ML030350561
| ML030350561 | |
| Person / Time | |
|---|---|
| Site: | Harris  |
| Issue date: | 01/31/2003 |
| From: | Ogle C NRC/RGN-II/DRS/EB |
| To: | Scarola J Carolina Power & Light Co |
| References | |
| EA-00-022, EA-01-310 IR-02-011 | |
| Download: ML030350561 (57) | |
See also: IR 05000400/2002011
Text
January 31, 2003
EA-01-310
Carolina Power & Light Company
ATTN: Mr. James Scarola
Vice President - Harris Plant
Shearon Harris Nuclear Power Plant
P. O. Box 165, Mail Code: Zone 1
New Hill, North Carolina 27562-0165
SUBJECT: SHEARON HARRIS NUCLEAR POWER PLANT - NRC INSPECTION REPORT
50-400/02-11
Dear Mr. Scarola:
On December 20, 2002, the U.S. Nuclear Regulatory Commission (NRC) completed a triennial
fire protection inspection at your Shearon Harris Nuclear Power Plant. The enclosed inspection
report documents the inspection findings, which were discussed on that date with you and other
members of your staff.
The inspection examined the effectiveness of activities conducted under your license relating to
implementation of your NRC-approved fire protection program. The inspectors reviewed
selected procedures and records, observed activities, and interviewed personnel.
Based on the results of this inspection, the inspectors identified nine findings that collectively
have a potential safety significance of greater than very low significance; however, a safety
significance determination has not yet been completed. These issues could have presented a
potential immediate safety concern. However, the issues are entered into your corrective action
program and compensatory measures are in place while long-term corrective measures are
being implemented. Please be advised that the characterization and number of these findings
could potentially change with further NRC review. In addition, since some of these findings are
related to your corrective action for the previous violation associated with the Thermo-Lag fire
barrier assembly between the B train switchgear room/auxiliary control panel room and the A
train cable spreading room, that violation will remain open.
CP&L 2
In accordance with 10 CFR 2.790 of the NRCs Rules of Practice, a copy of this letter and its
enclosure will be publicly available in the NRC Public Document Room or from the Publicly
Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is
accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public
Electronic Reading Room).
Sincerely,
/RA/
Charles R. Ogle, Chief
Engineering Branch 1
Division of Reactor Safety
Docket No.: 50-400
License No.: NPF-63
Enclosure: NRC Inspection Report 50-400/02-11
w/Attachments: 1. Supplemental Information
2. Operator Actions
cc w/encl:
James W. Holt, Manager
Performance Evaluation and
Regulatory Affairs CPB 9
Carolina Power & Light Company
Electronic Mail Distribution
Robert J. Duncan II
Director of Site Operations
Carolina Power & Light Company
Shearon Harris Nuclear Power Plant
Electronic Mail Distribution
Benjamin C. Waldrep
Plant General Manager--Harris Plant
Carolina Power & Light Company
Shearon Harris Nuclear Power Plant
Electronic Mail Distribution
Terry C. Morton, Manager
Support Services
Carolina Power & Light Company
Shearon Harris Nuclear Power Plant
Electronic Mail Distribution
(cc w/encl contd - See page 3)
CP&L 3
(cc w/encl contd)
John R. Caves, Supervisor
Licensing/Regulatory Programs
Carolina Power & Light Company
Shearon Harris Nuclear Power Plant
Electronic Mail Distribution
William D. Johnson
Vice President & Corporate Secretary
Carolina Power & Light Company
Electronic Mail Distribution
John H. O'Neill, Jr.
Shaw, Pittman, Potts & Trowbridge
2300 N. Street, NW
Washington, DC 20037-1128
Beverly Hall, Acting Director
Division of Radiation Protection
N. C. Department of Environmental
Commerce & Natural Resources
Electronic Mail Distribution
Peggy Force
Assistant Attorney General
State of North Carolina
Electronic Mail Distribution
Public Service Commission
State of South Carolina
P. O. Box 11649
Columbia, SC 29211
Chairman of the North Carolina
Utilities Commission
P. O. Box 29510
Raleigh, NC 27626-0510
Robert P. Gruber
Executive Director
Public Staff NCUC
4326 Mail Service Center
Raleigh, NC 27699-4326
(cc w/encl contd - See page 4)
CP&L 4
(cc w/encl contd)
Linda Coleman, Chairman
Board of County Commissioners
of Wake County
P. O. Box 550
Raleigh, NC 27602
Gary Phillips, Chairman
Board of County Commissioners
of Chatham County
Electronic Mail Distribution
Distribution w/encl:
L. Slack, EICS
C. Patel, NRR
OEMAIL
RIDSNRRDIPMLIPB
PUBLIC
OFFICE RII:DRS RII:DRS RII:DRS RII:DRP RII:DRS RII:DRS RII:DRP
SIGNATURE SCHIN SCHIN FOR SCHIN FOR SCHIN FOR SCHIN FOR SCHIN FOR FREDRICKSON
NAME RSchin GWiseman PFillion RHagar SWalker DCPayne PFredrickson
DATE 1/31/2003 1/31/2003 1/31/2003 1/31/2003 1/31/2003 1/31/2003 1/31/2003
E-MAIL COPY? YES NO YES NO YES NO YES NO YES NO YES NO YES NO
PUBLIC DOCUMENT YES NO
OFFICE RII:EICS
SIGNATURE EVANS
NAME CEvans
DATE 1/31/2003
E-MAIL COPY? YES NO
PUBLIC DOCUMENT YES NO
OFFICIAL RECORD COPY DOCUMENT NAME: C:\ORPCheckout\FileNET\ML030350561.wpd
U.S. NUCLEAR REGULATORY COMMISSION
REGION II
Docket No.: 50-400
License No.: NPF-63
Report No.: 50-400/02-11
Licensee: Carolina Power & Light (CP&L)
Facility: Shearon Harris Nuclear Power Plant
Location: 5413 Shearon Harris Road
New Hill, NC 27562
Dates: October 21 - 25, 2002 (Week 1)
November 4 - 8, 2002 (Week 2)
December 16 - 20, 2002 (Week 3)
Inspectors: P. Fillion, Reactor Inspector, Region II
R. Hagar, Resident Inspector, Shearon Harris (Week 3 only)
C. Payne, Fire Protection Team Leader, Region II (Week 3 only)
R. Schin, Senior Reactor Inspector, Region II (Lead Inspector)
S. Walker, Reactor Inspector (Week 3 only)
G. Wiseman, Senior Fire Protection Inspector, Region II
(Weeks 1 & 2)
Accompanying
Personnel: N. Staples, Inspector Trainee, Region II (Weeks 1 & 2)
Approved by: Charles R. Ogle, Chief
Engineering Branch 1
Division of Reactor Safety
Enclosure
SUMMARY OF FINDINGS
IR 05000400/2002-011; Carolina Power & Light; 10/21/2002 - 12/20/2002; Shearon Harris
Nuclear Power Plant, Triennial Baseline Inspection of the Fire Protection Program.
The inspection was conducted by a team of regional inspectors and the Shearon Harris resident
inspector. Nine findings were identified that collectively have a potential safety significance of
greater than very low significance; however, a safety significance determination has not yet
been completed. The significance of issues is indicated by their color (Green, White, Yellow,
Red) using IMC 0609 Significance Determination Process (SDP). Findings for which the SDP
does not apply may be Green or be assigned a severity level after NRC management review.
The NRC's program for overseeing the safe operation of commercial nuclear power reactors is
described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.
A. Inspector Identified and Self-Revealing Findings
Cornerstones: Mitigating Systems and Initiating Events
- TBD. Physical and procedural protection for equipment that was relied on for safe
shutdown (SSD) during a fire in safe shutdown analysis (SSA) areas 1-A-BAL-B1,
1-A-BAL-B2, and 1-A-EPA of the reactor auxiliary building were inadequate. Motor-
operated valve 1CS-165, volume control tank outlet to charging/safety injection pumps
was not protected physically or procedurally from maloperation due to a fire.
Consequently, a fire in one of the three SSA areas could result in a reactor coolant
pump seal loss of coolant accident (LOCA) with no high pressure safety injection
available.
A violation of Operating License Condition 2.F, the Fire Protection Program, and
Technical Specification (TS) 6.8.1 was identified. However, this finding is unresolved
pending completion of a significance determination. The finding is greater than minor
because it could result in a loss of equipment that was relied upon for SSD from a fire
and could initiate a LOCA event. Also, when assessed in combination with other
findings identified in this report, the significance could be greater than very low
significance. (Section 1R05.03.b.1)
- TBD. Physical and procedural protection for equipment that was relied on for SSD
during a fire in SSA area 1-A-BAL-B-B5 of the reactor auxiliary building were
inadequate. Motor-operated valves 1CS-169, charging/safety injection pump (CSIP)
suction cross-connect; 1CS-214, CSIP mini-flow isolation; 1CS-218, CSIP discharge
cross-connect; and 1CS-219, CSIP discharge cross-connect; were not protected
physically or procedurally from maloperation due to a fire. Consequently, a fire in SSA
area 1-A-BAL-B-B5 could result in a loss of all charging and high pressure safety
injection.
A violation of Operating License Condition 2.F, the Fire Protection Program, and
TS 6.8.1 was identified. However, this finding is unresolved pending completion of a
significance determination. The finding is greater than minor because it could result in a
loss of equipment that was relied upon for SSD from a fire. Also, when assessed in
combination with other findings identified in this report, the significance could be greater
than very low significance. (Section 1R05.03.b.2)
2
- TBD. Physical and procedural protection for equipment that was relied on for SSD
during a fire in SSA area 1-A-BAL-B-B4 of the reactor auxiliary building were
inadequate. Motor operated valves 1CS-166, volume control tank outlet to CSIPs; and
1CS-168, CSIP suction cross-connect; were not protected physically or procedurally
from maloperation due to a fire. Consequently, a fire in SSA area 1-A-BAL-B-B4 could
result in a loss of all charging and high pressure safety injection.
A violation of Operating License Condition 2.F, the Fire Protection Program, and
TS 6.8.1 was identified. However, this finding is unresolved pending completion of a
significance determination. The finding is greater than minor because it could result in a
loss of equipment that was relied upon for SSD from a fire. Also, when assessed in
combination with other findings identified in this report, the significance could be greater
than very low significance. (Section 1R05.03.b.3)
- TBD. Physical and procedural protection for equipment that was relied on for SSD
during a fire in SSA area 1-A-BAL-C of the reactor auxiliary building were inadequate.
Motor operated valves 1CC-208, component cooling water (CC) supply to reactor
coolant pump (RCP) seals; and 1CC-251, CC return from RCP seals; were not
protected physically or procedurally from maloperation due to a fire. Consequently, a
fire in SSA area 1-A-BAL-C could potentially result in an RCP seal LOCA.
A violation of Operating License Condition 2.F, the Fire Protection Program, and TS
6.8.1 was identified. However, this finding is unresolved pending completion of a
significance determination. The finding is greater than minor because it could result in a
loss of equipment that was relied upon for SSD from a fire and could initiate a LOCA
event. Also, when assessed in combination with other findings identified in this report,
the significance could be greater than very low significance. (Section 1R05.03.b.4)
- TBD. Many local manual operator actions were used in place of the required physical
protection of cables for equipment relied on for SSD during a fire, without obtaining NRC
approval for these deviations from the approved fire protection program. This condition
applied to all areas that were inspected, including the new auxiliary control panel fire
area that had been recently created as corrective action for previous Violation
50-400/02-08-01. This reliance on large numbers of local manual actions, in place of
the required physical protection of cables, could potentially result in an increased risk of
loss of equipment that was relied upon for SSD from a fire.
A violation of Operating License Condition 2.F and the Fire Protection Program was
identified. However, this finding is unresolved pending completion of a significance
determination. The finding is greater than minor because it could potentially result in an
increased risk of loss of equipment that was relied upon for SSD from a fire. Also, when
assessed in combination with other findings identified in this report, the significance
could be greater than very low significance. (Section 1R05.04.b.1)
- TBD. Procedure steps for safe shutdown (SSD) from a fire and related corrective action
for previous Violation 50-400/02-08-01 were inadequate. For a fire in the new auxiliary
control panel fire area, certain cables were not physically protected from the fire and
certain SSD procedure steps, that were used in place of physical protection of cables,
3
involved excessive challenges to operators. Consequently, a fire in the ACP fire area
could result in a loss of all auxiliary feedwater.
A violation of Operating License Condition 2.F, the Fire Protection Program, and TS
6.8.1 was identified. However, this finding is unresolved pending completion of a
significance determination. The finding is greater than minor because it could result in a
loss of equipment that was relied upon for SSD from a fire. Also, when assessed in
combination with other findings identified in this report, the significance could be greater
than very low significance. (Section 1R05.04.b.2)
- TBD. A procedure for SSD from a fire and related corrective action for previous
Violation 50-400/02-08-01 were inadequate. For a fire in certain safe shutdown analysis
areas of the reactor auxiliary building, including the new auxiliary control pane fire area,
there were too many SSD procedure contingency actions to respond to potential
spurious actuations for the one designated SSD non-licensed operator to perform.
Consequently, equipment that was relied on for SSD may not be available.
A violation of Operating License Condition 2.F, the Fire Protection Program, and
TS 6.8.1 was identified. However, this finding is unresolved pending completion of a
significance determination. The finding is greater than minor because it could result in a
loss of equipment that was relied upon for SSD from a fire. Also, when assessed in
combination with other findings identified in this report, the significance could be greater
than very low significance. (Section 1R05.04.b.3)
- TBD. A procedure for SSD from a fire was inadequate. For a fire in safe shutdown
analysis areas near the boric acid tank (BAT) in the reactor auxiliary building, the SSD
procedure directed operators to take CSIP suction from the BAT even if BAT level
indication were lost. However, the charging volume needed for reactor coolant system
cooldown would have emptied the BAT and damaged the CSIP.
A violation of Operating License Condition 2.F, the Fire Protection Program, and
TS 6.8.1 was identified. However, this finding is unresolved pending completion of a
significance determination. The finding is greater than minor because it could result in a
loss of equipment that was relied upon for SSD from a fire. Also, when assessed in
combination with other findings identified in this report, the significance could be greater
than very low significance. (Section 1R05.04.b.4)
- TBD. Required battery-backed emergency lights were not provided in locations where
operators were required to perform actions for SSD from a fire. This condition affected
SSD during fires in all of the areas inspected in the reactor auxiliary building, including
the new auxiliary control panel fire area that was created as corrective action for
previous Violation 50-400/02-08-01. The lack of required lighting could result in an
increased risk of operators failing to perform the SSD actions in a timely and accurate
manner.
A violation of Operating License Condition 2.F, the Fire Protection Program, was
identified. However, this finding is unresolved pending completion of a significance
determination. The finding is greater than minor because it could result in an increased
risk of operators failing to perform the SSD actions in a timely and accurate manner.
