IR 05000424/2010006

IR 05000424-10-006 & 05000425-10-006; Southern Nuclear Operating Company, Inc; on 08/2-6/2010 - 08/16-20-2010; Vogtle Electric Generating Plant, NRC Inspection Report and NRC Triennial Fire Protection and Temporary Instruction

ML110900693
Person / Time
Site:	Vogtle
Issue date:	03/30/2011
From:	Nease R NRC/RGN-II/DRS/EB2
To:	Tynan T Southern Nuclear Operating Co
References
IR-10-006
Download: ML110900693 (38)

Text

UNITED STATES rch 30, 2011

SUBJECT:

VOGTLE ELECTRIC GENERATING PLANT - NRC TRIENNIAL FIRE PROTECTION AND TEMPORARY INSTRUCTION 2515/181 REPORT 05000424/2010006 AND 05000425/2010006

Dear Mr. Tynan:

On August 20, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed inspections at Vogtle Electric Generating Plant, Units 1 and 2. In addition to the triennial fire protection inspection results, this inspection report also documents the results of an inspection performed in accordance with Temporary Instruction (TI) 2515/181, Validate the Effectiveness of the Regulatory Infrastructure Related to Fire Induced Circuit Failures and Operator Manual Actions.

The results of these inspections were discussed on August 20, 2010, with Mr. R. Dedrickson, Plant Manager, and other members of your staff. As a result of post-inspection analysis of the inspection findings by the NRC and your staff, the nature of the results changed from that discussed on August 20, 2010, and these changes were discussed by telephone with you and your staff on October 4, 2010, and again with Mr. M. Ajluni, Nuclear Licensing Director, and others on February 9, 2011. On March 29, 2011, a final exit meeting was conducted to discuss the results of this inspection with Mr. M. Ajluni, and other members of your staff.

The inspections examined activities conducted under your licenses as they relate to safety and compliance with the NRCs rules and regulations and with the conditions of your licenses. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

Based on the results of these inspections, no findings of significance were identified.

SNC 2 In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov./reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Rebecca L. Nease, Chief Engineering Branch 2 Division of Reactor Safety Docket Nos.: 50-424, 50-425 License Nos.: NPF-68, NPF-81

Enclosure:

Inspection Report 05000424/2010006 and 05000425/2010007 w/Attachment: Supplemental Information

REGION II==

Docket Nos.: 50-424, 50-425 License Nos.: NPF-68, NPF-81 Report Nos.: 05000424/2010006 and 05000425/2010006 Licensee: Southern Nuclear Operating Company, Inc. (SNC)

Facility: Vogtle Electric Generating Plant, Units 1 and 2 Location: Waynesboro, GA 30830 Dates: August 2 - 6, 2010 (Week 1)

August 16 - 20, 2010 (Week 2)

Inspectors: P. Fillion, Senior Reactor Inspector (Lead Inspector)

P. Braxton, Reactor Inspector A. Dahbur, Senior Reactor Engineer (Week 1 only)

F. Ehrhardt, Senior Reactor Inspector M. Thomas, Senior Reactor Inspector G. Wiseman, Senior Reactor Inspector Accompanying H. Barrett, Senior Fire Protection Engineer (Week 1 only)

Personnel: B. Metzger, Fire Protection Engineer (Week 1 only)

Approved by: Rebecca L. Nease, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000424/2010-006, 05000425/2010-006; 08/02 - 06/2010 and 08/16 - 20/2010; Vogtle

Electric Generating Plant (VEGP) Units 1 and 2; Fire Protection.

This report covers an announced two-week period of inspection by a triennial fire protection team composed of five regional inspectors. No findings were identified. The report also covers an inspection conducted pursuant to Temporary Instruction (TI) 2515/181 by one Region III inspector and one fire protection engineer from U.S. Nuclear Regulatory Commission (NRC),

Office of Nuclear Reactor Regulation. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 4, dated December 2006.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity

1R05 Fire Protection

This report documents the results of a triennial fire protection inspection of the Vogtle Electric Generating Plant (VEGP), Units 1 and 2. The inspection was conducted in accordance with NRC Inspection Procedure (IP) 71111.05T, Fire Protection (Triennial),dated December 24, 2009. The objective of the inspection was to review a minimum sample of 3 risk-significant fire areas to verify implementation of the fire protection program (FPP) and to verify site specific implementation of at least one B.5.b mitigating strategy as well as the storage, maintenance, and testing of B.5.b mitigating equipment.

The three fire areas (FAs) and associated fire zones (FZs) were selected after reviewing available risk information as analyzed by a senior reactor analyst from Region II, previous inspection results, plant walk downs of fire areas, relational characteristics of combustible material to targets, and location of equipment needed to achieve and maintain safe shutdown (SSD) of the reactor. In selecting the B.5.b mitigating strategy sample, the team reviewed licensee submittal letters, safety evaluation reports, licensee commitments, B.5.b implementing procedures, and previous NRC inspection reports.

Section 71111.05-05 of the IP specifies a minimum sample size of three fire areas and one B.5.b implementing strategy for addressing large fires and explosions. This inspection fulfilled the requirements of the procedure by selecting four fire zones in four separate fire areas, and one B.5.b mitigating strategy. The specific FAs/FZs chosen for review were:

• FZ 91, switchgear room (Room R-48) in the control building housing Unit 1 4160 V safety-related switchgear 1AA02, load sequencer and Halon equipment, a subpart of FA 1-CB-LA-G,

• FZ 98, Unit 1 Train B shutdown panel room (Room R-43) in the control building, FA CB-LA-L,

• FZ 105-1, Unit 1 main control room (MCR) (Room R-163) a subpart of FA 1-CB-L1-A,

• FZ 512, switchgear room (Room T-512) housing 13.8 kV switchgear 1NAA and 1NAB and various 480 V load centers in the turbine building (not identified as a FA by licensee).

