Text

Fire Protection Program Re Alternative Shutdown Capability
	ML13331A728
Person / Time
Site:	Wolf Creek
Issue date:	11/21/2013
From:	Broschak J; Wolf Creek
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML13331A727	List: ET 13-0035, Fire Protection Program Re Alternative Shutdown Capability;
References
	ET 13-0035
	Download: ML13331A728 (311)
	v • d • e

W0"LF CREEK NUCLEAR OPERATING CORPORATION November 21, 2013 John P. Broschak Vice President Engineering ET 13-0035 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555

Subject:

Docket No. 50-482: License Amendment Request (LAR) for Revision to the Wolf Creek Generating Station Fire Protection Program Related to Alternative Shutdown Capability Gentlemen:

Pursuant to 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," and 10 CFR 50.91, "Notice for public comment; State consultation," Wolf Creek Nuclear Operating Corporation (WCNOC) hereby requests an amendment to the Renewed Facility Operating License No. NPF-42 for the Wolf Creek Generating Station (WCGS). This license amendment request (LAR) is seeking approval by the Commission, pursuant to License Condition 2.C.(5), to make changes to the approved fire protection program as described in the Updated Safety Analysis Report (USAR).

The proposed changes to the approved fire protection program are based on the Reactor Coolant System (RCS) thermal-hydraulic response (Evaluation SA-08-006) for a postulated control room fire performed for changes to the alternative shutdown methodology outlined in letter SLNRC 84-0109, "Fire Protection Review." Drawing E-1 F9915, "Design Basis Document for OFN RP-017, Control Room Evacuation," Revision 5, Evaluation SA-08-006, "RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire," Revision 3, and Calculation WCNOC-CP-003, "VIPRE-01 MDNBR Analyses of Control Room Fire Scenarios," demonstrate the adequacy of the revised alternative shutdown procedure, OFN RP-017. The results of the Evaluation SA-08-006 identified required changes to the fire protection program as follows:

Revision to USAR Appendix 9.5B to include incorporation of drawing E-1F9915 as the licensing basis document for alternative shutdown following a control room fire in lieu of letter SLNRC 84-0109.

P.O. Box 411 / Burlington, KS 66839 / Phone: (620) 364-8831 a f-An Equal Opportunity Employer M/F/HCNET

ET 13-0035 Page 2 of 4

Revision to Calculation XX-E-013, Revision 3, "Post-Fire Safe Shutdown (PFSSD)

Analysis," Assumption 3-A-4 regarding application of loss of automatic functions, specific to automatic feedwater isolation in the event of a control room fire. Calculation XX-E-013 is incorporated by reference in USAR Appendix 9.5B, "Fire Hazards Analyses."

Deviation from the 10 CFR 50, Appendix R, Section III.L.1 comparison response, as described in Appendix 9.5E of the WCGS USAR, specific to maintaining RCS process variables within those predicted for a loss of normal AC power.

Deviation from the 10 CFR 50, Appendix R, Section III.L.2 comparison response, as described in Appendix 9.5E of the WCGS USAR, specific to maintaining pressurizer level on scale.

Attachment I provides the evaluation and justification for the proposed license amendment.

Attachment II provides a markup of License Condition 2.C.(5) reflecting the issuance of an amendment to the license condition. Attachment III provides markups of the USAR including Appendix 9.5B and 9.5E. USAR Appendix 9.5E provides a design comparison to 10 CFR 50 Appendix R. Attachment IV provides markups of the changes to Calculation XX-E-013.

Attachment V provides a drawing of the control room layout. Attachment VI provides photographs of the control room equipment cabinet area. Attachment VII provides response to the identified information deficiencies in NRC letter dated February 25, 2013. The Enclosure provides a copy of drawing E-1F9915, Revision 5.

It has been determined that this amendment application does not involve a significant hazard consideration as determined per 10 CFR 50.92, "Issuance of amendment." Pursuant to 10 CFR 51.22, "Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review," Section (b),

no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of this amendment.

The amendment application was reviewed by the WCNOC Plant Safety Review Committee. In accordance with 10 CFR 50.91, a copy of this application is being provided to the designated Kansas State official.

This license amendment request is submitted to resolve a long-standing deficiency with the WCGS fire protection program and is the subject of noncited violation 05000482/2009004-08, "Changes to the Approved Fire Protection Program Without Prior Staff Approval." The next Triennial Fire Protection Program inspection for WCGS is schedule for October 2014.

Therefore, WCNOC requests approval of this proposed amendment by September 30, 2014 with a 30 day implementation period to provide time to revise the applicable WCGS documents.

ET 13-0035 Page 3 of 4 This letter contains no commitments. If you have any questions concerning this matter, please contact me at (620) 364-4085, or Mr. Michael J. Westman at (620) 364-4009.

Sincerely, John P. Broschak JPB/rlt Attachment Evaluation of Proposed Change Attachment IV Ill Markup of Renewed Facility Operating License Attachment Markup of USAR Pages Attachment IV Markup of Calculation XX-E-013 Attachment V Control Room Layout Attachment VI Control Room Equipment Cabinet Area Photographs Attachment VII Response to NRC Identified Information Deficiencies Enclosure Drawing E-1F9915, Revision 5, "Design Basis Document for OFN RP-017, Control Room Evacuation" cc: T. A. Conley (KDHE), w/a, w/e M. L. Dapas (NRC), w/a, w/e C. F. Lyon (NRC), w/a, w/e N. F. O'Keefe (NRC), w/a, w/e Senior Resident Inspector (NRC), w/a, w/e

ET 13-0035 Page 4 of 4 STATE OF KANSAS )

COUNTY OF COFFEY )

John P. Broschak, of lawful age, being first duly sworn upon oath says that he is Vice President Engineering of Wolf Creek Nuclear Operating Corporation; that he has read the foregoing document and knows the contents thereof; that he has executed the same for and on behalf of said Corporation with full power and authority to do so; and that the facts therein stated are true and correct to the best of his knowledge, information and belief.

By Jo . Broschak VycPresident Engineering SUBSCRIBED and sworn to before me this cý I day of flovember- ,2013.

Notary Public Expiration Date 9(7'wJ_ . //T, ,)/1

Attachment I to ET 13-0035 Page 1 of 64 Evaluation of Proposed Change

Subject:

License Amendment Request (LAR) for Revision to the Wolf Creek Generating Station Fire Protection Program Related to Alternative Shutdown Capability

1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION 2.1 Proposed changes to License Condition 2.C.(5) 2.2 Proposed Change to USAR Appendix 9.5B, Drawing E-1F9915 2.3 Proposed Change to Calculation XX-E-013 (USAR Appendix 9.5B) 2.4 Proposed Change to USAR Appendix 9.5E, Response to Section III.L.1 2.5 Proposed Change to USAR Appendix 9.5E, Response to Section III.L.2

3. TECHNICAL EVALUATION 3.1 Post-Fire Safe Shutdown Design Basis Function 3.2 Background 3.3 Fire Protection Program License Basis 3.4 Defense-In-Depth Evaluation 3.5 Postulated Fire Scenario 3.6 Feedwater Isolation Signal Evaluation 3.6.1 System Description 3.6.2 Evaluation of SG Water Level Low-Low Feedwater Isolation Input Signals 3.6.3 Evaluation of Low Tavg Coincident with Reactor Trip (P-4) Feedwater Isolation Input Signal 3.6.4 Evaluation of Feedwater Isolation Output Signals 3.6.5 Control Room Cabinet Fire Testing 3.6.6 Evaluation of Smoke Effects 3.6.7 Feedwater Isolation Signal Conclusion 3.7 Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation 3.7.1 RETRAN-3D Input Model 3.7.2 Reactor Coolant Pump Seal Leakage Model 3.7.3 Sequence of Events 3.7.4 Evaluation Assumptions 3.7.5 Evaluation Instrument Uncertainties 3.7.6 Evaluation Results 3.7.7 Summary 3.8 Conclusion

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 4.2 Significant Hazards Consideration 4.3 Conclusions

5. ENVIRONMENTAL CONSIDERATION

6. REFERENCES

Attachment I to ET 13-0035 Page 2 of 64 EVALUATION

1.

SUMMARY

DESCRIPTION The proposed amendment requests Nuclear Regulatory Commission (NRC) approval, pursuant to License Condition 2.C.(5), to make changes to the approved fire protection program as described in the Updated Safety Analysis Report (USAR). This evaluation supports a request to amend Renewed Facility Operating License NPF-42 for the Wolf Creek Generating Station (WCGS). The proposed changes to the approved fire protection program are based on the Reactor Coolant System (RCS) thermal hydraulic response evaluation (Evaluation SA-08-006) for a postulated control room fire performed for changes to the alternative shutdown methodology outlined in letter SLNRC 84-0109 (Reference 1), "Fire Protection Review." Drawing E-1F9915 (Reference 2), "Design Basis Document for OFN RP-017, Control Room Evacuation," Revision 5, Evaluation SA-08-006 (Reference 3), "RETRAN-3D Post-Fire Safe Shutdown (PFSSD)

Consequence Evaluation for a Postulated Control Room Fire," Revision 3 and Calculation WCNOC-CP-003 (Reference 23), "VIPRE-01 MDNBR Analyses of Control Room Fire Scenarios,"

Revision 0 demonstrate the adequacy of the revised alternative shutdown procedure, OFN RP-017, "Control Room Evacuation," (Reference 4). The results of Evaluation SA-08-006 require changes to the approved fire protection program as follows:

Revision to USAR Appendix 9.5B to include incorporation of drawing E-1F9915 as the licensing basis document for alternative shutdown following a control room fire in lieu of letter SLNRC 84-0109.

" Revision to Calculation XX-E-013 (Reference 5), Revision 3, "Post-Fire Safe Shutdown (PFSSD) Analysis," Assumption 3-A-4 regarding application of loss of automatic functions, specific to automatic feedwater isolation in the event of a control room fire. Calculation XX-E-013 is incorporated by reference in USAR Appendix 9.5B, "Fire Hazards Analyses."

Deviation from the 10 CFR 50, Appendix R, Section III.L.1 comparison response, as described in Appendix 9.5E of the WCGS USAR, specific to maintaining RCS process variables within those predicted for a loss of normal AC power.

" Deviation from the 10 CFR 50, Appendix R, Section 1ll.L.2 comparison response, as described in Appendix 9.5E of the WCGS USAR, specific to maintaining pressurizer level on scale.

The proposed changes have been determined to adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. Therefore, prior Commission approval is required asSection III.L.1 and Section 1II.L.2 of Appendix R are not directly satisfied.

2. DETAILED DESCRIPTION This amendment application contains a proposed change to the Renewed Facility Operating License and changes to the fire protection program as described in the USAR.

Attachment I to ET 13-0035 Page 3 of 64 2.1 Proposed changes to License Condition 2.C.(5)

The proposed changes would revise Paragraph 2.C.(5)(a) of the renewed facility operating license and the fire protection program as described in the USAR.

License Condition 2.C.(5)(a) currently states:

(a) The Operating Corporation shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek site addendum through Revision 15, as approved in the SER through Supplement 5, Amendment No. 191, Amendment No. 193, and Amendment No. 205 subject to provisions b and c below.

License Condition 2.C.(5)(a) is revised to state:

(a) The Operating Corporation shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek site addendum through Revision 15, as approved in the SER through Supplement 5, Amendment No. 189, Amendment No. 191, Amendment No. 193, Amendment No. 205, and Amendment No. XXX, subject to provisions b and c below.

The proposed change reflects the approved fire protection program based on the issuance of the license amendment approving the proposed change. The amendment number will be reflected in the license condition upon the issuance of the amendment.

Additionally, Amendment No. 189 is being added to License Condition 2.C.(5)(a). Amendment No. 189 was issued on September 30, 2010 and revised the WCGS fire protection program for the use of fire-resistive cable for certain power and control cables with two motor-operated valves on the Component Cooling Water System. Subsequent to Amendment No. 189, amendments that approved changes to WCGS fire protection program were included in License Condition 2.C.(5)(a).

2.2 Proposed Change to USAR Appendix 9.5B. Drawing E-1F9915 Revision to USAR Appendix 9.5B to incorporate drawing E-1 F9915, "Design Basis Document for OFN RP-017, Control Room Evacuation," as the licensing basis document for alternative shutdown following a control room fire in lieu of letter SLNRC 84-0109. Incorporation of drawing E-1F9915 into USAR Appendix 9.5B incorporates the revised alternate shutdown methodology into the fire protection program. Drawing E-1F9915 is based on the results of Evaluation SA 006.

2.3 Proposed Change to Calculation XX-E-013 (USAR Appendix 9.5B)

Calculation XX-E-013, Assumption 3-A-4 currently states:

For fire in areas requiring alternative shutdown capability (i.e., where control room evacuation may be necessary), a loss of automatic function of valves and pumps with control circuits that could be affected by a control room fire is assumed. In addition, in the

Attachment I to ET 13-0035 Page 4 of 64 event of a loss of offsite power the emergency diesel generators are assumed to fail to start automatically on undervoltage.

Basis: NRC Generic Letter 86-10, Response to Question 3.8.4; NEI 00-01, Rev. 2, Paragraph 3.3.1.1.4.1, RG 1.189, Rev. 2, Section 5.4.4 Assumption 3-A-4 is revised as follows:

Except for an automatic feedwater isolation signal (FWIS), a fire in areas requiring alternative shutdown capability (i.e., control room) is assumed to cause a loss of automatic function of valves and pumps with control circuits that could be affected by a control room fire. For example, in the event of a loss of offsite power the emergency diesel generators will normally start automatically on undervoltage. However, in developing the alternative shutdown strategy, capability of this automatic feature to operate is not assumed. In the case of an automatic FWIS it is assumed that a FWIS is unaffected by a fire in the control room and that the FWIS will automatically close the main feedwater isolation valves and/or the main feedwater regulating valves (MFRV) and MFRV bypass valves.

Basis: NRC Generic Letter 86-10, Response to Question 3.8.4; NEI 00-01, Rev. 2, Paragraph 3.3.1.1.4.1; License Amendment XXX (amendment number to be incorporated based on NRC approval of this application)

Evaluation SA-08-006 assumes that an automatic feedwater isolation signal (FWIS) will occur in response to a low Tavg coincident with reactor trip (P-4) or low steam generator (SG) level. As a result of a non-cited violation documented in the 2011 NRC Triennial Fire Protection Inspection Report 05000482/2011007 (Reference 6), the WCGS fire protection program cannot take sole credit for main steam isolation valve (MSIV) closure using the hand switches in the control room.

Closing the MSIVs terminates main steam flow to the feedwater pump turbines and stops the main feedwater pumps. However, with the main feedwater pumps continuing to operate, the SGs overfill in a matter of minutes, which is insufficient time for operators to take action to stop the pumps. Therefore, WCNOC is proposing a revision to credit the automatic FWIS for closure of the main feedwater isolation valves (MFIVs) and/or the main feedwater regulating valves (MFRVs), and the MFRV bypass valves to terminate main feedwater flow and prevent SG overfill.

The basis for acceptance of this revision is discussed in Section 3.6.

2.4 Proposed Change to USAR Appendix 9.5E, Response to Section III.L.1 The WCGS response to Section III.L.1 in USAR Table 9.5E-1 (Sheet 25), is revised by adding the following statement:

The performance criteria of III.L.1 are satisfied, with the exception of maintaining reactor process variables within those predicted for a loss of normal ac power. This is acceptable, as long as a control room fire will not result in the plant reaching an unrecoverable condition, which could lead to core damage. The criteria for "not reaching an unrecoverable condition" are that 1) natural circulation is maintained, and 2) adequate core cooling is maintained.

Attachment I to ET 13-0035 Page 5 of 64 Appendix R,Section III.L.1 states the following:

"Alternative or dedicated shutdown capability provided for a specific fire area shall be able to (a) achieve and maintain subcritical reactivity conditions in the reactor; (b) maintain reactor coolant inventory; (c) achieve and maintain hot standby2 conditions for a PWR (hot shutdown 2 for a BWR); (d) achieve cold shutdown conditions within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; and (e) maintain cold shutdown conditions thereafter. During the postfire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal AC power, and the fission product boundary integrity shall not be affected; i.e.,

there shall be no fuel clad damage, rupture of any primary coolant boundary, or rupture of the containment boundary.

2As defined in the Standard Technical Specifications."

One of the requirements listed in Appendix R,Section III.L.1 is that the process variables shall be maintained within those predicted for a loss of normal AC power. This general requirement may not be met for all transients for two reasons:

1) Some of the transients evaluated have off-site power available and do not represent the transient characteristics of a normal loss of AC power.

2) The PFSSD analysis assumes a loss of off-site power in some scenarios coupled with one spurious operation (failure) and no automatic actuation of safety components.

These two additional conservative assumptions ensure the transient will be more severe than a loss of normal AC power.

Thus, the response of the process variables to these accident conditions cannot be bounded by the loss of normal AC transient results. However, Evaluation SA-08-006 and Calculation WCNOC-CP-003 demonstrates that adequate core cooling is maintained, natural circulation flow through the core is maintained, and the plant reaches safe shutdown conditions.

2.5 Proposed Chanae to USAR Appendix 9.5E. Response to Section III.L.2 The WCGS response to Section Ill.L.2 in USAR Table 9.5E-1 (Sheet 25), is revised by adding the following statement:

In general, the performance goals of III.L.2 are satisfied except that in some cases pressurizer water level is not maintained within level indication. This is acceptable as long as an evaluation demonstrates that unrecoverable conditions are not reached.

Appendix R, Section IlI.L.2 states the following:

"The performance goals for the shutdown functions shall be:

a. The reactivity control function shall be capable of achieving and maintaining cold shutdown reactivity conditions.

b. The reactor coolant makeup function shall be capable of maintaining the reactor coolant level above the top of the core for BWRs and be within the level indication in the pressurizer for PWRs.

Attachment I to ET 13-0035 Page 6 of 64

c. The reactor heat removal function shall be capable of achieving and maintaining decay heat removal.

d. The process monitoring function shall be capable of providing direct readings of the process variables necessary to perform and control the above functions.

e. The supporting functions shall be capable of providing the process cooling, lubrication, etc., necessary to permit the operation of the equipment used for safe shutdown functions."

Evaluation SA-08-006, Revision 3, demonstrates that the performance goals of Appendix R,Section III.L.2, are generally satisfied. Section 3.7 provides the results of Evaluation SA-08-006.

In one evaluated event (Scenario 3A), pressurizer water level is not maintained within level indication as required by Section III.L.2.b. This is acceptable since the evaluation demonstrates natural circulation is maintained and adequate core cooling is maintained. As such, an unrecoverable condition is not reached.

3. TECHNICAL EVALUATION 3.1 Post-Fire Safe Shutdown Design Basis Function The post-fire safe shutdown design basis for WCGS is the cold shutdown operational mode (Mode 5). In the event that a fire occurs in the plant, which is determined to warrant the plant being brought to a cold, depressurized condition, the plant will be taken immediately to a hot standby condition and then taken to cold shutdown. The time to achieve cold shutdown is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for control room fires. For fires outside the control room, repairs to cold shutdown equipment need to be made within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

10 CFR 50 Appendix R, Section Ill.L, "Alternative and dedicated shutdown capability," specifies that alternative or dedicated shutdown capability provided for a specific fire area shall be able to:

(a) achieve and maintain subcritical reactivity conditions in the reactor; (b) maintain reactor coolant inventory; (c) achieve and maintain hot standby conditions for a PWR; (d) achieve cold shutdown conditions within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; and (e) maintain cold shutdown conditions thereafter.

In order to meet the above criteria, the following functions must be available following any fire in the plant:

1. reactivity control function;

2. reactor inventory makeup function; and

3. decay heat removal function.

Attachment I to ET 13-0035 Page 7 of 64 Associated with the above functions is process monitoring instrumentation and other support systems needed to make the function available.

3.2 Background The WCGS USAR, Appendix 9.5E, provides a comparison of the WCGS Fire Protection Program against the requirements of Section III of Appendix R to 10 CFR 50. Although WCGS obtained its operating license after January 1, 1979, the NRC stated, in NUREG 0881 (Reference 7),

"Safety Evaluation Report related to the operation of Wolf Creek Generating Station, Unit No. 1,"

that they will condition the WCGS operating license to require WCGS to meet the technical requirements of Appendix R to 10 CFR 50, or provide equivalent protection. However, the license condition never appeared in the WCGS full power operating license when it was issued on June 4, 1985. Therefore, although Appendix R does not apply, WCGS's commitment to Appendix R is established in Appendix 9.5E as part of the approved fire protection program documented in the USAR.

During an NRC audit of fire protection during the week of July 30, 1984, assumptions applied in the control room fire hazards analysis were questioned. The concern resulted in meetings involving Standardized Nuclear Unit Power Plant System (SNUPPS), WCGS, Callaway Plant, and the NRC in August 1984 to resolve the issues. Meetings were held on August 10, 14, 15, and 22.

As a result of the meetings, SNUPPS developed letter SLNRC 84-0109 (Reference 1) which documented the SNUPPS "Response Plan for Immediate Evacuation of the Control Room Due to Fire." Letter SLNRC 84-0109 addressed spurious actuations and established Phases A through F actions to be taken to mitigate the consequences of a fire in the control room.

The 2005 NRC triennial fire protection inspection issued an apparent violation of License Condition 2.C.(5)(a). As a result of the apparent violation, changes to the alternative shutdown methodology were implemented in procedure OFN RP-017. Additionally, drawing E-1F9915, Revision 0, and Evaluation SA-08-006, "RETRAN-3D Post-Fire Safe Shutdown (PFSSD)

Consequence Evaluation for a Postulated Control Room Fire," Revision 0, were developed to demonstrate the adequacy of the revised alternative shutdown procedure. These evaluations predicted that a fire in the control room, which led to control room abandonment and caused a single pressurizer power operated relief valve (PORV) to spuriously open, could cause a steam bubble and subsequent void in the reactor vessel head. USAR Table 9.5E-1 was revised to include the following paragraph:

Analysis demonstrates that the performance goals of III.L.2 are satisfied. The performance criteria of III.L.1 are also satisfied, with the exception of maintaining reactor process variables within those predicted for a loss of normal ac power. This is acceptable, as long as a control room fire will not result in the plant reaching an unrecoverable condition, which could lead to core damage.

During the 2008 NRC triennial fire protection inspection, the team identified an unresolved item related to this change to the fire protection program. The team was concerned that the licensee changed the fire protection program in a manner that could adversely affect the ability to achieve and maintain safe shutdown in the event of a fire without prior NRC approval. Subsequently, the NRC identified this as noncited violation 05000482/2009004-08 (Reference 8).

In response to the NRC finding, WCNOC submitted a license amendment request (Reference 9) to make changes to the approved fire protection program as described in the WCGS USAR.

Attachment I to ET 13-0035 Page 8 of 64 Specifically, a revision to USAR Table 9.5E-1 was proposed to include information on RCS process variables not maintained within those predicted for a loss of normal AC power as evaluated in Evaluation SA-08-006, Revision 1. WCNOC letter ET 10-0031 (Reference 10) provided supplemental information necessary to enable the NRC staff to make an independent assessment regarding the acceptability of the proposed amendment. On May 24, 2011, a request for additional information (Reference 11) was issued related to the amendment request.

In preparing the information to support a response to request for additional information, further review of Evaluation SA-08-006, Revision 1, identified a number of discrepancies with the assumptions utilized. Based on these discrepancies, WCNOC letter ET 11-0005 (Reference 12) withdrew the license amendment request.

Following resolution of the discrepancies in Evaluation SA-08-006, WCNOC submitted a license amendment request under WCNOC letter ET 12-0033 dated December 20, 2012 (Reference 13).

WCNOC letter ET 13-0004 (Reference 14) withdrew the amendment request based on insufficient information required for NRC acceptance of the application. The NRC acknowledged the request to withdraw the amendment request via letter from NRC to WCNOC (Reference 15) and provided a list of information deficiencies in the submittal. Attachment VII identifies how the information deficiencies in Reference 15 are addressed.

3.3 Fire Protection Program License Basis The WCGS fire protection program license basis for alternative shutdown can be found in the following documents:

1. WCGS Renewed Facility Operating License NPF-42, Condition 2.C.(5), Fire Protection,

2. NUREG 0881 Supplement No. 5, and

3. WCGS USAR, Section 9.5.1, Appendix 9.5B, and Appendix 9.5E.

WCGS Renewed Facility Operating License NPF-42, Section 2.C.(5) conditions the operating license as follows regarding fire protection:

(5) Fire Protection (Section 9.5.1, SER, Section 9.5.1.8. SSER #5)

(a) The Operating Corporation shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPS Final Safety Analysis Report for the facility through Revision 17, the Wolf Creek site addendum through Revision 15, and as approved in the SER through Supplement 5, Amendment No. 191, Amendment No. 193, and Amendment No. 205 subject to provisions b and c below.

(b) The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(c) Deleted

Attachment I to ET 13-0035 Page 9 of 64 NUREG 0881 (Reference 7), "Safety Evaluation Report related to the operation of Wolf Creek Generating Station, Unit No. 1," (referred to as SER), Section 9.5.1.7, states the following regarding compliance with 10 CFR 50, Appendix R:

"9.5.1.7 Appendix R Statement On October 27, 1980, the Commission approved a rule concerning fire protection. Although this rule and its Appendix R are not directly applicable to Wolf Creek, the requirements set forth in Appendix R are being used as guidelines in licensing plants after January 1, 1979.

On April 27, 1981, the Commission required that Operating Licenses issued after January 1, 1979, contain a condition requiring compliance with commitments made by an applicant and agreed to by the staff after differences between the applicant's program and the guidelines set forth in Appendix A to BTP 9.5-1 and Appendix R to 10 CFR 50 have been identified and evaluated.

The applicant has provided in the FSAR an evaluation of how he meets Appendix R and identified any exceptions. The staff is continuing to review the information. The staff will condition the operating license to require the applicant to meet the technical requirements of Appendix R to 10 CFR 50, or provide equivalent protection."

Although the fire protection conditions in Section 2.C.(5) were not revised to include a specific Appendix R license condition, Section 2.C.(5)(a) references the SER, through Supplement 5 and, therefore, the above SER statement is considered a license condition by reference.

Letter SLNRC 84-0109 is the original response strategy for shutting down the plant and maintaining a safe hot standby condition from outside the control room in the event of a fire in the control room. This letter is part of the approved fire protection program because the response strategy is described, in detail, in NUREG 0881 Supplement 5, "Safety Evaluation Report related to the operation of the Wolf Creek Generating Station Unit No. 1," (Reference 16), Section 9.5.1.5. However, there was no technical basis supporting the actions and response times. The strategy was developed based on operator knowledge and experience at the time.

