Text

Proposed Response to Denial of Non-cited Violation for Comanche Peak
	ML100390025
Person / Time
Site:	Comanche Peak
Issue date:	02/08/2010
From:	Caniano R; Division of Reactor Safety IV
To:	Sosa B; NRC/OE
References
	EA-09-306
	Download: ML100390025 (77)
	v • d • e

EA 09-306 MEMORANDUM TO:

FROM:

SUBJECT:

Purpose UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 612 EAST LAMAR BLVD, SUITE 400 ARLINGTON, TEXAS 76011-4125 Belkys Sosa, Deputy Director Office of Enforcement Roy J. Caniano, Director Division of Reactor Safety Region IV PROPOSED RESPONSE TO DENIAL OF NON-CITED VIOLATION FOR COMANCHE PEAK This memorandum is to provide the results of Region IV's review of Non-cited Violation 05000445/2009004-05; 00500446/2009004-05, "Failure to Assure that One Train of Equipment is Free from Fire Damage." This violation was denied by the licensee by letter dated November 23, 2009 (ml093350541 ). Region IV has reviewed the licensee's contentions and all applicable supporting documentation, and has concluded that this violation was appropriate and valid.

Background

Between 1986 and 1988, during initial licensing, the fire protection program and specifically the safe shutdown analysis were reassessed by the licensee and the NRC. The reassessment and design confirmation resulted in revisions to many of the fire protection program documents, including those already reviewed by the NRC. As a result, the documentation for the fire protection licensing basis and design basis is complex.

During the first three triennial fire protection inspections at Comanche Peak (2002, 2005, and 2008), inspectors have had concerns about operator actions within fire protection documents.

Unresolved item 05000445; 05000446/2008006002 was issued to resolve the issue. Non-cited Violation 05000445/2009004-05; 00500446/2009004-05, "Failure to Assure that One Train of Equipment is Free from Fire Damage," was issued on October 27, 2009, after consulting with the Fire Protection Branch in NRR.

The subject of this violation is specific to unapproved operator actions performed outside the control room that are used to restore equipment required to achieve and maintain safe shutdown due to fire damage. The violation relates to lii.G.2 areas where the required equipment was supposed to have been rendered free of fire damage by one of the approved methods for separation or protection. The examples cited involved actions to align injection from auxiliary feedwater and charging, and then control flow using local operator actions

because the licensee did not ensure that instrument air needed free of fire damage.

Violation Statement these functions would be The Unit 1 License Condition 2.G states, "Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Finai Safety Anaiysis Report through Amendment 78 and as approved in the Safety Evaluation Report (SER) (NUREG-0797) and its supplements through SSER 24." In Supplemental Safety Evaluation Report 12, the NRC staff concluded from review of the "Fire Protection of the Safe Shutdown Capability" against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b, "The applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability."

Contrary to the above, the licensee faiied to properly implement the approved fire protection program. Specifically, the licensee did not assure that one train of equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage. The fire protection program, as implemented, relied on the use of local operator manual actions to operate components required to achieve and maintain safe hot shutdown conditions resulting from potential fire damage thus providing less physical separation and protection from the affects of fire than required by the approved fire protection program.

licensee's Contentions The licensee's contentions are listed in Luminant letter CP-200901579 dated November 23, 2009 (ADAMS ML093350541; provided in Attachment 1 ). This letter refers to licensing basis documents and documents which are not part of the licensing basis to support their contention that the licensing basis for Comanche Peak allowed credit for operator actions to ensure that one train or equipment required to achieve and maintain safe hot shutdown conditions remained free of fire damage.

Region IV Review Region IV has reviewed the licensee's contentions and a!! applicab!e supporting documentation, and has concluded that this violation was appropriate and remains valid. Specifically, the NRC did not approve of using operator actions to restore the required functions provided by auxiliary feedwater or charging in lieu of providing the required separation or protection, as the licensee contends. The licensee provided no new documentation to support their position. The licensee's letter denying the violation included a sworn affidavit in support of a contention that the NRC failed to include the staffs review and approval of operator actions, which was new information not specifically considered during the inspection.

The licensee's denial letter essentially states that the staff understood that the Comanche Peak Fire Safe Shutdown Analysis incorporated operator actions in order to assure that systems required to reach and maintain a safe shutdown condition were "free of fire damage." Region IV, in consultation with the Fire Protection Branch in NRR, has concluded that the NRC did not approve of operator actions in lieu of protecting required systems. This is based on the following:

No safety evaluation report statement specifically approved the use of operator actions to restore the auxiliary feedwater and charging functions in lieu of providing the required separation and protection necessary to ensure those required functions would be available.

Approval of a proposed method of compliance which does not meet the requirement must be requested, the basis for meeting the intent of the requirement justified, and the NRC must explicitly approve the request in a deviation in an SER. The licensee did not propose or justify a deviation for the operator actions that are the subject of the violation, and the SSERs do not approve of such a deviation.

Because there are no such statements in Safety Evaluation Reports, the licensee's position amounts to a claim of tacit approval by the staff. NRC Management Directive 8.4, "Management of Facility-Specific Backfitting and information Collection," defines tacit acceptance/approval as being: "when the NRC's silence to a licensee request is, by rule, deemed to be approval. Instances of tacit acceptance are rare; silence or lack of comment by the NRC staff where the NRC's rules do not require an NRC response does NOT constitute tacit acceptance." With respect to the licensee's specific claim that inspectors were aware of the condition that led to this violation, NUREG 1409, "Backfitting Guidelines," Section 3.3(1) states:

"cases where an inspector provides tacit approval are rare. Simply not challenging a licensee's practice would not be considered tacit approval." It goes on to state: "Explicit approval could be provided in an inspection report that states that a particular approach is acceptable. However, conclusions of that nature are usually made in safety evaluation reports rather than inspection reports."

The licensee's denial argument attempts to exploit significant inconsistencies within site fire protection documentation. In particular, the documents submitted for NRC review conclude that adequate protection and separation exist, while the underlying analyses show that operator actions were credited to restore required functions following fire damage.

The relevant documents that were submitted for NRC review were:

Final Safety Analysis Report, Section 9.5.1 Fire Protection Report (FPR)

Fire Hazards Analysis Report (FPR Section II)

Fire Safe Shutdown Analysis Report (FPR Section Ill)

Documents that were referenced in the denial letter but were not docketed, and therefore are not part of the current licensing basis, were:

Design Basis Document ME-020, "Fire Safe Shutdown Analysis,"

Calculation ME-CA-0000-1086, "Fire Safe Shutdown Analysis for Unit 1 and Common" EPM-P-257-152, Safe Shutdown Analysis for Unit 1 and Common" The results of the applicant's Fire Safe Shutdown Analysis (FSSA) were reported to the staff for review in the Fire Hazards Analysis Report (FHAR), listing acceptance criteria which matched NRC requirements. In each fire area, the applicant concluded that these separation and protection requirements were met. The Fire Safe Shutdown Analysis Report, which reported the results and a summary of the methodology of the FSSA, included a reference to the use of operator actions. This reference is not specific about how operator actions were credited, and did not include the intent or list specific examples. In the documents that describe the detailed method to be used and the detailed results of the FSSA, the license analysts began crediting operator actions when protection and separation was not assured during the 1986 - 1988 reanalysis. This change may have been caused by the identification of additional equipment needed to achieve and maintain a safe shutdown condition. The two calculations that describe the results of the FSSA include lists of numerous operator actions without describing the intent of the actions. This lack of documentation has made it difficult for inspectors to determine whether the licensee was in compliance. However, the newer of the two caiculations (ME-CA-0000-1086, Revision 0, 1987) included a discussion that loss of instrument air could require generic operator actions in any fire area. The subject violation relates directly to those potential fire damage scenarios, since two functions that are required to achieve and maintain safe shutdown cannot be assured without reliance on operator actions due to potential fire damage to the instrument air system.

During licensing, an NRC inspection identified concerns about some operator actions. An unresolved item was written to address whether actions to address spurious operation of associated circuits (non-required equipment which could prevent fulfillment of a required function) could be reliably performed. This URI specifically focused on those actions that were performed in the same fire area as the postulated fire. The licensee's denial letter used this inspection to show that the staff reviewed the FSSA calculation which included operator actions that were not otherwise submitted for NRC review. This inspection is the basis for the iicensee's claim of NRC approval.

Region IV, with NRR input, has concluded that Inspection Reports 87-22 and 88-39, the URi closure, and associated SSER 21 discussion involve specific approval of operator actions for spurious operation of associated circuits. These documents do not reflect NRC review or approval of operator actions for any other purpose (see below for discussion on approved operator actions). Further, Inspection Report 87-22 makes specific mention of not being able to sort out the operator actions listed in the FSSA ca!cu!ation.

In contrast to the licensee's documents, the NRC's documentation in SSERs 12 and 21 is consistent. It shows that the staff believed that the separation and protection requirements were being met without reliance on operator actions. These SSERs reflect the conclusions documented in the FHA.R. and FSSA.R, which were submitted for NRC review. The SSERs do not reflect the details about the use of operator actions in the Design Basis Document or the Fire Safe Shutdown Analysis calculations, which were not submitted for NRC review.

Region IV has concluded that the licensee failed to identify that the instrument air system was required to be available in order to support the charging and auxiliary feedwater functions. As a result, they failed to classify this system as a required system for achieving post-fire safe shutdown. This misclassification caused this system to be left out of analyses to determine whether the required systems were properly separated and protected. As a result, licensing basis documents concluded that separation and protection requirements for required systems were met. The fact that operator actions to restore the auxiliary feedwater and charging functions are necessary in order to successfully achieve a post-fire safe shutdown condition was never clearly stated in any document.

Air systems have an unusual vulnerability to fire that is not typical of mechanical systems. Air systems are typically fabricated using low-temperature silver brazed joints, which can fail when exposed to expected fire temperatures. The nature of the system makes it impractical to protect from fire damage. The instrument air system at Comanche Peak is not a safety-related system, so there is no redundant train available in the event of a failure. As a result, most licensees designed a fire protection program such that there is no reliance on instrument air.

After SSER 12 was issued, during a reanalysis of the Fire Safe Shutdown Anaiysis (FSSA), the applicant identified the dependence on instrument air and added operator actions to their FSSA methodology. Changes were made in the description of the FSSA methodology, but not in the more visible portions of the Fire Protection Report or FSAR. Design Basis Document DBD-ME-020 includes some discussion that separation and protection requirements may be augmented by operator actions to justify a level of fire protection (existing or proposed) commensurate with the regulatory guidelines and CPSES commitments. While the meaning of "augmented" remains unclear, this would appear to be the starting point for requesting a deviation. No such deviation was submitted, and the licensee has not identified any document that included a justification for reliance on operator actions in order to provide a level of safety commensurate with the NRC's separation and protection requirements. Region IV concluded that none of the licensing basis documents submitted to the NRC state this dependency on instrument air, the impact of loss of instrument air, or list any specific operator actions associated with the assumptions and criteria associated with the methodoiogy.

One minor discrepancy was noted during this review. The violation was issued by referring to the NRC's approval of the pertinent part of the fire protection program in SSER 12. However, SSER 21 documented the review of changes made to the FSSAR. Note that SSER 21, Section 9.5.1, does not supersede the same section in SSER 12. Instead, it treats the revision to the program as an update. The criteria used to review the fire protection program was also changed in SSER 21 from Branch Technical Position CMEB 9.5-1, to Appendix A of Branch Technical Position APCSB 9.5-1, Sections G, J, L, and O of Appendix R (applied as a guideline), and the guidance issued in Generic Letters 81-12 and 86-10. Although the FHAR conclusions and the staffs conclusions were identical, it would have been more appropriate to refer to the staffs conclusions in both SSERs 12 and 21 in the violation.

Region IV's review noted the NRC approved the use of operator actions in some specific cases for Comanche Peak:

None of the 30 approved deviations allowed operator actions, The operator actions involved in the disputed NCV were not the subject of a deviation request or approval.

Operator actions to terminate the effects of spurious operations caused by fire damage to circuits identified by the licensee that could affect safe shutdown (known as associated circuits) were approved by the staff. The operator actions invoived in the disputed NCV do not involve associated circuits.

The staff approved operator actions for alternative shutdown, as allowed by the requirements for this type of area (at Comanche Peak, only the main control room and cable spreading rooms are designated as complying with alternative shutdown requirements). The operator actions involved in the disputed NCV do not involve alternative shutdown issues.

For completeness, Region IV confirmed with the licensee that operator actions involved in this violation were never part of a change to the approved fire protection program as described in their license condition for the fire protection program.

The licensee's letter states that the NRC's contention in the denied violation is different from what was approved during licensing, and if the NRC maintains this position, this may constitute a backfit. In a conversation with Neil O'Keefe on February 1, 2010, Mr. Fred Madden, Director, Regulatory Affairs, stated that it was not Luminant's intention to claim a backfit or request an NRC review of whether the violation involved a backfit. Mr. Madden stated that the intention was to mention the possibility that a backfit might be involved. Therefore, no backfit review was performed as part of this enforcement review.

The licensee's letter claimed that operator actions were approved by the staff to make some equipment free of fire damage, but the violation clearly documents that the need for the disputed operator actions is created by a susceptibility to fire damage. The operator actions cannot undo the fire damage. provides a summary of Region IV's assessment of the statements made in the licensee's letter. These statements are individually placed into context. Attachment 2 also discusses pertinent licensing basis documents which were not mentioned or were not discussed in detail in the licensee's letter. The licensee's letter includes statements and an affidavit which reflect the recollections of licensee workers. These statements are not supported by the licensing basis, although they provided some context to the words in Inspection Report 87-22.

Requested Action Region IV requests that the Office of Enforcement review Region IV's proposed response and the supporting documentation in accordance with Section 3.1. 7 of the Enforcement Manual.

This review is requested to be completed by February 16, 201 O in order to support a 90-day response to the licensee.

The Region IV contact for this issue is Neil O'Keefe, Chief, Engineering Branch 2. He can be reached at (817) 860-8137.

Attachments:

1. Luminant Letter CP-200901579, dated November 2009 (ML093350541)

2. Summary of Referenced Documentation

3. Assessment of Licensee's Statements and Licensing Documents

4. Inspection Report 05000445; 05000446/2009004, Section 4OA5.5

5. Excerpts From Documents Discussed in This Letter LUMINANT LETTER CP-200901579, dated November 23, 2009 (ML093350541)

II Luminant Rafael Flores Senior Vice President

& Chief Nuclear Officer rafael.flores@Luminant.com Luminant Power PO Box 1002 6322 North FM 56 Glen Rose, TX 76043 T 254 897 5550 C 817 559 0403 F 254 897 6652 CP-200901579 Log# TXX-09136 Ref. #

10 CFR 50.4 November 23, 2009 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555

SUBJECT:

COMANCHE PEAK STEAM ELECTRIC STATION DOCKET NOS. 50-445 AND 50-446 DENIAL OF NON CITED VIOLATION Il'.J NRC INTEGRATED INSPECT;ION REPORT 05000445/4462009004

REFERENCES:

1.

NRC Integrated Inspection Report 05000445 / 446 2009004 dated October 27, 2009 from Wayne C. Vv'alker of t..J"RC to Rafael Flores.

2.

Letter logged TXX-08105 dated July 24, 2008, from Rafael Flores of Luminant Power to the NRC submitting Comanche Peak Licensing Basis on Use of Manual Actions for Fire Protection.

Dear Sir or Madam:

NRC Inspection Report 2009004 for Comanche Peak Units 1 and 2 issued on October 27, 2009 (Reference

1) summarized the results of the Integrated Inspection for the third quarter of 2009. Per 10CFR50.4, and in accordance with the guidance in the Enforcement Policy, Lurninant Generation Company LLC (Luminant Power) hereby disputes one of the noncited violations identified in the report. A detailed assessment of this noncited violation is presented in the attachment.

A "Green" Finding was identified in the report for failure to ensure that one train of the equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage as specified in the approved fire protection program. The inspectors identified that the licensee relied upon local manual actions to mitigate the effects of potential fire damage rather than provide the physical separation or protection required in the approved fire protection program.

Reference 2 provided the Comanche Peak licensing basis on the use of manual actions as a means of ensuring that one train of systems necessary to achieve and maintain safe hot shutdown conditions is free of fire damage. Since before the initial licensing of Comanche Peak Unit 1 in 1990, the licensing basis for Comanche Peak allowed credit for manual actions to achieve and maintain safe shutdown. The attachment provides additional information concerning the Comanche Peak manual action license basis.

The NRC contention that local manual actions to mitigate the effects of potential fire damage rather than 1u,,v;rlt-' th.... 1,hv~;rr1l,P1,r11r1ti,n, lH 1uutt-"l t;,... lt""lHJ;,Pd ; ** the t1l.JlJflJVt""d f;,t' lJrutt"".l t;tHI u1uP-1c:1m ;:-,

r--*--------r--

r------------r*-------

--*1-

- rx 1

v different from what was approved at the time Comanche Peak Unit 1 was licensed.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

Corrt.anu'1e Peak

Diablo Canyon

Palo Verde

SaJ1 Onofre* South Texas Project

1l/olf Creek

TXX-09136 Page 2 11/23/09 This communication contains no new licensing basis commitments regarding Comanche Peak Units 1 and 2.

We respectfully request that you fully consider the information provided in the attached denial. Should you have any questions, please contact me at (254)897-8601 or Mr. Jack Hicks at (254)897-6725.

Sincerely, Luminant Generation Company LLC

fael~/v ~

/Fred W. Madden Director, Oversight & Regulatory Affairs Attachment-Enclosure-Denial of Noncited Violation in NRC Inspection Report 05000445 / 446 2009004 Affidavit of Harold R. Beck dated November 19, 2009 c -

E. E. Collins, Region IV B. K. Singal, NRR Resident Inspectors, Comanche Peak

ATTACHMENT TO TXX-09136 DENIAL OF NONCITED VIOLATION IN NRC INSPECTION REPORT 05000445/446 2009004

Attachment to TXX-09136 Page 1 of 9 NON CITED VIOLATION 05000445/446 2009004-05, "Failure to Assure that One Train of Equipment is Free From Fire Damage" Excerpt from pages 28-31 of NRC hlspection Report 2009004:

Introduction. The inspectors identified a Green noncited violation of Unit 1 License Condition 2.G and Unit 2 License Condition 2.G. Specifically, the licensee failed to ensure that one train of the equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage as specified in the approved fire protection program. The licensee relied upon local manual actions to mitigate the effects of potential fire damage rather than provide the physical separation or protection required in the approved fire protection program.

