Text

Undated IR 05000400-02-011, on 12/20/2002, Carolina Power & Light Co., New Hill, North Carolina
	ML033560469
Person / Time
Site:	Harris
Issue date:	11/28/2003
From:	Ogle C; Division of Reactor Safety I
To:	Scarola J; Carolina Power & Light Co
References
	FOIA/PA-2003-0358 IR-02-011
	Download: ML033560469 (24)
	v • d • e

Carolina Power & Light Company

ATTN: Mr. James Scarola

Vice President - Harris Plant

Shearon Harris Nuclear Power Plant

P. 0. Box 165, Mail Code: Zone 1

New Hill, North Carolina 27562-0165

SUBJECT:

SHEARON HARRIS NUCLEAR PLANT - NRC INSPECTION REPORT

50-400/02-11

Dear Mr. Scarola:

On December 20, 2002, the Nuclear Regulatory Commission (NRC) completed a triennial fire

protection inspection at your Shearon Harris Nuclear Plant. The enclosed integrated inspection

report documents the inspection findings which were discussed on that date, with you and other

members of your staff.

The inspection examined the effectiveness of activities conducted under your license relating to

implementation of your NRC-approved fire protection program. The inspectors reviewed

selected procedures and records, observed activities, and interviewed personnel.

Based on the results of this inspection, the inspectors identified eight issues of very low safety

significance (Green). Each of these issues was determined to involve a violation of NRC

requirements. However, because of their very low safety significance and because they have

been entered into your corrective action program, the NRC is treating these issues as Non-

Cited Violations (NCVs), in accordance with Section VI.A.1 of the NRC's Enforcement Policy.

In addition, since two of these findings are related to your corrective action for the previous

violation associated with the Thermo-Lag fire barrier assembly between the 'B' train switchgear

room/auxiliary control panel room and the A train cable spreading room, that violation will

remain open. If you deny any NCV in this report, you should provide a response with the basis

for your denial, within 30 days of the date of this inspection report, to the Nuclear Regulatory

Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001; with copies to the

Regional Administrator, Region II; Director, Office of Enforcement, United States Nuclear

Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at

the Shearon Harris Nuclear Plant.

In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter and its

enclosure will be publicly available in the NRC Public Document Room or from the Publicly

CP&L

2

Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is

accessible from the NRC Web site at htto:/lwww.nrc.cov/reading-rm/adams.html (the Public

Electronic Reading Room).

Sincerely,

Charles R. Ogle, Chief

Engineering Branch 1

Division of Reactor Safety

Docket No.: 50-400

License No.: NPF-63

Enclosure: NRC Inspection Report 50-400/02-11

w/Attachment

cc w/encl:

Distribution w/encl:

PUBLIC

{OFFICE

RI1:DRS

RII:DRS

RII:DRP

RII:DRS

RII:DRP

SIGNATURE

NAME

RSchin

GWiseman

PFilfion

RHagar

SWalker

DCPayne

- PFredrickson

DATE

1/J2003

1/_J2003

1/__J2003

1/_J2003

1/IJ_003

1/_J2003

E-MAIL COPY?

YES

NO

YES

NO

YES

NO

-YES

N

NO

YES

NO

PUBLIC DOCUMENT

YES

NO

.

UFCA HU

_UP

lXXMN

NAE P:AMKISl-l '02- _ HO

_A.wpd

e

OFFICIAL RECORDI

COUPY

UOUUMLINJ NAML: F.XHAKKI5W0Z-11R0.WP(J

U.S. NUCLEAR REGULATORY COMMISSION

REGION II

Docket No.:

License No.:

50-400

NPF-63

Report No.:

Licensee:

Facility:

Location:

Dates:

Inspectors:

50-400/02-11

Carolina Power & Light (CP&L)

Shearon Harris Nuclear Plant

5413 Shearon Harris Road

New Hill, NC 27562

October 21 - 25, 2002 (Week 1)

November 4 - 8, 2002 (Week 2)

December 16 - 20, 2002 (Week 3)

P. Fillion, Reactor Inspector, Region II

R. Hagar, Resident Inspector, Shearon Harris (Week 3 only)

D. C. Payne, Fire Protection Team Leader, Region II (Week 3 only)

R. Schin, Senior Reactor Inspector, Region II (Lead Inspector)

S. Walker, Reactor Inspector (Week 3 only)

G. Wiseman, Senior Fire Protection Inspector, Region II (Weeks 1

&2)

