IR 05000482/2014008

IR 05000482-14-008; 10/20/2014 - 11/06/2014; Wolf Creek Generating Station; Triennial Fire Protection Team Inspection

ML14352A342
Person / Time
Site:	Wolf Creek
Issue date:	12/18/2014
From:	Greg Werner NRC/RGN-IV/DRS/EB-2
To:	Heflin A Wolf Creek
References
IR 2014008
Download: ML14352A342 (44)

Text

UNITED STATES ber 18, 2014

SUBJECT:

WOLF CREEK GENERATING STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000482/2014008

Dear Mr. Heflin:

On November 6, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Wolf Creek Generating Station and discussed the results of this inspection with you and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented two findings of very low safety significance (Green) in this report.

Both of these findings involved violations of NRC requirements. The inspectors also documented a licensee-identified violation which was determined to be of very low safety significance. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of the violations in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Wolf Creek Generating Station.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Wolf Creek Generating Station. In accordance with Title 10 of the Code of Federal Regulations 2.390, "Public Inspections, Exemptions, Requests for Withholding," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-482 License No. NPF-42

Enclosure:

Inspection Report 05000482/2014008 w/Attachment: Supplemental Information

REGION IV==

Docket: 05000482 License: NPF-42 Report Nos.: 05000482/2014008 Licensee: Wolf Creek Nuclear Operating Corporation Facility: Wolf Creek Generating Station Location: 1550 Oxen Lane NE Burlington, Kansas Dates: October 20 through November 6, 2014 Team Leader: J. Mateychick, Senior Reactor Inspector Inspectors: S. Alferink, Reactor Inspector G. Pick, Senior Reactor Inspector J. Watkins, Reactor Inspector Approved By: Gregory E. Werner Chief, Engineering Branch 2 Division of Reactor Safety-1- Enclosure

SUMMARY

IR 05000482/2014008; 10/20/2014 - 11/06/2014; Wolf Creek Generating Station; Triennial Fire

Protection Team Inspection.

The report covered a two-week triennial fire protection team inspection by specialist inspectors from Region IV. Two findings of very low safety significance (Green) are documented in this report. All of these findings involved violations of NRC requirements. Additionally, the NRC inspectors documented one licensee-identified violation of very low safety significance. The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red) and is determined using Inspection Manual Chapter 0609, "Significance Determination Process," dated June 2, 2011. Cross-cutting aspects are determined using Inspection Manual Chapter 0310, "Aspects within the Cross-Cutting Areas," dated December 19, 2013. Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy, dated July 9, 2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4.

A.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant under all postulated fire scenarios. A scenario which could impact the operation of the required diesel generator was not adequately addressed. The licensee implemented a fire watch in the control room as a compensatory measure until corrective actions can be taken. The licensee documented the deficiencies with Procedure OFN RP-017, "Control Room Evacuation," Revision 45, in Condition Report 00089788.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire)attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation and determined that the finding was of very low safety significance. The finding did not have a cross-cutting aspect since the performance deficiency was more than three years old and not indicative of current performance. (Section 1R05.05)

Green.

The team identified a non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to adequately label equipment and provide an adequate procedure for performing cold shutdown repairs required for post-fire safe shutdown. Since the plant would already be stable in hot shutdown, no immediate compensatory or corrective actions were required to assure safety. The licensee was evaluating corrective actions. The licensee documented the deficiencies in Condition Report 00089130.

The failure to ensure that Procedure OFN RP-017A, "Hot Standby to Cold Shutdown from Outside the Control Room Due To Fire," Revision 9, could be implemented as written was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. The finding was evaluated for safety significance using NRC Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process." Since the finding was related to the ability to achieve safe shutdown and the plant would remain in stable hot shutdown, the finding screened to

Green.