The team evaluated the licensees FPP against applicable requirements, including Operating License Condition 2.G; Title 10 of the Code of Federal Regulations, Part 50.48 (10 CFR 50.48); commitments to NRC Branch Technical Position (BTP) Chemical Engineering Branch (CMEB) 9.5-1; VEGP Updated Final Safety Analysis Report (UFSAR); related NRC safety evaluation reports (SERs) including all applicable supplements; and plant Technical Specifications (TS). Specific documents reviewed by the team are listed in the Attachment.

The team also completed Temporary Instruction (TI) 2515/181, Validate the Effectiveness of the Regulatory Infrastructure Related to Fire-induced Circuit Failures and Operator Manual Actions. That review is documented in Section 4OA5 of this report.

.01 SSD Analysis and Protection of SSD Capabilities

a. Inspection Scope

The team reviewed the Fire Event Safe Shutdown Evaluation (FESSE). One objective of this review was to evaluate the completeness and depth of the analysis which determined the credited and fire-affected equipment for each of the three FAs selected and the strategy for accomplishing the various system functions necessary to achieve and maintain hot shutdown, accomplish long term cooldown and achieve cold shutdown following a severe fire. Particular attention was paid to reactor coolant system inventory control, reactivity control and steam generator inventory control. A secondary objective of reviewing the FESSE was to understand its details so it could be determined whether the operations post-fire shutdown procedure was consistent with the analysis.

Through a combination of design information review and in-plant inspection, the team ascertained whether the fire protection features in place to protect the SSD capability satisfy the requirements mentioned above.

b. Findings

No findings of significance were identified.

.02 Passive Fire Protection

a. Inspection Scope

For the selected FZs, the team evaluated the adequacy of fire barrier walls, ceilings, floors, mechanical and electrical penetration seals, fire doors, and fire dampers. The team reviewed the installation, repair, and qualification records for a sample of fire doors, fire dampers, and penetration seals to ensure the fire barrier features were of the appropriate fire rating. The team compared the installed barrier configurations to the approved construction details, and supporting fire endurance test data, which established the ratings of the fire barriers. The team verified that the as-built configurations met the engineering design, standard industry practices, and were properly evaluated or qualified by appropriate fire endurance tests. The team reviewed licensee evaluations of the non-standard fire barrier penetration seal configurations for FZ 91 and FZ 98. The team also reviewed the fire hazards analysis (FHA) to verify the fire loading used by the licensee to determine the fire resistance rating of the fire barrier enclosures. In addition, the team reviewed licensing bases documentation, such as NRC SERs and exemptions from NRC regulations, to verify that passive fire protection features met license commitments.

The team walked down accessible portions of the selected FZs to observe the material condition of the passive fire barriers. In addition, a sample of completed surveillance and maintenance procedures for selected fire doors, fire dampers, and penetration seals were reviewed to ensure that these passive fire barriers were being properly inspected and maintained. The passive fire barriers included in the review are listed in the

.

b. Findings

No findings of significance were identified.

.03 Active Fire Protection

a. Inspection Scope

For the selected FZs, the team reviewed the adequacy of the design, installation, and operation of the automatic detection and alarm system to actuate in the early stage of a fire. The review included walk downs of the systems and an examination of the types of detectors, detector spacing, the licensee=s technical evaluation of the detector locations, and the steel ceiling beam reinforcing plans to assess whether the areas were protected by fire detectors in accordance with the code of record requirements in National Fire Protection Association(NFPA) 72E, 1982. The inspectors also reviewed the FHA, UFSAR Table 9.5.1.9, licensee submittals, and associated NRC SERs for FZs 91 and 98 to verify that the fire detection systems for the selected fire areas were installed in accordance with the design and licensing bases of the plant.

The team reviewed the adequacy of the design and installation of the gaseous automatic Halon fire suppression systems for FZ 98. This review included Halon fire suppression system controls to assure accessibility and functionality of the system, as well as associated ventilation system fire isolation dampers. The team also examined licensee design calculations, vendor certifications, and pre-operational test data to verify the required quantity of Halon for the area was available. Review of recent surveillance testing of the suppression system was performed to verify that system functionality was being maintained.

The team reviewed the secondary fire brigade staging and dress-out areas to assess the operational readiness of fire fighting and smoke control equipment. The fire brigade personal protective equipment and the self-contained breathing apparatuses were reviewed for adequacy and functionality. The team also reviewed fire fighting pre-fire plans and fire response procedures for the selected FZs to determine if appropriate information was provided to fire brigade members to identify safe shutdown equipment and to facilitate suppression of an exposure fire that could impact safe shutdown capability. The team walked down the selected FZs to compare the associated pre-fire plans and drawings with as-built plant conditions and fire response procedures. This was done to verify that fire fighting pre-fire plan instructions and drawings were consistent with the fire protection features and potential fire conditions described in the FHA. The inspectors also evaluated whether the fire response procedures and pre-plans for the selected fire areas/zones could be implemented as intended. Additionally, the team reviewed fire brigade response-to-drill scenarios that transpired over the past year.

b. Findings

No findings of significance were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team walked down the selected FZs to verify that redundant trains of systems required for hot shutdown, where located in the same fire area, were not subject to damage from fire suppression activities or from the rupture, or inadvertent operation of, fire suppression systems. The team evaluated whether the manual fire fighting activities could adversely affect the credited SSD equipment, inhibit access to alternate shutdown equipment, and/or adversely affect the local operator actions required for SSD in the selected FZs. The team also reviewed engineering analysis that addressed the inadvertent operation of fire protection systems and their effect on safety-related systems or components. Additionally, the team checked that fire fighting water would either be contained in the fire affected area or be safely drained off.

The team addressed the possibility that a fire in one FZ could lead to activation of an automatic suppression system in another FZ through the migration of smoke or hot gases, and thereby adversely affect SSD. Air flow paths out of the selected FZs were reviewed to verify that inter-area migration of smoke or hot gases would not inhibit necessary operator actions. This portion of the inspection was carried out through a combination of walk-downs, drawings, and records review.

b. Findings

No findings of significance were identified.