Accompanying Personnel:

H. Christensen, Deputy Director, Division of Reactor

Safety, Region II (Week 3 only)

C. Ogle, Chief, Engineering Branch 1, Division of Reactor

Safety, Region II

N. Staples, Inspector Trainee, Region II (Weeks 1 & 2)

Approved by:

Charles R. Ogle, Chief

Engineering Branch 1

Division of Reactor Safety

Enclosure

SUMMARY OF FINDINGS

IR 05000400-02-11; Carolina Power & Light; on 10/21/2002 - 12120/2002, Shearon Harris

Nuclear Plant, Triennial Baseline Inspection of the Fire Protection Program.

The inspection was conducted by a team of regional engineering inspectors and the Shearon

Harris resident inspector. Nine Green findings, each a Non-Cited Violation (NCV), were

identified. The significance of issues is indicated by their color (Green, White, Yellow, Red)

using IMC 0609 "Significance Determination Process" (SDP). Findings for which the SDP does

not apply may be "Green" or be assigned a severity level after NRC management review. The

NRC's program for overseeing the safe operation of commercial nuclear power reactors is

described in NUREG-1 649, "Reactor Oversight Process," Revision 3, dated July 2000.

Inspection Identified Findings

Cornerstones: Mitigating Systems and Initiating Events

Green. An NCV of Shearon Harris Operating License Condition (OLC) 2.F, Fire

Protection Program; and Technical Specification (TS) 6.8.1, Procedures and Programs,

was identified for failing to protect equipment [motor-operated valve (MOV) 1 CS-1 65,

volume control tank (VCT) outlet to charging pumps (CSIPs)] from maloperation due to

a fire. Consequently, a fire in any of three different plant areas could result in a reactor

coolant pump (RCP) seal loss of coolant accident (LOCA) with no operable CSIP.

This finding had a credible impact on safety because it could result in a loss of

equipment that was relied upon for safe shutdown from a fire and could initiate a LOCA

event. However, the finding was of very low safety significance because of the low fire

initiation frequency and probability of spurious actuations, and the effectiveness of

automatic sprinklers, fire brigade, and remaining SSD equipment to limit the effects of a

fire and to shut down the nuclear reactor. Therefore, this finding is characterized as

Green (Section 1 R05.-).

Green. An NCV of OLC 2.F and TS 6.8.1 was identified for failing to protect equipment

(MOVs 1CC-208, CC supply to RCP seals; and 1CC-251, CC return from RCP seals)

from maloperation due to a fire. Consequently, a fire in one plant area could potentially

result in an RCP seal LOCA.

This finding had a credible impact on safety because it could result in a loss of

equipment that was relied upon for safe shutdown from a fire and could potentially

initiate a LOCA event. However, the finding was of very low safety significance because

of the low fire initiation frequency and probability of spurious actuations, and the

effectiveness of automatic sprinklers, fire brigade, and remaining SSD equipment to limit

the effects of a fire and to shut down the nuclear reactor. Therefore, this finding is

characterized as Green (Section 1 R05..).

Green. An NCV of OLC 2.F and TS 6.8.1 was identified for failing to provide a fire

barrier to protect equipment [MOVs 1 CS-1 66, VCT outlet to CSIPs and I CS-1 68, CSIP

2

suction cross-connect] from maloperation due to a fire. Consequently, a fire in one

plant area could result in a loss of all charging and high pressure safety injection.

This finding had a credible impact on safety because it could result in a loss of

equipment that was relied upon for safe shutdown from a fire. However, the finding was

of very low safety significance because of the low fire initiation frequency and probability

of spurious actuations, and the effectiveness of automatic sprinklers, fire brigade, and

remaining SSD equipment to limit the effects of a fire and to shut down the nuclear

reactor. Therefore, this finding is characterized as Green (Section 1 R05._).

Green. An NCV of OLC 2.F and TS 6.8.1 was identified for failing to provide a fire

barrier to protect equipment [MOVs 1 CS-1 69, CSIP suction cross-connect; 1 CS-214,

CSIP mini-flow isolation; 1CS-218, CSIP discharge cross-connect; and 1CS-219, CSIP

discharge cross-connect] from maloperation due to a fire. Consequently, a fire in one

plant area could result in a loss of all charging and high pressure safety injection.

.

