protection, for Unit 1; License Condition 2.C.(3)(b), Fire Protection, for Unit 2; and the technical requirements manuals because the licensee did not properly test all portions of the underground fire piping. Specifically, the licensee did not determine the flow rates through two headers that provided water to the ring header supplying the Unit 2 auxiliary building. The licensee entered this violation into their corrective action program as Condition Report CR-ANO-C-2016-02613 and initiated actions to conduct a flow test of the headers.

Description.

The team reviewed the method used by the licensee to test their underground fire piping to ensure that they had flow tested each header containing sectionalizing valves, which could provide flow to buildings containing post fire safe shutdown equipment. The licensee flow tested their underground fire suppression system piping every 3 years in accordance with Procedure 1104.032, Supplement 10, 3-Year Fire Water System Flow Test, Revision 69, to demonstrate that the flow satisfied minimum flow requirements. From review of fire water piping drawings and the test procedure, the team determined that the licensee had not tested two headers in their underground fire piping that included sectionalizing valves and could provide flow to buildings containing post fire safe shutdown equipment. The team determined that the licensee had tested the most hydrologically challenging flow path to the buildings and tested the remainder of the outer ring of fire water piping.

From review of the licensing basis, the team concluded that the licensee was required to flow test the underground fire piping that had the potential to feed high value or hazardous areas. The headers not tested were designed to provide alternative supplies to the ring header that supplied buildings, which contained equipment necessary to shut the plant down after a fire.

The team determined that the Unit 1 licensing basis indicated that the underground fire piping met the design specified in Appendix A to Branch Technical Position APCSB 9.5-1, Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976. The design requirements included providing sectionalizing valves to allow for maintenance and to ensure that water could be provided to all areas in the event of a line break. The licensee designed their system in accordance with NFPA 24, Outside Protection, that specified that control valves (i.e., sectionalizing valves) shall be tested against full system pressure.

The team determined that the licensee used this test to meet the requirements specified in Unit 1 Technical Requirements Manual Test Requirement TR 3.7.8.13 and Unit 2 Technical Requirements Manual Test Requirement 4.7.1.13, which require that the licensee perform a flow test of the fire suppression water system every 3 years in accordance with Chapter 5, Section 11, of the Fire Protection Handbook, 14th Edition.

The team determined that Chapter 5, Section 11, specified, in part, that tests should be conducted in a way that demonstrates that the available flow and pressure at high value or hazardous areas can be determined readily and to determine whether any system faults such as mispositioned valves or blockage had occurred.

Updated Final Safety Analysis Report, Appendix 9A, Fire Protection Program, Section 9A.1.D, specified that the fire protection program is defined in the 1978 and 1988 Appendices A and R, Fire Protection Safety Evaluation Reports. Updated Final Safety Analysis Report, Section 9.8.3.1.9, Test Control, specifies that a test program is to be established and implemented to ensure that testing is performed and verified on applicable systems and components to demonstrate conformance with design and system readiness requirements.

The licensee initiated Condition Report CR-ANO-C-2016-02613 to document this deficiency and initiated actions to revise their flow test. Although the piping sections had not been tested, the team determined that fire pump functional testing demonstrated that the system remained capable of performing its design function until the licensee could perform the appropriate flow testing. In addition, the licensee had some history of actual flow through one of the lines not previously tested and had recently replaced piping in one of the untested lines.

Analysis.

The failure to implement an adequate procedure to test underground fire piping was a performance deficiency. Specifically, the licensee did not test two headers included and designed as part of their underground fire piping to demonstrate that no faults had occurred. This performance deficiency was more than minor because it was associated with the protection against external factors attribute (fire) and adversely affected the Mitigating Systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to test two underground fire piping headers failed to demonstrate the capability to deliver adequate flow and pressure to the fire suppression systems as designed.

The finding was screened in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. Because the finding affected fixed fire protection systems or the ability to confine a fire, the team reviewed the finding using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. The finding was screened as a Green finding of very low safety significance in accordance with Task 1.4.7, Fire Water Supply, Question A. Although the licensee failed to test all portions of the underground fire piping in accordance with their license and technical requirements manual, the team determined that at least 50 percent of required fire water capacity would be available based on the testing that is done. This finding did not have a cross-cutting aspect since all underground fire piping had not been flow tested since initial installation and it did not reflect current performance.

Enforcement.

Unit 1 License Condition 2.C.(8) specifies, in part, Entergy Operations, Inc., shall implement and maintain in effect all provisions of the approved fire protection program as described in Appendix 9A to the safety analysis report and as approved in the safety evaluation, dated March 31, 1992. Updated Final Safety Analysis Report, Appendix 9A, Fire Protection Program, Section 9A.1.D, specified that the fire protection program is defined in the 1978 and 1988 Appendices A and R, Fire Protection Safety Evaluation Reports. Updated Final Safety Analysis Report, Section 9.8.3.1.9, Test Control, specifies that a test program is to be established and implemented to ensure that testing is performed and verified on applicable systems and components to demonstrate conformance with design and system readiness requirements. The tests are to be performed in accordance with written test procedures and test results evaluated for conformance to the test objectives. Unit 1 Technical Requirements Manual, Test Requirement TR 3.7.8.13, specified, Perform a fire water system flow test in accordance with the NFPA published Fire Protection Handbook, 14th Edition, Chapter 5, Section 11, every 3 years.

