IR 05000416/2017008

From kanterella
Jump to navigation Jump to search
NRC Triennial Fire Protection Inspection Report 05000416/2017008
ML17156A038
Person / Time
Site: Grand Gulf Entergy icon.png
Issue date: 06/02/2017
From: Greg Werner
NRC/RGN-IV/DRS/EB-2
To: Emily Larson
Entergy Operations
Werner G
References
IR 2017008
Download: ML17156A038 (39)


Text

UNITED STATES une 2, 2017

SUBJECT:

GRAND GULF NUCLEAR STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000416/2017008

Dear Mr. Larson:

On April 21, 2017, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Grand Gulf Nuclear Station and discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.

The NRC team documented four findings of very low safety significance (Green) in this report.

All four of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

If you contest the violations or significance of the violations in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the Grand Gulf Nuclear Station.

If you disagree with a cross-cutting aspect assignment, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to the Regional Administrator, Region IV, and the NRC resident inspector at the Grand Gulf Nuclear Station. This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely,

/RA Greg Pick Acting for/

Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Docket No. 50-416 License No. NPF-29

Enclosure:

Inspection Report No. 05000416/2017008 w/Attachment: Supplemental Information

REGION IV==

Docket: 50-416 License: NPF-29 Report Nos.: 05000416/2017008 Licensee: Entergy Operations, Inc.

Facility: Grand Gulf Nuclear Station Location: P.O. Box 756 Port Gibson, MS 39150 Dates: April 3, 2017, through April 21,2017 Team Leader: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 Inspectors: S. Makor, Reactor Inspector, Engineering Branch 2 N. Okonkwo, Reactor Inspector, Engineering Branch 2 E. Uribe, Project Engineer, Inspection Program and Assessment Team Approved By: Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY

IR 05000416/2017008; 04/03/2017 - 04/21/2017; Grand Gulf Nuclear Station; Fire Protection (Triennial)

The report covers a two-week triennial fire protection team inspection by specialist inspectors from Region IV. Four findings, which were non-cited violations, are documented. The significance of inspection findings is indicated by their color (i.e., Green, White, Yellow, or Red)and determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated November 1, 2016. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 6.

NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of License Condition 2.C.(41) for failure to correct a condition adverse to fire protection in a timely manner. Specifically, the licensee failed to complete evaluations of multiple spurious operations (MSO) concerns identified in 2011. The licensee entered this finding into their corrective action program as Condition Report CR-GGN-2017-03996.

The failure to correct a condition adverse to fire protection in a timely manner was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, untimely resolution of these MSO actuations placed the facility at risk of being unable to safely shutdown the facility in response to a fire.

The finding was screened in accordance with Inspection Manual Chapter (IMC) 0609,

Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. Because the finding affected the ability to achieve and maintain post-fire safe shutdown, the team reviewed the finding using IMC 0609,

Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. The finding was screened as a Green finding of very low safety significance in accordance with Task 1.3, Ability to Achieve Safe Shutdown, Question A. Although the licensee failed to completely evaluate the impact of MSOs that could potentially result in the loss of suppression pool inventory, the team determined that for all fire areas one division of the residual heat removal system and the supporting standby service water system remained available along with suppression pool level indication. The team confirmed that suppression pool makeup for the standby service water system would remain available. For the postulated control room fire that led to control room evacuation, a senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding. The senior reactor analyst determined this finding was of very low safety significance. The finding had a cross-cutting aspect in the Conservative Bias component of the Human Performance area because the licensee failed to use decision making-practices that emphasize prudent choices over those that are simply allowable. Specifically, the licensee reclassified a condition report to be non-adverse allowing resolution to be given a lower priority prior to completing the evaluations required to provide a technical basis for that decision [H.14].

(Section 1R05.01.b)

Green.

The team identified a Green non-cited violation of Technical Specification 5.4.1.a for the failure to implement and maintain adequate written procedures covering a fire in the control room. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant under all postulated fire scenarios within the time limits established by the thermal hydraulic analysis. The licensee entered this finding into their corrective action program as Condition Report CR-GGN-2017-04011. As an immediate compensatory measure, the license issued Standing Order 17-0010 to provide operators additional guidance.

The failure to implement and maintain adequate written procedures covering timed operator actions during a fire in the control room was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the alternative shutdown procedure failed to ensure operators could safely shut down the plant under all postulated fire scenarios within the time limits established by the thermal hydraulic analysis. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. The senior reactor analyst determined this finding was of very low safety significance.

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than 3 years ago.

(Section 1R05.05.b.1)

Green.

The team identified a Green non-cited violation of License Condition 2.C.(41) for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to adequately isolate control circuits for safe shutdown equipment to ensure independence from the effects of a fire in the control room. The licensee entered this finding into their corrective action program as Condition Report CR-GGN-2017-04028. As an immediate compensatory measure, the licensee issued Standing Order 17-0010 to provide operators additional guidance.

The failure to adequately isolate control circuits for safe shutdown equipment from the effects of a control room fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the spurious actuation of safety relief valves would adversely affect the safe shutdown equipment relied upon to achieve and maintain safe shutdown conditions. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. The senior reactor analyst determined this finding was of very low safety significance.

