| |
Search Options | |||
| Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us | |
|||
EA-03-016 - Arkansas Nuclear 1 (Entergy Operations, Inc.)April 7, 2004 EA-03-016 Jeffrey S. Forbes, Site Vice President
Dear Mr. Forbes: The purpose of this letter is to provide you with the final results of our significance determination for a finding that was identified during the triennial fire protection inspection in June 2001. Since completing the inspection, we have been corresponding with your management and staff in order to properly evaluate the compliance and significance aspects of this finding. Upon identification by the NRC, Arkansas Nuclear One staff promptly established and maintained compensatory measures in all fire zones affected by the finding; therefore, the NRC had no immediate safety concern involving this finding. The finding involves your use of operator manual actions for achieving and maintaining hot shutdown conditions in the event of a fire in Fire Zones 98J (Unit 1 diesel generator corridor) and 99M (north electrical switchgear room), and is described in the subject inspection report, dated August 20, 2001, as unresolved item 50-313;368/0106-02. The finding was unresolved pending further NRC review to determine if your safe shutdown methodology for Fire Zones 99M and 98J met NRC regulations. In an exit meeting conducted on August 30, 2001, the NRC informed Arkansas Nuclear One management and staff that the existing configurations in Fire Zones 98J and 99M did not meet the requirements of 10 CFR Part 50, Appendix R, Section III.G.2. However, the issue has been tracked by the NRC since that time as unresolved pending the completion of the NRC's significance determination. In a letter dated September 28, 2001, Arkansas Nuclear One management claimed that NRC's position was a backfit. In a letter dated April 15, 2002, the NRC provided Arkansas Nuclear One management with the results of a backfit review, which concluded that for Fire Zones 98J and 99M, Arkansas Nuclear One management and staff had implemented a fire protection strategy that did not meet 10 CFR Part 50, Appendix R, Section III.G.2. Specifically, in lieu of ensuring that redundant trains of equipment and cables necessary for achieving hot shutdown were free of fire damage in the event of a fire (as required by Section III.G.2), Arkansas Nuclear One staff credited local remote operator actions for mitigating the effects of fire damage. Furthermore, the NRC determined that your staff's strategy and procedures (existing at the time of the inspection) for using manual actions were not adequate to ensure the plant could be safely shut down in the event of a fire in either of these fire zones. Based upon this determination, the NRC re-characterized the finding as an apparent violation in the April 15, 2002, letter, pending determination of its significance. The NRC assessed the finding using a Phase 3 significance determination process, and preliminarily determined that the finding had a significance of greater than very low (greater than green). The bases for and the process used in reaching this preliminary significance was discussed in our letter to Mr. Craig G. Anderson, Vice President, Operations, Arkansas Nuclear One, dated March 25, 2003. At Arkansas Nuclear One management's request, we conducted a regulatory conference on July 10, 2003. During this conference, Arkansas Nuclear One management and staff provided the results of a fire model analysis and an assessment of the significance of the finding. Subsequent to the regulatory conference, we requested additional information from Arkansas Nuclear One staff, which you provided to us in letters dated August 11, 2003, and November 21, 2003. In our final assessment of the significance of this finding, we considered the additional information provided to us at the regulatory conference and in those letters. Based on extensive review of the significance of this finding as described above, the NRC has concluded that the finding has low to moderate increased importance to safety (white). A detailed discussion of the basis for the final significance determination is provided in our March 23, 2003, letter and in Enclosure 2 to this letter. This review was performed in accordance with NRC's program for overseeing the safe operation of commercial nuclear power reactors, described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000 and in accordance with Inspection Manual Chapter 0609, "Significance Determination Process." You have 30 calendar days from the date of this letter to appeal the NRC staff's final determination of significance for the identified white finding. Such appeals will be considered to have merit only if they meet the criteria given in NRC Inspection Manual Chapter 0609, Attachment 2. Since the significance review is now complete, the NRC is providing you formal notice that this finding is a violation of 10 CFR Part 50, Section III.G.2. The violation is cited in the enclosed Notice of Violation (Enclosure 1). The circumstances surrounding the violation were described in detail in the subject inspection report and in our letter to Mr. Craig G. Anderson, Vice President, Operations, dated April 15, 2002. In accordance with the NRC Enforcement Policy, NUREG-1600, the Notice of Violation is considered escalated enforcement action because it is associated with a white finding. Your potential options for long-term resolution of this matter include: (1) implementing plant modifications to restore compliance with 10 CFR Part 50, Appendix R, Section III.G.2 or Section III.G.3; or (2) requesting an exemption to 10 CFR Part 50, Appendix R, Section III.G.2, which includes justification adequate for the NRC to reach a safety conclusion on the exemption request. You are required to respond to this letter and should follow the instructions specified in the enclosed Notice of Violation when preparing your response. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements. Because plant performance for this issue has been determined to be in the regulatory response band, we will use the NRC Action Matrix to determine the most appropriate NRC response for this finding. We will notify you, by separate correspondence, of that determination. In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosures will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Dockets: 50-313; 50-368 Enclosures: cc w/enclosures: Vice President Manager, Washington Nuclear Operations County Judge of Pope County Winston & Strawn Bernard Bevill Mike Schoppman
ENCLOSURE 1 NOTICE OF VIOLATION
During an NRC inspection conducted June 11 - 22, 2001, and July 2 - 13, 2001, a violation of NRC requirements was identified. In accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions," NUREG-1600, the violation is listed below: 10 CFR 50.48, "Fire protection," Section (b) states, "Appendix R to this part establishes fire protection features required to satisfy Criterion 3 of Appendix A to this part with respect to certain generic issues for nuclear power plants licensed to operate before January 1, 1979. ... With respect to all other fire protection features covered by Appendix R, all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III.G, III.J, and III.O." 10 CFR Part 50, Appendix R, Paragraph III.G.2 states, "Except as provided for in paragraph G.3 of this section, where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, one of the following means of ensuring that one of the redundant trains is free of fire damage shall be provided:
Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Incorporated is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555 with a copy to the Regional Administrator, Region IV, and a copy to the NRC Resident Inspector at the facility that is the subject of this Notice of Violation (Notice), within 30 days of the date of the letter transmitting this Notice. This reply should be clearly marked as a "Reply to a Notice of Violation" and should include: (1) the reason for the violation, or, if contested, the basis for disputing the violation or severity level, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken to avoid further violations, and (4) the date when full compliance will be achieved. Your response may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time. If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001. Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRC's document system (ADAMS), to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the public without redaction. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21. Dated this 7th day of April 2004
ENCLOSURE 2 Evaluation of Safety Significance Summary of Conclusions On August 20, 2001, the NRC issued Inspection Report 50-313/01-06; 50-368/01-06, which discussed a finding concerning the acceptability of the licensee's use of operator actions to remotely operate equipment necessary for achieving and maintaining hot shutdown, in lieu of providing protection to cables associated with that equipment, as a method of complying with 10 CFR Part 50, Appendix R, Section III.G.2. In a letter dated March 25, 2003, (ML0308500610) the NRC informed the licensee that the increase in core damage frequency was preliminarily determined to be in the range of 7E-6/year to 2E-5/year. During the regulatory conference conducted on July 10, 2003, the licensee provided the results of their safety significance determination. The licensee concluded that the increase in core damage frequency was approximately 4.9E-7/year. The Senior Reactor Analysts (SRAs) and fire protection engineers in Region IV and the Office of Nuclear Reactor Regulation reviewed the following documents and evaluations provided by the ANO staff:
Based on this review, the NRC determined that the licensee (1) inappropriately used the CFAST model in their assessment of the extent of fire damage; (2) did not properly evaluate execution errors in the human reliability estimation model; (3) used questionable assumptions in the human reliability analysis; and (4) made several questionable assumptions in calculating the core damage frequency. These factors resulted in the licensee developing a lower estimate of the increase in core damage frequency than is appropriate. A more realistic reconsideration of these factors, consistent with NRC's assessment, would result in a finding of low to moderate increased importance to safety (white). Determination of Safety Significance Entergy Operations, Inc., evaluated the significance of the finding in its "Post-Fire Manual Action Feasibility Assessment: A Phase 3 Significance Determination Process (SDP) Evaluation at Arkansas Nuclear One Unit 1," dated July 3, 2003. There were numerous fire zones in Unit 1 (including Fire Zone 98J) that were affected by the finding. The licensee performed their evaluation using Fire Zone 99M, because it was the most significant fire zone affected by the finding. During the review of the licensee's significance evaluation, the SRAs and fire protection engineers identified areas of uncertainty and assumptions that led to the licensee underestimating the significance of the finding. These areas are: (1) the fire growth behavior model; (2) the core damage frequency calculational methodology; (3) the human reliability estimation model, and (4) human