.05 Post-Fire Safe Shutdown From the Main Control Room

a. Inspection Scope

Methodology The team reviewed the licensees FPP described in UFSAR Section 9.5.1, the licensees FESSE, plant procedures, piping and instrumentation diagrams (P&IDs), electrical drawings, and other supporting documents. The review was performed to verify that hot and cold shutdown could be achieved and maintained from the MCR for postulated fires in FZs 91, 98, and 512. This review included verification that shutdown from the MCR could be performed both with and without the availability of offsite power. Plant walk downs were performed to verify that the plant configuration was consistent with that described in the FHA and FESSE. For postulated fires that utilize shutdown from the MCR, the team performed reviews to verify that the shutdown methodology properly identified the components and systems necessary to achieve and maintain SSD conditions. These inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring instrumentation, and support systems functions.

Operational Implementation The team reviewed the adequacy of procedures utilized for post-fire SSD and performed a walkthrough of procedure steps to ensure the implementation and human factors adequacy of the procedures. The team verified that licensee personnel credited for procedure implementation had procedures available, were trained on implementation, and were available in the event a fire occurred. The team also reviewed selected operator actions, including those taken to prevent or mitigate fire-induced spurious operation of selected components, to verify that the operators could reasonably be expected to perform the specific actions within the time required to maintain plant parameters within specified limits.

The team reviewed and/or walked down applicable sections of the following procedures for Unit 1 FZs 91, 98, and 512:

• Procedure 92005-C, Fire Response Procedure

• Procedure 17103A-C, Alarm Response Procedures for Fire Alarm Computer

• Procedure 17103B-C, Annunciator Response Procedures for Fire Alarm Computer The team reviewed local operator manual actions to ensure that the actions could be implemented in accordance with plant procedures in the times necessary to support the SSD method for the applicable FA/FZ. The team also reviewed the licensees manual action feasibility report for FZs 91 and 98.

b. Findings

No findings of significance were identified.

.06 Alternative Shutdown Capability

a. Inspection scope

Methodology The team reviewed the licensees FPP described in UFSAR Section 9.5.1, the licensees FESSE, plant procedures, P&IDs, electrical drawings, and other supporting documents for postulated fires in FZ 105-1. The reviews focused on ensuring that the required functions for post-fire SSD and the corresponding equipment necessary to perform those functions were included in the procedures. The review included assessing whether hot and cold shutdown from outside the MCR could be implemented, and that transfer of control from the MCR to the remote shutdown panels (RSPs) could be accomplished.

This review also included verification that shutdown from outside the MCR could be performed both with and without the availability of offsite power.

Plant walk downs were performed to verify that the plant configuration was consistent with that described in the FESSE. These inspection activities focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring instrumentation, and support systems functions.

Operational Implementation The team reviewed training lesson plans, job performance measures, and simulator scenarios for licensed and non-licensed operators to verify that the training reinforced the shutdown methodology of the FESSE and the procedures for FZ 105-1. The team also reviewed shift turnover logs and shift manning to verify that personnel required for SSD using the alternative shutdown systems and procedures were available onsite, exclusive of those assigned as fire brigade members.

The team reviewed procedures utilized for post-fire SSD and performed a walkthrough of procedure steps to ensure the implementation and human factors adequacy of the procedures. The team also reviewed selected operator actions to verify that the operators could reasonably be expected to perform the specific actions within the time required to maintain plant parameters within specified limits. The team reviewed and/or walked down applicable sections of the following response procedures:

• Procedure 92005-C, Fire Response Procedure

• Procedure 18038-1, Operation from Remote Shutdown Panels The team also reviewed the periodic test procedures and test records of the alternate shutdown transfer capability and instrumentation and control functions to ensure that the tests were adequate to verify the functionality of the alternative shutdown capability.

b. Findings

Introduction:

The team identified an unresolved item (URI) related to the Control Room Fire Alternate Shutdown Evaluation (CRFASE), calculation number X4C2301S035.

Specifically, the team found that the CRFASE does not reflect integrated automatic plant response to fire in the MCR requiring shutdown from the RSPs.

Description:

The CRFASE is an evaluation of the impact of a fire in the MCR on the operators ability to safely shut down the plant from outside the MCR. The evaluation addresses discreet spurious operation concerns on a system basis. The CRFASE provides time constraints and compensatory measures used to develop the operator actions, and sequencing of these actions, in procedure 18038-1, Operation from Remote Shutdown Panels.

During review of procedure 18038-1 and the CRFASE, the team questioned whether certain operator actions contained in step 3 of procedure 18038-1, if unable to be performed from the MCR, would be able to be performed within established time constraints in order to prevent and/or mitigate the adverse effects of spurious actuations.

These time constraints, adverse spurious actions, and the impact on the plant of these spurious actuations are described in the CRFASE. Specifically, the team questioned whether reactor coolant pumps #1 and #4 would be able to be tripped early enough from the RSP in time to prevent depressurization of the reactor coolant system to the safety injection (SI) actuation set point, in the event one pressurizer spray valve spuriously opens. The team also questioned whether main steam isolation valves (MSIVs) would be closed from the RSP in sufficient time to minimize the chances of a significant overcooling transient (as described in the CRFASE) in the event the MSIVs were not closed from the MCR in step 3.

Subsequent to the on-site inspection, the licensee developed a simulator exercise guide for the purpose of validating the time necessary for an operating crew to perform the steps in procedure 18038-1, through the point of tripping reactor coolant pump (RCP) #1 and #4 from the RSP, given immediate evacuation of the MCR and subsequent spurious operation of a pressurizer spray valve. The licensee stated that the time at which the pressurizer spray valve was set to open during the simulator exercise was based on a timing analysis contained in Request for Engineering Review RER C071912101, Safe Shutdown Time Critical Operator Actions in 18038-1/2 and 17103A-C.