This performance deficiency had a cross-cutting aspect in the area of human performance associated with documentation because the licensee did not prepare an accurate and up-to-date procedure that assured nuclear safety. Specifically, personnel did not verify that the steps in the revised procedure could be performed as written and that the components had proper labeling [H.7]. (Section 1R05.09)

B. Licensee-Identified Violations

A violation of very low safety significance that was identified by the licensee has been reviewed by the inspectors. Corrective actions taken or planned by the licensee have been entered into the licensees corrective action program. This violation and the corrective action tracking number are listed in Section 4OA7 of this report.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, "Fire Protection (Triennial)," at the Wolf Creek Generating Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas and one or more mitigating strategies for review. The inspection team used the fire hazards analysis section of the Wolf Creek Generating Station Individual Plant Examination of External Events to select the following three fire areas (inspection samples) for review:

Fire Area Description Auxiliary Building - 2026 Elevation, Electrical Penetration Room (North)

North Pipe Penetration Room 1323 C-9 Control Building 2000 Elevation, ESF Switchgear Room (North)

The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(5), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Updated Safety Analysis Report, Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis. Specific documents reviewed by the team are listed in the attachment.

Three fire area inspection samples and five mitigating strategy samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met applicable license commitments.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps and halon supply systems) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements. The team reviewed the fire water supply system flow and pressure tests confirming the system met its design requirements. The team also reviewed the halon suppression functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for fire-fighting.

The team observed an unannounced fire drill and subsequent drill critique on November 5, 2014, using the guidance contained in Inspection Procedure 71111.05AQ, "Fire Protection Annual/Quarterly." The team observed fire brigade members fight a simulated fire in a motor control center, located in the turbine building. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire-fighting techniques;

(4) sufficient fire-fighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train)

• Adequate drainage is provided in areas protected by water suppression systems

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Updated Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown were trained and available on-site at all times, exclusive of those assigned as fire brigade members.

The team performed a timed walkdown of the alternative shutdown procedure with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified that the operators could reasonably be expected to perform specific actions within the time required to maintain plant parameters within specified limits.

Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

Introduction.

The team identified a Green non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant under all postulated fire scenarios.

Description.

The licensee would use Procedure OFN RP-017, "Control Room Evacuation," Revision 45, to perform an alternative shutdown from the auxiliary shutdown panel and other control stations outside of the control room in the event a fire required evacuation of the control room. This procedure provides directions for operators to shut down the plant using only train B equipment. These directions include actions to start and load the train B emergency diesel generator.

The team performed a timed walkdown of the alternative shutdown procedure. Based on the timed walkdown results, the team determined that operators would remove any loads from the emergency diesel generator within 3 minutes 40 seconds. The operators would then proceed to ensure the emergency diesel generator was running, and close the breaker for the essential service water pump within 8 minutes 45 seconds. The team noted that the safe shutdown analysis credited emergency diesel generator cooling when valve EF HS-26A was closed, and the team determined that operators would close this valve within 9 minutes 50 seconds.

Based on these results, the team identified one alternative shutdown scenario where operators would not be able to successfully provide emergency diesel generator cooling prior to the emergency diesel generator reaching a high temperature trip setpoint. If this occurred, operators would need to wait until the emergency diesel generator cooled down before they could restart the emergency diesel generator and provide power to the required safe shutdown equipment (e.g., the charging pump, motor-driven auxiliary feedwater pump, and various motor-operated valves).

The specific scenario involved a control room fire coincident with a loss of offsite power and the expected automatic starting and loading of the train B emergency diesel generator. The team determined that fire damage (e.g., a blown fuse) could prevent the essential service water pump from automatically starting and cooling the emergency diesel generator.

The licensee used Calculation KJ-M-017, "Emergency Diesel Standby Generator (KKJ01B) Runtime Without ESW Flow," Revision 0, to determine the amount of time that the emergency diesel generator could run without essential service water cooling water.

The team used the same methodology to estimate the amount of heat transferred to the emergency diesel generator jacket water based on the steps in the alternative shutdown procedure and the timed walkdown results. For the scenario under consideration, the team determined that the emergency diesel generator would reach the high temperature trip setpoint prior to operators starting the essential service water pump and closing valve EF HS-26A.

The team noted that the control room fire could also cause a spurious actuation that resulted in the addition of another large load to the emergency diesel generator that was not normally sequenced onto the emergency diesel generator following a loss of offsite power. In this instance, additional heat would be added to the emergency diesel generator jacket water and operators would have less time to ensure cooling was provided to the emergency diesel generator before it reached the high temperature trip.

