IR 05000313/2007006

IR 05000313-07-006; 05000368-07-006; on 9/24/2007 - 10/19/2007; Arkansas Nuclear One, Units 1 and 2: Triennial Fire Protection Inspection

ML073390373
Person / Time
Site:	Arkansas Nuclear
Issue date:	12/03/2007
From:	Laura Smith NRC/RGN-IV/DRS/EB2
To:	Mitchell T Entergy Operations
References
IR-07-006
Download: ML073390373 (41)

Text

ber 3, 2007

SUBJECT:

ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000313/2007006; 05000368/2007006 AND EXERCISE OF ENFORCEMENT DISCRETION

Dear Mr. Mitchell:

On September 24, through October 19, 2007, the U.S. Nuclear Regulatory Commission (NRC)

completed a triennial fire protection inspection at your Arkansas Nuclear One, Units 1 and 2.

The enclosed report documents the inspection findings which were discussed on October 19, 2007, with you and other members of your staff.

During this triennial fire protection inspection, the inspection team examined activities conducted under your license related to safety and compliance with the Commissions rules and regulations and the conditions of your license. The inspection consisted of selected examination of procedures and records, observations of activities and installed plant systems, and interviews with personnel.

During this inspection, there was one finding of very low safety significance. This finding involved a violation of NRC requirements. The violation is being treated as a noncited violation because it was of very low safety significance and was entered in your corrective action program consistent with Section VI.A of the Enforcement Policy. If you contest the violation or the significance of the violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U. S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U. S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas, 76011; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at Arkansas Nuclear One.

Entergy Operations, Inc. -2-In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Linda J. Smith, Chief Engineering Branch 2 Division of Reactor Safety Dockets: 50-313 50-368 Licenses: DPR-51 NPF-6

Enclosure:

NRC Inspection Report 05000313/2007006 and 05000368/2007006

REGION IV==

Docket Nos.: 50-313; 50-368 License Nos.: DPR-51; NPF-6 Report No.: 05000313/2007006 and 05000368/2007006 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Units 1 and 2 Location: Junction of Hwy. 64W and Hwy. 333 South Russellville, Arkansas Dates: September 24 through October 19, 2007 Inspectors: J. Mateychick, Senior Reactor Inspector G. Pick, Senior Reactor Inspector S. Alferink, Reactor Inspector R. Mullikin, Consultant Approved By: L. J. Smith, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000313/2007006; 05000368/2007006; 9/24/2007 - 10/19/2007; Arkansas Nuclear One,

Units 1 and 2: Triennial Fire Protection Inspection The report covered a two-week period of inspection by region-based specialist inspectors and a contractor. One Green finding was identified during this inspection. The significance of most findings is indicated by its color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, "Significance Determination Process" (SDP). Findings for which the SDP does not apply may be green or be assigned a severity level after NRC management review.

The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Arkansas Nuclear One, Units 1 and 2 formally committed to converting their Fire Protection Programs to comply with the requirements of 10 CFR Part 50.48.© and National Fire Protection Association Standard 805. This involves using a risk-informed methodology. Because the conversion and licensing process are expected to identify and address a variety of difficult issues that are normally the subject of triennial fire protection inspections, and because any findings in this area would have to be addressed under the new, rather than the existing, program, the NRC has adapted its inspection and enforcement of certain issues for plants in this situation. As a result, the scope of this inspection was modified, and some issues raised in this inspection are documented but subject to enforcement discretion.

Cornerstone: Mitigating Systems

Green.

The team identified a Green noncited violation of License Conditions 2.C.(8) for Unit 1 and 2.C.(3)(b) for Unit 2 for failure to implement and maintain in effect all provisions of the approved fire protection program.

Specifically, the licensee failed to maintain adequate fire brigade staffing during fire scenarios requiring an alternative shutdown of Unit 2 coincident with a remote shutdown of Unit 1. The licensee entered the failure to maintain adequate fire brigade staffing under all circumstances into their corrective action process for resolution.

The failure to implement and maintain in effect all provisions of the approved fire protection program by failing to maintain adequate fire brigade staffing was a performance deficiency. The finding was more than minor since it was associated with the Mitigating Systems Cornerstone attribute of protection from external factors and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The significance of the finding was assessed using Appendix M of Manual Chapter 0609, "Significance Determination Process Using Qualitative Criteria." This finding was determined to be of very low safety significance (Green) by management review due to the short duration of the violation. The cause of the finding is related to the cross-cutting element of human performance. (Section 1R05.6)

B. Licensee-Identified Findings None.

REPORT DETAILS

1R05 Fire Protection

The purpose of this inspection was to review the Arkansas Nuclear One, Units 1 and 2 fire protection programs for selected risk-significant fire areas. The inspection was performed in accordance with Inspection Procedure (IP) 71111.05TTP, "Fire Protection-NFPA 805 Transition Period (Triennial)," dated 05/09/06, for a plant in transition to National Fire Protection Association (NFPA) Standard 805, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants," 2001 Edition. The NRC reduced the scope of this inspection by not specifically targeting safe shutdown circuit configurations for inspection. Emphasis was placed on verification of the post-fire safe shutdown capability. The inspection was performed in accordance with the NRC regulatory oversight process using a risk-informed approach for selecting the fire areas and attributes to be inspected. The team used the Individual Plant Examination for External Events for Arkansas Nuclear One, Units 1 and 2, to choose risk-significant areas for detailed inspection and review.

Inspection Procedure 71111.05TTP, "Fire Protection-NFPA 805 Transition Period (Triennial)," requires selecting a minimum of three fire areas for review. The four fire zones in three fire areas within Unit 1 reviewed during this inspection were:

• Fire Area B-8 - Fire Zone 104-S (Electrical Equipment Room, El. 368)

• Fire Area B-8 - Fire Zone 105-T (Lower South Electrical Penetration Rm, El. 374-6)

• Fire Area C - Fire Zone 20-Y (Radwaste Processing Area, El. 335)

• Fire Area I - Fire Zone 99-M (North Switchgear Room)

For each of these fire areas, the inspection focused on fire protection features, systems and equipment necessary to achieve and maintain safe shutdown conditions, and licensing basis commitments.

Documents reviewed by the team are listed in the attachment.

.1 Shutdown From Outside Main Control Room

a. Inspection Scope

The team reviewed the functional requirements identified by the licensee as necessary for achieving and maintaining hot and cold shutdown conditions to ensure that at least one post-fire safe shutdown success path was available in the event of a fire in each of the selected areas where post-fire safe shutdown relies on shutdown from outside the control room. The team reviewed piping and instrumentation diagrams of systems credited in accomplishing safe shutdown functions to independently verify whether the licensees shutdown methodology properly identified the required components.

The team focused on the following functions that must be available to achieve and maintain safe shutdown conditions:

• Reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

• Reactor coolant makeup capable of maintaining the reactor coolant inventory,

• Reactor heat removal capable of achieving and maintaining decay heat removal,

• Supporting systems capable of providing other services necessary to permit extended operation of equipment necessary to achieve and maintain hot shutdown conditions,

• Ability to achieve and maintain safe shutdown conditions with or without off-site power.