reliability analysis assumptions. The SRAs determined that these areas, each of which is discussed below, would increase the safety significance of the finding over the estimate provided by the licensee. Fire Growth Behavior Model The licensee's CFAST (Consolidated Model of Fire Growth and Smoke Transport) modeling of fire growth behavior for fire scenarios affecting cable trays located in Fire Zone 99-M was based on a fire source ignition at a height of 8 feet above the floor, which is representative of a fire on top of the switchgear cabinets. The SRAs and fire protection engineers found that several of the licensee's fire modeling assumptions were incorrect. The licensee did not include air entrainment into the compartment for the fire scenarios with fire doors fully open, resulting in a more limited combustion process. For each open door fire scenario, the buoyancy of the fire plume would draw air from below the burning tray and would not result in a sharp fire decay as predicted by the licensee's fire modeling. The licensee's fire modeling analysis showed the peak heat release rates and hot gas layer temperatures to be decreasing rapidly in all fire scenarios. Since air entrainment in all directions would be expected for a worst case fire scenario involving an elevated cable tray fire in Fire Zone 99-M, the non-consideration of this assumption in the licensee's CFAST model would lead to an under-prediction of fire growth behavior. Using the licensee's CFAST model, the NRC's fire protection engineers adjusted only the air entrainment parameter and concluded in the case of an elevated cable tray fire in Fire Zone 99-M, an increased hot gas layer temperature that would cause damage to redundant safe shutdown cables would be expected within approximately one hour. The SRAs and fire protection engineers found additional examples of assumptions in the licensee's fire model that also resulted in the licensee under-predicting fire damage end states. For example, in their CFAST model, the licensee used lower heat release rates for modeling an energetic fire resulting from electrical faults in a switchgear cabinet (500 kW versus 1,000 kW); and assumed a higher threshold cable damage temperature (700 °F versus 625 °F) for thermoset cables. Extensive cable fire test data have shown that there are several different types of thermoset cables that have different failure cable thresholds. A review of this fire test data shows that cable damage at 625 °F within 30 minutes is a reasonable bounding estimate of the failure threshold of cross-linked polyethylene (XLPE) insulated thermoset cables. (Reference: Appendix F-Fire Protection Significance Determination Process, Draft Revision 2.3a, October 14, 2003). In addition, the licensee incorrectly used the CFAST code to model an explosive or energetic fire resulting from electrical faults in a switchgear cabinet. The CFAST code is a two zone model, capable of predicting the environment in a multi-compartment structure subject to a steady and non-steady state fire growth. Using the CFAST code to model explosive fires for an immediate heat release is beyond its capabilities and limitations, and results in an under-prediction of fire growth behavior. Recent data collected from actual fire events have shown that fires caused by energetic electric faults in switchgear cabinets have led to extensive damage to cable trays, melting and vaporizing of equipment, and destruction of surrounding metal cabinets as a result of explosion, arcing, smoke, and ionized gases. The damage to electrical equipment and subsequent component maloperation occurred rapidly. See NRC report, "Operating Experience Assessment Energetic Faults in 4.16kV to 13.8 kV Switchgear and Bus Ducts That Caused Fires in Nuclear Power Plants 1986-2001," (ML021290358). This operating experience assessment provides additional evidence for the findings in NUREG/CR-6738, "Risk Methods Insights Gained From Fire Incidents," (ML012600378). See the following quote from the operating experience assessment: "... current fire risk modeling of energetic electrical faults in 4.16 kV to 13.8 kV switchgear does not address the following characteristics of energetic fires: (1) the fire bypasses the typical fire initiation and growth stages; (2) a fire inside an electrical panel can propagate outside the panel; (3) the fire may result in failed initial fire suppression attempts; (4) smoke propagation outside the fire area affects operator response; (5) the fire may be longer than the 10 to 30 minutes typically analyzed; and (6) the plant material condition and independent failures may influence the chain of events. "These events demonstrate that fires from energetic electrical faults contain more energy than assumed in fire risk models as evidenced by explosions, arcing, smoke, ionized gases, and melting and vaporizing of equipment. The energy release exceeds heat release rates (HRRs) assumed in fire risk models, possibly by a factor of 1000. Lower HRR values currently used may explain why current fire risk models have not identified the potential larger effects of fires from energetic electrical faults which may include the following: (1) bypass of the fire initiation and growth stages, (2) propagation of the fire to other equipment and across vertical fire barriers, (3) ac power system designs that may be vulnerable to an station black out, (4) failed fire suppression attempts with dry chemicals and the need to use water, (5) longer restoration time to recover, and (6) unexpected challenges and distractions to the operator from fire-induced failures." Based on the above discussion, the NRC concluded that