Analysis.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," dated September 20, 2013.

Because it affected the ability to reach and maintain safe shutdown conditions in case of a fire that led to control room evacuation and the Phase 2 methodology of Inspection Manual Chapter 0609, Appendix F, was not appropriate for this finding, a senior reactor analyst performed a Phase 3 evaluation to determine the risk significance.

The senior reactor analyst assigned a generic fire ignition frequency for the control room (FIFCR), which was slightly higher than the value in Calculation AN-95-029, "Control Room Fire Analysis," Revision 1. The analyst multiplied the fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming a 2-minute detection that required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FEVAC) was:

FEVAC = FIFCR

• SF

• NPCRE

= 1.09E-2/year

• 0.1

• 1.30E-2

= 1.42E-5/year The control room had a total of 103 cabinets. The analyst determined that a single fire in one of these cabinets could lead to the loss of essential service water cooling water to the emergency diesel generator and a single fire in two other cabinets could lead to a loss of offsite power. Therefore, a bounding change in core damage frequency for a control room fire that leads to evacuation and the loss of the emergency diesel generator (FEVAC+EDG) was determined to be:

FEVAC+EDG = FEVAC

• 3 / 103

= 1.42E-5/year

• 3 / 103

= 4.14E-7/year This frequency was considered to be bounding since it assumed:

1) A fire in any of the applicable cabinets would cause a loss of offsite power and a loss of essential service water cooling water, resulting in a loss of the emergency diesel generator 2) The conditional core damage probability given a control room fire with evacuation and the loss of the emergency diesel generator was equal to one 3) The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero)

In accordance with the guidance in Inspection Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process," dated May 6, 2004, the senior reactor analyst screened the performance deficiency for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/yr. Given that Wolf Creek has a large, dry containment and that control room evacuation sequences do not include steam generator tube ruptures or intersystem loss of coolant accidents, the analyst determined that this example was not significant with respect to large early release frequency. The analyst determined this example was of very low risk significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure OFN RP-017, "Control Room Evacuation," is a procedure required for fire protection program implementation. Contrary to the above, prior to November 6, 2014, the licensee failed to maintain adequate written procedures covering fire protection program. Specifically, the licensee failed to maintain Procedure OFN RP-017 so that it allowed operators to successfully implement the procedure as written under all required conditions. If the operators implemented the procedure when emergency diesel generator B had automatically started, emergency diesel generator B could have tripped on high temperature and the plant could not have been safely shut down.

Because this violation was of very low safety significance, has been entered into the corrective action program as Condition Report 89788, and the licensee has a fire watch in the control room as a compensatory measure until corrective actions can be taken, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000482/2014008-01, "Inadequate Alternative Shutdown Procedure."

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The teams evaluation focused on the cables of selected components from the reactor coolant system, refueling water storage tank, containment sump, essential service water, main steam atmospheric vent, emergency diesel, and chemical volume and control system. For the sample of components selected, the team reviewed electrical elementary and block diagrams and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place, as needed, to satisfy the separation requirements specified in the fire protection license basis. Specific components reviewed by the team are listed in the attachment.

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkdown of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team evaluated whether the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the timeframes specified in their design and licensing bases. The team reviewed whether the repair equipment, components, tools, and materials needed for the repairs were available and accessible on-site.

b. Findings

Introduction.

The team identified a Green non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to provide an adequate procedure for performing cold shutdown repairs required for post-fire safe shutdown. The licensee documented the deficiencies in Condition Report 00089130.

Description.

The team reviewed a sample of repairs required for achieving and maintaining cold shutdown that required personnel to lift leads and/or install jumpers associated with the boric acid transfer pump BATP2. During the walkthrough of Procedure OFN RP-017A, "Hot Standby to Cold Shutdown from Outside the Control Room Due To Fire," Revision 9, with plant personnel, a plant operator and electrical maintenance technician were unable to demonstrate that they could successfully complete Attachment B, "Jumper Installation for Boric Acid Pump Operation."