4
Also, when assessed in combination with other findings identified in this report, the
significance could be greater than very low significance. (Section 1R05.06.b)
B. Licensee-Identified Violations
None
REPORT DETAILS
1. REACTOR SAFETY
Cornerstones: Initiating Events and Mitigating Systems
1R05 FIRE PROTECTION
.01 Systems Required To Achieve and Maintain Post-Fire SSD Circuit Analysis
a. Inspection Scope
The team evaluated the licensees approved fire protection program (FPP) against
applicable requirements, including Operating License NFP-63, Operating License
Condition (OLC) 2.F, FPP; Branch Technical Position (BTP) Chemical Engineering
Branch (CMEB) 9.5-1 (NUREG-0800), July 1981; related NRC Safety Evaluation Reports
(SERs) in NUREG 1038, and plant TSs. The team evaluated all areas of this inspection,
as documented below, against these requirements. The team used the licensees
Individual Plant Examination for External Events (IPEEE) and in-plant tours to select four
risk significant fire areas/zones for inspection. The four fire areas/zones selected were:
- Fire Zone 1-A-4-CHLR; part of Fire Area 1-A-BAL-B:
This fire zone was located on the 261 foot level (ground level) of the reactor
auxiliary building (RAB). It was further subdivided in the licensees SSA into SSA
areas 1-A-BAL-B-B1 [including the A chiller and motor-driven auxiliary feedwater
(AFW) pump flow control valves (FCVs)] and 1-A-BAL-B-B2 [including the B
chiller and turbine-driven AFW pump FCVs]. A significant fire in either of these
areas would require shutdown of the unit from the main control room (MCR) and
additional manual operator actions in various areas of the plant.
- Fire Zone 1-A-4-COM-E; part of Fire Area 1-A-BAL-B:
This fire zone was located on the 261 foot level (ground level) of the RAB. It was
further subdivided in the licensees SSA into SSA areas 1-A-BAL-B-B4 [including
480V motor control center (MCC) 1B35-SB] and 1-A-BAL-B-B5 [including 480V
MCC 1A35-SA]. A significant fire in either of these areas would require shutdown
of the unit from the MCR and additional manual operator actions in various areas
of the plant.
- Fire Area 1-A-EPA:
This fire zone was located on the 261 foot level (ground level) of the RAB. It
included electrical penetration room A. A significant fire in this area would
require shutdown of the unit from the MCR and additional manual operator
actions in various areas of the plant.
2
- Fire Area 1-A-BATB:
This fire zone was located on the 286 foot level (above ground level) of the RAB.
It included the B electrical battery room. A significant fire in this area would
require shutdown of the unit from the MCR and additional manual operator
actions in various areas of the plant.
The team reviewed the post-fire SSD capability and the fire protection features to verify
that at least one post-fire safe shutdown success path would be maintained free of fire
damage during a fire in any of the selected fire areas/zones. The team reviewed the
licensees fire protection program, including the SSA and supporting calculations, to
determine the systems required to achieve post-fire SSD. The team also reviewed the
Safe Shutdown Equipment List, system flow diagrams, and the Fire Hazards Analysis
(FHA) in the Updated Final Safety Analysis Report (UFSAR) for each of the selected fire
areas to evaluate the completeness and adequacy of the SSD analysis and the systems
relied upon to mitigate fires in the selected fire areas. Specific licensee documents and
drawings reviewed during the inspection are listed in Attachment 1.
b. Findings
The team found that the licensees SSA method had identified cables that were required
for control room operation of SSD equipment during fires in certain areas but were not
physically protected from those fires. For these cables, the SSA method relied generally
on operator manual actions to either prevent or mitigate damage resulting from a fire
(e.g., locally open the breaker to an MOV and locally operate the MOV using the
handwheel), rather than on features which physically protect the cables. Using this
method, the licensee generally chose to physically protect these cables only if no
reasonable operator action could be identified to prevent or mitigate the fire damage.
Consequently, the licensee had identified and relied on more than 100 local manual
operator actions to achieve and maintain hot shutdown conditions during fires. The
licensee had not requested deviation approvals from the NRC for these operator actions,
and had not verified or validated the operator actions to the extent that would have been
involved in NRC reviews of deviation requests. This SSD methodology contributed to the
findings and unresolved items (URIs) that are described in the following sections.
.02 Fire Protection of SSD Capability
a. Inspection Scope
The team reviewed UFSAR Section 9.5.1, Appendix 9.5A, FHA; the FPP manual; and
the plant administrative procedures used to prevent fires and control combustible
hazards and ignition sources. This review was to verify that the objectives established by
the NRC-approved FPP were satisfied. The team also toured the selected plant fire
areas observing the licensees implementation of these procedures. The team also
reviewed the FPP transient combustible permit logs, and fire emergency/incident
investigation reports, for the years 2000-2002. Corrective action program action
requests (ARs) resulting from fire, smoke, sparks, arcing, and equipment overheating
incidents for the same period were also reviewed to assess the effectiveness of the fire
3
prevention program and to identify any maintenance or material condition problems
related to fire incidents.
The team reviewed flow diagrams and engineering calculations associated with the B
train battery room heating, ventilation, and air conditioning (HVAC) systems. This review
was done to verify that systems used to accomplish safe shutdown would not be inhibited
by a potential hydrogen gas fire in the B battery room due to inoperable ventilation
supply and exhaust fans. The team also reviewed the TS Limiting Condition for
Operation (LCO) requirements for loss of ventilation in the B train battery room to verify
that appropriate timely actions were specified to ensure that hydrogen gas
concentrations generated by the station batteries remained below explosive limits.
The team toured the plants primary fire brigade staging and dress-out areas to assess
the condition of fire fighting and smoke control equipment. Fire brigade personal
protective equipment located in brigade staging area lockers was reviewed to evaluate
equipment accessibility and functionality. Additionally, the team examined whether
backup emergency lighting was provided for access pathways to and within the fire
brigade staging and dress-out areas in support of fire brigade operations should a power
failure occur during the fire emergency. The team also observed whether emergency
exit lighting was provided for personnel evacuation pathways to the outside exits as
identified in the National Fire Protection Association (NFPA) 101, Life Safety Code and
Occupational Safety and Health Administration (OSHA) Part 1910, Occupational Safety
and Health Standards. The adequacy of the fire brigades self-contained breathing
apparatus (SCBAs) was reviewed as was the availability of supplemental breathing air
tanks.
Team members also toured the selected fire areas and compared the associated fire
pre-plans with as-built plant conditions. This was done to verify that they were consistent
with the fire protection features and potential fire conditions described in the UFSAR.
Additionally, the team reviewed drawings and engineering flood analysis associated with
the 261-foot elevation reactor auxiliary building floor and equipment drain system to verify
that those actions required for SSD would not be inhibited by fire suppression activities or
leakage from fire suppression systems.
The team reviewed the fire brigade response procedure, fire brigade organization, and
training and drill program administration procedures. Fire drill critiques of operating shifts
for the period of March 2001 through October 2002 were reviewed to verify that fire
brigade drills had been conducted in high fire risk plant areas. Fire brigade training/drill
records for 2002 were also reviewed to verify that the fire brigade personnel
qualifications, brigade drill response time, and brigade performance met the
requirements of the licensees approved FPP. Additionally, the team observed a fire drill
to verify the licensees implementation of the fire brigade organization, training, and drill
program administration procedures. The team observed the actions of the site fire
brigade, offsite fire department, and fire drill monitors; and attended the drill critique.
b. Findings
No findings of significance were identified.
4
.03 Post-Fire SSD Circuit Analysis
a. Inspection Scope
The team reviewed the adequacy of separation and fire barriers provided for the power
and control cabling of equipment relied on for SSD during a fire in the selected fire
areas/zones. On a sample basis, the team reviewed the SSA and the electrical
schematics for power and control circuits of SSD components, and looked for the
potential effects of open circuits, shorts to ground, and hot shorts. This review focused
on the cabling of selected components for the charging/safety injection system, AFW
system, and CC system. The team traced the routing of cables by using the cable
schedule and conduit and tray drawings. Walkdowns were performed to compare 1-hour
and 3-hour barriers (conduit and tray fire barrier wraps) to barriers indicated on the
drawings. Circuit and cable routings were reviewed for the following equipment:
- 1CS-278, boric acid tank (BAT) to CSIP MOV;
- BAT level instrumentation;
- motor-driven AFW pump 1A;
- motor-driven AFW pump 1B; and
- the turbine-driven AFW pump.
The team also reviewed studies of overcurrent protection on both alternating current (AC)
and direct current (DC) systems to identify whether fire induced faults could result in
defeating the safe shutdown functions.
b. Findings
(1) SSA Areas 1-A-BAL-B-B1, 1-A-BAL-B-B2, and 1-A-EPA of the RAB
Introduction
The team identified an unresolved item (URI) involving failure to follow the FPP and TS
6.8.1. The URI involved failure to protect equipment that was relied on for SSD during a
5
fire in SSA areas 1-A-BAL-B1, 1-A-BAL-B2, and 1-A-EPA of the RAB from fire damage.
MOV 1CS-165, volume control tank outlet to CSIPs, was not protected physically or
procedurally from maloperation due to a fire. Consequently, a fire in one of the three
SSA areas could result in a reactor coolant pump seal loss of coolant accident (LOCA)
with no high pressure safety injection available.
Description
The team found that the control power cable for charging system MOV 1CS-165; which
was relied upon to remain open for SSD during a fire in SSA areas 1-A-BAL-B-B1 and 1-
A-BAL-B-B2, and in fire area 1-A-EPA; was routed through those areas with no fire
barrier. As a result, the control power cable for the MOV was vulnerable to fire-induced
hot shorts which could result in spurious valve operation. The lack of a required fire
barrier was not recognized in the SSA and no procedural guidance was included in
Abnormal Operating Procedure (AOP)-36, Safe Shutdown Following a Fire, Rev. 21, for
operators to prevent maloperation of 1CS-165 prior to damage occurring to SSD
equipment. Consequently, a fire in one of the three SSA areas could cause 1CS-165 to
spuriously close, isolate all CSIP suction flowpaths, and immediately damage the
operating SSD CSIP.
For fires in SSA areas 1-A-BAL-B-B1, 1-A-BAL-B-B2, or 1-A-EPA the SSD analysis relied
on SSD Division 2 equipment to achieve and maintain hot shutdown. This included
reliance on CSIP B for RCS makeup water, RCP seal cooling, reactivity control by
boration, and high pressure safety injection. The SSA assumed that CSIP A was not
assured to be unaffected by the fire and CSIP C was not assured to be available.
Consequently, a failure of CSIP B could result in a loss of all charging and high pressure
safety injection. Also, for a fire in any of these three SSA areas, CC flow to the RCP
seals was not protected. The team found that the control power cable to MOV 1CC-207,
CC flow to RCP seals, was routed through the same three SSA areas in the same cable
tray with the control power cable to 1CS-165. AOP-36 included no operator action to
prevent spurious operation of MOV 1CC-207. Spurious closure of MOV 1CC-207 would
stop all CC flow to the seals of all three RCPs. Thus, the potential consequences of a
fire in any of the three SSA areas could be an RCP seal LOCA with no charging or high
pressure injection.
Also, the team found that the control power cables for MOVs 1CC-252, CC return from
RCP seals, and 1CC-249, CC return from RCP seals, were routed through SSA area 1-
A-BAL-B-B2 and could be affected by a fire in that area. AOP-36 included an operator
action to prevent spurious actuation of 1CC-252 for a fire in SSA area 1-A-BAL-B-B2.
That action included opening the breaker to MOV 1CC-252 on MCC 1E12. However, the
SSD NLO would likely not be able to safely do that action during a fire in SSA area 1-A-
BAL-B-B2 because MCC 1E12 was located in that SSA area. AOP-36 included no
operator action for 1CC-249. Spurious closure of 1CC-252 or 1CC-249 would stop all
CC flow to the RCP seals. The team noted that, while the operator action for 1CC-252
may not be needed for a fire in SSA area 1-A-BAL-B-B2 because the charging system
was supposed to provide RCP seal cooling, this inappropriate procedural action (sending
an operator into an area where there was a fire) could delay the SSD NLO from
performing other procedure actions that were required to achieve SSD.
6
In addition, the team found that modification ESR 01-00087, which was installed in
January 2002, had affected this condition and missed an opportunity to correct it. ESR
01-00087 changed the CSIP mini-flow path so that it would go to the VCT instead of
going directly to the CSIP suction. Prior to the ESR, if 1CS-165 spuriously closed, the
running CSIP would still have some suction although probably not enough to prevent
pump damage. After the ESR, if 1CS-165 spuriously closed, the running CSIP would
have no suction and CSIP failure would be more certain and more immediate. ESR 01-
00087 failed to recognize this effect and missed an opportunity to identify and correct the
condition.
Analysis
This finding had more than minor safety significance because it affected the objectives of
the Mitigating Systems and Initiating Events Cornerstones of Reactor Safety. The finding
affected the availability and reliability of systems that mitigate initiating events to prevent
undesirable consequences. It also affected the likelihood of occurrence of initiating
events that challenge critical safety functions. Also, when assessed in combination with
other findings identified in this report, the significance could be greater than very low
significance. However, the finding remains unresolved pending completion of a
significance determination.
Enforcement
OLC 2.F required that the licensee implement and maintain in effect all provisions of the
approved FPP as described in the Final Safety Analysis Report. The UFSAR, Section
9.5.1, FPP, stated that outside containment, where cables or equipment (including
associated non-essential circuits that could prevent operation or cause maloperation due
to hot shorts, open circuits, or shorts to ground) of redundant safe shutdown divisions of
systems necessary to achieve and maintain cold shutdown conditions are located within
the same fire area outside of primary containment, one of the redundant divisions must
be ensured to be free of fire damage. Section 9.5.1 further stated that if both divisions
are located in the same fire area, then one division is to be physically protected from fire
damage by one of three methods: 1) a three-hour fire barrier, 2) a one-hour fire barrier
plus automatic detection and suppression, or 3) a 20-foot separation with no intervening
combustibles and with automatic detection and suppression. The licensee had received
no NRC approvals for deviating from these requirements.
TS 6.8.1 required procedures as recommended by Regulatory Guide (RG) 1.33 and
procedures for fire protection program implementation. RG 1.33 recommended
procedures for combating emergencies, including fires. The licensees interpretation of
their fire protection program was that they could and would rely on proceduralized
operator actions in place of physically protecting SSD equipment from fire damage (see
Section 1R05.04.b.1). However, the licensee had failed to provide procedural guidance
in AOP-36 for operators to prevent maloperation of MOV 1CS-165.
