ML060750294
| ML060750294 | |
| Person / Time | |
|---|---|
| Site: | Wolf Creek  |
| Issue date: | 12/29/2005 |
| From: | - No Known Affiliation |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| FOIA/PA-2006-0095 IR-05-004 | |
| Download: ML060750294 (7) | |
Text
-i9 I v b
SUMMARY
OF FINDINGS IR 500482/2005004; 10/24/05 - 12/29/05; Wolf Creek Nuclear Operating Corporation; Wolf Creek Generating Station; Fire Protection (Triennial)
The NRC conducted an inspection with a team of four regional inspectors and one contractor.
The inspection identified two apparent violations (AV), two Green noncited violations (NCV) and two unresolved items (URI). The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609 "Significance Determination Process" (SDP).
Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC described its program for overseeing the safe operation of commercial nuclear power reactors in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.
A. NRC-Identified and Self Revealing Findings Cornerstone: Mitigating Systems
- Green. The team identified a noncited violation (NCV) for failure to comply with Technical Specification (TS) 5.4, "Procedures", in that a procedure required for post-fire safe shutdown was found to be inadequate. Procedure OFN RP-014, "Hot Standby to Cold Shutdown from Outside the Control Room", was inadequate because it did not provide a method to provide sufficiently borated water to the reactor coolant system so that cold shutdown could be achieved and maintained within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after a control room fire. Procedure OFN RP-014 requires monitoring of the boron concentration in the reactor and, if necessary, starting the acid transfer pumps to draw borated Water from the boric acid tanks. However, this procedure did not include sufficient instructions for refilling and borating the Refueling Water Storage Tank for a potential loss of offsite power or fire inducted damage to circuits related to the pumps.
This finding is greater than minor because it impacted the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences (i.e.,
core damage). The inspectors evaluated the finding using MC 0609, Appendix F, and determined that it screens as very low safety significance (Green) because it is related to the ability to achieve and maintain cold shutdown. (Section 1R05.1.b.(1))
- TBD. The team identified an Apparent Violation (AV) of Wolf Creek License Condition 2.C. (5) (a) concerning an inadequate alternate shutdown analysis. The licensee's alternate shutdown analysis was inadequate in that it used acceptance criteria which were inconsistent with and less conservative than those required by the approved Fire Protection Program. The licensee developed Calculation Number AN-02-021, Revision 0, "OFN RP-017 "Control Room Evacuation" Consequence Evaluation", to demonstrate alternative shutdown capability for W01olf Creek in response to NRC identified noncited violation 200208-01, Inadequate alternative shutdown procedure. The licensee used no fuel damage as an acceptance criteria. The calculation predicted that during an alternative shutdown, the reactor coolant system subcooling margin would not maintained, significant voiding would occur in the core, and a steam void would form in Intorinatio:n in this record was; deleted Enclosure in accordance with the Freedom of Information At,exemptions EOIA- `'--0 2S
' G
the reactor vessel head. The licensee found the results of the calculation to be acceptable since it demonstrated that the void formation would be limited, natural circulation in the reactor coolant system would be maintained, sufficient decay heat removal would be maintained, and no fuel damage would occur. This is not consistent with the license condition to meet the technical requirements of 10 CFR Part 50, Appendix R.Section II.L of 10 CFR Part 50 Appendix R, "Alternative and dedicated shutdown capability", states in part, "During the postfire shutdown, the reactor process variables shall be maintained within those predicted for a loss of normal a.c. power".
This finding is greater than minor because it impacted the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences (i.e.,
core damage). The licensee considers the spurious operation of multiple components to be outside of the plant licensing basis for the Fire Protection Program. Specifically, in this case, both pressurizer power-operated relief valves are assumed to spuriously open due to fire induced circuit damage. It is the NRC's understanding that the licensee does not consider these circuit vulnerabilities to be violations of NRC requirements. The NRC staff and the industry are currently working on developing a resolution methodology to address these types of potential fire-inducted circuit failures. The team concluded that this violation meets the criteria of the NRC Enforcement Manual Section 8.1.7.1 for deferring enforcement actions for postulated fire induced circuit failures. (Section 1R05.1 .b.(2))
Green. The team identified a noncited violation of License Condition 2.C.(5), Fire Protection (Section 9.5.1, SER, Section 9.5.1.8, SSER #5), for failure to ensure that redundant trains of safe shutdown systems in the same fire area were free of fire damage. The licensee credited manual actions to mitigate the effects of fire damage in lieu of providing the physical protection required by 10 CFR Part 50, Appendix R, Section III.G.2.
SNUPPS FSAR Appendix 9.5E provided the design comparison between the plant's fire protection program and 10 CFR 50, Appendix R. The comparison to Section III.G, Fire Protection of Safe Shutdown Capability, states, "Redundant trains of systems required to achieve and maintain hot standby are separated by 3-hour-rated fire barriers, or the equivalent provided by III.G.2, or else a diverse means of providing the safe shutdown capabilitv exists that is unaffected by the fire." Wolf Creek has interpreted "diverse means" to mean by any reasonable means including local valve and breaker operations as long as they are within the scope of normal operator duties. The team disagrees with this interpretation. The NRC staff does not recognize the use of manual actions as meeting the technical requirements of Appendix R,Section III.G.2. The components being operated are identified as required for operation of safe shutdown systems or are subject to potential spurious operation impacting the shutdown. The local manual actions are being performed due to fire damage to electrical cables related to those components and are meant to compensate for damage or maloperation of safe shutdown equipment caused by fire.