Unit 2 License Condition 2.C.(3)(b) specifies, in part, Entergy Operations, Inc., shall implement and maintain in effect all provisions of the approved fire protection program that comply with 10 CFR 50.48(a) and 10 CFR 50.48(c), as specified in the license amendment request, dated December 17, 2012, and as approved in the safety evaluation, dated February 18, 2015. Entergy Operations, Inc., letter 2CAN121202, License Amendment Request to Adopt NFPA-805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (2001 Edition)

Arkansas Nuclear One - Unit 2, dated December 17, 2012, Attachment A, NEI 04-02 Table B-1, Transition of Fundamental Fire Protection Program & Design Elements, described the fire protection program requirements.

Table B-1, Section 3.5.13, specifies, Headers fed from each end shall be permitted inside buildings to supply both sprinkler and standpipe systems. Where provided, such headers shall be considered an extension of the yard main system. Unit 2 Technical Requirements Manual, Test Requirement 4.7.1.13, specified, Once every 3 years, perform a fire water system flow test in accordance with the NFPA published Fire Protection Handbook, 14th Edition, Chapter 5, Section 11.

Procedure 1104.032, Supplement 10, 3 Year Fire Water System Flow Test, is intended to demonstrate functionality of the fire suppression water system by performing a flow test of the system in accordance with the NFPA Fire Protection Handbook for both Units 1 and 2.

Fire Protection Handbook, 14th Edition, Chapter 5, Section 11, specified, in part that the flow test was conducted to identify faults in the system such as mispositioned valves, broken valves, or foreign material in the fire mains, et cetera.

Contrary to the above, from original installation through June 24, 2016, the licensee had not implemented and maintained in effect all provisions of their approved fire protection program in that their flow test procedure had not flow tested all underground piping headers that supplied the buildings that contained post fire safe shutdown equipment as designed. Specifically, the licensee had not tested two underground main headers that provided flow to the ring header supplying the Unit 2 auxiliary building.

Because this violation was of very low safety significance and has been entered into the corrective action program as Condition Report CR-ANO-C-2016-02613 and the licensee initiated actions to correct the procedure and perform the flow test, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000313;05000368/2016009-01, Inadequate Loop Flow Testing.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed a plant walkdown and reviewed documents to verify that one success path necessary to achieve and maintain the nuclear safety performance criteria would be maintained free of fire damage by a single fire. Specifically, the team verified:

• A fire in one of the selected fire areas would not indirectly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage the success path necessary to achieve and maintain the nuclear safety performance criteria.

• A fire in one of the selected fire areas that may result in the use of a manually activated fire suppression system would not indirectly cause damage to the success path necessary to achieve and maintain the nuclear safety performance criteria.

• The inadvertent actuation of an automatic or manual fire suppression system or the rupture of a fire suppression system would not indirectly cause damage to the success path necessary to achieve and maintain the nuclear safety performance criteria.

• Adequate drainage was provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Shutdown from a Primary Control Station

a. Inspection Scope

Review of Methodology The team reviewed the nuclear safety capability assessment, procedures, piping and instrumentation drawings, electrical drawings, and other supporting documents to verify that the licensee can achieve and maintain safe and stable plant conditions from the primary control station in the event a fire required evacuation of the control room.

The team verified that the nuclear safety capability assessment properly identified the components and systems necessary to meet the nuclear safety performance criteria for the fire area selected. Specifically, the team determined the adequacy of the systems selected to meet the criteria for reactivity control, inventory and pressure control, decay heat removal, vital auxiliaries, and process monitoring. For the primary control station, which was analyzed using a performance-based approach, the team verified that the analysis included a consideration of all the necessary cables and equipment associated with operation and control of both AC and DC power supplies.

The team verified that the transfer of command and control from the control room to the primary control station would be unaffected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for shutdown control circuits).

Review of Operational Implementation The team verified that the training program for licensed and non-licensed operators included the procedures for achieving and maintaining safe and stable plant conditions, including any necessary recovery actions. The team also verified that sufficient personnel required to achieve and maintain safe and stable plant conditions were properly trained and were available at all times among the normal on-site staff, exclusive of the fire brigade.

The team performed a timed walkdown of Unit 2, Procedure 2203.014, Alternate Shutdown, Revision 31, with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified that the recovery actions taken were feasible and that operators could reasonably be expected to implement the procedure within the applicable time requirements to achieve the nuclear safety performance criteria. The team evaluated the feasibility of the recovery actions using the criteria established in the licensees approved fire protection program.

The team also verified that the licensee conducted periodic operational tests of the transfer and isolation capability and instrumentation and control functions used for transferring control from the main control room to the primary control station and other locations where recovery actions would be performed. The team verified that the tests were adequate to prove the functionality of the primary control stations capability to meet performance criteria and achieve and maintain safe and stable plant conditions.

b. Findings

No findings were identified.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the nuclear safety capability assessment to verify that the licensee identified the circuits required for nuclear safety functions and protected these circuits in accordance with the deterministic approach or provided an appropriate level of protection based on the results of an analysis using an acceptable risk-informed, performance-based approach. The team verified, on a sample basis, that the licensee properly identified circuits that may impact the nuclear safety performance criteria. The team verified that these circuits were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not affect the capability to meet the nuclear safety performance criteria. The team verified that the licensees analyses considered potential spurious operations due to fire-induced cable faults.

The teams evaluation focused on the cables of selected components from the reactor coolant system, the credited charging pump, the pressurizer power-operated relief valves, emergency diesel generator, 125Vdc system, and the credited motor-driven auxiliary feedwater pump. For the sample of components selected, the team reviewed process and instrumentation drawings and electrical elementary and block diagrams, and the team identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis.