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than 3 years ago.

(Section 1R05.05.b.2)

Green.

The team identified a Green non-cited violation of Technical Specification 5.4.1.a for the failure to maintain adequate written procedures covering a fire in the control room. Specifically, the licensee failed to ensure that all steps in Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, could be performed as written. Specifically, the licensees procedure did not provide specific guidance to the control room staff on how to actuate the low pressure core spray pump breaker lockout relay. The licensee initiated Condition Report CR-GGN-2017-03368 to address the deficiency and immediately implemented Standing Order 17-0009, which provides specific guidance to the control room staff on how to actuate the low pressure core spray pump breaker lockout relay.

The failure to provide a procedure that operators understood to implement the requirements of the approved fire protection program for a fire in the control room was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the alternative shutdown procedure failed to ensure operators could safely shut down the plant during a control room fire causing circuit faults. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. The Senior Reactor Analyst determined this finding was of very low safety significance.

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than 3 years ago.

(Section 1R05.05.b.3)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted at Grand Gulf Nuclear Station in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), dated January 31, 2013. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas and one or more mitigating strategies for review. The inspection team used the fire hazards analysis section of the Grand Gulf Nuclear Station Individual Plant Examination of External Events to select the following four risk-significant fire areas (inspection samples) for review:

Fire Area Description Auxiliary Building Corridors, Elevation 119 Ft. (Fire Zones IA201, IA211, and IA222)

Division 1 Switchgear Room (Fire Zone OC202)

Division 2 Switchgear Room (Fire Zone OC215)

Control Building Lower Cable Spreading Room (Fire Zone OC402)

The inspection team evaluated the licensees fire protection program using the applicable requirements, which included the plant Technical Specifications, Operating License Condition 2.C.(41), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Final Safety Analysis Report (FSAR), Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis. Specific documents reviewed by the team are listed in the attachment.

Four fire area inspection samples and three mitigating strategy samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met applicable license commitments.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(41) for failure to correct a condition adverse to fire protection in a timely manner. Specifically, the licensee failed to complete evaluations of multiple spurious operations (MSO) concerns identified in 2011.

Description.

Licensees must evaluate MSO concerns for potential adverse impact on the fire protection programs ability to achieve and maintain post-fire safe shutdown.

The licensee had addressed MSO concerns using the methodology in Nuclear Energy Institute document NEI 00-01, Guidance for Post Fire Safe Shutdown Circuit Analysis, Revision 2. The methodology included the use of a multidiscipline MSO Expert Panel.

A supplemental MSO Expert Panel was conducted in August 2011 using a draft of NEI 00-01, Revision 3. The panel identified additional MSO concerns not resolved by the evaluations, procedure revisions, and modifications performed based on NEI 00-01, Revision 2. The licensee documented these concerns in Engineering Report GGNS-EE-10-00002, Expert Panel for Addressing Multiple Spurious Operations, Revision 1, and continued tracking the concerns in Condition Report CR-GGNS-2013-03821.

The licensee documented evaluations of these MSO concerns in Engineering Change EC51550 in 2014. The licensee resolved most of these MSO concerns but identified five concerns that required additional evaluation. Also, in 2014 the licensee reclassified Condition Report CR-GGN-2013-03821 as non-adverse. The licensee transferred the five remaining open MSO concerns to Condition Report WT-WTGGN-2015-00090 in 2015 to be addressed as a plant project. The licensee has approved project funding for 2017 and 2018.

UFSAR Table 9.5-11, Fire Protection Program Comparison with NRC Requirements, is a point-by-point comparison of the fire protection program of the Grand Gulf Nuclear Station, with the positions of the Nuclear Regulatory Commissions Appendix A to Branch Technical Position APCSB 9.5-1, dated August 23, 1976, for plants under construction before July 1, 1976. UFSAR Table 9.5-11, Section C, Fire Protection Qualify Assurance Program, includes Position C.8, Corrective Action, which states, Measures should be established to assure that conditions adverse to fire protection, such as failures, malfunctions, deficiencies, deviations, defective components, uncontrolled combustible material, and non-conformances are promptly identified, reported, and corrected.

As the time of this inspection, the licensee had not completed evaluating these MSO concerns. The licensee documented this issue in Condition Report CR-GGN-2017-03996.

Analysis.

The failure to correct a condition adverse to fire protection in a timely manner was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, untimely resolution of these MSO actuations placed the facility at risk of being unable to safely shutdown the facility in response to a fire.

The finding was screened in accordance with Inspection Manual Chapter (IMC) 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. Because the finding affected the ability to achieve and maintain post-fire safe shutdown, the team reviewed the finding using IMC 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013. The finding was screened as a Green finding of very low safety significance in accordance with Task 1.3, Ability to Achieve Safe Shutdown, Question A. Although the licensee failed to completely evaluate the impact of MSOs that could potentially result in the loss of suppression pool inventory, the team determined that for all fire areas one division of the residual heat removal system and the supporting standby service water system remained available along with suppression pool level indication. The team confirmed that suppression pool makeup for the standby service water system would remain available.