Description. The inspectors reviewed a sample of three fire areas in Unit 1, which do not require evacuation of the control room during the shutdown. The inspectors reviewed the approved fire protection program as defined in License Condition 2.G and determined that one train of equipment required to achieve and maintain hot shutdown is required to be free from fire damage. The inspectors noted that the approved fire protection program allows local manual actions to respond to spurious operations of other equipment that could impact the safe shutdown but do not directly perform the required safe shutdown functions.

The inspectors conducted walkdowns with operations personnel of Procedure ABN-804A, "Response To a Fire In The Safeguards Building," Revision 5, and Procedure ABN-806A, "Response To a Fire In The Electrical and Control Buildings," Revision 5. The inspectors found that the fire protection program, as implemented, relied on the use of local manual actions to align and control equipment required to achieve and maintain hot shutdown resulting from potential fire damage instead of assuring that one train was free from fire damage. This approach expanded the use of local operator manual actions outside of the control room beyond the response to spurious operations allowed in the approved fire protection program.

The inspectors concluded that the licensee's fire protection program, as implemented, provided less physical separation and protection from the affects of fire than the approved program required, and was inherently less reliable than ensuring that one train of the required systems remained free from fire damage.

An example of this concern was the licensee's treatment of air-operated valves in the charging and auxiliary feed water systems, which were required to perform the reactor coolant inventory control and decay heat removal functions, respectively. The licensee did not designate the instrument air system as a required support system and ensure it would remain free of fire damage, so air may not be available to operate these air-operated valves. Consistent with this approach, the licensee did not protect the circuits required to operate these air-operated valves from fire damage. These air-operated valves are normally controlled from the control room to reach and maintain hot shutdown. For postfire safe shutdown, the licensee did not assure the ability to control these valves from the control room by protecting valve control circuits or the air supply. Instead, the licensee relies on local manual actions outside of the control room to de-energize the air-operated valves to their failed positions, and in the case of the turbine-driven auxiliary feed water pump, to then control the turbine manually. The licensee also assigns an equipment operator to control flow to the steam generators by throttling other manual valves as directed by the control room operators via radio to compensate for the loss of control of the air-operated vaives.

The licensee disagreed with the inspectors' interpretation of the fire protection program requirements and believed the current program complies with their license condition. The licensee submitted the basis for their position in Luminant letter CP-200800962, TXX-08105, dated July 24, 2008. This issue was

Attachment to TXX-09136 Page 2 of 9 discussed with the license and the Office of Nuclear Reactor Regulation, and the staff has concluded that the NRC did not approve manual actions in lieu of protection for equipment required for safe shutdown(refer to Attachment 2 of this report).

Comanche Peak Unit 1 License Condition 2.G states:

"Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (I\\HJREG-0797) and its supplements through SSER 24."

In Supplemental Safety Evaluation Report 12, the NRC staff documented the review of the "Fire Protection of the Safe Shutdown Capability" against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b. The NRC staff concluded:

"The applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/ or alternative shutdov..rn capability;"

and "Associated circuits whose fire-induced spurious operation could affect shutdown were identified to determine those components whose maloperation could affect safe shutdown.

These spurious operations are terminated by operator actions. The applicant identified these operator actions and allowed the operator sufficient time to perform these actions. On the basis of its evaluation, the staff concludes that these operator actions will terminate spurious operations that could affect plant shutdown."(Emphasis added)

The manual actions discussed related to spurious actuations resulting from damage to associated circuits. The NRC staff did not discuss or approve any deviations from the requirements for physical separation or protection specified i.Jl the standard reviev; plan to allov; the use of local operator manual actions to operate components necessary to achieve or maintain hot shutdown. The licensee has entered this issue into their corrective actio17-program as Smart Form SMF-2009-004454-00.

Analysis. Failure to ensure that one train of the systems required for hot shutdown was free from fire damage was a performance deficiency. The inspectors determined that this finding was more than minor because it is associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences.

The inspectors initiated an evaluation of this finding using the significance determination process in Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving postfire safe shutdown systems.

Additional information was required from the licensee concerning the scope of components identified as requiring manual actions, the fire areas where the manual actions were required and the routing of the cables of interest within those fire areas for Unit 1. Thirty-three components required to achieve and maintain hot shutdown were identified for further evaluation. Plant walkdowns were performed in 12 fire areas to identify fire scenarios that could potentially damage the cables of interest for these 33 valves credited for establishing and maintaining hot shutdown.

Using the methodology in Manual Chapter 0609, Appendix F, the plant walkdown results identified seven fire scenarios in three fire areas with the potential to damage cables for eleven valves required to

Attachment to lXX-09136 Page 3 of 9 establish and maintain hot shutdown. Since the issue involved multiple fire areas, a modified Phase 2 analysis was developed to access the risk due to the seven fire scenarios. The analysis was reviewed by a senior reactor analyst, who confirmed the issue resulted in a total delta core damage frequency of 3.7 x 10-7 and that the issue had very low safety significance.

Enforcement. The Unit 1 License Condition 2.G states, "Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24." In Suppiemental Safety Evaluation Report 12, the NRC staff concluded from review of the "Fire Protection of the Safe Shutdown Capability" against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b, "The applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability."

Contrary to the above, the licensee failed to properly implement the approved fire protection program.

Specifically, the licensee did not assure that one train of equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage. The fire protection program, as implemented, ielied on the use of local operator manual actions to operate components required to achieve and maintain safe hot shutdown conditions resulting from potential fire damage thus providing less physical separation and protection from the affects of fire than required by the approved fire protection program.

Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-004454-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-05; 00500446/2009004-05, "Failure to Assure that One Train of Equipment is Free From Fire Damage."

Attachment to TXX-09136 Page 4 of 9 LUMINANT POWER RESPONSE Reference 2 provided the Comanche Peak licensing basis on the use of manual actions as a means of ensuring that one train of systems necessary to achieve and maintain safe hot shutdown conditions is free of fire damage. This attachment provides additional information concerning manual action license basis.

Chronology:

A site audit (NRC Inspection Report 84-44 issued January 11, 1985) of the Comanche Peak fire protection program was conducted from October 24, 1984, through November 2, 1984. This audit included personnel from NRC Region IV, Office of Nuclear Reactor Regulation, Office of Inspection and Enforcement, and Brookhaven National Laboratory.

The staff issued Supplement 12 to the Safety Evaluation Report (SSER 12) in October 1985. This supplement contained details on a review of the applicant's fire protection program through Arr1endment 55 of the FSAR.

In mid-1986, TU Electric (the predecessor to Luminant Power) initiated what became essentially a 100%

design and hardware validation effort. Titled "Corrective Action Program" (CAP), this effort involved a complete design and hardware validation program of the safety-related and selected non-safety-related portions of Comanche Peak Unit 1 and common facilities (with the exception of the NSSS and vendor-supplied equipment design). It also included development of detailed design basis documentation.

On February 10, 1987, the NRC created the Office of Special Projects for Comanche Peak and TV A.

A site audit (NRC Inspection Report 87-22 issued January 12, 1988) of the Comanche Peak fire protection program was conducted from October 19 through 23, 1987. This audit included personnel from the Office of Special Projects/Coma.i-,w11e Peak Project Division (OSP /CPPD) and contractors from Science Applications International and Brookhaven National Laboratory.

TU Electric issued Project Status Report, Mechanical Supplement B - Fire Protection," Revision 0, on January 25, 1988.

A site inspection (NRC Inspection Report 88-39 / 88-33 issued June 24, 1988) was conducted from October 24, 1988, through November 2, 1988. It included follow-up on previously identified fire protection system inspection findings. This audit included personnel from OSP /CPPD and Region IV.

On November 7, 1988, the NRC issued "Summary of Meeting on September 29, 1988-Discussion of the Plant Systems Branch's FSAR Review for Comanche Peak." It stated the following:

"The changes to the fire protection program that have occurred since SSER 12 was published are being reviewed by A. Singh (RIV) and various contractors. Inspection Reports 50-445/84-44 and 50-445/87-22 examined establishment and implementation of the fire protection program and compliance with the requirements of BTP APCSB 9.5.1, Appendix A and 10 CFR 50, Appendix R. CPPD will coordinate the issuance of the SER with NRR."

The NRC staff issued Supplement 17 to the Safety Evaluation Report (SSER 17) in November 1988. This supplement presented the staff's evaluation of the applicant's Corrective Action Program (CAP) related

Attachment to TXX-09136 Page 5 of 9 to the mechanical, civil/structural, electrical, instrumentation and controls, and heating, ventilation, and air conditioning disciplines. Fire Protection is addressed in the mechanical section.

The staff issued Supplement 21 to the Safety Evaluation Report (SSER 21) in April 1989. The staff reviewed and evaluated the Comanche Peak fire protection program as described in the applicant's FSAR through Amendment 71 and performed an additional fire protection program audit and subsequent site visit (October 19-23, 1987, and May 2-6, 1988, respectively).

Comanche Peak Fire Safe Shutdown Analysis:

The Comanche Peak Fire Safe Shutdown Analysis (FSSA) was initiated in the early 1980s with Gibbs and Hill as the major contractor. EPM was later contracted to complete the subject program. In early 1986, Westinghouse was requested to participate in a program status review meeting at which time the operational and analytical basis for the FSSA was reviewed. There was a concern with the documents referenced in regard to the Comanche Peak FSSA. In the past, numerous documents had been transmitted to the NRC related to fire safe shutdown. The Fire Protection Program Review (FPPR) was the initial revision of the FSSA performed by EP},1 after SSER 12 v:as issued. In 1986 Westfr1ghouse performed a transient thermal hydraulic analysis to validate the systems and components chosen for the Comanche Peak FSSA. As additional documentation to the FSSA, the Westinghouse analysis provided assurance that the fire safe shutdown model for Comanche Peak was thermo-hydraulicaliy sound. The FSSA development continued up to and then through the CAP program.

FSSA Calculation No.-152, Revision 3 is "EPM-P257-152-003, CPSES, Unit No. 1 Fire Area Separation Analysis for CPSES Unit 1" dated May 4, 1987, was in effect when IR 87-22 occurred. The calculation was revised April 18, 1988, and Revision 4 was reviewed by the NRC and documented in Inspection Report 88-39.

"ME-CA-0000-1086, Revision 0, Fire Safe Shutdown Analysis for Unit 1 and Common," was issued on September 18, 1989, and was in effect when Unit 1 was licensed.

These calculations have always contained manual actions which were required to keep one train free of fire damage. Furthermore, the use of manual actions has always been documented in the Fire Safe Shutdo¥m Design Basis Document and the Fire Protection Report.

CPSES Design Basis.Document (DBD), "Fire Safe Shutdown Analysis, DBD-ME-020," Revision 0, was approved on June 19, 1987. Section 5.2 discusses fire safe shutdown analyses methodology. Section 5.2.14.1, "Safe Shutdown Capability by Fire Area," states that in order to achieve a level of fire safe shutdown capability commensurate with the Appendix R criteria, the following design engineering methods, operating methods, and fire protection engineering methods shali be utiiized:

(a)

One hour raceway barrier (b)

Manual operation (c)

Repair (d)

Evaluation.

It further states that manual operation should be used i11 situations v:here time required to perform this resolution will not preclude safe shutdown.

Revision 0 of the Fire Protection Report (FPR) was issued September 22, 1987.Section III of the FPR is the Fire Safe Shutdown Analysis Report (FSSAR). Section 4.3.1 of Section III discusses fire area compliance mechanisms:

Attachment to TXX-09136 Page 6 of 9 "In order to meet the criteria stated in Section II-4.5 (Fire Protection Features for Fire Safe Shutdown) within an area, the following mechanisms are utilized:

(1)

One or three hour rated barriers: A fire barrier which separates an area or one which encapsulates raceways containing fire safe shutdown components or cables.

(2)

Twenty (20) foot separation areas: A separation distance which is used in place of rated barriers to provide separation between required fire safe shutdown components of redundant systems.

(3)

Manual operation. This resolution is used in situations when the time required to perform this resolution does not preclude fire safe shutdown.

(4)

Repair. This resolution is utilized for cold shutdown or transition to cold shutdown only.

FHA evaluations are provided in situations where compliance with these mechanisms is not readily evident, or deviations are provided and documented in Appendix C."

Revision 27 of the FPR dated December 20, 2007, Section II-3.0 states:

"3.7 Separation criteria for cabling is addressed through the Fire Safe Shutdown Analysis and separation concerns are identified in Section III of this FPR."

Section III-3.1.1 states in part:

"Manual operations are allowed to achieve hot standby following a reactor trip and to maintain hot standby conditions."

FPR, Revision 3 (September 12, 1989) which was in effect at the time of Unit 1 licensing and FPR, Revision 6 Guly 31, 19991) which was in effect at the time of Unit 2 licensing have similar wording as in FPR, Revision 27.

In summary, the FSSA cakulations issued after 1985 (EPM-P257-152-003 & 004 and ME-CA-0000-1086, Rev. 0) have always contained manual actions which were required to keep on train free of fire damage.

Furthermore, the use of these manual actions has always been documented in the FSSA Design Basis Document, DBD-ME-020, and the Fire Protection Report since their issuance in 1987.

NRC Inspection Report 87-22:

NRC Inspection Report 87-22 documented the review of the fire protection program during October 19-23, 1987. The inspection was led by Amarjit Singh of NRC/OSP /CPPD. Section 5.0 of this Inspection Report discussed post fire safe shutdown capability. Calculation No. 152 was reviewed by the NRC and contained Table 2 in Attachment 16 of Volume 3. The following is from page 13 of NRC Inspection Report 87-22:

"Table 2 is a listing of safe shutdown devices and location by fire zone which required certaL11 operator actions including repairs, the location of the action, and the affected fire areas where a fire in those areas may create a requirement for the manual action. Also, the actions were classified accordLng to whether they were required for hot shutdown (hot standby) or cold shutdown.

The NRC inspection team noted that Table 2 is a key document in the applicant's justification for compliance with separation requirements for those areas not requiring alternative

Attachment to TXX-09136 Page 7 of 9 shutdown. The basis of the applicant's analysis and protection methodology for these areas is a combination of protecting certain components in a give fire area, in many instances of either redundant train, plus reliance on the local operator actions described in Table 2."

The NRC reviewed the following procedures which had been prepared by Comanche Peak to address manual actions:

ABN-803A, Response to a Fire in the Control Room or Cable Spreading Room ABN-804A, Response to Fire in the Safeguards Building ABN-805A, Response to Fire in the Auxiliary Building or the Fuel Buildir1g ABN-806A, Response to Fire in the Electrical and Control Building ABN-807 A, Response to Fire in the Safeguards Building ABN-808A, Response to Fire in the Service Water Intake Structure Building ABN-809A, Response to Fire in the Turbine Building The following is from page 13 of NRC Inspection Report 87-22:

"In view of the manual actions required to ensure compliance with separation requirements, the team considers the above procedures to be an integral part of the applicar1t's fire hazards analysis and fire safe shutdown analysis reports. The team considered it of considerable importance that the feasibility of the manual actions be properly analyzed with respect to the postulated fires a.nd the protected components within each area. As a minimum, the manual actions should be sorted so that those which need to be performed in the same fire area or zone in response to a postulated fire in that area or zone are identified and the time after reactor trip when the action must be performed compared to the area accessibility and component operability after the postulated fire.

During the inspection, the NRC team stated that the information in Table 2 concerning manual actions was not adequately sorted to identify actions which must be taken in the same fire area as the postulated fire. "

This clearly sf1ows that manual actions taken outside the same fire area as the postu.lated fire \\*vere reviewed and deemed acceptable to the NRC. The only open issue in the area of post fire safe shutdown capability was the adequacy of manual actions which must be taken in the same area as the postulated fire. This issue was documented as NRC Inspection Unresolved Item No. 8722-U-02 pending revision of Calculation No. 152. This issue was resolved and closed in NRC Inspection Report 88-39. That inspection report contains the following statement on page 14:

"Unresolved Item (445/8722-U-02): Manual Actions. The original issue dealt with the adequacy of those manual actions which must be taken in the same area as the postulated fire.

By letter dated May 3, 1988. TU Electric provided revised Cakuiation 152 which contained a revised listing of all the manual actions required in the same fire area as the postulated fire.

The NRC inspector reviewed the listing and the justifications of the identified manual actions and found them to be acceptable. Therefore, Unresolved Item 445/8722-U-02 is considered close."

In summary, in 1988 the NRC inspected Comanche Peak's use of manual actions and found them to be acceptable. These inspections were referenced in SSER 21.

Based upon the above, it is evident that the NRC inspectors were aware that some Comanche Peak manual actions were to align required FSSA systems that were credited in the FSSA to ensure that one

Attachment to TXX-09136 Page 8 of 9 train of the equipment required to achieve and maintain safe hot shutdown conditions remained free of fire damage. This is further supported by the attached enclosure.

SSER 17:

The staff issued Supplement 17 to the Comanche Peak Safety Evaluation Report (SSER 17) in November 1988. This supplement presented the staff's evaluation of the applicant's Corrective Action Program (CAP) related to the mechanical, civil/structural, electrical, instrumentation and controis, and heating, ventilation, and air conditioning disciplines. Fire Protection is addressed the mechanical section.

Section 4.6 discusses Fire Protection.

The section on Fire Safe Shutdown Analysis (FSSA) states that the design validation of the FSSA was based on the criteria in DBD-ME-020 and included engineering walkdowns to identify the location of systems, structures, and components required to achieve and maintain safe shutdown of the reactor in the event of a postulated fire coincident with a loss of offsite power and their relation to fire protection features.