A review was conducted to ensure that all required components in the selected systems were included in the licensees safe shutdown analysis. The team verified that hot and cold shutdowns can be achieved and maintained from areas outside the control room with or without the availability of offsite power for fires in areas where post-fire safe shutdown relies on shutdown from outside the control room.

b. Findings

No findings of significance were identified.

.2 Protection of Safe Shutdown Capabilities

a. Inspection Scope

For the selected fire areas/zones, the team evaluated the potential for fires, the combustible fire load characteristics, potential exposure fire severity, and the separation of systems necessary to achieve and maintain safe shutdown.

In accordance with IP 71111.05TTP, "Fire Protection (Triennial)," dated May 9, 2006, for a plant in transition to NFPA Standard 805, the NRC reduced the scope of this inspection by only targeting safe shutdown circuit configurations for which the licensee has completed their NFPA 805 assessment. Since the licensee has not completed their NFPA 805 assessment for any fire area, there was no additional inspection of circuits performed.

b. Findings

No findings of significance were identified.

.3 Passive Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, and fire doors. The team observed the material condition and

configuration of the installed barriers, seals, and doors. The team compared the as-installed configurations to the approved construction details. In addition, the team reviewed license documentation, such as NRC safety evaluation reports, and deviations from NRC regulations to verify that fire protection features met license commitments.

b. Findings

No findings of significance were identified.

.4 Active Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire suppression and detection systems. The team observed the material condition and configuration of the installed fire detection and suppression systems. The team reviewed design documents and supporting calculations. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and deviations from NRC regulations to verify that fire suppression and detection systems met license commitments.

The team also observed an announced site fire brigade drill and the subsequent drill critique using the guidance in IP 71111.05AQ. Team members observed the fire brigade simulate fire fighting activities at the lube oil storage house. The team verified that the licensee staff identified deficiencies, openly discussed them in a self-critical manner at the drill debrief, and took appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient fire fighting equipment brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) utilization of pre-planned strategies;

(7) adherence to the pre-planned drill scenario; and

(8) drill objectives.

b. Findings

No findings of significance were identified.

.5 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

For the sample areas, the team verified that redundant trains of systems required for hot shutdowns were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems including the effects of flooding.

b. Findings

No findings of significance were identified.

.6 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the licensee's alternative shutdown methodology to determine if the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions from alternative shutdown locations in the event of a fire in the control room requiring control room evacuation. The team focused on the adequacy of the systems selected for reactivity control, reactor coolant makeup, reactor heat removal, process monitoring, and support system functions. The team verified that hot and cold shutdowns from outside the control room could be achieved and maintained with offsite power available or not available.

The team verified the training program for licensed and non-licensed personnel included alternative or dedicated safe shutdown capability. The team also verified that personnel required to achieve and maintain the plant in hot shutdown following a fire using the alternative shutdown system are properly trained and are available at all times from normal onsite staff, exclusive of the fire brigade.

The team reviewed the operational implementation of the licensees alternative shutdown methodology. Team members observed a timed walk-through of the Unit 2 alternative shutdown procedure with licensed and non-licensed operators. The team observed operators simulate performing the steps of Procedure 2203.014, "Alternate Shutdown," Revision 19, which provided instructions for performing an alternative shutdown by manipulating equipment in the plant. The team verified that the minimum number of available operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable plant shutdown time requirements and that equipment labeling was consistent with the procedure. The team also verified that procedures, tools, dosimetry, keys, lighting, and communications equipment remained available and adequate to support successfully performing the procedure as intended.

The team reviewed the time-critical manual actions identified by the licensee as being necessary to support alternative shutdown from outside the control room, including the calculations and analyses that provided the bases for these critical times. The simulated completion times recorded during the procedure walk-through were compared to the analytical values to verify that the procedure could be implemented as intended.

The team verified that the licensee conducted periodic operational tests of the alternative shutdown transfer capability and instrumentation and control functions, and the tests were adequate to prove the functionality of the alternative shutdown capability.

b. Findings

Introduction.

The team identified a Green noncited violation of License Conditions 2.C.(8) for Unit 1 and 2.C.(3)(b) for Unit 2 for failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to maintain adequate fire brigade staffing during fire scenarios requiring an alternative shutdown of Unit 2 coincident with a remote shutdown of Unit 1.

Description.

Calculation 85-E-0086-02, "Manual Action Feasibility and Common Results," Revision 1 and Procedure 1015.007, "Fire Brigade Organization and Responsibilities," Revision 16, provide the general philosophy for responding to fires that require an evacuation of the Unit 2 control room. The philosophy provides four operations personnel, two from Unit 1 and two from Unit 2, and one security guard to participate on the fire brigade. During the scenario involving an alternative shutdown of Unit 2 coincident with a remote shutdown of Unit 1, Calculation 85-E-0086-02 specifies that the waste control operator and outside auxiliary operator from Unit 2 will participate on the fire brigade while the remaining Unit 2 operators implement Procedure 2203.014.

Similarly, this calculation specifies that the waste control operator and inside auxiliary operator - equipment operator from Unit 1 will participate on the fire brigade while the remaining Unit 1 operators implement Procedure 1203.029, "Remote Shutdown."

On September 20, 2007, the licensee modified Procedure 2203.014 in order to increase efficiency and decrease the amount of time needed to perform certain time-critical actions. This revision, Revision 19, created a new position in the alternative shutdown procedure, the auxiliary operator, and assigned them the responsibility to open the service water sluice gate. The auxiliary operator position in the Unit 2 alternative shutdown procedure was assigned to the Unit 2 outside auxiliary operator. This prevented the Unit 2 outside auxiliary operator from participating on the fire brigade.

The Unit 2 alternative shutdown procedure revision was being worked in parallel with a planned revision to the Unit 1 remote shutdown procedure. The changes to the Unit 1 remote shutdown procedure freed one operator, the Unit 1 outside auxiliary operator, who would now perform the fire brigade duties previously assigned to the Unit 2 outside auxiliary operator. However, the Unit 1 remote shutdown procedure revision was not implemented when the Unit 2 alternative shutdown procedure revision went into effect.

When notified of the issue, the licensee implemented immediate corrective actions to expedite the revision to the Unit 1 remote shutdown procedure. The Unit 1 remote shutdown procedure was revised on October 5, 2007, which brought the fire protection program back into compliance. The licensee entered this issue into their corrective action program as Condition Report CR-ANO-C-2007-01564.

The team determined that the procedure writers for both units were aware that the two procedures needed to be issued concurrently. The licensee performed an apparent cause evaluation and determined the Unit 2 operations standards supervisor was aware of the need to issue the procedure revisions simultaneously, but became distracted and forgot the need while working on several other unrelated procedure changes. The evaluation determined that the apparent cause was a lack of a mechanism for tracking issuance of procedures that affect the other unit.

Analysis.