Procedure OFN RP-017 implements the response plan for fire in the control room but differs from letter SLNRC 84-0109 and the response strategy in NUREG 0881 Supplement 5. The technical basis for the response plan in OFN RP-017 is documented in drawing E-1F9915, "Design Basis Document for OFN RP-017, Control Room Evacuation," Revision 5. This drawing, along with various inputs, provides the technical basis for each action step and response time in the procedure and shows that the plant can be safely brought to a hot standby condition using procedure OFN RP-017.

As discussed in Section 2.2 above, WCNOC proposes to establish drawing E-1F9915 as the new license basis for the procedure OFN RP-017 for shutting down the plant from outside the control room in case of a fire. Drawing E-1F9915 maintains the original philosophical approach for achieving and maintaining safe shutdown as discussed in letter SLNRC 84-0109 by manually manipulating equipment per an approved procedure. The procedure directs operators to take actions, regardless of the status of plant equipment, to avoid or mitigate undesirable events. The approved fire protection program is revised to modify the response strategy described in NUREG 0881 Supplement 5 to the response strategy described in drawing E-IF9915. The response strategy is encompassed in procedure OFN RP-017 with the technical basis provided in drawing E-1 F9915.

Attachment I to ET 13-0035 Page 10 of 64 3.4 Defense-I n-Depth Evaluation The concept of defense-in-depth, described in 10 CFR 50, Appendix R, is applied to the WCGS Fire Protection Program, including the control room, with the following three objectives:

1. Prevent fires from starting;

2. Detect rapidly, control, and extinguish promptly those fires that do occur; and,

3. Provide protection of structures, systems, and components (SSCs) important to safety so that a fire that is not promptly extinguished by fire suppression activities will not prevent safe shutdown of the plant.

Defense-in-depth fire protection features established for meeting the above objectives for the control room includes the following:

1. Fixed spot-type ionization smoke detectors are provided within the following control room cabinets:

a. RL001 through RL028, Main Control Boards

b. RP068, Balance of Plant Panel

c. NF039A, B and C - Load shedder/sequencer

2. Halon 1301 system actuated by fixed spot-type ionization smoke detectors is provided inside the cable trenches beneath the control room floor.

3. Fixed spot-type ionization smoke detectors installed at the ceiling level throughout the control room.

4. Duct smoke detectors installed on the control room back panel area return ductwork.

5. Administrative controls minimize the introduction of transient combustibles in the control room.

6. Minimum 3-hour fire barriers separating the control room from other areas of the plant.

7. Except under strictly controlled conditions, hot work activities are not permitted in the control room during power operation.

8. Cables carrying voltages greater than 120 VAC/125 VDC are not run in the control room.

Cables in the control room are limited to those that terminate in the control room for instrumentation and control circuits as well as lighting and other ancillary uses.

9. The carpet material used in the control room is 100 percent nylon and meets or exceeds the surface flammability requirements per ASTM E84 or CPSC Standard FFI-70, the static propensity rating per ASTM D2679 or AATCC-134, smoke development rating per ASTM E662, and the critical radiant flux rating per ASTM E-648 or NFPA 253.

10. The control room is continuously manned, allowing for quick response to any fire event in the control room.

Attachment I to ET 13-0035 Page 11 of 64 Based on the above discussion the fire protection defense-in-depth features within the control room provide reasonable assurance that a severe fire that causes the evacuation of the control room is unlikely.

3.5 Postulated Fire Scenario The fire scenario is an incipient fire within one of the cabinets in the control room. The fire continues to burn and is detected by the control room staff, either through actuation of the smoke detection system, control room operators sensing the fire or by investigation of abnormal control board conditions. At this point the fire is contained within the cabinet of origin. Based on fire testing documented in NUREG/CR-4527 (Reference 17), "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Control Cabinets: Part 1: Cabinet Effects Tests,"

there is reasonable assurance that the fire will remain in the cabinet of origin and will not spread to adjacent cabinets.

The scenario assumes that the fire causes evacuation of the control room and operators enter alternative shutdown procedure OFN RP-017. The decision to evacuate would be dependent on several factors, including the expected duration of the adverse control room environment, ability to mitigate the effects of the adverse environment, ability to fight the fire and the ability to mitigate the local damage effects. While the decision to evacuate may take several minutes, the decision to trip the plant is expected to be much sooner based on the equipment affected and extent of damage. This would prompt operators to enter the emergency operating (EMG) procedure network and trip the plant, if not already tripped automatically.

3.6 Feedwater Isolation Signal Evaluation Section 9.5.1.5 of NUREG 0881-Supplement 5 (Reference 16), provides NRC acceptance of the alternative shutdown strategy for a control room fire. The strategy was presented in letter SLNRC 84-0109 dated August 23, 1984 (Reference 1). In that letter, SNUPPS outlined the strategy for bringing the reactor to a safe and stable hot standby condition from outside the control room. Key observations from that letter related to feedwater are listed below:

1. The alternative shutdown strategy in SLNRC 84-0109 took no actions to isolate main feedwater.

2. MSIVs are closed in Phase D, which is a 30 minute action.

3. Isolation of the MSIVs was the only action taken in SLNRC 84-0109 that would have isolated main feedwater.

4. SG overfill did not appear to be an immediate concern in SLNRC 84-0109.

The NRC, in NUREG 0881 Supplement 5, accepted the alternative shutdown strategy with no specific actions taken to isolate main feedwater by the closure of the MFIVs. In addition, isolation of MSIVs was accepted as a 30 minute action. WCNOC procedure OFN RP-017 currently isolates the MSIVs and MFIVs in less than 3 minutes.

Attachment I to ET 13-0035 Page 12 of 64 Evaluation SA-08-006 assumes that an automatic MWIS will occur in response to a low Tavg coincident with reactor trip (P-4) or low SG level. As a result of a non-cited violation documented in the 2011 NRC Triennial Fire Protection Inspection Report 05000482/2011007 (Reference 6),

the WCGS fire protection program cannot take sole credit for MSIV closure using the hand switches in the control room. Closing the MSIVs terminates main steam flow to the feedwater pump turbines and stops the main feedwater pumps. However, since WCGS cannot credit the closing of the MSIVs from the control room, the main feedwater pumps continue to operate and the SGs overfill in a matter of minutes, which is insufficient time for operators to take action to stop the pumps. Therefore, WCNOC is proposing a deviation to credit the automatic FWIS for closure of the MFIVs and/or the MFRVs, and the MFRV bypass valves to terminate main feedwater flow and prevent SG overfill.

This section provides an evaluation of the availability of an automatic MWIS following a control room fire.

3.6.1 System Description When plant accident conditions require feedline isolation, a FWIS trips the main feedwater pumps and closes the MFIVs, the MFRVs, and the MFRV bypass valves. The MWIS also provides a signal to close the air-operated chemical injection isolation valve located in the chemical injection flow path associated with each main feedwater line. The valves automatically close when an MWIS is received. A MWIS is generated by a safety injection signal (SIS), low Tavg coincident with reactor trip (P-4), SG water level high-high, or SG water level low-low. The diverse parameters sensed to initiate an SIS are low steam line pressure, low pressurizer pressure, and high containment pressure.

A MWIS is generated on at least one of the following:

1. SG water level high-high (78% Narrow Range) on 2 of 4 level transmitters on 1 of 4 SGs,

2. SG water level low-low (23Y2% Narrow Range) on 2 of 4 level transmitters on 1 of 4 SGs,

3. Low Tavg (564 OF) coincident with reactor trip (P-4) - 2 out of 4 logic, or

4. SIS.

Based on plant data, a SG water level low-low MWIS occurs 7 seconds after reactor trip and a low Tavg coincident with reactor trip (P-4) MWIS occurs 16 seconds after a reactor trip. Only the SG water level low-low and low Tvg coincident with reactor trip (P-4) signals are evaluated here because it is only necessary to have one input to cause a FWIS.

The control room cabinets that contain equipment and controls associated with the FWIS are:

" SB038 - Protection Set I

" SB042 - Protection Set II

SB037 - Protection Set III

SB041 - Protection Set IV

SB029A - Train A Solid State Protection System (SSPS) Input Cabinet

SB029B - Train A SSPS Logic Cabinet

" SB029C/D - Train A SSPS Output Cabinets

Attachment I to ET 13-0035 Page 13 of 64

SB030AB - Train A SSPS Test Cabinets

" SB032A - Train B SSPS Input Cabinet

" SB032B - Train B SSPS Logic Cabinet

SB032C/D - Train B SSPS Output Cabinets

SB033A/B - Train B SSPS Test Cabinets

" SA075A - Train A Main Steam and Feedwater Isolation System (MSFIS) Cabinet

SA075B - Train B Main Steam and Feedwater Isolation System (MSFIS) Cabinet

RL006 - Turbogenerator and Feedwater Console 3.6.2 Evaluation of SG Water Level Low-Low Feedwater Isolation Input Signals This section provides an analysis of the SG water level low-low input signals to the SSPS.

Feedwater isolation output signals are evaluated in Section 3.6.4 below. Locations of conduit and cable tray carrying cables associated with the SG water level low-low feedwater isolation input signals within the equipment cabinet area are depicted on the control room layout diagram provided in Attachment V.

A SG water level low-low FWIS occurs when 231/% narrow range level is sensed by 2 out of 4 level transmitters on 1 out of 4 steam generators. SG narrow range water level is monitored by the following instruments:

SG A - AELT0517, AELT0518, AELT0519, AELT0551

SG B - AELT0527, AELT0528, AELT0529, AELT0552

SG C - AELT0537, AELT0538, AELT0539, AELT0553

SG D - AELT0547, AELT0548, AELT0549, AELT0554 Signals from AELT0551, AELT0529, AELT0539 and AELT0554 are processed in Train A Protection Set I Cabinet SB038. Cables associated with these level transmitters enter cabinet SB038 from the bottom via the lower cable spreading room. The cables are not exposed within the control room equipment cabinet area, except within cabinet SB038.

Signals from AELT0519, AELT0552, AELT0553 and AELT0549 are processed in Train B Protection Set II Cabinet SB042. Cables associated with these level transmitters enter cabinet SB042 from the top via the equipment cabinet area of the control room. The cables are run in conduit from the small electrical chase between columns C-5 and C-7 and run North to the cabinet. The conduit does not run over the top of the Train A protection cabinets.

Signals from AELT0518, AELT0528, AELT0538 and AELT0548 are processed in Train A Protection Set III Cabinet SB037. Cables associated with these level transmitters enter cabinet SB038 from the bottom via the lower cable spreading room. The cables are not exposed within the control room equipment cabinet area, except within the cabinet.

Signals from AELT0517, AELT0527, AELT0537 and AELT0547 are processed in Train B Protection Set IV Cabinet SB041. Cables associated with these level transmitters enter cabinet SB041 from the top via the upper cable spreading room. The cables are run in cable tray that runs vertically from the upper cable spreading room directly into the cabinet. The cable tray does not run over the top of the Train A protection cabinets.

Attachment I to ET 13-0035 Page 14 of 64 From the protection cabinets, the SG water level input signals are transmitted to the SSPS cabinets. Each of the four protection cabinets sends a level signal to both trains of SSPS input cabinets (SB029A - Train A and SB032A - Train B). The cables from SB038 to SB029A and SB032A run out the bottom of each cabinet into the lower cable spreading room and are not exposed within the control room equipment cabinet area, except within the cabinets. The cables from SB042 to SB029A and SB032A run in conduit in the equipment cabinet area of the control room. The cables from SB037 to SB029A and SB032A run out the bottom of each cabinet into the lower cable spreading room and are not exposed within the control room equipment cabinet area, except within the cabinets. The cables from SB041 to SB029A and SB032A run in cable tray out the top of the cabinets and into the upper cable spreading room.

Based on the above discussion, the SG water level inputs to the SSPS are adequately separated such that a credible fire in the control room will not affect both trains of inputs. Furthermore, the Train A and Train B cabinets are physically separated such that a credible fire would not affect both trains of cabinets. Therefore, there is reasonable assurance that a credible fire will not prevent a SG water level low-low input signal from 2 out of 4 level transmitters on 1 out of 4 SGs.

3.6.3 Evaluation of Low Ta__ Coincident with Reactor Trip (P-4) Feedwater Isolation Input Signal This section provides an analysis of the low Tavg coincident with reactor trip (P-4) feedwater isolation input signals to the SSPS. Feedwater isolation output signals are evaluated in Section 3.6.4 below. Locations of conduit and cable tray carrying cables associated with the low Tavg coincident with reactor trip (P-4) feedwater isolation input signals within the equipment cabinet area are depicted on the control room layout diagram provided in Attachment V.

RCS temperature is monitored by the following temperature elements:

Loop 1 - BBTE0411B (Cold Leg), BBTE0411A1 (Hot Leg), BBTE0411A2 (Hot Leg) and BBTE0411A3 (Hot Leg)

Loop 2 - BBTE0421B (Cold Leg), BBTE0421A1 (Hot Leg), BBTE0421A2 (Hot Leg) and BBTE0421A3 (Hot Leg)

" Loop 3 - BBTE0430B (Cold Leg), BBTE0431A1 (Hot Leg), BBTE0431A2 (Hot Leg) and BBTE0431A3 (Hot Leg)

Loop 4 - BBTE0441B (Cold Leg), BBTE0441A1 (Hot Leg), BBTE0441A2 (Hot Leg) and BBTE0441A3 (Hot Leg)

Signals from these temperature elements are processed in the applicable protection cabinet for that loop (SB038 - Loop 1, SB042 - Loop 2, SB037 - Loop 3, SB041 - Loop 4). The average temperature of each loop is calculated within the protection cabinet and the output is sent to both trains of SSPS input cabinets (SB029A - Train A and SB032A - Train B). One cable carries the temperature signal for all four transmitters per loop and enters the associated protection cabinet.

Signals for Train A (Loops 2 and 3) enter protection cabinets SB037 (Loop 3) and SB038 (Loop

1) through the lower cable spreading room. There are no exposed cables in the equipment cabinet area associated with the Train A input signals except those within the cabinets. Signals for Train B (Loops 2 and 4) enter protection cabinets SB041 (Loop 4) and SB042 (Loop 2) from the upper cable spreading room via raceway that is installed within the equipment cabinet area of the control room.

Attachment I to ET 13-0035 Page 15 of 64 The average temperature on each loop is calculated within each protection cabinet, and the results are transmitted to both trains of SSPS cabinets. Two cables (one per train) are run from each protection cabinet to each SSPS input cabinet (SB029A - Train A and SB032A - Train B).

Cables from SB041 to SB029A and SB032A run in vertical cable tray from the panel to the upper cable spreading room. Cables from SB042 to SB029A and SB032A run in conduit within the equipment cabinet area of the control room. Cables from both SB037 and SB038 to S8029A and SB032A run out the bottom of the panels into the lower cable spreading room. There are no exposed raceway for the Train A cables in the equipment cabinet area, except within the cabinet enclosures.

The reactor trip input signal to the SSPS cabinets originates from cabinets SB102A (Train A) and SB102B (Train B) located in the Rod Drive/MG Set Room. The signal is a short circuit when the reactor is tripped. The Train A reactor trip signal runs from SB102A to SB029B via the lower cable spreading room. There are no exposed raceways for the Train A signal in the equipment cabinet area, except within SB029A. The Train B reactor trip signal runs from SB102B to SB032B via conduit running in the equipment cabinet area of the control room. The conduit enters the equipment cabinet area of the control room from the East and runs West over the SB032 cabinet section and drops into SB032B. This conduit is separated from the SB029 cabinets by a horizontal distance of approximately four feet.

Based on the above discussion, the low Tang coincident with reactor trip (P-4) feedwater isolation input signals to the SSPS are adequately separated such that a credible fire in the control room will not affect both trains of inputs. Furthermore, the Train A and Train B cabinets are physically separated such that a credible fire would not affect both trains of cabinets. Therefore, there is reasonable assurance that a credible fire will not prevent a low Tayg coincident with reactor trip (P-

4) feedwater isolation input signal on 2 out of 4 temperature transmitters on one loop.

3.6.4 Evaluation of Feedwater Isolation Output Signals The reactor trip signals, low Tavg signals and SG water level low-low signals are processed in logic cabinets SB029B and SB032B. Once conditions are met for a FWIS, the following occurs:

1. The MFRVs and MFRV bypass valves close.

2. The MFIVs close.

3. The chemical injection isolation valves close.

4. The main feedwater pumps trip.

The occurrence of 1, 2 or 4 will terminate main feedwater flow to the SGs. The MFRV, MFRV bypass valves, and MFIVs are evaluated below. The chemical injection isolation valves are not evaluated because a normally closed manual valve and check valve. is installed between the chemical injection isolation valve and the feedwater header. These valves will prevent flow diversion from the main feedwater system to the chemical addition system. Therefore, the chemical injection isolation valves require no further evaluation. The main feedwater pumps are not evaluated because closure of the MFRV and MFRV bypass valves or the MFIVs terminates main feedwater flow to the SGs.

Attachment I to ET 13-0035 Page 16 of 64 3.6.4.1 MFRV and MFRV Bypass Valve Closure Evaluation The MFRVs are air-operated angle valves used to control feedwater flow to the SGs. The air supply to the valves is held open by two normally energized 125 VDC solenoid valves (one per train). Loss of 125 VDC power to either solenoid will fail the solenoid valve closed, bleed air from the regulator, and close the MFRV. Power to each solenoid is maintained by three normally closed contacts, wired in series, on slave relays K604, K605 and K606, located in SSPS output cabinets SB029C (Train A) and SB032C (Train B). Energizing either of these slave relays opens the contact and fails power to the solenoid.

Relay K604 is associated with the SIS input to the FWIS and is not being evaluated here since a SIS is not credited to provide a FWIS. 'Relays K605, associated with the SG water level input to the FWIS, and K606, associated with the low Tavg coincident with reactor trip (P-4) FWIS input, are evaluated here since these signals are credited for providing a FWIS following a control room fire. Power to Train A relays K605 and K606 is from 120 VAC power supply NNO1 12. Power to Train B relays K605 and K606 is from 120 VAC power supply NN0412. Power is applied to slave relay K605 when master relay K507 is energized following receipt of a SG water level high-high or low-low FWIS. Power is applied to slave relay K606 when master relay K520 is energized following receipt of a low Tavg coincident with reactor trip (P-4) FWIS. Master relays K507 and K520 are powered by 48 VDC power supplies within SB029B and SB032B. Train A power to the 48 VDC power supplies in cabinet SB029B is from NNO1 10 and NN0309. Train B power to the 48 VDC power supplies in cabinet SB032B is from NN0209 and NN0410.

Power from NNO1 12 to output cabinet SB029D enters the bottom of the cabinet from the lower cable spreading room and is not exposed in the equipment cabinet area except within the cabinet. Power from NN0412 to output cabinet SB032D enters the top of the cabinet via cable tray from the upper cable spreading room. Power from NNO1 10 and NN0309 to input cabinet SB029A enters the bottom of the cabinet from the lower cable spreading room and is not exposed in the equipment cabinet area except within the cabinet. Power from NN0209 to input cabinet SB032A runs in conduit from the upper cable spreading room into the top of SB032A.

Power from NN0410 runs in cable tray from the upper cable spreading room straight down to near the top of the cabinet then drops into conduit and runs over the top of SB032B and SB032C and drops into the top of SB032A.

Loss of one train of power will not prevent the other train from performing the FWIS functions.

Furthermore, loss of 120 VAC power to one of the 48 VDC power supplies will not prevent the other power supply from supplying the master relays on that train.

Four separate control cables (one per valve) run from SB029C to SB030A via cable tray that leaves the bottom of the cabinets and runs in the lower cable spreading room. From SB030A, the Train A cables drop down into the lower cable spreading room and run to the associated Train A MFRV solenoid valve. Four separate cables (one per valve) run from SB032C to SB033A via cable tray that leaves the top of the cabinet and runs in the upper cable spreading room. From SB033A, the Train B cables exit the top of the cabinet and run to main control panel RL006 via the upper cable spreading room and the cable trench below the control room floor. From RL006, the Train B cables run to the associated solenoid valve via the cable trench below the control room floor and the upper cable spreading room.

Attachment I to ET 13-0035 Page 17 of 64 The MFRV bypass valves operate in the same manner as the MFRVs. Two series solenoid valves, one per train, are installed on the air line for each bypass valve. Both solenoids need to be energized to open the valve. When a SG water level high-high or low-low FWIS or a low Tavg coincident with reactor trip (P-4) FWIS is initiated, the associated contact on the control circuit for each solenoid valve opens and causes a loss of power to the solenoid. The contacts for SG water level high-high and low-low FWIS are on slave relay K612 which is controlled by master relay K507. The contacts for the low Tavg coincident with reactor trip (P-4) FWIS are on slave relay K613 which is controlled by master relay K520. Power to the master relays is evaluated above. Power to the slave relays is from the same power source as slave relays K605 and K606 discussed above. Train A control cables exit cabinet SB029C from the bottom and enter the lower cable spreading room where they run to the solenoid valve. Train B control cables exit cabinet SB032C from the top and enter the upper cable spreading room where they run to the solenoid valve.

Based on the above discussion, there is reasonable assurance that a credible fire in the control room will not affect both trains of MFRVs and MFRV bypass valve circuits. Therefore, there is reasonable assurance that a FWIS will result in the closure of all four MFRVs and all four MFRV bypass valves.

3.6.4.2 MFIV Closure Analysis Each of the four MFIVs are held open by six energized solenoids (three per train). MFIV closure occurs upon loss of power to one train of solenoids. Power to the solenoids is controlled through Main Steam and Feedwater Isolation System (MSFIS) cabinets SA075A and SA075B. A FWIS is processed in the MSFIS cabinets, which in turn drops power to the solenoids to close the valves.

Output cabinets SB029D and SB032D each contain three slave relays (K743, K744 and K745) associated with the MFIV FWIS function. Each relay coil is normally de-energized. Relay K743 is associated with the SIS input to the FWIS and is not being evaluated here since a SIS is not credited to provide a FWIS following a control room fire. Relays K744, associated with the SG water level input to the FWIS, and K745, associated with the low Tavg coincident with reactor trip (P-4) FWIS input, are analyzed here since these signals are credited for providing a FWIS following a control room fire.

Power to Train A slave relays K744 and K745 is from 120 VAC power supply NNO1 12. Power to Train B slave relays K744 and K745 is from 120 VAC power supply NN0412. Power is applied to slave relay K744 when master relay K507 is energized following receipt of a SG water level high-high or low-low FWIS. Power is applied to slave relay K745 when master relay K520 is energized following receipt of a low Tavg coincident with reactor trip (P-4) FWIS. Master relays K507 and K520 are powered by 48 VDC power supplies within SB029B and SB032B. Train A power to the 48 VDC power supplies in SB029B is from NN01 10 and NN0309. Train B power to the 48 VDC power supplies in SB032B is from NN0209 and NN0410. An evaluation of the power cable routing is provided in Section 3.6.4.1 above.

Each slave relay has eight contacts that are either normally open or normally closed. Four of the normally closed contacts (one per MFIV) on each relay are used for the FWIS input to the MSFIS cabinets. The contacts are wired in series configuration so that any single contact opening will cause the MFIVs to close.

Attachment I to ET 13-0035 Page 18 of 64 Four control cables run out the bottom of cabinet SB029D into the lower cable spreading room and up through the floor into cabinet SA075A. These cables are associated with the Train A trip circuit for the four MFIVs. The cables are not exposed in the equipment cabinet area except within the cabinets.

Four control cables run from SB032D to SA075B via cable trays leaving the top of the cabinets and running in the upper cable spreading room. These cables are associated with the Train B trip circuit for the four MFIVs.

Once the FWIS is processed in SA075A and SA075B, power is removed from the associated solenoid valves that maintain the MFIVs in the open position. Power cables for the three Train A solenoid valves exit cabinet SA075A from the bottom and enter the lower cable spreading room, where the cables run to the MFIVs. Power cables for the three Train B solenoid valves exit cabinet SA075B from the top and enter the upper cable spreading room, where the cables run to the MFIVs.

Based on the above discussion, there is reasonable assurance that a credible fire in the control room will not affect both trains of circuits associated with the MFIVs. Therefore, there is reasonable assurance that a FWIS will result in the closure of all four MSIVs.

3.6.5 Control Room Cabinet Fire Testing Fire tests of representative samples of control room cabinets were conducted in the mid-1980s and the results are reported in NUREG/CR-4527 (Reference 17), "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Control Cabinets: Part 1: Cabinet Effects Tests."

The results of this test program show that severe fires in vertical control cabinets will not'spread to adjacent cabinets where IEEE-383 qualified and unqualified cable is used and where the cabinets are separated only by the metal enclosure of each cabinet forming a double wall metal barrier. In these tests, the cabinets were placed side-by-side leaving only a 1-inch air gap between cabinets.

The cabinets used in the fire tests are representative of the control cabinets used at WCGS. In fact, as stated in NUREG/CR-4527, Section 2.2 one of the key objectives of the test was to test representative type cabinets used in nuclear power plants. The test cabinets included three vertical cabinets measuring 5' long x 3' wide x 7.5' tall; one vertical cabinet measuring 4' long x 3' wide x 7.5' tall; one vertical cabinet measuring 3' long x 2.5' wide x 7.5' tall; four benchboard cabinets measuring 4' long x 6' wide x 8' tall; and, two mitered benchboards measuring 6.5' long x 6.5' wide x 8' tall. Some of the test cabinets had ventilation grills on the top and bottom of the doors, some had partial partitions on the left or right side of the cabinet and one of the cabinets had no door.

The control cabinets discussed in Section 3.6 have dimensions that are similar to those tested in NUREG/CR-4527 (See photos in the Enclosure to this request). The four protection cabinets (SB037, SB038, SB041 and SB042) are each three-bay cabinets with overall dimensions of 6.7' long x 2.5' wide x 7.9' tall. Ventilation grills are installed on the front and back along the entire length of the cabinet at the top and bottom. The SSPS cabinets (SBO29AIBIC/D and SBO32A/B/C/D) are each four bay cabinets with overall dimensions of 10' long x 2.5' wide x 7.6' tall. Ventilation openings are provided at the bottom of these cabinets. The SSPS test cabinets (SB030AB and SB033A/B) are each two bay cabinets with overall dimensions of 5' long x 2.5' wide x 7.6' tall. Ventilation openings are provided at the bottom of these cabinets. MSFIS

Attachment I to ET 13-0035 Page 19 of 64 cabinets SA075A and SA075B are each single bay cabinets with overall dimensions of 2' long x 2.5' wide x 7.5' tall. There are no ventilation openings in these cabinets.

