IR 05000416/2005008

IR 05000416-05-008, on 04/11/2005 - 05/12/2005, Grand Gulf Nuclear Station; Triennial Fire Protection Inspection

ML051720534
Person / Time
Site:	Grand Gulf
Issue date:	06/21/2005
From:	Laura Smith Division of Reactor Safety IV
To:	Gerald Williams Entergy Operations
References
IR-05-008
Download: ML051720534 (33)

Text

une 21, 2005

SUBJECT:

NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000416/2005-08

Dear Mr. Williams:

On April 11, 2005, through May 12, 2005, the NRC completed an inspection at your Grand Gulf Nuclear Station. The enclosed report documents the inspection findings which were discussed on May 12, 2005, with you and members of your staff.

This inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed plant personnel.

Based on the results of this inspection, the NRC has identified three findings that were evaluated under the risk significance determination process as having very low safety significance (green). The NRC has also determined that one of these findings involved a violation of NRC requirements. This violation is being treated as a noncited violation (NCV),

consistent with Section VI.A of the Enforcement Policy. This NCV is described in the subject inspection report. If you contest the violation or significance of this NCV, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Grand Gulf Nuclear Station facility.

Entergy Operations, Inc. -2-In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

//RA//

Linda Joy Smith, Chief Engineering Branch 2 Division of Reactor Safety Docket: 50-416 License: NPF-29

Enclosure:

Inspection Report 05000416/2005-08 w/Attachment Supplemental Information

REGION IV==

Docket: 50-416 License: NPF-29 Report No.: 05000416/2005-08 Licensee: Entergy Operations, Inc.

Facility: Grand Gulf Nuclear Station Location: Waterloo Road Port Gibson, MS Dates: April 11, 2005 through May 12, 2005 Inspector(s): N. O'Keefe, Senior Reactor Inspector J. Mateychick, Senior Reactor Inspector R. Mullikin, Consultant Accompanying S. Rutenkroger, Reactor Inspector (NSPDP)

Personnel: D. Livermore, Reactor Inspector Contractor: K. Sullivan, Brookhaven National Laboratory Approved By: L. Smith, Chief, Engineering Branch 2 Enclosure

SUMMARY OF FINDINGS

IR 05000416/2005-08; April 11, 2006 through May 12, 2005; Grand Gulf Nuclear Station:

Triennial Fire Protection Inspection.

The report covered a period of inspection by regional specialist inspectors, a consultant and a contractor. One Green non-cited violation (NCV) and two Green findings were identified. The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Cornerstone: Mitigating Systems

Green.

A noncited violation of 10 CFR 50, Appendix R, Section III.L.3 was identified for an inadequate alternative shutdown procedure. The team identified that Procedure 05-1-02-II-1, "Shutdown from the Remote Shutdown Panel," Revision 30, was not consistent with the safe shutdown analysis with respect to main steam isolation. The procedure did not require shutting the main steam isolation valves in a timely manner to prevent an excessive loss of reactor coolant in the event of a control room evacuation due to fire. Operators might not recognize the loss of coolant due to the limited indications available on the remote shutdown panel. This could result in loss of the reactor coolant makeup and decay heat removal functions. The licensee promptly corrected the procedure and entered this issue in their corrective action program under Condition Report 2005-01865.

Failure to assure that an important safe shutdown analysis assumption was translated into the alternative shutdown procedure was a performance deficiency. This issue was more than minor because it affected the Mitigating Systems cornerstone attributes of protection from external factors (fire) and procedure quality. Manual Chapter 0609,

Appendix F, "Fire Protection Significance Determination Process," Appendix F states that it excludes findings associated with control room evacuation. Therefore, in accordance with Manual Chapter 0609, the safety significance of this issue was determined by regional management review. This review concluded this finding was of very low safety significance because a licensee evaluation determined that the inventory lost from the reactor and containment through open main steam isolation valves following a control room fire would not affect low pressure injection for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Also, during the initial stages, the inventory loss would be beneficial compared to promptly shutting the main steam isolation valves, since the steam would be removing significant heat that would otherwise have been retained in containment and would have to be removed through the remaining engineered safety features train. Therefore, additional assistance would be available from the technical support center and repair teams to help identify the problem and direct closure of the main steam isolation valves.

(Section 1R05.6.2)

Green.

A finding was identified for fire brigade performance deficiencies that were not identified by the licensee during the drill critique. The deficiencies identified by the inspection team but not noted by the licensee's critique included not using lense inserts, using a fire hose that did not reach the fire properly, not maintaining a two-person rescue team, and not considering requesting offsite assistance. The licensee identified a number of additional performance deficiencies, and determined that performance during the May 10, 2005, unannounced fire drill was unsatisfactory. In accordance with the licensee's program, the individuals involved required remediation and the drill must be re-performed within 30 days.