The failure to implement and maintain in effect all provisions of the approved fire protection program by failing to maintain adequate fire brigade staffing was a performance deficiency. The finding was more than minor since it was associated with the Mitigating Systems Cornerstone attribute of protection from external factors and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The Assumptions and Limitations section of the Fire Protection Significance Determination Process, inspection manual chapter IMC 0609, Appendix F, specifically excludes fire brigade issues. As such, IMC 0612, Section 05.04.c, requires NRC management review to determine the significance of this finding. NRC management determined this finding to be of very low safety significance (Green) due to the short duration of the violation.

The finding has a cross-cutting aspect in the area of human performance associated with resources because the licensee did not adequately ensure the procedures governing the procedure change process were complete and accurate (H.2.(c)).

Technical Specifications governing procedures, Technical Specifications 5.4.1 for Unit 1 and 6.4.1 for Unit 2, both state, in part:

Written procedures shall be established, implemented, and maintained covering the following activities: "Fire Protection Program implementation Since Unit 1 and 2 were supplied by different reactor vendors, procedures for each unit must address that units specific system configuration and are generally independent from the other unit. Procedure 1000.006, Procedure Control, does not have a formal mechanism for controlling cases where procedures for both units must be issued simultaneously in order to coordinate shared resources of equipment or personnel. This weakness in administration of plant procedures resulted in a human error in issuing Unit 1 and 2 procedure revisions at different times when they were intended to be issued concurrently due to units sharing personnel. This human performance concern has the potential to result in inadequate procedures in other areas not limited to the Fire Protection Program.

Enforcement.

Arkansas Nuclear One License Conditions 2.C.(8) for Unit 1 and 2.C.(3)(b) for Unit 2, "Fire Protection," require that Entergy Operations, Inc. "shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in Appendix 9A to the Safety Analysis Report and as approved in the Safety Evaluation dated March 31, 1992, subject to the following provision:...

(2) The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire."

Appendix 9A of the Safety Analysis Report states that the Arkansas Nuclear One Fire Protection Program is defined by Section 9.8 of the Safety Analysis Report for Unit 1 and Section 9.5 of the Safety Analysis Report for Unit 2. Section 9.8 of the Safety Analysis Report for Unit 1 and Section 9.5 of the Safety Analysis Report for Unit 2 state, in part, that the fire brigade is composed of five trained individuals.

Contrary to the above, from September 20, to October 5, 2007, the licensee failed to ensure that five members were available for the fire brigade. Specifically, the licensee failed to ensure that there were five members available for the fire brigade for fire scenarios requiring an alternative shutdown of Unit 2 coincident with a remote shutdown of Unit 1. The inability to maintain adequate staffing of the fire brigade is considered to adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

This issue does not qualify for enforcement discretion during the transition to NFPA 805 since the licensee failed to maintain the approved fire protection program, did not identify that a program deficiency had been created due to the licensees activities and, therefore, did not implement any compensatory measures. Because this finding is of very low safety significance and has been entered into the licensee's corrective action program under Condition Report CR-ANO-C-2007-01564, this violation is being treated as a noncited violation consistent with Section VI.A of the NRC Enforcement Policy:

NCV 05000313;05000368/2007006-01, Failure to Maintain Adequate Fire Brigade Staffing During Alternate Shutdown.

.7 Circuit Analyses

This segment is suspended for plants in transition to NFPA 805.

.8 Communications

a. Inspection Scope

The team evaluated the adequacy of the communication systems to support plant personnel in the performance of alternative safe shutdown functions and fire brigade duties. The team verified that the licensee established and maintained in working order the primary and backup communications systems specified in the fire hazards analysis.

Further, the team evaluated environmental impacts such as ambient noise levels, coverage patterns, and clarity of reception. The team reviewed the electrical power supplies and cable routing for these systems to verify that the radios would remain functional following a fire.

b. Findings

No findings of significance were identified.

.9 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting system required to support plant personnel in the performance of alternative safe shutdown functions to verify it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions are required. The team verified that the licensee installed emergency lights with an eight-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices. The team evaluated the locations and positioning of emergency lights during a walkthrough of the control room evacuation procedure.

b. Findings

Introduction.

The team identified an unresolved item associated with an apparent

excessive failure rate for the Appendix R emergency lighting system.

Discussion. The team reviewed the licensee's testing and maintenance procedures, completed test packages, and condition reports associated with the emergency light 8-hour discharge tests. The test and maintenance procedures specify that the emergency lights will be inspected, cleaned, and tested annually.

The testing and maintenance procedures require the licensee to measure the ambient air temperature near each battery annually. The expected life of an emergency light battery is strongly dependent on the operating temperature of the battery. As such, the ambient air temperature measurement allows the licensee to predict the end of life for each battery. In addition, the testing and maintenance procedures also provide the replacement strategy for the emergency light batteries. These procedures note that the batteries need to be replaced only if they have already past their projected end of life.

The procedures do not provide for a proactive replacement if the projected end of life occurs before the next scheduled test.

The team reviewed the information provided by the emergency light battery vendor. The vendor specifically noted that temperature has an adverse effect on the life of a battery.

Further, the vendor stated that temperature records shall be maintained by the user in accordance with the published maintenance schedule. The vendor recommended maintenance schedule indicated the minimum frequency for measuring ambient temperature was quarterly.

While performing the annual emergency light tests in December 2006, the licensee noted in Condition Reports CR-ANO-2-2006-02657 and CR-ANO-2-2006-02683 that approximately 50 emergency lights in Unit 2 required new batteries, lights, or charging cards. A preliminary review of the completed test packages could not determine how many of these issues would have prevented the emergency lights from meeting their eight-hour mission time. Additional detailed review of the data is needed to determine if these issues constitute failures to meet the requirements of 10 CFR Part 50, Appendix R, Section III. J.

The licensee corrected the problems immediately and entered the increasing failure trend in their corrective action program as Condition Report CR-ANO-C-2007-01646.

The licensee is evaluating past failure of all emergency lighting units. Further review is needed to determine if the failure rate is excessive. Additionally, further review is needed to determine if these failures were caused by inadequate preventive maintenance activities. Specifically, further review is needed to determine if the annual temperature measurement or battery replacement strategy contributed to the failures.

Analysis.

The team concluded that there are two issues to be resolved. One issue is the determination of the number of lighting issues that would have prevented the lights from meeting the eight-hour requirement of 10 CFR Part 50, Appendix R, Section III. J.

The second issue is the influence of the preventive maintenance activities on these failures. In particular, further review is needed to determine if the annual temperature measurement or battery replacement strategy led to an increased number of light failures.

Enforcement.

Additional information was needed to determine whether there was a violation of 10 CFR Part 50, Appendix R, Section III. J. Specifically, the concern was whether the apparent failures of emergency lights constituted a violation of 10 CFR Part 50, Appendix R, Section III. J.

Pending review of the additional analysis by the licensee, this issue is being treated as an unresolved item: URI 05000313; 368/2007006-02, Inadequate Preventive Maintenance Activities Result in Excessive Emergency Light Failures.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee has dedicated repair procedures, equipment, and materials to accomplish repairs of components required for cold shutdown that might be damaged, that these components can be made operable, and that cold shutdown can be achieved within time frames specified by Appendix R to 10 CFR Part 50. The team also verified that the repair equipment, components, tools, and materials (e.g., pre-cut cable connectors with prepared attachment lugs) are available and accessible on site.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

The team reviewed the licensees program with respect to compensatory measures in place for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems or features.