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the procedure for shutdown from outside of the control room to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting provided, both in fixed and portable form, along access routes and egress routes and at control stations, plant parameter monitoring locations, and recovery action locations. The team verified that the emergency lighting was adequate for operators to perform the required recovery actions during a walkdown of the procedure for shutdown from outside of the control room.

Specifically, the team verified:

• The distribution system contained protective devices so that a fire in the area will not cause a loss of emergency lighting in any unaffected area needed to achieve and maintain safe and stable plant conditions.

• The battery power supplies had a capacity sufficient to support recovery actions necessary to meet the nuclear safety performance criteria.

• The illumination was sufficient for operators to perform the required recovery actions for a shutdown from outside the control room.

• The operability testing and maintenance of the emergency lighting followed licensee procedures and accepted industry practice.

• The emergency lighting batteries were maintained consistent with the manufacturers recommendations.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team determined that the licensee did not credit cold shutdown repairs to meet the nuclear safety performance criteria. The team reviewed the nuclear safety capability assessment and interviewed licensee personnel and determined that the licensee does not require transitioning to cold shutdown to achieve a safe and stable plant condition.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and success path equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing nuclear safety functions or capabilities for meeting performance criteria) necessary to achieve and maintain safe and stable plant conditions. The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

Multiple variations from deterministic requirement identified during the development of the risk-informed, performance-based fire protection program will require modifications to resolve. License Condition 2.C.(3)(b), Fire Protection, discusses the transition period. Modifications required for implementation must be completed prior to startup from the second refueling outage following issuance of the safety evaluation.

The license condition states, The licensee shall maintain appropriate compensatory measures in place until completion of the modifications. Compensatory measures in place at Unit 2 consist of hourly fire watches and continued use of the post fire safe shutdown procedures developed under the previous fire protection program. The team generally found the compensatory measures to be adequate. The team did identify an example of a procedure which did not provide an adequate compensatory measure as discussed in finding below.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(3)(b), Fire Protection, for the use of an inadequate procedure as a compensatory measure. Specifically, the procedure for providing temporary cooling to the safety parameter display system room when the normal room cooler is unavailable did not adequately address the impact of the temporary configuration on the ability to maintain safe and stable plant conditions for fires that require shutdown from outside the control room. The temporary room cooler did not have a power supply assured to remain available during a shutdown from outside the control room.

Description.

License Amendment 300, issued on February 18, 2015, authorized the transition of the Unit 2 fire protection program to a risk-informed, performance-based program based on National Fire Protection Association Standard 805. License Condition 2.C.(3)(b), Fire Protection, discusses the transition period. Modifications required for implementation must be completed prior to startup from the second refueling outage following issuance of the safety evaluation. The license condition states, The licensee shall maintain appropriate compensatory measures in place until completion of the modifications.

Unit 2 will remain in the transition period until startup from the next scheduled refueling outage at which time the unit must be in compliant with the approved risk-informed, performance-based program. To maintain an adequate level of fire protection until the new program is in place correcting the identified deficiencies (i.e. variations from deterministic requirements), Unit 2 is using the procedures developed under the previous fire protection program, hourly fire watches and supplemental standing orders as a suite of compensatory measures.

For fires requiring evacuation of the Unit 2 control room, Procedure 2203.014, Alternate Shutdown, requires the shift manager to evacuate from the control room to the technical support center and monitor plant parameters using the Alternate Shutdown display on the safety parameter display system. Procedure 2203.014, Section 9, ASDO Follow-Up Actions, requires shifting electrical power for safety parameter display system room cooler (2VUC-30) to Unit 1. The safety parameter display system room cooler is a required support system during alternative shutdown scenarios.

Procedure 2015.014, Safety Parameter Display System Operation, Attachment F, T-Mod [temporary modification] for SPDS [safety parameter display system] Computer Room Temporary Cooler, is used to maintain safety parameter display system room cooling when the normal room cooler is out of service. During a plant walkdown on June 7, 2016, the team identified that when the normal room cooler is out of service, Section 9 of Procedure 2203.014 cannot be performed. The temporary room cooler was connected to a power supply in the Unit 2 turbine building, which was not analyzed to be available during an alternate shutdown of Unit 2. Without the temporary cooler in operation, the safety parameter display system room temperature would rise significantly, challenging the reliability of the safety parameter display system computer components. Procedure 2015.014 did not establish any compensatory measure identifying a reliable power supply for the temporary room cooler during an alternate shutdown of Unit 2.

Procedure 2015.014 addressed the loss of the safety parameter display system and required designating three operators in each unit to monitor available instrumentation in the plant. The team noted this compensatory measure was not established when the temporary cooler was installed and was concerned that the additional personnel might not be available or able to respond quickly enough should the safety parameter display system fail during a control room evacuation due to fire. The team was also concerned that the instrumentation monitored in the plant may not be isolated electrically from the fire areas requiring evacuation of the control room and could be subject to fire damage.

The licensee entered this issue into their corrective action program as Condition Reports CR-ANO-2-2016-02143 and CR-ANO-C-2016-02638. In response to this issue, the licensee developed a thermal analysis of the safety parameter display system room temperature during this scenario and confirmed that the maximum room temperature would not challenge the operation to the safety parameter display system.

Analysis.

The failure to provide an adequate procedure for use as a compensatory measure was a performance deficiency. The performance deficiency was more than minor because it was associated with the Mitigating Systems cornerstone attribute of procedure quality and adversely affected the associated cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. Specifically, the loss of cooling to safety parameter display system room could adversely affect the availability, reliability, and capability of the safety parameter display system which is required to respond to a fire resulting in the evacuation of the Unit 2 control room.