When validating the simulator exercise guide, the licensee found that the CRFASE does not reflect integrated plant response for a control room fire as predicted through simulation. Simulated plant response was different from the response described in the CRFASE, in that an automatic SI actuation occurred approximately 6 minutes after plant trip due to decreasing RCS pressure arising from RCS cooldown caused by high auxiliary feedwater (AFW) flow. Additionally, in the simulated plant response, the SI actuation automatically isolated instrument air to containment, which caused the pressurizer spray valve to close before spurious operation of the valve was input into the simulator scenario in accordance with the timing analysis.

As a result of questions raised by the team during subsequent in-office inspection of this issue, the licensee initiated Condition Report (CR) 2010112114 to revise the CRFASE to review integrated plant response for a control room fire. In a telephone call with the licensee on October 4, 2010, the team stated that additional information would be required concerning the nature and extent of differences between plant response specified or assumed in the CRFASE and simulated or actual plant response. The team discussed the nature of the additional information required in telephone calls with the licensee on October 4, 2010, January 6, 2011, and January 11, 2011.

On January 26, 2011, the licensee provided information concerning integrated plant response obtained from plant-referenced simulator scenarios, relative to spurious component actuations and plant conditions described in the licensees CRFASE. During an initial review of this material, the team identified additional questions regarding the new information. During a final briefing of the inspection on February 9, 2011, the licensee informed the team that the information provided on January 26, 2011, needed to be revised for clarification, and additional information would be provided. This additional information is necessary for the team to determine whether the plant response to a control room fire as described in the CRFASE represents a performance deficiency, and to determine whether procedure 18038-1 is adequate for maintaining safe plant conditions while performing shutdown outside the MCR. A URI was opened pending receipt and review of this additional information which is identified as URI 5000424;425/2010006-01, Control Room Fire Alternate Shutdown Evaluation (X4C2301S035) Does Not Reflect Integrated Plant Response

.07 Circuit Analysis

a. Inspection Scope

The team reviewed the licensees safe shutdown analysis (SSA) wherein they identified the structures, systems and components required for post-fire SSD as well as the structures, systems and components important to SSD, for example, a flow diversion path. These reviews included P&IDs, control circuit diagrams, and cable routing information. The team reviewed the details of how the licensee addressed the various credible cable failure modes and common power supply considerations. In cases where the licensees analysis indicated resolution of a potential fire damage issue was required, the team followed up on that resolution. The objective and acceptance criterion for these reviews was that one train of structures, systems and components would be free of fire damage to allow operators to shut down the plant in the event a fire started and could not be rapidly extinguished.

b. Findings

Introduction:

The team identified a URI concerning the licensing basis for multiple spurious operations (MSOs) and adequacy of related compensatory measures implemented to address potential noncompliances related to multiple circuit faults.

Description:

As documented in the Background section of Enforcement Guidance Memorandum (EGM) 09-02, Enforcement Discretion for Fire-induced Circuit Faults, dated May 14, 2009, the matter of how many fire-induced circuit faults need be postulated in post-fire SSAs has been an industry-wide generic issue. With the issuance of Regulatory Guide (RG) 1.189, Revision 2, Fire Protection for Nuclear Power Plants, in October of 2009, the generic issue has been resolved, and the guidelines disseminated to all power reactor licensees regarding what constitutes an acceptable multiple circuit fault analysis. The inspection team confirmed that VEGP has performed an acceptable analysis. Refer to Section 4OA5 of this report for details of that analysis.

As a result of than analysis, the licensee identified 78 MSO scenarios that apply to VEGP. Each scenario on this list may represent a non-compliance with the Operating License Condition 2.G and the requirement to ensure one train of SSD equipment and associated circuits (that could adversely affect SSD) would be free of fire damage in the event of a fire. This list of potential noncompliances related to MSOs was entered into the corrective action program, identified as a degraded, but operable, condition, and compensatory measures were posted.

The team examined MSO Scenario 1: loss of all RCP seal cooling due to spurious closure of RCP 1 seal water inlet valve 1-HV-1803A concurrent with spurious isolation of auxiliary component cooling water (ACCW) to the RCP thermal barrier heat exchanger.

If this MSO were to occur, with the RCP running, an RCP seal loss-of-coolant-accident would result. Isolation of ACCW to the RCP thermal barrier heat exchanger could occur due to spurious closure of either ACCW supply isolation valve 1-HV-1978 or ACCW return isolation valve 1-HV-1974. Both the ACCW valves are located inside containment, and all three valves (1-HV-1803A, 1-HV-1978, and 1-HV-1974) are motor-operated valves. Cable 1BBD26SB in the control circuit for valve 1-HV-1803A could cause spurious closure of that valve if fire-induced short-circuit between wires X1 and T2 occurred. This cable runs from termination cabinet 1ACPT10 in the Train B cable spreading room to motor control center (MCC) 1BBD located in the control building.

Cable 1BBE25SB in the control circuit for valve 1-HV-1978 could cause spurious closure of that valve if fire-induced short-circuit between wires X1 and T2 occurred. Cable 1BBE24SB in the control circuit for valve 1-HV-1974 could cause spurious closure of that valve if fire-induced short-circuit between wires X1 and T2 occurred. Cables 1BBE25SB and 1BBE24SB run from termination cabinet 1ACPT04 in the Train B cable spreading room to MCC 1BBE in the auxiliary building. Termination cabinets 1ACPT10 and 1ACPT04 are in the same row of termination cabinets. Cable 1BBD26SB (associated with RCP 1 seal water valve 1-HV-1803A), cable 1BBE25SB (associated with ACCW valve 1-HV-1978) and cable 1BBE24SB (associated with ACCW valve 1-HV-1974) are routed in cable trays above the termination cabinet line-up, and are in close proximity. Since the termination cabinets are considered a fire ignition source, all three of these cables could be damaged by fire. Therefore, MSO Scenario 1 could occur due to a fire at termination cabinets 1ACPT 04 through 1ACPT10. The applicable SSD procedure for a fire in the Unit 1, Train B, cable spreading room (17103A-C, Annunciator Response Procedures for Fire Alarm Computer) did not include a step to trip RCP 1, nor take any other action to mitigate the potential for loss of all seal cooling to RCP 1.