The licensees incomplete assessment of fire brigade during the unannounced May 10, 2005, fire drill was a performance deficiency because the corrective action process would not have addressed the missed performance problems. This finding was more than minor because the Mitigating Systems cornerstone objective attribute to provide protection against external factors (fires) was affected. Manual Chapter 0609,

Appendix F, "Fire Protection Significance Determination Process," states that it excludes findings associated with the onsite manual fire brigade. Therefore, in accordance with Manual Chapter 0609, the safety significance was determined by regional management review. This review concluded that this finding was of very low safety significance because it reflected a training drill, rather than fire brigade fire performance during an actual fire. The fire brigade performance aspect of this finding affects the cross-cutting area of human performance. The incomplete drill evaluation aspect of this finding affects the crosscutting area of problem identification and resolution. This issue was entered into the licensee's corrective action program under Condition Report 2005-01872. (Section 1R05.4)

Green.

A finding was identified for not properly identifying repairs needed to achieve and maintain cold shutdown following a control room fire and documenting them in analyses and procedures. The team identified two repairs which were necessary in order to be able to achieve cold shutdown according to the licensee's alternate shutdown methodology. An alternate air supply was needed to maintain safety relief valves open during prolonged implementation of alternate shutdown cooling, and temporary instrumentation was needed to monitor reactor temperature and cooldown rate in the same mode. This issue was entered into the licensee's corrective action program under Condition Report 2005-02369.

Failure to properly identify repairs needed to achieve and maintain cold shutdown following a control room fire and document them in analyses and procedures was a performance deficiency. This issue was more than minor because it affected the Mitigating Systems cornerstone attributes of protection from external factors (fire) and procedure quality. This finding was determined to have very low safety significance using Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it involved an issue that only affected cold shutdown.

(Section 1R05.10)

B. Licensee-Identified Findings None.

REPORT DETAILS

1R05 Fire Protection

The purpose of this inspection was to review the Grand Gulf Nuclear Stations fire protection program for selected risk-significant fire areas. Emphasis was placed on verification of the licensee's post-fire safe shutdown capability. The inspection was performed in accordance with the NRC regulatory oversight process using a risk-informed approach for selecting the fire areas and attributes to be inspected. The team used the Individual Plant Examination for External Events for the Grand Gulf Nuclear Station to choose several risk-significant areas for detailed inspection and review.

Inspection Procedure 71111.05T, Triennial Fire Protection, requires selecting three to five fire areas for review. The four fire areas reviewed during this inspection were:

• Fire Area 11 - Auxiliary building 139 ft (Fire Zones 1A301-1A302 (corridors),1A316 (motor control center area), and 1A322 (centrifugal chiller area))

• Fire Area 31 - Division 1 switchchgear room (Fire Zone 0C202)

• Fire Area 42 - Control building areas, multiple elevations (Fire Zones 0C302-0C303 (ventilation equipment rooms), 0C308 (corridor) and 0C402 (lower cable spreading room))

• Fire Area 50 - Control building areas including the main control room (Fire Zones 0C502-0C504 main control room areas), 0C608 (technical support center), and 0C617-0C619 (electrical cable chases))

The team also performed a partial review of the turbine building to examine those areas with cables associated with offsite power.

For each of these fire areas, the inspection focused on fire protection features, systems and equipment necessary to achieve and maintain safe shutdown conditions, and licensing basis commitments.

Documents reviewed by the team are listed in the attachment.

.1 Systems Required to Achieve and Maintain Post-Fire Safe Shutdown

a. Inspection Scope

The team reviewed the licensee's methodology for achieving and maintaining post-fire safe shutdown to ensure that at least one post-fire safe shutdown success path was available in the event of a fire in each of the selected areas. The principal sources of this information included: Updated Final Safety Analysis Report (UFSAR) Appendices 9A (Fire Hazards Analysis Report) and 9C (Analysis of Safe Shutdown in the Event of a Major Fire) and supporting calculation FPP-1(Appendix R Evaluation Procedure ). The team focused on the following functions that must be available to achieve and maintain post-fire safe shutdown conditions:

• Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

• Reactor coolant makeup capable of maintaining the reactor coolant inventory,

• Reactor heat removal capable of achieving and maintaining decay heat removal, and

• Supporting systems capable of providing all other services necessary to permit extended operation of equipment necessary to achieve and maintain hot shutdown conditions.