This finding had a credible impact on safety because it could result in a loss of

equipment that was relied upon for safe shutdown from a fire. However, the finding was

of very low safety significance because of the low fire initiation frequency and probability

of spurious actuations, and the effectiveness of automatic sprinklers, fire brigade, and

remaining SSD equipment to limit the effects of a fire and to shut down the nuclear

reactor. Therefore, this finding is characterized as Green (Section 1 R05._).

Green. An NCV of TS 6.8.1 was identified for inadequate procedural steps. For a fire in

fire area 1-A-ACP, AOP-36 steps 2.C and 14.A (which involved removing fuses from

transfer panel 1 B near the door to the fire area) involved excessive challenges to

operators. Challenges included exposure to smoke that would leak past the door and to

the fire brigade who would be opening the door, entering a narrow energized electrical

cabinet, and using a metal screwdriver inside the cabinet and seven feet above the floor

with poor visibility and poor labeling. There was not reasonable assurance that all

auxiliary operators (AOs) could perform the steps during a fire. Consequently, operators

may not be able to manually start the auxiliary feedwater pump that was relied upon for

SSD.

This finding had a credible impact on safety because it could result in inability to operate

equipment that was relied upon for SSD from a fire. However, the finding was of very

low safety significance because of the low fire initiation frequency, fire brigade, and

remaining SSD equipment to limit the effects of a fire and to shut down the nuclear

reactor. Therefore, this finding is characterized as Green (Section 1 R05._).

Green. An NCV of TS 6.8.1 was identified for an inadequate procedure for SSD from a

fire. For a fire in areas l-A-BAL-B or l-A-ACP, there too many AOP-36 contingency

actions, to respond to potential spurious actuations, for the one available SSD AO to

perform. Examples included continuously locally manually throttling the charging

system flow control valve bypass valve while at the same time locally manually closing a

steam generator power operated relief valve that could stick open in a different area of

3

the plant; or at the same time locally manually controlling auxiliary feedwater flow in

another area of the plant. Consequently, a main steam line break event may not be

stopped or auxiliary feedwater may be lost.

This finding had a credible impact on safety because it could result in inability to prevent

an initiating event or to operate equipment that was relied upon for SSD from a fire.

However, the finding was of very low safety significance because of the low fire initiation

frequency, automatic sprinklers, fire brigade, and remaining SSD equipment to limit the

effects of a fire and to shut down the nuclear reactor. Therefore, this finding is

characterized as Green (Section 1 R05_).

Green. An NCV of TS 6.8.1 was identified for an inadequate procedure for SSD from a

fire. For a fire in area 1-A-BAL-B, AOP-36 directed operators to take CSIP suction from

the boric acid tank (BAT) even if BAT level indication were lost. However, the charging

volume needed for reactor coolant system (RCS) cooldown would have emptied the

BAT and damaged the CSIP.

This finding had a credible impact on safety because it could result in loss of equipment

that was relied upon for SSD from a fire. However, the finding was of very low safety

significance because of the low fire initiation frequency, automatic sprinklers, fire

brigade, and remaining SSD equipment to limit the effects of a fire and to shut down the

nuclear reactor. Therefore, this finding is characterized as Green (Section 1 R05L.

Green. An NCV of OLC 2.F and TS 6.8.1 was identified for failing to provide battery-

backed emergency lights for operators to perform actions for SSD from a fire. For a fire

in SSA areas 1 -A-BAL-B-B1, 1 -A-BAL-B-B2, 1 -A-BAL-B-B4, 1 -A-BAL-B-B5, 1-A-EPA, 1-

A-BATB, or 1-A-ACP; many operator actions had no adequate battery-backed

emergency lights. Some of those actions had no emergency lights at all. However,

some had fluorescent lights that would be powered by the emergency diesel generators

during a LOOP, but those lights had not been approved by the NRC as an exemption

from the requirement for battery-backed emergency lights.

This finding has a credible impact on safety because it could result in operators failing to

perform SSD actions in an accurate and timely manner. However, the finding was of

very low safety significance because operators had flashlights available which would

have enabled them to perform the actions. Therefore, this finding is characterized as

Green (Section 1 R05_).

Report Details

1.

REACTOR SAFETY

Cornerstones: Initiating Events and Mitigating Systems

1R05 FIRE PROTECTION

.01

Systems Required To Achieve and Maintain Post-Fire SSD Circuit Analysis

a.