Enclosure
This finding is greater than minor because it impacted the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences (i.e.,
core damage). The team found that the manual operator actions implemented to mitigate the effects of fire damage were reasonable (as defined in Enclosure 2 of NRC Inspection Procedure 71111 .05T, "Fire Protection (Triennial)"), and could be performed within the analyzed time limits. Therefore, in accordance with Enclosure 2 of NRC Inspection Procedure 71111 .05T, the finding was determined to be of very low safety significance (green), and the significance determination process was not entered.
(Section 1R05.2)
TBD. The team identified an Apparent Violation (AV) of Technical Specification 5.4, Procedures, clue to an inadequate alternate shutdown procedure which is required fo implementation of the Fire Protection Program. The team found that some time critical actions required to safely shutdown the plant following a control room fire could not be accomplished within the requied time periods. Specifically, the licensee's procedure meets the recommendations by Westinghouse Owners Group for assuring RCP seal reliability and avoiding component cooling water thermal barrier water hammer concerns based on a time line assuming operators only have to respond to one spurious operation from the fire-induced damage during the scenario. The team disagrees which this limitation of potential spurious operations.
This finding is greater than minor because it impacted the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences (i.e.,
core damage). The licensee considers the spurious operation of multiple components to be outside of the plant licensing basis for the Fire Protection Program. It is the NRC's understanding that the licensee does not consider these circuit vulnerabilities to be violations of NRC requirements. The NRC staff and the industry are currently working on developing a resolution methodology to address these types of potential fire-inducted circuit failures. The team concluded that this violation meets the criteria of the NRC Enforcement Manual Section 8.1.7.1 for deferring enforcement actions for postulated fire induced circuit failures. (Section 1R05.6.b.(2))
B. Licensee-identified Violations None Enclosure
I S
.2 Protection of Safe Shutdown Capabilities
- a. Inspection Scope The team reviewed the licensee's piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify whether the licensee's shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the fire areas selected for review. The team also reviewed and observed walkdowns of the licensee's procedures for achieving and maintaining safe shutdown in the event of a fire to verify that the safe shutdown analysis provisions were properly implemented. The team focused on the following functions that must be ensured to achieve and maintain post-fire safe shutdown conditions: (1) reactivity control capable of achieving and maintaining cold shutdown reactivity conditions, (2) reactor coolant makeup capable of maintaining the reactor coolant level within the level indication in the pressurizer, (3) reactor heat removal capable of achieving and maintaining decay heat removal, (4) supporting systems capable of providing all other services necessary to permit extended operation of equipment necessary to achieving and maintaining hot shutdown conditions, and (5) process monitoring capable of providing direct readings to perform and control the above functions.
The team reviewed the separation of safe shutdown cables, equipment, and components within the same fire areas, and reviewed the licensee's methodology for meeting the requirements of 10 CFR 50.48, Appendix A to Branch Technical Position 9.5-1 and 10 CFR Part 50, Appendix R, Section III.G. Specifically, this was to determine whether at least one post-fire safe shutdown success path was free of fire damage in the event of a fire in the selected areas. The evaluation focused on the cabling of selected components for the chemical and volume control system, high pressure safely injection system, and the auxiliary feedwater system. A sample of components was selected whose inadvertent operation could significantly affect the shutdown capability credited in the licensee's safe shutdown analysis. The specific components selected are listed in the attachment. In addition, the team reviewed license documentation, such as NRC safety evaluation reports, the Wolf Creek Updated Final Safety Analysis Report, submittals made to the NRC by the licensee in support of the NRC's review of their fire protection program, and deviations from NRC regulations to verify that the licensee met license commitments.
- b. Findings
Introduction:
The team identified a noncited violation of License Condition 2.C.(5), Fire Protection (Section 9.5.1, SER, Section 9.5.1.8, SSER #5), for failure to ensure that redundant trains of safe shutdown systems in the same fire area were free of fire damage. The licensee credited manual actions to mitigate the effects of fire damage in lieu of providing the physical protection required by 10 CFR Part 50, Appendix R, Section III.G.2. The team determined that the violation was of very low safety significance (green).
Enclosure
Description. Wolf Creek License Condition 2.C. (5) (a) states "The Operating Corporation shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek site addendum through Revision 15, and as approved in the SER through Supplement 5, subject to provisions b & c below." SER Section 9.5.1.7, Appendix R Statement, states "The staff will condition the operating license to require the applicant to meet the technical requirements fo Appendix R to 10 CFR 50, or provide equivalent protection."Section III.G.2 of 10 CFR 50, Appendix R, describes three acceptable methods for protecting at least one safe shutdown train when redundant trains are located in the same fire area. The Section III.G.2 requirements are based on the combination of physical barriers, spacial separation, fire detection and automatic suppression systems.