The team verified that specific safe shutdown (SSD) can be achieved and maintained with or without off-site power unless it was confirmed that a postulated fire in any of the selected fire areas/zones could not cause the loss of off-site power (LOOP).

To assure the licensee had properly identified the components and equipment necessary to achieve and maintain safe shutdown conditions in the fire areas selected for review, the team reviewed piping and instrumentation diagrams for the systems required for performing the functional requirements listed above. In addition, plant drawings, operating procedures, and other relevant documents were reviewed to verify the flow paths and operational characteristics of those systems relied on to accomplish the safe shutdown functions.

For each of the above functions, the team verified that the licensees methodology had properly identified the primary and support systems needed to assure their success. To verify whether the shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions, the team reviewed system design documents (e.g., design-basis documents, wiring diagrams, and piping and instrumentation diagrams) for a selected sample of equipment of primary and support shutdown systems. The results of this review were then compared to the list of safe shutdown equipment documented in Appendix A of FPP-1, Appendix R Evaluation Procedure, Rev. 3.

The team also checked if instrumentation required for post-fire SSD was adequately protected from the effects of fire within each of the fire areas/zones inspected. The SSD components, which were reviewed for operability during and after a fire in each of the selected fire areas/zones, are listed in the attachment. A list of the documents reviewed for this inspection element are also included in the attachment.

b. Findings

No findings of significance were identified.

.2 Fire Protection of Safe Shutdown Capability

a. Inspection Scope

For the selected fire areas/zones, the team evaluated the potential for fires, the combustible fire load characteristics, potential exposure fire severity, the separation of systems necessary to achieve and maintain SSD, and the separation of electrical components and circuits to ensure that at least one SSD train of equipment would remain free of fire damage.

On a sample basis, the adequacy of separation provided for the power and control cabling of redundant trains of shutdown equipment was evaluated. The evaluation focused on the cabling of selected components for the residual heat removal (RHR),nuclear boiler, and the standby service water (SSW) systems and included a sample of components whose failure or inadvertent operation due to fire could significantly affect the post-fire SSD capability. The specific components selected are listed in the attachment. A list of the documents reviewed for this inspection element are also included in the attachment.

b. Findings

No findings of significance were identified.

.3 Passive Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, fire doors, and electrical raceway fire barriers. The team observed the material condition and configuration of the installed barriers, seals, and doors. The team compared the as-installed configurations to the approved construction details and supporting fire tests. The team also verified that redundant trains of systems located in the same fire area were protected by a raceway fire barrier on one train of electrical cables or were subject to a deviation from the requirements of 10 CFR Part 50, Appendix R based on separation distance, the level of fire hazards present and existing fire protection features. Conditions in areas with deviations were confirmed to be consistent with licensee documents and NRC safety evaluation reports. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and National Fire Protection Association (NFPA)codes to verify that fire protection features met license commitments.

b. Findings

No findings of significance were identified.

.4 Active Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire suppression and detection systems. The team observed the material condition and configuration of the installed fire detection and suppression systems. The team reviewed design documents and supporting calculations. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the NFPA codes to verify that fire suppression and detection systems met license commitments.

The team also evaluated an unannounced site fire drill and the subsequent drill critique using the guidance in Inspection Procedure 71111.05T. The team reviewed station procedures for fire fighting, fire response operating procedures, and offsite notification.

b. Findings

Introduction.

A Green finding was identified for fire brigade performance deficiencies that were not identified by the licensee during a fire drill critique. The deficiencies identified by the inspection team but not noted by the licensee's critique included not using lense inserts, using a fire hose that didn't reach the fire properly, not maintaining a two-person rescue team, and not considering requesting offsite assistance. The licensee identified a number of additional performance deficiencies, and determined that drill performance was unsatisfactory. In accordance with the licensee's program, the individuals involved required remediation and the drill must be re-performed within 30 days.

Description.

On May 10, 2005, the team observed an unannounced fire drill. Team members observed operator actions in the control room, along with fire brigade assembly, dress-out, response to the simulated motor control center fire, and smoke removal activities. The team then observed the drill critique and discussed the drill results with the controllers.

The licensee identified the following issues:

• The fire brigade was slow getting to the point of attacking the fire (34 minutes from the report of fire).

• The Fire Brigade Leader did not brief the fire brigade members on the fire conditions or strategy for attacking the fire, nor did he maintain accountability and control of his members.

• Radio communications were very difficult and site public address system was also difficult to hear in many areas.

• Control room personnel did not supply an operator to deenergize the motor control center that was simulated to be on fire, so the fire brigade had to do it, contrary to station policy.

• Support and participation by other site personnel was lacking, which limited the training value. For example, maintenance personnel were assigned responsibility to help haul fire brigade support equipment to the fire location, but no maintenance personnel participated in the drill.