As previously stated, DBD-ME-020 allows the use of manual operations to achieve a level of fire safe shutdown capability commensurate with the 10 CFR Appendix R criteria. It further states that manual operations should be used in situations where tLme required to perform this resolution will not preclude safe shutdown.

The following conclusion was reached in SSER 17:

"On the basis of its inspections and audits, the staff finds, subject to completion of actions committed to by TU Electric as a result of the inspections, that the CPSES fire protection program provides a level of fire safety in conformance with or equivalent to the staff guidance in Appendix A to Branch Technical Position APCSB 9.5-1 (NUREG 0800) and Appendix R to 10 CFR Part 50. The staff further finds the CAP methodology described in Reference 96a (TU Eiectric, Project Status Report, "Mechanical Supplement B-Fire Protection," Revision 0, January 25, 1988.) consistent with staff inspection findings. The staff's evaluation of the applicant's fire protection plan will be provided in a future supplement."

SSER21:

The NRC issued Supplement 21 to the Comanche Peak Safety Evaluation Report (SSER 21) in April 1989. The staff reviewed and evaluated the Comanche Peak fire protection program as described in the applicant's FSAR through Amendment 71 and performed an additional fire protection program audit and subsequent site visit (October 19-23, 1987, and May 2-6, 1988, respectively).

TXX-88430 letter to the NRC dated April 29, 1988, identified areas relating to fire protection of the SER and SSER 12 which may require updating. Page 25 of the Attachment to TXX-88430 discussed SSER 12 Section 9.5.1.4, paragraph 5, page 9-20 which stated:

"The applicant's safe shutdown analysis dated May 7, 1982, states that systems needed for hot shutdown and cold shutdown consist of redundant trains and that one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability."

Attachment to TXX-09136 Page 9 of 9 Comanche Peak stated that "the Fire Safe Shutdown Analysis is as given in the Fire Protection Report Revision 1,Section III."

As previously stated, the Fire Safe Shutdown Analysis under went major revisions after the 1984 NRC inspection and issuance of SSER 12. These revisions began after the issuance of SSER 12 and lasted through the design validation phase of the CAP program. Furthermore, the use of manual actions has always been documented in the Fire Safe Shutdown Design Basis Document, Revision O Oune 19, 1987),

and the Fire Protection Report, Revision O (September 27, 1987).

The SSER writeup acknowledges that the fire hazards analysis was revised and included in the Fire Protection Report dated September 22, 1987. Revisions to the Fire Protection Report submitted to the NRC on April 28, 1988, reflected changes to the plant design described in the FSSA Report.

On November 7, 1988, the NRC issued "Summary of Meeting on September 29, 1988 - Discussion of the Plant Systems Branch's FSAR Review for Comanche Peak." It stated the following: "The changes to the fire protection program that have occurred since SSER 12 was published are being reviewed by A.

Singh (RIV) and various contractors. Inspection Reports 50-445/84-44 and 5-445/87-22 examined establishment and implementation of the fire protection program and compliance with the requirements of BTP APCSB 9.5.1 Appendix A and 10 CFR 50, Appendix R. CPPD will coordinate the issuance of the SER with NRR."

The NRC failed to update the SSER record in SSER 21 with the fire protection program changes that had occurred since the issuance of SSER 12 in 1985.

==

Conclusion:==

Since before the license issuance of Comanche Peak Unit 1 in 1990, the licensing basis for Comanche Peak allowed credit for manual actions to ensure that one train of the equipment required to achieve and maintain safe hot shutdown remained free from fire damage. Luminant Power believes that the use of manual actions was reviewed and understood by NRC inspectors, and those responsible for updating the SSER, during the review of changes to the Comanche Peak fire protection program since SSER 12 was issued.

Contrary to the NCV, NRC's acceptance of local manual actions was not limited to actions to mitigate the effects of potential fire damage. Instead, the design documents at the time, the FPR and the FSSA, and the NRC inspections at the time all consistently indicate that manual actions could be used to provide the physical separation or protection required in the approved fire protection program. The position in the NCV is different from what was approved at the time Comanche Peak Unit 1 was Hcensed. If the NRC maintains this position this may constitute a backfit under 10 CFR 50.109(a)(l).

ENCLOSURE TOTXX-09136 AFFIDAVIT OF HAROLD R. BECK DATED NOVEMBER 19, 2009

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION In the Matter of LUMINANT GENERATION COMP ANY LLC (Comanche Peak Nuclear Power Plant, Units I and 2)

AFFIDAVIT

)

Docket Nos. 50-445 and 50-446 I, Harold R. Beck, being duly sworn, hereby depose and state that I am currently an Engineering Consultant for AREVA NP, Inc., and do hereby affirm and state:.

1.

I have worked at Comanche Peak Nuclear Power Plant (CPNPP) during construction, licensing, and initial startup of the units, and intermittently during operation since that time up to the present My first work for CPNPP was with Gibbs & Hill, Inc.

in New York, NY starting in late 1981. I began working at the CPNPP site in mid 1983.

I worked atCPNPP fuil time from mid 1983 until I left site at the end of 1989.

I first became involved with the Fire Safe Shutdown Analysis (FSSA) at CPNPP in 1986. I was a Senior Engineer employed by Gibbs & Hill, Inc. working in the Mechani~al Engineering Group. I was part of a team of individuals that was working with the then Westinghouse Electric Corporation (Westinghouse). At that time, Westinghouse was developing a transient thermal hydraulic model to model the plant response to verify that the systems and components modeled in the FSSA were adequate to achieve safe shutdown conditions.

In 1987, I was a Senior Engineer employed by lmpell Corporation working at CPNPP as an assistant to the utility Fire Protection Engineer. My *main areas of responsibility were related to the resolution of outstanding technical issues with the FSSA as CPNPP was preparing for the Fire Protection Program audit with the NRC scheduled for the fall of 1987. The FSSA. was being performed at this time by the firm of Engineering, Planning and Management (EPM).

I participated in the fall 1987 NRC audit as part of the multi-discipline team that supported the audit. I also participated in the follow-on inspection by the NRC in 1988.

After the follow-on inspection in 1988, the organization responsible for the FSSA, Engineering, Planning, and Management, completed their activities and Impell took over responsibility for the FSSA. When lmpell took over responsibility for the FSSA, I was reassigned from assisting the utility Fire Protection Engineer, to become the FSSA supervisor in the ImpeH Fire Protection Group. I remained in this position until leaving rDl\\lPP g,T t'hP Pnrl nf 102.0 ~c I Tnlt 1 !:1nnrn'Ac*~}u~0,l in;t\\~1 r-Mi*irQ1li"u

'-'l.. l.'\\'.lf.

JI..

\\.41,.

'-1.1.'lo.'...,.,.__.__ '-".JI..

.A.

V/ ""-'.._..,.....a.._

.a.

-,t"J-'-""-" __,._._...., _

_.""-"'""-"....,_._.,._.. "'-'~*J*

I have been involved with the CPNPP FSSA at different times subsequent to the

completion of the Unit 1 licensing activities. 1 participated in revision of the FSSA in 1992. I have supported the last 3 NRC Triennial Fire Protection Inspections (2008, 2005, and 2002). The last revision to the.CPNPP FSSA was performed in 2007, and I 1 participated in that activity.

. 2.

Based upon my roles and responsibilities described in Paragraph 1, my personal kn.owledge and understanding at that time is described below:

a.

The initial development of the FSSA in the early 1980s was done by Gibbs & Hill, Inc. This was the basis for the early inspections perfonned by the NRC and subsequently became the basis for SSER 12. At this point in the plant construction, the Comanche Peak site engineering organization was responsible for the overall implementation of the Fire Protection Prograr.p. and coordinated the activities of supporting organizations and personnel. The site engineering orga.'lization was responsible for reviewing t.3/4e Gibbs and Hill analysis and determining the protection requireIJ1ents necessary to ensure that adequate protection was required.

In the mid 1980s (approximately 1985-1986 time frame), EPM was contracted to revise and enhance the analysis and address unresolved technical issues. In 1986, as a part of the update and enhancement efforts, Westinghouse was contracted to perform a transient thermal hydraulic analysis to validate the systems and components chosen to be modeled in the FSSA, -and validate that this population of equipment could achieve FSSA goals.

Somewhere at the end of this time period, responsibility for CPNPP was moved from RN of the NRC to NRR at NRC headquarters and finally to Office of Special Projects at NRC headquarters.

In late 1986, CPNPP began the Corrective Action Program (CAP).

As part of implementing the CAP. CPNPP hired engineering firms to validate the various safety related aspects of the CPNPP design (and numerous other related activities). At this time, Impell Corporation was hired to handle the Fire Protection Program and EPM was responsible for the continued development of the FSSA and the validation of its bases. These activities validated technical issues that represented the entire breadth of Fire Protection Program, from detennination of the various design bases, to analysis and documentation of specific design aspects and determining what specific requirements were not adequately met~

and specifying and implementing the corrective actions in support of eventual unit licensing.

The activities that were ongoing after the issuance of SSER 12 had a significant impact on the overall FSSA. The transient thermal

hydraulic analysis performed by Westinghouse confirmed the, systems and component requirements were different that what was originally modele_d by Gipbs & Hilt The analysis included time constraints for validation_ that were.based on operations assessments of when individual actions could be achieved. During this period, the Program and topical Design Basis Documents were in.ltlalJy drafted* as was the initial draft of the CPNPP Fire Protection Report.

A significant amount of time during the 1987 inspection by the NRC was spent identifying the scope and content of all of the design validation activities undertaken by Impell and EPM, and presenting the changes to the Fire Protection Program that were driven by corrective action program activities.

Numerous aspects of the Fire Protection Program were inspected by members of the NRC inspection team. The team walked through the post fire shutdown procedures, starting with the Control Room fire scenario and progressing to the various other fires postulated to occur in ~he plant.

The NRC inspectors expressed significant interest in the manual actions to be taken by CPNNP personal in an event credited in the FSSA, and looked at all of the related issues such as lighting, communication, access/egress for these actions. The NRC inspectors appeared to be especially concerned with manual actions that needed to be performed in the same area of the fire and wanted to confirm that those actions were feasible and could be taken in a manner that they were accomplished within their required time frame. During the inspection some short comings were identified by the NRC related to the specification of actions required by the analysis and the incorporation of those actions in the post fire shutdown procedures.

I took part in discussions with NRC inspection personnel during the walkdown of manual actions related to the purpose of specific actions. We discussed the purpose of the specific manual actions in the context of it was to mitigate spurious actuation or it was required to align a required system to perform the necessary function. Based on the discussions related to the purposes of the various actions reviewed, it was my understanding that the NRC inspectors were aware that some of our actions were to align required FSSA systems that were credited for FSSA.

T hHve no knowledge related to others at the }JRC_ }v1v V

understanding was based on my interaction with the inspection staffs for the 1987 and 1988 follow up inspection.

The foregoing is true to the best of my knowledge, information, and,belief.

STATE OF Texa~

COUNTY OF. lqrrq 11-f Harold R. Beck Subscribed and sworn to me, a Notary Public, in and for the State of /44qo/, this _l!J._

day of November, 2009.

BARBARA GRABRUCK MY COMMISSION EXPIRES Augu6125, 2010

~~

Notary Public's Signature

SUMMARY

OF REFERENCED DOCUMENTATION

SUMMARY

OF REFERENCED DOCUMENTATION Document Part of Submitted on the Approved FP Reviewed in SER?

Docket?

Program?

License Condition Yes NA NA FSAR 9.5.1 Yes Yes Yes Fire Hazards Analysis Report (FPR Section II)

Yes Yes Yes Fire Safe Shutdown Analysis Report (FPR Yes Partial Yes Section Ill)

Design Basis Document ME-020, "Fire Safe No No No Shutdown Analysis,"

ME-CA-0000-1086, Fire Safe Shutdown Analysis No No No for Unit 1 and Common EPM-P-257-152, Fire Safe Shutdown Analysis for Unit No No No 1 and Common Supplemental Safety Evaluation Reports 1, 12, Yes NA NA 21, 23, 26 and 27 Inspection Reports 87-22 and 88-39 No No NA

1. Responsibility for performing the Safe Shutdown Analysis in Calculation EPM-P-257-152 was shifted to a different contractor, and was then superseded by Calculation ME-CA-0000-1086. Neither version was submitted to the NRC for review, but the results were the basis for the conclusions in the Fire Hazards Analysis Report. The FHAR results based on the earlier version were reviewed in SSER 12, and the FHAR results based on later version were reviewed in SSER 21.

2. The licensee's choice to include several major licensing documents as sections of a single document, titled the Fire Protection Report (FPR), creates confusion when making references among documents. This was compounded by commonly making a reference to an entire section without referring to the specific part. The licensee's denial makes considerable use of this lack of clarity without showing how it demonstrates NRC approval of operator actions.

3. The licensee's Fire Safe Shutdown Analysis was performed by three different contractors because of quality problems. A Fire Protection Program Review was performed after problems were identified with the first version ( circa 1986). This effort validated prngram elements against Design Basis Document ME-020, "Fire Safe Shutdown Analysis," issued in 1987. This design basis document, issued after SSER12 and not submitted to the NRC, eventually contained analysis criteria that incorrectly stated that operator actions were commensurate with Appendix R criteria for separation and protection. This DBD was used to create the Fire Safe Shutdown Analysis calculations that contain operator actions, which were also not submitted to the NRC.

4. The staffs review of the results of the original FSSA were documented and accepted in SSER 12. When significant changes were made to the FSSA, the staff reviewed the results and documented acceptance in SSER 21 without additional detailed discussion of the revievv of the revisions vvith respect to protection and separation of required equipment in any SSER. The licensee's denial letter implies that this was a shortcoming in the staffs documentation, rather than an indication that the staff did not have the same understanding, as the licensee's letter implies. Region IV believes that the revised analyses submitted to the NRC for review did not fundamentally change the applicant's stated conclusions for complying with the separation and protection of required equipment after SSER 12. Therefore, the staffs conclusions with respect to this topic were already documents in SSER 12, and did not need to be repeated in detail. SSER 21 clearly documented that the staff concluded that the applicant's FSAR through Revision 71 provides a level of safety that is in conformance with the review requirements based on the evaluations, audit and site visit, as specifically noted in the SSER discussion

5.

In numerous other cases, deviations were identified by either the applicant or the staff and properly dispositioned by the staff in the SSERs using appropriate regulatory processes. Region IV did not identify any instances where the staff was aware of an issue that did not clearly meet regulatory requirements for which a proper resolution was not documented in an SSER. This appears to conflict with the licensee implied conclusion that the staff was aware of the applicant's intent to use operator actions as described in the violation.

6. The licensee's letter states that the Comanche response procedures have always had operator actions (eight procedures, broken down by building). However, licensee's documentation has never stated whether any operator actions in these procedures related to compliance with requirements for separation and protection. The documentation also has never stated whether the actions relate to a required function or a function which could affect the ability to meet a required function.

Assessment of Licensee's Statements and Licensing Basis Documents

Assessment of licensee's Statements and Licensing Basis Documents The purpose of this Attachment is to extract the licensee's statements and place them into context. Licensee statements are listed in red, while NRC comments are listed in black.

Quotations from NRC documents are shown in blue.

SSER '12 reviewed an early version of the FSSA. Subsequent to that time, significant changes were subsequently made to the FSSA (pg 5 of 9) The licensee submitted major changes to their fire safe shutdown analysis, fire hazards analysis, organizational and design modifications.

These changes were submitted shortly before the fire protection inspection documented in inspection report 87-22, and were discussed in SSER 21. The licensee statement points out that it would have been more appropriate to have stated that the NRC's approval was stated in both SSER 12 and 21. The following statements describe changes made to their Fire Safe Shutdown Analysis based on significant problems identified during the earlier licensing reviews and discussed in SSER 12.

FSSA Calculation EPM-F>-257--152. "CPSES Unit 1 Fire Area Separation Analysis.

revlsion 3. issued on 5/4/87. was in effect when the inspection for NRC inspection report was onqoing, and revision 4 issued on 4/18/88, was reviewed during the inspection for IR 88-39. These inspection reports were part of the NRC Office of Special Projects inspections that were primarily intended to check licensee corrective actions for problems with construction and the design basis. IR 87-22 found continued problems with Rev 3, so Rev 4 was issued to address specific questions documented in URI 445/8722-U-02. IR 88-39 closed out the URI.

MF-C:P,-Cl000--1086, Fir,~ Safe Shutdown Analysis for Unit 1 and Common. revision 0 was issued on 9/18/89 and was in effect v,;hen Unit 1 was licensed. It replaced EPM-P-257 152. though they were alrnost identical. This calculation, performed by a different contractor than the first FSSA, replaced the earlier calculation. The FSSA used the criteria in Design Basis Document DBD-ME-020, "Fire Safe Shutdown Analysis," to determine separation, but this DBD allowed operator actions. Neither of the FSSA calculations were submitted to the staff for review, nor was the DBD.

The description of the methodology [emphasis added] used for the FSSAs was ccntained 1n Design Ba';;is Document DBD-ME-020, Fire Safe Shutdown Analysis,"

revision 0 :ssued on 6i19/87 This document was not submitted to the NRC for review, and is not part of the licensing basis. While it contains the words that the licensee believes are the key to their position, no specific result from those words were provided to the NRC.

Specifically, if there were a reliance on operator actions in order to meet the intent of a separation and protection requirement, then those fire areas should have contained a discussion of those results. Instead, in every fire area, the results included statements that the separation and protection requirements were met.

In many cases where licensees have claimed to have received NRG approval for reliance on operator actions in lieu of meeting the protection and separation requirements, their arguments relied upon methodology documents that permitted use of operator actions, as TXU is doing here. BTP 9.5-1 does not require submission or review of the safe shutdown methodology; it requires submission and review of the results to ensure that the design complies with the separation and protection requirements. The licensee's submittal stated in each fire area that the separation and protection requirements were met, and the SERs state that that was the basis for approval.