Inspection Scope

The team evaluated the licensee's approved fire protection program (FPP) against

applicable requirements, including Operating License NFP-63, License Condition 2.F,

Fire Protection Program (FPP); Branch Technical Position (BTP) Chemical Engineering

Branch (CMEB) 9.5-1 (NUREG-0800), July 1981; related NUREG 1038, NRC Safety

Evaluation Reports (SERs); and plant Technical Specifications (TS). The team evaluated

all areas of this inspection, as documented below, against these requirements.

The team used the licensee's Individual Plant Examination for External Events (IPEEE)

and in-plant tours to select four risk significant fire areas/zones for inspection. The four

fire areas/zones selected were:

Fire Zone 1-A-4-CHLR; part of Fire Area 1-A-BAL-B:

This fire zone was located on the 261 foot level (ground level) of the auxiliary building. It

was further subdivided in the licensee's SSA into SSA areas 1-A-BAL-B-B1 [including

the "A" chiller and motor-driven AFW pumps flow control valves (FCVs)] and SSA area 1-

A-BAL-B-B2 (including the "B" chiller and turbine-driven TDAFW pump FCVs). A

significant fire in either of these areas would require shutdown of the unit from the main

control room (MCR) and additional manual operator actions in various areas of the plant.

Fire Zone 1-A-4-COM-E; part of Fire Area 1-A-BAL-B:

This fire zone was located on the 261 foot level (ground level) of the auxiliary building. It

was further subdivided in the licensee's SSA into SSA areas 1-A-BAL-B-B4 (including

480V MCC 1B35-SB) and 1-A-BAL-B-B5 (including 480V MCC 1A35-SA). A significant

fire in either of these areas would require shutdown of the unit from the main control

room (MCR) and additional manual operator actions in various areas of the plant.

Fire Area 1-A-EPA:

This fire zone was located on the 261 foot level (ground level) of the auxiliary building. It

included electrical penetration room 'A'. A significant fire in this area would require

shutdown of the unit from the MCR and additional manual operator actions in various

areas of the plant.

Fire Area 1-A-BATB:

This fire zone was located on the 286 foot level (above ground level) of the auxiliary

building. It included the 'B' electrical battery room. A significant fire in this area would

require shutdown of the unit from the MCR and additional manual operator actions in

various areas of the plant.

2

The team reviewed the post-fire SSD capability and the fire protection features to verify

that at least one post-fire safe shutdown success path would be maintained free of fire

damage during a fire in any of the selected fire areas/zones. The team reviewed the

licensee's fire protection program, including the SSA and supporting calculations, to

determine the systems required to achieve post-fire SSD. The team also reviewed the

safe shutdown equipment list (SSEL), system flow diagrams, and the fire area hazards

analysis in the Updated Final Safety Analysis Report (UFSAR) for each of the selected

fire areas to evaluate the completeness and adequacy of the SSD analysis and the

systems relied upon to mitigate fires in the selected fire areas. Specific licensee

documents and drawings reviewed during the inspection are listed in the Attachment.

b.

Findings

The team found that the licensee's SSA method for dealing with problem cables, that

were required for control room operation of safe shutdown equipment during a fire in a

certain area but were not physically protected from that fire, was primarily to rely on

operator manual actions (e.g., locally open the breaker to an MOV and locally operate

the MOV using the handwheel.) Only if no operator action could be found would Harris

physically protect the cables. Consequently, the licensee had over 100 local manual

operator actions that they relied on for hot shutdown. The licensee did not request

deviations from the NRC for these operator actions. This SSD methodology contributed

to the findings that are described in the following sections of this report.

.02

Fire Protection of SSD Capability

a.

Inspection Scope

The team reviewed UFSAR Section 9.5.1, Appendix 9.5A, Fire Hazards Analysis (FHA);

the FPP manual; and plant administrative fire prevention/combustible hazards-ignition

source control procedures. This review was to verify that the objectives established by

the NRC-approved FPP were satisfied. The team also toured the selected plant fire

areas observing the licensee's implementation of these procedures. The team also

reviewed the FPP transient combustible permit logs, and fire emergency/incident

investigation reports, for the years 2000-2002. Corrective action program Action

Requests (ARs) resulting from fire, smoke, sparks, arcing, and equipment overheating

incidents for the same period were also reviewed to assess the effectiveness of the fire

prevention program and to identify any maintenance or material condition problems

related to fire incidents.