• The fire brigade did not make a prompt search for injured personnel or spread of fire.

• Nobody took positive control of air use. Nobody ordered individuals to start using self-contained breathing apparatuses (SCBAs), or recorded start times.

Therefore, nobody was planning for swapping people out or getting replacement air bottles before fire brigade members exhausted their air bottles. Some fire brigade members started using their SCBAs 15 minutes before the simulated fire was attacked, wasting air.

• The fire brigade did not adequately demonstrate the proper use of portable fans and hose connections, or with the smoke removal plan. The hardware for making connections between fans and duct-hoses were damaged or difficult to mate properly.

The fire drill was rated as unsatisfactory by the drill controllers.

The team identified the following additional performance and equipment problems:

• Three fire brigade member arrived at the dressout area with prescription safety glasses, but did not use lense inserts when they donned air masks.

• The Fire Brigade Leader did not effectively utilize the fire pre-plan. He did not refer to the pre-plan until after the fire was simulated to be out, when he was prompted by the drill controller to review it for smoke removal instructions. He located the wrong pre-plan, and as a result, improperly concluded that no action was needed for smoke removal.

• The fire hose was only marginally effective in reaching the simulated fire. When fully extended, it was about 15 feet short of the simulated fire and required the nozzle to be located at an awkward angle for effectively spraying the cabinet internals.

• The fire brigade did not demonstrate a proper implementation of maintaining a rescue team outside the fire area. At one point, four fire brigade members and the fire brigade leader were in the fire area, with one fire brigade member who was out of air as the only "available" rescue person.

• The training value and realism were limited by the lack of support and participation by other site personnel. For example, control room operators did not walk down panels looking for symptoms of fire damaged equipment and did not use event classification and notification procedures. No simulations of equipment damaged by fire or plant impact due to de-energizing the motor control center were provided. Security personnel did not participate in the drill.

• Neither the control room personnel nor the fire brigade leader discussed requesting offsite assistance. The team concluded that the licensee had no clear policy guidance on this. With an average response time of 20-30 minutes for the local fire department, control room operators should have promptly requested offsite assistance.

Analysis.

The licensees incomplete assessment of fire brigade performance during the unannounced May 10, 2005, fire drill was a performance deficiency: FIN 05000416/2005008-01, Inadequate Fire Drill Critique. This finding was more than minor because the reactor safety mitigating systems cornerstone objective attribute to provide protection against external factors (fire) was affected. The inspectors referred to Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," to analyze this finding because the condition had an adverse effect on fire brigade effectiveness related to defense-in-depth strategies. Appendix F states that it excludes findings associated with the onsite manual fire brigade. Therefore, in accordance with Manual Chapter 0609, the safety significance was determined by regional management review. It was concluded that this finding was of very low safety significance because it reflected a training drill, rather than fire brigade fire performance during an actual fire. The fire brigade performance aspect of this finding affects the cross cutting area of human performance. The incomplete drill evaluation aspect of this finding affects the cross-cutting area of problem identification and resolution.

This issue was entered into the licensee's corrective action program under Condition Report 2005-01872.

Enforcement.

No violations of NRC requirements were identified.

.5 Protection From Damage Due to Fire Suppression Activities

a. Inspection Scope

For the sample areas, the team verified that redundant trains of systems required for hot shutdown were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems including the effects of flooding. The team also verified that in situations where redundant trains of systems located in the same fire area, either one train was protected by a raceway fire barrier or a deviation from the requirements of 10 CFR Part 50, Appendix R was approved.

Conditions in areas with deviations were confirmed to be consistent with licensee documents and NRC safety evaluation reports.

b. Findings

No findings of significance were identified.

.6 Alternative Safe Shutdown Capability

a. Inspection Scope

The team reviewed the licensee's alternative shutdown methodology to determine if the licensee properly identified the components, systems, and instrumentation necessary to achieve and maintain safe shutdown conditions from the remote shutdown panel and alternative shutdown locations. The team confirmed that plant design was such that alternate shutdown was only required for a fire in the control room complex, and the extent of that area was consistent with the ventilation system as well as the fire barriers.

The team focused on the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring and support system functions. The team verified that hot and cold shutdown from outside the control room could be achieved and maintained with offsite power available or not available. The team verified that the transfer of control from the control room to the alternative locations was not affected by fire-induced circuit faults by reviewing the provision of separate fuses for alternative shutdown control circuits.