Contrary to the above requirements, the licensee failed to ensure that one of the
redundant divisions (i.e., SSD Division 2, including MOV 1CS-165) would be free of fire
damage. MOV 1CS-165 was not protected from fire damage, either by one of the
7
physical methods described above or by procedures. The licensee entered the finding
into the corrective action program as AR 76260.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-01, Failure to Protect Charging System
MOV 1CS-165, VCT Outlet to CSIPs, From Maloperation Due To a Fire.
(2) SSA Area 1-A-BAL-B-B5 of the RAB
Introduction
The team identified a URI involving failure to follow the FPP and TS 6.8.1. The URI
involved failure to protect equipment that was relied on for SSD during a fire in SSA area
1-A-BAL-B-B5 from fire damage. MOVs 1CS-169, CSIP suction cross-connect; 1CS-
214, CSIP mini-flow isolation; 1CS-218, CSIP discharge cross-connect; and 1CS-219,
CSIP discharge cross-connect; were not protected physically or procedurally from
maloperation due to a fire. Consequently, a fire in SSA area 1-A-BAL-B-B5 could result
in a loss of all charging and high pressure safety injection.
Description
The team found that the control power cables for charging system MOVs 1CS-169, 1CS-
214, 1CS-218, and 1CS-219, which were relied upon to remain open for SSD during a
fire in SSA area 1-A-BAL-B-B5, were routed through that area with incomplete fire
barriers. The control cables were unprotected for about one foot above MCC 1-A35-SA
and inside the MCC. Licensee engineers stated that spurious actuations due to hot
shorts in the control cables were not credible during a fire in or near the MCC because
the power supply breaker to the MCC would trip first or electrical components within the
breaker would be affected by the heat from the fire such that the spurious actuations
would be precluded. However, the team found no testing or analysis proving that
spurious actuations could not occur.
This lack of required fire barriers was recognized in the SSA for 1CS-169, 1CS-214, and
1CS-218, and procedural guidance was included in AOP-36 for operators to prevent
maloperation of these valves. However, the procedural guidance was not adequate.
AOP-36 directed operators to go to MCC 1A35-SA and open the breakers for 1CS-169
and 1CS-214 to prevent spurious operation. However, operators would not be able to
safely do that in all scenarios because the required actions were in the area of the fire
that could cause the spurious operation. AOP-36 directed operators to go to MCC 1B35-
SB, in another room, to open the breaker for 1CS-218. However, operators would not be
able to do that because the breaker for 1CS-218 was actually located on MCC 1A35-SA.
The SSA had not identified a need for operator action to prevent maloperation of 1CS-
219 and AOP-36 included no action steps for that valve.
AOP-36 did include the following guideline for operators: Monitor for spurious valve and
pump operation which may result in equipment damage (for example, CSIP suction
valves.) The team noted that closure of a CSIP suction valve could result in pump
damage within seconds; before operators could respond to an annunciator, analyze the
8
condition, and take action to prevent pump damage. Another AOP-36 guideline was:
When directed by the Unit Shift Supervisor, then shut down equipment and de-energize
electrical busses located within the fire area. Operators stated that they would de-
energize MCC 1A35-SA if the fire brigade team leader or another operator told them that
the MCC was on fire or if they observed spurious actuations that could be initiating from
the MCC. However, the team noted that normally the fire brigade would not arrive and
attack the fire until about 20 minutes after the control room sounded the fire alarm, and
spurious actuations could occur well before that. By procedure, control room operators
would respond to a single fire detector annunciator by sending an NLO to verify that
there was a fire and that the fire was large enough to warrant sounding the fire alarm and
calling out the fire brigade. However, if the control room operators received annunciation
from two or more fire detectors, which would be very likely in the event of fire large
enough to present an operational safety concern, then they would not send an NLO but
instead would immediately sound the fire alarm and call out the fire brigade. So it was
likely that the first visual report on a large fire would not be received in the control room
until about 20 minutes after the fire alarm. By that time, the fire would have likely filled
the room with smoke so that the fire brigade would not be able to immediately identify if
the MCC was on fire.
The team concluded that it was unlikely that the control room would always de-energize
MCC 1A35-SA before spurious actuations could occur. Consequently, a fire in this area,
near or in MCC 1A35-SA, could cause any of the four MOVs to spuriously close. Closure
of 1CS-214 would stop all mini-flow from all CSIPs. Closure of 1CS-218 or 1CS-219
would stop charging flow from SSD CSIP B. If such a loss of charging flow or CSIP
mini-flow occurred, operators would receive an alarm in the control room and would
probably have time to diagnose the condition and initiate recovery actions before CSIP
damage occurred. However, closure of 1CS-169 would stop all suction to SSD CSIP B
and immediately damage the pump.
For a fire in SSA area 1-A-BAL-B-B5, the SSD analysis was to rely on SSD Division 2
equipment. This included reliance on CSIP B for RCS makeup water, RCP seal cooling,
reactivity control by boration, and high pressure safety injection. CSIP A was not
assured to be unaffected by the fire and CSIP C was not assured to be available. The
team noted that MOVs powered from MCC 1A35-SA could affect CSIP A and CSIP C.
While the SSA did not assure that CC would be available, the team did not identify any
vulnerabilities of CC to a fire in this area. Consequently, the team concluded that the
potential consequences of a fire in SSA area 1-A-BAL-B5 included a loss of all charging
and high pressure safety injection.
Analysis
This finding had more than minor safety significance because it affected the objectives of
the Mitigating Systems Cornerstone. The finding affected the availability and reliability of
systems that mitigate initiating events to prevent undesirable consequences. Also, when
assessed in combination with other findings identified in this report, the significance could
be greater than very low significance. However, the finding remains unresolved pending
completion of a significance determination.
9
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions (i.e., SSD Division 2, including MOVs 1CS-169, 1CS-214, 1CS-218, and 1CS-
219) would be free of fire damage. Also, TS 6.8.1 required procedures for implementing
the fire protection program and for combating fires.
Contrary to the above requirements, the licensee failed to assure that one of the
redundant divisions (SSD Division 2, including MOVs 1CS-169, 1CS-214, 1CS-218, and
1CS-219) would be free of fire damage. MOVs 1CS-169, 1CS-214, 1CS-218, and 1CS-
219 were not protected from fire damage, either by one of the physical methods
described above or by procedures. The licensee entered the finding into the corrective
action program as ARs 76260 and 80212.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-02, Failure to Protect Charging System
MOVs 1CS-169, 1CS-214, 1CS-218, and 1CS-219 From Maloperation Due To a Fire.
(3) SSA Area 1-A-BAL-B-B4 of the RAB
Introduction
The team identified a URI involving failure to follow the FPP and TS 6.8.1. The URI
involved failure to protect equipment that was relied on for SSD during a fire in SSA area
1-A-BAL-B-4 from fire damage. MOVs 1CS-166, VCT Outlet to CSIPs; CS-168, CSIP
Suction Cross-connect; and 1CS-217, CSIP Discharge Cross-connect; were not
protected physically or procedurally from maloperation due to a fire. Consequently, a fire
in SSA area 1-A-BAL-B-4 could result in a loss of all charging and high pressure safety
injection.
Description
The team found that the control power cables for charging system MOVs 1CS-166, 1CS-
168, and 1CS-217, which were relied upon to remain open for SSD during a fire in SSA
area 1-A-BAL-B-B4, were routed through that area with incomplete fire barriers. The
control cable for MOV 1CS-166 was unprotected for about one foot above MCC 1B35-SB
and inside the MCC. The control power cables for MOVs 1CS-168 and 1CS-217 were
unprotected inside MCC 1B35-SB. This lack of required fire barriers was not recognized
in the SSA and no procedural guidance was included in AOP-36 for operators to prevent
or mitigate maloperation of these valves. Consequently, a fire in this area, near or in
MCC 1B35-SB, could cause 1CS-166 or 1CS-168 to spuriously close, which would stop
all suction to SSD CSIP A, and immediately damage the pump. If CSIP C were aligned
to be used in place of CSIP A, then the fire could cause spurious closure of 1CS-217
and stop charging flow from CSIP C.
For a fire in SSD area 1-A-BAL-B-B4, the SSD analysis was to rely on SSD Division 1
equipment. This included reliance on CSIP A for RCS makeup water, reactivity control
by boration, and high pressure safety injection. CSIP B was not assured to be
10
unaffected by the fire and CSIP C was not assured to be available. Also, when all three
CSIPs were available, the C CSIP would be aligned to the B train; and it would take
licensee personnel several hours to align the C CSIP to the A train. Consequently, a
failure of CSIP A could result in a loss of all charging and high pressure safety injection.
If CSIP C were aligned to be operating in place of CSIP A, and a maloperation of 1CS-
217 caused a loss of charging flow, operators would receive a loss of charging flow alarm
and would probably have time to diagnose and respond to the condition before the CSIP
was damaged.
In addition, the team found that modification ESR 01-00087, which was installed in
January 2002, had affected the significance of the lack of protection for 1CS-166. As
described above for 1CS-168, ESR 01-00087 was a missed opportunity to identify and
correct the lack of protection for 1CS-166.
Analysis
This finding had more than minor safety significance because it affected the objectives of
the Mitigating Systems Cornerstone of Reactor Safety. The finding affected the
availability and reliability of systems that mitigate initiating events to prevent undesirable
consequences. Also, when assessed in combination with other findings identified in this
report, the significance could be greater than very low significance. However, the finding
remains unresolved pending completion of a significance determination.
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions (i.e., SSD Division 1, including MOVs 1CS-166, 1CS-168, and 1CS-217) would
be free of fire damage. Also, TS 6.8.1 required procedures for implementing the fire
protection program and for combating fires.
Contrary to the above requirements, the licensee failed to assure that one of the
redundant divisions (SSD Division 1, including MOVs 1CS-166, 1CS-168, and 1CS-217)
would be free of fire damage. MOVs 1CS-166, 1CS-168, and 1CS-217 were not
protected from fire damage, either by one of the physical methods described above or by
procedures. The licensee entered the finding into the corrective action program as AR
76260.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-03, Failure to Protect Charging System
MOVs 1CS-166, 1CS-168, and 1CS-217 From Maloperation Due To a Fire.
(4) SSA Area 1-A-BAL-C of the RAB
Introduction
The team identified a URI involving failure to follow the FPP and TS 6.8.1. The URI
involved failure to protect equipment that was relied on for SSD during a fire in SSA area
1-A-BAL-C from fire damage. MOV 1CC-251, CC Return From RCP Seals; and MOV
11
1CC-208, CC Supply To RCP Seals, were not protected either physically or procedurally
from maloperation due to a fire in SSA area 1-A-BAL-C. Consequently, a fire in that SSA
area could potentially result in an RCP seal LOCA.
Description
The team found that the control power cables for CC system MOVs 1CC-251 and 1CC-
208, which were relied upon to remain open for SSD during a fire in SSA area 1-A-BAL-
C, were routed through that area and into MCC 1B31 in that area with no fire barrier.
Fire area 1-A-BAL-C was located on the 286 foot level of the auxiliary building, above
electrical penetration room B. This lack of required fire barriers and need for operator
actions was recognized in the SSA but no procedural guidance was included in AOP-36
for operators to prevent or mitigate maloperation of these valves. Consequently, a fire in
this area could cause 1CC-251 or 1CC-208 to spuriously close, which would stop all CC
flow to the RCP seals.
For a fire in area 1-A-BAL-C, the SSD analysis relied on SSD Division 1 equipment. This
included reliance on CC to cool the RCP seals. CSIP supply to the RCP seals was not
assured to be unaffected by the fire. Consequently, a loss of CC to the RCP seals could
potentially result in a loss of all RCP seal cooling which could in turn result in an RCP
seal failure and a LOCA.
Analysis
This finding had more than minor safety significance because it affected the objectives of
the Initiating Events Cornerstone of Reactor Safety. The finding affected the likelihood of
occurrence of initiating events that challenge critical safety functions. Also, when
assessed in combination with other findings identified in this report, the significance could
be greater than very low significance. However, the finding remains unresolved pending
completion of a significance determination.
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions (i.e., SSD Division 1, including MOVs 1CC-251 and 1CC-208) would be free of
fire damage. Also, TS 6.8.1 required procedures for implementing the fire protection
program and for combating fires.
Contrary to the above requirements, the licensee failed to assure that one of the
redundant divisions (SSD Division 1, including MOVs 1CC-251 and 1CC-208) would be
free of fire damage. MOVs 1CC-251 and 1CC-208 were not protected from fire damage,
either by one of the physical methods described above or by procedures. The licensee
entered the finding into the corrective action program as AR 80089.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-04, Failure to Protect Component Cooling
MOVs 1CC-251 and 1CC-208, CC for RCP Seals, From Maloperation Due To a Fire.
12
.04 Operational Implementation of SSD Capability
a. Inspection Scope
The team reviewed and walked down the local manual actions needed to achieve and
maintain hot shutdown for fires in all of the selected areas/zones as described in Section
1R05.01.a. These manual actions were described in procedure AOP-036, Safe
Shutdown Following a Fire, Rev. 21.
The team also followed up on open VIO 50-400/02-08-01, Failure to Implement and
Maintain NRC Approved Fire Protection Program Safe Shutdown System Separation
Requirements. That VIO and related White finding had been left open in IR 50-400/02-
08. In a supplement to that IR dated October 4, 2002, the NRC had stated that licensee
modifications had reduced the risk significance of the degraded Thermo-Lag barrier to
that of a Green finding. However, VIO 50-400/02-08-01 was left open pending further
NRC review of licensee corrective actions and the development of internal NRC
inspection guidance, related to use of local manual actions as opposed to one of the
protection methods identified in NRC Position C.5.b.(2) of Branch Technical Position
(BTP) CMEB 9.5-1. During this inspection, the team reviewed and walked down the local
manual actions, needed to achieve and maintain hot shutdown, that were proceduralized
by the licensee during this inspection in AOP-36, Rev. 24, for the new ACP room fire
area.
The team reviewed and walked down the manual actions described above to verify that:
- The procedures used for SSD were available to the appropriate staff.
- The procedures used for SSD were consistent with the SSA methodology and
assumptions and also were consistent with fire pre-plan procedures.
- The actions were described in the fire-protection-related licensing-basis
documents.
- The procedures were written so that operator actions could be correctly
performed within the times assumed in the SSA.
- Personnel required to achieve and maintain the plant in hot shutdown condition
from the MCR could be provided from normal onsite staff, exclusive of the fire
brigade.
- Operator and fire brigade staffing would be adequate to complete the required
manual actions.
- Operators had sufficient access to the equipment to perform the required actions.
- Access to remote shutdown equipment and operator manual actions would not be
inhibited by smoke migration from one area to adjacent plant areas used to
accomplish SSD.