using correct modeling inputs and using an appropriate fire model for fires from energetic electric faults in switchgear cabinets would result in an increase in the core damage frequency estimates for each evaluated scenario. The licensee's under-prediction of fire damage contributes to the uncertainty associated with estimating the time to fire damage states. Furthermore, precise modeling of this issue would likely result in less optimistic times than those predicted by the licensee's analysis for executing feasible manual actions required for achieving safe shutdown of the plant in the postulated scenarios. Core Damage Frequency Calculational Methodology The licensee's calculational methodology for estimating the core damage frequency value included an additional term to credit the explosion factor for the energetic fire scenarios. However, this term was applied independently of the fire severity factor that was already included in the fire risk equation used in determining the core damage frequency estimate. The use of the explosion factor term resulted in "double counting" the credit for the fire severity effects of the fire scenario and lowered the core damage frequency estimates for the overall significance analysis. The removal of the explosive factor term from the calculational methodology would result in an increase in the core damage frequency estimates for each evaluated scenario. The SRAs noted that the licensee credited manual suppression probability in one of the fire scenarios where the estimated time to fire damage to primary equipment targets was significantly shorter than the expected time for fire brigade arrival and response. This resulted in a lower failure probability estimate for manual suppression being used in the licensee's calculational methodology. In addition, the SRAs noted that there were uncertainties in the actual number of electrical cabinets and switchgear rooms used in the derivation of weighting factors for the fire ignition source frequency estimates. The resolution of these uncertainties would result in an increase in the core damage frequency estimates for each evaluated scenario. The licensee's SDP analysis estimated the total increase in the Unit 1 core damage frequency was approximately 4.9E-7/year. The estimate was derived from a calculation of the increase in core damage frequency for fire scenarios in Fire Zone 99-M (2.2E-7/year) and a qualitative assessment of core damage frequency increases due to fires in Fire Zone 100N (2.2E-7/year) and Fire Zone 104S (4.4E-8/year). Although not discussed in the licensee's SDP analysis, there were 7 other fire zones in Unit 1 (including Fire Zone 98J) for which the licensee credits the use of manual operator actions in lieu of meeting the physical protection requirements of 10 CFR Part 50, Appendix R, Section III.G.2. If quantified, each of the fire zones would result in an increase in the core damage frequency. Human Reliability Estimation Model The licensee utilized EPRI TR-000259, "An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment," to determine the human reliability estimates of operator actions in the postulated fire scenarios. The SRAs noted that the principal use of the EPRI TR-000259 methodology was for developing human error probability estimates for human actions in "internal event" sequences that required recovery actions to be completed in the main control room. The application of the methodology to assess cognitive and execution errors for fire events, which required operator actions outside the control room is not consistent with the intended purpose of the document. The SRAs acknowledged that the EPRI TR-000259 methodology may be adapted to evaluate error probability estimates for human actions in ex-control room activities. Notwithstanding the possibility to modify the methodology, the SRAs determined that the licensee's SDP analysis derived optimistic human error probabilities for scenarios that relied on operations personnel to implement the provisions of their previous fire procedures. The analysis did not fully consider the negative effects of inadequate procedures, spurious actuations, unreliable instrumentation, and an unpredictable scenario affecting the ability of operations personnel to respond to a fire in Fire Zone 99-M. The resolution of the modeling concerns would result in less optimistic human error probabilities and an increase in the core damage frequencies for each evaluated scenario. Human Reliability Analysis Assumptions The licensee's human reliability analysis did not fully integrate several key assumptions, such as, operator responses, the timing of required actions, shift staffing, and the accessibility of plant equipment. These conditions apply to both the as-found procedures (symptomatic operator response) and the new procedures (tactical operator response). However, the SRAs determined that the effect on the as-found procedures was more significant. The licensee's simulator was used to evaluate the ability of operations personnel to respond to a fire in Fire Zone 99-M. The use of the simulator implies that a degree of fidelity and predictability exists in evaluating the response of plant systems to a fire. Because fire scenarios are unpredictable, the SRAs determined that it would be difficult to specify when plant components, indications, and controls would be rendered inoperable, actuate to a non-conservative position, or provide an erroneous indication. Consequently, the use of data from simulator exercises to reflect a reduced likelihood that operations personnel will fail to implement critical tasks resulted in lower human error probabilities. The