Enforcement Guidance Memorandum (EGM) 09-002 provides guidance for granting enforcement discretion for non-compliances involving the use of unapproved operator manual actions (OMAs) to address multiple circuit faults. Specifically, to be eligible for this enforcement discretion, by April 2010, licensees were to

(1) identify noncompliances related to MSOs,

(2) implement compensatory measures for the noncompliances, and

(3) place the noncompliances in the corrective action program. If granted, enforcement discretion would continue until October 2012 to allow time for licensees to resolve the noncompliances related to MSOs.

The Vogtle FPP specifies that as a compensatory measure, an hourly fire watch be implemented in FAs where a fire barrier is degraded. This requirement is applicable to the licensees list of potential noncompliances related to MSOs, because if these cables were protected from fire damage by a fire barrier (using a 3- hour rated barrier, one-hour rated barrier with detection and suppression, or 20 feet of separation with detection and suppression), the MSO scenario would be precluded from happening. However, the licensee modified its FPP, to allow for the use of operator rounds as a compensatory measure, specifically to address the MSO concerns. The justification given for this change was that Regulatory Issue Summary 2005-007, Compensatory Measures to Satisfy Fire Protection Program Requirements, recognizes the acceptability of alternate compensatory measures. While this is true, the alternate compensatory measures must be equivalent or adequately compensate for the degradation. In the case of using a fire watch as a compensatory measure for the MSO concerns, the specific location of the degraded fire barrier is not known beyond the fact that it is somewhere in the fire area.

The operator rounds take place once per 12-hour shift, and can take place any time during the shift. Therefore significantly more than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> may elapse between performing the fire watch function as part of the operator rounds. The team also found that the operator rounds will not cover all the rooms affected by the MSO concerns.

Specifically, the rooms involved in MSO Scenario 1 would not all be covered by operator rounds. In addition, the operator is not instructed to walkdown the entire floor area of each area he/she enters as part of the regular rounds; therefore, MSO areas of concern may not be observed by the operator. Furthermore, the team noted that a portion of operator rounds can be cancelled during a particular shift due to emergent plant conditions. For these reasons, the team concluded that the compensatory measures implemented at Vogtle for the MSO concerns did not constitute sufficient compensation as intended by EGM-09-002.

When the NRC inspection team communicated to the licensee that the use of operator rounds as described above was not an acceptable substitute for hourly fire watch, the licensee countered that their list of MSO scenarios did not represent any non-compliances, as the consideration of multiple circuit faults was outside the design basis for Vogtle. To substantiate this position, the licensee cited portions of Appendix 9B of the UFSAR, which is a line by line comparison of the CMEB 9.5-1 requirements against the Vogtle compliance position including clarification of conformance or justification of deviation.

The team concluded that further review of information related to the plant licensing basis is necessary in order to determine whether, or to what extent, multiple circuit fault scenarios must be considered as part of the Vogtle FPP. This licensing basis issue was referred to the Office of Nuclear Reactor Regulation for review. Even though the licensee has performed an analysis which considers MSOs, the question of the licensing basis is important to the question of whether or not the compensatory measures put in place for the newly-identified potential noncompliances related to MSOs are acceptable.

This issue will be identified as URI 05000424; 425/2010006-02, Licensing Basis for Multiple Spurious Operations and Adequacy of Related Compensatory Measures.

.08 Communications

a. Inspection Scope

The team reviewed the communication systems required to implement fire fighting and operator actions to achieve and maintain a safe shutdown condition, as credited in UFSAR Section 9.5.2. The team inspected the contents of designated emergency storage lockers and verified the capability of the sound-powered phone system to support the operators in the conduct and coordination of their required actions during a walkthrough of the safe shutdown procedures. The team verified that electrical power supplies and cable routing for the phone system would remain functional following a fire in the control room fire area and other fire areas. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with engineering personnel.

The team reviewed selected fire brigade drill summary/critique reports to assess proper operation and effectiveness of the fire brigade command post portable radio communications during fire drills and identify any history of operational or performance problems with radio communications during fire drills. In addition, the team reviewed the radio battery usage ratings for the fire brigade radios stored and maintained on charging stations to verify their availability.

b. Findings

No findings of significance were identified.

Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required to achieve and maintain hot shutdown conditions to verify that lights adequately illuminated access and egress routes to the areas where operator manual actions were required. The team reviewed the design, maintenance and past surveillance testing of emergency lighting units (ELUs) throughout the plant to confirm they would illuminate for an 8-hour period following interruption of normal power to the battery chargers as required by BTP CMEB 9.5-1, Section C.5.g. The team verified that the installed ELU batteries were maintained in accordance with manufacturer recommendations. The locations, positioning and aiming of emergency lights were observed during a walkthrough of safe shutdown procedure 18038-1, Operation From Remote Shutdown Panels, Rev. 31, and procedure 17103A-C, Annunciator Response Procedures for Fire Alarm Computer, Rev. 33.

Based upon plant walkdowns, the team requested that the licensee perform ELU tests in selected control building locations to demonstrate that sufficient illumination existed to manipulate plant components.

The team also observed whether emergency exit lighting was provided for personnel evacuation pathways to the outside as identified in National Fire Protection Association (NFPA) 101, Life Safety Code, and the Occupational Safety and Health Administration, Part 1910, Occupational Safety and Health Standards. This review also included examination of whether backup emergency lighting was provided for the primary and secondary fire emergency equipment storage locker locations and dress-out areas in support of fire brigade operations should power fail during a fire emergency.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed the SSA and plant procedure for responding to fires and implementing safe shutdown activities in order to determine if any repairs were required to achieve cold shutdown. The licensee had designated one system (an emergency diesel generator fuel oil pump) potentially requiring repair, in the form of a control circuit emergency jumper, in order to reach cold shutdown based on the safe shutdown methodology implemented. The team verified that the jumper was available and the procedure to install it worked. The team also evaluated whether cold shutdown could be achieved within the required time using the licensees procedures and repair methods.