Step B2 required wire 16BGG27BH to be removed from a starter/contactor located inside motor control center cubicle NG02AAF4, which is located on the front side of motor control center NG02A. The procedure identified this starter/contactor as terminal block M/terminal point Z (identified as M/Z in the table for Step B2). However, the starter/contactor was not labeled. It is important to note that there is not a traditional terminal block, only terminal points associated with these particular style starter/contactors. The associated drawing, E-13BG27, identified the starter/contactor as device 42. Similar motor control center cubicles were looked at and the starter/contactors were labeled in accordance with their associated drawing, by a number. Step B3 required electrical maintenance personnel to lift and tape two additional cables that are indicated to be located in the rear of motor control center NG02A. Step B4 required the labeling and installation of a jumper to bypass the starter/contactor device 42 (by Step B2 designated as M/Z); however, the procedure did not specify the location as being on the front side of motor control center NG02A.

When asked, both the operator and electrical maintenance technician simulating the jumper installation for the boric acid pump were unsure of the location and stated that they could not perform the procedure as written and would have to contact the technical support center for assistance during an emergency.

The licensee entered these issues into their corrective action program as Condition Report 00089130.

Analysis.

The failure to ensure that Procedure OFN RP-017A could be implemented as written was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire)to prevent undesirable consequences. The finding was evaluated for safety significance using NRC Inspection Manual Chapter 0609, Appendix F. Per Step 1.3, since the finding was related to the ability to achieve safe shutdown with the plant being in a stable hot shutdown condition, and the finding would not impact the ability to maintain hot shutdown, the inspectors determined that the finding was of very low safety significance (Green). This performance deficiency had a cross-cutting aspect in the area of problem identification and resolution associated with evaluation because the licensee did not perform an adequate extent of condition review while taking corrective actions for non-cited Violation 05000482/2011007-04, "Procedure Inadequacies Related to Cold Shutdown Repairs." Specifically, personnel did not verify that the steps in the revised procedure could be performed as written and that the components had proper labeling [P.2].

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Procedure OFN RP-017A, "Hot Standby to Cold Shutdown from Outside the Control Room Due to a Fire," is a procedure required for fire protection program implementation. Contrary to the above, from April 2014 to November 6, 2014, the licensee failed to maintain written procedures that could be implemented covering fire protection program implementation. Specifically, the licensee failed to maintain an adequate procedure for performing cold shutdown repairs required for post-fire safe shutdown since Procedure OFN RP-017A could not be implemented as written. Since the finding was related to the ability to achieve safe shutdown and the plant would remain in stable hot shutdown, no immediate compensatory or corrective actions were required to assure safety. Because this violation was of very low safety significance and it was entered into the corrective action program as condition Report 00089130, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 0500482/2014008-02, "Procedure Inadequacies Related to Cold Shutdown Repairs."

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

The team reviewed operator manual actions credited for achieving hot shutdown for fires that do not require an alternative shutdown. The team verified that operators could reasonably be expected to perform the actions within the applicable shutdown time requirements. The team reviewed these operator manual actions using the guidance contained in NUREG-1852, "Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire," dated October 2007.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed changes to the approved fire protection program. The team verified that the changes did not constitute an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees approved fire protection program, implementing procedures, and programs for the control of ignition sources and transient combustibles.

The team assessed the licensees effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis. The team performed plant walkdowns to independently verify that transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Alternative Mitigation Strategy Inspection Activities

a. Inspection Scope

The team reviewed implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by 10 CFR 50.54(hh)(2).

The team verified that the licensee maintained and implemented adequate procedures, maintained and tested equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the offsite ability to obtain fuel for the portable pump and foam used for firefighting efforts. The team reviewed the following mitigating strategies during this inspection:

• Attachment C - Spent Fuel Pool Makeup Using Fire Protection Standpipe

• Attachment F - Spent Fuel Pool Makeup Using 4-inch Drain Connection and Fire Truck

• Attachment L - CST Makeup Using Fire Protection Standpipe

• Attachment S - Local Manual SG Depressurization

• Attachment U - Low Pressure SG Injection Using Fire Truck Five mitigating strategy samples were completed.

b. Findings

No findings were identified.