The team also reviewed the operational implementation of the licensee's alternative shutdown methodology. Team members observed a walk-through of the control room evacuation procedures with one non-licensed operator, one licensed reactor operator, and one licensed senior reactor operator. The team observed operators simulate performing the steps of Procedure 05-1-02-II-1, "Shutdown from the Remote Shutdown Panel," Revision 30, which provided instructions for performing an alternative shutdown from the remote shutdown panel and for manipulating equipment locally in the plant.

The team verified that the minimum number of available operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable plant shutdown time requirements, and that equipment labeling was consistent with the procedure. Also, the team verified that procedures, tools, dosimetry, keys, lighting, and communications equipment were available and adequate to support successfully performing the procedure as intended. The team also reviewed records for operator training conducted on this procedure.

The team reviewed the time-critical manual actions identified by the licensee as being necessary to support alternate shutdown from outside the control room. Calculations and analyses which provided the bases for these critical times were also reviewed. The simulated completion times recorded during the procedure walk-through were then compared to the analytical values to verify that the procedure could be implemented as intended.

b. Findings

(1) Inadequate Procedure to Start and Load Emergency Diesel Generator Locally

Introduction.

An unresolved item was identified associated with inadequate procedures for locally starting and loading an emergency diesel generator (EDG) during a control room evacuation due to fire with loss of offsite power. During a walkthrough of a control room evacuation, the team identified that the procedure steps called for manipulation of controls in the control room in order to manually start the Division 1 EDG. The team noted that this procedure section was not specifically written for a control room evacuation. This issue is unresolved for both significance and enforcement because additional technical information was needed to assess the issue. The procedure was promptly corrected.

Description.

On April 12, 2005, the team observed a walkthrough of the procedures used to implement the licensee's alternative shutdown strategy. Operators were instructed to walkthrough the procedure steps necessary to evacuate the control room due to fire, shut down the plant, and achieve hot shutdown conditions. This was done for both situations where offsite power was available and not available.

Procedure 05-1-02-II-1, "Shutdown from the Remote Shutdown Panel," Revision 30, required operators to use System Operating Instruction 04-1-01-P75-1, "Standby Diesel Generator System," Revision 67, to locally start the Division 1 EDG in the event that offsite power was not available. However, this procedure did not provide instructions that could successfully start and load the EDG from outside the control room. Steps to shut the output breaker and load the EDG were written to be performed from inside the control room, which was not possible once the control room was evacuated.

Using electrical schematics, the licensee was able to demonstrate that two simple methods were available to start and load an emergency diesel generator locally. The team determined through interviews that it was likely that operators would be able to complete this action, even though it was not specifically contained in the procedure.

The team determined that the licensee was fundamentally relying on the EDG to start and load automatically in the event offsite power was lost. However, the team determined that the controls for this automatic actuation could be damaged by the postulated fire in the control room, and therefore could not be relied upon to function.

The team did an extent of condition review of other automatic actuations that might have been inappropriately relied upon. As discussed on Section 1R05.6.2, the licensee was also found to be inappropriately crediting automatic closure of the main steam isolation valves.

Analysis.

Failure to have an alternative shutdown procedure to restore power following a control room evacuation with loss of offsite power was a performance deficiency. This issue is potentially more than minor because it potentially affected the mitigating systems cornerstone objective for the procedure quality and protection from external factors attributes. However, additional information was needed to determine whether one or more credible fire scenarios existed which could simultaneously cause a control room evacuation, a loss of offsite power, and prevent automatic starting and loading of the Division 1 EDG.

Enforcement.

Appendix R to 10 CFR 50, Section III.G.3 covers requirements for alternative shutdown areas, such as the control room at Grand Gulf.Section III.L provides requirements for the performance capability of alternative shutdown capability;Section III.L.3 requires that "the alternative shutdown capability shall be independent of the specific fire area(s) and shall accommodate postfire conditions where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Procedures shall be in effect to implement this capability."

Additional information was needed to determine whether one or more credible fire scenarios existed which could cause a control room evacuation, a loss of offsite power, and prevent automatic starting and loading of the Division 1 EDG. Therefore, this issue will be treated as an unresolved item pending additional inspection and review: URI 05000416/2005008-02, Inadequate Alternative Shutdown Procedure for Locally Starting and Loading an EDG.

(2) Inadequate Procedure For Ensuring Timely Main Steam Isolation

Introduction.

A Green noncited violation was identified for an inadequate fire safe shutdown procedure. The team identified that the procedure for shutting down the plant in response to a fire in the control room was not consistent with the safe shutdown analysis with respect to main steam isolation. The procedure did not require shutting the main steam isolation valves (MSIV) in a timely manner to prevent an excessive loss of reactor coolant. Operators might not recognize the loss of coolant because of the limited indications available at the remote shutdown panel, which could lead to the loss of the reactor makeup and decay heat removal functions.