A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. For the control room, the senior reactor analyst used the fire ignition frequency for the control room listed in the Grand Gulf Nuclear Station Engineering Report for Individual Plant Examination of External Events Summary Report, Revision 1, as the best available information. The analyst multiplied the fire ignition frequency (FIFCR) by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming 2 minutes for detection, and the fire required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = FIFCR

  • SF
  • NPCRE

= 9.5E-3

  • 0.1
  • 1.30E-2

= 1.24E-5/yr The control room had a total of 43 panels and 15 termination cabinets. The senior reactor analyst determined that a fire in three panels could lead to the spurious operation of a pump taking suction from the suppression pool without an available flow path. The analyst calculated a bounding change in core damage frequency for the finding (CDF)by multiplying the control room evacuation frequency by the fraction of panels and termination cabinets containing the affected circuits.

CDF = FCR-EVAC

  • 3 / 58

= 1.24E-5/yr

  • 3 / 58

= 6.41E-7/yr This change in core damage frequency was considered to be bounding since it assumed:

  • Fire damage in the applicable cabinets would create circuit faults such that at least one non-credited pump of concern would spuriously start and its associated minimum flow valve would either fail to open or spuriously close;
  • The conditional core damage probability given a control room fire with evacuation and the loss of required inventory caused by this issue was equal to one; and
  • The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with IMC 0609, Appendix H, Containment Integrity Significance Determination Process, issued May 6, 2004, the analyst determined that this was a Type A finding, because the finding affected the plant core damage frequency. In accordance with the guidance in Appendix H, this finding would not involve a significant increase in risk of a large, early release of radiation because Grand Gulf has a Mark III containment, and the postulated sequences did not involve inter-system loss of coolant, station blackouts or accident sequences ending with the reactor coolant system at high pressures. Therefore, the analyst determined that the significance of this finding was considered to be core damage frequency-dominant, and the impact to large, early release frequency was negligible.

The finding had a cross-cutting aspect in the Conservative Bias component of the Human Performance area because the licensee failed to use decision making-practices that emphasize prudent choices over those that are simply allowable. Specifically, the licensee reclassified a condition report to be non-adverse allowing resolution to be given a lower priority prior to completing the evaluations required to provide a technical basis for that decision [H.14].

Enforcement.

License Condition 2.C.(41) requires the licensee to implement and maintain in effect all provisions of the approved fire protection program as described in Revision 5 to the Updated Final Safety Analysis Report and as approved in the Safety Evaluations, dated August 23, 1991, and September 29, 2006. UFSAR Table 9.5-11, Fire Protection Program Comparison with NRC Requirements, is a point-by-point comparison of the fire protection program of the Grand Gulf Nuclear Station, with the positions of the Nuclear Regulatory Commissions Appendix A to Branch Technical Position APCSB 9.5-1, dated August 23, 1976, for plants under construction before July 1, 1976. UFSAR Table 9.5-11, Section C, Fire Protection Qualify Assurance Program, includes Position C.8, Corrective Action, which states, Measures should be established to assure that conditions adverse to fire protection, such as failures, malfunctions, deficiencies, deviations, defective components, uncontrolled combustible material, and non-conformances are promptly identified, reported, and corrected.

Contrary to the above, from August 2011 to April 21, 2017, the licensee failed to complete corrective actions for conditions adverse to fire protection in a timely manner.

Specifically, the licensee has not completed required evaluations and corrective actions associated with potential multiple spurious operations identified by the licensees expert panel for addressing multiple spurious operations in August 2011.

Because this violation was of very low safety significance and has been entered into the corrective action program (Condition Report CR-GGN-2017-03996), this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2017008-01, Untimely Corrective Action.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team walked down accessible portions of the detection and suppression systems in the selected fire areas. The team also walked down major system support equipment in other areas (e.g., fire pumps and carbon dioxide supply systems) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements. The team also reviewed the halon suppression functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for firefighting.

The team observed an unannounced fire drill and subsequent drill critique on April 18, 2017, using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly, dated September 30, 2010. The team observed fire brigade members fight a simulated fire in the Division 1 Switchgear Room on the Auxiliary Building 119 elevation. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;
(2) proper use and layout of fire hoses;
(3) employment of appropriate firefighting techniques;
(4) sufficient firefighting equipment was brought to the scene;
(5) effectiveness of fire brigade leader communications, command, and control;
(6) search for victims and propagation of the fire into other areas;
(7) smoke removal operations;
(8) utilization of pre-planned strategies;
(9) adherence to the pre-planned drill scenario; and
(10) drill objectives.

b. Findings

No findings were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities, from the rupture, or inadvertent operation of fire suppression systems. Specifically, the team verified:

  • A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.
  • A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train).
  • Adequate drainage was provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform an alternative shutdown were trained and available onsite at all times, exclusive of those assigned as fire brigade members.