The following observation was made in NUREG/CR-4527 regarding Preliminary Cabinet Test (PCT) #2:

"PCT #2 demonstrated that for a vertical cabinet with open doors and with an in situ fuel loading of unqualified cable that appears similar to real fuel loadings in nuclear power plants, the fire will develop and spread rapidly throughout the burning cabinet. However, even a fire as large as this did not have a significant thermal effect (i.e. temperature rise that could result in melting of cables or components) on the adjacent cabinets in the configuration tested."

During PCT #2, thermocouple readings inside the test cabinet reached as high as 1,742 0 F, whereas the adjacent cabinet wall temperature only reached 536 0 F. The air temperature inside the adjacent cabinet reached 180 0 F. IEEE-383 qualified cable has a damage threshold of approximately 7000 F. Therefore, the temperatures experienced in the adjacent cabinet would not have been sufficient to damage the cables in that cabinet.

It should be noted that PCT #2 was performed with the cabinet doors open, which results in a higher heat release rate (HRR) than with the doors closed. This represents the most severe condition for the test. At WCGS, the cabinet doors are not open during normal operation and are alarmed to alert operators if the doors are opened. Also, WCGS uses IEEE-383 qualified cable, which resulted in a much lower fire severity when compared to the tests that used unqualified cable. Test PCT #3 studied the effects of a control cabinet fire that uses IEEE-383 qualified cable. The following observation was made regarding this test:

"Preliminary Cabinet Test #3 again showed that a cabinet fire in a vertical cabinet with qualified cable has little potential to propagate and spread throughout a single vertical cabinet. ... with the in situ fuel and configurations tested, a fire in a vertical cabinet with qualified cable is not likely to propagate or result in damage to cable components or equipment outside the cabinet as a result of the thermal environment."

During PCT #3, thermocouple readings were much lower than in test PCT #2. Inside the test cabinet, the air temperature only reached 423 0 F and the adjacent cabinet wall temperature only reached about 212 0 F. The air temperature inside the adjacent cabinet reached 1400 F.

Therefore, the temperatures experienced in the adjacent cabinet were not sufficient to damage the cables in that cabinet.

The test results in NUREG/CR-4527 provide valuable insight for the control room fire scenario discussed in this evaluation. The test results clearly show that under the test configuration studied, a severe fire in one cabinet will not propagate to adjacent cabinets as long as there is at least a double wall metal barrier and 1-inch air gap between the cabinets. It is reasonable to conclude that additional spatial separation further reduces the potential for thermal propagation between cabinets.

The ignition source used in most of the tests was a 2.5 gallon polyethylene bucket containing a 16 oz box of kimwipes and 1 quart of acetone. Some of the kimwipes were crumpled and placed in the bucket and some of the acetone was dumped into the bottom of the bucket to represent a spill. The total heat content of the ignition source was about 68,500 BTUs. This ignition source is

Attachment I to ET 13-0035 Page 20 of 64 extreme compared to the conditions present at WCGS. Administrative controls are in place to prevent the presence of this fuel load inside control room cabinets at WCGS. The only ignition sources inside these cabinets are the IEEE-383 qualified cables that terminate in the cabinets and other cabinet mounted equipment.

The testing also showed that ignition and sustained combustion of qualified cable was difficult even with the ignition source used. A series of 11 smaller scale scoping tests (ST) were preformed to evaluate the ability of the selected ignition source fuels to ignite and propagate a fire in a cable bundle and to select credible in situ fuel packages. These scoping tests also provide valuable insight of the potential fire hazard of qualified and unqualified cable. In test ST

2, only 1 pint of acetone was used in the ignition source package and the fire was not adequate to ignite and propagate a fire in a vertical bundle of qualified cable. In test ST #3, the full quart of acetone was included in the ignition source package and the vertical qualified cable bundle had to be loosened to allow additional air flow and flames through the cables. In this test, the cables ignited and flames propagated up the bundle. As was demonstrated in this test, it was necessary to increase the ignition source fuel and modify the configuration of the cables to achieve the desired test results. At WCGS, cables within control room cabinets are tightly bundled and run in raceways where possible. Therefore, the testing is conservative compared to the WCGS configuration.

Based on the testing reported in NUREG/CR-4527, a credible fire in the control room will not spread out of the cabinet of origin and will not adversely affect cables and components in adjacent cabinets as long as there is a double metal barrier and one inch air gap between cabinets. As shown in Attachments V and VI of this submittal, the configuration of the cabinets at WCGS is such that there is at least a one inch air gap and a double metal barrier between trains of cabinets.

A fire starting outside a cabinet was not considered credible because there are no significant ignition sources or combustibles located outside the cabinets. The back portion of the control room where the critical cabinets are located needs to remain accessible during operation. This along with administrative controls prevents the accumulation of transient combustibles in the area.

3.6.6 Evaluation of Smoke Effects This section discusses the potential for smoke and products of combustion affecting the redundant automatic FWIS. NUREG/CR-4596 (Reference 25) documents the testing of switches, meters, relays, strip chart recorders, electronic counters, a power supply, a power amplifier, and a oscilloscope amplifier that were subjected to actual room fire environments created by burning unqualified cable within cabinets. The primary objective of NUREG/CR-4596 was to assess the functionality of representative nuclear power plant components when subjected to secondary environments created by fire, specifically increased temperatures, increased humidity, and the presence of particulates and corrosive vapors. The test results revealed that most components survived the environments created by the cabinet fires and that higher ventilation rates and a larger room size resulted in significantly less combustion products being deposited on the components. The ceiling height in the equipment cabinet area of the control room is approximately 25 feet above the floor. The control room air conditioning system in the control room and equipment cabinet area is not equipped to shut down in the event of smoke entering the ductwork. During normal operation the return air flow is approximately 22,650 cfm from the control room envelope. The volume of the control room envelope is conservatively

Attachment I to ET 13-0035 Page 21 of 64 estimated at 156,000 cubic feet, determined by taking the overall length and width between columns Cl to C8 and CA to CF and using a ceiling height of 25 feet. The only deductions were the stairwell and the two large electrical chases. Based on the return air flow and the volume, the total number of air changes within the control room envelope is approximately 1 air change every 6.9 minutes (8 air changes per hour). Since the control room air conditioning system does not automatically shut down in the event of smoke in the ductwork, the system will continue to operate to remove products of combustion from the room until the ventilation system is shut down. The decision to trip the plant will likely be made early in the event as environmental and plant conditions warrant. Since the FWIS occurs within 20 seconds of a plant trip, it is not likely that smoke conditions would be sufficient to affect the redundant train of equipment. This is due to the continued operation of the control room air conditioning system, the spatial separation between redundant trains or cabinets and the large volume of the space.

Based on the above discussion, there is reasonable assurance that smoke and products of combustion will not affect the redundant train of FWIS equipment prior to actuation of a FWIS.

3.6.7 Feedwater Isolation Signal Conclusion Separation of circuits associated with a FWIS exists within the control room such that there is reasonable assurance that a credible fire in the control room would not affect both trains of FWIS circuits. A FWIS causes four actions to occur, three of which terminate feedwater flow and two of which have been evaluated above. A fire in the control room would be detected early, prior to significant damage occurring to equipment associated with both trains of FWIS. A manual reactor trip would be followed within approximately 7 seconds by a SG water level low-low FWIS (23 Y2%) or within 16 seconds by a low Tavg coincident with reactor trip (P-4) FWIS. This short duration between reactor trip and FWIS provides reasonable assurance that smoke and fire damage will not affect both trains of FWIS circuits.

3.7 Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation Evaluation SA-08-006, Revision 3, "RETRAN-3D Post-Fire Safe Shutdown (PFSSD)

Consequence Evaluation for a Postulated Control Room Fire," (Reference 3) documents the basis of the WCGS RCS thermal hydraulic response to different scenarios potentially caused by a fire in the control room. Twenty-four control room fire scenarios were chosen to address a spurious actuation that could result in significant RCS mass inventory loss, significant RCS pressure reduction, and pressurizer overfill. These scenarios were developed by evaluating various potential scenarios on the simulator, iterating on assumed failures, and selecting those scenarios that would result in a maximum RCS mass inventory loss and pressure reduction following an uncontrolled cool down of the primary system.

All scenarios assume a single spurious operation failure in conjunction with and without a loss of off-site power and with and without an auxiliary feedwater actuation signal (AFAS). The AFAS was modeled since it could adversely impact PFSSD due to the potential for uncontrolled cool down. With the exception of automatic feedwater isolation, no automatic actions were assumed unless it adversely impacted the transient.

The 24 bounding scenarios evaluated, shown in Table 1, can be grouped into three categories and are summarized as follows:

Attachment I to ET 13-0035 Page 22 of 64

1. Spurious behavior of pressurizer PORV failed open;

2. Spurious behavior of SG atmospheric relief valves (ARVs) failed open; and

3. Spurious uncontrolled letdown.

Table I - Summary of Transient Scenarios Auxiliary Automatic Feedwater Off-Site Safety Scenario Failure (AFW) Power Injection Pump Auto Available Signal Start Available 1 Failed Open Pressurizer PORV 1A Failed Open Pressurizer X PORV 1B Failed Open Pressurizer X PORV 1C Failed Open Pressurizer X X PORV 2 Failed Open Pressurizer X PORV 2A Failed Open Pressurizer X X PORV 2B Failed Open Pressurizer X X PORV 2C Failed Open Pressurizer X X X PORV 3 Failed Open SG ARV 3A Failed Open SG ARV X 3B Failed Open SG ARV X 3C Failed Open SG ARV X X 4 Failed Open SG ARV X 4A Failed Open SG ARV X X 4B Failed Open SG ARV X X 4C Failed Open SG ARV X X X 5 Letdown Open 5A Letdown Open X 6 Letdown Open X

Attachment I to ET 13-0035 Page 23 of 64 Table 1 - Summary of Transient Scenarios Auxiliary Automatic Feedwater Off-Site Safety Scenario Failure (AFW) Power Injection Pump Auto Available Signal Start Available 6A Letdown Open, No X Pressurizer Heaters 6B Letdown Open, No X Pressurizer Heaters, Pressurizer Spray On 6C Letdown Open X X 6D Letdown Open, No X X Pressurizer Heaters 6E Letdown Open, No X X Pressurizer Heaters, Pressurizer Spray On 3.7.1 RETRAN-3D Input Model The results presented in Evaluation SA-08-006 were developed using a four-loop best-estimate RETRAN-3D model of the plant used in the RETRAN-02 mode. The only exception to the RETRAN-02 mode was that the Chexal-Lellouche drift flux model option was used to better represent depleted mass distributions on the SG secondary and to simulate vapor collecting in the upper regions of the RCS should boiling occur. By using a model to simulate vapor and liquid phase separation (unequal velocities), the evaluation allows the vapor to collect in the upper tube primary region, and RCS vessel, which enhance the possibility of loop flow stagnation.

Empirical correlations developed from data are considered acceptable for use for thermal hydraulic analysis purposes if the conditions observed in the analysis remain in the correlation data boundaries. The Chexal-Lellouche drift flux correlation was developed from a steam-water void fraction database and an air and refrigerant void fraction database. A different form of the correlation is used for refrigerant. In RETRAN-3D the Chexal-Lellouche drift flux is applied for steam/water.

The Chexal-Lellouche drift flux steam/water void fraction data consists of several experiments measuring void fraction in heated fuel bundle assemblies and tubes and unheated experiments with various geometries. The steam/water data base is summarized Table 2.

Attachment I to ET 13-0035 Page 24 of 64 Table 2 - Summary of Chexal-Lellouche (1996) Void Fraction Model Database Heated Steam-Water Data Parameter Range Number of Data 1427 Void Fraction 0.01 - 0.95 Mass Flux 0 - 1.59 MIb/hr-ftW Pressure 14.5 - 2175 psia Heat Flux 0.0003 - 0.70 MBtu/hr-ft' Subcooling 0- 54 0 F Geometry Bundle assemblies and tubes (0.03 < Dh < 0.15 ft)

Unheated Steam-Water Data Parameter Range Number of Data 521 Void Fraction 0.01 - 0.99 Mass Flux 0 - 1.92 Mlb/hr-ft' Pressure 14.5 - 2610 psia Geometry Tube (0.015 _<Dh < 2.1 ft)

Void fraction, mass flux, pressure and hydraulic diameter are key parameters in a drift flux formulation.

Steam Generator The hydraulic diameter is used in the drift flux formulation through the Reynolds number.

Steam generator tubes and bundle region have a hydraulic diameter similar to fuel assemblies.

Specifically, the rod bundle data in the Chexal-Lellouche drift flux database have hydraulic diameters ranging from 0.03 ft to 0.15 ft.

For each of the WCNOC RETRAN-3D scenarios, the minimum and maximum values of void fraction, mass flux and pressure in the SG tubes and secondary bundle regions during the transient were obtained. By comparing the scenarios, the minimum and maximum values from the set of analyses are shown in Table 3. These SG parameters fall within Chexal-Lellouche drift flux model database range.

Table 3 - Range of SG Key Parameters during the WCNOC RETRAN-3D Fire Protection Analyses Hydraulic Pressure Mass Flux Region Diameter (psia) (MIb/hr-ft 2) Void Fraction (ft) High - Low High - Low High - Low SG Tubes 0.0507 2487 - 1264 3.13 - 0.084 0.0 - 0.0 SG Tube Bundle 0.107 1235-924 0.28-0.26 1.0-0.079

Attachment I to ET 13-0035 Page 25 of 64 Reactor Coolant System Some of the transient scenarios result in boiling in the RCS. Table 4 below shows the maximum scenario void fraction in the top core node. In all these scenarios, the vapor was condensed in the first SG tube volume and core boiling occurred for only a fraction of the transient. There was no major redistribution of RCS liquid and vapor mass in any of these scenarios.

Table 4 - Maximum Core Exit Void Fraction Scenario I 1A 11B 11C Void Fraction 0.06 0.02 0.0 0.07 The NRC approved the use of RETRAN-02 in the Safety Evaluation Report dated September 30, 1993 (Reference 18), for the WCNOC Topical Report NSAG-006 "Transient Analysis Methodology for the Wolf Creek Generating Station." The NRC has accepted the RETRAN-3D computer code for use in analyzing Chapter 15 accidents and transients subject to some conditions and limitations. This acceptance is documented in a letter from Stuart Richards, NRC, to Gary Vine, EPRI, dated January 25, 2001, entitled "Safety Evaluation Report (SER) on EPRI Topical Report NP-7450(P), Revision 4, "RETRAN-3D - A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems" (TAC No. MA431 1)," (Reference 19).

Specifically, Condition 40 of the NRC Safety Evaluation Report states:

"Organizations with NRC-approved RETRAN-02 methodologies can use the RETRAN-3D code in the RETRAN-02 mode, without additional NRC approval, provided that none of the new RETRAN-3D models listed, in the definition are used. Organizations with NRC-approved RETRAN-02 methodologies must obtain NRC approval prior to applying any of the new RETRAN-3D models listed above for UFSAR Chapter 15 licensing basis applications. Organizations without NRC approved RETRAN-02 methodologies must obtain NRC approval for such methodologies or a specific application before applying the RETRAN-02 code or the RETRAN-3D code for UFSAR Chapter 15 licensing basis applications. Generic Letter 83-11 provides additional guidance in this area. Licensees who specifically reference RETRAN-02 in their technical specifications will have to request a Technical Specification change to use RETRAN-3D."

Section 8.0 of the NRC Safety Evaluation Report indicates that use of the Chexal-Lellouche drift flux model will result in the need to assure its use is in conformance with Condition 16. Condition 16 indicates that the results of the analysis using the model must be carefully reviewed. WCNOC has reviewed the results of the model. Additionally, Evaluation SA-08-006 is not a USAR Chapter 15 licensing basis analysis and, as noted in Condition 40, additional NRC review is not required.

The adequacy of the use of RETRAN to show that the natural circulation can be maintained for conditions when boiling occurs is discussed below.

The momentum or flow equation in RETRAN-3D contains terms that represent the nodal pressure difference (hydrostatic head) due to differences in the adjacent nodal densities. In the absence of forced flow (operating pumps), the hydrostatic head represents a buoyant force that can induce natural circulation flow. The fundamental requirement for natural circulation is that there must be a means of affecting the density gradient around the loop. Heat removal from the SGs provides a means of introducing the necessary density gradient. For natural circulation, this

Attachment I to ET 13-0035 Page 26 of 64 term is the dominant driving force, which is balanced by the friction losses. This balance determines the flow rates.

Since the hydrostatic head is based on the nodal densities, it is applicable to both single-phase and two-phase flow. If nodes become two-phase, the associated density change is larger and can increase the natural circulation flow rate. Scenarios 1, 1A, and 1C discussed above had small void fractions at the core exit and these scenarios demonstrated natural circulation. The RETRAN-3D flow equation buoyancy term is also of the same form as those used in NRC supported system transient analysis codes such as RELAP5, TRAC and TRACE. The wall friction model in RETRAN-3D accounts for both laminar and turbulent friction and includes the additional losses associated with two-phase flow if present.

In Scenarios 3, 3A, 3B, and 3C, the transient is initiated by a loss-of-offsite power (LOOP) and a failed open SG ARV in the A loop SG. Because of the loss-of-offsite power the reactor coolant pumps (RCP) coast down and the RCS responds to enhanced energy transfer to the SG with the failed open ARV. After the RCPs coast down, the loop flow rates are determined by buoyant forces introduced by energy transferred to the SGs. There is no safety injection or normal charging to influence the RCS natural circulation flow.

The failed open ARV causes a rapid decrease in the A loop SG pressure (Scenario 3, Figure 1) which results in a decreased saturation temperature. This increases the primary to secondary temperature differential. After the loss of RCPs, the RCS flow coasts down to the point where the flow is driven solely by buoyancy (natural circulation). The magnitude of the flow is determined by the buoyancy and opposing wall friction. The loop flow rates are shown in Scenario 3, Figure 2.

Note that when the A loop SG is depressurizing (prior to approximately 2400 seconds), the loop natural circulation flow is larger than that for the other loops because of the increased heat transfer and larger change in density. However, after 2400 seconds when the enhanced cooling capability of the A loop SG is lost, the flow drops below that of the other loops. The pressure and corresponding saturation temperature for the C loop SG remains near the initial condition. This leads to a lower heat removal and density change and thus a lower natural circulation loop flow as can be seen in Scenario 3, Figure 2. The B and D loop SG pressures drop below that for the C loop after approximately 2400 seconds. This drops the secondary saturation temperature and increases the heat transfer, which leads to higher B and D loop flows than observed for loop C.

These results clearly demonstrate that the loop buoyant forces are driven by the SG heat removal and that RETRAN-3D is capable of computing natural circulation.

Scenario 3, Figure 2 demonstrates that RETRAN-3D predicts natural circulation after the loss of forced flow. The magnitude of the natural circulation flow has a secondary effect on the tube heat transfer coefficients; however, in these transients operators intervene to stabilize the system either by controlling auxiliary feedwater or ARV flow to direct and maintain the desired RCS temperature. Thus, a difference in natural circulation flow magnitude would be compensated for by operator actions and the end result would be similar.

Attachment I to ET 13-0035 Page 27 of 64 Scenario 3, Figure 1: Steam Generator Pressure 1400 1200 1000 800 S600 0)

CO 400 200 0

0 1200 2400 3600 4800 6000 7200 TransientTime (sec)

Scenario 3, Figure 2: Hot Leg Loop Flow 12000 "Loop A 10000

-Loop B

-Loop C 8000

-Loop D 6000 4000 2000 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec) 3.7.1.1 VIPRE-01 Minimum Departure from Nucleate Boiling Ratio Analyses This section discusses the results of analyses that were performed to show that the scenarios documented in Evaluation SA-08-006 do not result in core damage. Using the VIPRE-01 Code (Reference 22), Minimum Departure from Nucleate Boiling Ratio (MDNBR) analyses were performed for the 24 scenarios using system boundary conditions from the RETRAN-3D system

Attachment I to ET 13-0035 Page 28 of 64 analyses documented in Evaluation SA-08-006. Additional sensitivity analyses were performed to confirm that the most conservative axial and radial power profiles are used.

The VIPRE-01 model used for these analyses is a modified version of the WCGS Cycle 20 axial offset anomaly risk assessment model (Reference 24). The 1/8 core model is nodalized with each assembly represented by four 1/4 assembly channels. The axial nodalization was reduced from 3.0-inch nodes to 1.5-inch nodes to give better resolution of the heated section of the core.

This model uses cross flow with turbulent mixing to represent lateral mass and energy exchange.

The radial nodalization is given in Figure 1 below, where the small blocks represent the VIPRE-01 1/4 assembly channels, and the highlighted blocks represent different assemblies.

H 6 F E D 1

I F2 F 710 7l F7-10 17 5- 187 189 F14ý 195 719- 720 F217 1125 28 7 F237 24 7 F251 2 267 r27 12 F297 F347 351 F36 12 33 1464F7 37 EI34 E F42j36 F3 3] 2 330 F53 54- F557 567 IT41 F617 4F621 EI44 F4 5]45 1 49 5 EE3EE F677 F721 7- F767 7 14 47 F9 74] 7516 F9ý52 F897 F9-2 937 F947 95-15 53 E 56 EKI54 a F"]55500 10, F102l Figure 1: VIPRE-01 1/8 Core MDNBR Model The MDNBR analyses were performed with five different critical heat flux (CHF) correlations (Table 5) that are built into the current VUG version of the VIPRE-01 code (Version 2.4 Mod 280).

Table 5 - VIPRE-01 CHF Correlations Used VIPRE Acronym Description EPRI EPRI-1 Correlation W-3S Westinghouse W-3 with Simple Grid Factor BAW2 Babcock and Wilcox #2 Correlation MACB MacBeth Correlation BOWR Bowring Correlation

Attachment I to ET 13-0035 Page 29 of 64 The VIPRE-01 initial conditions are modeled the same as in Evaluation SA-08-006 as shown in Table 6.

Table 6 - VIPRE-01 Initial Conditions Description RETRAN 3D Value VIPRE-01 Value Core Outlet Pressure 2275.05 psia 2275.05 psia Core Inlet Flow 36934.27 / 8th core Ibm 4616.78 Ibm/sec Core Inlet Enthalpy 555.195 Btu/lbm 555.195 Btu/lbm 3565 MWth

1000 Power MW/kW / 8th core / 69.968 kW/rod (6369 rods per 1/8 core)

The average rod power was increased slightly to make up for a VIPRE-01 calculated normalized power that is less then 1.0 for the VIPRE-01 cases as shown in Table 7.

Table 7 - Normalized Power Increase Original Normalized New Cycle Time kW/rod Axial Profile Factor Applied kW/rod BOC 69.968 0.97410 1.026589 71.828 MOC 69.968 0.97580 1.024800 71.703 EOC 69.968 0.98053 1.019857 71.357 Transient boundary conditions were supplied by the RETRAN-3D analyses VIPRE Boundary Conditions (VBC) file and supplied as input to the VIPRE-01 code. These boundary conditions include normalized power, core outlet pressure, and core input flow and enthalpy. All cases have a similar power response with an early reactor trip and the power quickly reducing to decay heat values (Figure 2). The core outlet pressure is dependent on the transient scenario (Figure 3) with some transients rising to PORV opening and others with a pressure decrease to as low as approximately 1200 psia. Two types of transients are represented by the core inlet flow (Figure 4), those with an early RCP trip and others with a later RCP trip at approximately 420 seconds.

The core inlet enthalpy shown in Figure 5 is also dependent on the transient scenario.

Attachment I to ET 13-0035 Page 30 of 64 1.20 1,00 "

_0.80 0

a.

0.60 0

Z 0.40 0.20 0.00 0.0 5.0 10.o 150. 20.0 25.0 30.0 35.0 40.0 45.0 50.0 Translent Time (sec)

Figur e 2: Normalized Power Boundary Condition 2600 2400

- 2000o 0.

2 1800 n

T\AN

~1600 0

1400 1200 1000 0.0 1000.0 20.0 3=O 4=o0 5=000 6000.0 70000. 8=00 TranslentTime (sec)

Figure 3: Core Outlet Pressure Boundary Condition

Attachment I to ET 13-0035 Page 31 of 64 4OO=O

-MSNI-3

-MSNIA 35000 -MSNIB

-MSNIC

- .MSN242ORV314 3000 -MON2A4PVRV3I4 U8SN2B With AC Power Without AC Power -MSN2C

-MSN3 150 S250000 -MSN3a MSN3C

-MSN14

1. -MSN4A-14

-M8N48

-MSN4C

-MSNS

-MSN5A 10OOO -MgSN-14

-MSNd6A-14

- MSNOB-14-7 IMSNSC

~ivY~4 -

-MSNBD

-MSNGE 0.0 1000 200.0 300.0 400.0 5000 600.0 7000 800.0 900.0 10000 TransientTime (sec)

Figure 4: Core Inlet Flow Boundary Condition 580.0 570.0 560.0 E 550.0

~540.0 L,4

.2 C 520.0 510.0 500.0 490.0 0.0 1000.0 2000.0 3000.0 4000.0 5000.0 6000.0 7000.0 8000.0 TransientTime (sec)

Figure 5: Core Inlet Enthalpy Boundary Conditions

Attachment I to ET 13-0035 Page 32 of 64 Axial and radial power profiles are specific to WCGS. These include axial profiles at beginning-of-cycle (BOC) (0.0 GWD/MTU), middle-of-cycle (MOC) (0.150 GWD/MTU), and end-of-cycle (EOC) (23.018 GWD/MTU), and radial power profiles at various burn up steps on both an assembly basis and 1/4 assembly basis. Both were used in the MDNBR analyses.

Results VIPRE-01 transient MDNBR analyses were run for all 24 RETRAN-3D control room fire scenarios. In all cases, MNDBR occurs near the start of the transient before or within 1.0 sec of the reactor trip. The power reduces quickly following reactor trip and the calculated MDNBR increase significantly. Thus, MDNBR is close to the MDNBR for standard steady-state operating conditions.