.14 Multiple Spurious Operation Circuit Issues

a. Inspection Scope

Enforcement Guidance Memorandum 09-002, "Enforcement Discretion for Fire Induced Circuit Faults," dated May 14, 2009, specified that licensees would have 6 months from the issuance of Regulatory Guide 1.189, "Fire Protection for Nuclear Power Plants,"

Revision 2, to include multiple spurious noncompliances in their corrective action program. Enforcement Guidance Memorandum 09-002 also specified that licensees would have 3 years from issuance of Regulatory Guide 1.189, Revision 2, to complete any required corrective actions (see Section

4OA3 for details of the review).

The team reviewed the expert panel report, corrective action program documents, plant modifications, and engineering analyses. The team interviewed plant personnel involved with developing the modifications and implementing the corrective actions. The team walked down the modifications implemented in the plant. The team performed a detailed review of 28 of the identified multiple spurious operation scenarios (see Section

4OA3 for details of the review).

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the corrective actions for findings identified in previous inspections. The specific condition reports evaluated included:

• Condition Report 045434 associated with Finding 05000482/2011007-01, "Failure to Verify Isolation of Associated Circuits on Isolation Switches"

• Condition Report 045442 associated with non-cited Violation 05000482/2011007-02, "Inadequate Alternative Shutdown Procedure"

• Condition Reports 044912 and 045452 associated with non-cited Violation 05000482/2011007-03, "Failure to Ensure Post-Fire Safe Shutdown Components Remain Free of Fire Damage"

• Condition Reports 045397, 045399, 045401, and 045417 associated with non-cited Violation 05000482/2011007-04, "Procedure Inadequacies Related to Cold Shutdown Repairs" During its review of the findings related to circuits, the team evaluated whether the licensee effectively implemented the corrective actions documented in correspondence related to the spurious operation of the power-operated relief valves.

b. Findings

No findings were identified.

4OA3 Followup of Events and Notices of Enforcement Discretion

(Closed) Licensee Event Report 05000482/2010-007-00 and 05000482/2010-007-01:

Post-Fire Safe Shutdown Fire-Induced Multiple Spurious Operation Issues This licensee event report documented that the licensee had identified five multiple spurious operation issues that had insufficient operator guidance for responding to equipment maloperation. The licensee had identified the following issues during their post-fire safe shutdown by fire area re-analysis of multiple spurious circuit failures. The five multiple spurious issues included:

• Three issues that affected operation of the residual heat removal pumps

• Spurious actuation of pressurizer spray valves

• Spurious start of a centrifugal charging pump and overfill of the pressurizer The licensee had completed modifications for each of these reported deficiencies. In addition, the licensee had identified six other multiple spurious issues that required reanalysis and, in some cases, design document changes, but no plant modifications.

The licensee documented these 11 multiple spurious operation issues in Condition Report 25002.

The team performed a detailed review of the information related to this deficiency. The team reviewed drawings, design documents, and discussed the implemented modifications with fire protection personnel to gain an understanding of the actions taken to address the deficiency. The team verified that the licensee established appropriate compensatory measures and corrective actions.

The team reviewed these deficiencies as part of the review of licensee evaluation and resolution of multiple spurious operation scenarios. In addition to the 61 Pressurized Water Reactor Owners Group multiple spurious operation scenarios, the licensee expert panel had identified 14 scenarios and plant operations personnel identified one additional scenario. The team reviewed the scenario table and selected 28 of the multiple spurious operation evaluations for additional review, which included the five modifications and six other items discussed earlier.

Enforcement Guidance Memorandum (EGM) 09-002, "Enforcement Discretion for Fire Induced Circuit Faults," dated May 14, 2009, specified that licensees would have 6 months from issuance of Regulatory Guide 1.189, "Fire Protection for Nuclear Power Plants," Revision 2, dated November 2, 2009, to include multiple spurious noncompliances in their corrective action program. Licensees would then have 3 years from issuance of Regulatory Guide 1.189, Revision 2, to complete any required corrective actions.

Corrective actions were scheduled to be completed during the Refueling Outage 19, which was originally scheduled to be started for September 2012. However, Refueling Outage 19 was rescheduled to February 2013 due to a longer than expected previous refueling outage and an extended forced outage in January 2012. Missing the EGM deadline for completing the corrective actions was a performance deficiency and was screened in accordance with Manual Chapter 0612, Appendix B, "Issue Screening."