The team reviewed Procedure 1000.152, "Unit 1 & 2 Fire Protection System Specifications," and a sample of fire impairments to determine whether the procedures adequately controlled compensatory measures for fire protection systems, equipment and features (e.g., detection and suppression systems and equipment, and passive fire barriers).

The team reviewed Directive Number COPD024, "Risk Assessment Guidelines," to determine whether the procedures adequately controlled compensatory measures for out-of-service, degraded, or inoperable equipment that could affect post-fire safe shutdown equipment, systems or features.

b. Findings

No findings of significance were identified.

4OA

4OA2 Problem Identification and Resolution

a. Inspection Scope

The team verified that the licensee had identified issues related to this inspection area at an appropriate threshold and entered them in the corrective action program. For a sample of selected issues documented in the corrective action program, the team verified that the corrective actions were appropriate (refer to Inspection Procedure 71152, "Identification and Resolution of Problems" for additional guidance).

b. Findings

No findings of significance were identified.

4OA5 Other Activities

a. Inspection Scope

The team evaluated the following items to assess whether the licensee had corrected the deficiency or had included the item in the scope of their NFPA 805 evaluations. The team performed the inspection in this manner because Arkansas Nuclear One formally committed to converting their Fire Protection Program to comply with the requirements of 10 CFR 50.48©) prior to December 31, 2005. This conversion involved using a risk-informed methodology. The conversion and licensing processes are expected to identify and address a variety of difficult issues that are normally the subject of triennial fire protection inspections. Since any findings in this area will be addressed under the new, rather than the existing, program, the NRC has adapted its inspection and enforcement of certain issues for plants in this situation. The team evaluated any interim compensatory measures and, with the assistance of a senior reactor analyst, evaluated whether the licensee risk assessments satisfactorily demonstrated that the significance of the issues remained less than high safety significance (Red).

The team reviewed condition reports, design calculations, probabilistic risk evaluations, procedures and other plant documents. The team discussed the issues with fire protection engineers and licensee probabilistic safety assessment personnel. During the on-site portion of this inspection, the team confirmed information used and assumptions made during the evaluation.

.1 (Closed) Unresolved Item 05000313; 368/1998021-02: Potential for actuation of

high/low interface valves.

Introduction.

The team identified an apparent violation of License Conditions 2.c.(8)and 2.C.(3)(b) for Units 1 and 2, respectively, and 10 CFR Part 50, Appendix R, Section III. G.a for failure to evaluate the alternative shutdown capability for several groups of high/low interface valves. However, this violation will not be cited since the licensee met the Enforcement Policy criteria for enforcement discretion for a plant committed to adopting NFPA 805.

Discussion. While evaluating the alternative shutdown capability for both Units 1 and 2, the team questioned whether the licensee appropriately evaluated whether a fire in the

Unit 1 or Unit 2 control room or their respective cable spreading rooms could spuriously open redundant valves in any of several high/low pressure interface paths. Generic Letter 81-12, "Fire Protection Rule," provided guidance on implementing Section III. G. of Appendix R. The Licensee did not meet the guidance and failed to adequately protect high/low pressure interfaces from the effects of a fire in order to prevent a loss-of-coolant accident.

For Unit 1, the high/low interface valve combinations not evaluated included:

(1) pressurizer relief and pressurizer relief block valves;

(2) reactor vessel head, pressurizer and hot leg high point vent valves;

(3) reactor coolant system letdown flow valves; and

(4) reactor coolant system reactor coolant pump seal bleed-off valves.

For Unit 2, the high/low interface valve combinations not evaluated included:

(1) pressurizer emergency core cooling vent valves,

(2) low temperature overpressure protection relief isolation valves,

(3) reactor coolant letdown isolation valves, and

(4) reactor vessel head vent valves. The licensee initiated Condition Report C-1999-0045 to document its review of these high/low pressure interface issue examples identified in Sections 8.2, 8.3 and 8.5 of Inspection Report 05000313; 05000368/1998-021. As described in the inspection report, the licensee initiated hourly fire watches and modified procedures to increase the likelihood of preventing the high/low interface transient. In addition to both control rooms being continuously staffed, the control room cabinets containing the affected equipment had smoke detectors and alarms. Further, the cable spreading rooms had smoke detectors, line heat detectors in cable trays, and an open head automatic deluge system for all cable trays.

The inspector considered the interim actions acceptable to address the safety significance of this issue until the licensee completes their evaluation of these issues during their NFPA 805 conversion.

During this inspection, the team verified the following:

(1) the licensee continued the compensatory measures,

(2) the procedures continued to account for the high/low interface valves,

(3) for Unit 1 the risk of a hot short related to the electromagnetic relief valve resulting in core damage was bounding,

(4) for Unit 2 the risk of a hot short related to the emergency core cooling vent valves resulting in core damage was bounding,

(5) for both units the low temperature overpressure relief valves for both units are de-energized while at power, and

(6) Condition Report C-2006-0048 identified these high/low interface valve deficiencies as issues that required resolution during the NFPA 805 transition.

Analysis.

The performance deficiency associated with this finding involved the failure to have an adequate alternate safe shutdown analysis for a control room fire that affected several groups of high/low pressure interface valves. This finding is greater than minor because it is associated with Mitigating Systems cornerstone attribute of protection from external factors (fire) and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team assisted a senior reactor analyst in independently verifying that the risk

associated with these high/low pressure interface valves were less than high risk significance (Red). The simplified evaluation added:

(1) the probability of a fire initiating, affecting the valves, and requiring a control room evacuation;

(2) the probability of a fire initiating, affecting the valves, and not requiring a control room evacuation; and

(3) the impact of a cable spreading room fire initiating that affects the valves.

Unit 1 Unit 1 - Control Room Generic Fire Initiation Frequency per year (FIFCR) 1.00E-02 Probability of a fire in Cabinet C-04 (P1C04) 7.14E-02 Probability of a fire in Cabinet C-18 or C-30 (P2Cabinets) 1.43E-01 Generic Value related to probability of control room evacuation (Pw/evac) 1.80E-02 Control room non-suppression probability (Pw/o evac) 1.00E-01 CCDP SLOCA from the SPAR model 3.46E-02 Unit 1 - Cable Spreading Room Generic Fire Initiation Frequency - MC 0609, Appendix F per year (FIFCSR) 6.00E-03 Fire suppression value from Arkansas Nuclear One IPEEE (PSUP) 5.00E-02 Probability of de-energizing electromagnetic relief valve block valve (PERV) 2.10E-02 Bounding CCDP from licensee calculations 4.63E-01 Because the cable for the valves in Unit 1 is a two conductor cable the probability of a hot short affecting the valves was considered to be 1.0.