The initial VIPRE-01 calculations were performed with the EOC axial power profile and the assembly based radial power profile with the highest powered assembly, 8000 MWD/MTU. Each RETRAN-3D fire protection scenario from Evaluation SA-08-006 was assigned a case number as shown in Table 8. The MDNBR results are plotted versus case number in Figure 6. The MDNBR was taken from the VIPRE-01 CHF summary file (CHFDMP) for each CHF correlation. The EPRI-1 CHF correlation resulted in the most conservative results. The calculated MDNBR of 1.65 occurred for Cases 1-4 at 2.0 seconds.

Fuel centerline temperatures for Case 1 are shown in Figure 7. The temperatures are shown for the limiting rod with the MDNBR. Several transient times are represented; 0.0 for initial conditions, 2.0 when MDNBR occurs, and later in the transient. The VIPRE-01 calculations were made with a conservative gap conductance value (900 Btu/hr-ft2-F), thus the temperatures at the initial conditions are conservatively high. The fuel centerline temperatures remain below the value at steady-state operating conditions for the duration of the transient.

Some of the transients did not converge later in the transient. This problem was not pursued because MDNBR occurs early in the transient while power is still significant. VIPRE-01 is known to have convergence issues when the buoyancy forces are large as compared to the momentum driven forces. This occurs in these transients later, once the pumps coast down. All MDNBR values are calculated from a converged solution.

Table 8 - Correlation of Evaluation SA-08-006 Scenarios to VIPRE-01 Case Numbers Scenario Case Case Name Scenario Case Case Name 1 1 msnl-3 4 13 msn4-14 1A 2 msnla 4A 14 msn4a-14 1B 3 msnlb 4B 15 msn4b IC 4 msnlc 4C 16 msn4c 2 5 msn2-porv3l4 5 17 msn5 2A 6 msn2a-porv3l4 5A 18 msn5a 2B 7 msn2b 6 19 msn6-14 2C 8 msn2c 6A 20 msn6a-14 3 9 msn3 6B 21 msn6b-14-7 3A 10 msn3a 6C 22 msn6c 3B 11 msn3b 6D 23 msn6d 3C 12 msn3c 6E 24 msn6e

Attachment I to ET 13-0035 Page 33 of 64 6ý0 XXX XX X XXX XXX XXX XXX X X XX XX 5.0 4.0 A A A A A A A A A A A A A A A A A A A A A A A A z 3.0 2.0 1.0

EPR w-3S ABAW2 XMACB X8SWR 0 5 10 15 20 25 Translent Case Number Figure 6: MDNBR at EOC Axial and 8000 MWDIMTU Radial 3000 2500 2000 1500 1000 500 0 20 40 60 80 100 120 140 160 Axial Elevation (in)

Figure 7 - Fuel Centerline Temperatures for Limiting Case I

Attachment I to ET 13-0035 Page 34 of 64 Additional calculations were run with the BOC axial power profile (Figure 8) and MOC axial power profile (Figure 9) to confirm that the EOC profile is the most conservative. All the results are compared in Figure 10. The EOC profile resulted in slightly lower MDNBR than BOC and MOC.

6 XXX X XXX X XXX XXX XXX X XXX XX 5

4 A A A A A A A A A A AA A A A 0 A A A

A **

Z3-

0"U *W-3S A SAW2 XRM~C I SOWR F 01 0 S 10 15 20 25 Transient Case Number Figure 8: MDNBR at BOC Axial and 8000 MWD/MTU Radial

Attachment I to ET 13-0035 Page 35 of 64 6

XX XX XXX X XXX XXX XXX X XXX XX 5

A A A A A A A A A A A A A A A A A A A A A A A 2

EU *W-3S ASAW2 XMAcS X8OWR 0

0 5 10 15 20 25 Transient Case Number Figure 9: MDNBR at MOC Axial and 8000 MWD/MTU Radial

- -' - -- - - - - X -

X XX X X XX X X A A ii A A A A Ai 23

DBOC-EN 0I DOC-W-3S A SOC-AAW2 XSOC-MACB XBO4YV O MOC-EPM + MOIC-W-3S -P/MOC-&AW2

O-AM4ACM #POC-ORN/

EOC-EPN A EOC-W-3S EOC-BAW2 I BDC-MACB EOC-9OWR 0

0 5 10 15 20 25 Transient Case Number Figure 10: MDNBR at EOC, MOC, EOC Axial and 8000 MWDIMTU Radial

Attachment I to ET 13-0035 Page 36 of 64 The calculation results above used power profiles based on assembly average power factors while the VIPRE-01 model uses 1/4 assembly channels. To account for 1/4 assembly power gradients, additional calculations were performed with 1/4 assembly based radial power factors.

The EOC axial profile was used for these calculations. Results using the EPRI CHF correlation are shown in Figure 11. The calculated minimum DNB ratio of 1.67 occurred for Cases 1-4 at 1.0 second. This is slightly less conservative than the MDNBR calculated with the assembly-based radial power profile (MDNBR = 1.65).

1.75 1.74 A A A A A A A A A A A A A A 1.73 1.72 1.72 . 9 9 9 9 9 9 9 9 1.71 W 1.7 0!

z I A EPRI- 1/4 Assembly Bised Rsdlel Profile

EPRI- Assembly Based Radile Profile 1.69 1.68 A A A A A 1.67 A A A A 1.66 1.65 *

1.64 0 10 15 20 25 Transient Case Number Figure 11: Comparison of Radial Profiles with EPRI-1 Correlation To confirm that the MDNBR occurs with the 8000 MWD/MTU radial power profile used for the previous calculations, transient msn3a (Case 9) was run with all the available burn up radial profiles (1/4 assembly based) shown in Table 9. The results for these cases, using the EPRI-1 CHF correlation, are shown in Figure 12. The MDNBR occurs with 8000 MWD/MTU Case 12 (equally 7000 MWD/MTU, Case 11), thus confirming that the 8000 MWD/MTU radial power profile produces the most conservative results.

Attachment I to ET 13-0035 Page 37 of 64 Table 9 - Radial Power Profile Case Number vs. MWDIMTU (Figure 12)

Radial MWD/MTU Radial MWD/MTU Power Power Case Case 3 0.0 12 8000 4 150 13 10000 5 1000 14 12000 6 2000 15 14000 7 3000 16 16000 8 4000 17 18000 9 5000 18 20000 10 6000 19 22000 11 7000 20 22897 1.75 1.74

1.73 1.72 1.71 zn 1.7 1.69 1.68 1.67 1.66 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 Radial Power Case Number Figure 12: MDNBR for Different Burn-up Steps with EPRI-1 Correlation

Attachment I to ET 13-0035 Page 38 of 64 Summary of VIPRE-01 Minimum Departure from Nucleate Boiling Ratio Analyses Boundary conditions from the 24 RETRAN-3D Evaluation SA-08-006 scenarios were used to run VIPRE-01 MDNBR calculations to ensure that the fuel integrity is maintained. Additional sensitivity calculations were performed to ensure that the most conservative axial and radial power profiles were used in the analyses.

Results showed that the MDNBR occurs at full power or just after RCS reactor trip which occurs near the initiation of each transient. Thus, MDNBR is close to the value at steady-state operating conditions and the fuel integrity is maintained. Also, the fuel centerline temperature remains below the value at steady-state operating conditions for the duration of the transient. The MDNBR calculated was 1.65 with the EPRI-1 CHF correlation.

3.7.2 Reactor Coolant Pump Seal Leakage Model WCNOC recently replaced the number one seal insert with the second generation Westinghouse SHIELD Passive Thermal Shutdown Seal (SDS) on all four reactor coolant pumps (RCPs). The SDS is designed to restrict RCS leakage for plant events that result in a loss of all seal cooling.

No credit is taken in the WCGS PFSSD analysis (Calculation XX-E-103) for the reduced leakage rates from the new seal following a loss of all seal cooling. The PFSSD analysis use the leakage rates from the previous seal design, which are conservative compared to the new seal design.

Evaluation SA-08-006 uses a fixed seal leakage of 3 gpm per pump (12 gpm total) for the first 10 minutes. After 10 minutes, a seal leakage of 21 gpm per pump (84 gpm total) is used. During normal operation, RCP seal leakage is held at approximately 2 gpm per pump (8 gpm total). The use of 3 gpm seal leak off per pump adds conservatism to the evaluation. The assumption that seal leakage remains at the normal leak off rate for the first 10 minutes is based on Westinghouse Technical Bulletin TB-04-22, Revision 1, "Reactor Coolant Pump Seal Performance - Appendix R Compliance and Loss of All Seal Cooling," (Reference 20) which states that during a loss of all seal cooling event, the cool water in the pump annular cavity will maintain the seals cool and prevent increased seal leakage for approximately 13 minutes.

Reducing the time to 10 minutes adds margin and conservatism to the evaluation.

Based on the above discussion, the use of a RCP seal leakage model based on RCS pressure and temperature is not warranted for the WCGS RCS thermal hydraulic response, as the values used in the evaluation are consistent with vendor supplied information for the specific scenarios evaluated.

3.7.3 Sequence of Events Sequence of events for Scenarios 1, 1A, 1C and 3A are shown in the following tables. Only the FWIS is relied on for automatic actuation. A detailed discussion of automatic feedwater isolation is provided in Section 3.6.

Attachment I to ET 13-0035 Page 39 of 64 SCENARIO i SINGLE PRESSURIZER PORV FAILED OPEN WITH A LOSS OF OFF-SITE POWER Time Component/System (seconds) Description of Action Reactor Trip 0 Reactor trip 0 PORV opens PORV Pressurizer 180 PORV closes 0 AFW flow is 0 to all 4 SGs

SG A Flow remains at 0

SG B Flow from turbine driven AFW pump (TDAFWP) 900 remains at 0

SG C Flow remains at 0 AFW

SG D Flow from B motor driven AFW pump (MDAFWP) controlled at 60 to 62% WR 0 SG A Flow remains at 0 2100 SG B Flow from TDAFWP controlled at 60 to 62% WR

SG C Flow remains at 0

SG D Flow from B MDAFWP controlled at 60 to 62% WR SIS NA Safety injection is blocked for purpose of the evaluation 0 All charging flow stops due to LOOP Charging 1680 Charging flow to all 4 loops available through the BIT. Operator manually throttles flow to maintain pressurizer level on scale.

0 MSIVs are open and bypass valves are closed MSIVs and Bypass Valves 180 All 4 MSIVs close and bypass valves remain closed Steam Dumps 0 Steam dumps are open and remain open throughout the event 0 Main feedwater flow to all 4 SGs is approximately 4,000,000 lb/hr Main feedwater flow goes to 0 lb/hr on a FWIS, which occurs on any one of the following:

Main Feedwater 1 SG water level high-high (78% Narrow Range) 1 SG water level low-low (23 %% Narrow Range)

Low Tavg coincident with reactor trip (P-4) (564 0 F), or

SIS RCPs 0 RCPs trip due to LOOP Turbine 0 Turbine automatically trips in response to reactor trip 0 All heater banks turn off due to LOOP Pressurizer Heaters Backup group B heaters are available if necessary to increase 690 RCS pressure. Total output is 690 kW. Remaining heater banks are unavailable.

Pressurizer spray flow is 0 gpm due to LOOP which stops the Pressurizer Spray 0 RCPs. Spray flow remains at 0 gpm for the duration of the event.

Auxiliary spray flow is 0 gpm due to LOOP which stops the Auxiliary Pressurizer Spray 0 charging pumps. Auxiliary spray flow remains at 0 gpm for the duration of the event because normal charging is isolated by procedure.

0 Letdown flow is 120 gpm Normal Letdown 420 Letdown flow is 0 gpm 0 RCS inventory loss through the RCP seals is 12 gpm (3 gpm per RCP Seal Leak off pump) 600 RCS inventory loss through the RCP seals is 84 gpm (21 gpm per pump) and remains at this value for the duration of the event 0 ARV operates normally to control RCS temperature at 561°F SG A ARV 420 ARV is closed

Attachment I to ET 13-0035 Page 40 of 64 SCENARIO i SINGLE PRESSURIZER PORV FAILED OPEN WITH A LOSS OF OFF-SITE POWER Time ComponentlSystem (seconds) Description of Action 0 ARV operates normally to control RCS temperature at 561°F SG B ARV ARV is controlled by operator action at the Auxiliary Shutdown 420 Panel (ASP) to control RCS temperature between 551°F and 561IF SG CARV 0 ARV operates normally to control RCS temperature at 561 IF 420 ARV is closed 0 ARV operates normally to control RCS temperature at 561°F SG D ARV ARV is controlled by operator action at the ASP to control RCS temperature between 551OF and 561°F SG Blowdown 0 SG blowdown valves remain closed for the duration of the event SCENARIO 1A SINGLE PRESSURIZER PORV FAILED OPEN WITH A LOSS OF OFF-SITE POWER AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN Time ComponentlSystem (seconds) Description of Action Reactor Trip 0 Reactor trip 0 PORV opens PORV Pressurizer 180 PORV closes TDAFWP starts due to undervoltage on NB01/NB02 and injects 0 into all 4 SGs. Flow is limited to 250 gpm per SG due to flow orifices.

A and B MDAFWPs start from the shutdown sequencer and inject 250 gpm to their respective SG. Each AFW flowpath is 42 limited to 300 gpm total due to an automatic throttle valve installed in the MDAFWP supply line. However, because of the LOOP, this valve will not operate properly. So total flow to each SG will be 500 gpm after 42 seconds.

The B MDAFWP is stopped by operator. Flow to A and D SGs 420 reduces to 250 gpm from the TDAFWP. Flow to B and C SGs remains at 500 gpm from the A MDAFWP and TDAFWP.

The TDAFPW is reduced to minimum output by operator at the AFW ASP to prevent overfilling the SGs. The A MDAFWP breaker is opened to stop uncontrolled AFW flow from this pump.

SG A Flow goes to 250 gpm from the B MDAFWP due to 900 valve ALHV0007 failing open 0 SG B Flow reduces to 0 gpm

SG C Flow reduces to 0 gpm

SG D Flow from B MDAFWP controlled at 60 to 62% Wide Range (WR)

Manual valves in the AFW discharge flowpath are closed to direct flow to the credited SGs.

2100 SG A Flow goes to 0 gpm

SG B Flow from the TDAFP controlled at 60 to 62% WR

" SG C Flow remains at 0 gpm

SG D Flow from B MDAFWP controlled at 60 to 62% WR SIS NA Safety injection is blocked for purpose of the evaluation 0 All charging flow stops due to LOOP Charging Charging flow to all 4 loops available through the Boron Injection 1680 Tank (BIT). Operator manually throttles flow to maintain pressurizer level on scale.

MSIVs and Bypass Valves 0 MSIVs are open and bypass valves are closed

Attachment I to ET 13-0035 Page 41 of 64 SCENARIO 1A SINGLE PRESSURIZER PORV FAILED OPEN WITH A LOSS OF OFF-SITE POWER AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN Time Component/System (seconds) Description of Action 180 All 4 MSIVs close and bypass valves remain closed Steam Dumps 0 Steam dumps are open and remain open throughout the event 0 Main feedwater flow to all 4 SGs is approximately 4,000,000 lb/hr Main feedwater flow goes to 0 lb/hr on a FWIS, which occurs on any one of the following:

Main Feedwater 1 SG water level high-high (78% Narrow Range)

SG water level low-low (23 %% Narrow Range)

Low Tavg coincident with reactor trip (P-4) (564 0 F), or

SIS RCPs 0 RCPs trip due to LOOP Turbine 0 Turbine automatically trips in response to reactor trip 0 All heater banks turn off due to LOOP Pressurizer Heaters Backup group B heaters are available if necessary to increase 690 RCS pressure. Total output is 690 kW. Remaining heater banks are unavailable.

Pressurizer spray flow is 0 gpm due to LOOP which stops the Pressurizer Spray 0 RCPs. Spray flow remains at 0 gpm for the duration of the event.

Auxiliary spray flow is 0 gpm due to LOOP which stops the Auxiliary Pressurizer Spray 0 charging pumps. Auxiliary spray flow remains at 0 gpm for the duration of the event because normal charging is isolated by procedure.

0 Letdown flow is 120 gpm Normal Letdown 420 Letdown flow is 0 gpm 0 RCS inventory loss through the RCP seals is 12 gpm (3 gpm per RCP Seal Leak off pump) 600 RCS inventory loss through the RCP seals is 84 gpm (21 gpm per pump) and remains at this value for the duration of the event 0 ARV operates normally to control RCS temperature at 561OF SG A ARV 420 ARV is closed 0 ARV operates normally to control RCS temperature at 561OF SG B ARV ARV is controlled by operator action at the ASP to control RCS temperature between 551OF and 561OF SGCARV 0 ARV operates normally to control RCS temperature at 561OF

.420 ARV is closed 0 ARV operates normally to control RCS temperature at 561OF SG D ARV ARV is controlled by operator action at the ASP to control RCS temperature between 551 °F and 561 OF SG Blowdown 0 SG blowdown valves remain closed for the duration of the event

Attachment I to ET 13-0035 Page 42 of 64 SCENARIO IC SINGLE PRESSURIZER PORV FAILED OPEN WITH A LOSS OF OFF-SITE POWER, SIS ACTUATION AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN ComponentlSystem seconds Description of Action Reactor Trip 0 Reactor trip o PORV opens Pressurizer PORV 180 PORV closes TDAFWP starts due to undervoltage on NB01/NB02 and injects 0 into all 4 SGs. Flow is limited to 250 gpm per SG due to flow orifices.

A and B MDAFWPs start from the shutdown sequencer and inject 250 gpm to their respective SG. Each AFW flowpath is 42 limited to 300 gpm total due to an automatic throttle valve installed in the MDAFWP supply line. However, because of the LOOP, this valve will not operate properly. So total flow to each SG will be 500 gpm after 42 seconds.

The B MDAFWP is stopped by operator. Flow to A and D SGs 420 reduces to 250 gpm from the TDAFWP. Flow to B and C SGs remains at 500 gpm from the A MDAFWP and TDAFWP.

The TDAFWP is reduced to minimum output by operator at the AFW ASP to prevent overfilling the SGs. The A MDAFWP breaker is opened to stop uncontrolled AFW flow from this pump.

9 SG A Flow goes to 250 gpm from the B MDAFWP due to 900 valve ALHV0007 failing open

" SG B Flow reduces to 0 gpm

SG C Flow reduces to 0 gpm

" SG D Flow from B MDAFP controlled at 60 to 62% WR Manual valves in the AFW discharge flowpath are closed to direct flow to the credited SGs.

2100

SG A Flow goes to 0 gpm cnrle t6 o6%W

SG B Flow from the TDAFWP controlled at 60 to 62% WR

SG C Flow remains at 0 gpm

SG D Flow from B MDAFWP controlled at 60 to 62% WR SIS 42 Safety injection operates as designed in response to any SIS 0 Normal charging pump stops due to LOOP 12 LOCA sequencer starts both Centrifugal Charging Pumps Charging (CCPs) in response to SIS 600 Train B CCP is stopped by operator action. Train A CCP continues to operate in response to SIS.

1680 Charging flow through the BIT is controlled MSIVs and Bypass Valves 0 MSIVs are open and bypass valves are closed 180 All 4 MSIVs close and bypass valves remain closed Steam Dumps 0 Steam dumps are open and remain open throughout the event 0 Main feedwater flow to all 4 SGs is approximately 4,000,000 lb/hr Main feedwater flow goes to 0 lb/hr on a FWIS, which occurs on any one of the following:

Main Feedwater 1 SG water level high-high (78% Narrow Range) 15

SG water level low-low (23 %%Narrow Range)

Low Tavg coincident with reactor trip (P-4) (564 0F), or

SIS RCPs 0 RCPs trip due to LOOP Turbine 0 Turbine automatically trips in response to reactor trip Pressurizer Heaters 0 All heater banks turn off due to LOOP

Attachment I to ET 13-0035 Page 43 of 64 SCENARIO IC SINGLE PRESSURIZER PORV FAILED OPEN WITH A LOSS OF OFF-SITE POWER, SIS ACTUATION AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN Time Component/System (seconds) Description of Action Backup group B heaters are available if necessary to increase 690 RCS pressure. Total output is 690 kW. Remaining heater banks are unavailable.

Pressurizer spray flow is 0 gpm due to LOOP which stops the Pressurizer Spray 0 RCPs. Spray flow remains at 0 gpm for the duration of the event.

Auxiliary spray flow is 0 gpm due to LOOP which stops the Auxiliary Pressurizer Spray 0 charging pumps. Auxiliary spray flow remains at 0 gpm for the duration of the event because normal charging is isolated by procedure.

0 Letdown flow is 120 gpm Normal Letdown 420 Letdown flow is 0 gpm 0 RCS inventory loss through the RCP seals is 12 gpm (3 gpm per RCP Seal Leak off 600 pump)

RCS inventory loss through the RCP seals is 84 gpm (21 gpm per pump) and remains at this value for the duration of the event 0 ARV operates normally to control RCS temperature at 561 IF SG AARV 420 ARV is closed 0 ARV operates normally to control RCS temperature at 561OF SG B ARV ARV is controlled by operator action at the ASP to control RCS temperature between 551 IF and 561 IF 0 ARV operates normally to control RCS temperature at 561OF SG C ARV 420 ARV is closed 0 ARV operates normally to control RCS temperature at 561°F SG D ARV ARV is controlled by operator action at the ASP to control RCS temperature between 551F and 561°F SG Blowdown 0 SG blowdown valves remain closed for the duration of the event SCENARIO 3A SINGLE STEAM GENERATOR ARV FAILS OPEN WITH A LOSS OF OFF-SITE POWER AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN Time Component/System (seconds) Description of Action Reactor Trip 0 Reactor trip Pressurizer PORV 0 PORVs remain closed for the duration of the event AFW 0 TDAFWP starts and injects into all 4 SGs. Flow is limited to 250 gpm per SG due to flow orifices.

A and B MDAFWPs start from the shutdown sequencer and inject 250 gpm to their respective SG. Each AFW flowpath is 42 limited to 300 gpm total due to an automatic throttle valve installed in the MDAFWP supply line. However, because of the LOOP, this valve will not operate properly. So total flow to each SG will be 500 gpm after 42 seconds.

The B MDAFWP is stopped by operator. Flow to A and D SGs 420 reduces to 250 gpm from the TDAFWP. Flow to B and C SGs remains at 500 gpm from the A MDAFWP and TDAFWP.

Attachment I to ET 13-0035 Page 44 of 64 SCENARIO 3A SINGLE STEAM GENERATOR ARV FAILS OPEN WITH A LOSS OF OFF-SITE POWER AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN Time ComponentlSystem (seconds) Description of Action The TDAFWP is reduced to minimum output by operator at the ASP to prevent overfilling the SGs. The A MDAFWP breaker is opened to stop uncontrolled AFW flow from this pump.

9 SG A Flow goes to 250 gpm from the B MDAFWP due to 900 valve ALHV0007 failing open

SG B Flow reduces to 0 gpm

SG C Flow reduces to 0 gpm

SG D Flow from B MDAFWP controlled at 60 to 62% WR Manual valves in the AFW discharge flowpath are closed to direct flow to the credited SGs.

2100 SG A Flow goes to 0 gpm

SG B Flow from the TDAFWP controlled at 60 to 62% WR

SG C Flow remains at 0 gpm

SG D Flow from B MDAFWP controlled at 60 to 62% WR SIS NA Safety injection is blocked for purpose of the evaluation 0 All charging flow stops due to LOOP Charging 1680 Charging flow to all 4 loops available through the BIT. Operator manually throttles flow to maintain pressurizer level on scale.

0 MSIVs are open and bypass valves are closed MSIVs and Bypass Valves 180 All 4 MSIVs close and bypass valves remain closed Steam Dumps 0 Steam dumps are open and remain open throughout the event 0 Main feedwater flow to all 4 SGs is approximately 4,000,000 lb/hr Main feedwater flow goes to 0 lb/hr on a FWIS, which occurs on any one of the following:

Main Feedwater 1 SG water level high-high (78% Narrow Range) 15

SG water level low-low (23 %% Narrow Range)

Low Tavg coincident with reactor trip (P-4) (5640 F), or

SIS RCPs 0 RCPs trip due to LOOP Turbine 0 Turbine automatically trips in response to reactor trip 0 All heater banks turn off due to LOOP Pressurizer Heaters Backup group B heaters are available if necessary to increase 690 RCS pressure. Total output is 690 kW. Remaining heater banks are unavailable.

Pressurizer spray flow is 0 gpm due to LOOP which stops the Pressurizer Spray 0 RCPs. Spray flow remains at 0 gpm for the duration of the event.

Auxiliary spray flow is 0 gpm due to LOOP which stops the Auxiliary Pressurizer Spray 0 charging pumps. Auxiliary spray flow remains at 0 gpm for the duration of the event because normal charging is isolated by procedure.

0 Letdown flow is 120 gpm Normal Letdown 420 Letdown flow is 0 gpm 0 RCS inventory loss through the RCP seals is 12 gpm (3 gpm per RCP Seal Leak off pump) o600 RCS inventory loss through the RCP seals is 84 gpm (21 gpm per pump) and remains at this value for the duration of the event.

0 ARV fails full open.

SG AARV 3600 ARV closes.

SG B ARV 0 ARV operates normally to control RCS temperature at 561OF

Attachment I to ET 13-0035 Page 45 of 64 SCENARIO 3A SINGLE STEAM GENERATOR ARV FAILS OPEN WITH A LOSS OF OFF-SITE POWER AND AFW PUMPS AUTO START FOR UNPLANNED COOLDOWN Time Component/System (seconds) Description of Action ARV is controlled by operator action at the ASP to control RCS temperature between 551°F and 561°F SG C ARV 0 ARV operates normally to control RCS temperature at 561 OF 420 ARV is closed 0 ARV operates normally to control RCS temperature at 561°F SG D ARV ARV is controlled by operator action at the ASP to control RCS temperature between 551°F and 561OF SG Blowdown 0 SG blowdown valves remain closed for the duration of the event 3.7.4 Evaluation Assumptions Assumptions used in the Evaluation SA-08-006 are those identified in 10 CFR 50, Appendix R, Section III.L. Specifically, a single spurious operation is assumed concurrent with and without a LOOP. Also, automatic functions are assumed to be disabled except for the FWIS and subsequent closure of the MFIVs and/or MFRVs and MFRV bypass valves. Initial plant conditions are Mode 1, 100% power, normal operating pressure (2235 psi) and normal operating temperature (585 0 F).