13
- The training program for operators included appropriate lesson plans and job
performance measures (JPMs) for SSD activities.
b. Findings
(1) Reliance on Manual Actions In Place of Required Physical Separation or Protection
Introduction
The team identified a URI involving failure to follow the FPP. The URI was related to the
licensees reliance on many manual actions in place of the required physical separation
or protection.
Description
The team found that the licensee used many local manual operator actions to achieve
and maintain hot shutdown in place of the required physical separation or protection of
cables and equipment. Further, the licensee had not obtained NRC approval for these
deviations from the approved FPP. This condition applied to all areas inspected,
including the new ACP fire area that had been recently created as corrective action for
previous Violation 50-400/02-08-01. The local manual operator actions that were
reviewed are listed in Attachment 2. The team assessed that during a fire, an SSD NLO
would reasonably be able to perform each of the individual reviewed operator actions,
except those that are identified below as other findings. However, reliance on all of these
manual actions in place of physical separation or protection could increase the risk of
failure of SSD equipment to operate during a fire. There could be a risk that the NLO
would fail to perform every manual action in a timely and accurate manner, without
encountering unforseen difficulties or making a mistake.
Analysis
This issue could have more than minor safety significance because it could affect the
objectives of the Mitigating Systems Cornerstone of Reactor Safety. The issue could
potentially affect the availability and reliability of sytems that mitigate initiating events to
prevent undesirable consequences. Also, when assessed in combination with other
findings identified in this report, the significance could be greater than very low
significance. However, the finding remains unresolved pending completion of a
significance determination.
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions would be free of fire damage. Further, if both divisions were located in the
same area, then one of the divisions was to be physically protected from fire damage by
one of three specified methods. The licensees approved FPP did not provide for
reliance on operator actions in place of physical separation or protection of SSD
equipment. In addition, OLC 2.F and the UFSAR, Section 9.5.1, FPP, included quality
assurance requirements for fire protection. The FPP stated that a QA program was
14
being used to identify and rectify any possible deficiencies in design, construction, and
operation of the fire protection systems.
Contrary to the above requirements, the licensee failed to assure that one of the
redundant divisions would be free of fire damage by using one of the specified methods.
of physical protection. The licensee had not obtained NRC approval for reliance on the
operator actions listed in Attachment 2 in place of the required physical separation or
protection. In addition, those operator actions in Attachment 2 that are in place of
physical protection of cables in the new ACP fire area represent inadequate corrective
action for previous Violation 50-400/02-08-01. The licensee had entered this issue into
their corrective action program as AR 69721.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-05, Reliance on Manual Actions in Place of
Required Physical Separation or Protection.
(2) Fire SSD Operator Actions With Excessive Challenges
Introduction
The team identified a URI involving failure to follow the FPP and TS 6.8.1. The URI was
related to certain procedure steps for SSD from a fire and for related corrective action for
previous VIO 50-400/02-08-01, associated with an inadequate Thermo-Lag fire barrier
assembly between the B train switchgear room/ACP room and the A train cable
spreading room. For the new ACP room fire area, certain cables were not physically
protected from the fire and certain SSD procedure steps, that were used in place of
physical protection of cables, involved excessive challenges to operators. Consequently,
a fire in the ACP fire area could result in a loss of all auxiliary feedwater.
Description
For a fire in Fire Area 1-A-ACP, AOP-36 steps 2.c and 14.a required the NLO to remove
fuses from transfer panel 1B. Completing these steps would include the following
challenges:
- The subject transfer panel was physically located approximately 20 feet from the
ACP room door. With a fire in the ACP room, the area around the transfer panel
could become uninhabitable before the NLO could complete these steps,
because some smoke from the fire could enter the transfer panel area from
around the door while the door was closed, and because smoke would certainly
enter the transfer panel area when the door was opened by the fire brigade to
attack the fire.
- To physically reach the subject fuses, the NLO would need to place his or her
entire body inside a cabinet with an opening that was approximately 15 inches
wide. Also, the inside of the cabinet included energized electrical components on
each side of the cabinet, with about 15 inches of width between them. The
15
licensee had not ensured that all NLOs were physically capable of safely entering
that cabinet - the team noted that some NLOs were more than 15 inches wide.
- Because the subject fuses were located on a panel inside the cabinet and
approximately seven feet above floor level, all but the tallest NLOs would need to
use a narrow, custom-made wooden step-stool inside the cabinet to be able to
reach the fuses. The team noted that the location of the step-stool was not
controlled.
- Because the subject fuses were also located behind a plexiglass fuse cover that
was held in place by small metal screws, the NLO would need to raise his or her
hands above the level of his or her head and use a metal screwdriver to remove
the fuse cover. The licensee had not ensured that all NLOs were physically
capable of completing this activity. Furthermore, because this activity involved
manipulating a metal screwdriver inside an energized electrical cabinet, the team
considered the activity to involve a personnel safety hazard.
- To identify the correct fuses to be pulled, the NLO must first identify the cabinet in
which the fuses are located, and then identify the fuses themselves, within that
cabinet. The team observed that the subject cabinet was physically adjacent to
four identical cabinets, that these cabinets were not labeled on the side from
which the NLO would enter, and that the instructions in AOP-036 did not identify
the subject cabinet. Furthermore, the team observed that the labels which
uniquely identified the subject fuses within the cabinet were difficult to see - they
were partially obscured by cables which had been landed on adjacent terminal
blocks.
The team considered that these challenges were excessive and that there was not
reasonable assurance that all NLOs would be able to perform the actions during a fire.
Consequently, operators would not able to start the turbine-driven AFW pump and the
AFW system could become unavailable. The team concluded that these procedure
steps were inadequate and that consequently they represented inadequate corrective
action for VIO 50-400/02-08-01.
Analysis
This finding had more than minor significance because it affected the objectives of the
Mitigating Systems Cornerstone of Reactor Safety. The finding affected the availability
and reliability of systems that mitigate initiating events to prevent undesirable
consequences. Also, when assessed in combination with other findings identified in this
report, the significance could be greater than very low significance. However, the finding
remains unresolved pending completion of a significance determination.
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions would be free of fire damage. Further, if both divisions were located in the
same area, then one of the divisions was to be physically protected from fire damage by
one of three specified methods. The licensees approved FPP did not provide for
16
reliance on operator actions in place of physical separation or protection of SSD
equipment. Also, TS 6.8.1 required procedures for implementing the fire protection
program and for combating fires. In addition, OLC 2.F and the UFSAR, Section 9.5.1,
FPP, included quality assurance requirements for fire protection. The FPP stated that a
QA program was being used to identify and rectify any possible deficiencies in design,
construction, and operation of the fire protection systems.
Contrary to the above requirements, the licensee failed to protect the turbine-driven AFW
pump from effects of a fire where it was relied on for SSD. In addition, the licensees
corrective actions for a previous VIO 50-400/02-08-01 were inadequate because they
failed to rectify deficiencies in design, construction, and operation related to SSD from a
fire in the area of the ACP room. The licensee entered the finding into the corrective
action program as AR 80214.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-06, Fire SSD Operator Actions With
Excessive Challenges.
(3) Too Many SSD Actions for Operators to Perform
Introduction
The team identified a URI involving failure to follow the FPP and TS 6.8.1. The URI was
related to an inadequate procedure for SSD from a fire and for inadequate corrective
action for VIO 50-400/02-08-01. For a fire in certain SSA areas of the RAB (including the
new ACP fire area), AOP-36 included too many SSD contingency actions to respond to
potential spurious actuations for the one designated SSD NLO to perform all of the
actions. Consequently, equipment that was relied on for SSD may not be available.
Description
The team found that for each fire SSA area inspected, AOP-036 required operators to
complete a relatively large number of manual actions outside the main control room. The
team determined that the normal shift operating crew included four NLOs; three were
assigned to the fire brigade and one was assigned to be the SSD NLO. The local
manual operator actions required to achieve and maintain hot shutdown for each of the
fire areas inspected are listed in Attachment 2 to this report. The most demanding fire
areas were fire area 1-A-ACP, which included about 55 such actions, and fire area 1-A-
BAL-B, which included about 39 such actions.
Also, since the SSA did not ensure that offsite power would not be lost due to a fire in
any of the SSA areas inspected, operators were expected to be able to respond to a loss
of offsite power (LOOP) and reactor trip while performing the fire SSD actions. The team
noted that a LOOP or reactor trip could place even more demands on the one NLO who
was not fighting the fire.
17
The team found that while most of the manual actions in these SSA areas involved one-
time actions (like opening a breaker), others could require the NLO to monitor plant
conditions and make system adjustments over an extended period of time. The manual
actions which could require dedicated NLO attention, and thus possibly detract from the
successful and timely performance of subsequent required local manual operator
actions, included the following:
areas inspected, Step 13.b(3) required the NLO to establish continuous
communications with the MCR, locally shut 1CS-228 to isolate the normal
charging flow control valve (FCV) and then to locally control charging flow by
throttling the bypass valve, 1CS-227. Both valves were in close proximity and
located in the scalloped area of the 248-ft level in the RAB. This area was
located in the radiation-controlled area (RCA) and radiation levels at these valves
were elevated but within 10 CFR 20 limits. A sound powered phone with a long
extension cord was located in the area to allow the NLO to wait in low dose areas
between valve manipulations if the NLOs radio was not functional. However,
local manual operator actions subsequent to this step could be adversely
impacted [e.g., Section 3.0, Step 14.b for locally responding to a failed open
steam generator power operated relief valve (PORV)].
locally operate a PORV on the C steam generator, to obtain and maintain the
desired RCS temperature. AOP-36 requires operators to trip the reactor if the fire
is not contained in the ACP panel or involves any electrical cable tray.
Consequently, during a large fire in the ACP room the unit would not be at steady
state when this action was undertaken, and because a fire in this area may
complicate operator efforts to stabilize the plant, the NLO who undertakes this
action may be required to monitor RCS temperature and make appropriate
adjustments to the PORV position almost continuously and for some time, until
the plant is reasonably stable.
throttle 1AF-149 to maintain level in the C steam generator. For the same
reasons as described above, the NLO who undertakes this action may be
required to continue to monitor steam-generator level and make appropriate
adjustments to the position of 1AF-149 almost continuously and for some time,
until the plant is reasonably stable.
The team found that some of the required manual actions would be completed inside the
radiologically controlled area (RCA), while others would be completed outside the RCA.
The team also observed that completing the manual actions in AOP-036, in the order in
which they are described in that procedure, would require the SSD NLO to enter and exit
the RCA several times. The team noted that:
- some manual actions involved valves identified as potentially contaminated or
located in contamination areas,
18
- radioactive radon gas can become associated with anyone who passes through
the RCA,
- hand or foot contamination as well as radon gas can cause a portal monitor to
alarm, and
- anyone who is in a portal monitor when it alarms must wait at the exit point for
health physics (HP) technicians to complete a detailed survey to determine the
true cause of the alarm, before proceeding.
The team noted that the licensee had no emergency dosimeters or rapid ingress/egress
procedures in place for use during plant emergency situations. The team therefore
considered that every time the SSD NLO exited the RCA, that NLO may experience a
portal-monitor alarm, and may therefore be forced to wait for HP technicians to arrive at
the exit and complete a detailed survey before proceeding. The team received a portal
monitor alarm on many occasions during this inspection. Operators stated that, if they
received such an alarm during a fire, they would wait for an HP technician before
proceeding to perform SSD actions.
The team considered that the manual actions in AOP-036 could not reasonably be
completed by the available staff, because:
- the SSD NLO may be required to complete as many as 55 manual actions,
- several manual actions required dedicated operator attention,
- some of the manual actions could require a considerable amount of time to
complete,
- some manual actions could be delayed by RCA portal-monitor alarms, and
- only one NLO would have been available to complete all SSD manual actions.
The team concluded that the SSD NLO may not be able to accomplish some required
manual actions in a timely manner. Consequently, some equipment relied on for SSD
may not be available. For example, the SSD NLO may not be able to respond to a failed
open steam generator PORV, locally throttle a steam generator PORV, or throttle AFW.
The team therefore considered AOP-36 to be inadequate.
Analysis
This finding had more than minor significance because it affected the objectives of the
Mitigating Systems Cornerstone of Reactor Safety. The finding affected the availability
and reliability of systems that mitigate initiating events to prevent undesirable
consequences. Also, when assessed in combination with other findings identified in this
report, the significance could be greater than very low significance. However, the finding
remains unresolved pending completion of a significance determination.
19
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions would be free of fire damage. Further, if both divisions were located in the
same area, then one of the divisions was to be physically protected from fire damage by
one of three specified methods. Also, TS 6.8.1 required procedures for implementing the
fire protection program and for combating fires. In addition, OLC 2.F and the UFSAR,
Section 9.5.1, FPP, included quality assurance requirements for fire protection. The FPP
stated that a QA program was being used to identify and rectify any possible deficiencies
in design, construction, and operation of the fire protection systems.
Contrary to the above requirements, the licensee failed to protect various equipment
either physically or procedurally from the effects of a fire where that equipment was relied
on for SSD. In addition, the licensees corrective actions for previous VIO 50-400/02-08-
01 were inadequate because they failed to rectify deficiencies in design, construction,
and operation related to SSD from a fire in the area of the ACP room. The licensee
entered the finding into the corrective action program as AR 80215.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-07, Too Many SSD Actions for Operators
to Perform.
(4) Using the BAT Without Level Indication
Introduction
The team identified a URI involving failure to follow the FPP and TS 6.8.1. The URI was
related to an inadequate procedure for SSD from a fire. For a fire in SSA area 1-A-BAL-
B, the SSD procedure directed operators to take CSIP suction from the BAT even if BAT
level indication were lost. However, the charging volume needed for RCS cooldown
would have emptied the BAT and damaged the SSD CSIP.
Description
The team found that, for a fire in SSA area 1-A-BAL-B-B2 or -B3, near the BAT, AOP-36
directed operators to use the BAT as a suction source for the CSIPs even if the BAT
level indication was lost due to the fire. This alignment was to be used in preparation for
and during a cooldown of the RCS. However, the team analyzed that the charging
volume needed for RCS cooldown would have emptied the BAT and damaged the SSD
CSIP.
The SSA stated that, if BAT level indication was lost due to a fire, then the RWST was to
be used as a suction source for the CSIPs. However, this analysis was not implemented
in AOP-36. AOP-36 was inadequate because it failed to recognize that the charging
volume needed for RCS cooldown would have emptied the BAT and damaged the SSD
CSIP.
20
Analysis
This finding had more than minor significance because it affected the objectives of the
Mitigating Systems Cornerstone of Reactor Safety. The finding affected the availability
and reliability of systems that mitigate initiating events to prevent undesirable
consequences. Also, when assessed in combination with other findings identified in this
report, the significance could be greater than very low significance. However, the finding
remains unresolved pending completion of a significance determination.