The finding was screened in accordance with IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012.

Because the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire, the team reviewed the finding using IMC 0609, Appendix F, 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. A senior reactor analyst performed detailed risk evaluation of this finding because inspection Manual Chapter 0609, Appendix F, does not include explicit treatment of fires in the control room. An evaluation of the survivability of the safety parameter display system compared to the best estimate of the heatup of the room housing its equipment demonstrated that the safety parameter display system would survive with high probability until the plant reached a safe and stable condition for the postulated fires. As a result, the finding was determined to be of very low safety significance (Green).

This finding did not have a cross-cutting aspect since it was not indicative of current performance in that the performance deficiency occurred more than three years ago.

Enforcement.

License Condition 2.C.(3)(b), Fire Protection, authorized the transition of the Unit 2 fire protection program to a risk-informed, performance-based program based on NFPA 805. Item number 2 in the Transition License Condition section of the license condition states, The licensee shall implement the modifications to its facility, as described in Table S-1, Plant Modifications, Attachment 5, of Entergy Operations, Inc.,

letter 2CAN081401, dated August 7, 2014, prior to startup from the second refueling outage following issuance of the safety evaluation, and, the licensee shall maintain appropriate compensatory measures in place until completion of the modifications.

Contrary to the above, from February 18, 2015, to June 24, 2016, the licensee failed to maintain an appropriate compensatory measure for a required support system as required by License Condition 2.C.(3)(b). Specifically, the licensees procedures for a temporary safety parameter display system room cooler being used instead of the normal room cooler did not adequately address and compensate for the potential impact on achieving and maintaining safe and stable plant conditions should the control room require evacuation due to fire.

Because this violation was of very low safety significance and has been entered into the corrective action program, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy:

NCV 05000368/2016009-02, Inadequate Procedure Used as a Compensatory Measure.

.11 Radiological Release

a. Inspection Scope

The team verified that the licensee provided reasonable assurance that a fire would not result in a radiological release that adversely affects the public, plant personnel, or the environment. The team also verified that the licensee evaluated that any radiation release to any unrestricted area resulting from fire suppression activities (but not involving fuel damage) were as low as reasonably achievable and would not exceed applicable 10 CFR Part 20 limits. The team verified that the licensee analyzed the radioactive release on a fire area basis. The team walked down the selected fire zones and verified that the pre-fire plan tactics and instructions were consistent with the potential radiological conditions identified in the analyses.

b. Findings

No findings were identified.

.12 Non-Power Operations

a. Inspection Scope

The plant did not enter an outage during the inspection. However, the team verified that the licensee performed the following activities:

• Defined higher risk evolutions that are performed during outages.

• Defined the key safety functions required to maintain the plant in a safe and stable condition during non-power operational modes.

• Performed the nuclear safety capability assessment during non-power operations and defined specific pinch points where one or more key safety functions could be lost.

• Established additional fire protection defense-in-depth actions to be taken during higher risk evolutions in the locations of the pinch points where key safety functions could be lost.

b. Findings

No findings were identified.

.13 Monitoring Program

a. Inspection Scope

The team verified that the licensee established a monitoring program to ensure that the availability and reliability of the fire protection systems, structures, and components credited in the performance-based analyses are maintained and to assess the performance of the fire protection program in meeting the nuclear safety performance criteria. The team verified that the monitoring program ensured the assumptions in the engineering analysis remain valid. The team also verified that the licensee was maintaining acceptable levels of availability, reliability, and performance per its license condition. When the established levels of availability, reliability, and performance were not met, the team verified that the licensee took appropriate corrective actions to return fire protection systems and features to the established acceptable levels.

b. Findings

Introduction.

The inspectors identified a Green non-cited violation of License Condition 2.C(3)(b), Fire Protection, for the failure to establish an appropriate monitoring program in accordance with NFPA 805, Section 2.6. Specifically, the licensee failed to set the action level for the availability of some plant components to ensure that the assumptions in the engineering analysis remained valid and also failed to establish a monitoring plan for the concurrent unavailability of one set of two components.

Description.

The inspectors reviewed selected samples of equipment monitored by the licensee using Procedure EN-DC-357, NFPA 805 Monitoring Program, Revision 0, to ensure that the licensees program properly implemented the requirements of NFPA 805, Section 2.6. The inspectors also reviewed implementing Calculation, Calculation ANO2-FP-15-00001, NFPA 805 Monitoring Program: Scoping, Revision 0, Calculation ANO2-FP-15-00002, NFPA 805 Monitoring Program Phase 2: Screening Using Risk Criteria and Phase 3: Risk Target Value Determination, Revision 0, and Modification EC 57365, Unit 2 NFPA 805 Monitoring Program, Revision 0.

Licensee letter 2CAN121202, License Amendment Request to Adopt NFPA-805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants (2001 Edition), Arkansas Nuclear One - Unit 2, dated December 17, 2012, contained Attachment S, Plant Modifications and Items to be Completed During Implementation. Table S-2 of Attachment S contained items (procedure changes, process updates, and training to affected plant personnel) that were committed to be completed prior to the implementation of the new NFPA 805 fire protection program and included Item S2-1, Develop a monitoring program required by NFPA 805 that will include a process to monitor and trend the fire protection program based on specific goals established to measure effectiveness. Section 4.6 Monitoring Program, of licensee letter 2CAN121202 stated, The monitoring program will be implemented after issuance of the Safety Evaluation, as part of the Fire Protection Program transition to NFPA 805. In order to assess the impact of the transition to NFPA 805 on the current monitoring program, the ANO Fire Protection Program documentation, such as the maintenance program processes, Fire Protection Program implementing procedures, and plant change processes will be reviewed. Sections 4.5.3 and 5.2 of NEI 04-02, as clarified in the NRC approved version of FAQ 10-0059, will be used during the review process.