These calculations have always contained manual actions which were required to keep one train free of fire damage. Furthermore, the use of manual actions has always been documented in the Fire Safe Shutdown Design Basis Document and Fire Protection Report. This statement is complex, so it is broken down:

These calculations have always contained manual actions which were required to keep one train free of fire damage. This part of the sentence is a factual statement to the extent that these documents allowed for the possibility of operator actions. However, there is no documentation in any of these documents that state that any specific operator actions were relied upon in any specific fire areas or for any specific components in order to meet regulatory requirements for separation and protection of required equipment. The actual intent of the operator actions in this violation is not documented. Further, it is incorrect to claim that operator actions can "keep one train free of fire damage;" the operator actions of concern (there are other types of operator actions that are allowed) were used to restore fire-damaged equipment to operation that were required to be free of fire damage.

Furthermoie, the use of manual actions has ab,vays been documented in the Fire Safe Shutdown Design Basis Document and Fire Protection Report. This is a factual statement. However, the DBD and the portions of the FPR that contain references to operator actions were never submitted to the NRG for review.

These documents contained the description of the methodology used to perform the fire safe shutdown analysis. The NRG reviewed the results of the FSSA and FHA, which were submitted to the NRC, not the methodology itself. The methodology is not something covered by regulatory requirements, and the NRC did not endorse guidance covering methodology. The regulator; requirements only cover what the licensee must demonstrate as results.

The DBD methodology appears flawed in that is was attempting to "... achieve a level of fire safe shutdown capability commensurate with the Appendix R criteria... " rather than a level that was in compliance with the Appendix R criteria.

The documentation of the completed FSSAR was made unclear with respect to the criteria used by making references to other sections in the FPR. Most references were made to Section 11-4.5, which listed criteria that match the separation and protection requirements from Appendix A of Branch Technical Position,t...PGSB 9.5-1. However, one section (Section !!!.4.3.1) states:

"In order to meet the criteria stated in Section 11-4.5, within a fire area, the following mechanisms are utilized: (3) Manual operation. This resolution is used in situations when the time required to perform this resolution does not preclude fire safe shutdown."

This part of the document was not submitted to the NRC for review. The criteria in Section 11-4.5 repeat the commitments in FSAR Section 9.5.1, which match NRC requirements, was submitted to the NRC. The departure from the acceptable criteria was made as a "mechanism" which Region IV believes cannot be construed to meet the NRC's requirements. Specifically, an operator action cannot be used to claim that equipment is free of fire damage.

The Fire Protection Report, Revision 3 (9/12/98), Section 11-3.0 states:

3.7 Separation criteria for cabling is addressed through the Fire Safe Shutdown Anaiysis and separation concerns are identified in Section Ill of this FPR While this statement is vague in its intent or legal meaning, Section Ill contains no iisting of separation concerns.

Section 111-3.1.1 states in part:

"Manual operations are allowed to achieve hot standby following a reactor trip and to maintain hot standby conditions."

This statement provided confusion during three triennial fire protection inspections until it was finally placed into context. The documentation provides no basis for concluding that operator operations are "allowed," or whether the NRC was involved in reaching this conclusion. This document was not submitted to the NRC for licensing review, and no regulatory documents contain similar statements, so this appears to have been a licensee conclusion.

This statement also does not elaborate on what actions or what components may be involved in these "manual operations." The intent or purpose of the manual operations must be known to determine whether there is a compliance problem.

Specifically: (1) manual operations of equipment which is required to achieve and maintain hot standby and which is free of fire damage are aiiowed; (2) manual operations of equipment which is not required for safe shutdown are allowed; and (3) manual operations which are intended to restore functionality of equipment which is required to achieve and maintain hot standby because this equipment was not ensured to be free of fire damage is not allowed.

Taken together with statements in each fire area description that separation and protection requirements are met, had this statement been reviewed by NRC licensing personnel, this statement does not provide any context that would trigger the NRC to believe this was substituting operator actions in lieu of protection and separation. The licensee seems to be reading a lot into this statement that is not supported by content or context.

Two NRC inspection reports, issued by the Office of Special Projects, involved inspection and review of manual actions issues during the period when the FSSA had been revised (i.e.- after SSER 12). The licensee states that the inspectors reviewed FSSA Calculations EPM-P-257-152.

The licensee then provided a summary of the inspection reports. For better clarity and context, the inspection report contents are included below.

"This clearly shows that manual actions taken outside the same fire area as the postulated fire were reviewed and deemed acceptable to the NRC."

Inspection Report 87-22, Section 5.0 is quoted here. It gives an incomplete summary of what took place during the inspection, including the scope of the inspection and its relationship to the license reviews that had previously taken place or were ongoing (licensee agrees). An inspection is not normally used as a method of completing licensing reviews, which is what the licensee implies happened during this inspection. However, it clearly states:

During the 84-44 inspection, numerous apparent inconsistencies were noted in the applicant's analysis and assuniptions concerning the protection of fire safe shutdown equipment for areas... where alternative shutdown is not required. The report then lists a few specific examples of problems:

The Fire Hazards Analysis Report contained a general statement for each fire area:

"One train of the required redundant equipment and components within the area is protected by one of the means provided in Section 11-4.5." This section contained only a listing of the all potential means of complying with CMEB 9.5.1 C.5.b separation requirements. Therefore, the FHAR does not identify specifically what components are protected for a postulated fire in that area. An inspection like this should include a confim1ation that the components claimed to be prntected were actually protected.

documentation did not support reaching a conclusion that the plant matched the analysis.

Th~

I IIC Calculation EPM-P-257-152, Table 2 is a listing of safe shutdown devices and location by fire zone which require certain operator actions including repairs, the location of the action, and the affected fire areas where a fire in those areas may create a requirement for the manual action. Also, the actions are classified according to whether they are required for hot shutdown or co!d shutdown.

The inspection team noted that Table 2 ~s a key document in the applicant's justification for compliance with separation requirements for those areas not requiring alternative shutdown. The basis for the applicant's analysis and protection methodology for these areas is a combination of protecting certain components in a given fire area, in many instances either redundant train, plus reliance on the !ocal operator manual actions described in Table 2.

These two paragraphs are unclear in that they do not place anything into regulatory context. The report lists the six procedures used to implement operator actions used in response to fires. Hov1ever1 these procedures and the ca!cu!ation did not (and still do not) list the intent or purpose for the operator actions. However, further down in this section, the report focused on operator actions to overcome spurious operations caused by fire damage to non-required components which could affect the success of required systems.

in view of the manual actions required to ensure compliance with separation requirements, [This statement can only be explained if it was intended to apply to overcoming potential spurious operation of non-required components that could affect the success of required systems] the team considers the above procedures to be an integral part of the appiicant's fire hazards analysis and fire safe shutdown analysis reports. The team considers it of considerable importance that the feasibility of tr,e manual actions be properly analyzed with respect to the postulated fires and the protected components within each fire area. As a minimum. the manual actions should be sorted so that those which need to be performed in the same fire area or zone in response to a postulated fire in that area or zone are identified and the time after the reactor trip when the action must be performed compared to the area accessibility and component operability after the postulated fire. The inspectors were requesting better documentation to support an inspection of the feasibility of operator actions. Our current fire protection inspections conduct these same types of reviews. However, the licensee did not include documentation of the intent or purpose for the operator actions.

During the inspection, the team noted that the inforrnation in Table 2 concerning manual actions was not adequately sorted to identify actions which must be taken in the same fire area as the postulated fire. Furthermore, the feasibility of each action with respect to the postulated fire was not presented. The applicant presented a revised listing of the manual actions with justifications for each action just prior to the exit meeting. The list indicated that some revisions to Table 2 were necessary and that some actions had been deleted. The new listing of actions would be presented in a previously planned Revision 4 of Calculation EPM-P-257-152.

The issue of the adequacy of manual aciio11s which must be taken in the sairIe area as the postulated fire remains unresolved pending TU Electric's revision to Calcuiation EPM-P-257-152 and NRC review of the document (445/8722-U-02).

Inspection Report 87-22, Section 5.0 contained a mix of information without a clear context of the purpose of the inspection or the conclusions drawn from the inspection.

The lack of clarity allows more than one interpretation. However, this report did not approve of or find anything acceptable to the NRC. It did open an unresolved item that was narrowiy focused on a set of operator actions which must be taken in the same area as the fire. Since no other conclusions were stated and no other unresolved items were identified, it is therefore appropriate to conclude that the context of the unclear statements related to this one issue. [Note: This conclusion is not necessary to the conclusion that the violation was correct, since this report did not approve operator actions, nor did any Safety Evaluation Reports]

IR 87-22 appears to document that the inspector had a certain understanding of the licensee's analysis such that they believed that certain operator actions were required to ensure compliance with separation requirements. Since operator actions cannot be used for separation of required systems, it appears that it was intended to apply to oveicoming potential spurious operation of non-required components that could affect the success of required systems Inspection report 88-39 closed the URI 445/8722-U-02 with even less clarity:

(Closed) Unresolved Item (445/8722-U-02): Manua! actions. The original issue dealt with the adequacy of 445/8722-U-02. By letter dated May 3, 1988, TU Electric provided revised Calculation 152 which contained a revised listing of all the manual actions required in the same fire area as the postulated fire. The NRC inspector reviewed the listing and the justifications of the identified manual actions and found them to be acceptable Therefore Unresolved Item 445/8722-U-02 is considered closed.

The statements above were clearly limited to operator actions required in the same fire area as the postulated fire. These actions were of specific concern to the NRC at every site because actions that might be needed before there was adequate time to extinguish a fire might not be feasible.

"In summary, in 1988 the NRC inspected Comanche Peak's use of manual actions and found them to be acceptable. These inspections [87-22 and 88-39] were referenced in SSER 21.

The licensee's letter implies that the statements in this URI closure mean that the NRC approved the use of operator actions, regardless of their purpose. The statements do not support such a conclusion. Further, an inspection report is not the NRC's mechanism for approving licensing actions.

"Use of manual actions as a means of ensuring that one train of systems necessary to achieve and maintain safe hot shutdown is free of fire damage... " (cover !etter and page 6 of 9)

The licensee is unable to establish any documentation that shows the NRC approved the use of operator actions in lieu of protecting or separating equipment required for to achieve and maintain a safe hot shutdown condition. There was no documentation submitted to the NRC that shows that this was the intent of the applicant. If the applicant had made it cleai that this was their intent to rely on operator actions in lieu of protection and separation, the licensee would have had to make a specific request for deviation from the requirements (no request was documented), and the NRC would have had to explicitly discuss why the licensee had made a good case that the intent of the requirement was satisfied (no deviation was documented or approved).

Contrary to the NCV, NRC's acceptance of local manual actions was not limited to actions to mitigate the effects of fire damage. instead, the design docurnents at the time, the FPR and the FSSA, and the NRC inspections at the time all consistently indicate that manual actions could be used to provide the physical separation or protection required in the approved fire protection program. The discussion in Inspection Report 2009004 explains the extent to which operator actions were approved by the NRC, which is expanded upon in this document. Therefore, the first sentence is correct except where it overstates what the violation included. The content of the design documents, FPR, FSSA, and inspection reports with respect to operator actions is described in this document, and these descriptions show that (1) contents involving the criteria for separation and protection of required equipment and discussion of operator actions were not consistent; (2) the documents submitted to the NRC do not include any specific operator actions that were intended to restore equipment required to achieve and maintain a post-fire safe shutdovvn condition; (3) only one deviation vas requested and approved that involved not meeting separation requirement and which allowed operator actions, and the need for this was identified by the NRG; (4) the NRC inspections did not approve the use of operator actions, but did support closure of an unresolved item that involved operator actions that were found to be acceptable in an SSER; and (5) the Comanche Peak SSERs consistently stated that the applicant submitted documents that showed that the plant met the separation and protection requirements and did not mention reliance on operator actions to restore required equipment that was subject to fire damage in order to meet these requirements. Further, no statements were found in the SSE Rs that approved of the FSSA methodology that included statements that stated that operator actions were an option.

The position in the NCV is different from what was approved at the time Comanche Peak Unit 1 was iicensed. if the NRC maintains this position this may constitute a backfit under 10 CFR 50.109(a) (1 ). Region IV's review supported the conclusion of a violation in this case, and found no information that supports the licensee's claim that the NRC approved operator actions in other that specific examples. Therefore, this violation would not constitute a backfit.

The affidavit provided as the enclosure to the licensee's denial letter provides a brief summary of the multiple contractors performing fire protection analyses and addressing shortcomings. It documents that Westinghouse identified that the list of equipment required to achieve and maintain safe shutdown was different that the previous list. The individual's recollections of the scope of NRC inspections in the 1987 - 1988 period, vvhich included walking down the fire response operating procedures for feasibility, with a primary focus on those actions which were to be performed in the same area as the postulated fire. The individual then states:

Based on the discussions related to the purposes of the various actions reviewed, it was my understanding that the NRC inspectors were aware that some of our actions were to align required FSSA systems that were credited for FSSA.

This statement is not supported by documentation. If the statement is correct, any understanding by the inspectors did not get to the licensing reviewers. The focus of the inspection vvas feasibility of the actions compared to the time available and accessibility constraints. Inspection Report 87-22 documented concerns about the poor level of documentation supporting the operator actions.

INSPECTION REPORT 05000445; 05000446/2009004, SECTION 4OA5.5

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION IV 612 EAST LAMAR BLVD, SUITE 400 ARLINGTON, TEXAS 76011-4125 October 27, 2009 Rafael Flores, Senior Vice President and Chief Nuclear Officer Luminant Generation Company, LLC Comanche Peak Steam Electric Station P.O. Box 1002 Glen Rose, TX 76043

Subject:

COMANCHE PEAK STEAM ELECTRIC STATION - NRC INTEGRATED INSPECTION REPORT 05000445/2009004 AND 05000446/2009004

Dear Mr. Flores:

On September 19, 2009, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your Comanche Peak Steam Electric Station. The enclosed integrated inspection report documents the inspection findings, which were discussed on October 1, 2009, with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents six NRG-identified findings of very low safety significance (Green).

These findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they are entered into your corrective action program, the NRC is treating these findings as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest the noncited violations or the significance of the noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E. Lamar Blvd, Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the Comanche Peak Steam Electric Station facility. In addition, if you disagree with the characterization of any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at the Comanche Peak Steam Electric Station. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

Luminant Generation Company, LLC In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, and its enclosure, will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of NRC's document system (ADAMS).

ADAMS is accessible from the NRC Web site at http://l,vwvv.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Docket: 50-445: 50-446 License: NPF-87; NPF-89

Enclosure:

Sincerely, Wayne C. Walker, Chief Project Branch A Division of Reactor Projects NRC Inspection Report 05000445/2009004 and 005000446/2009004 w/Attachment 1: Supplemental Information w/Attachment 2: Results of the Staff's Review of Manual Actions in the Licensing Basis cc w/

Enclosure:

Mike Blevins, Chief Operating Officer Luminant Generation Company LLC Comanche Peak Steam Electric Station P.O. Box 1002 Glen Rose, TX 76043 Mr. Fred W. Madden, Director Regulatory Affairs Luminant Generation Company LLC P.O. Box 1002 Glen Rose, TX 76043 Timothy P. Matthews, Esq.

Morgan Lewis 1111 Pennsylvania Avenue, NW Washington, DC 20004 County Judge P.O. Box 851 Glen Rose, TX 76043

requiring the control room to be evacuated. Contrary to the above, the licensee failed to provide adequate procedures for implementing the fire protection program. Specifically, the procedural guidance for implementing the postfire safe shutdown strategy would fail to prevent damage to the credited centrifugal charging pump if it was in operation at the time of a fire requiring an evacuation of the control room.

Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-004453-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-04; 00500446/2009004-04, "Inadequate Postfire Safe Shutdown Procedure."

.5 (Closed) Unresolved Item 05000445/2008006-02; 05000446/2008006-02, "Unapproved Local Manual Actions For Hot Shutdown" Introduction. The inspectors identified a Green noncited violation of Unit 1 License Condition 2.G and Unit 2 License Condition 2.G. Specifically, the licensee failed to ensure that one train of the equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage as specified in the approved fire protection program. The licensee relied upon local manual actions to mitigate the effects of potential fire damage rather than provide the physical separation or protection required in the approved fire protection program.

Description. The inspectors reviewed a sample of three fire areas in Unit 1, which do not require evacuation of the control room during the shutdown. The inspectors reviewed the approved fire protection program as defined in License Condition 2.G and determined that one train of equipment required to achieve and maintain hot shutdown is required to be free from fire damage. The inspectors noted that the approved fire protection program allows local manual actions to respond to spurious operations of other equipment that could impact the safe shutdown but do not directly perform the required safe shutdown functions.

The inspectors conducted walkdowns with operations personnel of Procedure ABN-804A, "Response To a Fire In The Safeguards Building,"

Revision 5, and Procedure ABN-806A, "Response To a Fire In The Electrical and Control Buildings," Revision 5. The inspectors found that the fire protection program, as implemented, relied on the use of local manual actions to align and control equipment required to achieve and maintain hot shutdown resulting from potential fire damage instead of assuring that one train was free from fire damage. This approach expanded the use of local operator manual actions outside of the control room beyond the response to spurious operations allowed in the approved fire protection program.

The inspectors concluded that the licensee's fire protection program, as implemented, provided less physical separation and protection from the affects of fire than the approved program required, and was inherently less reliable than ensuring that one train of the required systems remained free from fire damage.

An example of this concern was the licensee's treatment of air-operated valves in the charging and auxiliary feedwater systems, which were required to perform the reactor coolant inventory control and decay heat removal functions, respectively. The licensee did not designate the instrument air system as a required support system and ensure it Enclosure

would remain free of fire damage, so air may not be available to operate these air-operated valves. Consistent with this approach, the licensee did not protect the circuits required to operate these air-operated valves from fire damage. These air-operated valves are normally controlled from the control room to reach and maintain hot shutdown. For postfire safe shutdown, the licensee did not assure the ability to control these valves from the control room by protecting valve control circuits or the air supply. Instead, the licensee relies on local manual actions outside of the control room to de-energize the air-operated valves to their failed positions, and in the case of the turbine-driven auxiliary feedwater pump, to then control the turbine manually. The licensee also assigns an equipment operator to control flow to the steam generators by throttling other manual valves as directed by the control room operators via radio to compensate for the loss of control of the air-operated valves.