Enforcement
As described in Section 1R05.03.b.1 above, OLC 2.F required that one of the redundant
divisions would be free of fire damage. Further, if both divisions were located in the
same area, then one of the divisions was to be physically protected from fire damage by
one of three specified methods. Also, TS 6.8.1 required procedures for implementing the
fire protection program and for combating fires.
Contrary to the above requirements, the licensee failed to protect the BAT level indication
from effects of a fire where it was relied on for SSD, and the AOP-36 reliance on using
the BAT without level indication was inadequate. The licensee entered the finding into
the corrective action program as AR 75065.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-08, Using the Boric Acid Tank Without
Level Indication.
.05 Emergency Communications
a. Inspection Scope
The team reviewed the adequacy of the communication systems relied upon to
coordinate the shutdown of the unit and fire brigade duties, including the site paging
(PA), portable radio, and sound-powered phone systems. The team reviewed the
licensees portable radio channel features to assess whether the system and its
repeaters were protected from exposure fire damage. During walkdowns of sections of
the post-fire SSD procedure, the team checked if adequate communications equipment
would be available for the personnel performing the procedure. The team also reviewed
the periodic testing of the site fire alarm and PA systems; maintenance checklists for the
sound-powered phone circuits and amplifiers; and inventory surveillance of post-fire SSD
operator equipment to assess whether the maintenance/surveillance test program for the
communications systems was sufficient to verify proper operation of the systems.
b. Findings
No findings of significance were identified.
21
a. Inspection Scope
The team reviewed the design and operation of DC emergency lighting system self-
contained, battery powered emergency lighting units (ELUs) as described in UFSAR
Sections 9.5.1.2.2.e and 9.5.3. During plant walk downs of selected areas where
operators performed local manual actions defined in the post-fire SSD procedure, the
team inspected area ELUs for operability and checked the aiming of lamp heads to
determine if adequate illumination was available to correctly and safely perform the
actions required by the procedures. The team inspected emergency lighting features
along access and egress pathways used during SSD activities for adequacy and
personnel safety. The locations and identification numbers on the ELUs were compared
to design drawings to confirm the as-built configuration. The team also checked if these
battery power supplies were rated with at least an 8-hour capacity. In addition, the team
reviewed the manufacturers information and the licensees licensee periodic
maintenance tests to verify that the ELUs were properly designed and were being
maintained in an operable manner.
b. Findings
Introduction
The team identified a URI involving failure to provide fixed, self-contained lighting with
individual eight-hour-minimum battery power supplies in areas that must be manned for
safe shutdown and for inadequate corrective action for previous VIO 50-400/02-08-01.
Description
In the SSA areas in which the team walked down safe shutdown manual actions, the
team identified that the locations for local manual operator actions listed in Attachment 3
to this report would not be illuminated by fixed, self-contained lighting with individual
eight-hour-minimum battery power supplies. Some of these local manual operator
actions that were lacking required illumination had been added as corrective action for
previous VIO 50-400/02-08-01.
The team observed that about 17 of the locations for local manual operator actions had
no emergency lighting, as identified in Attachment 3. [The team also observed that many
more locations for local manual operator actions had fluorescent lights, that would be
powered by the safety-related emergency diesel generators, that could provide
emergency illumination. However, these lights did not meet the requirements for lights
with eight-hour batteries. These locations are separately identified in Attachment 3.
Also, the team noted that the licensee had not requested NRC exemptions from the
requirement to provide lights with eight-hour batteries.]
22
The team also observed that all NLOs routinely carried flashlights and had access to
more flashlights that were stored in the auxiliary building. The team assessed that, by
using a flashlight, the SSD NLO would be able to perform the required actions but that
those actions would take more time to perform when relying on illumination by a flashlight
and could be less reliable.
Analysis
This finding had more than minor significance because it affected the objectives of the
Mitigating Systems Cornerstone of Reactor Safety. The finding affected the availability
and reliability of systems that mitigate initiating events to prevent undesirable
consequences. Also, when assessed in combination with other findings identified in this
report, the significance could be greater than very low significance. However, the finding
remains unresolved pending completion of a significance determination.
Enforcement
OLC 2. F. and UFSAR Section 9.5.1 stated that BTP 9.5-1 was used in the design of the
fire protection program for safety-related systems and equipment and for other plant
areas containing fire hazards that could adversely affect safety-related systems. BTP
9.5-1, Section C.5.g, Lighting and Communication, paragraph (1), required that fixed
self-contained lighting consisting of fluorescent or sealed-beam units with individual
eight-hour-minimum battery power supplies should be provided in areas that must be
manned for safe shutdown and for access and egress routes to and from all fire areas.
In addition, OLC 2.F and the UFSAR, Section 9.5.1, FPP, included quality assurance
requirements for fire protection. The FPP stated that a QA program was being used to
identify and rectify any possible deficiencies in design, construction, and operation of the
fire protection systems.
Contrary to the above requirements, the licensee failed to provide fixed self-contained
lighting consisting of fluorescent or sealed-beam units with individual eight-hour-minimum
battery power supplies in the location of the manual actions identified above and listed in
Attachment 3. In addition, the licensees corrective actions for previous VIO 50-400/02-
08-01 were inadequate because they failed to rectify deficiencies in design, construction,
and operation related to SSD from a fire in the area of the ACP room. The licensee
entered this finding into the corrective action program as AR 79047.
This finding and related violation are unresolved pending completion of a significance
determination, in combination with the other fire protection issues identified in this report.
This finding is identified as URI 50-400/02-11-09, Failure to Provide Required Emergency
Lighting for SSD Operator Actions.
23
.07 Cold Shutdown Repairs
a. Inspection Scope
The team reviewed existing procedures and examined plant equipment to establish that
the licensee had dedicated repair procedures, equipment, and materials to accomplish
repairs of damaged components required for cold shutdown, that these components
could be made operable, and that cold shutdown could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The
team examined cold shutdown repair equipment and replacement electrical power and
control cables for systems needed to take the plant to cold shutdown following a large
fire. The team evaluated the estimated manpower and the time required to perform post-
fire repairs for reasonableness.
b. Findings
No findings of significance were identified.
.08 Fire Barriers and Fire Area/Zone/Room Penetration Seals
a. Inspection Scope
The team walked down the selected fire zones/areas to evaluate the adequacy of the fire
resistance of barrier enclosure walls, ceilings, floors, and cable protection. This
evaluation also included fire barrier penetration seals, fire doors, fire dampers, cable tray
fire stops, and fire barrier partitions to ensure that at least one train of SSD equipment
would be maintained free of fire damage from a single fire. The team observed the
material condition and configuration of the installed fire barrier features and also
reviewed construction details and supporting fire endurance tests for the installed fire
barrier features. The team compared the observed fire barrier penetration seal
configurations to the design drawings and tested configurations. The team also
compared the penetration seal ratings with the ratings of the barriers in which they were
installed. In addition, the team reviewed licensing documentation, engineering
evaluations of Generic Letter 86-10 fire barrier features, and NFPA code deviations to
verify that the fire barrier installations met design requirements and license commitments.
b. Findings
No findings of significance were identified.
.09 Fire Protection Systems, Features, and Equipment
a. Inspection Scope
The team reviewed flow diagrams, electrical schematic diagrams, periodic test
procedures, engineering technical evaluations for NFPA code deviations, operational
valve lineup procedures, and cable routing data for the power and control circuits of the
motor-driven fire pump, the diesel-driven fire pump, and the fire protection water supply
system yard mains. The review evaluated whether the common fire protection water
delivery and supply components could be damaged or inhibited by fire-induced failures of
24
electrical power supplies or control circuits and subsequent possible loss of fire water
supply to the plant. Additionally, team members walked down the fire protection water
supply system in selected fire areas to assess the adequacy of the system material
condition, consistency of the as-built configuration with engineering drawings, and
operability of the system in accordance with applicable administrative procedures and
NFPA standards.
The team examined the adequacy of installed fire protection features in accordance with
the fire area and system spatial separation and design requirements in BTP CMEB 9.5-1.
The team walked down accessible portions of the fire detection and alarm systems in the
selected fire areas to evaluate the engineering design and operation of the installed
configurations. The team also reviewed engineering drawings for fire detector spacing
and locations in the four selected fire areas for consistency with the licensees fire
protection plan and the requirements in NFPA 72E.
The team also walked down the selected fire zones/areas with automatic sprinkler
suppression systems installed to assure proper type, placement and spacing of the
heads/nozzles and the lack of obstructions. The team examined vendor information,
engineering evaluations for NFPA code deviations, and design calculations to verify that
the required suppression system density for each protected area was available.
The team reviewed the adequacy of the design, installation and operation of the manual
suppression standpipe and fire hose system for the selected fire areas. The team
examined design calculations and evaluations to verify that the required fire hose water
flow and sprinkler system density for each protected area were available. The team
checked a sample of manual fire hose lengths to determine whether they would reach
the SSD equipment. Additionally, the team observed placement of the fire hoses and
extinguishers to assess consistency with the fire fighting pre-plan drawings.
b. Findings
No findings of significance were identified.
.10 Compensatory Measures
a. Inspection Scope
The team reviewed the licensees Fire Protection System Engineering Status Reviews
which identified each fire protection systems performance problems and regulatory
issues. The team also reviewed the Fire Protection Out of Service Log generated for the
last 18 months and associated compensatory measures. The review was performed to
verify that the risk associated with removing fire protection and/or post-fire systems or
components was properly assessed and adequate compensatory measures were
implemented in accordance with the approved fire protection program.
b. Findings
No findings of significance were identified.
25
4. OTHER ACTIVITIES (OA)
4OA2 Identification and Resolution of Problems
a. Inspection Scope
The team reviewed the corrective action program procedures and a selected sample of
condition reports associated with the Harris FPP to verify that the licensee had an
appropriate threshold for identifying issues. The team also reviewed licensee audits and
assessments of fire protection and safe shutdown. The team evaluated the effectiveness
of the corrective actions for the identified issues.
b. Findings
As discussed in Sections 1R05.04.b.1, 1R05.04.b.2, 1R05.04.b.3, and1R05.06.b, the
team found that licensee corrective actions for VIO 50-400/02-08-01 regarding an
inadequate fire barrier wall were inadequate, in that the licensees corrective actions for
that violation contributed to four of the findings described above.
The team found that licensee audits and self-assessments in the area of SSD were
weak. The audits and self-assessments had not identified the types of findings that this
inspection found. Contributing factors included a lack of attention to detail; for example,
not tracing cable routings or walking down operator actions as was done in this
inspection. In addition, the CP&L corporate Nuclear Assessment Section (NAS) audits of
fire protection at Shearon Harris did not look at SSD. A Peer Report included in the
November 2000 NAS audit of Shearon Harris fire protection stated: Harris NAS Fire
Protection Program Audits of recent past have not included fire events safe shutdown
within the scope of the audits due to a reliance on engineering self-assessments. It is
the opinion of the auditor that the scope of future Harris NAS Fire Protection
assessments should include fire events safe shutdown related documentation and
activities. However, the team noted that subsequent NAS audits of Harris fire
protection did not audit SSD.
The team noted that the licensees initial corrective actions to the findings described in
this report were timely and responsive. The licensee revised SSD procedures three
times during the inspection, made a 10 CFR 50.72 report to the NRC, and stationed an
additional SSD NLO.
4OA5 Other Activities
As discussed in Section 4OA2.b above, the team found that licensee corrective actions
for VIO 50-400/02-08-01 regarding an inadequate fire barrier wall were inadequate.
Since the new findings are unresolved pending completion of the significance
determination, VIO 50-400/02-08-01 will remain open.
26
4OA6 Meetings
Exit Meeting Summary
The team presented the inspection results to Mr. J. Scarola and members of his staff at
the conclusion of the inspection on December 20, 2002, and also by telephone on
January 31, 2003. The licensee acknowledged the findings presented. Proprietary
information is not included in this inspection report.
