IR 05000528/2007008

IR 05000528-07-008, 05000529-07-008, 05000530-07-008; on 07/23/07 - 08/17/07; Arizona Public Service Company; Palo Verde Nuclear Generating Station, Units 1, 2, and 3; Fire Protection (Triennial)

ML072610535
Person / Time
Site:	Palo Verde
Issue date:	09/18/2007
From:	Laura Smith Division of Reactor Safety IV
To:	Edington R Arizona Public Service Co
References
IR-07-008
Download: ML072610535 (34)

Text

September 18, 2007

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2 AND 3 - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000528/2007008; 05000529/2007008; AND 05000530/2007008

Dear Mr. Edington:

On August 17, 2007, the Nuclear Regulatory Commission (NRC) completed the onsite portion of an inspection at your Palo Verde Nuclear Generating Station, Units 1, 2 and 3. The enclosed report documents the inspection findings, which were discussed in an exit meeting at the end of the onsite inspection on August 17, 2007, with you and other members of your staff.

During this triennial fire protection inspection, the inspection team examined activities conducted under your license related to safety and compliance with the Commissions rules and regulations and the conditions of your license. The inspection consisted of selected examination of procedures and records, observations of activities and installed plant systems, and interviews with personnel.

Based on the results of this inspection, the NRC has identified one finding related to compliance with the Fire Protection Program that was evaluated under the risk significance determination process as having very low safety significance (Green). This violation is being treated as a noncited violation, consistent with Section VI.A of the Enforcement Policy. This noncited violation is described in the subject inspection report. In addition, one licensee-identified violation related to failure to maintain configuration control of the fire protection design basis calculations is listed in this report. If you contest these noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington DC 20555-0001; and the NRC Resident Inspector at the Palo Verde Nuclear Generating Station, Units 1, 2 and 3, facility.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response will be made available electronically for public inspection in the

Arizona Public Service Company-2-NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Linda Joy Smith, Chief Engineering Branch 2 Division of Reactor Safety Dockets: 50-528 50-529 50-530 Licenses: NPF-41 NPF-51 NPF-74

Enclosure:

NRC Inspection Report 05000528/2007008, 05000529/2007008, and 05000530/2007008 w/Attachment: Supplemental Information

REGION IV==

Dockets:

50-528, 50-529, 50-530 Licenses:

NPF-41, NPF-51, NPF-74 Report:

05000528/2007008, 05000529/2007008, 05000530/2007008 Licensee:

Arizona Public Service Company Facility:

Palo Verde Nuclear Generating Station, Units 1, 2, and 3 Location:

5951 S. Wintersburg Road Tonopah, Arizona Dates:

July 23 through August 17, 2007 Team Leader:

G. Pick, Senior Reactor Inspector, Engineering Branch 2 Inspectors:

J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 S. Alferink, Reactor Inspector, Engineering Branch 2 R. Mullikin, Consultant, Engineering Branch 2 Accompanying Personnel:

E. Ruesch, Reactor Inspector, Engineering Branch 2 A. Wolfson, Engineering Associate, Engineering Branch 2 K. Sullivan, Consultant - Brookhaven National Laboratory Approved By:

Linda Joy Smith, Chief Engineering Branch 2 Division of Reactor Safety

Enclosure-2-

SUMMARY OF FINDINGS

IR 05000528/2007008, 05000529/2007008, 05000530/2007008; 07/23/07 - 08/17/07; Arizona

Public Service Company; Palo Verde Nuclear Generating Station, Units 1, 2, and 3; Fire Protection (Triennial)

The NRC conducted an inspection with a team of three regional inspectors and two contractors.

The inspection identified one Green noncited violation. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using MC 0609 "Significance Determination Process" (SDP). Findings for which the significance determination process does not apply may be Green or may be assigned a severity level after NRC management review. The NRC describes its program for overseeing the safe operation of commercial nuclear power reactors in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Cornerstone: Mitigating Systems

Green.