Specific documents reviewed by the team are listed in the Attachment.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection scope

The team reviewed the administrative controls for out-of-service, degraded, and/or inoperable fire protection features (e.g., detection and suppression systems and equipment, passive fire barriers, or pumps, valves or electrical devices providing SSD functions or capabilities). The team reviewed the fire protection program impairment log for the selected FZs. The compensatory measures that had been established in these areas were compared to those specified for the applicable fire protection feature. The team verified that the risk associated with removing the fire protection feature from service was properly assessed and the compensatory measures were implemented in accordance with the approved FPP. This review also verified that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings of significance were identified.

.12 B.5.b Mitigating Strategy

a. Inspection Scope

The team reviewed, on a sample basis, the licensees steam generator depressurization and feedwater makeup mitigation measures for large fires and explosions to verify that the measures were feasible, personnel were trained to implement the strategies, and equipment was properly staged and maintained. The team requested and reviewed inventory and maintenance records of required equipment. Through discussions with plant staff, review of documentation, and plant walk-downs, the team verified the engineering basis to establish reasonable assurance that the makeup capacity could be provided using the specified equipment and water sources. The team reviewed the licensees capability to provide a reliable and available water source and the ability to provide the minimum fuel supply. The team performed a walk-down of the storage and staging areas for the B.5.b equipment to verify that equipment identified for use in the current procedures were available, calibrated and maintained. In the presence of licensee staff, the team conducted an independent audit and inventory of required equipment and a visual inspection of the dedicated credited power source and water source. The team reviewed training records to verify that operations and security personnel training/familiarity with the strategy objectives and implementing guidelines were accomplished according to the established training procedures. Additionally, the team reviewed licensee corrective actions to address operator training deficiencies identified in CR 2010107564. The team also reviewed CRs 2010108282 and 2010108295 related to maintenance of B.5.b equipment.

b. Findings

No findings of significance were identified.

4OA2 Identification and Resolution of Problems

a. Inspection Scope

The team reviewed recent independent licensee audits for thoroughness, completeness and conformance to requirements. Guidance and/or requirement for performing independent audits are contained in Generic Letter 82-21 Technical Specifications for Fire Protection Audits and the licensees Quality Assurance Manual, as well as Appendix A to Branch Technical Position APCSB 9.5-1 Guidelines for Fire Protection for Nuclear Power Plants, Section C.10, Audits. The team reviewed other corrective action program (CAP) documents, including completed corrective actions documented in selected CRs, and operating experience program documents to verify that industry-identified fire protection problems potentially or actually affecting the plant were appropriately entered into, and resolved by, the CAP process. Items included in the operating experience effectiveness review included NRC Regulatory Issue Summaries, Information Notices, industry and vendor-generated reports of defects and noncompliance under 10 CFR Part 21, and vendor information letters. A number of CRs were reviewed with regard to the attributes of timeliness, apparent cause determination, proposed corrective action addresses the apparent cause, reportable, operability determination, etc. The CRs reviewed are listed in the Attachment.

b. Findings

No findings of significance were identified.

4OA5 Validate the Effectiveness of the Regulatory Infrastructure Related to Fire-Induced Circuit

Failures and Operator Manual Actions (TI 2515/181)

a. Inspection scope

The overall scope of the inspection was to gather information to assess the effectiveness of the regulatory infrastructure in the areas of fire-induced circuit faults and use of operator manual actions to achieve post-fire safe shutdown. Regulatory infrastructure refers to the guidance contained in NRC RG 1.189, Revision 2, Fire Protection for Nuclear Power Plants, Section 5.3, Fire Protection of Safe Shutdown Capabilities, and Section 5.4, Alternative and Dedicated Shutdown Capability, and Nuclear Energy Institute Publication NEI 00-01, Revision 2, Guidance for Post Fire Safe Shutdown Circuit

Analysis.

A secondary objective of the inspection was to evaluate the implementation of the above mentioned guidance. To do this, the team reviewed the major elements of an acceptable multiple circuit fault and OMA analysis listed below:

• Expert panel process,

• Definition of SSD flow paths,

• Use of probabilistic risk assessment (PRA),

• Consideration of the generic list of multiple circuit faults scenarios,

• Treatment of high/low pressure interface flow diversion paths,

• Consideration of the various types of circuit faults,

• Designation of plant specific multiple circuit fault scenarios as either required or important as defined in the guidance documents above,

• Review of the existing single circuit fault analysis,

• Acceptance criteria for OMAs The team reviewed a representative sample of multiple circuit fault scenarios, which are listed below:

• Reactor coolant pump 1 seal water inlet valve and auxiliary cooling water return isolation valve or supply isolation valve (MSO Scenario 1)

• Volume control tank outlet valve and reserve water storage tank outlet valve (MSO Scenario 9)

• Valves in the RCS letdown line (MSO Scenarios 6, 7 and 13)

b. Findings

Use of recently issued industry guidance to address spurious operations The licensees original SSA included an evaluation of fire-induced single spurious and multiple spurious operations. This evaluation identified 33 spurious operation scenarios, including both single and multiple types. However, the licensee recognized that all of the credible MSO scenarios had not been identified in this original evaluation, and performed a new MSO analysis which is described in the following paragraphs.

Through review of documentation, interviews with a person on the expert panel and cognizant engineers, the team concluded that the expert panel process was carried out in accordance with the guidance in NEI 00-01. In general, the safe shutdown paths were marked on the plant system P&IDs, and they were outlined in the UFSAR. These marked-up P&IDs also indicated which components were added to the safe shutdown equipment list as a result of the MSO analysis. Multiple possible SSD paths were defined depending on the location of the fire being considered. Safety-related Train A or Train B equipment would be used for safe shutdown depending on the fire area of interest. Superimposed on that concept, a preferred and an alternate path using each train were defined. With regard to some details (e.g., reactor coolant system letdown via the reactor head vent), the team had to rely on discussion with the safe shutdown engineers to determine the flow path which had been analyzed. The licensee stated they had not used the internal events PRA as a tool to identify MSO scenarios. The licensee stated the reason for not using the internal events PRA was that they are in the process of developing a fire PRA, which will be the preferred tool to use for the purpose of identifying additional MSO scenarios.