Description.

For a fire in the control room that requires evacuation, the plant was licensed to be brought to a safe shutdown condition using alternative shutdown equipment and methods which were different than the normal method. Generally, these methods are required to meet the acceptance criteria of 10 CFR Part 50, Appendix R, Section III.L. The safe shutdown analysis demonstrated adequate core cooling by relying on manual plant depressurization and core reflood using low pressure coolant injection controlled from the Remote Shutdown Panel. The NRC approved an exemption to the III.L requirement to keep the core covered at all times based on this safe shutdown analysis.

The inspectors identified that Procedure 05-1-02-II-1, "Shutdown from the Remote Shutdown Panel," Revision 30, was not consistent with the safe shutdown analysis with respect to main steam isolation. The procedure did not require prompt shutting of the main steam isolation valves to prevent excess reactor coolant inventory loss to the steam system. The procedure eventually directs MSIV closure when changing to the alternate shutdown cooling mode, but the time when this would occur was not specified in the procedure. The licensee's safe shutdown methodology provided a fixed amount of makeup water from the suppression pool inside containment, which could eventually be exhausted through losses if the MSIVs were not shut. Loss of suppression pool level in this way could cause loss of suction to the low pressure injection pump and loss of core cooling.

The team determined that the licensee had been relying on one of two events to cause the automatic closure of the MSIVs: automatic closure due to a low reactor water level, or loss of offsite power to the valves. The team pointed out that the licensee could not rely on a loss of offsite power to accomplish this actuation, since offsite power was expected to be lost in only a small fraction of possible control room fires. Also, the automatic actuation control circuits for low reactor water level were not protected from damage due to a control room fire, so they could not be relied upon to function.

Analysis.

Failure to assure that an important safe shutdown analysis assumption was translated into the alternative shutdown procedure was a performance deficiency. This issue was more than minor because it affected the Mitigating Systems cornerstone attributes of protection from external factors (fire) and procedure quality.

Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," Appendix F states that it excludes findings associated with control room evacuation. Therefore, in accordance with Manual Chapter 0609, the safety significance of this issue was determined by regional management review. This review concluded this finding was of very low safety significance because a licensee evaluation determined that the inventory lost from the reactor and containment through open MSIVs following a control room fire would not affect low pressure injection for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Also, during the initial stages, the inventory loss would be beneficial compared to promptly shutting the MSIVs, since the steam would be removing significant heat that would otherwise have been retained in containment and would have to be removed through the remaining engineered safety features train. Therefore, additional assistance would be available from the technical support center and repair teams to help identify the problem and direct closure of the MSIVs.

Enforcement.

Failure to adequately translate an important safe shutdown analysis assumption into the alternative shutdown procedure was a violation of 10 CFR 50, Appendix R, Section III.L.3. This issue is being treated as a non-cited violation in accordance with Section VI.A of the NRC Enforcement Policy: NCV 05000416/2005008-03, Alternative Shutdown Procedure Did Not Implement Safe Shutdown Analysis Assumption to Isolate Containment in a Timely Manner. The licensee corrected the procedure and entered this issue in their corrective action program under Condition Report 2005-01865.

.7 Circuit Analyses

a. Inspection Scope

The team reviewed the licensees post-fire safe shutdown analysis to verify that the licensee had identified both required and associated circuits that may impact safe shutdown. The NRC inspection of associated circuits had been the subject of a moratorium since November 2000, but was reinitiated in January 2005.

On a sample basis, the team verified that cables of equipment required to achieve and maintain hot shutdown conditions in the event of fire in selected fire zones had been properly identified. In addition, the team verified that these cables had either been adequately protected from the potentially adverse effects of fire damage, mitigated with approved manual operator actions, or analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. In order to accomplish this, the team reviewed electrical schematics and cable routing data for power and control cables associated with each of the selected components.

Since the licensee utilizes thermoset cables, the team reviewed the following cable failure modes for selected required and associated circuits:

• Spurious actuations due to any combination of conductors within a single multiconductor cable;

• A maximum of two cables considered where multiple individual cables may be damaged by the same fire;

• For cases involving direct current control circuits, the potential spurious operation due to failures of the control cables (even if the spurious operation requires two concurrent shorts of the proper polarity, e.g., plus-to-plus and minus-to-minus);and

• For cases involving decay heat removal system isolation valves at high-pressure/low-pressure interfaces, the vulnerability of three-phase power cables due to three-phase proper polarity hot shorts.