The frequency with which a control room fire in Cabinet 1C04 results in a hot short is:

FIFCR

• P1C04

• Photshort = 1E-02/yr

• 7.14E-02

• 1 = 7.14E-04/yr Determining the likelihood contributions from both evacuation and without evacuation:

With evacuation = Pw/evac

• 7.14E-04/yr = 1.80E-02

• 7.14E-04/yr = 1.29E-05/yr Without evacuation = Pw/o evac

• 7.14E-04/yr = 1.00E-01

• 7.14E-04/yr = 7.14E-05/yr Similarly, the likelihood contribution for a fire in Cabinets 1C18 or C30 from a hot short:

FIFCR

• P2Cabinets

• Photshort = 1E-02/yr

• 1.43E-01

• 1 = 1.43E-03/yr Determining the likelihood contributions from both evacuation and without evacuation:

With evacuation = Pw/evac

• 1.43E-03/yr = 1.80E-02

• 1.43E-03/yr = 2.57E-05/yr Without evacuation = Pw/o evac

• 1.43E-03/yr = 1.00E-01

• 1.43E-03/yr = 1.43E-04/yr The total likelihood of a main control room fire that requires evacuation and leads to core damage is the contribution of the core evacuation fire probabilities multiplied by 1.0:

1.29E-05/yr + 2.57E-05/yr = 3.86E-05/yr

• 1.0 = 3.86E-05/yr

The likelihood of a cable spreading room fire that affects the valves is as follows:

FIFCSR

• PSUP

• Photshort = 6.00E-03/yr

• 5.00E-02

• 1.0 = 3.00E-04/yr The likelihood contributions related to de-energizing the block valve multiplied by the conditional core damage probability is:

PERV

• 3.00E-04/yr

• CCDP = 2.10E-01

• 3.00E-04/yr

• 4.63E-01 = 2.92E-05/yr The total change in core damage frequency from a control room fire or a cable spreading room fire over any given year is:

3.86E-05 + 2.92E-05 = 6.78E-05 Unit 2 Unit 2 - Control Room Generic Fire Initiation Frequency per year (FIFCR) 1.00E-02 Probability of a fire in Cabinet C-09 (P2C09) one of thirteen 7.69E-02 Probability of hot short in multi-conductor cables (Photshort) 4.40E-01 Generic Value related to probability of control room evacuation (Pw/evac) 1.80E-02 Control room non-evacuation (i.e., non-suppression) probability (Pw/o evac) 1.00E-01 Unit 2 - Cable Spreading Room Generic Fire Initiation Frequency - MC 0609, Appendix F per year (FIFCSR) 6.00E-03 Fire suppression probability from Arkansas Nuclear One IPEEE (PSUP) 2.00E-02 Probability of de-energizing electromagnetic relief valve block valve (PERV) 2.10E-02 The frequency with which a control room fire in Cabinet 2C09 results in a hot short is:

FIFCR

• P2C09

• Photshort = 1E-02/yr

• 7.69E-02

• 4.4E-01 = 3.38E-04/yr Determining the likelihood contributions from both evacuation and without evacuation:

With evacuation = Pw/evac

• 3.38E-04/yr = 1.80E-02

• 3.38E-04/yr = 6.09E-05/yr Without evacuation = Pw/o evac

• 3.38E-04/yr = 1.00E-01

• 3.38E-04/yr = 3.38E-05/yr The likelihood that a cable spreading room fire that affects the valves and leads to core damage is as follows:

FIFCSR

• PSUP

• Photshort = 6.00E-03/yr

• 2.00E-02

• 4.40E-01 = 5.28E-05/yr The total frequency a control room fire with evacuation and a cable spreading room fire without suppression is:

6.096E-06/yr + 5.28E-05/yr = 5.89E-05/yr In summary, for either Unit 1 or Unit 2 the probability that a fire in the control room or cable spreading room affects the high/low interface valves in any given year and results

in core damage is less than high risk significance (Red).

Enforcement.

License Conditions 2.c.(8) and 2.C.(3)(b) for Units 1 and 2, respectively, specifies, "EOI shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in Appendix 9A to the SAR and as approved in the Safety Evaluation dated March 31, 1992." Further, as required by 10 CFR 50.48(b),

"With respect to all other fire protection features covered by Appendix R, all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III. G, III.J, and III. O." Section III. G.3.a specifies that aalternative or dedicated shutdown capability and its associated circuits in the area under consideration should be provided where the protection of systems whose function is required for hot shutdown does not satisfy the requirements of Section III.G.2.

Generic Letter 81-12, "Fire Protection Rule," provided guidance on implementing Section III. G. of 10 CFR Part 50 Appendix R. The licensee did not meet the guidance and failed to adequately protect high/low pressure interfaces from the effects of a fire in order to prevent a loss-of-coolant accident. Additionally, the NRC response to Generic Letter 86-10, "Implementation of Fire Protection Requirements," Question 5.3.10, specified that the safe shutdown capability in an alternative shutdown system should not be adversely affected by a fire in any plant area, which results in spurious actuation of the redundant valves in any high/low pressure interface line.

Contrary to the above, the licensee failed to provide alternative shutdown capability in the control room for circuits related to high/low interface valves as required specified by 10 CFR Part 50, Appendix R, Sections III. G and III. L. Specifically, the licensee failed to evaluate the impact of numerous pairs of high/low pressure interface valves and determine whether operators had time to respond or whether modifications would be required to correct the failure to adequately protect these valve combinations.

Because the licensee committed to adopting NFPA 805 and changing their fire protection program license basis to comply with 10 CFR 50.48©, this issue is covered by enforcement discretion in accordance with the NRC Enforcement Policy. Specifically, the licensee:

(1) would have identified and addressed this issue during the conversion to NFPA 805,

(2) had entered this issue into their corrective action program and implemented appropriate compensatory measures,

(3) demonstrated the finding would not be categorized under the Reactor Oversight Process as Red or a Severity Level I violation, and

(4) submitted their letter of intent prior to December 31, 2005. The inspector determined that this violation meets the criteria for enforcement discretion for plants in transition to a risk-informed, performance-based fire protection program as allowed per 10 CFR 50.48©. Since all the criteria were met, the NRC is exercising enforcement discretion for this issue.

.2 (Closed) Unresolved Item 05000313; 368/2001006-01: Three conduits in Fire

Zone 98-J containing Hemyc wrapped safe-shutdown equipment

Introduction.

The team identified an apparent violation of License Conditions 2.c.(8)and 2.C.(3)(b) for Units 1 and 2, respectively, and 10 CFR Part 50, Appendix R, Section III.G.2 for failure to maintain adequate separation between

redundant trains of safe shutdown equipment. Specifically, the installed Hemyc fire barrier material cannot provide the required 1-hour of protection. However, this violation will not be cited since the licensee met the Enforcement Policy criteria for enforcement discretion for a plant committed to adopting NFPA 805.

Description.