SNUPPS FSAR Appendix 9.5E provided the design comparison between the plant's fire protection program and 10 CFR 50, Appendix R. The comparison to Section III.G, Fire Protection of Safe Shutdown Capability, states, "Redundant trains of systems required to achieve and maintain hot standby are separated by 3-hour-rated fire barriers, or the equivalent provided by III.G.2, or else a diverse means of providing the safe shutdown capability exists that is unaffected be the fire." Wolf Creek has interpreted "diverse means" to mean by any reasonable means including local valve and breaker operations as long as they are within the scope of normal operator duties. The team disagrees with this interpretation. The NRC staff does not recognize the use of manual actions as meeting the technical requirements of Appendix R. The components being operated are identified as required for operation of safe shutdown systems or are subject to potential spurious operation impacting the shutdown. The local manual actions are being performed due to fire damage to electrical cables related to those components and are meant to compensate for damage or maloperation of safe shutdown equipment caused by fire. Manual actions are not a method of satisfying Appendix R,Section III.G.2 requirements. Plant specific manual actions may be acceptable based on detailed specific exemptions or deviations for each case identified.
Analysis. This finding is of greater than minor safety significance because it impacted the mitigating systems cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences. The team reviewed Procedure OFN KC-016, "Fire Response" and stepped through the manual actions directed in the procedure with licensee operations personnel. The team found that the manual operator actions were reasonable (as defined in Enclosure 2 of Inspection Procedure 71111 .05T), and could be performed within the analyzed time limits. Since the manual operator actions was considered reasonable, the significance determination process was not entered. The team determined that this finding is of very low safety significance (green) in accordance with the guidance in Enclosure 2 to Inspection Procedure 71111 .05T.
Enforcement. The licensee's Fire Hazard Analysis states that it will comply with the technical requirements of Appendix R or utilize a diverse means to do so. Appendix R,Section III.G.2 to 10 CFR Part 50 requires that cables whose fire damage could prevent the operation or cause maloperation of safe shutdown functions be physically protected Enclosure
from fire damage. Contrary to this requirement, the licensee implemented a methodology that utilized manual operator actions as a diverse means to mitigate the effects of fire damage in lieu of providing physical protection from fire damage. This is a violation of Wolf Creek License Condition 2.C. (5) (a) for failing to meet the technical requirements of 10 CFR 50, Appendix R, as required by SER Section 9.5.1.7. Because this finding is of very low safety significance, this violation is being treated as a noncited violation, consistent with Section VL.A of the NRC Enforcement Policy: NCV 05000482/2005008-03, Failure to Ensure Redundant Safe Shutdown Systems Located In the Same F:ire Area Are Free of Fire Damage.
.3 Passive Fire Protection
- a. Inspection Scope For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, fire doors, electrical raceway fire barriers and fire rated electrical cables. The team observed the material condition and configuration of the installed barriers, seals, doors, and cables. The team compared the as-installed configurations to the approved construction details and supporting fire tests. In addition, the team reviewed license documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Protection Association code to verify that fire protection features met license commitments.
- b. Findinas No findings of significance were identified.
.4 Active Fire Protection
- a. Inspection Scope For the selected fire areas, the team evaluated the adequacy of fire suppression and detection systems. The team observed the material condition and configuration of the installed fire detection and suppression systems. The team reviewed design documents and supporting calculations. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations and the National Fire Prctection Association codes to verify that fire suppression and detection systems met license commitments.
The team also observed an announced site fire brigade drill and the subsequent drill critique using the guidance in Inspection Procedure 71111.05AQ. Team members observed the fire brigade simulate fire fighting activities in plant Fire Area T-4 (Lube Oil Storage Room). The inspectors verified that the licensee staff identified deficiencies, openly discussed them in a self-critical manner at the drill debrief, and took appropriate corrective actions. Specific attributes evaluated were: (1) proper wearing of turnout gear and self-contained breathing apparatus; (2) proper use and layout of fire hoses; (3) employment of appropriate fire fighting techniques; (4) sufficient fire fighting equipment Enclosure
c ITEMS OPENED AND CLOSED Opened 05000482/2005008-02 AV Failure to Maintain Reactor Coolant System Subcooling During the Alternate Shutdown (1R05.1.b(2))05000482/2005008-04 URI Lack of Evaluations of Changes to The Approved Fire Protection Program (1R05.6.b(1))05000482/2005008-05 AV Inadequate Alternative Shutdown Procedure (1RC)5.6.b(2))05000482/2005008-06 URI Failure to Adequately Evaluate Fire Protection Program Deficiencies (40A2)
Opened and Closed 05000482/2005008-01 NCV Failure to Provide Adequate Post-Fire Shutdown Procedures (1R05.1.b(1))05000482/2005008-03 NCV Failure to Ensure Redundant Safe Shutdown Systems Located In the Same Fire Area Are Free of Fire Damage (1R05.2)
Closed None Discussed None A-2 Attachment