3.7.5 Evaluation Instrument Uncertainties Evaluation SA-08-006 was performed using a best-estimate RETRAN 3D model, which uses nominal plant conditions and setpoints. Instrument uncertainties are typically applied when choosing the potentially worse case initial conditions for conservatism when performing USAR Chapter 15 analyses. Evaluation SA-08-006 is not a USAR Chapter 15 analysis, and therefore setpoints are not adjusted to account for instrument uncertainties. A best-estimate model provides a more realistic basis, versus Chapter 15 analyses, for establishing maximum operator response times for control room fire scenarios. WCGS procedure Al 21-017, "Timed Fire Protection Actions Validation," is performed every three years to verify operator manual actions credited for fire scenarios can be performed within the required time. The procedure identifies that a completion time that is less than or equal to 80% of the time sensitive action required time is considered adequate assurance that the time sensitive action can be reliably performed.

Furthermore, the procedure identifies that if the time sensitive action is completed between 80%

and 100% of the required time, consider performing additional validations using other performers or evaluate for a degrading trend in timed operator action completion time and initiate a condition report for tracking. The 80% threshold, in part, accounts for instrument uncertainties.

3.7.6 Evaluation Results The key results of this evaluation are shown in Table 10. Although not an Appendix R requirement, it is noted in Table 10 whether boiling in the RCS occurs. In Scenarios 1, 1A and 1C minimal boiling occurred in the upper core region for a short period. The only transient scenario that does not meet the Appendix R,Section III.L.2 performance goals is Scenario 3A in which, for a brief period, the pressurizer water level is not maintained within level indication.

Scenarios 1, 1A, IC, and 3A are discussed in further detail below.

Attachment I to ET 13-0035 Page 46 of 64 Table 10 - Results of the Transient Scenarios Cold Core Pressurizer Natural Shutdown Remains Level Circulation RCS Boiling Scenario Achieved Covered Maintained Maintained Prevented 1 Yes Yes Yes Yes No 1A Yes Yes Yes Yes No 1B Yes Yes Yes Yes Yes IC Yes Yes Yes Yes No 2 Yes Yes Yes Yes Yes 2A Yes Yes Yes Yes Yes 2C Yes Yes Yes Yes Yes 2D Yes Yes Yes Yes Yes 3 Yes Yes Yes Yes Yes 3A Yes Yes No Yes Yes 3B Yes Yes Yes Yes Yes 3C Yes Yes Yes Yes Yes 4 Yes Yes Yes Yes Yes 4A Yes Yes Yes Yes Yes 4B Yes Yes Yes Yes Yes 4C Yes Yes Yes Yes Yes 5 Yes Yes Yes Yes Yes 5A Yes Yes Yes Yes Yes 6 Yes Yes Yes Yes Yes 6A Yes Yes Yes Yes Yes 68 Yes Yes Yes Yes Yes 6C Yes Yes Yes Yes Yes 6D Yes Yes Yes Yes Yes 6E Yes Yes Yes Yes Yes 3.7.6.1 Scenario 1 Scenario 1 assumes a LOOP with one pressurizer PORV failed open. A reactor trip occurs at time zero when operators press the reactor trip pushbuttons. The MSIVs are closed by manual operation within 180 seconds after reactor trip. Automatic feedwater isolation occurs on low Tavg (5640 F) coincident with reactor trip (P-4). A rapid RCS depressurization occurs due to the reactor trip and the failed open PORV. With the PORV open, a rapid decrease in pressurizer level occurs followed by RCS coolant drawn into the pressurizer creating an increase in pressurizer

Attachment I to ET 13-0035 Page 47 of 64 level. When the PORV is closed at 180 seconds by operator action the RCS begins to repressurize and the pressurizer level decreases. The following figures from Evaluation SA 006 show the pressurizer level and pressure during the Scenario 1 transient.

Scenario 1, Figure 2: Pressurizer Pressure 3000 2500 2000 Throttle CCPs and ARVs 1500 L

1000 Close 9L PORV 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Scenario 1, Figure 3: Pressurizer Level 100 90 80 70

1 60 C

-J C 50 40 a-30 20 10 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

The rapid depressurization of the RCS results in minimal upper core boiling between 160 seconds and 1770 seconds. The maximum void fraction achieved in the upper core is less than 6.6%. All of the voids are collapsed due to cooling and elevation head prior to reaching the top of the SG tubes so natural circulation is maintained.

Attachment I to ET 13-0035 Page 48 of 64 The following figure from Evaluation SA-08-006 shows the upper core void fraction during the Scenario 1 transient.

Scenario 1, Figure 8: Upper Core Void Fraction 1.0 0.9

-Upper Core Volume 0.8 0.7 0.6 LA.

0.5

0.4 0.3 0.2 0.1 0.0 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

The following figures from Evaluation SA-08-006 demonstrate that, during the Scenario 1 transient, the RCS loop flows remain in natural circulation and RCS temperature stabilizes.

Scenario 1, Figure 5: Hot Leg Loop Flow 12000

-Loop A 10000 -

-Loop B

- Loop 8000 C

-Loop D

6000-U.

4000 -

2000 -

0 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Attachment I to ET 13-0035 Attachment I to ET 13-0035 Page 49 of 64 Scenario 1, Figure 4: Core Inlet and Exit Temperature At T=0 PORV Fails Open, -Core Inlet 620 - AFW Off, RCP Trip, MSIV Open - Core Outlet PORV, MSIV Closes 600 U-580 560 540 Starts 520 500 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

After 3000 seconds the RCS pressure, temperature, and pressurizer level have stabilized indicating a safe shutdown condition.

3.7.6.2 Scenario 1A Scenario 1A is similar to Scenario 1 with the exception of the AFW pumps auto start for an unplanned cooldown. With the LOOP, the reactor trip occurs at time zero and the RCPs coast down. Automatic feedwater isolation occurs on low Tavg (5640 F) coincident with reactor trip (P-4).

The MSIVs are closed by manual operation within 180 seconds after reactor trip. A rapid RCS depressurization occurs due to the reactor trip and the failed open PORV. With the PORV open, a rapid decrease in pressurizer level occurs followed by RCS coolant drawn into the pressurizer creating an increase in pressurizer level. When the PORV is closed at 180 seconds by operator action the RCS begins to repressurize and the pressurizer level decreases.

Attachment I to ET 13-0035 Page 50 of 64 The following figures from Evaluation SA-08-006 show the pressurizer level and pressure during the Scenario 1A transient.

Scenario 1A, Figure 2: Pressurizer Pressure 3000 2500 i 2000 J 1500 I 1000 500 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Scenario 1A, Figure 3: Pressurizer Level I

1200 2400 3600 4800 6000 7200 Transient Time (sec)

The rapid depressurization of the RCS results in minimal upper core boiling between 180 seconds and 450 seconds. The maximum void fraction achieved in the upper core is less than 2.35%. All of the voids are collapsed prior to reaching the top of the SG tubes so natural circulation is maintained.

Attachment I to ET 13-0035 Page 51 of 64 The following figure from Evaluation SA-08-006 shows the upper core void fraction during the Scenario 1A transient.

Scenario 1A, Figure 8: Upper Core Void Fraction 1.0 0.9

-Upper Core Volume 0.8 0.7 I 0.6 0.5 0.4 0.3 0.2 0.1 0.0 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

The following figures from Evaluation SA-08-006 demonstrate that, during the Scenario 1A transient, the RCS loop flows remain in natural circulation and RCS temperature stabilizes.

Scenario 1A, Figure 5: Hot Leg Loop Flow 12000

-LoopA 10000

-Loop B

- Loop 8000 c

- Loop D

6000 4000 2000 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Attachment I to ET 13-0035 Page 52 of 64 Scenario 1A, Figure 4: Core Inlet and Exit Temperature At T=0 PORV Opens, 620 AFW On, LOOP

-Core Inlet PORV Closes - Core Outlet 580 TThrottle CCP and ARVs 560-540

,f CCP Initiation Control D SG 520 AFW 500 0 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

After 3000 seconds the RCS pressure, temperature, and pressurizer level have stabilized indicating a safe shutdown condition.

3.7.6.3 Scenario 1C Scenario 1C is similar to Scenario 1A with the exception of the AFW pumps auto start for an unplanned cooldown and safety injection is available if required. With the LOOP, the reactor trip occurs at time zero and the RCPs coast down. The MSIVs are manually closed within 180 seconds of reactor trip. Automatic feedwater isolation occurs on low Tavg (564°F) coincident with reactor trip (P-4). A rapid RCS depressurization occurs due to the reactor trip and the failed open PORV. This is followed by a SIS which initiates the CCPs increasing pressurizer level as shown in Scenario 1C, Figure 3.

Attachment I to ET 13-0035 Page 53 of 64 The following figures from Evaluation SA-08-006 show the pressurizer level and pressure during the Scenario 1C transient.

Scenario 1C, Figure 2: Pressurizer Pressure 3000 2500 I 2000 i 1500 1000 50 500 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Scenario 1C, Figure 3: Pressurizer Level 100 90 80 70 I

60 50 40 30 20 10 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Low RCS pressure after 4800 seconds results in minimal upper core boiling for the period after that time.

Attachment I to ET 13-0035 Page 54 of 64 The maximum void fraction achieved in the upper core is less than 11.2% as shown in the following figure from Evaluation SA-08-006. All of the voids are collapsed prior to reaching the top of the SG tubes.

Scenario 1C, Figure 8: Upper Core Void Fraction 1.0 0.9

-Upper Core Volume 0.8 0.7 I 0.6 0.5 S0.4 0.3 0.2 0.1 0.0 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

The following figures from Evaluation SA-08-006 demonstrate that, during the Scenario 1C transient, the RCS loop flows remain in natural circulation and RCS temperature stabilizes.

Scenario 1C, Figure 5: Hot Leg Loop Flow 12000 10000 8000 6000 4000 2000 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Attachment I to ET 13-0035 Page 55 of 64 Scenario 1C, Figure 4: Core Inlet and Exit Temperature At T=0 PORV Opens, 620 AFW Remains On, SI

-Core Inlet 600 PORV and MSIV -Core Outle Close 560 Throttle CCP 540 520 D SG AFW 500 .

1200 2400 3600 4800 6000 7200 Transient Time (sec)

After 6000 seconds the RCS pressure, temperature, and pressurizer level have stabilized indicating a safe shutdown condition.

3.7.6.4 Scenario 3A Scenario 3A assumes a loss of offsite power with the SG A ARV failed open and closes at 3600 seconds. The AFW pumps auto start. A reactor trip occurs at time zero and automatic feedwater isolation occurs on low Tavg (564°F) coincident with reactor trip (P-4). The MSIVs are manually closed within 180 seconds of reactor trip. The failed open ARV with AFW flow to the SGs result in a RCS cooldown.

The RCS pressure, temperature, and pressurizer water level initially decrease due to the reactor trip followed by a small rise after the MSIVs close increasing SG pressure and cooling capability.

The uncontrolled AFW flow and failed open SG A ARV causes excess SG cooling and these RCS parameters continue to decline. Through the first 2000 seconds, SG A pressure is decreasing and is the primary reason the RCS cools. At 840 seconds pressurizer level goes off scale low and returns on scale at 1780 seconds. To verify no voiding occurred in the RCS hot leg, the water level in the pressurizer surge line was examined. The water level in the surge line reached a minimum height of 67% volume for a short period of time and increases with the initiation of CCP flow. Natural circulation is maintained through this time period and the core remains in a controlled safe shutdown condition.

Attachment I to ET 13-0035 Page 56 of 64 The following figures from Evaluation SA-08-006 show the pressurizer level and pressure during the Scenario 3A transient.

Scenario 3A, Figure 2: Pressurizer Pressure 3000 2500 2000 C 1500 I 1000 500 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Scenario 3A, Figure 3: Pressurizer Level 100 90 80 70 60 I

50 40 30 20 10 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Attachment I to ET 13-0035 Page 57 of 64 The following figures from Evaluation SA-08-006 demonstrate that, during the Scenario 3A transient, the RCS loop flows remain in natural circulation and RCS temperature stabilizes.

Scenario 3A, Figure 5: Hot Leg Loop Flow 12000

- Loop A 10000

-Loop B

- Loop 8000 C

- Loop U. 6000 D

4000 2000 0

0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

Scenario 3A, Figure 4: Core Inlet and Exit Temperature 620 600 580 560 540 520 500 0 1200 2400 3600 4800 6000 7200 Transient Time (sec)

After 4800 seconds the RCS temperature and pressurizer level have stabilized indicating a safe shutdown condition.

Attachment I to ET 13-0035 Page 58 of 64 3.7.7 Summary Based on the control room fire scenarios investigated in Evaluation SA-08-006, Revision 3, the VIPRE-01 MDNBR analysis documented in Calculation WCNOC-CP-003, and the procedural guidance of OFN RP-017 (Reference 4) and OFN RP-017A, "Hot Standby to Cold Shutdown From Outside the Control Room due to a Fire" (Reference 21), the plant will not reach unrecoverable conditions, which could lead to core damage. The pressurizer level remains on scale for all scenarios except Scenario 3A and natural circulation flow is maintained. This demonstrates that safe hot standby and inventory levels can be achieved and maintained using the timing limitations defined in Evaluation SA-08-006. In all cases the reactor core remains cooled and no core damage is indicated, no pressure vessel limits are exceeded, and the reactor reaches a new stable steady-state condition representing safe shutdown.

The results of these transient evaluations are not bounded by the normal loss of AC power transient because of an additional spurious operation (failure) and no automatic actuation of safety components assumptions. These two additional conservative assumptions ensure the transient will be more severe than a loss of normal AC power. In addition, some of the transients have off-site power available and will have much different results than an AC power loss transient. Thus, they cannot be directly compared.

In only two scenarios, small amounts of voiding occur for a short period of time with a LOOP and a failed open PORV. Natural circulation and adequate core cooling is maintained throughout the duration of the transient.

3.8 Conclusions It is acceptable to re-baseline the license basis for shutdown of the plant from outside the control room in the event of a fire in the control room from letter SLNRC 84-0109 referenced in NUREG 0881 Supplement 5 to drawing E-IF9915. The present license basis is a letter that has no documented technical basis for the sequence of operator actions. Drawing E-1F9915 is a comprehensive and documented technical basis for the sequence of operator actions in procedure OFN RF-017.

The RCS thermal hydraulic response evaluation results in Evaluation SA-08-006 and the MDNBR analyses results in Calculation WCNOC-CP-003 demonstrate that the control room shutdown capability meets the Appendix R, III.L.1 criteria with one exception. The RCS process variables are not maintained within those predicted for a loss of normal ac power. Specifically, some voiding is observed in the upper core region in three (Scenarios 1, 1A, and 1C) of the 24 scenarios modeled. However, this is acceptable since the evaluation shows that the plant does not reach unrecoverable conditions.

Evaluation SA-08-006 and Calculation WCNOC-CP-003 also demonstrate that the performance goals of Appendix R,Section III.L.2, are met with one exception. In one analyzed event (Scenario 3A), pressurizer water level falls below the indicated level for a short period of time.

This is acceptable because the evaluation also shows that the core remains covered and the plant does not reach unrecoverable conditions.

Attachment I to ET 13-0035 Page 59 of 64 It is acceptable to credit an automatic FWIS in the event of a fire in the control room. The redundancy and diversity of FWIS initiators in the control room, the physical location of redundant protection cabinets in the control room as well as fire test data associated with control cabinet fires provides reasonable assurance that a single credible fire in the control room will not adversely affect both trains of components necessary to actuate an automatic FWIS.

Based on the above discussion, the proposed changes to the approved fire protection program discussed herein are acceptable as there is reasonable assurance that safe shutdown can be achieved.

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 10 CFR 50, Section 48, Fire Protection, paragraph (a)(1) states, in part: "Each holder of an operating license issued under this part or a combined license issued under part 52 of this chapter must have a fire protection plan that satisfies Criterion 3 of appendix A to this part."

Paragraph (b) states, in part: "Appendix R to this part establishes fire protection features required to satisfy Criterion 3 of appendix A to this part with respect to certain generic issues for nuclear power plants licensed to operate before January 1, 1979."

10 CFR 50, Appendix R, Section III.L.1, states: "Alternative or dedicated shutdown capability provided for a specific fire area shall be able to (a) achieve and maintain subcritical reactivity conditions in the reactor; (b) maintain reactor coolant inventory; (c) achieve and maintain hot standby2 conditions for a PWR (hot shutdown for a BWR); (d) achieve cold shutdown conditions within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; and (e) maintain cold shutdown conditions thereafter. During the postfire shutdown, the reactor coolant system process variables shall be maintained within those predicted for a loss of normal a.c. power, and the fission product boundary integrity shall not be affected; i.e., there shall be no fuel clad damage, rupture of any primary coolant boundary, of rupture of the containment boundary."

10 CFR 50, Appendix R, Section III.L.2, states: "The performance goals for the shutdown functions shall be:

a. The reactivity control function shall be capable of achieving and maintaining cold shutdown reactivity conditions.

b. The reactor coolant makeup function shall be capable of maintaining the reactor coolant level above the top of the core for BWRs and be within the level indication in the pressurizer for PWRs.

c. The reactor heat removal function shall be capable of achieving and maintaining decay heat removal.

d. The process monitoring function shall be capable of providing direct readings of the process variables necessary to perform and control the above functions.

Attachment I to ET 13-0035 Page 60 of 64

e. The supporting functions shall be capable of providing the process cooling, lubrication, etc., necessary to permit the operation of the equipment used for safe shutdown functions."

10 CFR 50, Appendix A, Criterion 3-Fire protection. Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions. Noncombustible and heat resistant materials shall be used wherever practical throughout the unit, particularly in locations such as the containment and control room. Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on structures, systems, and components important to safety. Firefighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems, and components.

4.2 Significant Hazards Consideration The proposed amendment request is requesting Nuclear Regulatory Commission (NRC) approval, pursuant to License Condition 2.C.(5), to make changes to the approved fire protection program as described in the Updated Safety Analysis Report (USAR). The proposed changes to the approved fire protection program are based on the Reactor Coolant System (RCS) thermal hydraulic response (Evaluation SA-08-006) for a postulated control room fire performed for changes to the alternative shutdown methodology outlined in letter SLNRC 84-0109, "Fire Protection Review." Drawing E-1F9915, "Design Basis Document for OFN RP-017, Control Room Evacuation," Revision 5, and Evaluation SA-08-006, "RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire," Revision 3, demonstrate the adequacy of the revised alternative shutdown procedure, OFN RP-017, "Control Room Evacuation." The results of Evaluation SA-08-006 identified required changes to the fire protection program as follows:

Revision to USAR Appendix 9.5B to include incorporation of drawing E-1F9915 as the licensing basis document for alternative shutdown following a control room fire in lieu of letter SLNRC 84-0109.

Revision to Calculation XX-E-013 (Reference 5), Revision 3, "Post-Fire Safe Shutdown (PFSSD) Analysis," Assumption 3-A-4 regarding application of loss of automatic functions, specific to automatic feedwater isolation in the event of a control room fire. Calculation XX-E-013 is incorporated by reference in USAR Appendix 9.5B, "Fire Hazards Analyses."

" Deviation from the 10 CFR 50, Appendix R, Section III.L.1 comparison response, as described in Appendix 9.5E of the WCGS USAR, specific to maintaining RCS process variables within those predicted for a loss of normal AC power.

Deviation from the 10 CFR 50, Appendix R, Section lII.L.2 comparison response, as described in Appendix 9.5E of the WCGS USAR, specific to maintaining pressurizer level on scale.

The proposed changes would revise Paragraph 2.C.(5)(a) of the renewed facility operating license and the fire protection program as described in the USAR.

Attachment I to ET 13-0035 Page 61 of 64 The proposed changes have been determined to adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. Therefore, prior Commission approval is required asSection III.L.1 and Section III.L.2 of Appendix R is not directly satisfied.

WCNOC has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The design function of structures, systems and components (SSCs) are not impacted by the proposed deviations from Appendix R, Sections lII.L.1 and Ill.L.2, and Calculation XX-E-013.

The proposed changes to the approved fire protection program are based on the RCS thermal-hydraulic response (Evaluation SA-08-006) for a postulated control room fire performed for changes to the alternative shutdown methodology outlined in letter SLNRC 84-0109, "Fire Protection Review." Drawing E-1F9915, "Design Basis Document for OFN RP-017, Control Room Evacuation," Revision 5, Evaluation SA-08-006, "RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire,"

Revision 3, and Calculation WCNOC-CP-003, 'VIPRE-01 MDNBR Analyses of Control Room Fire Scenarios," Revision 0 demonstrate the adequacy of the revised alternative shutdown procedure, OFN RF-017. The proposed changes do not alter or prevent the ability of SSCs from performing their intended function to mitigate the consequences of an initiating event within the assumed acceptance limits. Therefore, the probability of any accident previously evaluated is not increased. Equipment required to mitigate an accident remains capable of performing the assumed function.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed changes will not alter the requirement or function for systems required during accident conditions. The design function of structures, systems and components are not impacted by the proposed change. Evaluation SA-08-006 and Calculation WCNOC-CP-003 determined natural circulation is maintained and adequate core cooling is maintained. The fission product boundary integrity is not affected and safe shutdown capability is maintained.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

There will be no effect on the manner in which safety limits or limiting safety system settings are determined nor will there be any effect on those plant systems necessary to assure the

Attachment I to ET 13-0035 Page 62 of 64 accomplishment of protection functions. The revised alternative shutdown methodology provides the ability to achieve and maintain safe shutdown in the event of a fire. Evaluation SA-08-006 and Calculation WCNOC-CP-003 determined natural circulation is maintained and adequate core cooling is maintained.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, WCNOC concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. ENVIRONMENTAL CONSIDERATION WCNOC has evaluated the proposed changes and determined that the changes do not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES

1. SNUPPS letter SLNRC 84-0109, "Fire Protection Review," from N. A. Petrick, SNUPPS, to H. R. Denton, USNRC, August 23, 1984.

2. Drawing E-1F9915, Revision 5, "Design Basis Document for Procedure OFN RP-017, Control Room Evacuation," October 30, 2013.

3. Evaluation SA-08-006, "RETRAN-3D Post-Fire Safe Shutdown (PFSSD) Consequence Evaluation for a Postulated Control Room Fire," Revision 3, October 17, 2012.

4. Procedure OFN RP-017, Revision 41, "Control Room Evacuation," January 11, 2013.

5. Calculation XX-E-013, Revision 3, "Post-Fire Safe Shutdown (PFSSD) Analysis," July 22, 2013.

6. NRC letter, "Wolf Creek Generating Station - NRC Triennial Fire Protection Inspection Report (05000482/2011007)," December 27, 2011. ADAMS Accession No. ML11361A427.

Attachment I to ET 13-0035 Page 63 of 64

7. NUREG 0881, "Safety Evaluation Report related to the operation of Wolf Creek Generating Station, Unit No. 1," April 1982.

8. NRC letter, "Wolf Creek Generation Station - NRC Integrated Inspection Report 05000482/2009004," November 10, 2009. ADAMS Accession No. ML093140803.

9. WCNOC letter ET 10-0026, "License Amendment Request (LAR) for Deviation from Fire Protection Requirements - Reactor Coolant System Subcooling During Alternative Shutdown," September 22, 2010. ADAMS Accession No. ML102720417.

10. WCNOC letter ET 10-0031, "Response to Supplemental Information Request for License Amendment Request Deviation from Fire Protection Requirements - Reactor Coolant System Subcooling During Alternative Shutdown (TAC NO. ME4757)," November 22, 2010.

ADAMS Accession No. ML103340290.

11. NRC letter from J. R. Hall, USNRC, to M. W. Sunseri, WCNOC, "Wolf Creek Generating Station - Request for Additional Information Regarding License Amendment Request to Revise the Fire Protection Program (TAC NO. ME4757)," May 24, 2011. ADAMS Accession No. ML111380215.

12. WCNOC letter ET 11-0005, "Withdrawal of License Amendment Request to Revise the Fire Protection Program (TAC NO. ME4757)," June 30, 2011. ADAMS Accession No. ML11188A074.

13. WCNOC letter ET 12-0033, "License Amendment Request (LAR) for Deviation from Fire Protection Requirements," December 20, 2012. ADAMS Accession No. ML13002A146.

14. WCNOC letter ET 13-0004, "Withdraw of License Amendment Request for Deviation from Fire Protection Requirements," February 5, 2013. ADAMS Accession No. ML13050A039.

15. NRC letter from Carl F. Lyon, USNRC, to M. W. Sunseri, WCNOC, "Wolf Creek Generating Station - Withdraw of License Amendment Request Re: Deviation from Fire Protection Requirements (TAC NO. MF0427)," February 25, 2013. ADAMS Accession No. ML13039A064.

16. NUREG 0881, "Safety Evaluation Report related to the operation of Wolf Creek Generating Station, Unit No. 1," Supplement No. 5, March 1985.

17. NUREG/CR-4527, "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Control Cabinets: Part 1: Cabinet Effects Tests," April 1987.

18. NRC letter from W. D. Reckley, USNRC, to N. S. Cams, WCNOC, "Wolf Creek Nuclear Operating Corporation - Transient Analysis Methodology for the Wolf Creek Generating Station (TAC NO. M79740)," September 30, 1993.

19. NRC letter from Stuart Richards, NRC, to Gary Vine, EPRI, "Safety Evaluation Report on EPRI Topical Report NP-7450(P), Revision 4, "RETRAN-3D - A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems" (TAC No. MA431 1)," January 25, 2001.

Attachment I to ET 13-0035 Page 64 of 64

20. TB-04-22, Revision 1, "Reactor Coolant Pump Seal Performance - Appendix R Compliance and Loss of All Seal Cooling," August 9, 2005.

21. Procedure OFN RP-017A, Revision 5, "Hot Standby to Cold Shutdown From Outside the Control Room due to a Fire," June 6, 2012.

22. C. W. Stewart et al, "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores," Revision 4.3, NP-2511-CCM-A, Research Project 1584-1, February 2011.

23. Calculation WCNOC-CP-003, Revision 0, "VIPRE-01 MDNBR Analyses of Control Room Fire Scenarios," October 1, 2013.

24. Calculation AN- 2-003, "Cycle 20 AOA Risk Assessment," Revision 0, October 2, 1012.

25. NUREG/CR-4596, "Screening Tests of Representative Nuclear Power Plant Components Exposed to Secondary Environments Created by Fires," June 1986.