During a previous inspection, NRC observed that the licensee had wrapped several conduits containing safe-shutdown circuits in Fire Zone 98J in Hemyc material. The licensee used the Hemyc fire wrap as a 1-hour barrier to separate safe shutdown functions within the same fire area. The laboratory had performed testing of four-inch diameter Heymc-wrapped conduits; however, the team identified two and three inch diameter conduits containing safe-shutdown cables wrapped with Hemyc. These safe shutdown cables included:

(1) a power cable for Makeup Pump P36B;

(2) 120 Vac feeder cable from Inverter Y12 to Distribution Panel RS-3;

(3) 120 Vac feeder cable from Inverter Y11 to Distribution Panel RS-1;

(4) Load Center B5 feeder breaker control cable; and

(5) Load Center B5 to B6 tie breaker control cable.

The NRC documented the testing of Hemyc material in Information Notice 2005-07, "Results of Hemyc Electrical Raceway Fire Barrier System Full Scale Fire Testing."

NRC tested four common methods of joining the Hemyc material into a complete electrical raceway fire barrier system. The testing demonstrated that all but one assembly (conduit or cable tray) experienced temperatures capable of damaging plant cables as identified in Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, Attachment 7.

Generic Letter 2006-03, "Potentially Nonconforming Hemyc and MT Fire Barrier Configurations," required licensees to discuss:

(1) the installation of Hemyc or MT barrier materials and the impact on their facility including whether the installation was described in their licensing basis and

(2) their corrective actions and planned completion date.

The licensee described in their Generic Letter 2006-03 response that they had installed Hemyc on conduits and cable trays. Because of the estimated cost to replace the Hemyc, the licensee elected to adopt NFPA 805 in accordance with 10 CFR 50.48©, as specified in their December 21, 2005, letter of intent. As immediate corrective actions, the licensee initiated compensatory measures, which consisted of roving fire watches.

Since the licensee had placed the fire barrier configurations into the scope of their NFPA 805 improvement program, the licensee indicated that the Hemyc would be resolved through the course of completing their NFPA 805 work tasks and would not be corrected prior to December 2008.

During this inspection, the team performed several activities to ensure that the licensee had taken appropriate interim compensatory measures and had appropriately evaluated the risk of the Hemyc 1-hour fire barrier configurations. Specifically, the team:

(1) interviewed fire protection engineers;

(2) walked down each of the Heymc installations in each fire zone;

(3) evaluated the inputs used in the FAST models for Unit 2 Fire Zone OO and Unit 1 Fire Zone 38-Y;

(4) evaluated the inputs used in the FIVE fire models for Unit 1 Fire Zones 20-Y, 34-Y, 38-Y, 73-W, 149-E and the Intake; and

(5) evaluated the effectiveness of the interim compensatory measures.

The team determined that the licensee had accurately identified the spatial configurations and fire loading for the affected fire zones that were discussed in the Hemyc risk evaluations and the fire model evaluations. The team verified that the licensee used appropriate methods to evaluate the risk of the installed Hemyc and had established appropriate fire model boundaries. The licensee documented their Heymc concerns, compensatory measures and risk assessments in Condition Report C-2006-0048, Corrective Actions 11, 13, 14, 16, 17 and 27.

Analysis.

Failure to meet the separation requirements for a 1-hour fire barrier was a performance deficiency since the licensee did not comply with their Fire Protection Program, as required License Conditions 2.c.(8) and 2.C.(3)(b) for Units 1 and 2, respectively. This finding was more than minor because it affected the protection against external factors attribute of the Mitigating Systems cornerstone. The licensee documented their risk evaluations in "Fire Risk Assessment of Unit 1 Heymc Wrap at Arkansas Nuclear One," dated December 28, 2005, and "Fire Risk Assessment of Unit 2 Heymc Wrap at Arkansas Nuclear One," dated December 28, 2005, for Units 1 and 2, respectively. The team determined that the licensee had demonstrated in their simplified fire zone risk assessment and that the risk was less than high safety significance (Red).

Enforcement.

License Conditions 2.c.(8) and 2.C.(3)(b) for Units 1 and 2, respectively, specifies, "EOI shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in Appendix 9A to the SAR and as approved in the Safety Evaluation dated March 31, 1992." Further, as required by 10 CFR 50.48(b),

"With respect to all other fire protection features covered by Appendix R, all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III. G, III. J, and III. O." Section III. G.2 specified three options for separating cable and equipment for redundant trains within the same fire area, which included 1-hour fire barriers. The Arkansas Nuclear One fire hazards analysis described where 1-hour fire barriers protected redundant trains of safe shutdown equipment in each of the affected fire zones.

Contrary to the above the licensee had installed an inadequate 1-hour fire barrier in nine Unit 1 fire zones and four Unit 2 fire zones that could have impacted the ability to safely shutdown the facility. The licensee included this item in their corrective action program as Condition Report C-2006-0048, Action 12.

Because the licensee committed to adopting NFPA 805 and changing their fire protection program license basis to comply with 10 CFR 50.48©, this issue is covered by enforcement discretion in accordance with the NRC Enforcement Policy. Specifically, the licensee:

(1) would have identified and addressed this issue during the conversion to NFPA 805,

(2) had entered this issue into their corrective action program and implemented appropriate compensatory measures,

(3) demonstrated the finding would not be categorized under the Reactor Oversight Process as Red or a Severity Level I violation, and

(4) submitted their letter of intent prior to December 31, 2005. The inspector determined that this violation meets the criteria for enforcement discretion for plants in transition to a risk-informed, performance-based fire protection program as allowed per 10 CFR 50.48©. Since all the criteria were met, the NRC is exercising

enforcement discretion for this issue.

.3 (Closed) Unresolved Item 05000313; 368/2004010-01: Inadequate alternate shutdown

analysis

Introduction.

The team identified an apparent violation of License Conditions 2.c.(8)and 2.C.(3)(b) for Units 1 and 2, respectively, and 10 CFR Part 50, Appendix R, Section III.L.1, because the licensee had failed to ensure that the pressurizer level would remain within the indicating range during all potential accident scenarios that could result during a control room evacuation or fire in the cable spreading room.

However, this apparent violation will not be cited since the licensee satisfied the NRC Enforcement Policy enforcement discretion criteria for a plant committed to adopting NFPA-805.

Discussion. The team identified an apparent violation of License Conditions 2.c.(8)and 2.C.(3)(b) for Units 1 and 2, respectively, and 10 CFR Part 50, Appendix R, Section III.L.1, because the licensee had an inadequate alternate shutdown analysis.

Summary of 2004 Inspection Calculation 85-E-0086-02, "Manual Action Feasibility Methodology and Common Results," Revision 0, evaluated the ability of operators to perform manual actions for fires in areas outside the control room and for alternate shutdown manual actions. This calculation referred to numerous other calculations that the licensee believed could be used to demonstrate alternate shutdown viability.

During review of Calculation 85-E-0086-02, the team determined that the licensee had not ensured that reactor coolant system process variables remained in a condition similar to a loss of normal ac power nor did the licensee ensure that the pressurizer level remained within the indicating range, as specified in 10 CFR Part 50, Appendix R, Section III.L.1 and Section III.L.2, respectively.