The team reviewed flow diagrams and engineering calculations associated with the B'

battery room heating ventilation and air conditioning (HVAC) systems. This review was

done to verify that systems used to accomplish safe shutdown would not be inhibited by

a potential hydrogen gas fire in the 'B' battery room due to inoperable ventilation supply

and exhaust fans. The team also reviewed the TS LCO requirements for loss of

ventilation in the 'B' battery room to verify that appropriate timely actions were specified

to ensure that hydrogen gas concentrations generated by the station batteries remained

below explosive limits.

3

The team also toured the plant's primary fire brigade staging and dress-out areas to

assess the condition of fire fighting and smoke control equipment. Fire brigade personal

protective equipment located in brigade staging area lockers was reviewed to evaluate

equipment accessibility and functionality. Additionally, the team examined whether

backup emergency lighting was provided for access pathways to and within the fire

brigade staging and dress-out areas in support of fire brigade operations should a power

failure occur during the fire emergency. The team also observed whether emergency

exit lighting was provided for personnel evacuation pathways to the outside exits as

identified in the National Fire Protection Association (NFPA) 101, Life Safety Code and

Occupational Safety and Health Administration (OSHA) Part 1910, Occupational Safety

and Health Standards. The adequacy of the fire brigade self-contained breathing

apparatus (SCBAs) was reviewed as well as the availability of supplemental breathing air

tanks. Team members also toured the selected fire areas and compared the associated

fire pre-plans with as-built plant conditions. This was done to verify that they were

consistent with the fire protection features and potential fire conditions described in the

UFSAR. Additionally, the team reviewed drawings and engineering flood analysis

associated with the 261' elevation reactor auxiliary building floor and equipment drain

system to verify that those actions required for ASD would not be inhibited by fire

suppression activities or leakage from fire suppression systems.

The team reviewed the fire brigade response procedure, fire brigade organization,

training and drill program administration procedures. Fire drill critiques of operating shifts

for the period of March 2001 through October 2002 were reviewed to verify that fire

brigade drills had been conducted in high fire risk plant areas. Fire brigade training/drill

records for 2002 were also reviewed to verify that the fire brigade personnel

qualifications, brigade drill response time, and brigade performance met the

requirements of the licensee's approved FPP. Additionally, the team observed a fire drill

to verify the licensee's implementation of the fire brigade organization, training, and drill

program administration procedures. The team observed the actions of the site fire

brigade, offsite fire department, and fire drill monitors; and attended the drill critique.

b.

Findings

No findings of significance were identified.

.03

Post-Fire SSD Circuit Analysis

a.

Inspection Scope

The team reviewed the adequacy of separation and fire barriers provided for the power

and control cabling of equipment relied on for SSD during a fire in any of the selected fire

areas/zones. On a sample basis, the team reviewed the electrical schematics for power

and control circuits of SSD components and looked for the potential effects of open

circuits, shorts to ground, and hot shorts. This review focused on the cabling of selected

components for the charging/safety injection system, AFW system, and component

cooling water (CC) system. The team traced the routing of cables by using the cable

schedule and conduit and tray drawings. Walkdowns were performed to compare 1-hour

and 3-hour barriers (conduit and tray wraps) to barriers indicated on the drawings.

Circuits and cabling routings were reviewed for the following equipment: 1 CS-169,

4

charging/safety injection pump (CSIP) suction cross connect MOV; 1CS-168, CSIP

suction cross connect MOV; 1CS-214, CSIP minimum flow MOV; 1CS-217, CSIP

discharge cross connect MOV; 1CS-218, CSIP discharge cross connect MOV; 1CS-219,

CSIP discharge cross connect MOV; 1CS-1 65, volume control tank (VCT) outlet MOV;

1 CS-1 66, VCT outlet MOV; 1 CS-278, boric acid tank (BAT) to CSIP MOV; BAT level

instrumentation; 1 CC-207, CC supply to RCP seals MOV; 1 CC-208, CC supply to RCP

seals MOV; 1 CC-252, CC return from RCP seals MOV; 1 CC-251, CC return from RCP

seals MOV; 1CC-249, CC return from RCP seals MOV; 1 RC-1 17, pressurizer power-

operated relief valve (PORV) block valve; 1 Sl-310, containment sump to 'A' RHR pump

MOV; 1SI-311, containment sump to 'B' RHR pump MOV; motor-driven AFW pump 1A;

motor-driven AFW pump 1 B; and turbine-driven AFW pump.