The team identified a noncited violation of License Conditions 2.C.(7),

2.F and 2.C.(6) for Units 1, 2, and 3, respectively. Specifically, procedures required by 10 CFR Part 50, Appendix R, Section III.G.3 and III.L.3 had deficiencies that might impact the ability to complete a number of time-critical steps required to safely shutdown the facility following a fire in the control room.

This was because the licensee failed to provide a number of tools necessary to complete the procedure as written. The team determined that, although operators did not use the equipment during time-critical steps, the lack of tools could negatively impact the ability to accomplish subsequent time-critical steps.

This deficiency was more than minor because the finding is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone since it could affect the the availability, reliability, and capability of systems that respond to a fire events to prevent undesirable consequences.

Using the guidance of Manual Chapter 0609, Appendix F, Attachment 2, the deficiency was determined to have a low degradation rating because it involved a procedural deficiency that was compensated by operator experience/familiarity, and revised calculations demonstrated that there was sufficient time margin available to complete the actions. Based on this, the finding screened as having very low safety significance (Green) during a Phase 1 significance determination.

This finding had cross-cutting aspects in the area of human performance because the licensee failed to ensure that personnel, equipment, procedures, and other resources were available and adequate to assure nuclear safety.

Specifically, the licensee did not ensure that adequate emergency equipment was available to support procedure completion. (H.2(d)). (Section 1R05.6)

Licensee-Identified Violations

A violation of very low safety significance, identified by the licensee, was reviewed by the team. The team verified that the licensee entered into their corrective action program actions needed to address the violation. The violation and corrective actions are listed in Section 4OA7 of this report.

REPORT DETAILS

1R05 Fire Protection The inspection team evaluated the fire protection program for the Palo Verde Nuclear

Generating Station in selected risk-significant areas. The team emphasized verifying the ability of the licensee to maintain post-fire safe shutdown capability. The team used a risk-informed approach for selecting the fire areas and the attributes to be inspected in accordance with the NRC regulatory oversight process. The risk-informed approach taken relied on the risk rankings of fire areas in the Palo Verde Nuclear Generating Station Fire Probabilistic Safety Analysis combined with considerations related to the number of manual actions required for a fire in each fire area. Inspection Procedure 71111.05T, "Fire Protection (Triennial)," requires selecting three to five fire areas for review. Consequently, the risk-significant areas in Unit 3 selected for detailed inspection and review included:

Fire Zone 5A Train A Engineered Safety Features Switchgear Room Fire Zone 42B Train B Electrical Penetration Room Fire Zone 42C Auxiliary Building 100' East Corridor Area For each of these fire areas (samples), the team focused on fire protection features, systems and equipment necessary to achieve and maintain safe shutdown conditions, and licensing basis commitments.

Documents reviewed by the team are listed in the attachment.

.1 Shutdown From Outside Main Control Room

a. Inspection Scope

The team evaluated the adequacy of the methodology for achieving and maintaining post-fire safe shutdown to ensure that at least one post-fire safe shutdown success path was available in the event of a fire in each of the selected areas. The principal sources of this information included:

• Updated Final Safety Analysis Report, Appendix 9BF, "Fire Protection Evaluation Report"

• Calculation 13-MC-FP-0318, "III.G/III.L Compliance Assessment," Revision 10

• Calculation 13-MC-FP-0317, "10 CFR 50 Appendix R Considerations,"

Revision 8

• Calculation 13-MC-FP-0316, "10 CFR 50 Appendix R Manual Action Feasibility,"

Revision 10

• Calculation 13-MC-FP-0315, "10 CFR 50 Appendix R Safe Shutdown Equipment List," Revision 9

• Calculation 13-EC-FP-004, "10 CFR 50 Appendix R Safe Shutdown Cable and Identification List," Revision 7

• Calculation TA-13-C00-2000-004, "CENTS Computer Code Analysis of the 10 CFR 50, Appendix R, Fire Protection Scenarios for Units 1, 2 and 3 with New Steam Generators," Revision 3 The team focused on the following functions that must be available to achieve and maintain post-fire safe shutdown conditions with and without off-site power:

(1) reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

(2) reactor coolant makeup capable of maintaining the reactor coolant inventory,

(3) reactor heat removal capable of achieving and maintaining decay heat removal,

(4) supporting systems capable of providing all other services necessary to permit extended operation of equipment necessary to achieve and maintain hot shutdown conditions.