Methodology for analyzing the impact of spurious operations on safe shutdown equipment Using the guidance in NEI 00-01, Appendix G, Generic List of MSOs, as well as the PWR Generic List of Fire-Induced Multiple Spurious Operation Scenarios, Revision 1 (preliminary), developed by the pressurized water reactor (PWR) Owners Group under project PA-RMSC-0376, the licensee developed a plant specific list of MSO scenarios.

The licensees list contained 78 individual scenarios. At the time of the inspection, the licensees analysis of this list had progressed to the point where they had identified which FAs were associated with each MSO scenario. This information was determined through the use of fault tree logics, review of control circuits for the components involved and analysis of the routing of those cables. The licensee entered this information into the corrective action program as CR 2010105915 for Unit 1 and CR 2010105916 for Unit 2 identified as degraded but operable conditions. As part of the original safe shutdown analysis, the licensee had a list of single spurious operation scenarios, which was combined with a list of high/low pressure interface flow paths analyzed for MSO scenarios. At least 19 of the items on the newly-developed MSO list involved components on the original spurious operation list. Therefore, a resolution was already in place for 19 of the 78 items on the MSO list. For the remaining 59 items, a resolution had not yet been defined.

NRC RG 1.189, Revision 2, and NEI 00-01, Revision 2, state that MSO scenarios applicable to a particular plant should each be characterized as either required for safe shutdown or important to safe shutdown. Both documents give general guidance in determining the correct characterization. The characterization is important because a different set of options is available to resolve an MSO concern depending on whether it is required for SSD or important to SSD. The PWR Owners Group generic list of MSOs mentioned above provides a recommended characterization (required or important) for each scenario on their list. In general, the required versus important characterization indicated on the licensees plant specific MSO list matched those on the PWR Owners Group generic list. The team, using the general guidance of NRC RG 1.189, Revision 2, arrived at a different characterization than the licensee for at least one MSO scenario.

Scenario 10 on both the licensees list and the PWR Owners Group list is spurious closure of the volume control tank (VCT) outlet valve when the credited charging pump is aligned to the VCT and failure to open of the refueling water storage tank to charging pump suction valve. The licensee, using the PWR Owners Group list, characterized Scenario 10 as important, although they said this determination was preliminary. The team using the guidance in RG 1.189, Section 5.3.1.1, Protection for the Safe Shutdown Success Path, characterized it as required. Specifically, Section 5.3.1.1, states, Spurious actuations, either single or multiple, with the potential to affect safe shutdown success path structures systems and components (same as required) should be mitigated in accordance with the features described in this section; tools such as fire modeling and OMAs should not be used. Scenario 10 fits this description since the scenario would result in functional inoperability of the credited charging pump which is required for inventory control and pressure control. A note on the PWR Owners Group list for Scenario 10 states that the rationale for the important characterization is that the VCT outlet valve is not in the credited flow path. The team noted that this does not appear to be consistent with the required characterization for Scenario 51 on the PWR Owners Group list, which is a generic scenario for spurious isolation of pump discharge flow and spurious isolation of pump recirculation flow.

Another example where the team arrived at a different conclusion regarding the characterization of required versus important was MSO Scenario 1. Scenario 1 is loss of all cooling to one or all of the RCPs due to spurious closure of seal water isolation valve concurrent with spurious isolation of ACCW flow through the thermal barrier. This scenario is discussed in detail in Section 1RO5.07, Circuit Analysis, of this report. If this scenario occurs with the RCP running, an RCP seal LOCA would result. The guidance in RG 1.189, Section 5.3.1.5, indicates that significant diversion paths from the SSC flow path that would lead to core damage or cause reactor coolant loss if diverted for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or less are in the required category. The team concluded that MSO Scenario 1 fits this definition. Based on the two examples discussed herein, the team concluded that further clarification of the guidance on the characterization of a particular MSO as either required or important is warranted. The team noted that the PWR Owners Group generic list of MSOs had not been reviewed and endorsed by the NRC prior to this inspection.

While reviewing the types of circuit faults that the licensee postulated in their circuit analysis for MSOs, the team identified that the methodology and guidance given in NEI 00-01 may not explicitly cover all the required configurations. Section 3.5.1.1 of NEI 00-01 contains the circuit failure criteria to be applied. Within this section (page 56),the following criterion is given, there is no limit on the number of concurrent/

simultaneous fire-induced circuit failures that must be considered for circuits for components required for hot shutdown located within the same fire area. Later, on page 57, in giving the criteria to be applied to circuits important to safe shutdown, NEI 00-01 states, for ungrounded DC circuits, a single hot short from the same source is assumed to occur unless it can be demonstrated that the occurrence of a same source short is not possible in the affected area. In addition, on Page 61, NEI 00-01 states, There is no limit to the number of shorts-to-ground that could be caused by the fire.

These criteria are illustrated in NEI 00-01 Figures 3.5.2-3 and 3.5.2-5 covering ungrounded control circuits. Note that there is nothing on the figures (or text) indicating that the two shorts-to-ground being postulated must occur in the same raceway section.

The two grounds could be in two different raceway sections, and the current path between the two grounds could be through any electrically continuous grounded metallic path or even involve earth (which is ground). Extrapolating this concept, there is no reason why the two grounds must be on the same circuit. It would be just as credible that they are in different circuits as long as both circuits are from the same source, as made explicit in NEI 00-01 for the hot shorts. However, the licensee implemented design criteria which excluded ground paths between two separate raceways on the basis that the likelihood of such a path supporting a spurious operation would be remote.