Frequently Asked Question 10-0059, NFPA 805 Monitoring, Revision 5, stated in the Details Section, Item 3, Action level threshold - When establishing the action level threshold for reliability and availability, the action level should be no lower than the fire PRA [probabilistic risk assessment] assumptions.

In establishing the monitoring program for startup transformer 3, emergency diesel generators 2K-4A and 2K-4B, station batteries 2D-11 and 2D-12, the Unit 2 auxiliary feedwater pump, and train B of the Unit 2 emergency feedwater system, the licensee opted to use their maintenance rule program as the monitoring program. The following table compares the maintenance rule program allowable availability and the fire probabilistic risk assessment basic event for test and maintenance unavailability of these components.

Maintenance Rule Program Fire Probabilistic Risk Component(s) Allowable Availability Assessment Unavailability Startup Transformer 3 4.11E-3 1.16E-3 Emergency Diesel 4.0E-2 8.83E-3 Generators 2K-4A and 2K-4B Batteries 2D-11 and 1.0E-3 6.54E-5 2D-12 Auxiliary Feedwater 1.0E-2 2.23E-3 Pump Emergency Feedwater 1.0E-2 2.12E-3 System Train B Therefore, the action levels for availability in the monitoring program were greater than the assumptions in the fire probabilistic risk assessment. For example, the action level for the enhanced monitoring of an emergency diesel generator represented at 526 hours0.00609 days <br />0.146 hours <br />8.69709e-4 weeks <br />2.00143e-4 months <br /> per year, using the levels in the maintenance rule program, as compared to 116 hours0.00134 days <br />0.0322 hours <br />1.917989e-4 weeks <br />4.4138e-5 months <br /> of unavailability in the fire probabilistic risk assessment.

Also in their review, the inspectors noted basic event KTM2CHCP7B, Concurrent test and maintenance of charging pump 2P-36C and emergency feedwater Pump 2P-7B, was in a cut-set which was in the top 90 percent of cut-sets comprising core damage frequency. Through discussion with the licensee, the inspectors discovered that the licensee was not monitoring the concurrent unavailability of these two components.

The inspectors considered this to be another example of inadequate monitoring.

Analysis.

The failure to adequately monitor unavailability of the plant components to ensure that the assumptions in the engineering analysis remained valid was a performance deficiency. The performance deficiency was more than minor because if left uncorrected, the performance deficiency had the potential to lead to a more significant safety concern. Specifically, the performance deficiency could adversely affect the acceptable level of availability of the components which are used to respond to fire initiating events, in that the action levels for availability in the monitoring program were greater than the assumptions in the fire probabilistic risk assessment.

The finding was screened in accordance with IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012.

Because the finding affected the ability to reach and maintain safe shutdown conditions in case of a fire, the team reviewed the finding using IMC 0609, Appendix F, 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. The finding was screened as a Green finding of very low safety significance in accordance with Step 1.3, Ability to Achieve Safe Shutdown, B Question. Based on the criteria in Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, dated February 28, 2005, the finding was assigned a low degradation rating. Using Table A2.3, the inspectors considered the low degradation rating because the issue involved monitoring of components that did not appreciably degrade below acceptable levels during the exposure period.

This finding had a cross-cutting aspect associated with change management within the human performance area since leaders did not use a systematic process (e.g., assigning an overall owner) for evaluating and implementing change during the development of the monitoring program for the fire probabilistic risk assessment model for Unit 2 (H.3).

Enforcement.

License Condition 2.C(3)(b), Fire Protection, states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program that comply with 10 CFR 50.48(a) and 10 CFR 50.48(c), as specified in the license amendment request, dated December 17, 2012, and supplements, dated November 7, 2013; December 4, 2013; January 6, 2014; May 22, 2014; June 30, 2014; August 7, 2014; September 24, 2014; and December 9, 2014, and as approved in the safety evaluation, dated February 18, 2015. The approved fire protection program is a risk-informed, performance-based program in accordance with NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, 2001 Edition (NFPA 805), incorporated by reference into 10 CFR 50.48(c). Standard NFPA 805, Section 2.6, Monitoring, states that, Monitoring shall ensure that the assumptions in the engineering analysis remain valid.

Contrary to the above, from February 18, 2015, to June 22, 2016, the licensee failed to appropriately monitor plant equipment to ensure that the assumptions in the NFPA 805 engineering analysis remained valid. Specifically, the licensees monitoring program did not monitor the availability of startup transformer 3, emergency diesel generators 2K-4A and 2K-4B, station batteries 2D-11 and 2D-12, the auxiliary feedwater pump, and train B of the emergency feedwater system to ensure that it was no lower than the fire probabilistic risk assessment assumptions. Additionally, the licensee failed to ensure that concurrent unavailability of the Unit 2 charging pump C and motor driven emergency feedwater pump were monitored.

Because the finding was of very low safety significance (Green), was entered into the licensees corrective action program as Condition Report CR-ANO-2-2016-2355 and was in the process of developing corrective actions to address the monitoring of the components and work with industry organizations and the NRC Office of Nuclear Reactor Regulation to determine long-term resolution. This finding is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement policy. This finding is identified as NCV 05000368/2016009-03, Failure to Ensure that the Assumptions in the Engineering Analysis Remain Valid.