The licensee disagreed with the inspectors' interpretation of the fire protection program requirements and believed the current program complies with their license condition.

The licensee submitted the basis for their position in Luminant letter CP-200800962, TXX-08105, dated July 24, 2008. This issue was discussed with the license and the Office of Nuclear Reactor Regulation, and the staff has concluded that the NRC did not approve manual actions in lieu of protection for equipment required for safe shutdown (refer to Attachment 2 of this report).

Comanche Peak Unit 1 License Condition 2.G states:

"Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24."

In Supplemental Safety Evaluation Report 12, the NRC staff documented the review of the "Fire Protection of the Safe Shutdown Capability" against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b. The NRC staff concluded:

"The applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability;"

and "Associated circuits whose fire-induced spurious operation could affect shutdown were identified to determine those components whose maloperation could affect safe shutdown. These spurious operations are terminated by operator actions.

The applicant identified these operator actions and allowed the operator sufficient time to perform these actions. On the basis of its evaluation, the staff concludes that these operator actions will terminate spurious operations that could affect plant shutdown." (Emphasis added)

The manual actions discussed related to spurious actuations resulting from damage to associated circuits. The NRC staff did not discuss or approve any deviations from the requirements for physical separation or protection specified in the standard review plan to allow the use of local operator manual actions to operate components necessary to Enclosure

achieve or maintain hot shutdown. The licensee has entered this issue into their corrective action program as Smart Form SMF-2009-004454-00.

Analysis. Failure to ensure that one train of the systems required for hot shutdown was free from fire damage was a performance deficiency. The inspectors determined that this finding was more than minor because it is associated with the protection against external factors attribute of the Mitigating Systems cornerstone, and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to external events (such as fire) to prevent undesirable consequences.

The inspectors initiated an evaluation of this finding using the significance determination process in Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving postfire safe shutdown systems. Additional information was required from the licensee concerning the scope of components identified as requiring manual actions, the fire areas where the manual actions were required and the routing of the cables of interest within those fire areas for Unit 1. Thirty-three components required to achieve and maintain hot shutdown were identified for further evaluation. Plant walkdowns were performed in 12 fire areas to identify fire scenarios that could potentially damage the cables of interest for these 33 valves credited for establishing and maintaining hot shutdown.

Using the methodology in Manual Chapter 0609, Appendix F, the plant walkdown results identified seven fire scenarios in three fire areas with the potential to damage cables for eleven valves required to establish and maintain hot shutdown. Since the issue involved multiple fire areas, a modified Phase 2 analysis was developed to access the risk due to the seven fire scenarios. The analysis was reviewed by a senior reactor analyst, who confirmed the issue resulted in a total delta core damage frequency of 3. 7 x 10-7 and that the issue had very low safety significance.

Enforcement. The Unit 1 License Condition 2.G states, "Luminant Generation Company LLC shall implement and maintain in effect a!! provisions cf the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24." In Supplemental Safety Evaluation Report 12, the NRC staff concluded from review of the "Fire Protection of the Safe Shutdown Capability" against the guidelines of Standard Review Plan Section 9.5.1, Position C.5.b, "The applicant's analysis indicates that at least one of the redundant trains needed for safe shutdown would be free of fire damage by providing separation, fire barriers, and/or alternative shutdown capability."

Contrary to the above, the licensee failed to properly implement the approved fire protection program. Specifically, the licensee did not assure that one train of equipment required to achieve and maintain safe hot shutdown conditions remained free from fire damage. The fire protection program, as implemented, relied on the use of local operator manual actions to operate components required to achieve and maintain safe hot shutdown conditions resulting from potential fire damage thus providing less physical separation and protection from the affects of fire than required by the approved fire protection program. Enclosure

Since the violation was of very low safety significance and was documented in the licensee's corrective action program as Smart Form SMF-2009-004454-00, it is being treated as a noncited violation, consistent with Section VI.A.1 of the NRC Enforcement Policy: NCV 05000445/2009004-05; 00500446/2009004-05, "Failure to Assure that One Train of Equipment is Free From Fire Damage."

.6 (Closed) Unresolved Item 05000445/2008006-03: 05000446/2008006-03, "Inadequate Alternative Shutdown Procedure" Introduction. The inspectors identified a Green noncited violation of Technical Specification 5.4.1.d for the failure to maintain adequate written procedures covering fire protection program implementation. Specifically, Procedure ABN-803A, "Response to a Fire in the Control Room or Cable Spreading Room," that is used to perform an alternate shutdown, had two examples of critical actions that could not be completed in the time required by the postfire safe shutdown analysis. The licensee documented this deficiency in Smart Form SMF-2009-004455.

Description. Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Alternate shutdown at the Comanche Peak Steam Electric Station requires operators to safely shutdown the plant in accordance with Procedure ABN-803A for Unit *1 for fire in the controi room or cabie spreading room requiring evacuation of the control room.

The inspectors performed a wa!kthrough of Procedure ABN-803A for a simulated fire in either the control room or cable spreading room that required operators to shutdown the plant using manual actions and controls at the remote shutdown panel.

Procedure ABN-803A, Attachment 13 specified the maximum allowable times to complete certain actions. The inspectors noted during the timed walkthrough by operators that the following actions could not be performed within the required times.

Example 1 - Spurious Opening of the Train A Power-Operated Relief Valve A fire in either the control room or cable spreading room could result in a power-operated relief valve spuriously opening. To close the trains A and B power-operated relief valves, a relief reactor operator would, in accordance with Procedure ABN-803A, Attachment 2, transfer control of the power-operated relief valves from the control room to the remote shutdown panel. When this is accomplished, the fire induced hot short would be isolated and the power-operated relief valve would return to its closed position. According to Attachment 13 of Procedure ABN-803A, operators must complete this action within 5 minutes to avoid empting the pressurizer.

Procedure ABN-803A, Attachment 2, step D instructed the relief reactor operator to transfer control of 46 switches at the transfer panel from the control room to the remote shutdown panel. The inspectors timed the completion of all 46 transfer switches to be 7 minutes and 24 seconds. The inspectors estimated that the transfer of the train A power-operated relief valve would occur at approximately 6 minutes. Attachment 2, step C, stated that the transfer of the 46 switches cannot be started until communication has been established with the reactor operator at the remote shutdown panel. Enclosure EXCERPTS FROM DOCUMENTS DISCUSSED IN THIS LETTER

CPS

/ FSAR 9.5 OTHER AUXILIARY SYSTEMS 50

9. S. 1 FIRE PROTECTION SYSTEM

9. 5. 1. l General This section is a description of the Fire Protection Program of the 50 CPSES units 1 and 2.

The evaluation of fire hazards is included in 71 the CPSES Fire Protection Report (FPR) which follows the format of the U.S. Nuclear Regulatory Commissions's "Supplementary Guidance on Information Needed for Fire Protection Program Evaluation" and the 50 supplementary criteria in their September 30, 1976, letter.

The overall Fire Protection Program was developed utilizing the defense in depth concept.

This concept is a combination of:

1.

Preventing fires from starting

2.

Quickly detecting and suppressing fires that do occur to limit the extent of damage

3.

Designing plant safety systems so that a fire that becomes fully established and burns for a considerable time, in spite of the fire protection systems provided, will not prevent essential plant safety functions from being performed.

66 The FPR quantifies potential fire hazards throughout the plant in 71 terms of combustible heat release loading.

The Fire Protecliun and Detection Systems are designed based on this heat release loading and 66 on the nature of the transient and in situ combustible material in the area.

A summary of this information is presented in tabular form in 71 the FPR.

9.5-1 P,rnendment 71 May 27, 1988

13.

CPS

/FSAR Fire Hazards Analysis Evaluation 71 A Fire Ha7a Analysis aluation is an assessment of the impact 71 of a single fire hazard on redundant components or systems used to provide fire safe shutdown functions for the plant.

A Fire Hazards Analysis Evaluation is performed by a Fire Protection Engineer and, if required a Systems Engineer.

The purpose of a Fire Hazards Analysis Evaluation is to demonstrate compliance with BTP APCSB 9.5-1 Appendix A based on the following considerations:

potential transient and in situ combustible hazards are 66 considered.

protection provided is commensurate with the hazards.

66 the consequences of a fire on the plant's ability to safely 66 shutdown are considered.

The Fire Hazards Analysis Evaluation is written, organized 71 and maintained to facilitate review by a person who is not involved in the evaluation.

The conclusions of the FHA Evaluations are summarized in 71 the applicable sections of the Fire Protection Report.

/I 9.5.1.2.2

\\

Assumptions The FHA Evaluation is based on the following assumptions:

50

1.

Generally, the minimum fire barrier rating is three hours except 65 for the barriers enclosing the stairwells and elevator shafts, which are rated at two hours, the cable tray/conduit fire barriers which are rated at I-hour, and other special cases where a rating of less than three hours is adequate.

t,.l; IV(.t..,-,fr*".,,_p 0 /JLrC'f.f-ar q_cfro/15 II'\\ ft.rs /,st:

9.5-5 Amendment 71 May 27, 1988

71 71 65 65 65 54 65 66

2.

3.

4.

CPSES/FSAR When it is determined that a fire involving a fire safe shutdown c

onent Or' stein 0rl l l not affect its undant counterpart, the undant system is ass er ate thout failures~

The Maximum Permissible Fire Loading for a fire zone assumes a fire burning in the area which follows the characteristics of the standard time-temperature curve, or as noted in the FPR, Reference [19].

A fire involving a combustible loading, up to the Maximum Permissible Fire Loading for the fire zone, will be contained within the fire area by the passive and active/fire protection features (i.e. fire wall and sprinklers, etc.).

Furthermore, it is assumed that if any of these passive or active fire protection features is inoperable and the compensatory actions required by Technical Specifications have been implemented then an equivalent level of protection is provided.

9.5.1.2.3 Methodology In order to evaluate potential fire hazards, provide adequate fire protection, ensure isolation of fire safe shutdown systems from these hazards, and prevent the release of radioactive material to the environment, the following method of design and analysis has been formulated and i,nplemented for the entire plant:

The plant is divided into separate fire areas using plant walls and f 1 oors as barTi ers.

Due curis 1 uer*ctt. i un as-shown below 1 s given to the separation of redundant fire safe shutdown components from each other, from non-fire safe shutdown components and from major concentrations of combustible materials.

Considerations were also given to other area characteristics such as electrical cable routing into and through the area, the ductwork supplying and exhausting the area, access and egress routes for the area, and vent area for depressurization during a tornado.

Amendment 71 9.5-6 May 27, 1988

2.

3.

CPS FSAR For each fire area/fire zone, the heat of combustion for each ustible is cal ulated.

The calculat heat co1nbustion for all in-situ combustibles is divided by the floor area to determine the combustible loading (BTU/sq ft) for the fire area/fire zone.

In addition, the approximate fire duration ( mi nut es) is determined based on the ASTM E-119 standard time-temperature curve.

The transient combustibles and the in-situ combustibles will not exceed the Maximum Permissible Fire Loading without implementation of compensatory measures.

The fire safe shutdown essential equipment in each area is tabulated.

4.

Once the fire area and combustible material information is tabulated, fire protection equipment is located throughout the plant based on the severity and configuration of the fire hazards, the calculated heat release of each fire area and the plant equipment and components located in the fire area.

65 65

5.

Fire detectors are located in all areas of the plant where there 66 is a significant combustible loading and in all areas containing equipment required for safe shutdown except as described in

6.

Section 9.5.1.6.1.

Hose stations are installed in all safety related buildings of the plant such that an effective hose stream can reach any location in a safety related building except Section 9.5.1.6.1.

7.

Portable extinguishers are located in all safety related buildings in accordance with NFPA 10 requirements.

9.5-7 May 27, 1988 66

65 71 65 65 66 71 CPSES/FSAR

8.

Fixed automatic water suppression systems will generally be

9.

installed in safety related plant areas where any of the following conditions exist:

a.

A high fire hazard exists h

LJ

Redundant safe shutdown equipment or cabling outside the Containment Building is located in the same fire area and is not separated by a three hour fire barrier.

c.

There is a congestion of cabling.

In areas where condition (a) and in areas where condition (b) described above exists, the type of protection that will be coverage adequate for the hazard in the area unless iustification for deviations are orovided ner reference r1q1 anrl I

I I..

~ -

as described in 9.5.1.6.1.

The water spray design density will be based on Section 9.5.1.6.1-E.3.c.

Where the condition described in (c) exists, based on Section 0

~ 1 n

~ r rn...... ~nL-lr;.,,...

r1!r-+r--mr

,,1.;11 hr--

'!""'\\,,....,...,, *.:,...f,.._.,...t

..C......,.,....

........... t...1.!.........

.l,.,...

..1*..J*J..*Ll*...l*\\...J

->f-'1 lllf\\.1\\,,,..1

.:3J.:Jt..\\_.lll.J V'/111 UC J--'IUVIUCU IVI

\\..QUIIII~

LV augment other fire protection features in the area.

Where redundant fire safe shutdown equipment cabling is located in the same fire area and is not separated by a three hour fire barrier or a horizontal distance of 20 feet with negligible 55

intervening combustibles or fire hazard, one train of this cabling will be enclosed by a one-hour fire barrier (or radiant energy shield inside containment) unless an alternate shutdown path is utilized or justification for deviations are provided per reference [19] except as described in Section 9.5.1.6.1.

A.mendment 71 May 27, 1988 9.5-8

CPS

/FSAR 9.5.1.6 Conclusions 9.5.l.fi.l Comparison with Appendix A of Branch Technical Position APCSB 9.5-1 of Standard Review Plan 9.5.1 As requested by the NRC in their September 30, 1976, letter, the following is a comparison of the CPSES fire protection program with the guidelines in Appendix A to the above branch technical position.

May 27, 1988 9.5-32

17 1

1 l..!..

0421. 1 17 C

I I

AR CPSES Fire Protection Program The applicant 11 assure 1 th procurement and p ramrnatic requirements, as well as audit and surveillance, that adequate documentation will be prepared and maintained to serve as evidence that the fire protection program is in conformance with the above requirements.

APCSB 9.5-1 Appendix A C.10 Audits Audits should be conducted and documented to verify compliance with the fire protection program including design and procurement documents; instructions; procedures and drawings; and inspection and test activities.

CPSES Fire Protection Program Audits will be conducted and documented to serve as evidence that the applicant has assured that activities including design, procurement, instructions, procedures, inspections and tests are in compliance with the fire protection program.

I

\\

I APCSB 9.5-1 Appendix A D.

General Guideline for Plant Protection D.1 Building Design 0.1.a Plant Layouts should be arranged to:

( 1 )

Isolate safety-related systems from unacceptable hazards, and January 15, 1988 9.5-52

)

CPSES Fire Protection Program (1)

All buildings of the plant are divided into fire areas.

The 50 criteria used to develop this arrangement are discussed in Subsection 9.5.1.2.2, 9.5.1.2.3 and 9.5.1.5.1.

APCSB 9.5-1 Appendix A (2)

Separate redundant safety related systems from each other so that both are not subject to damage from a single fire hazard.

(2)

Alternatives:

(a)

Redundant safety-related systems that are subject to damage from a single fire hazard should be protected by a combination of fire retardant coatings and fire detection and suppression systems, or (b) a separate system to perform the safety function should be provided.

CPSES Fire Protection Program (2)

(a) :

Where redundant fire safe shutdown sys terns, required to I

bring the plant to a hot standby condition, are located a'

within the same fire area 2nd are,11h i i:>rt to rl i'!ffii'\\(]P from

-*,__--,;_*0 -_, '-

-**** -* ::J -

I' single fire hazard a Fire Hazards Analysis Evaluation demonstrates and documents compliance to that recommended in the guideline by protecting the function with one of the following:

9.5-53

.Amendment 71 May 27, 1988 71 Ill I

rr tJ'.J 7"

I l 71 71 71 CPSES/FSAR For terns located outside the Containment Building the following is provided:

1)

A one-hour fire barrier on one set of required fire safe shutdown cabling and, based on the fire hazards of the area, automatic fire suppression and fire detection are provided.

2)

Alternate shutdown capability

3)

Fire detection and suppression, adequate for the hazards of the area, accompanied by 20 feet of horizontal separation with negligible intervening combustibles or fire hazards, u,nless justified per

/J, _

Dcforcnrc, r1ol

/I r,c,_..tL.

L..J/,,.,/~ r,.,.,.__li-of";::.e--h..,.. ~ort L"'-'J *

/('.,t__t I

I IJ

/d J;

~ of f,or C-Vl"'i'r1C(

/1).., juJf1 fr<!,;,f, *..,,cpa.,

/

6 "1 a>l'/14 S fn

/,e.Gt,,,

0 P f'r.:, f,u:_{io.... / <::'(/'<U'"i fio-1.

Separation of redundant required sets of fire safe shutdown systems and components by a fire barrier having a 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months rating, unless justified per Reference [19].

ror systems 1ccated inside the Containment Building the following is provided:

1)

2)

Fire detection in combination with radiant energy shields protecting one set of required fire safe shutdown systems and components unless justified per Reference [19].

Fire detection accompanied by 20 feet of horizontal separation with negligible intervening combustibles or fire hazards, unless justified per Reference

[ 19].

(b)

Where a redundant system required to bring the plant to a cold shutdown condition is subject to damage from a single Amendment 71 May 27, 1988 fire hazard, the foll ng will be provided:

9.5-54

NUREG-0797 Safety Evaluation Report related to the operation of Corn_anche Peak Steam F,lectric Station, Units 1 and 2 Docket Nos. 50-445 and 50-446 Texas Utilities Generating Company, et al.