To assure the licensee had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the fire areas selected for review, the team reviewed and compared piping and instrumentation diagrams to the list of safe shutdown equipment documented in the post-fire safe shutdown analysis and referenced supporting calculations. In addition, the team reviewed plant drawings, operating procedures, operator lesson plans, and other relevant documents to verify the flow paths and operational characteristics of systems relied on to accomplish required safe shutdown functions.

b. Findings

No findings of significance were identified.

.2 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the safe shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the selected fire areas. The team also reviewed and observed walkdowns of the procedures for achieving and maintaining safe shutdown in the event of a fire to verify that the licensee properly implemented the safe shutdown analysis provisions. The team focused on the following functions that must be ensured to achieve and maintain post-fire safe shutdown conditions:

(1) reactivity control capable of achieving and maintaining cold shutdown reactivity conditions,

(2) reactor coolant makeup capability to maintain reactor coolant subcooling margin,

(3) reactor heat removal capable of achieving and maintaining decay heat removal,

(4) supporting systems capable of providing all other services necessary to permit extended operation of equipment necessary to achieving and maintaining cold shutdown conditions, and

(5) process monitoring capable of providing direct readings to perform and control the above functions.

The team reviewed the separation of safe shutdown cables, equipment, and components within the same fire areas, and reviewed the methodology for meeting the requirements of 10 CFR 50.48, Appendix A to Branch Technical Position 9.5-1 and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire in the selected areas. The evaluation focused on the cabling of selected components for the charging system, the auxiliary feedwater system and the nuclear cooling water system. The team selected a sample of components whose inadvertent operation resulting from fire damage could significantly affect the capability credited in the safe shutdown analysis. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, the Palo Verde Nuclear Generating Station Final Safety Analysis Report, submittals made to the NRC by the licensee in support of NRC review of their fire protection program, and approved deviations from NRC regulations, to verify that the licensee met license commitments.

b. Findings

No findings of significance were identified.

.3 Passive Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire area barriers, penetration seals, fire doors, electrical raceway fire barriers and fire rated electrical cables. The team observed the material condition and configuration of the installed barriers, seals, doors and cables. The team compared the as-installed configurations to the approved construction details and supporting fire tests. In addition, the team reviewed license basis documentation, such as NRC safety evaluation reports, and approved deviations from NRC regulations and the National Fire Protection Association codes to verify that fire protection features met license commitments.

b. Findings

No findings of significance were identified.

.4 Active Fire Protection

a. Inspection Scope

For the selected fire areas, the team evaluated the adequacy of fire suppression and detection systems. The team reviewed the material condition, operational configuration and design of the installed fire detection and suppression systems. The team verified the licensee had installed, tested and maintained the automatic and manual suppression and detection systems in accordance with the code of record. Further, the team confirmed the suppression systems were appropriate to control and/or extinguish fires associated with the hazards located in each selected area. In addition, the team evaluated the capability of and the maintenance performed on the smoke removal equipment. The team reviewed license basis documentation, such as NRC safety evaluation reports, and approved deviations from NRC regulations and the National Fire Protection Association codes to verify that fire suppression and detection systems met license commitments.

The team observed two unannounced fire drills and the subsequent drill critiques using the guidance in Inspection Procedure 71111.05AQ, "Fire Protection Annual/Quarterly."