In addition, on a sampling basis, the team reviewed the adequacy of selected electrical protective devices (e.g., circuit breakers, fuses, relays), breaker coordination, and the adequacy of electrical protection provided for nonessential cables, which share a common enclosure (e.g., raceway, junction box, conduit, etc.) with cables of equipment required to achieve and maintain safe shutdown conditions.

For the selected fire areas, the team also reviewed the location and installation of diagnostic instrumentation that is necessary for achieving and maintaining safe shutdown conditions to ensure that in the event of a fire, this instrumentation would remain functional.

b. Findings

No findings of significance were identified.

.8 Communications

a. Inspection Scope

The team reviewed the communication systems required to implement fire fighting and operations to achieve and maintain safe shutdown. The team verified the availability of portable radios for the fire brigade and plant operators, the availability of the Gai-Tronics page/party system, and verified the adequacy of the radio repeater systems and ensured they would be available, operable, and adequate for the performance of safe shutdown functions. The team assessed the capability of the communication systems to support the operators in the conduct and coordination of their required actions.

The team also reviewed corrective actions taken to address a finding regarding communications that was identified during the previous Triennial Fire Protection Inspection that was documented in NRC Inspection Report 50-416/2002-007. The issue was being addressed through Condition Report 2002-01472. The finding involved six fixed radio repeaters that were not protected from exposure fire damage. The team reviewed the licensees implementation of a compensatory runner to facilitate communications between the fire brigade leader and the control room, as well as the status of the licensees permanent corrective actions. Installation of separate radio repeaters was scheduled to be completed shortly after the completion of this inspection.

b. Findings

No findings of significance were identified.

.9 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting system required for safe shutdown activities in the selected fire areas to verify it was adequate for supporting the performance of manual actions required to achieve and maintain hot shutdown conditions. The team evaluated the adequacy of emergency lighting for access and egress routes to the areas where manual actions are required in Procedure 05-1-02-II-1, Shutdown From the Remote Shutdown Panel, Revision 30, at control stations and plant parameter monitoring locations. The team reviewed repetitive tasks for testing and test data trending to verify that the individual battery operated units were capable of supplying sufficient illumination. The team noted that the batteries had at least an 8-hour capacity.

The team determined that the operability testing and maintenance of the lighting units followed licensee procedure and accepted industry practice and were consistent with the manufacturer's recommendations.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team used the guidance in Inspection Procedure 71111.05T and Generic Letter 86-10 to review licensee procedures to determine whether repairs were required to achieve cold shutdown and to verify that dedicated repair procedures, equipment, and material to accomplish those repairs were available on the site. The team also evaluated whether cold shutdown could be achieved within the required time using the licensee's procedures and repair methods.

b. Findings

Introduction.

A Green finding was identified for not properly identifying repairs needed to achieve and maintain cold shutdown following a control room fire and documenting them in analyses and procedures. The team identified two repairs which were necessary in order to be able to achieve cold shutdown according to the licensee's alternate shutdown methodology. An alternate air supply was needed to maintain SRVs open during prolonged implementation of alternate shutdown cooling, and temporary instrumentation was needed to monitor reactor temperature and cooldown rate in the same mode.

Description.

In order to monitor reactor cooldown rate and maintain the plant within the design cooldown rate limits, the licensee's methodology specified that operators would initially monitor cooldown rate by converting reactor steam pressure to temperature.

Once temperature was too low to produce steam, the methodology relied upon installing measuring and test equipment to an installed temperature element in the residual heat removal system. The team concluded that this constituted a repair needed to reach and maintain a cold shutdown condition. However, the team identified that the licensee did not identify it in their fire protection program as a repair, and did not prepare work instructions or pre-staged equipment for accomplishing the task. The team determined that this task was within the skill of the craft, and that the necessary measuring and test equipment was readily available.

Also, the team noted that the alternate shutdown methodology relied upon alternate shutdown cooling. This mode of reactor cooling required that at least three safety relief valves (SRVs) be kept open for a significant period of time, so that a single train of low pressure coolant injection could recirculate water through the reactor and suppression pool and remove heat from both. The team identified that the normal air supply to SRVs was not listed as equipment needed to support safe shutdown (on the safe shutdown equipment list), nor did the safe shutdown analysis acknowledge or specify that an alternate air supply would be needed. As a consequence, the instrument air system was not protected from damage for a fire in the control room and would not have power during a loss of offsite power.

The team noted that alternate air supply capabilities did exist, were proceduralized, and the equipment was available onsite. Procedure 05-1-02-V-9, "Loss of Instrument Air,"

Revision 32, contained adequate instructions, and also determined that a portable compressor, nitrogen bottles, a regulator and fittings were available to implement the instructions. However, the team noted that operators were not trained or provided instructions that this alternate air supply would need to be used during a control room evacuation. Further, there were no means of warning at the remote shutdown panel that air pressure was low, except that operators might notice the change in valve position after the open SRVs failed closed.