The team performed a timed walk down of the alternative shutdown procedure with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified that the operators could reasonably be expected to perform specific actions within the time required to maintain plant parameters within specified limits.

Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

On June 30, 2014, the triennial fire protection inspection team documented three concerns associated with the potential spurious actuation of safety relief valves during control room fire scenarios. The team documented these concerns as Unresolved Item 2014007-01 (ML14181B397).

The first concern related to control room fire scenarios that were required to be analyzed and mitigated. During this inspection, the team reviewed the fire protection licensing basis and circuit evaluations documented in Condition Reports CR-GGN-2005-00770 and CR-GGN-2017-03998. Based on these circuit evaluations, the team determined that the licensee was required to analyze and mitigate the spurious actuation of a single safety relief valve prior to operators isolating the control room and establishing control at the remote shutdown panel.

The second concern related to the amount of time available for operators to depressurize the reactor during control room fire scenarios. For control room fires, the alternative shutdown strategy required operators to take immediate actions to restore electrical power, align a residual heat removal pump in the low pressure coolant injection mode, and depressurize the reactor using six safety relief valves prior to the reactor vessel level reaching -160. During this inspection, the team reviewed the alternative shutdown procedure and associated thermal hydraulic analysis, and performed a timed walkdown of the alternative shutdown procedure. Based on the results of the first concern and the timed walkdown, the team determined that the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant under all postulated fire scenarios within the time limits established by the thermal hydraulic analysis.

The third concern related to the isolation of the safety relief valve circuits. During this inspection, the team reviewed the fire protection licensing basis, guidance on alternative shutdown scenarios and circuit failure issues, electrical drawings, and previous condition reports. The team determined that the safety relief valve circuits were not adequately isolated from the effects of a control room fire.

The team determined that these three issues constituted the following two violations of NRC requirements.

.1 Inadequate Alternative Shutdown Procedure Timing

Introduction.

The team identified a Green non-cited violation of Technical Specification 5.4.1.a for the failure to implement and maintain adequate written procedures covering a fire in the control room. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant under all postulated fire scenarios within the time limits established by the thermal hydraulic analysis.

Description.

The plants safe shutdown requirements were established by Operating License Condition 2.C.(41). This condition stated, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in Revision 5 to the Updated Final Safety Analysis Report and as approved in the Safety Evaluations, dated August 23, 1991, and September 29, 2006.

The fire protection program was described in Appendix 9B of the Updated Final Safety Analysis Report. This appendix referenced various sections of the Updated Final Safety Analysis Report and Technical Requirements Manual that comprised the fire protection program. The Updated Final Safety Analysis Report sections included Appendix 9C.

Appendix 9C contained an analysis of an alternative shutdown. The analysis stated that when the reactor vessel level reached -160, approximately 18 minutes from initiation of the event, operators would manually open six safety relief valves. The analysis also stated that all consequences of the fire, including hot shorts, open circuits, shorts to ground and general equipment failures, were considered in addition to a coincident loss of off-site power.

The team noted that Appendix 9C was later revised in 2013 to reflect the licensees extended power uprate. As a result, the 18 minute time limit for operators to open the six safety relief valves was reduced to 14 minutes. The team noted that the results in Appendix 9C were based on an analysis that did not assume the spurious actuation of any safety relief valves.

In 2005 the licensee identified that the safe shutdown analysis did not consider all consequences of the fire in addition to a coincident loss of off-site power. Specifically, the licensee did not assume the worst case spurious actuation or signal resulting from the fire. The licensee concluded that a single hot short in one cable could spuriously actuate an individual safety relief valve and two hot shorts within a single cable could spuriously actuate the automatic depressurization system. The licensee documented this evaluation in Condition Report CR-GGN-2005-00770.

During this inspection, the licensee re-evaluated the circuits for the automatic depressurization system. The licensee concluded that additional hot shorts or circuit failures were required to spuriously actuate the automatic depressurization system. The licensee documented this evaluation in Condition Report CR-GGN-2017-03998.

Based on the circuit evaluations, the team determined that the licensee was required to analyze and mitigate the spurious actuation of a single safety relief valve prior to operators isolating the control room and establishing control at the remote shutdown panel.

In response to the concerns documented in Unresolved Item 2014007-01, the licensee performed an updated thermal hydraulic analysis for alternative shutdown scenarios.

This updated analysis was documented in Engineering Change 62184 associated with Engineering Report GGNS-NE-10-00003, GGNS EPU Appendix R - Fire Protection.

The updated analysis considered the spurious actuation of a single safety relief valve and demonstrated that the reactor vessel level reached -160 in approximately 10 minutes. The analysis assumed that operators manually opened five additional safety relief valves when the reactor vessel level reached -162.3. The analysis credited the residual heat removal system starting in the low pressure coolant injection mode but did not indicate whether the system started automatically or manually.

The team noted that the analysis implicitly assumed the safety relief valve that spuriously actuated was one of the six credited safety relief valves. If the safety relief valve that spuriously actuated was not one of the six credited safety relief valves, then the alternative shutdown procedure would direct operators to manually open the six credited safety relief valves, resulting in a total of seven open safety relief valves. This implicit assumption was considered adequate to determine the amount of time available for operators to depressurize the reactor, but was considered inadequate to evaluate the plant response after the operators manually opened the safety relief valves.