Team members observed the fire department simulate fire fighting activities in plant Fire Area 6A (DC Equipment Room - Train A, Channel C) and Fire Area 14 (Lower Cable Spreading Room). The inspectors evaluated whether the licensee staff identified deficiencies, openly discussed deficiencies in a self-critical manner at the drill debrief, and took appropriate corrective actions. The team evaluated the following attributes:

(1) proper donning of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses; (3)proper employment of appropriate fire fighting techniques;

(4) sufficient fire fighting equipment brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other plant areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings of significance were identified.

.5 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

For the selected fire areas, the team verified that redundant trains of systems required for hot shutdown were not subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems including the effects of flooding.

b. Findings

No findings of significance were identified.

.6 Alternative Shutdown Capability

a. Inspection Scope

The team reviewed the operations implementation of the alternative shutdown methodology. Team members observed a timed walk-through of the control room evacuation procedures with watchstanders consisting of both licensed reactor operators and non-licensed operators. The team observed operators simulate performing the steps of Procedure 40AO-9ZZ19, "Control Room Fire," Revision 16, that provided instructions for performing an alternative shutdown from the remote shutdown panel and for manipulating equipment in the plant. The team verified that the minimum number of required operators, exclusive of those required for the fire brigade, could reasonably be expected to perform the procedural actions within the applicable plant alternate shutdown time requirements and that equipment labeling was consistent with the procedure. Also, the team verified that procedures, tools, dosimetry, keys, lighting, and communications equipment remained available and adequate to support successfully performing the procedure as intended. The team also reviewed records for operator training conducted on this procedure.

The team reviewed the time-critical manual actions identified by the licensee as being necessary to support alternate shutdown from outside the control room, including the calculations and analyses that provided the bases for these critical times. The simulated completion times recorded during the procedure walk-through were then compared to the analytical values to verify that the procedure could be implemented as intended.

b. Findings

Inadequate Procedure for Safe Shutdown From Outside the Control Room

Introduction.

The team identified a Green noncited violation of License Conditions 2.C.(7), 2.F and 2.C.(6) for Units 1, 2 and 3, respectively. Specifically, the procedures required by 10 CFR Part 50, Appendix R, Section III.G.3 and III.L.3 had deficiencies that could impact the ability to safely shutdown the facility following a fire in the control room.

Description.

The team observed both timed and untimed walkthroughs of Procedure 40AO-9ZZ19. The licensee had documented the feasibility criteria in Calculation 13-MC-FP-0316, "10CFR50 Manual Actions Feasibility," Revision 10.

During the walkthrough, the team identified a number of time-critical steps that personnel failed to accomplish as specified in the procedure. Specifically:

• Appendix A, Step 3 required that operators open Breakers SGA-HV-179A and SGA-HV-184A in order to close the atmospheric dump valves within 5 minutes; however, the operator completed this action in 5 minutes and 55 seconds.

• Appendix B, Steps 2-5 directed that an operator open and disable the reactor coolant pump breakers within 5 minutes. The team determined that the operator completed the actions in 5 minutes and 38 seconds.

Additionally, the team determined that the licensee failed to provide required equipment to ensure the procedure could be accomplished as written. The team determined that, although operators did not use the equipment during time-critical steps, the lack of tools could affect the ability to accomplish subsequent time-critical steps. Specifically:

• Appendix A, Step 5 requires a reactor operator to open Breakers PKA-M4110 72/CB1 and PKA-M4110 72/CB2, the normal and alternate feeds for the main steam isolation valve logic control cabinet. The operator did not have the necessary screwdriver to open and gain access to these breakers.

Operators do not carry screwdrivers; screwdrivers were not maintained in either of the emergency equipment cabinets; and the procedure did not alert the operator to obtained a screwdriver prior to going to the room. The team determined that the successful completion of the subsequent time-critical step (Step 6), to place the remote shutdown panel disconnect switch to local within 10 minutes, might be impacted because the operator would need to find the missing tool.