Furthermore, the licensee stated that the particular issue raised by the team remains in question between industry groups working on circuit analysis issues. They also implied that NUREG/CR-6850 would support their interpretation of the design criteria, although they did not cite a specific section of that document. The team noted that fourth bullet in NUREG/CR 6850, Section 5.2.2, Step 2.2, Item No. 2, states, In practice, unless the energized conductors (from the same power source) are located in the same raceway as the target cables/conductors, the likelihood of a viable conduction path through a grounded surface is extremely remote. Given the apparent confusion between NEI 00-01 and NUREG/CR 6850 regarding the treatment of shorts-to-ground on ungrounded control circuits (i.e. circuits with no intentional ground installed), the team concluded that additional clarification may be needed.

Methodology for analyzing the impact of spurious operations on alternative safe shutdown equipment Alternative SSD would be used for a main control room fire only. The methodology used to analyze MSO scenarios described above was used for all plant FAs including the main control room.

Reliance on OMAs as a resolution for potential spurious operations in original analysis The licensees procedures included OMAs intended to mitigate or preclude the effects of analyzed single spurious operations or spurious opening of high/low pressure interface paths. The team addressed the feasibility of these OMAs through evaluation and walkthrough of safe shutdown procedures for the four selected FAs. While, in general, the OMAs associated with the four selected FAs were feasible, a URI was identified in Section 1RO5.07 of this report regarding the Vogtle licensing basis with respect to MSOs.

The licensees original SSA evaluated both single spurious and multiple spurious scenarios. In this analysis, the licensee had identified three scenarios which would be characterized as required using the current guidance. These scenarios applied to one or more FAs besides the alternative shutdown FAs. Shutdown procedures included OMAs to mitigate the consequences of these potential spurious operations.

Reliance on OMAs as resolution for MSO scenarios identified in the recent analysis At the time of the inspection, the licensee had not identified a resolution for the MSO scenarios on the newly-developed list described in the preceding paragraphs.

Compensatory measures were put in place while the resolutions were being developed and implemented as allowed by Enforcement Guidance Memorandum EGM-09-02; however, the team questioned the adequacy of these compensatory measures. Refer to Section 1RO5.07 of this report for discussion of this issue. In general, the guidance documents do not allow use of OMAs as a resolution for MSO scenarios characterized as required for SSD. This concept was discussed with the licensee, who was already aware of the guidance contained in NRC RG 1.189, Revision 2, and NEI 00-01, Revision 2.

4OA6 Meetings, Including Exit

On August 20, 2010, the lead inspector presented the summary of inspection results to Mr. R. Dedrickson, Plant Manager, and members of the licensees staff. The licensee acknowledged the findings. The inspection results were updated in a telephone call on October 4, 2010, with T. Tynan, Site Vice President, and members of the licensees staff.

The inspection results were updated again in a telephone call on December 16, 2010, and February 9, 2011, with M. Ajluni, and other members of the licensees staff. A final exit meeting was conducted on March 29, 2011, with M. Ajluni and other members of the licensees staff. Proprietary information is not included in this report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Ajluni, Director, Nuclear Licensing

K. Black, Supervisor, Engineering Programs

R. Dedrickson, Plant Manager

J. Ealick, Supervisor, SNC Fleet Oversight

P. Goodman, Fire Protection System Engineer

M. Hickox, Licensing Engineer

L. Hughes, Senior Fire Protection Engineer, SNC Corporate

J. Lattner, Principal Fire Protection Engineer, SNC Corporate

B. Lewis, Fire Brigade Instructor

P. Long, Supervisor, Fire Protection, SNC Corporate

L. Mansfield, Director, Site Engineering

C. Martin, Senior Safe Shutdown Engineer, SNC Corporate

D. McCary, Operations Manager

R. Odom, Supervisor, Operations Training

T. Petrak, Systems Engineering Manager

S. Prewitt, Operations Procedure Supervisor

D. Puckett, Supervisor, Performance Improvement

J. Robinson, Manager, Technical Services

M. Sharma, Nuclear Specialist, Performance Improvement

J. Singleton, Senior Engineer, Site Fire Protection Program

B. Stewart, System Engineer for Emergency Lighting

D. Sutton, Engineering Programs Manager, SNC Corporate

S. Swanson, Site Support Manager

T. Tynan, Site Vice-President

S. Waldrup, Operations Superintendent

M. Wilson, SNC Fleet Oversight Auditor

NRC Personnel

R. Nease, Branch Chief, Engineering Branch 2, Region II

M. Cain, Senior Resident Inspector, Vogtle Electric Generating Plant

T. Chandler, Resident Inspector, Vogtle Electric Generating Plant

D. Frumkin, NRR/DRA/AFPB/AFP

P. Qualls, NRR/DRA/AFPB/AFP

LIST OF ITEMS

OPENED Open

05000424, 425/2010006-01 URI Control Room Fire Alternate Shutdown Evaluation (X4C2301S035) Does Not Reflect Integrated Plant Response (Section 1R05.06)

05000424, 425\2010006-02 URI Licensing Basis for Multiple Spurious Operations and Adequacy of Related Compensatory Measures (Section 1R05.07)

LIST OF FIRE BARRIER FEATURES INSPECTED (Refer Report Section 1RO5.03- Passive Fire Barriers)

Fire Damper Identification Description 1-1532-S7-401 FZ 91 to FZ 72 Fire Door Identification Description Door 171 FZ 105-1 to FZ 106 Door 177 FZ 105-1 to FZ 183A Door 178 FZ 105-1 to FZ 183A Door A41 FZ 93 to FZ 98 Door A49 FZ 91 to FZ 85 Fire Barrier Penetration Seal Identification Description V12111Z1322-A FZ 91 to FZ 92 V12111Z1323-A FZ 91 to FZ 92 V12111Z11307-A FZ 91 to FZ 103 V12111Z1089A FZ 98 to FZ 95 V12111Z1090A FZ 98 to FZ 95 V12111Z1595A FZ 98 to FZ 60 V12111Z10411A006 FZ 98 to FZ 93 V12111Z1213-1 FZ 105-1 to FZ 183A V12111Z1222-1 FZ 105-1 to FZ 95