Attachment II to ET 13-0035 Page 1 of 2 Markup of Renewed Facility Operating License

Attachment II to ET 13-0035 Page 2 of 2 5

(5) Fire Protection (Section 9.5.1, SER, Section 9.5.1.8. SSER #5)

(a) The Operating Corporation shall maintain in effect all provisions of the approved fire protection program as described in the SNUPPs SAmendment No. 189,Final Safety Analysis Report for the facility through Revision 17, site addendum through Revision 15, as approved in the SER through Suppem ,Amendment No. 191, Amendment No. 193, eaMd Amendment No. 2 subject to N. XXprovisions andAmedmet b and c below.

(b) The licensee may make changes to the approved fire protection program without prior approval of the Commission only ifthose changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(c) Deleted.

(6) Qualification of Personnel (Section 13.1.2. SSER #5, Section 18, SSER Deleted per Amendment No. 141.

(7) NUREG-0737 Supolement 1 Conditions (Section 22. SER)

Deleted per Amendment No. 141.

(8) Post-Fuel-Loading Initial Test Program (Section 14, SER Section 14, SSER #5)

Deleted per Amendment No. 141.

(9) Inservice Inspection Program (Sections 5.2.4 and 6.6. SER)

Deleted per Amendment No. 141.

(10) Emergency Planning Deleted per Amendment No. 141.

(11) Steam Generator Tube Rupture (Section 15.4.4. SSER #5)

Deleted per Amendment No. 141.

(12) LOCA Reanalysis (Section 15.3.7. SSER #5)

Deleted per Amendment No. 141.

Renewed License No. NPF-42 Amendment No. 205

Attachment III to ET 13-0035 Page 1 of 5 Markup of USAR Pages

Attachment III to ET 13-0035 Page 2 of 5 WOLF CREEK APPENDIX 9.5B FIRE HAZARDS ANALYSES The USAR FHA has been superseded by the following documents:

" E-1F9905, Fire Hazard Analysis.

E-IF9900, Post-Fire Safe Shutdown Manual Actions.

E-lF9910, Post-Fire Safe Shutdown Fire Area Analysis.

XX-E-013, Post-Fire Safe Shutdown (PFSSD) Analysis.

" M-663-00017A, Fire Protection Evaluations for Unique or Unbounded Fire Barrier Configurations.

The above documents are incorporated by Reference within 9.5B-0 Rev. 19

Attachment III to ET 13-0035 Page 3 of 5 '30 OHMAGGSTMHIIS

ýPAGGE WOLF CREEK 'yFOR INFORMATION ONLY TABLE 9.5E-1 (Sheet 25) 10CFR50 Appendix R WCGS covered by any complete shift personnel complement. These duties include command control of the brigade, transporting fire suppression and support equipment to the fire scenes, applying the extinguishant to the fire, communication with the control room, and coordin-ation with outside fire departments.

g. Potential radiological and toxic hazards in fire zones.

h. Ventilation system operation that ensures desired plant air distribution when the ventilation flow is modified for fire con-tainment or smoke clearing operations.

i. Operations requiring con-trol room and shift engineer coordination or authorization.

j. Instructions for plant operators and general plant personnel during fire.

III. L. Alternative and Dedicated Shutdown Capability

1. Alternative or dedicated An auxiliary shutdown shutdown capability provided panel, described in for a specific fire area shall Section 7.4, in conjunction be able to (a) achieve and with certain local maintain subcritical reac- controls, provides a means tivity conditions in the of achieving and maintaining reactor, (b) maintain hot standby in the event reactor coolant inventory that the main control room (c) achieve and maintain is uninhabitable.

hot standby"7 conditions Rev. 23

Attachment III to ET 13-0035 Page 4 of 5 WOLF CREEK TABLE 9.5E-1 (Sheet 26) 10CFR50 Appendix R WCGS for PWR (hot shutdowný') for The auxiliary shutdown a BWR); (d) achieve cold panel contains the con-shutdown conditions within trols and indication 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; and (e) maintain necessary to maintain cold shutdown conditions reactor coolant system thereafter. During the inventory, remove decay postfire shutdown, the heat, and provide the reactor coolant system required boration for process variables shall hot standby. Adequate be maintained within operations shift staffing those predicted for loss is provided to achieve and of normal ac power and maintain post-fire safe shut-the fission product down "Hot Standby Conditions" boundary integrity shall in the event of a fire.

not be affected i.e., Cold shutdown can be there shall be no fuel achieved and maintained clad damage, rupture of from outside the control any primary coolant room by additional manual boundary, or rupture operator action at local of the containment control sites.

boundary.

The auxiliary shutdown

2. The performance goals for panel is included in the shutdown functions shall the fire hazards anal-be: ysis, Appendix 9.5B.

a. The reactivity control function shall be capable of /

reactor process variables within those predicted for a loss of normal ac power. This is acceptable, as long as a control room fire will not result in the plant reaching an unrecoverable conditions, which could lead to core damage. The criteria for "not reaching an unrecoverable condition" are that 1) natural circulation is maintained, and 2) adequate core cooling is maintained.

7 - As defined in the Standard Technical Specifications.

Rev. 23

Attachment III to ET 13-0035 Page 5 of 5 WOLF CREEK TABLE 9.5E-1 (Sheet 27) 10CFR50 Appendix R

b. The reactor coolant In general, the performance goals of makeup function shall be III.L.2 are satisfied except that in capable of maintaining the some cases pressurizer water level reactor coolant level above is not maintained within level the top of the core for BWRs indication. This is acceptable as and be within the level long as an evaluation demonstrates that indication in the pressur- unrecoverable conditions are not reached.

izers for PWRs.

c. The reactor heat removal function shall be capable of achieving and maintaining decay heat removal.

d. The process monitoring function shall be capable of providing direct readings of the process variables necessary to perform and control the above functions.

e. The supporting functions shall be capable of providing the process cooling, lubri-cation, etc., necessary to permit the operation of the equipment used for safe shutdown functions.

3. The shutdown capability for specific fire areas may be unique for each such area or it may be one unique combination Rev. 0

Attachment IVto ET 13-0035 Page 1 of 2

.Markup of Calculation XX-E-013

Attachment IVto ET 13-0035 Page 2 of 2 FORM APF 05D-001-01, REV. 09 CALCULATION NO. XX-E- 013 CALCULATION SHEET REVISION NO. 3 Page 16 3-A-3 Design basis fires are not assumed to occur concurrently with non-fire related failures in safety systems, plant accidents, or the most severe natural phenomena.

Basis: NRC Generic Letter 86-10, Response to Question 7.2; NUREG 0800, Section 9.5-1, Rev. 3, ic RaC nr ic L 86.1...... t

.......... i ...

"u...........o I ; 0 0..2, .P.rr.p Ma 11383.3.....1.., Ra 1..1.88, Doe. 2, Section". a p.m..

1, Except for an automatic feedwater isolation signal (FWIS), a fire in areas requiring alternative

( Exeshutdown capability (i.e., control room) is assumed to cause a loss of automatic function of valves and pumps with control circuits that could be affected by a control room fire. For example, in the event of a loss of offsite power the emergency diesel generators will normally start automatically on undervoltage. However, in developing the alternative shutdown strategy, capability of this automatic feature to operate is not assumed. In the case of an automatic FWIS it is assumed that a FWIS is unaffected by a fire in the control room and that the FWIS will automatically close the main feedwater isolation valves and/or the main feedwater regulating valves (MFRVs) and MFRV bypass valves.

Basis: NRC Generic Letter 86-10, Response to Question 3.8.4; NEI 00-01, Rev. 2, Paragraph 3.3.1.1.4.1; License Amendment XXX (amendment number to be incorporated based on NRC pp oval of this ap lication 3-A-5 For fire areas not requiring an alternative shutdown capability, automatic operation of components and logic circuits is credited in the analysis only where the control circuits associated with the automatic operation are known to be unaffected by the postulated fire (i.e., III.G.2 separation requirements are satisfied).

Basis: 10 CFR 50, Appendix R, Specific Requirements Sections III.G.1 and III.G.2; NEI 00-01, Rev. 2, Paragraphs 3.1.1.10 and 3.3.1.1.4.1.

3-A-6 Off-site power may or may not be available. The maximum duration of any loss of offsite power event is assumed to be 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Basis: 10 CFR 50, Appendix R, Section III.L.3; NUREG 0800, Section 9.5-1, Rev. 3, paragraph C.l.b.

3-A-7 Loss of offsite power has been specifically evaluated for every fire area to demonstrate where a LOOP may occur as a result of a fire. For alternate shutdown, a LOOP is considered as a simultaneous event.

(Appendix 2 identifies fire areas where a fire may cause a LOOP)

Basis: 10 CFR 50, Appendix R, Section III.L.3; NUREG 0800 Position C5.c.(3); NEI 00-01, Rev. 2 paragraph 3.1.1.7.

3-A-8 Failure of onsite power supplies is not assumed unless it is caused as a direct consequence of a fire.

Basis: 10 CFR 50, Appendix R, Section III.L.3; NUREG 0800 Position C5.c.(4); NEI 00-01, Rev. 2, Paragraph 3.1.1.7.

Attachment VII to ET 13-0035 Page 1 of 6 Response to NRC Identified Information Deficiencies

Attachment VII to ET 13-0035 Page 2 of 6 Response to NRC Identified Information Deficiencies Specific Information Deficiency Response

1. In general, the submittal lacks sufficient discussion of the plant's defense-in- See Attachment I, Sections 3.4, 3.5, and 3.6 depth for fire protection, including a discussion of the accident scenario prior to dependence on the thermal-hydraulic analysis; the fire detection and suppression measures for the impacted areas; the information regarding postulated fire scenarios, ignition sources, and location of important circuits affected by the fire; and a discussion of the time line of a potential scenario that would result in entry into procedure OFN-RP-017. In addition, the assumptions concerning unaffected equipment lack sufficient detail (e.g., see submittal Appendix V, which shows a diagram of the control room and states that, since the cabinets are physically separated, the remaining trains of the solid state protection system (SSPS) would be unaffected. This only addresses the cabinets and does not address whether the cables involved in SSPS would be affected.). More specifically, the submittal lacks:

a. A description of the postulated fire scenarios, ignition sources, fuel loading, and target cables (e.g., such as those that would open power-operated relief valves (PORVs), inhibit block valves from closing, controlling centrifugal charging pumps, cause loss of offsite power). The NRC staff noted that a limited discussion of the bounding fire testing per NUREG/CR-4527, "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Control Cabinets: Part 1: Cabinet Effects Tests," April1987 (ADAMS Accession No. ML060590316), was included in the licensee's submittal, but it was not specific to the plant configuration.

b. A discussion of alternatives if defense-in-depth does not prevent the The Wolf Creek Generating Station (WCGS) control room transient. The NRC staff recommends that the licensee refer to recent NRC fire area is an alternative shutdown area and the alternative exemptions (e.g., see the March 2010 exemption for James A. FitzPatrick outlined in 10 CFR 50, Appendix R, Section III.G.3 was Nuclear Power Plant available at ADAMS Accession No. ML100340670) used for this area. The James A. FitzPatrick Nuclear Power which provide a defense-in-depth analysis. In the licensee's submittal, the Plant exemption is specific to a Section III.G.2 fire area and alternative appears to be reliance on manual actions to prevent does not apply to the WCGS license amendment request.

unrecoverable conditions, even if they are outside of 10 CFR Part 50, For a fire in the control room, defense-in-depth is not Appendix R assumptions. credited because the assumptions in Appendix R,Section III.L require consideration of loss of off-site power and loss of automatic functions, along with a single spurious actuation. This item also indicates that the alternative appears to be reliance on manual actions, even ifthey are outside of 10 CFR Part 50, Appendix R assumptions. The

Attachment VII to ET 13-0035 Page 3 of 6 Specific Information Deficiency Response alternative shutdown requirements in Appendix R,Section III.G.3 allow the use of operator manual actions.

2. The revised Assumption 3-A-4 removes the discussion of the loss of offsite See Attachment I, Section 2.3. Discussion of the loss of power and automatic starting of the emergency diesel generators. It is unclear offsite power and automatic starting of the emergency why the discussion of loss of offsite power is being removed from the diesel generators is retained.

assumption.

3. No loss of the automatic function of the feedwater isolation signal is assumed, See Attachment I, Section 3.6.

based on cabinet separation.

a. A diagram and discussion (submittal page 11 of 34) focuses on cabinet separation, but does not provide cable routing information or a justification of why cable routing is not important. The reference to Regulatory Guide 1.75, Revision 2, "Physical Independence of Electric Systems," September 1978 (ADAMS Accession No. ML003740265), is not sufficient, based on the available fire damage information relating to cables.

b. It appears that the only failure mode is assumed to be damage due to heat, See Attachment I, Section 3.6.6.

and there is no discussion of smoke damage in adjacent cabinets (e.g., see the example of smoke damage documented in an NRC letter dated March 12, 2012, to Omaha Public Power District (ADAMS Accession No. ML12072A128)).

4. Accident Scenario 1 (submittal page 17 of 34) describes that a PORV is "stuck Spuriously open is the correct terminology.

open" and is manually closed at 180 seconds.

a. It is unclear whether "stuck open" is the correct terminology or whether "spuriously open" is intended.

b. Table 7.1 (submittal page 58 of 102) describes that the PORV is closed by Step C2 isolates both the + 125 VDC and - 125 VDC from isolating control power. However, ifthe spurious actuation of the PORV is the PORV circuit. The PORVs are non-high low pressure due to a hot short, then the electrical current may be provided by a source interfaces so consideration of multiple proper polarity hot other than the designated control power. In that case, it is unclear how shorts is not required. A single proper polarity hot short will procedure step C2 assures PORV closure, not cause the PORVs to open.

Attachment VII to ET 13-0035 Page 4 of 6 Specific Information Deficiency Response

c. The required time to complete procedure step C2 is 180 seconds. Scenario Operator timing is performed on a three year frequency per time T=0 is tripping the reactor, subsequently followed by control room procedure Al 21-017, "Timed Fire Protection Actions evacuation, plant-wide announcements, implementation of the Emergency Validation," to ensure Step C2 can be completed within 180 Plan, traveling to the emergency locker outside the auxiliary shutdown seconds. In the most recent performance, two operators panel, and the remainder of the procedure. Procedure step C2 appears to were timed with acceptable results.

occur following RP-01 7, step 6.b. If the reactor trip occurs concurrently with the spurious PORV opening, it is unclear that all of the actions leading up to procedure step C2 (OFN-RP-017, steps 1 through 6, and the initial step in Attachment C) can be performed in 180 seconds.

d. In submittal pages 57-59 of 102, procedure step C2 isolates power to close Step C2 is an immediate action step, meaning the the PORV, but step C3 requires the operator to obtain a copy of the operators are required to perform the step from memory.

procedure. It is unclear how step C2 is performed without a procedure.

5. Scenario 3A includes the assumption that the centrifugal charging pumps The train "B" CCP is manually started in procedure OFN (CCPs) are available, but no fire analysis or separation (either cable or cabinet) RP-017 by closing the breaker. Prior to performing this analysis is provided to assure that the CCPs are available for the same fire step, control power is removed from the bus to ensure a scenario where the steam generator (SG) "A" atmospheric relief valve is stuck control room fire does not affect operation of the pump.

open. Therefore, a control room fire that affects one of the steam generator ARVs will not prevent operation of the train "B" CCP. The train "B" CCP is lined up and started within 28 minutes following reactor trip.

6. Use of the RETRAN computer code See Attachment I, Section 3.7.1.

a. The submittal lacks a discussion of the adequacy of the Chexal-Lellouche drift flux model used in RETRAN for calculating mass distributions on the steam generator secondary side and simulating vapor collections in the upper regions of the reactor coolant system (RCS) for conditions of boiling occurrence.

b. The submittal lacks a discussion of the adequacy of the use of RETRAN to See Attachment I, Section 3.7.1.

show that natural recirculation (based on single- or two-phase flow) can be maintained for conditions when boiling occurs.

Attachment VII to ET 13-0035 Page 5 of 6 Specific Information Deficiency Response

7. Acceptance Criteria of the Thermal-Hydraulic Analysis See Attachment I, Section 3.7.1.1.

The licensee used the criterion that the average RCS hot-leg temperature of less than 630 degrees Fahrenheit (OF) to show no fuel damage.

a. The submittal lacks a discussion of the bases of the criterion used to show no core damage discussed above, and explain why the departure-from-nucleate-boiling ratios and fuel rod centerline temperatures are not calculated to ensure the integrity of the fuel and cladding by showing satisfaction of the respective acceptable limits.

b. The submittal lacks a discussion for cases 1, 1A, 1C and 3A of Attachment See Attachment I, Section 3.7.2.

1 to the submittal the reactor coolant pump seal leakage model used in the analysis for conditions with the RCS pressure equal to or greater than 2250 pounds per square inch absolute and the cold-leg temperature equal to or greater than 550 OF. The submittal lacks justification if no reactor coolant pump seal leakage model is considered in the analysis.

8. Sequence of Events. The following information was lacking in the submittal: See Attachment I, Section 3.7.3.

a. (1) A table listing the sequence of events for cases 1, 1A, 1C, and 3A, with specifications of the set points for those events that relied on automatic actuation;

a. (2) A discussion of how instrumentation uncertainties are considered and See Attachment I, Section 3.7.5.

the operator action times for those events that relied on operator actions; and

a. (3) For the operator actions, a description to show why the actions can be Time sensitive operator actions are verified on a periodic achieved within the operator action times. basis to ensure operators can continue to meet the time requirements. The assumed operator actions are consistent with data from these periodic tests. The requirement to perform periodic timing is specified in procedure Al 21-017, "Timed Fire Protection Actions Validation."

b. (1) A list of the assumptions and values of the plant initial conditions used in See Attachment I, Section 3.7.4.

the analyses, and justification that those assumptions and initial conditions are representative of WCGS; and

Attachment VII to ET 13-0035 Page 6 of 6 Specific Information Deficiency Response

b. (2) A discussion of the uncertainties for the initial values of the plant See Attachment I, Section 3.7.5.

parameters used in the analyses, or a discussion showing why the uncertainties are not considered.

Enclosure to ET 13-0035 Drawing E-IF9915, Revision 5, "Design Basis Document for Procedure OFN RP-017, Control Room Evacuation" (227 pages)

APF 05-013-01, REV. 04 E-1F9915 DESIGN BASIS DOCUMENT FOR OFN RP-017, CONTROL ROOM EVACUATION DRAFT MARKUP ASSOCIATED WITH LICENSE AMENDMENT REQUEST (ET 13-0035)

ENGINEERING REVIEW:

DRAFTER:

Digitally signed CHECKER: by Brian R Fox Date:

ENGINEER:

2013.10.29 07:18:07 -05'00' SUPERVISOR:

1. El APPROVED-MFG. MAY PROCEED Z ELECTRONIC APPROVAL

2. [1 NOT APPROVED--RESUBMIT FINAL DOCUMENT/DRAWING-MFG. MAY PROCEED El YES [] NO

3. 0l APPROVED INFORMATION NOT CONTROLLED UNDER DESIGN PROCESS

4. El ACCEPTABLE-MAINTAIN AS RECORD (INFO. ONLY)

5. [E RESTRICTED FOR WOLF CREEK PLANNING ONLY-MFG. MAY PROCEED [] YES Cl NO APPROVAL OF THIS DOCUMENT/DRAWING DOES NOT RELIEVE SUPPLIER/CONTRACTOR FROM FULL COMPLIANCE WITH CONTRACT, SPECIFICATIONS AND/OR PURCHASE ORDER REQUIREMENTS.

COMMENTS: None P.O.#: N/A VENDOR MANUAL: N/A PAGE: N/A

~1 ~- -

CHANGE PACKAGE #: INCORPORATED CHANGE DOCUMENT(S):

012958 WIP-E-1 F9915-004-A-1 014449 DC RELEASED:

WirLF CREEK,ý.ý Kay Lynn Smith SReleased by Document Services.

Release Date:

'NUCLEAR OPERATING CORPORATION 201 3.10.30 08:01:05 -05'00' COMPONENT NUMBER(S)

N/A COMPONENT NUMBERS ARE FOR INITIAL (REV, W01) DATA LINKING ONLY. ADDITIONAL COMPONENT LINKS ARE MADE IN DATABASE ONLY.

Design Basis Document for Procedure OFN RP-017 Page 2 of 102 E 1F9915, Rev. 5 TABLE OF CONTENTS Page 1.0 Purpose .............................................................................................................................................. 3 2.0 Scope and Assum ptions .............................................................................................................. 3 2.1 Scope .............................................................................................................................................. 3 2.2 Assum ptions ................................................................................................................................... 3 3.0 Methodology ....................................................................................................................................... 3 4.0 References ......................................................................................................................................... 4 4.1 W olf Creek Documents ........................................................................................................... 4 4.2 Nuclear Regulatory Com m ission Documents ............................................................................ 6 4.3 Other Documents ............................................................................................................................ 6 5.0 Background ........................................................................................................................................ 6 6.0 Sum m ary of Tim ing Basis ........................................................................................................... 6 6.1 Reactivity Control ............................................................................................................................ 7 6.2 Reactor Coolant Makeup/Inventory Control .............................................................................. 7 6.3 Decay Heat Removal ............................................................................................................. 8 6.4 Process Monitoring ......................................................................................................................... 9 6.5 Support ........................................................................................................................................... 9 7.0 Section-by-Section Review ......................................................................................................... 11 7.1 OFN RP-017, Section 1.0 - Purpose ...................................................................................... 11 7.2 O FN RP-017, Section 2.0 - Sym ptom s or Entry Conditions .................................................... 12 7.3 OFN RP-017, Section 3.0 - References and Com m itm ents .................................................. 12 7.4 Step-by-Step Review .............................................................................................................. 18

of Pages Appendix 1 - O FN RP-017 Credited Com ponent Evaluation ................................................................ 30 Appendix 2 - Control Room Fire Consequence Evaluation for Motor Operated Valves ....................... 37 Appendix 3 - Control Room Multiple Spurious Operation (MSO) Review ............................................. 58

Design Basis Document for Procedure OFN RP-017 Page 3 of 102 E 1F9915, Rev.5 1.0 Purpose The purpose of this document is to provide a technical basis for procedure OFN RP-017, Control Room Evacuation (due to fire) and define the timing basis for each action step within OFN RP-01 7.

2.0 Scope and Assumptions 2.1 Scope This document applies to procedure OFN RP-01 7.

2.2 Assumptions The following assumptions are applied when developing the Wolf Creek strategy for shutting down and maintaining hot standby using procedure OFN RP-017.

2.2.1 Only fire-induced failures are postulated to occur and all equipment is in normal operating state at the time of the fire.

2.2.2 Response Not Obtained (RNO) actions are included as operator aids and exceeds the procedural guidance required by regulation. It is not expected that the RNO actions will be necessary unless the primary action is affected by the fire.

2.2.3 Prior to transfer of control to the Auxiliary Shutdown System only a single spurious actuation is assumed to occur at a time, except in the case of two redundant valves in a high/low pressure interface line. All potential spurious actuations are mitigated/prevented using OFN RP-01 7 but timing is based on the spurious actuations occurring one at a time, or two at a time in the case of high/low pressure interface lines.

2.2.4 The Wolf Creek Fire Protection licensing basis, as described in USAR, Section 9.5.1, requires that a loss of off-site power be assumed in conjunction with a control room fire. However, a loss of offsite power may not be the most conservative assumption for every fire scenario. Therefore, the thermal hydraulic calculations were performed assuming off-site power is available and off-site power is not available to determine the most conservative outcome. The results of the thermal hydraulic calculation are presented in evaluation SA-08-006.

2.2.5 Automatic functions capable of mitigating spurious actuations are assumed to be defeated by damage to cables located in the area associated with the automatic function.

2.2.6 The reactor is tripped prior to evacuation of the control room. This is the only action assumed to work prior to evacuation. Tripping the reactor is considered to be t = 0 seconds for the purpose of timing subsequent steps.

2.2.7 Transfer of control to the alternative or dedicated shutdown system is assumed to occur when all isolation and transfer switches have been manipulated per procedure OFN RP-01 7. These switches are either located at the Auxiliary Shutdown Panel or at the local equipment.

3.0 Methodology The methodology for completing this document is described in this section.

Each section and step within OFN RP-017 was reviewed and a technical basis for the section or step was documented.

Section 1.0 describes the purpose of E-1 F9915. Section 2.0 identifies the scope. Section 4.0 lists the references used to compile E-1 F9915.

Section 5.0 provides background information on OFN RP-017.

Design Basis Document for Procedure OFN RP-017 Page 4 of 102 E 1F9915, Rev.

Section 6.0 is a summary of each PFSSD function and the major equipment associated with the function.

In addition, Section 6.0 summarizes the timing requirement to ensure the function is satisfied per the times justified in Section 7.0.

Section 7.0 provides a technical review of each section in OFN RP-01 7. First, the front-end sections are discussed and a technical basis provided. These front-end sections include the Purpose, Symptoms or Entry Conditions, and References and Commitments.

Next, each Action/Expected Response and Response Not Obtained step within OFN RP-017 is tabulated in Table 7.1. The columns and the information provided in each column are described below.

Step Number - The step number identified in OFN RP-01 7, revision 42.

Step Description - The Step wording taken verbatim from the procedure.

PFSSD Function - This column describes the PFSSD function that is satisfied by performing the Step. Functions are as follows: R - Reactivity Control; M - Reactor Coolant Makeup and Inventory Control; D - Decay Heat Removal; P - Process Monitoring; S - Support. If the step does not satisfy a specific function, then N/A is placed in the column.

Basis - This column provides useful information about the step and why it is included in the procedure.

Required Time to Complete - This column describes the maximum time that the operator has to complete the step to ensure the function supported by the step is satisfied. Completion of a step after the time indicated does not necessarily mean unrecoverable conditions would be reached but it would be beyond that which has been analyzed. Further analysis would be needed to determine the impact of not meeting a time limit identified in this document.

Timing Basis - This column describes the basis for the maximum allowed operator response time given in the previous column. The basis is derived from a number of calculations and evaluations as described in the column.

Control Room Fire Impact - This column describes whether a fire in the control room could cause the component to spuriously operate after the Step and any identified pre-requisite Steps are complete. If yes, then further discussion is provided for why it is acceptable.

Prerequisite Steps - This column identifies the Step(s) that are required to be completed prior to completing the Step. Prerequisites are steps that must be completed before the current step to prevent potential damage to equipment or prevent spurious operation of the equipment after the step is completed and the Operator moves on. A step that restores power to a component is not considered a prerequisite. These pre-requisites are listed to provide reasonable assurance that future procedure changes will not improperly re-order the steps.