• Both Appendix B, Step 6 and Appendix F, Step 17 require that two different operators acquire the same racking tool from the emergency equipment cabinet in Switchgear Room B; however, the licensee provided only one racking tool in the cabinet. Coordinating sharing of the tool was not accounted for the analysis of manual action times for completion of Appendices B and F. Following Step 6, Appendix B had nine time-critical steps, with the critical times ranging from 14 to 60 minutes. Subsequent to Appendix F, Step 17, Step 25 specifies that the operator has 60 minutes to isolate the emergency cooling makeup.

The team noted that the licensee had identified similar deficiencies during the Fire Protection Program Audit completed in February 2007, and concluded that the issues reflected inadequate change and configuration control among the procedure and the safe shutdown calculations. The team concluded that the above were additional examples of this problem. Although corrective actions had been generated to further assess the procedure steps for feasibility, they had not yet been completed because these actions were sequenced after other actions that logically had to precede them.

Analysis.

The team determined that this deficiency was more than minor because the finding is associated with the Protection Against External Factors attribute of the Mitigating Systems Cornerstone since it could affect the availability, reliability, and capability of systems that respond to a fire events to prevent undesirable consequences.

Because this issue related to fire protection, the team used Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process."

Using the guidance of Manual Chapter 0609, Appendix F, Attachment 2, the team determined that this post-fire safe shutdown deficiency had a low degradation rating because it involved a procedural deficiency that was compensated by operator experience/familiarity. Specifically, the actions involved were routine operator actions for which they received training. Further, the licensee had re-performed the thermal-hydraulic analysis and determined that there was sufficient time margin available to complete the actions. Although the operators had exceeded the specified time in the procedure, the team determined they operators could accomplish the task prior to the analyzed time. Based on this, the finding screened as having very low safety significance (Green) during a Phase 1 significance determination.

The team determined that this finding had cross-cutting aspects in the area of human performance because the licensee failed to ensure that personnel, equipment, procedures, and other resources were available and adequate to assure nuclear safety.

Specifically, the licensee did not ensure that adequate emergency equipment was available to support procedure completion. (H.2(d)).

Enforcement.

License Conditions 2.C.(7), 2.F and 2.C.(6) for Units 1, 2 and 3, respectively, specifies, "APS shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility, as supplemented and amended, and as approved in the SER [Safety Evaluation Report] through Supplement 11." The Palo Verde Nuclear Generating Station Safety Evaluation Report (NUREG 0857), dated November 1991, Section 9.5.1.9 specified that the licensee had committed to 10 CFR Part 50, Appendix R, Section III.G. The licensee designated the control room as complying with the requirements of Section III.G.3 provides for alternative shutdown capability.Section III.L contains the acceptance criteria which must be met to demonstrate compliance with alternative shutdown requirements of Section III.G.3.Section III.L.3 requires procedures be developed to implement alternative shutdown capability to achieve and maintain hot shutdown conditions. Procedure 40AO-9ZZ19, "Control Room Fire,"

Revision 16, provided the method used by the licensee to achieve alternate shutdown for a control room fire that requires evacuation.

Contrary to the above, the licensee failed to implement and maintain in effect all the provisions of the approved fire protection program. Specifically, the licensee failed to ensure that some time-critical steps of Procedure 40AO-9ZZ19 could be implemented as intended by the post-fire safe shutdown analysis to achieve and maintain hot shutdown conditions. Specifically, required equipment and tools needed were not provided, potentially impacting the ability to complete subsequent time-critical steps as indended. Because this finding is of very low safety significance and entered into the corrective action program Condition Report Disposition Request 3051927, this violation is being treated as a noncited violation, consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000528; 05000529;05000530/2007008-01, Inadequate procedure for safe shutdown from outside the control room.