The team also reviewed studies of overcurrent protection on both AC and DC systems to

check whether fire induced faults could result in defeating the safe shutdown functions.

b.

Findinas

(1)

MOV 1CS-165. VCT Outlet to CSIPs

Introduction

The team identified an NCV of OLC 2.F, Fire Protection Program; and Technical Specification (TS) 6.8.1, Procedures and Programs; for failing to provide a fire barrier to

protect equipment (MOV 1CS-165), that was relied upon for safe shutdown (SSD), from

maloperation due to a fire; and for failing to provide procedural guidance for operators to

prevent or mitigate the maloperation.

Description

The team found that the control power cable for charging system MOV 1 CS-165, which

was relied upon to remain open for SSD during a fire in SSA areas 1-A-BAL-B-B1 and 1-

A-BAL-B-B2, and in fire area 1-A-EPA, was routed through those areas with no fire

barrier. This lack of a required fire barrier was not recognized in the SSA and no

procedural guidance was included in AOP-36, Safe Shutdown Following a Fire, Rev. 21,

for operators to prevent or mitigate maloperation of 1 CS-165 prior to damage occurring

to SSD equipment. Consequently, a fire in one of the three areas could cause 1CS-1 65

to spuriously close, stop all CSIP suction, and immediately damage the operating SSD

CSIP.

The SSD analysis for a fire in areas 1 -A-BAL-B-B1, 1 -A-BAL-B2, or 1-A-EPA was to rely

on SSD division 2 equipment. This included reliance on CSIP 'B' for RCS makeup water,

RCP seal cooling, reactivity control by boration, and high pressure safety injection. CSIP

'A' was not assured to be unaffected by the fire and CSIP 'C' was not assured to be

available. Consequently, a failure of CSIP 'B' could result in a loss of all charging and

high pressure safety injection. Also, for a fire in any of these three areas, CC to the RCP

seals was not protected. The team found that the control power cable to MOV 1 CC-207,

CC flow to RCP seals, was also routed through the same three areas and in the same

cable tray with the control power cable to 1 CS-165. Spurious closure of MOV 1 CC-207

would stop all CC flow to the seals of all three RCPs. Thus the potential consequences

5

of a fire in any of the three areas could be an RCP seal LOCA with no operable CSIP.

In addition, the team found that the control power cable for MOV 1 CC-252, CC return

from RCP seals, was routed through SSA area 1-A-BAL-B-B2 and could be affected by a

fire in that area. AOP-36 included an operator action to prevent spurious actuation of

1 CC-252 for a fire in SSA area 1 -A-BAL-B-B2. That action included opening the breaker

to the MOV on MCC 1 E12. However, the SSD AO would likely not be able to safely do

that during a fire in SSA area 1 -A-BAL-B-B2 because MCC 1 El2 was located in that

area. Spurious closure of 1CC-252 would stop all CC to the RCP seals. The team noted

that, while this operator action may not be needed for a fire in SSA area 1 -A-BAL-B-B2

because the charging system was supposed to provide RCP seal cooling, this

inappropriate procedural action (sending an operator into an area on fire) could delay the

SSD AO from performing other actions that were needed.

The team found that modification ESR 01-00087, which was installed in about January

2002, had affected this condition and missed an opportunity to correct it. ESR 01-00087

changed the CSIP mini-flow path so that it would go to the VCT instead of bypassing the

VCT and going directly to the CSIP suction. Prior to the ESR, if 1 CS-1 65 spuriously

closed, the running CSIP would still have some suction although probably not enough to

prevent pump damage. After the ESR, if 1CS-165 spuriously closed, the running CSIP

would have no suction and its failure would be more certain and more immediate. ESR

01 -00087 failed to recognize this effect and missed an opportunity to identify and correct

the condition.

Analysis

This finding had more than minor safety significance because it affected the Mitigating

Systems and Initiating Events objectives of the Reactor Safety Cornerstone. The finding

affected the availability and reliability of systems that mitigate initiating events to prevent

undesirable consequences. It also affected the likelihood of occurrence of initiating

events that challenge critical safety functions. However, the finding was of very low

safety significance because of the low fire initiation frequency and probability of spurious

actuations, and the effectiveness of automatic sprinklers, fire brigade, and remaining

SSD equipment to limit the effects of a fire and to shut down the nuclear reactor.

Therefore, this finding is characterized as Green.