.14 Plant Change Evaluation

a. Inspection Scope

The team reviewed plant change evaluations to verify that, where performance-based methods were applied, the methods adequately represented plant design and conditions in the fire area, were performed by qualified people, were acceptable for the application, and met the requirements of the fire protection license condition for self-approved changes to the fire protection program. Additionally, the inspectors reviewed the governing procedures related to engineering changes and the requirements for performing plant change evaluations.

The team sampled the following changes:

• EC-22985, ANO-2 Unit Auxiliary Transformer 2X-02 Replacement.

• EC-29712, ANO-2 Sullair Compressor 2C-43 Replacement.

• EC-31123, Replacement of 2P-32D Reactor Coolant Pump Motor with Refurbished Motor.

• EC-32417, Install Unloader Solenoid Valve and Timer for the 2C-7 Starting Air Compressor.

b. Findings

Introduction.

The inspectors identified two examples of a Severity Level IV non-cited violation of License Condition 2.C(3)(b), Fire Protection, for the licensees failure to properly implement their risk-informed fire protection program and accurately identify component ignition frequencies in their fire probabilistic risk assessment. Specifically, the component ignition frequencies for air compressors and ventilation equipment were found to be non-conservative compared to the NRC approved guidance.

Description.

The inspectors reviewed the ignition frequency data in Calculation PRA-A2-05-013, ANO2 Fire Probabilistic Risk Assessment Plant Partitioning and Fire Ignition Frequency, Revision 0. Upon review of the ignition frequency for air compressors, the inspectors noted that the ignition frequency for air compressors was approximately 10 times lower (with a value of 4.56E-4/year) than the generic fire frequency for air compressors outlined in NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities, (which had a value of 4.65E-3/year).

Step 6.5.3, Plant Specific Updates of Generic Fire Ignition Frequencies, of NUREG/CR-6850 allows the licensee to perform a Bayesian update to the generic data, but the inspectors noted that the factor of 10 difference could not be explained solely to a Bayesian update with the plant historical data from the plant which was listed in the calculation. The licensee explained that an error was caused by an improper parameter for the distribution for the fire ignition frequency for the air compressors being provided in generic data in NUREG/CR-6850. In a September 1, 2009, NRC memorandum, Closure of NFPA 805 Frequently Asked Question 08-0048 Revised Fire Ignition Frequencies, the NRC noted that the alpha factor for the ignition frequency distribution of air compressors was potentially in error and stated that, Note also that a sensitivity analysis need not be performed for Bin 9 (Air Compressors); the alpha value in Table 2-2 of EPRI 1016735 appears to be in error, in Footnote 1.

The licensees contractor for fire probabilistic risk assessment model development used the erroneous alpha factor while performing the Bayesian update even though the footnote had been provided to bring attention to the error. The inspectors considered the lack of checking of the validity of the results of the Bayesian update and subsequent use to be within the realm of control of the licensee. This use of this lower fire ignition frequency provided a lower estimate of core damage frequency and large early release frequency for the scenarios originating from air compressor fires and ultimately provided lower total core damage frequency and large early release frequency baseline estimates.

• For the second example, when doing a plant walkdown, the inspectors observed Unit 1 exhaust fans VEF-3A and VEF-3B along with Unit 2 exhaust fans 2VEF-3A and 2VEF-3B. The motors for these fans were 5 horsepower. Section 6.5.6, Fixed Fire Ignition Source Counts, of NUREG/CR-6850, instructed licensees for Bin 26 - Ventilation Subsystems: Do not count ventilation fans if the drive motor is 5 horsepower or less. The inspectors then reviewed Calculation PRA-A2-05-003, ANO-2 Fire Scenario Report, Revision 1, for the site and discovered that these exhaust fans were counted as ignition sources when they should not have been. The licensee entered this condition into their corrective action program, as Condition Reports CR ANO-C-2016-2600, CR-ANO-C-2016-2528, and CR-ANO-2-2016-02356, with the intent to perform an extent of condition relating to other potential components that are misclassified in the fire ignition frequency analysis. Correct the Fire Ignition Frequency Report and the associated Fire Probabilistic Risk Assessment model calculations to incorporate the correct ignition frequency and the appropriate scenarios.

These motors were counted as ignition sources in the ventilation subsystem bin. The ventilation subsystem was assigned a plant-wide frequency which is divided by the number of subsystems and/or fans. By having additional ignition sources count when they should not have, the individual fire ignition frequency for a given ventilation subsystem component was erroneously low because the plant-wide number was divided by an erroneously larger number of components. This miscalculation produced low final core damage frequency and large early release frequency estimates for the probabilistic risk assessment. A counter-balancing effect was that the fire scenarios which were previously counted in the estimates would have to be removed from consideration. The inspectors reviewed these scenarios and qualitatively assessed that the overall effect would be that the risk metric estimates would be erroneously low. Also, the inspectors considered that the extent of condition for counting 5 horsepower motors as ignition sources had the potential to affect other ignition frequency source bins (e.g., Bin 14 -

Electric Motors and Bin 21 - Pumps) prescribed in the methodology in NUREG/CR-6850, which would also further provide erroneous probabilistic risk assessment results.