U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation July 1981

the requirements of GDC 4 with respect to tornado missiles and the guidelines of Regulator; Guide 1.117 BTP

_)-1 U

n1et.

Based on the above, the staff concludes that the safety chilled-water system meets the requirements of GDC 2. 4. 44, 45, and 46 with respect to protection against natural phenomena and missiles.

decay heat removal capability, insen1ice inspection. and functional testing, and the guidelines of Regulatory Guides 1.26. 1.291 i.102, and 1.117 and BTP ASB 3-1 with respect to the Quality Group and seismic classification. external flooding, tornado missile, and pipe-break effect protection. It is, therefore, acceptable. except as noted above.

9.5 Other Auxiliary Systems 9.5.1 Fire Protection Review The staff has reviewed the Comanche Peak fire protection program re-evaluation and fire hazards analysis submitted by the applicant by letter dated April 1978, including Revision 2. Because Units 1 and 2 are of the same design except as noted, the comments made in this report apply to both unns.

The appiicant's re-evaluation was in response to the staffs request for a review of the fire protection program against the guidelines of Appendix A to BTP ASB 9.5-1. The overall objective of the staff review is to ensure that in the event of a fire at Comanche Peak, personnel and plant equipment would be adequate to sateiy shutdown the reactor. to maintam the plant in a safe-shutdown condition. and to minimize the release of radioactivity to the environment.

The staff review includes an evaluation of the automatic and manually operated water and gas fire suppression systems, the fire detection system, fire barriers, fire doors and dampers, fire protection administrative controls, and the fire brigade size and training. There has not yet been a related site visit. The staff has asked. the applicant to identify any specific exception to the guidelines in

/l Appendix A to BTP 9.5-1 and Appendix R to 10 CFR Part 50. The staff has also requested infonnation related to maintaining a postfire shutdown capability. All systems, areas, and evaluations discussed herein are subject to revision following a fire protection site visit and the receipt of the requested infom1ation. This remains an outstanding issue.

F511<. S.e_.__f1a""' 9. s-.,. C. I I

,, I 5/JC!.c_, h <:..

1-:, f11.e._ c... ~r,so/1. ;vo 9.5.1.1 Fire Protection Systems Description and Evaluation Water Supplv System ex:.ce/'t-'<V'I

-le ql{oc..,.J o.fYl/15

/*L..t.t. or 13**f,e_c-f.o,,-./s.e,'2't"'t.f-1c.,,..,

WQ..fQ_ /'L'jves te..c/,

The water supply system is common to both units. It consists of two fire pumps connected through a common header to a 12-in., ductile iron pipe yard main loop. Both the electric motor-and diesel-driven fire pumps are rated at 2500 gpm at 138 psi. The fire pumps and their controllers are UL listed. Their design and installation conform to the requirements of National Fire Protection Association (NFPA) Standard 20, "Standard for the Installation of Centrifugal Fire Pumps." The pumps are located in the service water intake structure with the diesel fire pump enclosed in a 3-hr-fire-rated enclosure with a water deluge system.

The pumps take suction from the safe-shutdown impounJrneul waler supply, which is a seismic structure containing millions of gallons of water. Each fire pump has a separate suction line to the water supply source.

9-29

Based on its evaluation, the staff concludes that the protection for the diesel generator rooms w

n1eets 1\\SB 9.5-1 and is, therefore, acccptabie.

Batterv Rooms The plant battery rooms are separated from each other and from the balance of plant by 3-hr-fire-rated barriers. The ventilation system is designed to maintain the hydrogen level below 2%. Ho ' se stations and portable fire extinguishers are available in the area for fire suppression. During a site visit~ the staff will revie\\v cable rot1tings and determine \\vhether the applicant has provided a hydrogen gas detection system that alarms in the control room.

Other Plant Areas The staff will evaluate other plant areas during a site visit. In general, the applicant will be required to provide fire detectors, portable extinguishers, and automatic sprinklers before fuel load. The staff does not have sufficient information to review the plant communication systems that will be used by the fire brigade. This item will be reviewed during the staff site visit.

9.5.1.5 Alternate Shutdown The applicant has committed to install an electrically and physically independent alternate shutdown system for the control room and cable spreading room. The applicant has not provided the details of the design of the alternate shutdown system, nor has he provided the information necessary to complete the review. The staff will report on the adequacy of the alternate shutdown system after its site visit.

9.5.1.6 Administrative Controls, Fire Brigade, and Technical Specifications The applicant has not provided enough infonnation for the staff to evaluate this aspect of the overall fire protection program. The staff will require that a minimum five-person fire brigade be maintained on silc at all times, with adequate dedicated breathing apparatus for ail fire brigade members.

9.5.1.7 Appendix R Statement On October 27, 1980, the Commission approved for publication in the Federal Re2:ister a Section 50.48 and Appendix R to 10 CFR Part 50, delineating certain fire protection provisions i nuclear power plants licensed to operate before January 1, 1979. Although this fire protection rule does not apply to Comanche Peak, the staff will use the contents of this rule in the evaluation of th fire protection program.

The applicant has not yet made a commitment to meet the requirements of Appendix R to 10 CFR Part 50. The staff wiii require the applicant to comply with all the technical requirements of Appendix R or provide equivalent protection.

9-34

Safety Evaluation Report related to the operation of NUREG-0797 Supplement Comanche Peak Steam Electric Station, Units I and 2 Docket Nos. 50-445 and 50-446 Texas Utilities Generating Company, et al-U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation October 1981 ABSTRACT Supplement No. 1 to the Safety Evaluation Report (SER) related to the operation of the Comanche Peak Steam Electric Station, Units 1 and 2, has been prepared by the Office of Nuclear Reactor Regulation of the U.S. Nuclear Regulatory Commission. The facility is located in Somervell County, Texas. Subject to favorable resolution of the items identified in this supplement, the staff concludes that the facility can be operated by the applicant without endangering the health and safety of the public. This document provides the NRC staffs evaluation of the outstanding and confirmatory issues that have been resolved, and addresses changes to the SER which have resulted from the receipt of additional information from the applicant.

Comanche Peak SSER #1

The applicant, by Jetter dated /\\ugust 28~ 1981, has committed to describe the batter)' room air flo,v monitors in a future amendment to the Based on the applicant's commitments and the staffs site visit, the staff concludes that the battery room air Oow monitors are adequate, meet the requirements of Appendix A to BTP ASB 9.5-1, and are, therefore, acceptable.

Other Plant Areas In the SER, the staff stated that "other plants areas" would be evaluated during our site visit. The staff has evaluated other areas-of the plant not specifically addressed in our SER and, also, the staff reviewed the plant's communication systems that will be used by the fire brigade.

The applicant has committed to install additional fire detectors, portable extinguishers and automatic sprinklers, prior to fuel loading. The applicant has, also, installed an adequate communication system for use by the fire brigade.

The staff finds that the fire protection for these areas, with the indicated modifications is in accordance with the guidelines of Appendix A to BTP ASB 9.5-1 and is, therefore, acceptable.

9.5.1.6 Administrative Controls, Fire Brigade, and Technical Specifications In the SER, the staff stated that it did not have adequate information to complete its review regarding the Administrative Controls, Fire Brigade, and Technical Specifications.

The applicant, by letter dated August 28, 1981, has committed to implement the Technical Specifications in accordance with the NRC's Standard Technical Specifications.

'T'1~A

,-** ~~.1;.-_.

..,_.,,_.4-. \\...,.--,.,-

....,.,,.._.,,.....,..,_... -.,-,~.J..J..,...,_~

l-....,,~ 1,..,H-,..,.....,.ln+~rl A"1~'!l""t "")Q 1001 f-!'"'I> ;'YV\\-nln1"Y'\\D-¥'lt tho hra 't"\\rntar-t~f""\\n 1 UC dl:--'.l-111L-ct.UL 11a~ \\..-U1111111LLCU, u y 11...,Lu..,.1 Uc:tL\\..,U riu5u,:::n,.::..u,

1../0 1., l.V 111..t1-11v1u...... u1,. Lu....,.LH""' _FJ..VL""'""'\\,,J.'-'u program contained in the staffs supplemental guidance, "Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls and Quality Assurance," dated August 29, 1977 including (1) fire brigade training, (2) control of combustibles, (3) control of ignition sources, ( 4) fire fighting and (5) quality assurance.

The staff concludes that, with the applicant's commitments, the 5-man fire brigade, and the equipment and training for the brigade conforms to the recommendations of the National Fire Protection Association, to Appendix A to BTP ASB 9.5-1, to NRC supplemental staff guidelines and, to NRC Standard Technical Specifications, and, therefore, are acceptable.

9.5.1.7 Appendix R Statement The applicant has hot committed to meet the technical requirements of Appendix R to 10 CFR Part 50 or provide equivalent protection. Since the review of Comanche Peak was not specifically conducted to Appendix R requirements, we will require the applicant to meet the technical requirements of Appendix R to 10 CFR Part 50, or provide equivalent protection. This remains an outstanding issue.

Comanche Peak SSER # I 9-3

\\

NURE 79 Supplement 1'Jo. 12 Safet)' Evaluation Report related to the operation of Comanche Peak Steam Electric Station, Units 1 and 2 Docket Nos. 50445 and 50-446 Texas Utilities Generating Company, et al.

U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation October 1985 S5E/(

WG..>

/nu ABS TR.A.CT Supplement 12 to the Safety Evaluation Report related to the operation of the Comanche Peak Steam Electric Station. Units 1 and 2 (NUREG-0797), has been prepared by the Office of Nuclear Reactor Regulation of the U.S. Nuclear Regulatory Commission. The facility is located in Somerve!! County~ Texas; approximatel)' 40 miles southv;est of Fort \\Vorth, Texas. This supplement reports the status of certain issues that had not been resolved at the time of publication of the Safety Evaluation Report and Supplements 1, 2, 3, 4, and 6 to that report. This supplement also lists the new issues that have been identified since Supplement 6 was issued and includes the evaluations for licensing items resolved in this interim period. Supplement 5 has not been issued.

Supplements 7, 8, 9, I 0, and 11 were limited to the staff evaluations of allegations investigated by the NRC Technical Review Team, and items identified therein are not included in this supplement.

Comanche Peak SSER 12 1-1

On the basis of the improvements in the handling of heavy loads resulting from irnpkmentation of

<CREG-0612 (Phase I). further action is not required to reduce the risks associated with the handling of heavy loads (NUREG-06 l 2. Phase II). Therefore, a detailed Phase II review of heavy loads 1s not necessary and Phase II is considered compieted. However, although not a requirement. the staff encourages the implementation of any actions identified in Phase 1I regarding the handling of heavy loads that licensees consider appropriate.

On the basis of the above, Outstanding Issue (23) in Section 1.7 of the SER is resolved.

9.5 Other Auxiliary Systems 9.5. 1 Fire Protection In Supplement 1 to the SER, the staff indicated that its review of fire protection was incomplete with respect to the alternate safe shutdown system and conformance with Appendix R to 10 CFR

50. That supplement further noted that the staff would confirm documentation of the applicant's commitments relating to the fire protection program.

By letters dated August 16, October 15, December 18, and December 20, 1984, and February 19, June 26, July 22, and August 14, 1985, and in FSAR Amendments 50, 52, 53, and 54, the applicant made significant changes in the fire protection program and requested approval of listed deviations from the staff guideiines.

,;rf eJ.

,I._

- ",L.

/

1.11 I:, / !..., 1,e.,,re.,-,.1 U' n, I

_//

.,...,,.,.._-~..JI-$

..*"\\

d-""'14 S~c~C'l../~./'\\f-ThiS section completely supersedes those in previous supplements. '

1* ;_-~; - * * *5

'*, _, +!.. _ 1 **

<: r/'-'-

vJ6 s~.......,,l V }"I...,...,"?

""-~'"...

f I

f"tV!7-;- !-,,..,,.,, b~"Ji.

Jc,a.1 -,-./.l.,.,.,f--

The staff has reviewed the fire protection program, as described in the applicant's f SAR through Amendment 55, for conformance with the Standard Review Plan (SRP, NUREG-0800), Section 9.5.1. This docu1nent addresses the applicant's co11forn1ancc vvith Branch Te'2hr1ical Pu~iliun (BTP)

CMEB 9.5-1.

As part of its review, the staff visited the plant site to examine the relationship of safety-related components, systems, and structures in specific plant areas to both combustible materials and to associated fire detection and suppression systems.

The staffs review included an evaluation of the automatic and manually operated water and gas fire suppression systems, the fire detection systems, fire barriers, fire doors and dampers, fire protection administrative controls, and the fire brigade size and training. The objective of the review was to ensure that, in the event of a fire, personnel and plant equipment would be adequate to safely shut down the reactor, to maintain the plant in a safe shutdown condition, and to minimize the release of radioactive material to the environment.

9.5. i.1 fire Protection Program Requirements Fire Protection Program The fire protection program is described in the applicant's Fire Protection Evaluation Report and the FSAR. The program establishes policy for the protection of structures, systems, and components important to safety and conforms to Comanche Peak SSER 12 9-3

this to be in accordance the L Sections C.5.a(l 0) and (1 i ), and, therefore. acceptable.

High voltage-high amperage transformers installed inside buildings are of the dry type. All oil-filled transformers are installed outside buiidings containing safety-related equipment. All walls of buildings containing safety-reiated equipment iocated within 50 ft of any oil-filled transformer have a minimum fire resistance rating of 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Each oil-filled transformer is protected with a water spray extinguishing system that is automaticaily actuated by heat detectors. On the basis of its evaluation, the staff concludes that the installation of the transformer meets the guidelines of BTP CMEB 9.5-i, Sections C.5.a(l2) and (13), and is, therefore, acceptable.

Access and escape routes are provided for each fire area. Stairwells outside primary containment serving as access and egress routes are enclosed with fire barriers having 2-hour fire ratings with 1-1/2-hour UL-labeled fire door assemblies at all openings into the stairwell. Fire exit routes will be clearly marked and established by prefire plans. On the basis of its review, the staff concludes that the applicant's fire protection program concerning access and egress routes meets the guidelines of BTP CMEB 9.5-1, Sections C.5.a( 6) and (7), and is, therefore, acceptable.

Fire Protection of the Safe Shul<lown Capabilitv By letters dated October 1, 1984, and May 21, August 5, 6, and 14, and September 4, 1985, the applicant provided information on the safe shutdown capabiiiry following a fire at Comanche Peak Units I and 2. The staff has reviewed the applicant's design against the guidelines of SRP Section 9.5.1, Position C.5.b.

The applicant's safe shutdown analysis identifies the redundant systems available for achieving hot shutdown and cold shutdown. For hot shutdown, the auxiliary feedwater system, the atmospheric steam relief valves, and the boron addition portion of the chemic;:,J and volume control sys!!:111

~..ht

__ ?_'!?:ita.J2lt. For cold shutdown, the pressurizer heater controls, auxiliary sprays and redundant trains of the residual heat removal system would be available. The safe shutdown analysis considers components, cabling, and support equipment for systems identified above that are needed to achieve shutdown. The support equipment for hot and cold shutdown includes the service water system; the component cooling water system; the diesel generators; and the HVAC systems for the control room, the emergency core cooling system equipment rooms, the service water and component cooling water pump rooms, the diesel generator rooms, and the essential switchgear rooms. The a licant's analysis indicates that at least one of the redu

,ins needed for safe shutdown would be free of fire damage y prov1 mg separation, fire barriei:_s, and/or alternative shutdown capability.

The applicant developed plant safe shutdown logics to identify components required to achieve shutdown. The applicant also utilized a computer program to determine the routes of power and control cables by fire zones. The computer program product is used in conjunction with the safe shutdown logics to identify components that provide a safe shutdown path. After identifying fire-safe-shutdown-related components (i.e., equipment, trays, conduits, and cables) by fire area, the applicant performed an interaction study to locate the fire areas Comanche Peak SSER 12 9-8

vvherc redundant paths are not properly separated.

interaction study was done by

\\Valkdowns.

review identified equipment and cabling that is associated because of a shared common power source or common enclosure. Associated circuits whose fire-induced spurious operation could affect shutdown were identified to determine those components whose maloperation could affect safe shutdown. These spurious operations are terminated by operator actions. The applicant identified these operator actions and allowed the operator sufficient time perfonn these actions. On the basis of its evaluation, the staff concludes that these operator actions will terminate spurious operations that could affect plant shutdown.

omAs +;.

.e;_ SSc.CreJ~d c,,c_._,, f-.s

.rY!"t be_ of< Ip /U/2.c.. ~11"1 "",,;.e-y.

The following are high/low pressure interfaces: residual heat removal (RHR) suction valves, pressurizer power-operated relief valves, excess letdown isolation valves, normal letdown isolation valves, and the reactor head vent isolation valves. The means for preventing spurious operation of the RHR suction valves' high/low pressure interface is addressed as follows.

Power for the RHR shutdown isolation valves has been removed at the circuit breaker; therefore, spurious operation as a result of fire damage to control cables is not possible. Because the valves are pmvered by 3-phase 480-V ac, spurious operation as a result of fire-damaged power cables between the circuit breaker and the valve motor is not considered credible.

To prevent spurious operation of the four remaining high/low pressure interfaces, the applicant relies on operator actions to prevent the spurious actions from occun~ing. These actions involve the d1sconnect1ng of power sources from the high/low pressure interfaces and are described in the plant operating procedures. The staff concludes this is an acceptable means of preventing spurious operations in high/low pressure interfaces.

The applicant responded to the staffs request for information involving verification that breaker fuses are properly coordinated and the trip settings are properly selected. The applicant reviewed the breaker ft1ses and recalibrated or replaced any breaker fuses that \\,Vere not properly coordinated or selected. The staff concludes that the applicant's coordination and selective tripping of breaker fuses is acceptable.