Enforcement

OLC F. required that the licensee implement and maintain in effect all provisions of the

approved fire protection program as described in the Final Safety Analysis Report. The

UFSAR, Section 9.5.1, Fire Protection Program, stated that outside containment, where

cables or equipment (including associated non-essential circuits that could prevent

operation or cause maloperation due to hot shorts, open circuits, or shorts to ground) of

redundant safe shutdown divisions of systems necessary to achieve and maintain cold

shutdown conditions are located within the same fire area outside of primary

containment, one the redundant divisions must be ensured to be free of fire damage.

Section 9.5.1 further stated that one division is to be protected from fire damage by one

of three methods: 1) a three-hour fire barrier, 2) a one-hour fire barrier plus automatic

detection and suppression, or 3) a 20-foot separation with no intervening combustibles

6

and with automatic detection and suppression.

TS 6.8.1 required procedures as recommended by Regulatory Guide (RG) 1.33 and

procedures for fire protection program implementation. RG 1.33 recommended

procedures for combating emergencies, including fires. The licensee's interpretation of

their fire protection program was that they could and would rely on operator actions in

place of physical protection of SSD equipment (see Section

).

However, the

licensee had failed to provide procedural guidance in AOP-36 for operators to prevent

the maloperation of MOV 1CS-165.

Contrary to the above requirements, the licensee failed to protect MOV 1 CS-165 from

maloperation due to a fire where it was relied on for SSD. Because the licensee entered

the finding into the corrective action program as AR76260, this item is being treated as

an NCV in accordance with Section VI.A.1 of the NRC's Enforcement Policy. This item is

identified as NCV 50-400/02-11 -01, Failure to Protect MOV 1 CS-1 65, VCT Outlet to

CSIPs, From Maloperation Due To a Fire.

(2)

MOV 1CC-251. CC Return From RCP Seals:

and MOV 1 CC-208. CC Supply To RCP Seals

Introduction

The team identified an NCV of OLC 2.F and TS 6.8.1 for failing to provide a fire barrier

to protect equipment (MOV 1 CC-251 and MOV 1 CC-208) that was relied upon for SSD

from maloperation due to a fire, and for failing to provide procedural guidance for

operators to prevent or mitigate the maloperation.

Description

The team found that the control power cables for CC system MOVs 1 CC-251 and 1 CC-

208, which were relied upon to remain open for SSD during a fire in area 1-A-BAL-C,

were routed through that area with no fire barrier. Fire area 1-A-BAL-C was located on

the 286 foot level of the auxiliary building, above electrical penetration room 'B'. This

lack of a required fire barrier was not recognized in the SSA and no procedural guidance

was included in AOP-36 for operators to prevent or mitigate maloperation of these

valves. Consequently, a fire in this area could cause 1 CC-251 or 1 CC-208 to spuriously

close, which would stop all CC to the RCP seals.

The SSD analysis for a fire in area 1-A-BAL-C was to relyon SSD division 1 equipment.

This included reliance on CC to cool the RCP seals. CSIP supply to the RCP seals was

not assured to be unaffected by the fire. Consequently, a loss of CC to the RCP seals

could result in a loss of all RCP seal cooling which could in turn result in an RCP seal

failure and a LOCA.

Analysis

This finding had more than minor safety significance because it affected the Initiating

Events objective of the Reactor Safety Cornerstone. The finding affected the likelihood

of occurrence of initiating events that challenge critical safety functions. However, the

7

finding was of very low safety significance because of the low fire initiation frequency and

probability of spurious actuations, and the effectiveness of automatic sprinklers, fire

brigade, and remaining SSD equipment to limit the effects of a fire and to shut down the

nuclear reactor. Therefore, this finding is characterized as Green.

Enforcement

As described in Section .03.b.1 above, OLC F. required equipment relied upon for SSD

be physically protected against maloperation due to the fire. Also, TS 6.8.1 required

procedures for implementing the fire protection program and for combating fires.

Contrary to the above requirements, the licensee failed to protect MOV I CS-1 65 from

maloperation due to a fire where it was relied on for SSD. Because the licensee entered

the finding into the corrective action program as AR 80089, this item is being treated as

an NCV in accordance with Section VI.A.1 of the NRC's Enforcement Policy. This item is

identified as NCV 50-400/02-11-02, Failure to Protect MOVs 1 CC-251 and 1 CC-208, CC

for RCP Seals, From Maloperation Due To a Fire.