The team concluded that using an alternate air supply to operate SRVs constituted a repair needed to reach and maintain a cold shutdown condition. However, the team identified that the licensee did not identify it in their fire protection program as a repair or provide instructions in the alternate shutdown procedure that this alternate air supply would be needed for a control room evacuation. This issue was entered into the licensee's corrective action program under Condition Report 2005-02369.

Analysis.

Failure to properly identify repairs needed to achieve and maintain cold shutdown following a control room fire and document them in analyses and procedures was a performance deficiency: FIN 05000416/2005008-04, No Procedures for Implementing Two Repairs Needed to Achieve Cold Shutdown Following A Control Room Fire. This issue was more than minor because it affected the Mitigating Systems cornerstone attributes of protection from external factors (fire) and procedure quality.

This finding was determined to have very low safety significance using Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process,"

because it involved an issue that only affected cold shutdown.

Enforcement.

No violation of NRC requirements was identified.

.11 Compensatory Measures

a. Inspection Scope

The team reviewed the licensees program with respect to compensatory measures in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems or features.

The team reviewed the licensees procedure 10-S-03-1, Fire Protection Procedure -

Fire Protection System Impairment, Revision 11, and the Technical Requirements Manual Section 6.2, Fire Systems, and the control room fire impairment log to confirm the licensees procedures adequately controlled compensatory measures for fire protection systems, equipment and features (e.g., detection and suppression systems and equipment, and passive fire barriers). The team reviewed the licensees procedure 01-S-18-6, Administrative Procedure - Risk Assessment of Maintenance Activities, Revision 2, to confirm the licensees procedures adequately controlled compensatory measures for post-fire safe shutdown equipment.

b. Findings

No findings of significance were identified.

4OA2 Problem Identification and Resolution

a. Inspection Scope

The team reviewed a sample of condition reports to verify that the licensee was identifying fire protection-related issues at an appropriate threshold and entering those issues into the corrective action program. A listing of condition reports reviewed is provided in the attachment to this report.

Also, the team reviewed the compensatory measures and corrective actions taken to address a radio communications finding from the last Triennial Fire Protection Inspection. This issue is also discussed in Section 1R05.8.

b. Findings

No findings of significance were identified.

4OA4 Cross-Cutting Aspects of Findings

A finding discussed in Section 1R05.4 regarding an inadequate fire drill critique was found to have cross-cutting aspects in problem identification. The performance of the fire brigade during the drill was found to have cross-cutting aspects in human performance.

4OA6 Meetings, Including Exit

On May 12, 2005, the inspectors presented the inspection results to Mr. G. Williams and other members of his staff who acknowledged the findings. The inspectors confirmed that proprietary information was not provided or examined during this inspection.

Following completion of additional review in the Region IV office, a final exit was held by telephone with Mr. D. Bottemiller and other members of the licensee staff on June 16, 2005, to provide an update on the inspection findings as discussed at the May 12, 2005, exit meeting.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee personnel

B. Arasteh, Fire Protection Engineer

C. Bottemiller, Manager, Licensing

W. Cade, Operations Shift Manager

H. Castles, Senior Loss Control Engineer

D. Chipley, Sr. Engineer

D. Coulter, Sr. Licensing Specialist

G. Lantz, Engineering Supervisor

R. Kerar, Fire Protection Engineer

R. Sorrels, Technical Specialist IV

G. Spikes, Safety Analysis Engineer

G. Williams, Vice President, Operations

D. Wilson, Supervisor, Systems Engineering

M. Withrow, Manager, Nuclear Engineering

T. Worthington, Engineering Supervisor

NRC personnel

R. Bywater, Senior Reactor Analyst, Region IV

P. Koltay, Inspection Program Branch

R. Perch, Project Manager, NRR

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000416/2005008-02 URI Inadequate Alternative Shutdown Procedure for Locally Starting and Loading an EDG (Section 1R05.6.1).

Opened and Closed

05000416/2005008-01 FIN Inadequate Fire Drill Critique (Section 1R05.4)

05000416/2005008-03 NCV Alternative Shutdown Procedure Did Not Implement Safe Shutdown Analysis Assumption to Isolate Containment in a Timely Manner (Section 1R05.6.2)

Attachment

05000416/2005008-04 FIN No Procedures for Implementing Two Repairs Needed to Achieve Cold Shutdown Following A Control Room Fire (Section 1R05.10)