SUPPLEMENTAL INFORMATION
Partial List of Persons Contacted
Licensee
D. Baksa, Supervisor, Equipment Perfromance
J. Caves, Licensing Supervisor
R. Duncan, Director of Site Operations
M. Fletcher, Manager, Fire Protection Program
P. Fulford, Superintendent, Design Engineering
C. Georgeson, Supervisor, EI&C Design
W. Gregory, Operations Fire Protection Specialist
W. Gurganious, Manager, NAS
T. Hobbs, Manager, Operations
A. Khanpour, Manager, Engineering
F. Lane, Jr., Senior Nuclear Work Management Specialist
J. Laque, Manager, Maintenance
T. Morton, Site Services Manager
J. Scarola, Site Vice President
B. Waldrep, Plant General Manager
NRC
J. Brady, Senior Resident Inspector, Shearon Harris
H. Christensen, Deputy Director, Division of Reactor Safety (DRS), Region II (RII)
C. Ogle, Chief, Engineering Branch 1, DRS, RII
Items Opened, Closed, and Discussed
Opened
50-400/02-11-01 URI Failure to Protect Charging System MOV 1CS-165, VCT
Outlet to CSIPs, From Maloperation Due To a Fire (Section
1R05.03.b.1)
50-400/02-11-02 URI Failure to Protect Charging System MOVs 1CS-169, 1CS-
214, 1CS-218, and 1CS-219 From Maloperation Due To a
Fire (Section 1R05.03.b.2)
50-400/02-11-03 URI Failure to Protect Charging System MOVs 1CS-166, 1CS-
168, and 1CS-217 From Maloperation Due To a Fire
(Section 1R05.03.b.3)
50-400/02-11-04 URI Failure to Protect Component Cooling MOVs 1CC-251 and
1CC-208, CC for RCP Seals, From Maloperation Due To a
Fire (Section 1R05.03.b.4)
Attachment 1
2
50-400/02-11-05 URI Reliance on Manual Actions in Place of Required Physical
Separation or Protection From a Fire (Section 1R05.04.b.1)
50-400/02-11-06 URI Fire SSD Operator Actions With Excessive Challenges
(Section 1R05.04.b.2)
50-400/02-11-07 URI Too Many Fire SSD Actions for Operators to Perform
(Section 1R05.04.b.3)
50-400/02-11-08 URI Using the Boric Acid Tank Without Level Indication (Section
1R05.04.b.4)
50-400/02-11-09 URI Failure to Provide Required Emergency Lighting for SSD
Operator Actions (Section 1R05.06.b)
Closed
None
Discussed
50-400/02-08-01 VIO Failure to Implement and Maintain NRC Approved Fire
Protection Program Safe Shutdown System Separation
Requirements (Section 40A5)
List of Inspection Documents Reviewed
PROCEDURES
AOP-036, Safe Shutdown Following a Fire, Rev. 21 and Rev. 24
AOP-038, Rapid Downpower, Rev. 2
AP-301, Seasonal Weather Preparations and Monitoring, Rev. 34
EOP-EPP-004, Reactor Trip Response, Rev. 10
EOP-Guide-1, Path 1 Guide, Rev. 14
FIR-NGGC-0003, Hot Work Permit, Rev. 0
FPP-001, Fire Protection Program Manual, Rev. 22
FPP-002, Fire Emergency, Rev. 22
FPP-003, Fire Investigation Report, Rev. 7
FPP-004, Transient Combustible Control, Rev. 12
FPP-005, Duties of a Fire Watch, Rev. 15
FPP-007, Control of Flammable and CombustibleFPP-013, Fire Protection - Minimum
Requirements and Mitigating Actions, Rev. 30
FPP-014, Fire Protection Surveillance Requirements, Rev. 12
FPT-3002, Fire Main Valve Position Verification, Rev. 15
FPT-3006, Fire Main Flow Test, Rev. 6
Attachment 1
3
FPT-3101, Fire Hose Rack Inspection: Auxiliary Building, Rev. 11
FPT-3120, Fire Hose Valve Operability Test: Auxiliary Building, Rev. 4
FPT-3151, Fire Extinguisher Inspection: Auxiliary Building, Rev. 0
FPT-3425, Fire Damper Inspection: Reactor Auxiliary Building, 286 Elevation, Rev. 9
FPT-3550, Fire Penetration Seal Visual Inspection, Rev. 10
MPT-E0030, Self Contained DC Emergency Lighting System Test/Inspection, Rev. 16
MPT-E0032, Self Contained DC Emergency Lighting System Eight Hour Life Test, Rev. 14
MST-I0277, Electrical Power Feed Switchover for RHR Inlet Isolation Valve 1RH-1
OP-110, Section 8.3, Venting the SI Accumulators, Rev. 18
OP-172, Reactor Auxiliary Building HVAC System, Rev. 25
RTP-006, Maintaing Floor Drain Loop Seals, Rev. 7
TPP-219, Emergency Services Training Program, Rev. 9
DESIGN CRITERIA AND DESIGN BASIS DOCUMENTS
DBD-315, Fire Detection System, Rev. 1
DBD-316, Fire Barrier System, Rev. 1
DBD-317, Water-Based Fire Suppression System, Rev. 0
SD-149, System Description Fire Protection/Detection Systems, Rev. 16
ENGINEERING CALCULATIONS AND EVALUATIONS
4-RMB, High Resistance Grounding Calculation - 6.9 kV System, Rev. 5, dated 2/19/93
E-5506, Appendix R Coordination Study, Rev. 7, dated 5/17/02
HNP-M/BMRK-002, Code Compliance Evaluation NFPA 72 D -Fire Detection Systems, Rev. 0
HNP-M/BMRK-003, Code Compliance Evaluation NFPA 80 -Standard for Fire Doors and
Windows, Rev. 0
HNP-M/BMRK-005, Code Compliance Evaluation NFPA 10 - Portable Fire Extinguishers, Rev. 0
HNP-M/BMRK-006, Code Compliance Evaluation NFPA 14 -Standpipe and Hose Systems,
Rev. 0
HNP-M/BMRK-008, Code Compliance Evaluation NFPA 20 -Standard for Outside Protection,
Rev. 0
HNP-M/BMRK-009, Code Compliance Evaluation NFPA 13 - Sprinkler Systems, Rev. 0
HNP-9-RAB-6B, SWGR RM. B Ventilation System Served by AH-13, Rev. 2
COMPLETED MAINTENANCE AND SURVEILLANCE TEST PROCEDURES/RECORDS
Periodic Maintenance Checklist Tables CL-E-0013, -0038, -0053, Safe Shutdown Testing for
PA Amplifiers and Sound Powered Phone Circuits, dated November 4, 2002
Work Order Package 00192587, Perform MPT-E0030, dated March 1, 2002
Work Order Package 00125222, Perform MPT-E0032, dated December 11, 2001
Work Order Package 00132600, Perform MPT-E0032, dated January 21, 2002
FPT-3120, Fire Hose Valve Operability Test: Auxiliary Building, dated March 8, 2002
FPT-3205, Fire Detector Functional Test: Local Fire Detector Control Panel 5, dated
October 2, 2002
Attachment 1
4
FPT-3206, Fire Detector Functional Test: Local Fire Detector Control Panel 6, dated
July 30, 2002
FPT-3302, Main Drain Test Auxiliary Building, dated May 18, 2001
FPT-3550, Fire Penetration Seal Visual Inspection, E385A, dated February 28, 1998
FPT-3550, Fire Penetration Seal Visual Inspection, E374, dated April 20, 1991
FPT-3550, Fire Penetration Seal Visual Inspection, P839, dated February 2, 1998
DRAWINGS
84-60823A-01, Sheets 1 and 2, I-T-E/Gould Motor Control Center Layout for MCC 1A35-SA,
Rev 6
84-60823A-01, Sheet 1, MCC 1A35-SA, Rev. 7
84-60823A-01, Sheet 2, MCC 1A35-SA, Rev. 7
84-60823A-05, Sheet 1, MCC 1B35-SB, Rev. 2
84-60823A-06, Sheet 2, MCC 1B35-SB, Rev. 4
1364-93040, EC-1 through EC-6 Internal Conduit Fire Seals, Rev 3
1364-93049, EL-1 and EL-2 Wall/Floor Electrical Fire Seals, Rev 3
CAR-2165-G-197S01, Fire Protection Piping Reactor Auxiliary Building, Sht. 1, Rev. 15
CAR-2166-341, Reactor Auxiliary Building Lighting, Sht. 1, Rev. 5
CAR-2166-342, Reactor Auxiliary Building Lighting, Sht. 2, Rev. 6
CAR-2166-345, Reactor Auxiliary Building Lighting, Sht. 1, Rev. 9
CAR-2166-401/2581, Control Wiring Diagram, Motor Driven Fire Pump, Rev. 9
CAR-2166-401/2583, Control Wiring Diagram, Diesel Driven Fire Pump, Rev. 6
CAR-2166 B-401, Sheet 160, Pressurizer Power Relief Isolation Valve 1-8000A, Rev. 20
CAR-2166 B-401, Sheet 161, Pressurizer Power Relief Isolation Valve 1-8000B, Rev. 19
CAR-2166 B-401, Sheet 1922, Auxiliary Feedwater Pump 1B-SB (MD), Rev. 11
CAR-2166 B-401, Sheet 1921, Auxiliary Feedwater Pump 1A-SA (MD), Rev. 10
CAR-2166 B-401, Sheet 1978, Auxiliary Feedwater Turbine Governor System 1X-SB, Rev. 7
CAR-2166 B-401, Sheet 419, Containment Sump to RHR 1-8812B (1SI-311), Rev. 22
CAR-2166 B-401, Sheet 418, Containment Sump to RHR 1-8812A (1SI-310), Rev. 20
CAR-2166 SK-E-542S08, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.2
CAR-2166 SK-E-542S09, Sheet 2, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.3
CAR-2166 SK-E-542S10, Sheet 3, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], El 236.0, REV.2
CAR-2166 SK-E-S11, Sheet 4, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.2
CAR-2166 SK-E-542S12, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.4
CAR-2166 SK-E-542S13, Sheet 2, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.3
CAR-2166 SK-E-542S14, Sheet 3, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.3
CAR-2166 SK-E-542S15, Sheet 4, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.3
Attachment 1
5
CAR-2166 SK-E-542S16, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.4
CAR-2166 SK-E-542S18A, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.4
CAR-2166 SK-E-542S18B, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.4
CAR-2166 SK-E-542S23, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.3
CAR-2166 SK-E-542S16, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.2
CAR-2166 SK-E-542S17, Sheet 2, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.5
CAR-2166 SK-E-542S18A, Sheet 3A, Reactor Auxiliary Building SSD Analysis [Tray and
Conduit Plan], Unit 1, REV.5
CAR-2166 SK-E-542S18B, Sheet 3B, Reactor Auxiliary Building SSD Analysis [Tray and
Conduit Plan], Unit 1, REV.3
CAR-2166 SK-E-542S20, Sheet 1, Reactor Auxiliary Building SSD Analysis [Tray and Conduit
Plan], Unit 1, REV.3
CAR-2166 B-401, Sheet 959, RCP Thermal Barrier Containment Isolation Valve 1 -9483
(1CC-249), Rev. 18
CAR-2166 B-401, Sheet 962, RCP Thermal Barrier Containment Isolation Valve 1 -9484
(1CC-251), Rev. 16
CAR-2166 B-401, Sheet 947, RCP Thermal Barrier Isolation Valve 1 FCV-685 (1CC-252),
Rev. 14
CAR-2166 B-401, Sheet 956, RCP Component Cooling Water Supply Isolation Valve 1 -9480B
(1CC-208), Rev. 15
CAR-2166 B-401, Sheet 955, RCP Component Cooling Water Supply Isolation Valve 1 -9480A
(1CC-169), Rev. 14
CAR-2166 B-401, Sheet 245, Volume Control Tank Outlet Isolation Valve 1-LCV-115E
(1CS-166), Rev. 21
CAR-2166 B-401, Sheet 243, Volume Control Tank Outlet Isolation Valve 1-LCV-115C
(1CS-165), Rev. 20
CAR-2166 B-401, Sheet 297, Charging/Safety Injection Pump Discharge Header Isolation
Valve 1-8132A (1CS-219), Rev. 19
CAR-2166 B-401, Sheet 294, Charging/Safety Injection Pump Suction Header Isolation Valve
1-8130B (1CS-168), Rev. 18
CAR-2166 B-401, Sheet 299, Charging/Safety Injection Pump Discharge Header Isolation
Valve 1-8133A (1CS-218), Rev. 19
CAR-2166 B-401, Sheet 295, Charging/Safety Injection Pump Suction Header Isolation Valve
1-8131A (1CS-169), Rev. 19
CAR-2166 B-401, Sheet 270, Charging/Safety Injection Pumps Miniflow Isolation Valve 1-8106
(1CS-214) , Rev. 17
CAR-2166-G-037S01, One Line Wiring Diagram Bus 1-4A, Rev. 11
CAR-2168-G-506S01, HVAC - Reactor Auxiliary Building, Plan El. 261, Rev. 12
CAR-2168-G-506S01, HVAC - Reactor Auxiliary Building, Plan El. 286, Rev. 12
CAR-2168-G-517SO5, Air Flow Diagram, Rev. 17
CAR-2168-G-611, Plumbing and Drainage, Rev. 13
Attachment 1
6
CAR-2168-G-614SO1, Riser Diagram, Plumbing and Drainage, Rev. 4
CAR-SH-E-10B, Ebasco Specification 210-73, Motor Control Centers for Use in Central Power
Station- Class 1E, Rev. 13
CAR-SH-IN-24, Fire Protection Multi-cycle Deluge Valve System Logic, Rev. 10
CPL-2165-G1000S12, Sheet 2, SSD Flow Diagram Safety Injection System, Rev. 0
CPL-2165-G1000S13, Sheet 3, SSD Flow Diagram Safety Injection System, Rev. 0
CPL-2165-G1000S21, Sheet 3, SSD Component Cooling Water System, Rev. 0
CPL-2165-S - 1365, Simplified Flow Diagram for CVCS System, Rev. 17
CPL-2165-G1000S23, SSD HVAC Essential Services Chilled Water Condenser Flow Diagram
Unit, 1-SA, Div 1, Rev. 1
CPL-2165-G1000S26, SSD HVAC Essential Services Chilled Water Condenser Flow Diagram
Unit, 1-SB, Div 2, Rev. 1
CPL-2165-G1000S16, Sheet 3, SSD HVAC Essential Services Chilled Water Condenser Flow
Diagram Unit, 1-SA, Div 1, Rev. 1
FD-CAR-1.10(L) 3, Detector Locations - Reactor Auxiliary Building, Plan El. 261, Rev. 5
FD-CAR-1.10(L) 4, Detector Locations - Reactor Auxiliary Building, Plan El. 286, Rev. 6
APPLICABLE CODES AND STANDARDS
NFPA 10, Standard for the Installation of Portable Extinguishers, 1978 Edition
NFPA 13, Standard for the Installation of Sprinkler Systems, 1978 Edition
NFPA 14, Standard for the Installation of Standpipe and Hose Systems, 1976 Edition
NFPA 15, Standard for Water Spray Fixed Systems for Fire Protection, 1978 Edition.
NFPA 20, Standard for the Installation of Centrifugal Fire Pumps, 1972 Edition
NFPA 24, Outside Protection, 1977 Edition
NFPA 72D, Standard for the Installation, Maintenance and Use of Proprietary Signaling
Systems for Guard, Fire Alarm, and Supervisory Service, 1975 Edition.
NFPA 72E, Automatic Fire Detectors, 1978 Edition.
NFPA 80A, Standard on Fire Doors and Windows, 1970 Edition.
NFPA 90A, Standard on Air Conditioning and Ventilating Systems, 1979 Edition.
NFPA 101, Life Safety Code, 1976 Edition
NUREG-1552, Supplement 1, Fire Barrier Penetration Seals in Nuclear Power Plants, dated
January 1999
OSHA 29 CFR Part 1910.36
Underwriters Laboratory, Fire Resistance Directory, dated January 1998
OTHER DOCUMENTS
EC-50147, Fire Protection System Pressure Changes, Rev.0
Ebasco Services Inc., Cable and Raceway System Reports
Ebasco Specification 210-73, Motor Control Centers for use in Central Power Station - Class
1E, Rev.13
Fire Brigade Lesson Plan HO-LP-12.6-22, Placing a Hose Rack in Operation, Rev 3
Fire Pre-Plan A19-5-261-0602, RAB Fire Zone 1-A-4-CHLR, Rev.3
Fire Pre-Plan A22-5-261-0606, RAB Fire Zone 1-A-4-COME, Rev.3
Fire Pre-Plan A27-5-261-0614, RAB Fire Zone 1-A-EPA, Rev.3
Fire Pre-Plan A38-6-286-0647, RAB Fire Zone 1-A-BATB, Rev.3
Attachment 1
7
Fire Pre-Plan T05-10-821-06682, Turbine Building Fire Zone 1-G-286, Rev.1
FP-941, Field Change, Location of Cable Tray Fire Breaks, Rev. 1
Transient Combustible Permit Logs (FPP-004) for the period 2001-2002
Fire Brigade Drill Logs (FNP-0-AP-27) for operating shifts for the period 2001-2002
Fire Brigade Shift Schedule and Training Matrix for November 9, 2002
UFSAR Figures 9.5A-8 and 9.5A-9, Fire Protection-Reactor Auxiliary Bldg.