On the basis of the applicant's submittals and its evaluation, the staff concludes that the Comanche(

Peak design for safe shutdown capability is acceptable. See also Sections 7.4.2 and 8.4.6 of this supplement for additional staff evaluations of the safe shutdown capability during a fire in the control room or cable spreading room.

rs By letters dated August 15, 1984, and February 19, July 29, and August 14, 1985, the applicant requested deviations from the guidelines of Section III.G.2 of Appendix R (BTP CMEB 9.5-1, )

Section C.5.b) for the fire protection of safe shutdown capability. The following are the staffs evaluations of each deviation request:

1

/Je....,11e.f10'1 5 c/1 ;J v10 (I)

Service Water Intake Strncture M v* lu.e_ o hi.I/ '.5, The applicant requested a deviation from Section III.G.2 of Appendix R (BTP CMEB 9.5-1, Section C.5.b) because complete I-hour-fire-rated barriers are not provided to separate the redundant service water pumps.

Comanche Peak SSER 12 9-9

boric acid storage tank area (b) valve isolation room (c) valveroom67

( d) radioactive penetration areas zones SA l@2 and SB 143 (e) boron injection surge tank room safeguard building eievation 852 ft 6 in.

(f) control room HVAC equipment rooms 73 and 74

( 10) installation of automatic sprinkiers not in accordance with NFPA 13 in 10 plant areas (Section 9,5. 1.4):

(a) auxiliary building 790-ft elevation fire area AA fire zone 2 la (b) auxiliary building 810-ft elevation fire area AA fire zone 21 b

( c) auxiliary building 831-ft elevation fire area AA fire zone 21 d

( d) auxiliary building 854-ft elevation fire area AA fire zone 21 f (e) safeguard building 790-ft elevation fire area SB fire zone 4 (f) safeguard building 810-ft elevation fire area SB fire zone 8 (g) safeguard building 831-ft elevation fire area SB fire zone 15 (h) safeguard building 831-ft elev'ation fire area SB fire zone 144 (i) electrical and control building 792-ft elevation fire area EA fire zone 57 (j) electrical and control building 792-ft elevation fire area EA fire zone 43

( l I) installation of non-fire-tested 3-hour barriers in two plant areas (Section 9.5.1.4):

(a) auxiliary building charging pump rooms 200 and 201 (b) safeguard building elevation 831 ft 6 in.

(12) installation of non-fire-rated penetrations in containment (Section 9.5-1.4):

(a) eiectrical penetration seals (b) containment air locks

( c) mechanical penetration seals

( 13) installation of cable not qualified to IEEE 383-1974 (Section 9.5.1.4)

( 14) intertie of the circulating water pump system with the fire protection water supply system (Section 9.5.1.5)

(15) carpet installed in the control room (Section 9.5.1.6)

( 16) day tanks with a capacity greater than 1,100 gal (Section 9.5.1.6) 9.5.1.8 Conclusion On the basis of its review, the staff concludes that the Comanche Peak Fire Protection Program, with thP ~!"~rrwPrl riPui~tif\\nc:, ('f\\nfm*rnc: tf\\ thP rpn,111rp1::1.,c,~tc, {"\\f r..nc '\\ 4 ppPnrliv D to 1 n rFP,n, and Appendix A to BTP CMEB 9.5-1, and is, therefore, acceptable.

Comanche Peak SSER 12 9-3 2

l'JTJREG-0797 - - -

Supplement No. 21 Safety Evaluation Repo.rt related to the operation of Comanche Peak Stean1 Electric Station, Units 1 and 2 Docket Nos. 50-445 and 50-446 Texas Utilities Electric Company, et. al.

U.S. Nudear Regulatory Commission Office of Nuclear Reactor Regulation April 1989 Comanche Peak SSER 21 1-1

9 All 9.5 Other Auxiliary Systems 9.5.1 Fire Protection A site audit (NRC Inspection Report 84-44) of the Comanche Peak fire protection program was conducted from October 24, 1984, through November 2, 1984. This audit, which includes personnel from both the Office of Nuclear Reactor Regulation (NRR) and Region IV, resulted in a number of open items.

The staff issued Supplement 12 to the SER (SSER 12) in October 1985. This supplement contained details on a review of the applicant's fire protection program through Amendment 55 of the FSAR.

On October 9, 1987, the applicant submitted an extensive amendment to the FSAR, just prior to an audit that was conducted from October 19 through October 23, 1987. This amendment included revisions to the fire safe shutdown analyses, the fire hazards analysis, and organizational and design The applicant submitted Revision 1 to the Fire Protection Report by letter dated April 29, 1988. This document'\\ \\\\thich pro\\'idcs the basis of the CPS ES fire protection prcgra111, has been incorporated int8 the FSAR by reference. Revision I to the Fire Protection Report includes information and analyses that address many of the issues raised during the October 1987 site audit. The staff performed a followup site visit to review the resolution of many audit issues from May 2 through 6, 1986.

The applicant compared the CPSES fire protection program with the guidelines contained in Appendix A to Branch Technical Position (BTP) APCSB 9.5-1 (NUREG-0800), as well as with Sections G, J, and O of Appendix R to 10 CFR Part 50. Previously, the staff used the guidelines of BTP CivlEB 9.5-1 to evaluate the adequacy of the fire protection program. However, the staff subsequently concluded that the applicable fire protection criteria for CPSES included Appendix A to BTP APCSB 9.5-1; Sections G, J, L, and 0 of Appendix R to 10 CFR Part 50 (applied as a guideline);

and the guidance issued in Generic Letters 81-12 and 86-10.

The staff has reviewed and evaluated the CPS ES fire protection program as described in the applicant's FSAR through Amendment 71 and performed an additionai audit and a site visit (October 19-23, 1987, and May 2-6, 1988, respectively) as documented below.

9.5.1.1 Fire Protection Program Requirements Fire Protection Pro2-ram In SSER 12, the staff stated that the CPS ES fire protection program met the guidelines of BTP CMEB 9.5-1 and was, therefore, acceptable. During the Comanche Peak SSER 21 9-1

are in place during diesel unloading operations. The staff finds this resolution to a satisfactory method of ensuring the integrity of both trains oil service water pump cables.

( 5) Deviation on Lack of nne-Hour Separation Between Various Equipment In SSER 12, the staff approved a deviation from Section III.G.2 of Appendix R to 10 CFR Part 50 for a lack of 1--hour separation between redundant service water pumps. In a letter dated October 2. 1987, the applicant stated that this deviation request should be expanded to include the service water recirculation valves, branch circuits, exhaust fans, and branch circuit motor control centers (MCCs). The previous deviation was granted on the basis of ( 1) negligible combustible loading, (2) the presence of early warning smoke detection, and (3) area-wide automatic suppression. This area was reviewed during the audit u-0 October 19-23, 1987. The staff determined that the previous conclusions for granting the deviation remain valid and that expanding the deviation to include the additional equipment will not adversely affect plant safety. Therefore, the lack of I-hour separation between the aforementioned components is an acceptable deviation from,Section III.G.2 of Appendix R to 10 CFR Part 50.

15 (6) Manual Actionsfwithin the Same Fire Area)

~----~

I tn

.During the audit of October 19-23, 1987, the staff raised a concern regarding the necessity for plant operators to perform certain manual actions within the same fire area as that containing the postulated fire. During the May 2-6, 1968, site visit, the applicant presented the staff with evaluations detailing each of the manual actions in question, the fire protection features of the fire area iii which the manual action was to be taken, and justification for acceptability of the situation. These evaluations were reviewed in detail by the staff, and each manual action in question was walked down in the field.

As a result of this review, two additional plant modifications, were deemed necessary. These f,

modifications are:

7~<!...Se.. ~.)<4,,,,._//e..s 1-1volv"-

l'Lefu*""~ol e..7,.,,/.1,,,,,...,_rt.,...,, :Sb ;:;,ot.e..:.. 10 "'

t,,.}H

,1114.,-,clc, td bdouJ.

( l)

Fire Area CA (Containment) - Control and power cables associated with valve 8112 (seal return) must be separated from cable interactions that could produce a spurious safety injection signal. This would preclude the need for manual actions to restore seal return in. the fin~ area if ::i fire cm_1sed the loss of this return, During the I\\,fay 1988 site visit, the applicant modified its evaluation to identify this separation criterion. The applicant also stated that these sets of cable v! ill be separated in accordance with plant Design Document DBD-ME-020, "Fire Safe Shutdown Analysis" which establishes separation criteria for redundant safe shutdown devices and cables inside containment.

(2)

Fire Area AA-S (Auxiliary Building-South) - Manual action to realign the component cooling water (CCW) valves may be required to begin within 30 minutes of a fire occurring in the same fire area. Although this is a fairly short time in relation to fire control concerns, the fire area is a large area that covers multiple flours of the auxiliary building. The cables that could cause the spurious operation in question are some distance from the valves and on another elevation. The staff reviewed the fire-protection features of the fire area and found that they provide Comanche Peak SSER 21

reasonable assurance that a fire that night cause spurious valve operation would not propagate within the area and prevent the operators from gaining access to the valves. Because of the large volume of the fire area and the multiple elevations, the staff also determined that smoke and gases generated from the fire would not present a habitability problem for the operators performing the manual action. The concern raised by the staff was that the valves in question were approximately 15 feet above ground and would be difficult to reach in the short amount of time required. Because of this, the applicant, by letter dated May 20, 1988, committed to making the necessary plant modifications to facilitate quick access to the valves.

With the modifications identified above, the manual actions within the same fire areas were found to be acceptable. Staff acceptance is based on the fact that there is sufficient distance to perform manual operations from the ciosest cable that could cause -he spurious operations and that the fire protection features of the fire areas and the timeframes of the manual operations required in relation to anticipated fire development and control are adequate.

Lighting Section III.J of Appendix, R to 10 CFR Part 50 requires that all areas needed for operation of safe shutdown equipment, including access and egress routes thereto, be provided with emergency lighting units with at least an 8-hour-battery power supply.

SSER 12 stated, emergency lighting will be installed in all areas of the plant that may have to be manned for safe shutdown operations and at access and egress routes to and from all areas." The staff found the emergency lighting to be acceptable on this basis. During the 1984 audit, however, the staff found that a number of lights were misaligned and that some areas requiring safe shutdown operations did riot have emergency light. This issue was identified as an open item.

During the audit of October 19-23, 1987, the applicant presented procedures that were designed to ensure the proper alignment of emergency lights. The stall' observed that a number of lights were rnisaligned; however, the applicant stated that because of the present construction phase of the plant.

it was difficult to maintain the lights in alignment. The applicant also presented a procedure for identifying locations that require emergency lights. Although the areas that were identified in the 1984 audit had been provided with lights, new areas-requiring lighting had been identified as a result of changes in the safe shutdown analyses. On the basis of the applicant's commitment that all areas requiring emergency lights would have lights installed before plant operation and the staffs evaluation of the applicant's plan to meet this commitment, the staff finds the emergency lighting to be acceptable.

Communication At the tine of the l 984 audit, plant procedures identified the Gaitronics page system as the method used to contact fire-brigade and other emergency response personnel. The audit team was concerned that a control room fire could disable the page system, leaving no emergency communications system. During the audit Comanche Peak SSER 21 9-10

normally w

held classification to components that are necessary to provide or support ( l) a safety system function, (2) control of outside containment airborne radioactivity released in an accident, or (3) removal of decay heat from spent fuel. The three pumps listed above are not required for safe shutdown of the plant.

The applicant evaluated the three safety-related pump rooms and determined that, because of the substantial reinforced concrete constrnction of the rooms, the insignificant amount of in situ combustibles, and adequate protection in Room 174 (which houses these pumps), a fire in any one of these rooms would riot endanger other safety-related equipment required for safe plant shutdown. In addition, because of the substantial constrnction of the mechanical components in these rooms, the strnctural integrity of #-.he pumps would not be compromised by a fire in the respective pump rooms.

During the site visit of May 2-6, 1988, the staff discussed these conclusions with the applicant and inspected the specific rooms of concern. On the basis of this review, the staff agrees with the applicant's evaluation. Therefore, the staff finds the lack of detection in the three rooms containing safety related pumps to be acceptable.

9 5 1 7 Summary of Deviations From Appendix A to BTP APCSB 9.5-1 and Appendix R to 1.0 CFR Part 50

('0-CD 1 ') *-.,*~*.;.1~- -~--.:1. -~ l?. -1._.. ;r,:,-,-,. f.,.,.,,..,._

Ii ~-~~r1;,, Ii +,.._ "Q'T'D,\\ orc:,p O <::_ 1 'lnrl t<. DDPnrl;v R 0uL1\\.. 1 L.. p1 uv lUCbc U\\,,,L<l11.:, Vu 1 v u~ 111ul1v11.:, 1..1-v111 1 l.l:-11-'""uuJJ\\. i. \\,,

1,..v L).1.

.1 i

.._.,,_ '--J-'-

.,.4..u:u,._ :;...t'f-1'-*~,__..........

to 10 CFR Part 50. On the basis of the evaluations in this report, the staff concludes that.the 11 additional deviations listed below are also acceptable.

( 1) unrated steel hatches in the fire-area boundaries (2) 2-hour-rated stairwell boundaries

13) fire doors mounted to steel angle and not in conformance with Underwriters Laboratories guidelines

( 4) dampers outside barriers

( 5) untested penetration seal configurations in bus ducts (6) untested penetration seal configurations in fiexibie conduit (7) lack of separation and suppression for the redundant residual heat removal inlet isolation valves (8) lack of separation between MSIVs and MSIV solenoids (9) lack of 1-hour separation between service water isoiation valves, service water recirculation valves, branch circuits, exhaust fans, and branch circuit motor control centers

( 1 0) failure to comply with NFP A 72E in certain plant areas (11) failure to comply-with NFPA 14 in certain plant areas 9.5.1.8 Conclusions On the basis of its evaluations, audit, and site visit, as specifically noted in previous paragraphs, the staff concludes that the CPS ES fire protection program, as outlined in the applicant's FSAR through Amendment 71. orovides a level of fire safety that is in conformance with, or-equivalent to, staff guidance in App~ndix A to BTP APCSB 9.5~ 1 and Appendix R to 10 CFR Part 50. In addition, the staff concludes that the following condition related to fire protection shall be placed in the operating license:

Comanche Peak SSER 21 9-14 Eii&lt¥

The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety'./\\_nalysis P._eport (as amended) and as approved in the SER and its supplements, subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

i\\s noted previously, some areas of the fire protection program were found to be acceptable on the basis of actions to be perfom1ed by the applicant in the future. These areas are summarized below:

(1)

(2)

Stairwell Boundaries The applicant could not demonstrate that six stairwell boundaries, which should be qualified as 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months rated, were qualified as such. The applicant will verify the construction of these walls and upgrade the walls to a 2-hour rating if a current rating of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months cannot be documented.

Conduit Seals The applicant committed to sealing-conduits 4 inches and smaller in diameter at the barrier or on both sides of a barrier at the first opening, if detection and suppression do not exist on both sides of the barrier. The staff found the use of untested seals in flexible conduit to be acceptable. The staff also found the use of an untested penetration seal configuration in bus ducts to be acceptable.

(3)

Fire Doors The staff found that UL guidelines that describe how security modifications that could be made to fire doors without jeopardizing the rating of the doors may not have been implemented. The applicant committed to a review of all fire doors now installed to determine if the modifications comply with the guidance provided by UL. When compliance cannot be established, the applicant committed to either bringing the door into compliance or replacing the door.

(4)

Manholes Subject to Flammable-Liquids Fire (5)

The staff found that redundant service water cables in manholes were subject to a flammable-liquids fire when both manholes are open. The applicant committed to providing administrative procedures that prohibit both manhole covers from being removed at the same time.

Emergency Lightimr The staff reviewed emergency lighting in areas containing safe shutdown equipment and the access and egress routes thereto. On the basis of modifications to the safe shutdown analyses, additional areas requiring Comanche Peak SSER 21 9-15

7 Supplement No. 23 Safety Evaluation Report related to the operation of Comanche Peak Steam Electric Station, Units 1 and 2 Docket Nos. 50-445 and 50-446 Texas Utilities Electric Company, et al.

Office of Nuclear Reactor Regulation February 1990 Comanche Peak SSER 23

only ones equipped with accumulators, as staff, therefore, finds that the conclusions reached in of and SEP~ Suppien1ent to the acceptability of the compressed air system remain unchanged by this revision.

Heating, Ventilation, and Air Conditioning (HVAC) Systems 9.4.5 lv1iscellaneous Building Ventilation Systems In SER Section 9.4.5, the staff indicated that the diesel generator building ventilation system included one I 00-percent-capacity exhaust fan. In FSAR Amendments 76 and 78, the applicant provided a more detailed description of the diesel generator building ventilation system. There is one 100-percent capacity exhaust fan for each of the day tank rooms and four 25-percent-capacity exhaust fans (a total of eight fans) for each diesel generator room. This design provides adequate redundancy and more operational flexibility during the winter months when all four exhaust fans may not be required. The staff, therefore, finds that the conclusions reached in Section 9.4.5 of the SER and SSER 22 related to the acceptability of the diesel generator building ventilation system are still valid.

9.5 Other Auxiliary Systems 9.5. l Fire Protection SSER 21 contained a review of the applicant's fire protection program described in the FSAR through Amendment 71 and in Revision I of the Fire Protection Report (FPR) submitted by the applicant in a letter dated April 29, 1988. The applicant has since revised its fire protection program in Amendments 75, 76, and 78 to the FSAR and by submitting Revisions 2 and 3 to the FPR in letters dated July 19, 1989 and September 22, 1989, respectively.

9.5.1.2 Administrative Controls In SSER 21, the staff identified a concern relative to the possibility that tv,:o adjacent manholes containing redundant shutdown cables could be subjected to a flamable liquid since the manholes are in close proximity to the diesel fuel unloading area. During a site audit conducted on October 2-6, 1989 (NRC Inspection Report 50-445/89-69; 50-446/89-69), the applicant presented the n1odified procedures \\Vhich cover the unluading vf diesel fueL The niodified procedures ensure that both manhole covers would be in place before diesel fuel unloading. The procedures were reviewed and found to adequately address the concern raised in SSER 21. Therefore, this concern is considered resolved.