(3)

MOV 1CS-169, CSIP Suction Cross-connect: MOV 1CS-214. CSIP Mini-flow Isolation:

MOV 1CS-218. CSIP Discharge Cross-connect: and MOV 1CS-219. CSIP Discharge

Cross-connect

Introduction

The team identified an NCV of OLC 2.F and TS 6.8.1 for failing to provide a fire barrier to

protect equipment (MOVs 1 CS-1 69,1 CS-214,1 CS-218, and 1 CS-219) that was relied

upon for SSD from maloperation due to a fire, and for failing to provide procedural

guidance for operators to prevent or mitigate the maloperation.

Description

The team found that the control power cables for charging system MOVs 1 CS-1 69, 1 CS-

214,1 CS-218, and 1 CS-219, which were relied upon to remain open for SSD during a fire

in area 1-A-BAL-B-B5, were routed through that area with incomplete fire barriers. The

control cables were unprotected for about one foot above MCC 1-A35-SA and inside the

MCC.

This lack of a required fire barrier was recognized in the SSA for 1 CS-I 69,1 CS-214, and

ICS-218, and procedural guidance was included in AOP-36 for operators to prevent

maloperation of these valves. However, the procedural guidance was not adequate.

AOP-36 directed operators to go to MCC 1 -A35-SA and open the breakers for 1 CS-169

and 1 CS-214 to prevent spurious operation. However, operators would not be able to

safely do that because the actions were in the area of the fire that could cause the

spurious operation. AOP-36 directed operators to go to MCC 1-B35-SB, in another

room, to open the breaker for 1 CS-218. However, operators would not be able to do that

because the breaker for 1 CS-218 was actually located on MCC 1 -A35-SA. AOP-36

included no operator guidance for 1 CS-219.

AOP-36 did include the following guideline for operators: "Monitor for spurious valve and

8

pump operation which may result in equipment damage (for example, CSIP suction

valves.)" The team noted that closure of a CSIP suction valve could result in pump

damage within seconds; before operators could respond to an annunciator, analyze the

condition, and take action to prevent pump damage. Another AOP-36 guideline was:

'When directed by the Unit SCO, then shut down equipment and de-energize electrical

busses located within the fire area." Operators stated that they would de-energize MCC

1-A35-SA if the fire brigade team leader or another operator told them that the MCC was

on fire or if they observed spurious actuations that could be initiating from the MCC.

However, the team noted that the fire brigade would not arrive at the fire until about 22

minutes after the control room sounded the fire alarm, and spurious actuations could well

occur before that. By procedure, control room operators would respond to a single fire

detector annunciator by sending an AO to verify that there was a fire and that the fire was

large enough to warrant sounding the fire alarm and calling out the fire brigade.

However, if the control room received annunciation from two or more fire detectors,

which would be very likely in the event of fire large enough to present an operational

safety concern, then they would not send an AO but instead would immediately sound

the fire alarm and call out the fire brigade. So it was likely that the first visual report on

the fire would not be received in the control room until about 22 minutes after the fire

alarm. By that time, the fire would likely have filled the room with smoke so that the fire

brigade may not be able to see if the MCC was on fire.

The team concluded that it was unlikely that the control room would de-energize MCC 1-

A35-SA before spurious actuations could occur. Consequently, a fire in this area, near

MCC 1A35-SA, could cause any of the four MOVs to spuriously close. Closure of 1CS-

214 would stop all mini-flow from all CSIPs. Closure of 1CS-218 or 1CS-219 would stop

charging flow from SSD CSIP 'B'.

If such a loss of charging flow or CSIP mini-flow

occurred, operators would receive an alarm in the control room and would probably have

time to diagnose the condition and initiate recovery action. However, closure of 1 CS-1 69

would stop all suction to SSD CSIP 'B' and immediately damage the pump.

The SSD analysis for a fire in area 1-A-BAL-B-B5 was to rely on SSD division 2

equipment. This included reliance on CSIP 'B' for RCS makeup water, RCP seal cooling,

reactivity control by boration, and high pressure safety injection. CSIP 'A' was not

assured to be unaffected by the fire and CSIP 'C' was not assured to be available. The

team noted that MOVs powered from MCC 1-A35-SA could affect CSIP 'A' and CSIP 'C".

Consequently, a failure of CSIP 'B' could result in a loss of all charging, RCP seal

cooling, and high pressure safety injection. Thus the potential consequences of a fire in

SSA area 1 -A-BAL-B5 could be an RCP seal LOCA with no operable CSIP.