.7 Circuit Analyses

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee had identified all circuits that may impact safe shutdown. On a sample basis, the team verified that cables of equipment required to achieve and maintain hot shutdown conditions in the event of fire in selected fire zones had been properly identified. In addition, the team verified that these cables had either been adequately protected from the potentially adverse effects of fire damage, mitigated with approved manual operator actions, or analyzed to show that fire-induced faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown. In order to accomplish this, the team reviewed electrical schematics and cable routing data for power and control cables associated with each of the selected components. The specific components selected for review are delineated in Attachment B.

Since the licensee utilized thermoset cables for most applications, the team reviewed the following cable failure modes for selected required and associated circuits:

• Spurious actuations resulting from any combination of conductors within a single multiconductor cable;

• A maximum of two cables considered where multiple individual cables may be damaged by the same fire;

• For cases involving direct current control circuits, the potential spurious operation resulting from failures of the control cables (even if the spurious operation requires two concurrent shorts of the proper polarity, (e.g., plus-to-plus and minus-to-minus)); and

• For cases involving decay heat removal system isolation valves at high-pressure/low-pressure interfaces, the vulnerability of three-phase power cables resulting from three-phase proper polarity hot shorts.

In addition, on a sample basis, the adequacy of circuit protective coordination for safe shutdown power sources was evaluated. The specific power sources selected for review included: 4.16 kV Bus PBA-S03, 480 Vac Load Center PGA-L31, 480Vac Motor Control Center PHB-M38, and 125 VDC Distribution Panel PKC-D23. Also, on a sample basis, the adequacy of electrical protection provided for non-essential cables that share a common enclosure with cables of required safe shutdown equipment was reviewed to ensure that the non-essential cables are adequately protected to preclude common enclosure concerns.

b. Findings

No findings of significance were identified.

.8 Communications

a. Inspection Scope

The team evaluated the adequacy of the communication system to support plant personnel in the performance of alternative safe shutdown functions and fire brigade duties. The team verified that the licensee established and maintained in working order primary and backup communications specified in the fire hazards analysis. Further, the team evaluated the environmental impacts such as ambient noise levels, coverage patterns, and clarity of reception. The team determined whether the electrical power supplies and cable routing for the phone system would allow them to remain functional following a fire in the control room and other fire areas.

b. Findings

No findings of significance were identified.

.9 Emergency Lighting

a. Inspection Scope

The team reviewed the emergency lighting system required to support plant personnel in the performance of alternative safe shutdown functions to verify it remained adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions, and for illuminating access and egress routes to the areas where manual actions are required. The team verified that the licensee:

(1) installed emergency lights with an 8-hour capacity,

(2) maintained the emergency light batteries in accordance with manufacturer recommendations, and

(3) tested and performed maintenance in accordance with plant procedures and industry practices. The team evaluated the locations and positioning of emergency lights during a walkthrough of the control room evacuation procedure and during review of manual actions performed for fires in areas outside of the control room.

b. Findings

No findings of significance were identified.

.10 Cold Shutdown Repairs

a. Inspection Scope

The team reviewed documentation to determine if any repairs were required in order to achieve cold shutdown. The team noted that the licensee did not require or credit the repair of equipment to reach cold shutdown based on the safe shutdown methodology implemented.

b. Findings

No findings of significance were identified.

.11 Compensatory Measures

a. Inspection Scope

(1) Out-of-Service Equipment The team reviewed the program for implementing compensatory measures for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems or features.

The team reviewed the following documents:

(1) Technical Requirements Manual sections related to active and passive fire protection equipment,

(2) Procedures 14DP-0FP34, "Firewatch Duties," and 14DP-0FP31, "Fire System Impairment, "

(3) the current fire impairment log, and a sample of fire impairments, and

(4) Procedures 70DP-0MR01, "Maintenance Rule," and 70DP-0RA05, "Assessment and Management of Risk When Performing Maintenance in Modes 1 and 2." The team evaluated whether the procedures adequately controlled:

• Compensatory measures for fire protection systems, equipment and features (e.g., detection and suppression systems and equipment, and passive fire barriers).