These ignition source errors affected Unit 1 also, whose license amendment request for transition to a risk-informed fire protection program is currently under review. The inspectors informed reviewers from the Office of Nuclear Reactor Regulation of the discrepancies. Section 1.5.3, Incomplete/Inaccurate Information in the Licensing Process, of the NRC Enforcement Manual describes that generally no enforcement action is taken for inaccurate or incomplete information submitted in the licensing process, but the NRC has the authority to do so on a case-by-case basis if a particular submission warrants such action. The inspectors considered that, because the licensee entered this condition into their corrective action program, as Condition Reports CR ANO-C-2016-2600, CR-ANO-C-2016-2528, and CR-ANO-2-2016-02356, and planned to correct the information, enforcement was not warranted for Unit 1.

Analysis.

The licensees failure to adequately implement the prescribed guidance in NUREG/CR-6850 to estimate the ignition frequencies for their risk-informed fire protection program was a performance deficiency. The performance deficiency was minor because the answer to all the IMC 0612, Appendix B, more than minor questions was No. The team determined that this issue was a traditional enforcement violation because it impacted the regulatory process when the only NRC-approved framework for conversion to NFPA 805 was not fully followed. The NRC determined that this violation was associated with a minor performance deficiency. The team determined that this violation was a Severity Level IV in the traditional enforcement process when comparing it to the violation examples in Section 6.1, Reactor Operations, of the NRC Enforcement Policy, specifically noting it was similar to Example 6.1.d.4 for failing to adequately assess the baseline risk of plant operations associated with implementation of a risk-informed program (NFPA 805) such that the program was implemented inappropriately. The finding did not have a cross-cutting aspect because traditional enforcement violations are not assessed for cross-cutting aspects.

Enforcement.

License Condition 2.C(3)(b), Fire Protection, states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program that comply with 10 CFR 50.48(a) and 10 CFR 50.48(c), as specified in the license amendment request dated December 17, 2012, and supplements, dated November 7, 2013; December 4, 2013; January 6, 2014; May 22, 2014; June 30, 2014; August 7, 2014; September 24, 2014; and December 9, 2014, and as approved in the safety evaluation, dated February 18, 2015.

As noted in the licensee safety analysis report, the licensee approved methodology for implementation of a fire protection program which complies with 10 CFR 50.48(a) and 10 CFR 50.48(c) is with the methodology specified in NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities. NUREG/CR-6850

(1) states in Section 6.5.3, Plant Specific Updates of Generic Ignition Frequencies, the generic bin frequencies can be updated using Bayesian approach and

(2) states in Section 6.5.6, Fixed Fire Ignition Source Counts, for Bin 26 - Ventilation Subsystems, Do not count Ventilation fans if the drive motor is 5 horsepower or less.

Contrary to the above, during the transition to their risk-informed fire protection program to June 24, 2016, the licensee failed to properly implement the prescribed methodologies. Specifically, the licensee did not

(1) adequately perform a Bayesian update to obtain a proper plant-wide ignition frequency for air compressors and

(2) exclude all applicable 5 horsepower motors in the tabulation of the ignition frequency for ventilation subsystems. Because the finding was of very low safety significance (Green), and was entered into the licensees corrective action program as Condition Reports CR-ANO-C-2016-2600 and CR-ANO-C-2016-2528, this finding is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy.

This finding is identified as NCV 05000368/2016009-04, Failure to Adequately Establish Ignition Frequencies for the Risk-Informed Fire Protection Program.

.15 Alternative Mitigation Strategy Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by 10 CFR 50.54(hh)(2).

The team verified that the licensee maintained and implemented adequate procedures, maintained and tested equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the off-site ability to obtain fuel for the portable pump and foam used for firefighting efforts. The strategies and procedures selected for this inspection sample included:

• Manually depressurize SGs using portable pump.

• Flood containment.

b. Findings

No findings were identified.

.16 Implementation of Risk-Related Implementation Items

a. Inspection Scope

The team verified that the licensee appropriately implemented risk-related items in the establishment and early operation of their NFPA 805 program. This review included the risk management policy for fire brigade emergency response, upgraded fire human reliability analysis methods, alternate steam generator level monitoring methods, and incorporation of revised fire risk methods in the fire probabilistic risk assessment. The team also reviewed the licensees integration of multi-compartment scenarios into the base fire probabilistic risk assessment. Finally, the team reviewed the licensees probabilistic risk assessment to ensure the basic event data in the fire probabilistic risk assessment matched the internal events probabilistic risk assessment basic events, which included a verification of multiple spurious operation and human reliability analysis treatment.

The team sampled the following alternate methods to ensure that the licensee appropriately replaced them with approved methods:

• Pump Frequency Apportioning The licensee based apportioning on pump runtime to account for lower usage with standby pumps. Standard NFPA 805 suggested apportioning on pump count alone. The licensee had performed sensitivity studies using pump count apportioning. Acceptable results were achieved.

• Diesel Generator Fire Treatment The licensee assumed that most fires occur during surveillance testing.

Therefore, it was assumed that an operator would be physically stationed in the room. This artificially improved manual suppression credit. Standard NFPA 805 suggested that surveillance testing is indicative of demand runs and likely will not have manual suppression. The licensee had performed sensitivity indicated studies indicating that the acceptance criteria were still met.

• Use of Draft Frequently Asked Question 08-0050.

The licensee indicated there was no change to their conclusions given implementation of the final frequently asked question.

• Electrical Cabinet Generic Severity Factor.

The licensee assumed that 10 percent of fires will damage targets external to the cabinet. However, the acceptance criteria were still met when the severity factor was set to 1.0.

b. Findings

No findings were identified.

.17 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees approved fire protection program, implementing procedures, and programs for the control of ignition sources and transient combustibles.