It was determined that the performance deficiency was a minor violation due to the low safety impact of the additional time necessary to implement the corrective actions and did not affect the cornerstone objective. The team verified that the corrective actions were completed during Refueling Outage 19 which began in February 2013.

.2 (Closed) Licensee Event Report 05000482/2013-009-00: Unanalyzed

Condition - Post-Fire Safe Shutdown Design Issue May Impact Ability to Achieve Safe Shutdown This licensee event report documented that the licensee had ammeters installed on the main control board without circuit overcurrent protection. Because of the lack of circuit overcurrent protection, a fire affecting the eight safety-related ammeter circuits could create a secondary fire in another area of the plant. The licensee had confirmed that only safety-related circuits were affected and required modification.

The team performed a detailed review of the information related to this deficiency. The team reviewed drawings, design documents, and discussed the event with plant personnel to gain an understanding of the actions taken to address the deficiency. The team verified that the licensee established appropriate compensatory measures, corrective actions, and planned modifications.

The licensee documented this deficiency in their corrective action program as Condition Report 00074959 and initiated actions to review the applicable circuits. As compensatory measures, the licensee established roving fire watches in the fire areas where the circuits were routed.

The team reviewed the planned circuit modifications and verified that they will correct the deficiency. This licensee-identified finding involved a violation of License Condition 2.C(5). The team discussed the enforcement related to this deficiency in Section 4OA7.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. A. Heflin, President and Chief Executive Officer, and other members of the licensee staff at an exit meeting on November 6, 2014. The licensee acknowledged the findings presented.

The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

4OA7 Licensee-Identified Violations

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements that meets the criteria of Section 2.3.2.a of the NRC Enforcement Policy for being dispositioned as a non-cited violation.

Unanalyzed Condition - Post-Fire Safe Shutdown Design Issue May Impact Ability to Achieve Safe Shutdown On October 9, 2013, Licensee Event Report 05000482/2013-009 described an unanalyzed condition wherein a fire in fire areas containing certain unprotected, shunt, direct current ammeter circuits could result in secondary fires outside the initial fire area. This condition can occur only under specific circuit fault conditions wherein a fire causes a short to ground on cables associated with the DC ammeters, concurrent with a short to ground on a safety-related 125V DC circuit on the negative side of the same battery source. This condition is known as a ground equivalent hot short. The ammeter circuits are not overcurrent protected and, consequentially, could overheat and ignite anywhere along the route of the associated ammeter cables. The licensee determined in a cause analysis and extent of condition review that the only affected circuits were the eight DC ammeters associated with the safety-related 125V DC batteries and battery chargers. The team determined the routing of the affected cables involved five fire areas. The five fire areas were switchboard rooms/battery rooms FA C16, locked cable chase FA C18, locked cable chase FA C24, lower cable spreading room FA C21, and control room FA C27.

The team evaluated the various scenarios of where the primary fire could start and where the secondary fire(s) could develop. The team determined that there were no normal ignition sources (electrical cabinets or equipment) in the two locked cable chases or the lower cable spreading room. Transient combustibles in these areas were strictly controlled by Procedure AP 10-102, "Control of Combustible Materials,"

Revision 18, and the cable chases are protected by a wet pipe automatic sprinkler system and automatic smoke detection alarms in the main control room. A fire in the switchboard rooms/battery room FA C16 is the area where the ammeter shunts are located and a primary fire there would not result in a secondary fire outside this area.

The only remaining fire area to evaluate was the control room FA C27, which had a low combustible loading, all cables entering the control room are IEEE 383 rated, and the cables and cable trenches were protected by an automatic halon extinguishing system and automatic smoke detectors. While a primary fire in the control room could cause a secondary fire to develop along the cable route, the team determined that in the event that a secondary fire did occur that the impact would be limited to the same train as the primary fire. Therefore, the redundant post-fire safe shutdown success path would be unaffected by the fire.