• Compensatory measures for out-of-service, degraded, or inoperable equipment that could affect post-fire safe shutdown equipment, systems or features.

(2) Manual Actions As discussed in Regulatory Information Summary 2006-10, "Regulatory Expectations with Appendix R Paragraph III.G.2 Operator Manual Actions," the licensee must meet the separation requirements of 10 CFR Part 50, Appendix R, Section III.G and manual actions are not considered equivalent to a barrier. For post-1979 licensees with the standard license condition, manual actions may have been substituted for physical separation and protection based upon an evaluation that no reduction in the safety margin occurs. The team evaluated the manual actions implemented by the licensee to replace of the separation required in plant fire areas intended to meet 10 CFR Part 50, Appendix R, Section III.G.2.Section III.G.2 of Appendix R lists three options for satisfying the requirements for separation and protection of equipment needed to ensure safe shutdown remains free of fire damage. The team concluded that the licensee had not fully protected or separated one train of cables to ensure safe shutdown in the event of a fire in multiple fire areas. Specifically, the licensee relied on manual actions to overcome the effects of spurious operations or circuit damage resulting from the effects of fire for the equipment required to achieve and maintain hot shutdown in the event of a fire. The team verified that the licensee had implemented numerous manual actions in the early 1990s after determining that the barrier material providing the separation did not meet the regulatory requirements.

The team determined that the licensee had identified that they would use operator manual actions instead of the required Section III.G.2 separation requirements. Further, the team determined that NRC correspondence with the licensee indicated that the licensee did not need to submit deviations for NRC approval; specifically, since the plants licensed after 1979 had the standard license condition, the licensee could approve deviations so long as the changes did not adversely affect safe shutdown.

The team evaluated whether the manual actions were reasonable and feasible by reviewing the following items: diagnostic instrumentation, environmental considerations, staffing, communications, special tools, training, accessability, procedure adequacy, and verification/validation of the procedure required actions. The team further evaluated whether the changes to the fire protection program adversely affected the ability to achieve and maintain safe shutdown in the event of a fire.

The team reviewed the post-fire safe shutdown analysis documented in calculations:

(1) TA-13-C00-2000-004, "CENTS Computer Code Analysis of the 10 CFR 50, Appendix R, Fire Protection Scenarios,"

(2) 13-MC-FP-0315, "10CFR50 Appendix R Safe Shutdown Equipment List,"

(3) 13-MC-FP-0316, "10CFR50 Appendix R Manual Action Feasibility,"

(4) 13-MC-FP-0317, "10CFR50 Appendix R Operational Considerations," and

(5) 13-MC-FP-0318, "10CFR50 Appendix R III.G/III.L Compliance Assessment." The team reviewed Procedure 40DP-9ZZ19, "Operational Considerations Due to Plant Fire," which provided guidance along with the emergency operating procedures to assure the appropriate response to shutdown the facility for fires located outside the control room.

The team evaluated licensed operator and shift technical advisor classroom and simulator training related to the response to fires outside the control room. Through interviews, the team assessed the knowledge and ability of reactor operators, shift technical advisors and control room supervisors to use Procedure 40DP-9ZZ19 to safely shutdown the reactor for a fire outside of the control room. The team conducted plant walk downs of operator manual actions performed by auxiliary operators outside of the control room for the sample fire areas to evaluate: whether the actions were feasible; the presence of required emergency lighting and communications; and the actions performed remained within the scope of normal duties or trained as part of implementation of emergency operating procedures.

b. Findings

No findings of significance were identified.

4OA2 Problem Identification and Resolution

a. Inspection Scope

The team reviewed a sample of condition report disposition requests to verify that the licensee was identifying fire protection-related issues at an appropriate threshold and entering those issues into the corrective action program. A listing of condition reports and problem evaluation requests reviewed is provided in the attachment to this report.