During this inspection, the team performed a timed walkdown of the alternative shutdown procedure and determined that it took operators approximately 12 minutes to depressurize the reactor and start the residual heat removal pump. Since the reactor vessel level would reach -160 within 10 minutes with one spuriously actuated safety relief valve and operators were not ready to depressurize the reactor until 12 minutes, the team determined that the alternative shutdown procedure did not ensure operators could safely shut down the plant under all postulated fire scenarios within the time limits established by the thermal hydraulic analysis. As an immediate compensatory measure, the licensee issued Standing Order 17-0010 to provide operators additional guidance for taking actions within the time required.

Analysis.

The failure to implement and maintain adequate written procedures covering timed operator actions during a fire in the control room was a performance deficiency.

The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the alternative shutdown procedure failed to ensure operators could safely shut down the plant under all postulated fire scenarios within the time limits established by the thermal hydraulic analysis.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

The senior reactor analyst used the fire ignition frequency for the control room listed in the Grand Gulf Nuclear Station Engineering Report for Individual Plant Examination of External Events Summary Report, Revision 1, as the best available information. The analyst multiplied the fire ignition frequency (FIFCR) by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming 2 minutes for detection, and the fire required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = FIFCR

  • SF
  • NPCRE

= 9.5E-3

  • 0.1
  • 1.30E-2

= 1.24E-5/yr The control room had a total of 43 panels and 15 termination cabinets. The senior reactor analyst determined that a fire in four panels could lead to the spurious actuation of the safety relief valves. The analyst calculated a bounding change in core damage frequency for the finding (CDF) by multiplying the control room evacuation frequency by the fraction of panels and termination cabinets containing the affected circuits.

CDF = FCR-EVAC

  • 4 / 58

= 1.24E-5/yr

  • 4 / 58

= 8.52E-7/yr This change in core damage frequency was considered to be bounding since it assumed:

  • Fire damage in the applicable cabinets would create circuit faults such that at least one safety relief valve spuriously opened;
  • The conditional core damage probability given a control room fire with evacuation and the spurious actuation of at least one safety relief valve was equal to one; and
  • The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in IMC 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004, the senior reactor analyst screened the performance deficiency for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/yr.

Given that Grand Gulf Nuclear Station has a Mark III containment, the control room evacuation scenarios of concern do not include intersystem loss of coolant accidents or station blackouts, and the control room evacuation scenarios of concern do not result in a high reactor coolant system pressure, the analyst determined that this violation was not significant with respect to large early release frequency. The analyst determined this violation was of very low risk significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than 3 years ago.

Enforcement.

Technical Specification 5.4.1.a states that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978.

Regulatory Guide 1.33, provides a list of typical safety-related activities that should be covered by written procedures. Item 6.p includes a fire in the control room or forced evacuation of the control room. Contrary to the above, prior to April 21, 2017, the licensee failed to establish, implement, and maintain written procedures covering the applicable procedures recommended in Regulatory Guide 1.33. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shut down the plant under all postulated control room fire scenarios within the time limits established by the thermal hydraulic analysis.

Because this violation was of very low safety significance and has been entered into the corrective action program (Condition Report CR-GGN-2017-04011), this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2017008-02, Inadequate Alternative Shutdown Procedure.

.2 Failure to Isolate Control Circuits for Safe Shutdown Equipment from the Effects of a

Control Room Fire

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(41) for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to adequately isolate control circuits for safe shutdown equipment to ensure independence from the effects of a fire in the control room.

Description.

Grand Gulf Nuclear Station received its operating license on November 1, 1984. Since the license was issued after January 1, 1979, the license application was reviewed by the NRC staff using the applicable technical guidance contained in the Standard Review Plan (NUREG-0800), Section 9.5.1, dated July 1981.

This guidance contained Regulatory Position C.5.c.7, which provided the following criterion for alternative or dedicated shutdown capability:

  • The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown.

This criterion is identical to 10 CFR Part 50, Appendix R, Section III.L.7, which is applicable to plants licensed prior to January 1, 1979.

The plants safe shutdown requirements were established by Operating License Condition 2.C.(41). This condition stated, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in Revision 5 to the Updated Final Safety Analysis Report and as approved in the Safety Evaluations, dated August 23, 1991, and September 29, 2006.

The fire protection program was described in Appendix 9B of the Updated Final Safety Analysis Report. This appendix referenced various sections of the Updated Final Safety Analysis Report and Technical Requirements Manual that comprised the fire protection program. The Updated Final Safety Analysis Report sections included Table 9.5-12.

Table 9.5-12 contained a comparison of the licensees fire protection program to the requirements in 10 CFR Part 50, Appendix R. In Table 9.5-12, the licensee stated that it met the intent of 10 CFR Part 50, Appendix R, Section III.L.