4.0 References 4.1 Wolf Creek Documents 4.1.1 Procedure OFN RP-01 7, Revision 42 - Control Room Evacuation 4.1.2 Wolf Creek Operating License NPF-42 4.1.3 Wolf Creek Safety Evaluation Report including Supplements 1 through 5 4.1.4 Wolf Creek Technical Requirements Manual (TRM), Revision 38 4.1.5 SNUPPS Letter SLNRC 84-0109 - Fire Protection Review 4.1.6 Memo from NRC to KG&E dated August 31, 1984 - Minutes of August 22, 1984 Meeting with

Design Basis Document for Procedure OFN RP-017 Page 5 of 102 E I F99915, Rev. 5 Kansas Gas and Electric and Union Electric Company 4.1.7 Calculation XX-E-01 3, Post-Fire Safe Shutdown Analysis 4.1.8 Safety Analysis Evaluation SA-08-006, Rev. 3 - Retran-3D Post-Fire Safe Shutdown (PFSSD)

Consequence Evaluation for a Postulated Control Room Fire 4.1.9 Calculation Change Notice AN-02-10-000 EDG Room Temperature at Various Outside Air Temperatures for the NRC Triennial Fire Protection Inspection 4.1.10 Calculation EF ESW System Flow Requirements 4.1.11 Drawing M-018-000155 - Operation of Diesel Engine without Cooling Water 4.1.12 Drawing J-14001 - Control Room Equipment Arrangement 4.1.13 Drawing E-13EF06A - Schematic Diagram ESW to Ultimate Heat Sink Isolation Valves 4.1.14 Drawing E-025-00007, Sheet 185 - EFHV0038 Design Configuration Document 4.1.15 Document E-1 ONK - Class 1E 125 VDC System Description 4.1.16 Specification M-018 - Standby Diesel Generator 4.1.17 PIR 2005-3314/CR2007-003037 - Issues involving NRC Information Notice 92-18 4.1.18 CR 00012368 -Timing Basis for Re-Establishing Room Cooling 4.1.19 CR 00016481 - Guidance for Control Room Re-Entry After Fire 4.1.20 CR 00019239 - Time to Close Valve BNHV8812A 4.1.21 CR 00019242 - Train B Emergency Diesel Generator Potential Failure to Start 4.1.22 CR 00020612 -Amphenol Connectors for MSIVs cannot be Removed by Hand 4.1.23 CR 00023410 - Issues with the Train B Emergency Diesel Generator Voltage Regulator 4.1.24 CR 00030350 - Post-Fire Safe Shutdown Concern with Train B Diesel Generator Field Flashing 4.1.25 CR 00030376 - Revise E-1 F9915 to Document Time to Establish Diesel Engine Cooling 4.1.26 CR 2008-004708 - Determine Time to Establish Diesel Engine Cooling 4.1.27 CR 00041746 - Spurious Operation of Valve EFHV0060 4.1.28 Calculation KJ-M-01 7, Rev. 0 - Emergency Diesel Standby Generator (KKJ01 B) Runtime Without ESW Flow 4.1.29 CR 00041746 - Potential for EFHV0060 to Open Due to Control Room Fire 4.1.30 CR 00044460 - Add OFN RP-017 Component Evaluation to E-1 F9915 4.1.31 CR 00046634-02 Add MSO Evaluation to E-1 F9915 4.1.32 CR 00046642 - RCP Seal Return Valves 4.1.33 CR 00046702 - Auxiliary Shutdown Panel Controls for B Motor Driven Auxiliary Feedwater Pump 4.1.34 CR 00046707 - Review Reactor Trip Switch Circuits for Alternative Shutdown 4.1.35 CR 00072102 - Operator Time Sensitive Action in OFN RP-01 7 Not Met

Design Basis Document for Procedure OFN RP-017 Page 6 of 102 E 1F99115, Rev'.5 4.2 Nuclear Regulatory Commission Documents 4.2.1 10 CFR 50.48 - Fire Protection 4.2.2 10 CFR 50, Appendix R - Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979 4.2.3 NRC Generic Letter 86 Implementation of Fire Protection Requirements 4.2.4 NRC Information Notice 2005 Fire Protection Findings on Loss of Seal Cooling to Westinghouse Reactor Coolant Pumps 4.2.5 Regulatory Guide 1.189, Rev. 2 - Fire Protection for Nuclear Power Plants 4.3 Other Documents 4.3.1 Westinghouse WCAP-16396-NP, Westinghouse Owners Group Reactor Coolant Pump Seal Performance for Appendix R Assessments.

4.3.2 Westinghouse Technical Bulletin TB-04-22, Rev. 1, Reactor Coolant Pump Seal Performance -

Appendix R Compliance and Loss of All Seal Cooling.

4.3.3 NEI 00-01, Rev. 2 - Guidance for Post-Fire Safe Shutdown Circuit Analysis 4.3.4 Westinghouse Letter LTR-RAM-1-10-053 dated October 15, 2010.

Subject:

White Paper Westinghouse Reactor Coolant Pump Seal Behavior For Fire Scenarios, Revision 2.

4.3.5 Westinghouse WCAP-1 7541 -P, Revision 0 - Implementation Guide for the Westinghouse Reactor Coolant Pump SHIELD Passive Thermal Shutdown Seal, dated March 2012.

5.0 Background The Control Room evacuation and plant shutdown procedure is documented in OFN RP-017 (power operation to hot standby) and OFN RP-01 7A (hot standby to cold shutdown). The original basis for procedure OFN RP-017 is SLNRC 84-0109, which documents a phased approach to shutting down the plant and maintaining it in a safe hot standby condition if control room evacuation is required following a fire. This phased approach was approved by the NRC in Supplement 5 of the Wolf Creek Safety Evaluation Report.

Although SLNRC 84-0109 formed the original licensing basis for hot shutdown from outside the control room at SNUPPS facilities, its basis is not clearly defined nor understood. Some of the step sequences and actions are questionable by today's operational and regulatory standards. Over the years, changes have been made to OFN RP-01 7, which were not in literal compliance with the letter. The changes were subsequently determined to not have an adverse impact on the health and safety of the public. However, because of the confusing nature of the letter, it was decided that a design basis document that clearly describes the basis for OFN RP-01 7 is needed.

License Amendment XXX approved superseding letter SLNRC 84-0109 with document E-1 F9915 as the basis for alternative shutdown in the event of a fire in the control room. Therefore, letter SLNRC 84-0109 is considered historical and is no longer part of the approved fire protection program.

6.0 Summary of Timing Basis This Section includes a summary of the major equipment credited in OFN RP-01 7 for satisfying each PFSSD function (Reactivity Control, Reactor Coolant Makeup and Inventory Control, Decay Heat Removal, Process Monitoring and Support). In addition, operator response timing, to ensure the function is satisfied prior to reaching unrecoverable conditions, is discussed.

Design Basis Document for Procedure OFN RP-017 Page 7 of 102 E IFODIS, Rev. 5 6.1 Reactivity Control Reactivity control is achieved by tripping the reactor prior to leaving the control room. Tripping the reactor is considered to be t = 0 seconds for the OFN RP-01 7 timeline. (Assumption 2.2.6)

The main steam isolation valves (MSIVs) and steam generator (SG) blowdown valves are isolated to prevent return to criticality due to uncontrolled cooldown. The MSIVs are assumed to remain open until action is taken outside the control room within 3 minutes to close them. Prior to evacuating the control room, operators attempt to close the MSIVs using the all-close hand switches, but this action is assumed to fail. In these cases, the steam dumps are assumed to operate properly to control temperature to 557°F, then the steam dumps are isolated within 7 minutes by de-energizing power to the valves, at which time the ARVs are used for temperature control. All components located downstream of the MSIVs are assumed to be unaffected by the fire.

Plant cooldown is controlled using SGs B and D atmospheric relief valves (ARVs) while SGs A and C ARVs are closed. Based on Calculation SA-08-006, a single SG ARV can remain open for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with no adverse impact on safe shutdown. Otherwise, all SG ARVs are assumed to function normally at time 0, controlling pressure less than 1184.7 psia. Steam generators B & D ARVs are assumed to close at 7 min then control as necessary at 561 degrees F after the operator takes manual control of the B & D ARVs from the auxiliary shutdown panel (ASP). Steam generators A & C ARVs are assumed to close at 7 minutes, then stay closed after the operator at the ASP closes them per procedure.

The MSIVs are assumed to remain open until operator action outside the control room closes them, despite operation of the control room all-close hand switches prior to evacuation. In all scenarios the MSIVs are assumed closed in 3 minutes when power is removed from MSFIS cabinet SA075A in Step C2.

The main turbine trips in response to a reactor trip through an interlock from the reactor trip breakers that is unaffected by a fire in the control room. Therefore, steam loss through the turbine is prevented.

The Train B Chemical and Volume Control System (CVCS) is used to provide borated water to the RCS to maintain negative reactivity conditions. This is accomplished using the Train B centrifugal charging pump (CCP) taking suction from the borated refueling water storage tank (RWST) and injecting to the RCS through the boron injection tank (BIT). Calculation SA-08-006 assumes the Train B CVCS is lined up and injecting through the BIT within 28 minutes.

6.2 Reactor Coolant Makeup/inventory Control Reactor coolant makeup and inventory control is achieved by first isolating all potential RCS leakage and inventory reduction paths including pressurizer power operated relief valves (PORVs), normal letdown, excess letdown, reactor vessel head vents, reactor coolant pump seals, MSIVs, steam generator blowdown, steam generator ARVs, and residual heat removal (RHR) suction from the RCS. Leakage through the RHR system is not credible since the RHR pump suction valves are normally closed and de-energized. The reactor coolant pumps (RCPs) are stopped to prevent loss of inventory through the RCP seals.

Based on Calculation SA-08-006, pressurizer PORVs are assumed isolated within 3 minutes and normal letdown is assumed isolated within 7 minutes. Charging flow to the reactor coolant pump seals is assumed to be isolated within 10 minutes. The reactor coolant pumps are assumed to be stopped within 7 minutes. Steam generator ARVs and MSIVs are isolated as discussed in Section 6.1.

Letdown flow is assumed to be isolated within 7 minutes. In all scenarios where letdown is unaffected, initial flow is 120 gpm until isolated. The 120 gpm flow rate is based on normal letdown of 75 gpm plus an additional 45 gpm that could be flowing for Chemistry concerns (this rarely occurs). In the scenarios where letdown valves fail open, letdown flow goes to 195 gpm for 7 minutes, which is the maximum letdown flow. The automatic letdown isolation signal on low pressurizer water level (17%) is assumed to fail.

Design Basis Document for Procedure OFN RP-017 Page 8 of 102 E-1F991 5, Rev. 5 Pressurizer heater backup group B is cycled to maintain pressurizer pressure within 2000 to 2300 psig.

In the loss of off-site power scenarios, Calculation SA-08-006 assumes pressurizer heaters fail to operate at time zero. At 11.5 minutes, backup group B is controlled at the ASP. In the non loss of off-site power scenarios, all three heater groups operate normally but power to backup group B is lost by procedure within 7 minutes. Power is restored within 11.5 minutes and control on backup group B is available from the ASP.

Calculation SA-08-006 assumes the steam generator blowdown valves remain closed in all scenarios. A single failure involving the blowdown valves does not affect PFSSD as demonstrated in Calculation WCNOC-CP-002. Furthermore, open blowdown valves help the SG overfill cases, which would cause the results to be non-conservative. Therefore, modeling of spurious SG blowdown was not performed.

Calculation SA-08-006 assumes the pressurizer and auxiliary pressurizer spray valves operate normally except in those scenarios where the pressurizer spray is assumed to fail. In those scenarios, the pressurizer spray valves are assumed to open at time zero and pressurizer spray stops at 7 minutes when the RCPs are stopped. Auxiliary spray is assumed to operate at time zero and stops in 7 minutes when PK5117 is opened in Step D1.

The Train B CVCS is used for makeup and inventory control by taking suction from the RWST and injecting through the BIT. Calculation SA-08-006 assumes the Train B CVCS is lined up and injecting through the boron injection tank (BIT) within 28 minutes.

A potential concern with inventory control is that a control room fire could cause the number 1 seal return valves (BBHV8141A, B, C and D) to close, which could cause excessive RCS leakage. OFN RP-017 isolates RCP seal cooling, contributing to this event. OFN RP-017 also trips the RCPs, which minimizes the impact of this event.

A white paper prepared by Westinghouse and distributed as letter number LTR-RAM-1-10-053 (Reference 4.3.4) summarizes RCP seal behavior for fire scenarios. This white paper is a compilation of several WCAPs and Technical Bulletins on the subject.

Table 1 in the letter is a scenario matrix that identifies the number 1 and number 2 RCP seal behavior and resultant leakage given RCPs running or not running and seal cooling available or not available. For the scenario postulated here (Number 1 seal return line isolated, RCPs not running and no seal cooling),

the resultant leakage is 21 gpm per seal or 84 gpm total. This leakage is well within the makeup capability of the charging pump, which has a design flow rate of 150 gpm at 2800 psi and a runout flow of 550 gpm at 606 psi. Therefore, this condition does not pose a concern for PFSSD at Wolf Creek.

Wolf Creek has replaced the number one seal insert with the Westinghouse SHIELD Passive Thermal Shutdown Seal (SDS) on all four reactor coolant pumps (RCPs). The SDS is designed to restrict reactor coolant system (RCS) leakage for plant events that result in a loss of all seal cooling (Reference 4.3.5).

No credit is taken in the Wolf Creek post-fire safe shutdown analyses for the reduced leakage rates from the new seal following a loss of all seal cooling. The Wolf Creek analyses use the leakage rates from the previous seal design, which are conservative compared to the new seal design.

6.3 Decay Heat Removal Hot standby decay heat removal is achieved using Train B motor driven auxiliary feedwater pump (MDAFP), taking suction from the condensate storage tank (CST), to supply feedwater to steam generator D and the turbine driven auxiliary feedwater pump (TDAFP), taking suction from the condensate storage tank (CST), to supply feedwater to steam generator B.

Calculation SA-08-006 assumes the Train B MDAFP is lined up and supplying steam generator D within 15 minutes and the TDAFP is lined up and supplying steam generator B within 35 minutes. Steam generators B and D atmospheric relief valves are used to control reactor coolant system (RCS) temperature. When the Train B MDAFP is started in 15 minutes, valve ALVO032 may still be open.

Therefore, approximately 250 gpm will flow from the B MDAFP to the A SG due to failed open valve ALHV0007 until valve ALVO032 is manually closed in Step E4 in 35 minutes. Therefore, the B MDAFP

Design Basis Document for Procedure OFN RP-017 Page 9 of 102 E- F9915, Rev.

could be injecting into the A SG for 20 minutes. SA-08-006, Rev. 3 (Scenario 1A) shows that the A SG reaches 100% WR indication in about 1800 seconds (30 minutes), which occurs prior to closing valve ALVO032. This has no adverse impact since the A SG is not used as a heat sink in OFN RP-017 and steam for the TDAFP turbine is not supplied by the A SG. The MSIVs are closed in 3 minutes, which is prior to the A SG reaching 100% WR, so water will not enter the TDAFP turbine. Steam generators A and C atmospheric relief valves are isolated. See Section 6.1 for discussion about steam generator ARVs.

The reactor is tripped at t = Os when operators actuate the reactor trip push buttons prior to evacuating the control room. The reactor trip causes a low Tavg signal within 5 seconds and initiates a feedwater isolation signal, which stops main feedwater flow and prevents steam generator overfill from main feedwater.

To prevent steam generator overfill in cases where the fire causes a spurious auxiliary feedwater actuation signal (AFAS), the Train A MDAFP is stopped by operator action within 15 minutes. The TDAFP is taken to minimum output within 15 minutes and remains there until valves in the AFW discharge line are closed, which takes 35 minutes. At that point, the TDAFP is started to supply SG B.

Main steam isolation valves are required to be closed for decay heat removal to control cooldown. See Section 6.1 for discussion about MSIVs.

Cold shutdown decay heat removal is not included in OFN RP-017.

6.4 Process Monitoring Process monitoring ensures RCS variables are within specified limits. The ASP contains all the required process monitoring instruments to verify reactivity conditions, pressurizer level, pressurizer pressure, RCS temperature and steam generator level. Source range indicator SEN10061X indicates reactivity level. Pressurizer level is determined by BBLI0460B. Pressurizer pressure is determined using reactor vessel pressure instrument BBPI0406X. RCS temperature is determined using RCS loop 2 cold leg temperature indicator BBTI0423X and loop 4 hot leg temperature indicator BBTI0443A. Steam generator level is determined using steam generators B and D narrow range level indicators AELI0502A and AELI0504A, respectively. These process monitors are unaffected by a fire in the control room.

6.5 Support The post fire safe shutdown support function provides the necessary cooling, ventilation and electrical power required by the reactivity control, reactor makeup, decay heat removal and process monitoring functions. The support function supports all the other post fire safe shutdown functions and includes component cooling water (CCW), essential service water (ESW), room cooling and ventilation, control room isolation and electrical power distribution.

Component cooling water is required for OFN RP-01 7 to supply cooling to the Train B charging pump oil cooler and the seal water heat exchanger. Both of these components support centrifugal charging pump (CCP) operability. Therefore, CCW is required to be operable prior to the need for charging. Based on Calculation SA-08-006, charging needs to be lined up and injecting within 28 minutes.

Essential service water is required to provide cooling to the CCW heat exchanger, emergency diesel engine coolers and various room coolers. In addition, ESW is a backup source of auxiliary feedwater.

Emergency diesel engine cooling is required to maintain the engine jacket water temperature below the trip setpoint of 195*F. The engine is started in Step C6 when the offsite power feeder breakers are opened, which provides an automatic start signal to the engine. Step C8.e closes the Train B emergency diesel generator (EDG) output breaker and step C9 starts the ESW pump. The combined generator loading of the non-shed loads and the ESW pump is 3,615.9 kW per calculation KJ-M-017, which is 58,3% of the EDG rating of 6,201 kW. At this point, service water (SW) crosstie valve EFHV0026 is not closed and it is assumed that the ESW flow is diverted to the SW system. Therefore, no EDG cooling benefit is assumed after the start of the ESW pump. Step C12 closes EFHV0026, at which point EDG cooling can be credited.

Design Basis Document for Procedure OFN RP-017 Page 10 of 102 E-1 F99115, Rev.5 Table 1 in Calculation KJ-M-01 7 identifies the allowable time to establish EDG cooling given various values of unloaded times from 1 minute to 5 minutes in 15 second increments. The table shows that, as the time to complete steps C6 through C8 increases, the time to complete Steps C9 through C12 decreases. For example, if step C8 is completed in 2.5 minutes after step C6, operators have 2.51 minutes to complete Steps C9 through C1 2 and close EFHV0026. However, if the operator takes 3.5 minutes to complete Step C8 after Step C6 is completed, then they only have 2.22 minutes to complete Steps C9 through C1 2 and close EFHV0026. Table 1 from Calculation KJ-M-01 7 follows.

Time Allowable Time Allowable Unloaded Time Loaded Unloaded Time Loaded (Min) (Min) (Min) (Min) 1 2.80 3.25 2.28 1.25 2.75 3.5 2.22 1.5 2.69 3.75 2.12 1.75 2.63 4 1.98 2 2.57 4.25 1.85 2.25 2.51 4.5 1.71 2.5 2.45 4.75 1.58 2.75 2.39 5 1.44 3 2.33 Room coolers and ventilation fans are used to maintain a suitable environment for the equipment within the room to ensure long term operation of the equipment. Room coolers credited in the event of a control room fire are as follows:

1. Train B Class 1E Electrical Equipment Room A/C Unit (SGK05B)

2. Train B Electrical Penetration Room Cooler (SGL15B)

3. Train B Component Cooling Water Pump Room Cooler (SGLI IB)

4. Train B Auxiliary Feedwater Pump Room Cooler (SGF02B)

5. Train B Centrifugal Charging Pump Room Cooler (SGL12B)

6. Train B Containment Coolers (SGN01 B and SGN01 D)

7. Train B ESW Pump Room Supply Fan (CGDO1 B) and Dampers (GDTZ1 1A and GDTZ1 1C)

Procedure SYS GK-200 allows up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to pass after loss of one Train of Class 1E Electrical Equipment Room A/C before compensatory measures are established to restore cooling to the affected Train. For conservatism, this design basis document uses 60 minutes as the requirement to restore Class 1E Electrical Equipment Room A/C.

The timing basis for establishing electrical penetration room cooling is documented in CR 012638. Based on the evaluation in CR 012638, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months should be used as the maximum time to restore cooling to the electrical penetration rooms. This time is based on the Wolf Creek Technical Requirements Manual (TRM), TR 3.7.22-1 which states that operators have 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore room temperatures to within allowable limits given in Table TR 3.7.22-1. (Note that the TRM revision in effect when the CR was evaluated (Revision 35) required equipment to be declared inoperable if temperatures were not restored within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The current revision of the TRM (38) does not require equipment to be declared inoperable). For conservatism, 1-hour is used as the timing basis in E-1F9915. The allowable temperature limit for the electrical penetration rooms is 101 degrees F per Table TR 3.7.22-1. Based on operator timing, the electrical penetration room cooler is started within 13 minutes. Therefore, the time to restore electrical penetration room cooling is well within the 1-hour limit established in E-1 F9915.

The pump room coolers (SGL1 1B, SGF02B and SGL12B) automatically start when the pump starts.

Procedure OFN RP-017 lines up power and ESW flow to the pump room coolers prior to starting the pumps. Therefore, pump room cooling will be provided as soon as each pump starts.

Design Basis Document for Procedure OFN RP-017 Page 11 of 102 E 1F991 5,Rev. 5 The containment coolers maintain containment temperature within acceptable limits but are not directly required for safe shutdown after a fire in the control room. There are no post-fire safe shutdown components in containment that will adversely impact the ability to achieve safe shutdown if the coolers are not started. Therefore, the timing for this step is not critical and, therefore, no time limit has been established.

The timing basis for establishing ESW pump room ventilation is documented in CR 012638. Based on the evaluation in CR 012638, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months should be used as the maximum time to restore cooling to the ESW pump room. This time is based on the Wolf Creek Technical Requirements Manual (TRM), TR 3.7.22-1 which states that operators have 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore room temperatures to within allowable limits given in Table TR 3.7.22-1. (Note that the TRM revision in effect when the CR was evaluated (Revision 35) required equipment to be declared inoperable if temperatures were not restored within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The current revision of the TRM (38) does not require equipment to be declared inoperable). For conservatism, 1-hour is used as the timing basis in E-1 F9915. The allowable temperature limit for the ESW pump rooms is 119 degrees F per Table TR 3.7.22-1. Based on operator timing, the ESW pump room supply fan is started approximately 12 to 15 minutes after the ESW pump is started. In addition, Step A16 directs an available operator to check ESW pump room temperature. Based on operator timing, Step A16 is reached in less than 20 minutes. At this point, the Site Watch, who has no fire brigade or OFN RP-017 duties, could be dispatched to the ESW pumphouse to check room temperatures and make adjustments as necessary per the Step A16 RNO column. Therefore, the time to restore room cooling in the ESW pump room is well within the 1-hour limit established in E-1 F9915.

7.0 Section-by-Section Review 7.1 OFN RP-017, Section 1.0 - Purpose 7.1.1 OFN RP-017, Section 1.1 1.1 To provide operatoractions for evacuating the Control Room due to fire, establishingplant control from the Auxiliary Shutdown Panel (ASP), and reactorshutdown to Hot Standby conditions.

Basis - 10 CFR 50, Appendix R, Section III.L.3 requires procedures to be in effect to implement the alternative and dedicated shutdown capability for any fire area utilizing the provisions in Appendix R,Section III.G.3. Wolf Creek took no exception to this requirement in the Appendix R comparison documented in the USAR, Table 9.5E. Letter SLNRC 84-0109 (August 23, 1984), Section 2.0 Response Plan Summary states, in part, "Procedures will be developed to implement this plan at Callaway and Wolf Creek." The Wolf Creek SER, Supplement 5, Page 9-12 states, in part, "(1) The applicant will revise the procedures for a fire in the control room in accordance with the SNUPPS letter of August 23, 1984 ... "

Therefore, Wolf Creek is committed to maintain in effect procedure OFN RP-01 7 to achieve hot standby conditions. Cold shutdown is achieved from outside the control room using OFN RP-017A.

7.1.2 OFN RP-017, Section 1.2 1.2 This procedure should only be used when the Control Room is uninhabitableand damage to controls or ControlRoom equipment has occurred or is imminent.

Basis - This statement emphasizes that control room evacuation should only take place when control from the control room is lost or will be lost. Shutting down from outside the control room is not desired and evacuation should only be done when the plant cannot be controlled from inside the control room.

7.1.3 OFN RP-017, Section 1.3 1.3 Since the Control Room is uninhabitable,this procedure includes actions to:

Design Basis Document for Procedure OFN RP-017 Page 12 of 102 E-IF9O1, Rev.5

Prevent subsequent fire/physical damage to Control Room circuits from adversely affecting systems needed to maintain Hot Standby

Transfer critical Train B controls to the ASP

Maintain the plant in Hot Standby from the ASP Basis - This step identifies the objectives for OFN RP-017. It clearly states that the procedure is only intended to maintain hot standby from outside the control room using Train B components. Cold shutdown is achieved using procedure OFN RP-01 7A.

7.2 OFN RP-017, Section 2.0 - Symptoms or Entry Conditions Section 2.0 provides conditions in which operators may deem entering OFN RP-017 to be necessary. These entry conditions are not licensing commitments but rather guidance for operators to use when determining the need to enter OFN RP-01 7. The decision is a judgment call made by operating staff with the final decision made by the Shift Manager. Step 1 in the procedure provides additional conditions to be considered prior to evacuating the control room. There are no NRC criteria for establishing the point at which operators evacuate the control room. Therefore, there is no licensing basis for when control room evacuation takes place.

7.3 OFN RP-017, Section 3.0 - References and Commitments 7.3.1 OFN RP-017, Section 3.1 - References

a. Nuclear Safety EngineeringSurveillance Report No. 1991-005 Basis - This surveillance report, designated SSR 91-005, was performed by Wolf Creek Nuclear Safety department and was issued on 4/26/1991. The purpose of the surveillance was to determine the adequacy of 10CFR50.59 screenings on Operations procedures.