Additionally, the team reviewed planned actions related to the Fire Protection Improvement Program. The licensee had determined that significant deficiencies had developed in the control of the design documentation, procedures, and maintenance backlogs related to the fire protection program.

b. Findings and Observations

The team determined that the licensee had performed a detailed, critical self-assessment in Autumn 2006 and a comprehensive Quality Assurance audit in Spring 2007. The licensee had allowed their corrective maintenance work items to increase which resulted in an large backlog of work items. The self-assessment concluded that poor management oversight had caused the backlog. To address the problem, the licensee established a fire protection program manager to be responsible for ensuring implementation of the corrective actions, which included:

(1) identifying and correcting design documentation issues related to the calculations that had not been updated to match plant configuration and operational changes;

(2) identifying the scope of the maintenance backlog and assigning dedicated resources to improve the material condition of fire protection features; and

(3) developing an electronic database to assist in maintaining configuration control of Appendix R safe shutdown systems and components.

The team reviewed backlog of corrective action program documents, which included 119 outstanding corrective actions, including all the items that related to fire safe shutdown calculations. The team concluded that the licensee had completed the higher-priority actions to correct plant and procedure issues, so the backlog did not affect the ability to implement the safe shutdown procedures. The remaining issues involved correcting the calculations and other bases documents.

During the inspection, the team identified several other deficiencies of the same nature and type as those listed in the licensees corrective action program. The team concluded that, although the licensee had identified a significant number of corrective actions that required implementing, this inspection demonstrated that not all problems had been identified. The team determined that the design control deficiencies resulted in a violation of their license condition for maintaining their configuration control of fire protection safe shutdown calculations. The licensee-identified violation is documented in Section 4OA7 of this inspection report.

40A6

Exit Meeting Summary

The team leader presented the inspection results to Mr. R. Edington, Senior Vice President Nuclear, and other licensee personnel at the conclusion of the inspection on August 17, 2007. The inspectors returned all proprietary information reviewed during the inspection.

4OA7 Licensee-Identified Violation

The following violation of very low safety significance (Green) was identified by the licensee and is a violation of NRC requirements that meets the criteria of Section VI of the NRC Enforcement Policy, NUREG-1600, for being dispositioned as a noncited violation.

• License Conditions 2.C.(7), 2.F and 2.C.(6) for Units 1, 2 and 3, respectively, specifies the licensee will maintain their Fire Protection Program. The licensee failed to maintain design control of their fire protection design basis calculations and their implementing procedures. The team determined this post-fire safe shutdown deficiency had a low degradation rating; therefore, the finding screened as having very low safety significance (Green). The licensee initiated an improvement plan to address these deficiencies as documented in Condition Report Disposition Request 2966011.

A ATTACHMENT A

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Agazzi, Captain, Fire Department

S. Bauer, Director, Regulatory Affairs

R. Bement, Vice President, Nuclear Operations

R. Buzard, Senior Consultant, Regulatory Affairs

D. Carnes, Director, Nuclear Assurance

M. Czarnylus, Fire Department

R. Eddington, Senior Vice President Nuclear

C. Foster, Senior Engineer, Design Engineerig-Mechanical

F. Garrett, TMA Management, Regulatory Affairs

R. Guron, Senior Engineer, Design Engineering-Electrical

J. Hesser, Vice President, Engineering

A. Huttie, Director, Emergency Services

S. Koski, Fire Protection System Engineer

R. Merryman, Section Leader, Operations Standards

M. Perito, Plant Manager, Nuclear Operations

T. Radtke, General Manager, Emergency Services and Support

S. Sawtschenko, Manager, Information Services - Telecom

K. Sweeney, Department Leader, Systems Engineering

T. Weber, Section Leader, Regulatory Affairs

R. Wilferd, Section Leader, Fire Protection Program

NRC Personnel

G. Warnick, Senior Resident Inspector

ITEMS OPENED AND CLOSED

Opened and Closed

05000528; 05000529;05000530/2007008-01

NCV

Inadequate procedure for safe shutdown from outside the

control room (Section 1R05.6)

A