The licensee specified that they did not interpret the Appendix R, Section III.L.1 and Section III.L.2, as specifically written in the regulation. Rather, the licensee designed their plant response to ensure that the core would remain covered. The team expressed concern because the use of inappropriate acceptance criteria in the calculations could result in nonconservative time limits utilized as acceptance criteria for alternate shutdown actions.

The team noted that, while in some instances the NRC had approved loss of indicated pressurizer level at a few plants for a short period of time, the NRC had not evaluated or approved a decrease of pressurizer level to the top of active fuel (or outside of the indicating range for a significant period of time). The loss of pressurizer level to this degree could cause the formation of a bubble in the reactor vessel and, thus, significantly challenge natural circulation cooling.

Current Inspection The team evaluated revised Calculation 85-E-0086-02, the thermal hydraulic calculations for both units that demonstrated the core would remain covered, revised response procedures, documents reflecting the Appendix R reanalysis, and the

corrective action documents that track the items that need enforcement discretion and/or NRC approval. From review of design information and interviews with engineering personnel, the team determined:

• Calculation 85-E-0072-02, "Time From Loss of All AC Power to Loss of Subcooling," Change 2, established conservative conditions for evaluating a loss of subcooling. For a loss of makeup and with 80 gpm letdown, if the operators isolate letdown within approximately 2 minutes then they have 55 minutes to re-establish makeup flow to prevent losing subcooling/indicated level in the pressurizer. If letdown were not isolated until 4 minutes into the event, operators would not lose subcooling if they reestablished makeup in 42 minutes.

• Calculation 85-E-0072-03, "Time to Loss of Subcooling or Loss of Pressurizer Liquid Inventory From Plant Trip With No Makeup Available Under Various RCS Leak Path Scenarios," Revision 2, evaluated a range of scenarios for various leak paths using conservative assumptions. The shortest time to react involved failed open pressurizer relief valves. The licensee now operates with the valves isolated and the block valve closed. For these conditions, if operators isolate letdown within 3 minutes then they have 30 minutes to restore makeup prior to losing indication.

• Calculation 85-E-0073-05, "Time to Core Uncovery Following Opening of the ANO-1 Electromagnetic Relief Valve With No Makeup Available," Revision 0, assumes a loss of 255 gpm through the pressurizer relief valve and continues to have a loss of letdown of 80 gpm. With these conservative assumptions, the licensee had 45 minutes to take action to prevent core uncovery.

The team verified that the licensee had similar bounding analyses for Unit 2 scenarios and determined that the reaction time available to reactor operators was similar. In addition, the team determined during this inspection that the licensee could implement the Unit 2 alternate shutdown procedure as written.

The team verified that licensee procedures direct isolating letdown during the initial steps. From interviews with reactor operators and control board walk downs, the team determined that for a control room evacuation, the licensee can isolate letdown within the prescribed period for both units. In addition, because of conservatism in the above calculations, the team concluded that the licensee could react in sufficient time to prevent core damage as a result of a control room fire. The team determined the likelihood of the event is small since it would require multiple failures in two different control panels.

The licensee had committed to revising their fire protection program to comply with 10 CFR 50.48©. The licensee will be performing thermal-hydraulic calculations to support their fire response procedures. The team determined that the licensee plans to establish response procedures that meet the NFPA 805 nuclear safety performance criteria. NFPA 805, Section 1.5.1.(b), Nuclear Safety Performance Criteria, specifies in part, "Fire protection features shall be capable of providing reasonable assurance that, in the event of a fire, the plant is not placed in an unrecoverable condition (emphasis added). To demonstrate this, the following performance criteria shall be met. . . .

Inventory and Pressure Control. With fuel in the reactor vessel, head on and tensioned, inventory and pressure control shall be capable of controlling coolant level such that

subcooling is maintained for a PWR . . . such that fuel clad damage as a result of a fire is prevented."

The team determined that term unrecoverable condition was described for a similar loss of inventory in the, "Safety Evaluation of Fire Protection Measures at the Davis-Besse Nuclear Power Station, Unit 1, Per Appendix R to 10 CFR Part 50," dated May 30, 2001.

Specifically, on pages 28 and 29, the following was described:

"The staff initially had several concerns with the licensee's alternate shutdown approach. The first was that the performance goals for the alternate shutdown function, as required by Section III. L of Appendix R, may not have been met. At Davis-Basse as with other pressurized water reactors, some plant transients of short duration may cause certain reactor coolant process variables and their indications, such as pressurizer level, to exceed those predicted for a loss of offsite power. These transients would occur for a short period and could result from a delay in reactor trip or from a delay in equipment manipulations such as the time to properly realign auxiliary feedwater valves following fire induced spurious signals. The staff has evaluated the consequences of these transients and concludes that they are not safety significant as long as no unrecoverable plant condition will occur. An unrecoverable plant condition is defined as the loss of any shutdown function(s) for such duration as to ultimately cause the reactor coolant level to fall below the top of the reactor core and lead to a subsequent breach of the fuel cladding."

In response to a question from Region III inspectors described in Task Interface Agreement 2003-06, dated February 6, 2004, NRC reiterated the position that it is acceptable under certain post-fire safe shutdown scenarios for reactor coolant level to go to the top of active fuel so long as core damage does not result (i.e., an unrecoverable condition).

Analysis.

The performance deficiency associated with this finding involved the failure to have an adequate alternate safe shutdown analysis for a control room fire. This finding is greater than minor because it is associated with Mitigating Systems cornerstone attribute of protection from external factors (fire) and affects the associated cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team and a senior reactor analyst reviewed the simplified, basic risk analysis performed by the licensee to demonstrate that the risk significance of the issues would be less than high risk significant.

The licensee used the ignition source frequency following the NUREG/CR-6850, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities," September 2005, method outlined in Task 6. Although the licensee had not completed this task for the entire site, the licensee had completed the evaluation in the four zones of interest. The licensee utilized the non-suppression probabilities listed in NUREG/CR-6850, Appendix P. The licensee used the conditional core damage probability (CCDP) values from their external events evaluation.

Unit 1 - Control Room Initiation Frequency NUREG/CR-6850, Task 6 method (FIFCR) 4.83E-03 Fire non-suppression probability from NUREG/CR-6850, Appendix P (PSUP) 1.50E-01 CCDP from IPEEE 1.10E-01 Unit 1 - Cable Spreading Room Initiation Frequency NUREG/CR-6850, Task 6 method (FIFCSR) 1.34E-03 Fire non-suppression probability from NUREG/CR-6850, Appendix P (PSUP) 5.00E-02 CCDP from IPEEE (CCDPCR) 7.36E-03 For Unit1, the ignition probability (PIGN) for each room can be determined as follows:

PIGN = FIFCR

• PSUP Unit 1 Control Room = 4.83E-03/yr

• 0.15 = 7.25E-04/yr Unit 1 Cable Spreading Room = 1.34E-03/yr

• 0.05 = 6.70E-05/yr Determining the likelihood contributions requires multiplying the frequencies by the conditional core damage probabilities and adding up the contributions:

CDFCR = 7.25E-04/yr

• CCDPCR = 7.25E-04

• 0.11 = 7.97E-05/yr CDFCSR = 6.70E-05/yr

• CCDPCSR = 6.70E-04

• 7.36E-03 = 4.70E-07/yr The combined likelihood contribution from the Unit 1 control and cable spreading rooms that could result in a delta core damage frequency (CDF) is:

CDF = CDFCR + CDFCSR = 7.97E-05/yr + 4.70E-07/yr = 8.02E-05/yr Unit 2 - Control Room Initiation Frequency NUREG/CR-6850, Task 6 method (FIFCSR) 3.69E-03 Fire non-suppression probability from NUREG/CR-6850, Appendix P (PSUP) 1.50E-01 CCDP from IPEEE 5.60E-02 Unit 2 - Cable Spreading Room Initiation Frequency NUREG/CR-6850, Task 6 method (FIFCSR) 1.87E-04 Fire non-suppression probability from NUREG/CR-6850, Appendix P (PSUP) 5.00E-02 CCDP from IPEEE (CCDPCSR) 5.60E-02 Similarly, for Unit 2 the ignition probability (PIGN) for each room can be determined as follows:

PIGN = FIFCR

• PSUP Unit 2 Control Room = 3.69E-03/yr

• 0.15 = 5.54E-04/yr Unit 2 Cable Spreading Room = 1.87E-04/yr

• 0.05 = 9.35E-06/yr

Determining the likelihood contributions requires multiplying the frequencies by the conditional core damage probabilities and adding up the contributions:

CDFCR = 5.54E-04/yr

• CCDPCR = 5.54E-04/yr

• 0.056 = 3.10E-05/yr CDFCSR = 9.35E-06/yr

• CCDPCSR = 9.35E-06/yr

• 0.056 = 5.24E-07/yr The combined likelihood contribution from the Unit 2 control and cable spreading rooms is:

CDF = CDFCR + CDFCSR = 3.10E-05/yr + 5.24E-07/yr = 3.15E-05/yr The licensee performed the calculation so that a fire could occur in any cabinet and not just the cabinets with components that would affect the pressurizer level. The final probability values bound the values that will result after development of the full probability analysis accounting for the specific failures needed to cause a loss of inventory below the pressurizer indicating range resulting in core damage.

The following licensee calculations had been completed for specific items that could result in a loss of inventory affecting the pressurizer level:

• PRA-A1-05-002, "Probability of ANO-1 Fire-Induced LOCA Due to Hot Short of the ERV (PSV-1000)," Revision 0, identified a likelihood of 1.174E-5/yr for postulated main control room or cable spreading room fires.

• PRA-A2-05-001, "Probabilistic Safety Analyses of ANO-2 Fire-Induced LOCAs,"

Revision 0, identified a likelihood of 8.88E-6/yr for postulated main control room or cable spreading room fires.

In each case the final core damage frequency value indicated the event was less likely than the calculated bounding values. The licensee indicated that not all scenarios would be included until the fire probabilistic risk assessment was completed. Since the values were all less likely and, based upon some industry numbers will likely be lower still, the licensee believes that the overall core damage frequency for all combined scenarios once developed will still be less than high safety significance (Red).

The team and the senior reactor analyst concluded the licensee had established a "reasonable" high level risk assessment and agreed that the probability that a fire in the control room or cable spreading room results in an unrecoverable condition is less than high risk significance (Red).

Enforcement.

License Conditions 2.c.(8) and 2.C.(3)(b) for Units 1 and 2, respectively, specifies, "EOI shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in Appendix 9A to the SAR and as approved in the Safety Evaluation dated March 31, 1992." Further, as required by 10 CFR 50.48(b),

"With respect to all other fire protection features covered by Appendix R, all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III. G, III. J, and III. O."

Part 50 of Title 10 of the Code of Federal Regulations, Appendix R, Section III.L.1, requires that reactor coolant system process variables shall be maintained within those predicted for a loss of normal ac power. For a loss of normal ac power at Arkansas Nuclear One, predicted pressurizer level (a reactor coolant system process variable)remains well within the indicating range. In lieu of Appendix R, Section III.L.1, the licensee may meet the performance goals of Appendix R, Section III.L.2. Appendix R, Section III.L.2, specifies, in part, that pressurizer level be maintained within the indicating range during a control room fire. The licensee utilized Calculation 85-E-0086-02, Revision 0, to demonstrate compliance with 10 CFR Part 50, Appendix R, Sections III.L.1 or III.L.2. Contrary to the above, Calculation 85-E-0086-02 failed to demonstrate compliance with 10 CFR Part 50, Appendix R, Sections III.L.1 or III.L.2, because the calculation utilized acceptance criteria inconsistent with Appendix R requirements.

Because the licensee committed to adopting NFPA 805 and changing their fire protection program license basis to comply with 10 CFR 50.48©, this issue is covered by enforcement discretion in accordance with the NRC Enforcement Policy.

Specifically, the licensee:

(1) would have identified and addressed this issue during the conversion to NFPA 805,

(2) had entered this issue into their corrective action program and implemented appropriate compensatory measures,

(3) demonstrated the finding would not be categorized under the Reactor Oversight Process as Red or a Severity Level I violation, and

(4) submitted their letter of intent prior to December 31, 2005. The inspector determined that this violation meets the criteria for enforcement discretion for plants in transition to a risk-informed, performance-based fire protection program as allowed per 10 CFR Part 50.48©. Since all the criteria were met, the NRC is exercising enforcement discretion for this issue.

4OA6 Management Meetings

Exit Meeting Summary

On October 19, 2007, the team leader presented the inspection results to Mr. T. G. Mitchell, and other members of licensee management. The team destroyed or returned all proprietary information reviewed during the inspection to the licensee.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

S. Cotton, Manager, Training

J. Eichenberger, Manager, Corrective Actions and Assessments

B. Fletcher, Procurement Supervisor

M. Fletcher, Instructor, Fire Protection

B. Greeson, Acting Manager, Engineering Programs and Components

R. Hendrix, Fire Protection Engineer

R. Henry, Manager, Nuclear Information Technology

D. James, Manager, Licensing

T. Mitchell, Vice President, Operations

R. Puckett, Project Manager

S. Pyle, Licensing Specialist

C. Reasoner, Director, Engineering

T. Robinson, Fire Protection Engineer

J. Smith, Manager, Quality Assurance

J. Walker, Fire Protection Engineer

L. Young, Fire Protection Engineer

NRC

J. Josey, Resident Inspector

ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000313; 368/2007006-02 URI Inadequate Preventive Maintenance Activities Result in Excessive Emergency Light Failures (Section 1R05.9)

Opened and Closed

05000313; 368/2007006-01 NCV Failure to Maintain Adequate Fire Brigade Staffing During Alternate Shutdown (Section 1R05.6)

Closed

05000313; 368/1998021-02 URI Potential for actuation of high/low interface valves (Section 4OA5.1)

Attachment

05000313; 368/2001006-01 URI Three conduits in Fire Zone 98-J containing Hemyc wrapped safe-shutdown equipment (Section 4OA5.2)

05000313; 368/2004010-01 URI Inadequate Alternate Shutdown Analysis (Section 4OA5.3)

Attachment