9.5.1.4 General Plant Guidelines Electrical Cable Construction. Cable Travs. and Cab!e Penetrations In FSAR Amendment 78, the applicant identified an additional small amount of cable did not meet the specifications of Institute of Electrical and Electronics Engineers (IEEE) Standard 383-197 4, This cable has been installed in the control room/cable spreading room for the data acquisition system. In SSER 12. Section 9.5. l.4, the staff specified the amount of cahling not in compliance Comanche Peak SSER 23 9-2

U.S. NUCLEAR REGULATORY COMMISS OFFICE OF SPECIAL PROJ(CTS P.02 NRC Insµection Report:

50-445/87-22 50-445 Construction P@rmit:

CPR-126 Oocket No:

App ii cant:

TU Electric Sk1way Tower 400 N0rth.Olive Street Lock Box 81 Dallas, Texas 75201 F.aci1ity Name:

Comanche ?eak Steam Electric Station (CPSES).

Unit 1 Inspection At:

I~specticn Conducted:

Comanche Peak Site, Glen Rose, Texas October 19*23, 1987 Inspectors:

Dennis Ke 1 ey Comanche Peak Steam Electr Also participryting ond contributing to the report w~* e:

Harvey Thomas, Brookhaven National Laboratory (BNL)

Anthony Fresco, BNL Thomas Storey, Science Appiication International Reviewed by:

~hi.llip F.lMcKee, Deputy Director Comanche PeaK Project Division Office of Special Projects ln~pettlon Summary Insoection Conducte~ October 19-23. 1987 (Report S0-445/87-22)

I/ GP/~~

Date I /,

/

r i/ l\\/ I:_,.

'Da t.e Areas inspected:

Special announced inspection of the implem~ntation ot fire protection program and compliance with Branch Technical Position (BTP)

CMEB 9.5-1, Fire Protection for Nuclear Power Plants," (formerly Appendi~ A to BTP APCSB ~.5-1); per FSAR commitments and 5£R evaluation Resuits:

Within the ar!i'as inspected, no violations were identified.

8801200~59 880111 PDR AODCK 05000~45 Q

PDR

P.04 This report documents f1ndfngs durtng an inspection ccnaucted by ~r. A.

Singh and Mr. D, Kelley of tht Office of ~p~cfal Projects (OSP)t ~r. T, A.

Storey cf Science Applications international Corparit1on (SAIC) and Messrs, H. ThCJmas and A. Frtsco of Brookhilven Natfona1 Ldboratory dur1na the perioo October 19*23. 19&7.

The fire protection program fer Comanche Pl:!dk Steam Electric Staticn (CPSEZ} is descr1b::o in the applicant's Fire Protection Report (Ref. A.l}

and the FSAR.

The opp11cant i~ committed to the Fire Prctect1on Program of Appendix A to APCSB 9.5*1* as mod1ticd by app11CiDt correspondence tn tha

~!RC that docu1r.ents additional corr!lr.itments and cev1at1ons from FSA!<

colllmitments.

Supplemerit 12 to th~ 5afoty E.valuation Report (NUREG*079i) issued 1n October 1905 presents the staff rev1Ew of the CPSES Fire Protection Program.

ln Supplen,ent 12 the staff reviewed the applic:crnt's program against branch Tc:ct'tnical Position (OTP) CMEB 9.5.1, ~1i11ch superseded ftpp~ndix A to DTP APCSB 9.5.l.

Among other changes, the cr1teria of Appendix Rt~ 10 CFR Part 50 were factored into GTP CMEB 9.5.:.

TUEC letter date~ October D~ 1987 prov1d~d the staff with an advaoce copy of a change to the FSAR section) relative to the fire protection program *.

TUEC letL~r dated October 2, 1987 provided the staff wit~ r~v1sed deviations to BTP APCSB 9.~-1 Appenoi~ A and 10 CFR 50. Appendix R, A site insp~ction of the CPSES fire protection program ~as conduct~d uuring Octcber 29 thrc~oh November~. 1964. The tnspecticn ~as documented in i~spect1on R~port (IR) SG-445/84~4~. This inspection (hereuft~r referred to as 84-44 inspection) included personnel frum the Office tf Nuclear Reactor Regulation, Re91011 lVand the Office of inspection and Enforcement and retulted in a i~~ber of opt~ items.

A __...,,.

,,.....,.,._'_...,:.,._,,4 ""**-.:....,

OA AA 4.,,..,~.....l!'l,,.,..,._......_IIIP\\

oiA...-.11,.-fAA i!"4r :-!.hi;~i,,m&lf"l'P'

.:.a... A l"'lfCQ~ 'l;J!(.l=IH!t:U Y\\Jf JU\\;

1..IH;: o-,,--,-,

ULlf""r;;:W-i.JY'H

.tlH..,f!.,,f\\,.U;'-o.l

'('"";"r.,..\\,H.Jf l4!HO\\;Ht.. w1,,.y impl~mentdticr of the fir~ protectio~ program ana tompliance wtth the requirements of BTP "Fire Protection for Nucle~r Power Plants," per f5~R commitments ~nd SER evdluation. Withfn these,r~dS, the inspection con115tfa of i~l@~,iv~ ox~m1nation of prc,edur@s ana rfl~r~sont,ti~~

records, 1nterviews wii'.h i,ersonnei, ar.d observ11t1ons by the 1rispecton.

D1.1rin9 this ins~~nion. cpen items r(tsu1ting from previous NPC c.udits 3nd inspections wer~ reviewed. ihe results of these reviews are included within this r~port.

~.O Fire Prc~P.ction Pr~qram Reguire~ents 3,1 Fir~ Protection Pro~ram 1~ S~ER 12. the staff stated that the fire protecti0n program meets the au1de11~es of BTP C~EB 9.5-1 a~d fs theretorei acceptable. Durinu the

§4_44 inspect1oP. the 1nspe~tors fouid that the ap~)icant 1s proor~m did not spec1fica1ly oesi;nate respor.s1bi11ty 1or f1re brigade traini~9 arid n,aintenance of trairtrng records, Jn add1tion. the inspectors founc:

that the prcgram dia oct identify that d QA program was estehlishea fer the rtre protection progr~m (Unre~olved Item 44~/8444-0-01. 1st item:.

FEB-07-2008 08:39 P.05 Gurin; th1, inspection the applicant presented procedure FIR-101, "Fire Protection Proaram" which had been revtsed to ijddress the staff cc~cerns statfd above. *The revision~ ~ere found to adequately tddress the assignment or fire br1gade training and records fflainteni:!nce responsibilitits and clearly establ1she~ that a QA program wou1o ~e provided f~r f1re protection. Cptn Itom 445/8444*0-0l, lst item, is therefore c1osed.

3.2 f1_r Hozards Analysis I~ SSER 12, thE staff concluded that the fire hazards analysi~ (FhA) met the guidelir.es of BTP CMEe 9.5-1.

Tl'lt applicant li~s since revised tne FHA e.nd has incluoed it in the F1re Protcct1on Report dated September z2. 1987.

Revisions to thtt fl1A reflect changes iri plant design or chdnges in the F1re Safe Sh~tdown Analysfs report.

As a result of this revision, a nfw dev1at1cn rtlating to the RHR 1so1ation valves was ident1fitd. Also. a nu~ber of ch~~ges to previous dev1dtlons wert n~de.

Where these chang&s may have affected previous staff evalua-t1uns, they are d1scussed in th13 1nspection report.

The new dewi~tion i$ ciscussed in Section 4.2 of this report.

~.3 Administrative Cc~trols The staff concluded in SSFR 12 thH the administrative controls identified by the app1icant met the 9uideiu,es of BT? CMEB 9.5-1.

During th~ 84-44 1nspecti~n, four itc~s were id~ntifiea ~here administrati~e procedures were tnaaequate.

Thf 4 tems were as follows:

Failu,~ to oi;sign.. tt,:ho 1s res;;::cnsible for obtaining~ fire permit rur c:cntroliing ignitior. sources.

(Oi:,en Item 44SiuC:44-0-0l 1 4th 1 ter.i)

FGli1ure tc c.:elete a hrnpcirary 1nstrl.iction for protection ct the new fuel area after the permanent procedure "as in place.

(Open Itt:ni 445/8444*0*01, 5th iten,)

Dtscrcpanc1es bet~&en the propcsed Technical Spec1ftcattons and the fire protection surveill~nce procedures.

(Ope~ lt~n 445/8444-0*02)

Failure to include a fire pump performance curve in U1 i:reoperaticmal test proce-dut*e.

(Open ! tern 445/8444*G-03)

Luring this inspection the applicart demonstr~ted that all of the abc~t men~icned discrepancies ilc1d been addrtssed in revisions to prr.ce;;dures.

These procedures wtre reviewet dur1ng the inspection erd found acceptable.

The ab~v~ li5ted open it~ms are therefore clos~d.

3,4 Fire 8rioade and Fir~ P.rigade Training In SSER 1?, tr.e staff st~ted that the fire br1oace and fire briaade

rdining proqram meet the guide1inf:'! cf BTP CMEB 9.5-l.

Durir.g-the 84-44 i~spec~i~n, the defi~ition of tht,*tre brigade compcsiticr was 4

4,4.4

!fa 1 on Suppr£S sf on System~

Section E.4 of Appt~dtx A BTP APCSB 9.5-1 states that Pfhe use of Halon tire ext1nouishing agents should as Q r.11nlmum cc.;11.p?y w1th the requirements of NFPA 12A ~~d 12B, Halogenated Fire E,ttngutsh1ng Agent Systems.. Ha1cr. 1301 ana h,len 1211.~ During this 1r.spect1on. the inspectcr was conc~rnea that the Palon system provided i" the Cable Spreading Room ma) not be in complidnce with NFPA 12A.

T~t applicant inditHed that the review of the system arainst the requirements of NFPA 12A had not been p&rformed.

lht:refore, the applicant needs to perform a r~view of the Cable Spreading Room Halon system ag,1nst the requiren.er.ts of NFPA 12A.

Any aeviat1ons 1drnt1f1ecl in this rev1e\\lJ 1r-*i11 be required to be submitted to the staft tor eva1u?t1on.

The flRC CCD5fdcrs thi1 tt~n open pending applicant complttion of the evbluat1on and NRC review of th& results (~~:/8722-0-C6).

S.O, ;::;~:l:::~;:~4:~::::;t:;::B:~::uus *~p*r*nt 1neonsist,ncie,.were r.ot~d 1n tne cpp11~an~*s dh~1ys1s ana assumpt1oni concern1n9 tne pr0tect1on or fire safe $hutdown equ1pn,E:nt for oreas outside of the control room and cable s;rtad1ng rogm where alternatiYe. safe shutdown 1s not rtqu1r~d.

P.13 Sinte the 84-44 inspection, the applicant has provided a more ccmprehens,~e methcdclogy and ar.alysh 111 t\\10 documents, the fin Safe Shutdown o~sign Ba$1S Document (DBU), OBD*~E-020. and th~ Fire Protection Report \\FPR).

The Fir~ Hazards ArPlysis Repcrt (FHAR) [Ref. AppendtJ A, A.l(bJ] which is contained ~ilhin the FPP., describes each fir~ orea and its associated ffre.protecticn features. !he fire s~fe shutdo-r ~quipment lccated within an area is iisted }n the Fire Safe ~hutaown Analysis Repcrt lFSSAR) [Ref.

P.p~~ndh A. A.l(c)] aisc conuinec: within the FPP... For each fire area which contains safo shutdown ccu:pCJnents. the reference to the campar.ents protectea to ac.:hieve safe shutdown is typically a cer.~ral statement:

"One trdin of the required rad~~clant equipn~nt and components within the iirea. is prott!Cted by ont-rf the means provided 1n Section Il.4.5."

Section II.4.5 contain~ only a listing of all of the potentihl means cf complying t-tith CMEB 9.5.1 C.5.o separation rcquireme1,ts. Therefore, the FHAR does not identify specific~lly what tomponents are protect~d fer a postulatfg tire 1n that area, except in certain c1rcum~tant~s such as for Fire Ared AA where the protection of CCW isolation valves 1HV4512, lHV4513, lHV4514 1 end 1HV4515 and their associated circuits is described.

~

The listing of protected components ior etch.fire area is provided in I

three volume docun:ent co11ectivi:1y reforred to as Calculatior. r:o. 152, Revision 3 [Ref. Appendix A, A.3]. Calculation No. 15Z is predom1r?ntly a compute:r pri nteiu: for each fire Jrea of thi: raceways. the Sdfe shutdown cablt:s, the cables which must be thermolaooed in the area, the I, carresponaing safe shutdohn dev1c~s and aiior1at~d equipnent locaticn (fire zones of the devices), the e1ectrica1 nodes (junction boxes) anc

(

the raceway ltn9th.

A disrnssion of protection of a.ssoi:iate~ circuits is

~ ::;:~~.1;,::c\\1;; 7 ~'~:";~;~:'::~ bl Mc-c~ -=o-1oeG

...L.

.L

I fu /'~-d'o +A-e. F SS,1-.

l,. } h l l v i

"'i.

rl4.c..,..)

Co,nsr"=tc.1,:,,r W"'f.S

,...,.St7...-;<.i:>f

From the perspeet1ve of mech11.rdrai systf!'l'S oper~biii

, C:1ieui.H1on 110. 152 provides two tdbles fo ~ttachment lb of Voiume 3:

fable l "Fire Art:a Compliance Tab1e 11 and Tc1bie 2 "(.;perator Artie.ins for Fini Are=S,~ T~b1e l suf!'ffl~r1zes thi compl1ence wethod for $tparation for

~cch fire arta, but tn th@ inspectors Gp1nfon does not prov1Gt ~ clear path for determinin; Equipment to be proiecte~. Table 2 is o lfsting cf safe shutdc\\i.n devices and location by f'fre :011ti t,f11ch require certain operator actions 1ncludfn9 repairs, the 1ccation of the act1on. and the aff1.:cte<1 tlre areas where d fire in those areas il'ay create ci n:qu1remenr r'.14 for the rnan'-ictl ai;t1011.

Aho the actfans are c1ass1f'ied acccra1ng to

'l'ihether they dre required for hot ~hut.down (hot standby) or cold shutdown.

The inspection team noted that Table, is a key document 1n the appl1cant's justification for compliance with separation requirPP.Jents for those areas net requiring alternativ~ shutdown.

The basis cf the applica~t*s an~l1~is

~rotec~o~*1_J!'~th~do!_~9,v_Jt,!': these arNlS 1s a. combinatfon of prc,tectiri_f certain components in i -~hen fire area* in 01any 1nstar.ces of either redundant train, plus re iance on the local operator actions ~escribec in Table 2, The fo1 low1rig proctoures (Refs. t.p~. A, Bl to eJ 1n add1t1cr1 tc Procedure No. AB~*E~3A. *Respon~e to a fire 1n the Control P.oom or C~ble Spreddin9 Room,* h,vt been prepared hy the applicant tc address manual act1c.,n~:

ABN-BO~A uRespon~e tn Fire 1n the Safeguaras Bu11dtn;h Al:!N-8O5A **i-:~sponse to fire in the t.u,.i Hary Btriiding or trH!

Fuel Bu11ding 14 ABN*BOeA 5 Respons~ to Fire in t~e Electricll and Contrnl i:..,.;,,,t;,,,.,11

.... \\,I.*-***~

ABN*80iA =Response to ~ire in tht ContainM~nt gu11din;*

,J Abl~-2O8A 111Respcrise to Fir1; in Service ire.ter Intake !:.tructure"

..i ABN-SC9A "Response to Fire in the Turbine Euilding 1

fh s

l_n view of the fll!l'H.. al activr,s required tc ensure con.pihnce w1tli 7&-.~~

1

/.,

separation reguirenients,. ~e team consfoers the above rrocedure~ to be... ~~t'"'".t..,,,.n integral part of the applicant's f~re ha~~rds analysts and fire saf~.snu~* £0/lrqt co? analysn; reports.

the team cor.sidere~ it eif considerab1e import:lr.ce t.ho.~ the feuibi11ty of the manual actions be prr,pr.:rly tnal;zed with respect to the postuiattd fires anc the protectrd components within ~ach fire drta.

a mini~um, the manuQl actions s~cuid be sorted so that t~ se which neeo to be er or.

n same 1re ~rea or zone ir.,espon~

to a postu ated re ri that area or zc.ne are 1drr.ti fied anc, tr.e time aft.r:r reactor trlp when the action must be perfonned cc~eared to the area acces; sl6i1it, and corrpcrnmt opera&ility after the postu,ated fire.

/rb,r'I ~c.vs, During the inspt!ct1on 1 the tcarn noted tho'I. the inform~tfon 1n Table 2 f Hi concerning the mdnual aLtions was not aQequate1y sorted to icEntify

5+,u-t O

4 action.s ;;Mch must be tili.er. in th= same fire area as the postulated fire.

V~ 1 a,,,d Furthermore, tlit! t~esibility of t:dch ac:tion with respE:Ct to the

-H,e_ c,,.J..,

11 ~~st~iate~ f~re t-:as ~ot p~esent~a_. _The.~~pli~ant ~r~~ented a r:-&vi~ed

,d t *~.,;hu~ 11srrng or tne mir,ua1.actions ~,nn Justn1cn10ns rnr edCh c).i;r.1cr. Just

,-a..r J,fr! sS 77'J prior to the exit r.cietin9.

The iist indic.ated that soir.e revisitms to J"" t", ~ e,c -

13

ML100390025

Contents

Text

SUBJECT:

Background

SUBJECT:

REFERENCES:

Dear Sir or Madam:

SUMMARY

SUMMARY

Subject:

Dear Mr. Flores:

Enclosure:

Enclosure:

Navigation menu

ML100390025

Text

SUBJECT:

Background

SUBJECT:

REFERENCES:

Dear Sir or Madam:

SUMMARY

SUMMARY

Subject:

Dear Mr. Flores:

Enclosure:

Enclosure:

Navigation menu

Search