The NRC approved the licensees fire protection program in the Safety Evaluations, dated August 23, 1991, and September 29, 2006. In the Safety Evaluation, dated August 23, 1991, the NRC approved a deviation to the technical requirements of 10 CFR Part 50, Appendix R, Section III.L.2. The NRC did not approve any deviations from the technical requirements of 10 CFR Part 50, Appendix R, Section III.L.7.

Based on the plants licensing basis, the licensee was required to meet the technical requirements of 10 CFR Part 50, Sections III.G and III.L with a single deviation from Section III.L.2. Therefore, the licensee was required to ensure that control circuits for safe shutdown equipment were independent of and electrically isolated from the control room so that fire damage would not prevent the ability to achieve and maintain safe shutdown conditions during an alternative shutdown.

For any valves that were required to close or remain closed for post-fire safe shutdown, the licensee was required to ensure that control room fires could not prevent the closure of the valves and could not spuriously open the valves once the control room has been isolated and control transferred to the remote shutdown panel. If any valves that were required to close or remain closed for post-fire safe shutdown may not close or may spuriously open due to a control room fire, this would not constitute isolation and independence from the control room.

The team reviewed the safe shutdown equipment list contained in Attachment A15 of Engineering Report GGNS-E-11-00001, GGNS Appendix R Safe Shutdown Analysis (FPP-1). The team verified that all of the safety relief valves were listed as safe shutdown equipment and the 14 non-credited safety relief valves were required to remain closed.

In Unresolved Item 2014007-01, the team was concerned that hot shorts in the control room could cause a spurious actuation that threatened the ability to achieve and maintain safe shutdown conditions. The team noted that the control room cabinets containing the safety relief valve circuits also contained other 125 Vdc circuits that may remain energized during an alternative shutdown. The team was concerned that hot shorts from one or more of these circuits could prevent the closure of safety relief valves (if spuriously open) or could spuriously open the safety relief valves after the control room was isolated and control transferred from the control room to the remote shutdown panel.

In response to the concerns documented in Unresolved Item 2014007-01, the licensee reviewed the safety relief valve circuits to determine the circuit failures that could result in the spurious opening of a single safety relief valve. The licensee confirmed that a single intra-cable short within a control circuit cable could actuate an individual safety relief valve.

The safety relief valve control cables were routed together within the control room with each cable containing multiple safety relief valve control conductors and multiple

+125 Vdc conductors. Because of the availability of +125 Vdc power, the licensee confirmed that it was possible for a short between the +125 Vdc conductors and the safety relief valve conductors to occur during a control room fire.

The team noted that this result was consistent with a previous evaluation performed in Condition Report CR-GGN-2005-00770. The previous evaluation concluded that all twenty safety relief valves could potentially spuriously open due to multiple intra-cable shorts occurring during a control room fire. The previous evaluation also noted that each of the Division I cables contained six conductors that were always hot and two conductors that were connected to the positive side of a safety relief valve solenoid valve.

Since the safety relief valve control cables were routed together within the control room with other conductors that remained energized during an alternative shutdown, the team determined that a fire in one of these cabinets could lead to hot shorts from one or more of these circuits, preventing the closure of a safety relief valve (if spuriously opened) or spuriously opening a safety relief valve once the control room was isolated and control transferred to the remote shutdown panel. As stated above, this does not constitute isolation and independence from the control room. As an immediate compensatory measure, the license issued Standing Order 17-0010 to provide operators additional guidance.

Analysis.

The failure to adequately isolate control circuits for safe shutdown equipment from the effects of a control room fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the spurious actuation of safety relief valves would adversely affect the safe shutdown equipment relied upon to achieve and maintain safe shutdown conditions.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

The senior reactor analyst used the fire ignition frequency for the control room listed in the Grand Gulf Nuclear Station Engineering Report for Individual Plant Examination of External Events Summary Report, Revision 1, as the best available information. The analyst multiplied the fire ignition frequency (FIFCR) by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming 2 minutes for detection, and the fire required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = FIFCR

  • SF
  • NPCRE

= 9.5E-3

  • 0.1
  • 1.30E-2

= 1.24E-5/yr The control room had a total of 43 panels and 15 termination cabinets. The senior reactor analyst determined that a fire in four panels could lead to the spurious actuation of the safety relief valves. The analyst calculated a bounding change in core damage frequency for the finding (CDF) by multiplying the control room evacuation frequency by the fraction of panels and termination cabinets containing the affected circuits.

CDF = FCR-EVAC

  • 4 / 58

= 1.24E-5/yr

  • 4 / 58

= 8.52E-7/yr This change in core damage frequency was considered to be bounding since it assumed:

  • Fire damage in the applicable cabinets would create circuit faults such that at least one safety relief valve spuriously opened;
  • The conditional core damage probability given a control room fire with evacuation and the spurious actuation of at least one safety relief valve was equal to one; and
  • The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004, the senior reactor analyst screened the performance deficiency for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/yr.

Given that Grand Gulf Nuclear Station has a Mark III containment, the control room evacuation scenarios of concern do not include intersystem loss of coolant accidents or station blackouts, and the control room evacuation scenarios of concern do not result in a high reactor coolant system pressure, the analyst determined that this violation was not significant with respect to large early release frequency. Consequently, this violation was of very low risk significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than 3 years ago.