License Condition 2.C(5)(a) specifies, in part, that the licensee implement and maintain in effect all provisions of the approved fire protection program as described in the Standardized Nuclear Power Plant System Final Safety Analysis Report through Revision 17, the Wolf Creek site addendum through Revision 15, and as approved in the Safety Evaluation Report through Supplement 5, Amendment No. 191, Amendment No. 193, and Amendment No 205. Section 4.4.1.1 of the Fire Hazards Analysis states that "only one fire is postulated to occur at any one time and multiple fires are not postulated." Contrary to the above, since initial construction until November 6, 2014, the licensee failed to implement the fire protection program that ensured only one fire will occur at one time. Specifically, the licensee failed to ensure that direct current ammeter circuits were properly protected to prevent secondary fires from initiating in other areas of the plant. The performance deficiency was more than minor because it was associated with the protection against external factors attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events (fire) to prevent undesirable consequences. The finding was evaluated for safety significance using NRC Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," dated September 20, 2013. Since the finding was related to the ability to achieve safe shutdown and safe shutdown would be unaffected, the inspectors determined the finding had a very low safety significance (Green). Specifically, no secondary fires resulting from a primary fire could prevent the reactor from achieving safe shutdown. The licensee documented this issue in their corrective action program as Condition Report 00074959. This violation is also discussed in Section 4OA3.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Alford, Engineering

D. Anderson, Supervisor, IMR

R. Audano, Superintendent, Maintenance

T. Baban, Manager, Systems Engineering

R. Birk, Superintendent, Mechanical Maintenance

L. Brinkly, Supervisor, Maintenance Corrective Action Program

A. Broyles, Manager, Information Services

K. Clark, Fire Protection Technician

R. Coombes, Reactor Operator

J. Cuffe, Supervisor, Health Physics

D. Dees, Superintendent, Operations Support

D. Erbe, Manager, Security

R. Flannigan, Manager, Nuclear Engineering

R. Fincher, Manager, Quality

B. Fox, Engineer, Appendix R Safe Shutdown

J. Fritton, PWR Owners Group

C. Garland, Nuclear Station Operator

N. Good, Licensing

D. Grove, Superintendent, Maintenance Support

A. Heflin, President and Chief Executive Officer

S. Henry, Manager, Integrated Plant Services

P. Herrman, Manager, Programs

D. Hess, FIN Electrician

R. Hobby, Licensing

J. Keating, Reactor Operator

W. Ketchum, Supervisor, Engineering

J. Knust, Licensing

S. Koenig, Manager, Regulatory Affairs

B. Logan, Master IMR Technician

D. Mand, Manager, Design Engineering

J. McCory, Vice President, Engineering

E. McIntyre, Manager, Human Resources

W. Muilenburg, Supervisor, Licensing

B. Reasoner, Site Vice President and Chief Nuclear Operations Officer

S. Schrum, Nuclear Station Operator

T. Slenker, Operations

A. Stull, Vice President and Chief Administrative Officer

E. Smith, Design Engineer

S. Smith, Plant Manager

T. Smith, Manager, Project Construction

J. Suter, Supervisor, Fire Protection Engineering

D. Sullivan, Manager, Supply Chain Services

S. Teal, Supervisor, Organizational Effectiveness

K. Thompson, Superintendent, Site Safety

L. Upson, Manager, Strategic Initiatives

Attachment

Licensee Personnel

A. Vickery, Manager, Financial Services

R. Wolfe, Non-licensed Nuclear Operator

J. Yunk, Manager, Corrective Action

NRC Personnel

C. Peabody, Senior Resident Inspector

R. Stroble, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None

Opened and Closed

0500482/2014008-01 NCV Inadequate Alternative Shutdown Procedure

(Section 1R05.05)0500482/2014008-02 NCV Procedure Inadequacies Related to Cold Shutdown Repairs

(Section 1R05.09)

Closed

05000482/2010-007-00 LER Post-Fire Safe Shutdown Fire-Induced Multiple Spurious

Operation Issues

05000482/2010-007-01 LER Post-Fire Safe Shutdown Fire-Induced Multiple Spurious

Operation Issues

05000482/2013-009-00 LER Unanalyzed Condition - Post-Fire Safe Shutdown Design

Issue May Impact Ability to Achieve Safe Shutdown