PA System Engineering Status Review, dated April 11, 2002
Fire Protection System Engineering Status Review, dated September 11, 2002
Fire Detection System Engineering Status Review, dated September 11, 2002
Fire Protection Out of Service Log, for the period 2000-2002, dated October 7, 2002
Gould Shawmut Publication T-3889, Fuse Selectivity Ratios for 250 V Applications Up To
200,000 RMS SYM Amperes
Letter from P Gaffney, Ebasco, to W. Helms, CP&L, on the subject of 6.9 kV Grounding, dated
January 16, 1991
TECHNICAL MANUALS/VENDOR INFORMATION
Akron Brass Company, Turbojet Fire Hose Nozzle Model 1720, dated October 16, 2002
Angus Industrial Fire Hose Products, Red Chief-Lightweight Attack Hose, dated
October 16, 2002
C&D Technologies, Battery Model LCR-19, dated November 1, 2002
Data Sheet J 2.5, Model F Sprinklers, Automatic Sprinkler Corporation
Data Sheet NC48-194, Rate Compensated Thermal Detector, Johnson Controls Inc.
ID-PQL, Gould Technologies Vendor Manual, 8/27/85
AR REPORTS, AUDITS, AND SELF ASSESSMENTS REVIEWED
AR 02956, Evaluate NRC IN 99-07
AR 25032, NFPA 14 Code Deviations
AR 71908, OSHA Emergency Lights for Personnel Evacuation Failed to Function
AR 73540, Safe Shutdown Program Self-Assessment
AR 73607, Safe Shutdown Program Self-Assessment
AR 73719, Safe Shutdown Program Self-Assessment
Assessment 023155, Fire Protection Program, performed during 9/11/00 - 9/21/00
Assessment 056309, Safe Shutdown in Case of Fire Program, performed during 9/23/02 -
9/25/02
Assessment 056314, Fire Protection Program, performed during 03/02-08/02
Assessment 067063, Fire Brigade Training Program, performed during 07/29/02 - 08/02/02
Assessment ENG 99-022, Fire Protection Safe Shutdown Program, performed during 10/04/99
- 10/08/99
Assessment H-FP-99-01, Harris Fire Protection, performed during 12/06/99 - 12/17/99
Assessment H-FP-00-01, Fire Protection, performed during 10/16/00 - 10/27/00
Assessment H-FP-01-01, Fire Protection, performed during 08/06/01 - 08/16/01
Assessment H-FP-02-01, Fire Protection, performed during 08/12/02 - 08/16/02
Attachment 1
8
CORRECTIVE ACTION PROGRAM ACTION REQUEST REPORTS GENERATED AS A
RESULT OF THIS INSPECTION
AR 75065, Discrepancy Between SSA and AOP-36 Regarding Actions to Take in the Event
That Boric Acid Tank Level Indication is Lost due to a Fire
AR 75258, AOP-36 Incorrectly Directs Operators to Use the B Chiller During a Fire at the B
Chiller.
AR 75337, AOP-36 Incorrectly Lists the Location of the Starter for MOV 1CS-218 as MCC
1B35-SB. The Starter for 1CS-218 is in MCC 1B35-SA.
AR 75339, Fire In The Turbine Building Can Cause Loss Of Both Fire Pumps
AR 76260, Fire in MCC 1B35-SB Could Cause Spurious Closure of 1CS-166 or 1CS-168 Which
Would Isolate the A CSIP From its Suction Source. Also, Fire in MCC 1A35-SA Could
Cause Spurious Closure of 1CS-219 and Stop the Preferred Normal Charging Flow
Path. The SSA Does Not Include Analysis or Immediate Operator Actions to Prevent
These Conditions
AR 76405, Plant Modification ESR 01-00087, CSIP Recirc Flowpath Change, did not Recognize
that the SSA and AOP-36 Should have been Revised to Account for Potential Spurious
Closure of the VCT Outlet Valves, 1CS-165 and 1CS-166
AR 76584, P&ID Drawing for MCC 1B35-SB has Incorrect Descriptions for Two Breakers
AR 76621, Fire Hose Nozzles Used In The Plant Are Not Approved For Energized Electrical
Equipment And Do Not Match The FSAR Description
AR 76623, Evaluate Transient Combustible Load Allowance For Fire Zones Not Surrounded By
AR 76626, Evaluate Loss Of PA, Radio Communications, and Fire Detection Systems In The
Communications Room
AR 76632, NRC FP Walkdown Observations - No Battery-Backed Lighting for 1CS-214 Manual
Actions and Three of Four Normal Lights Out; also the SSD AO is Not Assigned a Portable
Radio for Communications Use in the Event of a Fire
AR 76993, Review NLO Training on AOP-36
AR 77527, A Review of the ARs Initiated as a Result of the 2002 SSD Self-Assessment and the
NRC Triennial FP Inspection Indicates a Trend Concerning Inconsistencies Between the Safe
Shutdown Analysis and Implementing Procedure AOP-30
AR 79047, Additional Lighting Required for Performance of SSD Tasks
AR 79567, AOP-36 Walkthrough Validation Concern for MCC 1E12 Operator Actions that are
In the Fire Area
AR 79582, AOP-36 Walkthrough Validation Comments
AR 80045, Component Cooling Valves that Provide Seal Protection for Reactor Coolant Pumps
have Incorrect SSD Division Designator in the SSA (Calculation E-5524)
AR 80089, Valve 1CC-251, CCW to RCP Thermal Barriers, is powered from MCC 1B31-SB,
Which is Located in Fire Area 1-A-EPB and Unprotected From a Fire in That Area.
Consequently, the SSD Credited RCP Thermal Barrier Cooling Could Be Lost During a Fire in
1-A-EPB.
AR 80144, Need to Reword Steps in AOP-36
AR 80161, Review NRC IE Circular 77-03, Fire Inside a Motor Control Center
Attachment 1
LOCAL MANUAL OPERATOR ACTION STEPS
REVIEWED FOR ACHIEVING HOT STANDBY
Summary of Number of Local Manual Action Steps to be Performed Outside of the Control
Room to Achieve and Maintain Hot Standby
________Number of Manual Action Steps_______
Fire Area / Zone Generic Steps Area Specific Total Steps
in AOP-36 for Steps in AOP-036 by Fire
All Fire Areas and Other Area/Zone
Procedures
Referenced by
1-A-BAL-B 10 29 39
1-A-BATB 10 14 24
1-A-EPA 10 14 24
1-A-ACP 10 45 55
Listing of AOP-036 Manual Action Steps Reviewed for Safe Shutdown Following a Fire
AOP-36 Section 3.0 Actions (Generic Steps for All Fire Areas/Zones):
Step 12.c RNO MONITOR AFW pump suction pressure indicators as an alternative to CST
level indication: (Refer to Attachment 4, AFW Suction Pressure vs. CST
level)
PI-2271 (at TDAFW Pump)
Step 13.b(3) Locally PERFORM the following (248 RAB):
(a) SHUT 1CS-228, Normal Charging FCV Inlet Isolation Valve.
(b) THROTTLE 1CS-227, Normal Charging FCV Bypass, as necessary to
control charging flow.
Step 13.c RNO ESTABLISH flow through the Hi Head SI Line, as follows:
(1).....(MCR action)
(2).....(MCR action)
(3) OPEN ONE of the following breakers:
(4) WHEN directed by MCR, THEN locally THROTTLE the de-energized
valve to maintain PRZ level:
Attachment 2
2
1SI-3, BIT Outlet Isolation
1SI-4, BIT Outlet Isolation
Step14.b UNLOCK and SHUT the affected manual block valve(s): (Steam Tunnel
Platform El. 280)
1MS-59, SG A PORV Manual Block
1MS-61, SG B PORV Manual Block
1MS-63, SG C PORV Manual Block
AOP-36 Attachment 1 (Area Specific) Actions For Fire Area 1-A-BATB:
Step 1 IF RHR suction valves spuriously open resulting in RWST drain down,
THEN PERFORM the following recommended actions, as required:
Step 1.a ISOLATE the Containment Recirc Sumps from the RWST, as follows:
(1) SHUT the following valves:
1SI-322, RWST To RHR Pump A-SA (RAB 286)
1SI-323, RWST To RHR Pump B-SB (RAB 286)
(2) DE-ENERGIZE the following valves:
1SI-322 at breaker 1A31-SA-6E (RAB 286)
1SI-323 at breaker 1B31-SB-6E (RAB 286)
Step 1.b REFILL the RWST with A RHR Pump, as follows:
(1) SHUT 1SI-327, Low Head SI Train B to Hot Leg Crossover Isol Vlv.
(2) OPEN the following valves to align RHR HX outlet flow to the RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol Vlv
1SI-331, Low Head SI Recirc to RWST Isol Vlv
(3) USE the RHR Pump as needed.
Step 1.d WHEN RHR Pumps are no longer required to fill the RWST,
THEN:
(1) SHUT the following valves to isolate RHR HX outlet flow from the
RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol Vlv
1SI-331, Low Head SI Recirc to RWST Isol Vlv
(2) OPEN 1SI-327, Low Head SI Train B to Hot Leg Crossover Isol Vlv.
Step 2 PERFORM the following to prevent spurious valve opening:
Attachment 2
3
Step 2.a VERIFY the following valves are SHUT:
1SI-301, CV Sump 1B To RHR Pmp 1B-SB CIV (RAB 286)
1SI-311, CV Sump 1B To RHR Pmp 1B-SB Downstrm Iso Vlv
(RAB 286)
Step 2.b DE-ENERGIZE the following valves:
1SI-301 at breaker 1B21-SB-11B (RAB 286)
1SI-311 at breaker 1B21-SB-7A (RAB 286)
AOP-36 Attachment 1 (Area Specific) Actions For Fire Area 1-A-EPA:
Step 7 IF RHR suction valves spuriously open resulting in RWST drain down,
THEN PERFORM the following recommended actions, as required:
Step 7.a ISOLATE the Containment Recirc Sumps from the RWST, as follows:
(1) SHUT the following valves:
1SI-322, RWST To RHR Pump A-SA (RAB 286)
1SI-323, RWST To RHR Pump B-SB (RAB 286)
(2) DE-ENERGIZE the following valves:
1SI-322 at breaker 1A31-SA-6E (RAB 286)
1SI-323 at breaker 1B31-SB-6E (RAB 286)
Step 7.b REFILL the RWST with B RHR Pump, as follows:
(1) SHUT 1SI-326, Low Head SI Train A to Hot Leg Cross-over Isol Vlv.
(2) OPEN the following valves to align RHR HX outlet flow to the RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol Vlv
1SI-331, Low Head SI Recirc to RWST Isol Vlv
(3) USE the RHR Pump as needed.
Step 7.c IF charging is required in the interim,
THEN USE the Boric Acid Tanks.
Step 7.d WHEN RHR Pumps are no longer required to fill the RWST,
THEN:
(1) SHUT the following valves to isolate RHR HX outlet flow from the
RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol Vlv
1SI-331, Low Head SI Recirc to RWST Isol Vlv
(2) OPEN 1SI-326, Low Head SI Train A to Hot Leg Cross-over Isol Vlv.
Attachment 2
4
Step 8 PERFORM the following to prevent spurious valve opening:
Step 8.a VERIFY the following valves are SHUT:
1SI-300, CV Sump 1A To RHR Pmp 1A-SA CIV (RAB 286)
1SI-310, CV Sump 1A To RHR Pmp 1A-SA Downstrm Iso Vlv
(RAB 286)
Step 8.b DE-ENERGIZE the following valves:
1SI-300 at breaker 1A21-SA-7C (RAB 286)
1SI-310 at breaker 1A21-SA-9B (RAB 286)
AOP-36 Attachment 1 (Area Specific) Actions for Fire Area 1-A-BAL:
Step 1 PERFORM the following to prevent spurious valve operations:
Step 1.a VERIFY the following valves are OPEN
1CS-214, Charging/SI Pumps Miniflow Isol (RAB 236 near Boric Acid
Pumps)
1CS-169, CSIP Suction Header Xconn (RAB 247 above CSIPs)
1CS-218, CSIP Discharge Header Xconn (RAB 247 above CSIPs)
1CC-252, CCW From RCP Thermal Barrier FCV (RAB 236 Scalloped
Area)
Step 1.b DE-ENERGIZE the following valves:
1CS-214 at breaker 1A35-SA-4C (RAB 261)
1CS-169 at breaker 1A35-SA-4B (RAB 261)
1CS-218 at breaker 1B35-SB-14D (RAB 261)
1CC-252 at breaker 1E12-6B (RAB 261)
Step 5 CAUTION
The following step will inhibit all automatic and manual safeguards functions
since a fire in this area could cause spurious actuations as well as disable
controls for resetting SI.
Removal of Output Relay Power Fuses from both trains of SSPS will
generate a Reactor Trip signal. The Reactor should be shut down prior to
performing the following step.
Attachment 2
5
OBTAIN SSPS Key 96
AND DEFEAT both trains of SSPS by removing the listed fuses in the front of
the listed SSPS Output Cabinets:
Train A, Output Cabinet No. 1, Output Relay Power fuses
Train A, Output Cabinet No. 2, fuses 61 and 62
Train B, Output Cabinet No. 1, Output Relay Power fuses
Train B, Output Cabinet No. 2, fuses 61 and 62
Step 20 IF the following valves cannot be shut due to fire damage to their control
cables,
1CS-165, VCT Outlet/Dilution FCV (1-LCV-115C)
1CS-166, VCT Outlet (1-LCV-115E)
THEN:
Step 20.a STOP ALL CSIPs.
Step 20.b SHUT EITHER of the following valves:
1CS-170, A CSIP Suction X-conn
1CS-168, C CSIP Suction X-conn with A CSIP
Step 20.c SHUT EITHER of the following valves:
1CS-169, C CSIP Suction X-conn with B CSIP
1CS-171, B CSIP Suction X-conn
Step 20.d VERIFY SHUT 1CS-214, Charging/SI Pumps Miniflow Isol.
Step 21 IF BOTH of the following occur due to fire damage to their control cables:
1SW-270, ESW Header A Return to Aux Reservoir, spuriously SHUTS
1SW-276, ESW to NSW Discharge HDR, spuriously OPENS
THEN ALIGN flow to the cooling tower, as follows:
Step 21.a VERIFY OPEN 1SW-275, ESW Return Header A to NSW.
Step 21.b WHEN time permits,
THEN:
(1) DE-ENERGIZE 1SW-270, ESW Header A Return to Aux Reservoir, at
breaker 1A35-SA-9C (RAB 261).
(2) OPEN 1SW-270 locally (RAB 261).
(3) WHEN 1SW-270 is open,
THEN SHUT 1SW-276, ESW to NSW Discharge Hdr.
Attachment 2
6
Step 22 IF BOTH 1SW-270 AND 1SW-276 shut,
THEN CROSS-CONNECT ESW Discharge Headers as follows:
Step 22.a VERIFY OPEN 1SW-274, ESW Return Header B to NSW.