resolution of this issue would likely result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario. The SRAs noted that the time available to execute successful actions was dependent on the plant response to a fire in Fire Zone 99-M. More time would be available if automatic actuations occurred at the onset of the event. If automatic actuations were successful then a longer duration for completing recovery actions for subsequent failures would be reasonable. However, some fire scenarios would involve conditions where automatic actuations of equipment have failed, and operations personnel would be required to perform manual actions outside of the main control room. The time durations available for successful recovery actions in these scenarios would be short, and these short time windows may challenge the time frames assumed in the licensee's thermal hydraulic analyses. By not evaluating scenarios where automatic actuations failed at the onset of the event, the licensee derived lower human error probabilities. The resolution of this issue would likely result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario. The licensee's SDP analysis specified that there were 4 licensed operators, 1 shift engineer, 2 auxiliary operators, and 1 waste control operator. The licensee's SDP analysis assumed that sufficient staffing was available to complete all of the required actions. The SRAs noted that: (1) a fire in Fire Zone 99-M would require several ex-control room equipment manipulations, (2) one licensed operator and the shift engineer would likely be involved in implementation of the emergency response organization procedures, and (3) one auxiliary operator and the waste control operator would be assigned to the fire brigade. The remaining personnel available to operate plant equipment would be 1 auxiliary operator and 2 licensed operators. The SRAs had previously compared the actions described in the licensee's alternate shutdown procedures to the actions required for a fire in Fire Zone 99-M and determined that most of the actions described in the alternate shutdown procedures would need to be completed. The SRAs noted that 4 operators were required to implement the alternate shutdown procedures; however, only 3 operators would be available for operating plant equipment during a fire in Fire Zone 99-M. The resolution of the inconsistency in the staffing levels between the alternate shutdown procedures and the previous procedures for a fire in Fire Zone 99-M would result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario. The licensee's SDP analysis specified that the accessibility for the steam admission valve from Steam Generator A to the 7A emergency feedwater turbine was difficult, in that an operator would need to climb over several pipes to reach the valve. Given the timing of events and the added stress from responding to a plant fire, access to this valve could be delayed or an operator could be injured attempting to gain access to the valve location. Additionally, the licensee's SDP analysis identified that breakers would need to be operated in areas adjacent to the affected Fire Zone 99-M. The SRAs noted that the fire brigade's path to the fire area was through the adjacent switchgear room or through the adjacent diesel generator corridor. In either case, the opening of one of both of the doors to Fire Zone 99-M would permit smoke to escape into the areas, which would be used by operations personnel for access to perform manual actions. Operations personnel dispatched to perform manual actions would not have donned breathing apparatus, and could have difficulty manipulating circuit breakers because of decreased visibility due to smoke from Fire Zone 99-M, and obstructed access from fire fighting equipment. Furthermore, additional decision-making by operations personnel would be required to choose access via an unaffected direction, delaying manual actions. The resolution of the accessibility to plant equipment would likely result in less favorable human error probabilities and an increase in the core damage frequency for each evaluated scenario. Conclusions The licensee's risk analysis did not fully evaluate several areas of uncertainty and assumptions involving: (1) the fire growth behavior model; (2) the core damage frequency calculational methodology; (3) the human reliability estimation model; and (4) human reliability analysis assumptions. A more detailed quantitative analysis addressing these uncertainties would result in an increase in the core damage frequency associated with the failure to provide protection to cables and equipment necessary to achieve and maintain hot shutdown. The NRC's original Phase 3 SDP assessment determined that the range of estimated core damage frequencies was between 7E-6/year and 2E-5/year. The additional information provided in the licensee's SDP analysis was useful in determining that the finding should not be characterized as having greater than low to moderate safety significance (greater than white). The NRC determined that a more detailed quantification of the uncertainties identified in the licensee's SDP analysis, as discussed above, would provide results that are consistent with the lower bound of the original NRC Phase 3 SDP analysis. The licensee's input data used in the derivation of human error probabilities, the identification of affected plant equipment, and fire modeling assumptions; combined with the reviews completed by NRC analysts, provided sufficient information to conclude that the finding should be characterized as having low to moderate safety significance (white). |
|
Privacy Policy |
Site Disclaimer |