Enforcement.

License Condition 2.C.(41) requires the licensee to implement and maintain in effect all provisions of the approved fire protection program as described in Revision 5 to the Updated Final Safety Analysis Report and as approved in the Safety Evaluations, dated August 23, 1991, and September 29, 2006. Updated Final Safety Analysis Report, Table 9.5-12 contains a comparison of the licensees fire protection program to the requirements in 10 CFR Part 50, Appendix R. In Table 9.5-12, the licensee states that it met the intent of 10 CFR Part 50, Appendix R, Section III.L.

Title 10 of the Code of Federal Regulations Part 50, Appendix R, Section III.L.7 states:

  • The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division, and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown.

Contrary to the above, prior to April 21, 2017, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to ensure that the safety relief valves, which were considered safe shutdown equipment, were isolated from associated non-safety circuits in the control room so that hot shorts, open circuits, or shorts to ground caused by a postulated fire in the associated circuits would not prevent safe shutdown.

Because this violation was of very low safety significance and has been entered into the corrective action program (Condition Report CR-GGN-2017-04028), this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2017008-03, Failure to Isolate Control Circuits for Safe Shutdown Equipment From the Effects of a Control Room Fire.

.3 Inadequate Alternative Shutdown Procedure Steps

The team identified the following finding during the current inspection:

Introduction.

The team identified a Green non-cited violation of Technical Specification 5.4.1.a for the failure to maintain adequate written procedures covering a fire in the control room. Specifically, the licensee failed to ensure that all steps in Procedure 05-1-02-II-1, Shutdown from the Remote Shutdown Panel, could be performed as written. Specifically, the licensees procedure did not provide specific guidance to the control room staff on how to actuate the low pressure core spray pump breaker lockout relay.

Description.

On April 5, 2017, the team completed a timed walkdown of Procedure 05-1-02-II-1 with operations personnel to ensure that the time critical actions can be completed within the time frame specified by Grand Gulf Appendix R

Analysis.

Step h.1.a in Attachment XXI, Control Room Fire Operator Actions (RHR A Injection to Reactor), requires the control room supervisor to, Trip the lockout relay for LPCS to isolate the breaker controls from potential control room fire hot shorts (MSO Item H).

The team determined that Step h.1.a in Attachment XXI did not provide adequate guidance to accomplish the task of actuating the trip function of the low pressure core spray pump lockout relay. The control room supervisor was unsure on how to accomplish the step. The team confirmed that control room personnel preforming the procedure do not receive formal training on the operation of that type of lockout relay.

The licensee revised Procedure 05-1-02-II-1 in April of 2014 to include actions to prevent the low pressure core spray pump from spuriously starting and overloading the emergency diesel generator. This was a concern identified as part of the licensee efforts for identifying and resolving MSO circuit concerns.

The licensee initiated Condition Report CR-GGN-2017-03368 to address the deficiency and immediately implemented Standing Order 17-0009, which provided specific guidance to the control room staff on how to actuate the low pressure core spray pump breaker lockout relay.

Analysis.

The failure to provide a procedure that operators understood to implement the requirements of the approved fire protection program for a fire in the control room was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the alternative shutdown procedure failed to ensure operators could safely shut down the plant during a control room fire causing circuit faults.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

The senior reactor analyst used the fire ignition frequency for the control room listed in the Grand Gulf Nuclear Station Engineering Report for Individual Plant Examination of External Events Summary Report, Revision 1, as the best available information. The analyst multiplied the fire ignition frequency (FIFCR) by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming 2 minutes for detection, and the fire required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = FIFCR

  • SF
  • NPCRE

= 9.5E-3

  • 0.1
  • 1.30E-2

= 1.24E-5/yr The control room had a total of 43 panels and 15 termination cabinets. The senior reactor analyst determined that a fire in one panel could lead to the spurious start of the low pressure core spray pump. The analyst calculated a bounding change in core damage frequency for the finding (CDF) by multiplying the control room evacuation frequency by the fraction of panels and termination cabinets containing the affected circuits.

CDF = FCR-EVAC

  • 1 / 58

= 1.24E-5/yr

  • 1 / 58

= 2.13E-7/yr This change in core damage frequency was considered to be bounding since it assumed:

  • Fire damage in the applicable cabinet would create circuit faults such that the low pressure core spray pump would spuriously start;
  • The conditional core damage probability given a control room fire with evacuation and the spurious actuation of the low pressure core spray pump was equal to one; and
  • The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in IMC 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004, the senior reactor analyst screened the performance deficiency for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/yr.

Given that Grand Gulf Nuclear Station has a Mark III containment, the control room evacuation scenarios of concern do not include intersystem loss of coolant accidents or station blackouts, and the control room evacuation scenarios of concern do not result in a high reactor coolant system pressure, the analyst determined that this violation was not significant with respect to large early release frequency. Consequently, this violation was of very low risk significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than 3years ago.

Enforcement.