Step 22.b VERIFY OPEN 1SW-275, ESW Return Header A to NSW.
Step 22.c VERIFY OPEN 1SW-271, ESW Header B Return to Aux Reservoir.
Step 22.d WHEN time permits,
THEN:
(1) DE-ENERGIZE 1SW-270, ESW Header A Return to Aux Reservoir, at
breaker 1A35-SA-9C (RAB 261).
(2) OPEN 1SW-270 locally (RAB 261).
(3) WHEN 1SW-270 has been opened,
THEN SHUT 1SW-274, ESW Return Header B to NSW.
AOP-36 Attachment 1 (Area Specific) Actions for Fire Area 1-A-ACP:
Step 1b SECURE Rod Drive MG sets using OP-104, Rod Control System
Step Number Description
7.3.2.02 Place GENERATOR CIRCUIT BREAKER CONTROL
switch 1A to TRIP
7.3.2.03 Place MOTOR CIRCUIT BREAKER CONTROL switch 1A
to TRIP
7.3.2.04 Open Reactor Trip Breakers, if not already open.
7.3.2.05 Place GENERATOR CIRCUIT BREAKER CONTROL
switch 1B to TRIP
Place MOTOR CIRCUIT BREAKER CONTROL switch 1B
to TRIP
Step 2 If BOTH MDAFW pumps are disabled, THEN:
Attachment 2
7
Step 2c Obtain a transfer panel key 33, 34, 35, 36, 99 or 106 (MCR or ACP key
locker)...
... and de-energize the TDAFW Pump Trip and Throttle Valve by removing
fuses 1A-11/1976 and 1A-12/1976
Step 2d De-energize 1MS-70 by opening disconnect switch on DP-1A2-SA-2B.
Step 2f IF TDAFW Pump is NOT operating properly, THEN locally...
...VERIFY OPEN TDAFW Pump Trip and Throttle Valve
...VERIFY OPEN 1MS-70, Main Steam B to Aux FW Turbine
Step 2g IF MCB CST level indication is NOT available,
THEN locally monitor AFW pump suction pressure using Attachment 4.
Step 4 REMOVE the fuse for 1BD-30 SA at panel ARP-19A
REMOVE the fuse for 1BD-49 SA at panel ARP-19A
Step 6 OPEN the power supply breaker for 1CS-235 at breaker 1B31-SB-10A
Step 7 ISOLATE AND VENT IA to 1CH-279
Step 7a SHUT 1IA-871-I1"
Step 7b OPEN air filter drain petcocks on Instrument Air Filter
Step 7c CHECK 1CH-279, AH-12 1ASA valve OPEN
Step 8 OPEN the power supply breaker for 1CS-171 at breaker 1B35-SB-4D
Step 9 Locally VERIFY OPEN 1CS-171, B CSIP Suction X-Conn valve
Locally VERIFY OPEN 1CS-235, Charging Line Isolation valve
Step 10 Locally verify shut 1BD-30, SG 1B Blowdown Isolation valve
Locally verify shut 1BD-49, SG 1C Blowdown Isolation valve
Step 13 IF SG C PORV cycles erroneously, THEN:
Step 13c IF SG C PORV manual/automatic station does not function properly,
THEN locally OPERATE SG C PORV using OP-126 for desired cooldown
rate.
Step Number Description
8.2.1.2.01 Obtain pliers, flashlight, head set, extension cord
Attachment 2
8
8.2.1.2.02 Open Servo Valve Solenoid feeder breaker PP-1A312-SA-
3
Open Servo Valve Solenoid feeder breaker PP-1B312-SB-
3
Open Servo Valve Solenoid feeder breaker IDP-1A-SIII-11
8.2.1.2.03 Remove the cover from the side of the PORV
8.2.1.2.04 Establish communications with the Control Room
8.2.1.2.07 To throttle open the PORV,
8.2.1.2.07a Rotate Solenoid B manual override approximately 3/4 turn
in the clockwise direction
8.2.1.2.07b As directed by the Control Room, slowly rotate Solenoid A
manual override approximately 3/4 turn in the clockwise
direction
8.2.1.2.07c When the PORV is at its desired position, place Solenoid A
manual override back to its original position
8.2.1.2.08 To partially shut the PORV,
8.2.1.2.08a Check Solenoid A manual override in the fully
counterclockwise position.
8.2.1.2.08b As directed by the Control Room slowly rotate Solenoid B
manual override to its original position by rotating it
approximately 3/4 turn in the counterclockwise direction,
until the PORV starts to shut.
8.2.1.2.08c When the PORV is at the desired position, rotate Solenoid
B manual override approximately 3/4 turn in the clockwise
direction.
Step 14 IF FCV-2071C, Aux FW C Regulator 1AF-131, spuriously CLOSES, THEN
Step 14a REMOVE fuse 1A-5/1952 at Transfer Panel 1B
Step 14b THROTTLE 1AF-149, Stm Turb Aux FW C Isolation, to maintain SG C level
AOP-36 Attachment 2 Actions For SSD 1 Equipment Powered by SSD 2:
Step 2 IF control power is lost to 1CS-231, Charging Flow controller,
THEN PERFORM the following locally:
Attachment 2
9
Step 2.a SHUT 1CS-228, Normal Charging FCV Inlet Isolation Valve.
Step 2.b MAINTAIN 25% to 60% PRZ level (charging flow) using 1CS-227, Normal
Charging FCV Bypass.
AOP-36 Attachment 3 Actions For SSD 2 Equipment Powered by SSD 1:
This attachment was reviewed but contained no hot standby local manual
operator actions.
LOCAL MANUAL OPERATOR ACTION STEPS
REVIEWED FOR ACHIEVING COLD SHUTDOWN
AOP-36 Attachment 1 (Area Specific) Actions for Fire Area 1-A-EPA:
Step 4.b WHEN manpower is available,
THEN:
(1) DE-ENERGIZE the following valves:
1SI-246, SI Accumulator A Discharge, at breaker 1A21-SA-5C
1SI-248, SI Accumulator C Discharge, at breaker 1A21-SA-3D
Attachment 2, SSD 1 Equipment Powered by SSD 2:
Step 6 IF 1RH-30, RHR Heat Xchg A Out Flow Cont, OR 1RH-20, RHR Hx Xchg A
Byp Flow Cont, cannot be controlled due to loss of control power,
THEN:
Step 6.a ISOLATE 1RH-20 air supply, 1IA-128-I2, to cause it to fail closed.
Step 6.d VERIFY RHR is cooling the RCS by trending temperature using ONE of the
following methods:
.....(MCR action)
Local temperature indication TI-5551A (RHR Heat Exchanger Outlet)
Attachment 2
MANUAL ACTIONS DESCRIBED IN AOP-036
WITHOUT REQUIRED EMERGENCY LIGHTING
AOP-36, Section 3.0, for All Fire Areas
Step # Description
13.a(7) Open 1CS-526, BA Tk Supply to CSIP Isol. Vlv.
AOP-36, Attachment 1, for Fire Area 1-A-ACP
Step # Description
1.b Secure Rod Drive MG sets using OP-104, Rod Control System
2.c Obtain a transfer panel key 33, 34, 35, 36, 99 or 106 (MCR or ACP key
locker) and de-energize the TDAFW Pump Trip and Throttle Valve by
removing 2 fuses
2.d De-energize 1MS-70 by opening disconnect switch on DP-1A2-SA-2B.
2.f Locally verify open TDAFW Pump Trip and Throttle Valve and 1MS-70,
Main Steam B to Aux FW Turbine
2.g Locally monitor AFW pump suction pressure
4 Remove the fuses for 1BD-30 SA and 1BD-49 SA at panel ARP-19A
6 Open the power supply breaker for 1CS-235 at breaker 1B31-SB-10A
9 Locally verify open 1CS-235
14.a Remove fuse 1A-5/1952 at Transfer Panel 1B
AOP-36, Attachment 1, for Fire Area 1-A-BATB
Step # Description
1.b(1) Shut 1SI-327, Low Head SI Train B to Hot Leg Crossover Isol. Vlv.
1.d(2) Open 1SI-327, Low Head SI Train B to Hot Leg Crossover Isol. Vlv.
AOP-36, Attachment 1, for Fire Area 1-A-EPA
Step # Description
7.b(1) Shut 1SI-326, Low Head SI Train A to Hot Leg Crossover Isol. Vlv.
7.d(2) Open 1SI-326, Low Head SI Train A to Hot Leg Crossover Isol. Vlv.
Attachment 3
2
AOP-36, Attachment 1, for Fire Area 1-A-BAL SSA Area 1-A-BAL-B
Step # Description
21.b(2) Open 1SW-270 locally (RAB 261).
22.c Verify open 1SW-271, ESW Header B Return to Aux. Reservoir.
22.d(2) Open 1SW-270 locally (RAB 261). (Same as step 21.b(2) above but for
different plant conditions.)
MANUAL ACTIONS DESCRIBED IN AOP-036
WITHOUT REQUIRED BATTERY-BACKED EMERGENCY LIGHTING
BUT WITH DIESEL-POWERED FLOURESCENT LIGHTING
AOP-36, Section 3.0, for All Fire Areas
Step # Description
12.c Monitor AFW pump suction pressure indicators as an alternative to CST
RNO level indication: (Refer to Attachment 4, AFW Suction Pressure vs. CST
level)
- PI-2271 (at TDAFW Pump)
13.b(3) (a) Shut 1CS-228, Normal Charging FCV Inlet Isolation Valve.
(b) Throttle 1CS-227, Normal Charging FCV Bypass, as necessary to
control charging flow.
13.c (3) Open one of the following breakers:
RNO * 1B31-SB-4C, 1SI-3 BIT Outlet
- 1A31-SA-4C, 1SI-4 BIT Outlet
13.c When directed by MCR, then locally throttle the de-energized valve to
RNO maintain PRZ level:
- 1SI-3, BIT Outlet Isolation
- 1SI-4, BIT Outlet Isolation
AOP-36, Attachment 1, for Fire Area 1-A-ACP
Step # Description
1.b Secure rod drive MG sets using OP-104
2.c Obtain a transfer panel key 33, 34, 35, 36, 99 or 106 (MCR or ACP key
locker) and de-energize the TDAFW Pump Trip and Throttle Valve by
removing 2 fuses
Attachment 3
3
2.f Locally verify open TDAFW pump trip and throttle valve & 1MS-70
2.g Locally monitor AFW pump suction pressure
4 Remove the fuses for 1BD-30 SA and 1BD-49 SA at panel ARP-19A
AOP-36, Attachment 1, for Fire Area 1-A-BATB
Step # Description
1.a(2) (2) DE-ENERGIZE the following valves:
1SI-322 at breaker 1A31-SA-6E (RAB 286)
1SI-323 at breaker 1B31-SB-6E (RAB 286)
1.b(2) (2) OPEN the following valves to align RHR HX outlet flow to the RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol. Vlv
1SI-331, Low Head SI Recirc to RWST Isol. Vlv
1.d(1) (1) SHUT the following valves to isolate RHR HX outlet flow from the
RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol. Vlv
1SI-331, Low Head SI Recirc to RWST Isol. Vlv
AOP-36, Attachment 1, for Fire Area 1-A-EPA
Step # Description
4.b(1) DE-ENERGIZE the following valves:
1SI-246, SI Accumulator A Discharge, at breaker 1A21-SA-5C
1SI-248, SI Accumulator C Discharge, at breaker 1A21-SA-3D
7.a(2) (2) DE-ENERGIZE the following valves:
1SI-322 at breaker 1A31-SA-6E (RAB 286)
1SI-323 at breaker 1B31-SB-6E (RAB 286)
7.b(2) (2) OPEN the following valves to align RHR HX outlet flow to the RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol. Vlv
1SI-331, Low Head SI Recirc to RWST Isol. Vlv
7.d(1) (1) SHUT the following valves to isolate RHR HX outlet flow from the
RWST:
1SI-448, Low Head SI Recirc to RWST Root Isol. Vlv
1SI-331, Low Head SI Recirc to RWST Isol. Vlv
Attachment 3
4
AOP-36, Attachment 1, for Fire Area 1-A-BAL-B
Step # Description
1.a VERIFY the following valves are OPEN
1CS-214, Charging/SI Pumps Miniflow Isol. (RAB 236 near Boric Acid
Pumps)
1CS-169, CSIP Suction Header Xconn (RAB 247 above CSIPs)
1CS-218, CSIP Discharge Header Xconn (RAB 247 above CSIPs)
5 OBTAIN SSPS Key 96 AND DEFEAT both trains of SSPS by removing
the listed fuses in the front of the listed SSPS Output Cabinets:
Train A, Output Cabinet No. 1, Output Relay Power fuses
Train A, Output Cabinet No. 2, fuses 61 and 62
Train B, Output Cabinet No. 1, Output Relay Power fuses
Train B, Output Cabinet No. 2, fuses 61 and 62
16.b(1) DE-ENERGIZE the following valves:
1SI-246, SI Accumulator A Discharge, at breaker 1A21-SA-5C (RAB 286)
1SI-247, SI Accumulator B Discharge, at breaker 1B21-SB-5C (RAB 286)
1SI-248, SI Accumulator C Discharge, at breaker 1A21-SA-3D (RAB 286)
22.a VERIFY OPEN 1SW-274, ESW Return Header B to NSW.
22.d(3) WHEN 1SW-270 has been opened,
THEN SHUT 1SW-274, ESW Return Header B to NSW.
AOP-36, Attachment 2, Safe Shutdown 1 Equipment Powered by Safe Shutdown 2
Step # Description
2 IF control power is lost to 1CS-231, Charging Flow controller,
THEN PERFORM the following locally:
a. SHUT 1CS-228, Normal Charging FCV Inlet Isolation Valve.
b. MAINTAIN 25% to 60% PRZ level (charging flow) using 1CS-227, Normal
Charging FCV Bypass.
6.a ISOLATE 1RH-20 air supply, 1IA-128-I2, to cause it to fail closed.
6.d VERIFY RHR is cooling the RCS by trending temperature using ONE of
the following methods:
Local temperature indication TI-5551A (RHR Heat Exchanger Outlet)
Attachment 3
5
AOP-36, Attachment 3, Safe Shutdown 2 Equipment Powered by Safe Shutdown 1
Step # Description
4.b (1) OPEN feeder breaker 1A21-SA-5C, Accum 1A-SA Disch Iso (RAB
286).
(2) OPEN feeder breaker 1A21-SA-3D, Accum 1C-SA Disch Iso (RAB 286).
6.d VERIFY RHR is cooling the RCS by trending temperature using ONE of
the following methods:
Local temperature indication TI-5551A (RHR Heat Exchanger Outlet)
Attachment 3