The team assessed the licensees effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis. The team performed plant walk downs to independently verify that transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

No findings were identified.

==4OA3

4OA3 Follow up of Events and Notices of Enforcement Discretion

==

.1 (Closed) Licensee Event Report 05000368/2014-005-00: Unfused Direct Current

Control Cables for Their Direct Current Turbine Lube Oil Pump This licensee event report documented the licensee identified fire vulnerabilities caused by unfused direct current (DC) control cables. The licensee determined that the non-safety related 125 volts DC control center for the Unit 2 turbine generator emergency seal oil pump did not have circuit protection as described in Generic Letter 81-12 (Fire Protection Rule) as an associated circuit for common enclosures. The licensee routed these cables in several fire zones that contained equipment relied upon to achieve and maintain safe and stable conditions. Without protection, the licensee determined that the potential for secondary fires or cable failures exceeded the design assumptions of their Appendix R Safe Shutdown

Analysis.

The licensee documented the issue in Condition Report CR ANO-2-2014-02857. As an immediate corrective action, and as a compensatory measure, the licensee established roving fire watches in the fire areas containing the circuits. The licensee developed Engineering Change, EC-58268, which will provide permanent protection by installing control power fuses on the turbine generator emergency seal oil pump control circuit.

Each control power fuse will have an easily recognizable indicating light installed on the front panel of the local motor control center to allow personnel to determine if either fuse is blown. The licensee plans to install the design change in the spring of 2017 during the Unit 2 outage.

The team performed a detailed review of the information in this license event report, the condition report, design documents, and drawings related to the planned circuit modifications. The team discussed the issue with plant personnel to gain an understanding of the actions taken to address the issue. The team determined the modification will correct the deficiency. The team verified that the licensee established appropriate compensatory measures, corrective actions, and planned modifications.

No violation of NRC requirements were identified.

Findings No findings were identified.

4OA5 Other Activities

The team reviewed the following items identified during a previous inspection:

• Low diesel fire pump lube oil pressure.

• High diesel fire pump fuel oil pressure.

• Backlog of fire protection work orders.

• Condition of fire protection piping.

• Quality of the abnormal operating procedure (alternate shutdown procedure).

The team determined that the licensee had scheduled overhaul of their diesel fire pump engine because of the decreasing trend in lube oil pressure. The licensee determined that they had been performing the fuel oil test on the operating diesel engine when the test was designed as a bench test.

The team determined that the licensee had maintained the schedule for working down the backlog and had incorporated administrative changes to ensure work orders for fire protection equipment that protected post fire safe shutdown equipment would not receive the lowest priorities from the work management process.

The team determined that the licensee had initiated corrective actions in 2012 to replace the fire water piping most susceptible to microbiologically induced corrosion. In addition, the licensee has established a long-range plan to replace piping based on available resources and funds. The licensee had established discreet batches and targeted fiscal years to get the funding approved. At the time of the inspection the licensee had begun fabricating the piping that would be replaced in 2016. The team confirmed that the licensee had captured this operating experience in license renewal documents was well aware of this aging mechanism. The team determined that the licensee had implemented appropriate corrective actions.

The team reviewed the quality of the alternate shutdown procedure as a sample of an abnormal operating procedure. The team determined that the procedure appropriately used cautions and notes to alert the operators without providing actions to the operators.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. B. Gordon, Acting General Manager, and other members of the licensee staff at an exit meeting on June 24, 2016. The licensee acknowledged the findings presented.

The team verified that no proprietary information was retained by the team or documented in this report.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

B. Bayer, Manager, Maintenance

D. Bice, Senior Specialist, Licensing

B. Bordon, Projects

J. Browning, Site Vice President

P. Butler, Manager, Project Engineering

T. Chernivec, Manager, Production

J. Couch, Coordinator, PI Department

C. Couser, Lead Engineer, Fire Protection

B. Davis, Director, Engineering

B. Gordon, Acting General Manager

J. Hall, Probabilistic Risk Analyst

T. Hamilton, Operations, Waste Water Controls

C. Heinzen, Engineer, Fire Protection

G. Hudnall, Manager, Performance Improvement

D. James, Director, Recovery

J. Key, Operations, Simulations Unit 1

R. Knight, Shift Manager, Unit 2

J. Matt, Engineer, Fire Protection

M. McGill, Engineer, Fire Protection

B. Nong, Engineer, Fire Protection, Diablo Canyon

D. Pehrson, Senior Manager, Operations

D. Perkins, Manager, Operations

S. Pyle, Manager, Regulatory Assurance

K. Royal, WCO and Fire Brigade Instructor

T. Sherri, Assistance Manager, Maintenance

M. Skartvedt, Manager, Systems Engineering

W. Smith, Engineer, Fire Protection

G. Sullins, Director, Regulatory Assurance and Performance Improvement

J. Taylor, Nuclear Safety Culture Assessment/Nuclear Plant Operator, Safe Shutdown

C. Walker, Supervisor, Design Engineering

L. Weatherall, Fire Marshall

G. Woerner, Assistant Manager, Design Engineering

L. Young, Site Project Lead, NFPA 805

NRC Personnel

B. Tindell, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000313;

05000368/ NCV Inadequate Loop Flow Testing 2016009-01

05000368/2016009-02 NCV Inadequate Procedure Used as a Compensatory Measure

05000368/2016009-03 NCV Failure to Ensure that the Assumptions in the Engineering Analysis Remain Valid

05000368/2016009-04 NCV Failure to Adequately Establish Ignition Frequencies for the Risk-Informed Fire Protection Program