Technical Specification 5.4.1.a states that written procedures shall be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, dated February 1978.

Regulatory Guide 1.33 provides a list of typical safety-related activities that should be covered by written procedures. Item 6.p includes a fire in the control room or forced evacuation of the control room.

Contrary to the above, from April 29, 2014, to April 5, 2017, the licensee failed to establish, implement, and maintain written procedures covering the applicable procedures recommended in Regulatory Guide 1.33. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safety shutdown the plant under all postulated control fire scenarios, including a forced evacuation of the control room.

Because this violation was of very low safety significance and has been entered into the licensees corrective action program as Condition Report CR-GGN-2017-03368, this violation is being treated as a non-cited violation consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000416/2017008-04, Inadequate Alternative Shutdown Procedure.

.06 Circuit Analysis

a. Inspection Scope

The team identified the circuits that may impact the ability to achieve and maintain safe shutdown. The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain safe shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The teams evaluation focused on the cables of selected components from the reactor core isolation cooling, reactor water cleanup, standby service water, 480 V power distribution, and switchgear room cooling systems. For the sample of components selected, the team reviewed electrical elementary and block diagrams, and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. Specific components reviewed by the team are listed in the attachment.

b. Findings

No findings were identified.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkdown of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings were identified.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed changes made to the approved fire protection program since May 21, 2014, (The pervious triennial fire protection inspection). The team verified that the changes did not constitute an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees approved fire protection program, implementing procedures, and programs for the control of ignition sources and transient combustibles.

The team assessed the licensees effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis. The team performed plant walkdowns to independently verify that transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Alternative Mitigation Strategy Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by 10 CFR 50.54(hh)(2).

The team verified that the licensee implemented and maintained adequate procedures, maintained and tested equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the off-site ability to obtain fuel for the portable pump and foam used for firefighting efforts. The strategy and procedure selected for this inspection sample included:

  • Procedure 05-S-01-STRATEGY, Attachment V, Adding Fire Water to Condenser Hotwell
  • Procedure 05-S-01-STRATEGY, Attachment VI, Adding Fire Water to CST
  • Procedure 05-S-01-STRATEGY, Attachment VII, Operation of SRVs With Temporary Power Three mitigating strategy samples were completed.

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

See the Green NCV 05000416/2017008-01 discussed in Section 1R05.01.b of this report.

4OA5 Other Activities

(Closed) Unresolved Item 05000416/2014007-01, Possible Spurious Actuation of the Safety Relief Valves During Control Room Fire Scenarios On June 30, 2014, the triennial fire protection inspection team documented three concerns associated with the potential spurious actuation of safety relief valves during control room fire scenarios. The team documented these concerns as Unresolved Item 2014007-01 (ML14181B397). During this inspection, the team determined that these three concerns constituted two violations of NRC requirements. These violations are discussed in Section 1R05.05 of this report. This unresolved item is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. E. Larson, Site Vice President, and other members of the licensee staff at an exit meeting on April 21, 2017. The licensee acknowledged the findings presented.

The team verified what proprietary information was retained by the team and will be properly disposed of after issuing this report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

R. Brinkman, Control Room Supervisor
R. Burrell, Senior Engineer
D. Chipley, Senior Engineer
R. Dukes, Fire Protection Contractor
S. Dupont, Regulatory Assurance Contractor
J. Hallenbeck, Manager Design Engineering
E. Larson, Site Vice President
J. Mathis, Supervisor Regulatory Assurance - Contractor
R. McNemar, Fire Marshall
R. Meister, Regulatory Assurance Senior Specialist
J. Nadeau, Regulatory Assurance Manager
G. Phillips, Supervisor Codes / Program Engineering
P. Salgado, Manager Performance Improvement
R. Sorrels, Fire Protection Engineer
K. Valdivia, Design Engineer
P. Williams, Director Engineering
M. Winsor, Fire Protection Contractor

NRC Personnel

H. Barrett, Senior Fire Protection Engineer, Fire Protection Branch (NRR/DRA/AFPB)
G. Casto, Branch Chief, Fire Protection Branch (NRR/DRA/AFPB)
D. Frumkin, Senior Fire Protection Engineer, Fire Protection Branch (NRR/DRA/AFPB)
C. Moulton, Fire Protection Engineer, Fire Protection Branch (NRR/DRA/AFPB)
M. Young, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000416/2017008-01 NCV Untimely Corrective Action (Section 1R05.01.b)

Inadequate Alternative Shutdown Procedure Timing

05000416/2017008-02 NCV (Section 1R05.05.b.1)

Failure to Isolate Control Circuits for Safe Shutdown

05000416/2017008-03 NCV Equipment From the Effects of a Control Room Fire (Section 1R05.05.b.2)

Inadequate Alternative Shutdown Procedure Steps

05000416/2017008-04 NCV (Section 1R05.05.b.3)

Closed

Possible Spurious Actuation of The Safety Relief Valves

05000416/2014007-01 URI During Control Room Fire Scenarios (Section 4OA5)

LIST OF DOCUMENTS REVIEWED