OFN 00-017, Control Room Evacuation, Revision 13 was chosen for review. The review concluded that the 50.59 screenings were appropriate but made 12 recommendations for improvement of the procedure. Most of the recommendations were incorporated into revision 14 of OFN 00-017 and some were not with justification. The changes made to OFN 00-017 as a result of this surveillance that are still in effect today in OFN RP-01 7 are listed below:

1. NK41 01 is no longer opened to remove control power from Train A bus NB01 breakers.

The observer stated that by opening the switch, the Train A AFW pump would not be able to be controlled from the ASP. Operations removed the step due to there being no requirement to open the switch. Train A equipment is not required for OFN RP-01 7.

However, it may be practical to open NK4101 to support Step Cl 5 (Stopping the Train A Containment Spray Pump).

2. Fuse #46 in panel RP209 is pulled to fail close the MSIV bypass valves. The observer noted that opening the breaker would remove power from other equipment and felt that this is not a good idea. He also noted that Callaway pulls fuses to close the MSIV bypass valves. Step B12 pulls fuse #46 in RP209.

3. NK4411 is used to isolate steam generator blowdown. This differs from SLNRC 84-0109, which says to use the switches in the Radwaste Control Room. Use of NK4411 will achieve the desired result faster than sending an operator to the Radwaste Control Room. See Step C27.

4. As a result of recommendation 12, an attachment was added to give operators instruction to protect Train A equipment after all other critical steps are completed.

Attachment F provides guidance based on this recommendation.

b. USAR 7.4.6, Safe Shutdown From Outside The Control Room

Design Basis Document for Procedure OFN RP-017 Page 13 of 102

&I1FG91 5, Rev~. 5 Basis - USAR Section 7.4.6 describes the capability of Wolf Creek to shutdown from outside the control room using the Auxiliary Shutdown Panel (ASP), switchgear and motor control centers. The mitigating actions for a fire in the control room use Train B ASP and equipment. Train B was selected because instrumentation and controls for the turbine driven auxiliary feedwater pump are located on the Train B ASP.

c. USAR Appendix 9. 5B, Fire HazardsAnalyses Basis - The Fire Hazards Analysis is now located in document E-1 F9905, which is incorporated into the USAR, Appendix 9.5B by reference.

d. PIR 1997-2819, EDG Master Transfer Switch In Auto With Fire In The Control Room Basis - PIR 1997-2819 identified a concern where OFN RP-017 did not previously require placing master transfer Switch KJHS0109 in Local/Manual position. The initiator stated that if the switch were left in Auto position, a control room fire could affect the circuits and shut down the diesel generator. After review of the circuits, OFN RP-01 7 was revised to require operators to place KJHS0109 in Local/Manual. Step C.8.b proceduralized this action. Also see PIR 2006-000860 discussion below.

e. PIR 1997-2453, Enter OFN RP-013 At 2 mR/hr Submersion Dose Rate Basis - PIR 1997-2453 identified a concern where OFN RP-01 7 previously required evacuation of the control room if radiation reached certain levels. As a result, OFN RP-017 was revised to allow Health Physics and Shift Supervisor discretion on whether to evacuate. PIR 1997-3376 was also written to evaluate the need to evacuate the control room at all for radiation levels. OFN RP-017 was revised to remove the specific radiation levels and allow the Shift Supervisor to enter OFN RP-01 3 at his discretion.

f. OP 1988-0190, Replacing BG HV-8105 with local valves within the NCP room Basis - This is an inter-office correspondence that requested a procedure change to OFN 00-017 (now OFN RP-017) to reduce the time to complete certain actions. The procedure required an operator to first open BGFCV0121 locally in the positive displacement pump (PDP) room (now the normal charging pump (NCP) room) on the 1974 elevation then the same operator had to ascend to the north pipe penetration room on the 2000 elevation to locally close BGHV8105. The memo requested that instead of closing BGHV8105, valves BG8402B and BGV0017 be manually closed or verified closed. These valves are located in the NCP room along with BGFCV0121. The change was made as requested and OFN RP-01 7 uses BG8402B and BGV001 7.

g. PIR 1999-109, Removing control power priorto rotatingESF bus #2 isolate switch Basis - This PIR identified 3 issues where OFN RP-01 7, Revision 11 was not consistent with the original response strategy for control room fires documented in SLNRC 84-0109 (Superseded by E-1 F9915). These issues are discussed below:

Issue 1 - Note 10 in SLNRC 84-0109 states that FCHV0312 and ABHV0005 will not be opened until it is verified that ALHV0036 is open. There are two loop steam supply valves to the turbine driven auxiliary feedwater pump (TDAFP) (ABHV0005 (loop 2) and ABHV0006 (loop 3)). SLNRC 84-0109 only credited ABHV0005 to provide a steam supply to the TDAFP. OFN RP-017, Rev. 11 Step A9 required the operator at the ASP to open steam supply valve ABHV0006 using ABHIS0006B prior to verifying that suction valve ALHV0036 is open. However, OFN RP-01 7, Rev. 11 Steps A6 and A8 had the same operator at the ASP close the turbine trip and throttle valve (FCHV0312) using

Design Basis Document for Procedure OFN RP-017 Page 14 of 102 E 1F991 5,Rev. 5 FCHIS0312B and the turbine governor valve (FCHV0313) using FCHS0313 and FCHIK0313. Step A7 required the operator at the ASP to isolate ABHV0005 using ABHIS0005B. The requirement in SLNRC 84-0109 has been met in that FCHV0312 and ABHV0005 are maintained closed until ALHV0036 is opened. However, ABHV0006 was added to the procedure at some later time. Since FCHV0312 is maintained closed, the TDAFP will not operate even with ABHV0006 open.

Issue 2 - This issue involves performing steps in the procedure in a different sequence than what was approved in SLNRC 84-0109. Note 2 in SLNRC 84-0109 states that DC power should be tripped after Action 9 [assure MCC and load center breakers are closed]

in room 3302 so that breakers can be electrically tripped by hand to the desired position.

OFN RP-017, Rev 11 had operators' open the control power breakers to the NB02 bus and then rotate switch NBHS0014 to the isolate position. By opening the control power breaker before rotating NBHS0014, relay 195 will not energize and the control room will not be isolated.

Revision 18 of OFN RP-01 7 deleted NBHS001 4 from the procedure. The hand switch would not have completely isolated the control room from the control circuit on the affected components. Also, a control room fire could have opened the control power fuse due to a hot short, thereby isolating control power prior to operation of the hand switch.

The current revision of OFN RP-01 7 requires operators to remove control power from the NB02 bus and not use NBHS0014. Isolating control power will prevent spurious operation of any of the breakers associated with NB02. The possibility still exists for the NB02 breakers to close prior to isolating control power. Therefore, to ensure the NB02 bus loads are shed, each pump breaker, except for the ESW pump, is verified open prior to opening the NB02 feeder breakers to simulate a LOSP and start EDG-B. Verifying each of these breakers is open also ensures the diesel will not fail to start due to overload.

On the basis of the above discussion, the concern raised in Issue 2 of this PIR is no longer valid. The use of NBHS0014 would never have fully isolated the control room and, therefore, its use was never required. Isolation of control power to NB02 ensures spurious operation of the breakers will not occur. All revisions of OFN RP-01 7 (OFN 00-017) required isolation of control power to NB02 in Phase A. The intent of SLNRC 84-0109 is met since isolation of control power effectively prevents spurious operation due to cable failures in the control room.

Issue 3 - The third issue involves the closure of the MSIVs using a portable air supply versus an electrical source, as delineated in SLNRC 84-0109. The MSIVs are closed prior to leaving the control room using ABHS0079 or ABHS0080. However, their closure cannot be guaranteed due to possible fire damage. Therefore, OFN RP-01 7 has steps to close the valves if they failed to close in response to the fast close signal.

SLNRC 84-0109, Note 6 states that the MSIVs will be closed with a portable 125 VDC source. Wires to the valves will then be cut to leave the valves in the closed position. Prior to revision 27, OFN RP-01 7 used a portable air source to close the MSIVs. This change was made in MA 93-0181 with insufficient documentation for the change. The PIR evaluation provides adequate justification for the change and RCMS 1985-118 documents the change in commitment. Since the use of air versus power to close the MSIVs is a more reliable and safe method, it met the intent of SLNRC 84-0109 and was therefore acceptable.

The MSIVs were replaced in refuel outage 16 (DCPs 09952 and 11608) with solenoid actuated system medium operated valves. These valves do not require an accumulator or external air supply so the portable air source and associated air hoses and fittings are not

Design Basis Document for Procedure OFN RP-017 Page 15 of 102 E- F9915, Rev. 5 required. The new MSIVs are held open by six normally energized solenoid valves, three associated with Train A and three associated with Train B. Either train of solenoid valves can operate the associated valve, independent of the opposite train solenoids which provides for diversity and electrical independence. De-energizing either train of solenoids will cause the MSIVs to close. Amphenal connectors, 3 per MSIV per train, have been provided near each MSIV to provide a way for operators to disconnect power to the solenoids and close the MSIVs. This method for closing the MSIVs is utilized in the current version of OFN RP-017.

h. PIR 1999-107, Concerns with meeting requiredtime frame Basis - This PIR was written to document whether changes made in revision 12 of OFN RP-01 7 meet the commitments made in SLNRC 84-0109. The PIR concluded that commitments were met and no changes were required.

PIR 1999-3648 Procedurenot matching plant labels Basis - This PIR addressed labeling inconsistencies between OFN RP-01 7 and the plant labels. The procedure was revised to match plant labeling.

j. PIR 2002-1956, Failureto properly track and implement actions specified within Regulatory CorrespondenceSLNRC 84-0109 as referenced in USAR Appendix 9.5B.

Basis - This PIR identifies concerns with OFN RP-01 7, Rev. 16 not meeting commitments in SLNRC 84-0109. The evaluation shows a step-by-step comparison of OFN RP-017, Rev. 16 with SLNRC 84-0109 and provides justification for any deviations. The PIR evaluation found that the deviations would not have prevented the safe shutdown of the plant. The deviations were historical with no documented evaluation in some cases. In many cases, the deviations were a result of alternative methods to produce the desired result. The alternative methods were determined to be faster and/or safer than that specified by SLNRC 84-0109. Note that the contents of USAR Appendix 9.5B is now contained in E-1F9905.

k. PIR 2003-3479, Revisions to procedures need fire protection review Basis - This PIR identified problems associated with emergency lighting for equipment required to implement OFN RP-01 7. Changes have been made to the procedure over the years with no consideration given to emergency lighting requirements. As components were added or deleted from the procedure, consideration was not always given to emergency lighting requirements. As a result of the PIR, a number of emergency lighting changes were made to ensure each OFN RP-017 action has sufficient lighting in accordance with Wolf Creek commitments.

Westinghouse Tech Bulletin TB-04-22, Reactor CoolantPump Seal Performance - App R Compliance and Loss of All Seal Cooling and WCAP 10541, Reactor Coolant Pump Seal Performance FollowingA Loss of All AC Power, NRC IN 2005-14, FP Findingson Loss of Seal Cooling to Westinghouse RCPs.

Basis - These documents describe industry positions on reactor coolant pump seal cooling. Because of the uncertainty of where the NRC may go in the future with RCP seal cooling issues, Wolf Creek decided to deviate from SLNRC 84-0109 and not restore seal cooling in response to a control room fire. Rather, Wolf Creek will use a natural circulation cooldown and provide RCS makeup and boration through the Boron Injection Tank (BIT) flow path, rather than the seal injection flow path. Revision 22 of OFN RP-01 7 made this change. The use of natural circulation to cooldown will not adversely impact the ability to achieve and maintain safe shutdown.

Design Basis Document for Procedure OFN RP-017 Page 16 of 102 EA R3915, Rev. 5 m/n. PIR 2005-3314 (laterconverted to PIR 2007-003037 in PILOT), Failureto Address NRC Information Notice 92-18.

Basis - This PIR was written to address URI 2005008-06, which was given to Wolf Creek during the Fall, 2005, NRC Triennial Fire Protection Inspection. Wolf Creek has responded to this issue by modifying the control circuit on 36 motor operated valves so a hot short from a fire in the control room will not bypass the valve protective features and prevent operation of the valve.

NRC IN 92-18 identified a concern where a control room fire could cause the spurious operation of motor operated valves due to hot shorts that bypass the valve protective features. The hot short, if sustained, could cause valve damage in a manner that prevents the valve from being manually operated to its desired position. Therefore, the ability to achieve safe shutdown after a control room fire could be compromised.

Wolf Creek initially responded to the IN by crediting the modifications that were done prior to startup in which the NRC required the installation of a number of isolation switches.

However, these modifications did not address the concerns raised in IN 92-18. In April 1999 the NRC conducted an inspection at Callaway and questioned their response to IN 92-18, which was the same response given by Wolf Creek. As a result, Wolf Creek initiated PIR 1999-1245 to take another look at the issue. The PIR was closed in March 2001 with no actions taken due to the ongoing industry discussions with the NRC on the issue of hot shorts, as well as a moratorium placed on circuit inspections by the NRC. The PIR closure statement said that a new PIR will be generated when the industry initiative to address the issue is completed.

The NEI and EPRI conducted testing in 2001 to gain a better understanding of the issue of hot shorts causing spurious actuations. The testing found that under certain fire conditions, spurious actuations could occur due to hot shorts. In January 2005 the NRC resumed inspections of fire-induced safe shutdown circuits. However, the IN 92-18 issue remained unresolved at Wolf Creek and, until PIR 2005-3314 was written, a new PIR was not written as stated in PIR 1999-1245.

o. PIR 2007-003003, PotentialLoss of Field Flashing on Train B Emergency Diesel Generator Basis - This PIR (originally PIR 2005-3333) was written to identify a condition where field flashing could be lost on the Train B EDG due to a fire in the control room. Since Train B is the protected train in the event of a control room fire, this could have an adverse impact on the ability to achieve safe shutdown. Change Package 12097 was prepared and implemented to modify the control circuit and add a control room isolation switch (KJHS01 10) and redundant fuses on the circuit to ensure the availability of field flashing.

p. PIR 2006-000860, PotentialLoss of Train B Emergency Diesel Generatorduring Control Room Fire Basis - This PIR was written after it was discovered that a control room fire could cause a hot short in the EDG shutdown circuit that could stop the EDG during the event. Since Train B is the protected train in the event of a control room fire, this could have an adverse impact on the ability to achieve safe shutdown. The control room portion of the circuit was only partially isolated by hand switch KJHS0109, which left it vulnerable to a control room fire. Change Package 12097 was prepared and implemented to modify the circuit to provide full isolation from the control room.

q. PIR 1998-3012, VCT Outlet Valve Did Not Have Redundant Control PowerFusing. LER 98-004-00, Verifying BG LCV 112C Closed

Design Basis Document for Procedure OFN RP-017 Page 17 of 102 E-1F991 5, Revr. 5 Basis -This PIR identifies a concern where OFN RP-017 directed operators to close BGLCV01 12C using local hand switch BGHS01 12C. However, because the control power circuitry does not contain redundant fusing, control power could be lost, resulting in failure of the valve to close.

Prior to revision 27, OFN RP-01 7 had operators try the hand switch then open the breaker once sufficient time has passed for the valve to close. Another operator then followed up and verified the valve was closed and manually closed it if it was not closed.

DCP 12131 was implemented to add a redundant fuse to the circuit so that operation of BGHS01 12C will close the valve. Therefore, the actions to open the breaker and manually close the valve have been removed from OFN RP-017.

r. E-1F9915, Design Basis Document for OFN RP-01 7, Control Room Evacuation This document describes the basis for OFN RP-017.

s. EngineeringDisposition, PFSSD Issue With Voltage Regulator(CR 00023410)

Basis - This CR identifies a concern where a fire in the control room could have affected the Train B EDG voltage regulator and could have energized the unit parallel relay, placing the EDG in droop mode of operation. The control circuitry was found to not have sufficient isolation capability to ensure the Train B EDG will be available in the event of a control room fire. A temporary modification (TMO 10-004-NE) was implemented and OFN RP-017 was revised to address the issue. A permanent modification will be implemented at a later date.

The temporary modification installed jumper in panel NE0106 to bypass the control room circuitry for the null meter and the Auto/Manual voltage regulator selector switch. This ensures a control room fire will not damage the voltage regulator.

The procedure change added Step C7 to remove the break glass cover from the emergency start pushbutton (KJ HS-101D) to energize the ESA and ESB relays to de-energize the UPR relay. This action will also energize relay 90 VEP which disables the control room auto/manual raise/lower voltage control switches and ensures a control room fire will not cause a hot short that sends a raise or lower signal to the voltage regulator.

t. CalculationSA-08-06, Rev. 2, Retran 3D Post-FireSafe Shutdown (PFSSD) Consequence Evaluation for a PostulatedControlRoom Fire.

Basis - This calculation demonstrates the thermal-hydraulic performance of the plant during a postulated control room fire that causes spurious operation of equipment. The results of the calculation are used to determine the maximum allowed time to mitigate a spurious operation. These times are utilized throughout Table 7.1.

u. DCP 13898, EFHV060 Isolation Switch Basis -This DCP modified the control circuit for valve EFHV0060 to address NRC Information Notice 92-18 and add an ISO/CLOSE switch to provide operators the ability to close the valve and prevent flow imbalance in the Train B ESW system.

7.3.2 OFN RP-017, Section 3.2 - Commitments

a. Letter SLNRC 84-0109, Fire ProtectionReview RCMS #1985-118 [Entire Procedure]

Design Basis Document for Procedure OFN RP-017 Page 18 of 102 E 11F92915, Rev. 5 Basis - SLNRC 84-0109 provides the original licensing basis for response to a control room fire and shutdown from outside the control room. The letter assigned 6 phases to the time critical actions within the letter. Procedure OFN RP-017 no longer uses phases. The timing is now based on thermal hydraulic calculations, which provide more realistic time response criteria to the potential spurious operations that could occur in the event of a fire in the control room. Therefore, all mention of phases has been removed from the procedure. The new timing requirements are described in Table 7.1.

Letter SLNRC 84-0109 should remain in this section because of other commitments within the letter. These commitments are described throughout this document where applicable.

b. SLNRC 84-0109 change to commitment RCMS #1988-201 Basis - See 3.1 .f above.

c. PIR 2005-3209, and LER 2005-006, Unanalyzed Condition Related To Loss Of RCP Seal Cooling DuringA PostulatedAppendix R Fire Event. (Removes steps from procedure for RCP seal restoration)

Basis - An Apparent Violation (AV) issued by the NRC during the 2005 Triennial Fire Protection Inspection identified a concern where Revision 21 of OFN RP-017 may not have been able to restore seal cooling prior to seal damage occurring. The current procedure does not restore seal cooling in response to a control room fire. Rather, the RCPs are stopped, the seal injection flow path is isolated, RCP thermal barrier is isolated from the CCW system, RCS makeup and boration is accomplished through the BIT flow path and natural circulation cooldown is used. The thermal hydraulic calculations show that stable hot standby conditions are achieved using OFN RP-017.

7.4 Step-by-Step Review Table 7.1 provides a detailed evaluation for each Step in OFN RP-017 per the Methodology in Section 3.0.

Design Basis Document for Procedure OFN RP-017 Page 19 of 102 E !F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete (Note 2) Steps (Note 1)

(min)

Wolf Creek USAR, Appendix 9.5E, Response to Section lU.L states, inpart: "...Adequate Operations shift staffing is provided to achieve and maintain post-fire safe shutdown..."

10CFR50, Appendix R,Section 11l.L.4 states, inpart, The fire brigade is "...The number of operating shift personnel, exclusive dedicated to fighting of fire brigade members, required to operate such the control room fire. equipment and systems shall be on site at all times.

They are not NOTE responsible for N/A The Wolf Creek Technical Requirements Manual N/A N/A N/A N/A performing any of the (TRM), TR 5.2.1.b states inpart: "Asite Fire Brigade operator actions of at least 5 members shall be onsite at all times ...

described inthis The Fire Brigade shall not include the Shift Manager procedure. (SM), and the two other members of the minimum shift crew necessary for safe shutdown of the Unit and any personnel required for other essential function during an emergency."

Note that four operators, besides the SM, are required to complete OFN RP-017.

Design Basis Document for Procedure OFN RP-017 Page 20 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note )(rain) Complete (Note 2) Steps Check Control Room The decision to evacuate is made by the Shift Evacuation Due To Fire Manager based on environmental conditions and/or SREQUIRED the ability to control the plant from the control room Annunciators and (CR). There is no regulatory basis for when the CR status panels - NOT should be evacuated.

READABLE FROM The Wolf Creek SER, Supplement 5, page 9-10 states "AT THE CONTROLS" N/A inpart: "The new procedures assume that evacuation N/A N/A N/A N/A of the control room takes place when the fire starts..."

Spurious equipment It is not realistic to assume the control room operators actuations - will evacuate as soon as a fire starts. Only the control OBSERVED room staff can make the decision to evacuate based Loss of Control

on conditions. Therefore, OFN RP-01 7 provides Room controls - guidelines that the Shift Manager can use for deciding IMMINENT when to evacuate.

Generic letter 86-10, response to question 3.8.4 states, inpart: "...Note that the only manual action in the control room prior to evacuation usually given credit for is the reactor trip. For any additional control room actions deemed necessary prior to evacuation, a demonstration of the capability of performing such Trip The Reactor 2* SHS1R0 actions would have to be provided..." The reactor assumed is at tripped No N/A 2SB HS-1 0 R Ina memo from the NRC to KG&E dated August 31, t=0.

SB HS-42 1984, which documents the minutes of an August 22, t0O 1984 meeting with KG&E and UEC, the NRC provided clarifications of staff positions discussed during the meeting. One of those positions is as follows:

Creditcan be taken only for a manual scram before leaving the control room.

Design Basis Document for Procedure OFN RP-017 Page 21 of 102 E-IFQ--1, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function SNcti BASIS To TIMING BASIS Impact? Prereq BS Complete (Note 2) Steps (Note 1)(min)

Based on this staff position, the NRC acknowledged that the reactor will trip when the switches are depressed prior to evacuating the control room.

Hand switches SB HS-1 and SB HS-42 are located on separate panels. SB HS-1 is located on RL003 while SB HS-42 is located on RL006. There is a 2 foot air gap between the panels as well as metal outer covers that will restrict the spread of fire between panels.

Automatic smoke detection is present ineach panel, which will provide early warning of a fire. In addition, the control room is constantly attended. A fire inone panel is unlikely to spread to the other due to the physical separation present.

Drawing E-13SB12A shows a schematic diagram of the reactor trip switch wiring. Each switch has two normally open contacts per train. Two out of four contact closures on one out of two trains actuates the reactor trip function at panel SB102A or SB102B, located outside the control room. Two contacts on each switch are on separation group 1 and two contacts are on separation group 4. Physical separation between each group is maintained in accordance with IEEE 384 to ensure a fire that affects one group will not arrect the other.

The positioning of the reactor trip switches on separate panels and the arrangement of the switch contacts and wiring provides reasonable assurance that one of the switches will successfully trip the reactor.

Design Basis Document for Procedure OFN RP-017 Page 22 of 102 E 1F95915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note )(rain) Complete (Note 2) Steps (Note 1)

Generic letter 86-10, response to question 3.8.4 states, inpart: "...Note that the only manual action in the control room prior to evacuation usually given credit for is the reactor trip. For any additional control room actions deemed necessary prior to evacuation, a demonstration of the capability of performing such Yes. The actions would have to be provided. Additionally, SA-08-006 MSIVs assurance would have to be provided that such assumes this step could actions could not be negated by subsequent spurious will be completed spuriously Close MSIVs actuation signals resulting from the postulated fire." approximately 5 open or

" AB HS-79 Hand switches AB HS-79 and AB HS-80 are located seconds after the remain 3 R, M,D on RL006, which also has one of the two reactor trip 5 sec reactor trip switches open after N/A AND hand switches (SB HS-42). Therefore, due to the are depressed. the

AB HS-80 close proximity between the reactor trip hand switch See Section 6.1 for switches and the MSIV close hand switches, it is reasonable to discussion on the have been conclude that actuating both hand switches is possible timing basis for actuated.

prior to exiting the control room. MSIV closure. See Step D16.

Credit is not given for actual MSIV closure since spurious actuation could occur as a result of the control room fire. Therefore, Step D16 provides instructions to close them ifnot already closed. For a single failure not involving the MSIVs, SA-08-006 assumes the MSIVs close inStep 3.

Shift Manager proceed The Shift Manager (SM) proceeds directly to the ASP N/A N/A N/A N/A 4 to ASP and direct N/A to direct performance of OFN RP-017.

personnel.

Design Basis Document for Procedure OFN RP-017 Page 23 of 102 E !FOB! 6, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note1)(rain) Complete (Note 2) Steps The Gaitronics system is the preferred method to announce the fire and call out the fire brigade. The Gaitronics control panel is located inthe back panel area of the control room on the far South wall, remote Announce the from the main control room area. Afire inthe main evacuation of the control room area, inthe absence of a loss of offsite 4.a Control Room due to N/A power, will not affect the ability of the Gaitronics N/A N/A N/A N/A fire and entry into OFN system to announce the fire and call out the fire RP-017 using Plant brigade due to the physical separation of the control Gaitronics handset panel (QF076) and power cables. However, a loss of offsite power to NG01, NG02, PG1 9 and PG20 will prevent operation of the system. Therefore, an RNO is provided to ensure timely callout of the fire brigade and notification of control room evacuation.

IFGaitronics is not working, THEN perform the following:

1) Announce This RNO provides instructions to ensure all available 4.a RNO Evacuation using the Ti N rvdsisrcin oesr l vial public address system. N/A means are used to call out the fire brigade and commence OFN RP-017 actions ifthe Gaitronics N/A N/A N/A N/A

2) IFannouncement system is unavailable.

cannot be made, THEN dispatch runners to notify OFN RP-017 personnel.

4.b Repeat announcement. N/A The Operator repeats the announcement to ensure it N/A N/A N/A N/A is heard.

Design Basis Document for Procedure OFN RP-017 Page 24 of 102 EA1F9A-15, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact?

(Note 1) Complete (rmin) (Note 2) Steps 4.c Check Fire Brigade - N/A The Operator ensures the fire brigade has been called N/A N/A N/A N/A CALLED OUT out successfully and, ifnot, performs the RNO actions.

Perform the following:

1) Make the following announcement using the Public Address System

"Fire Fire Fire.

Fire inControl Room. Fire Brigade members assemble at turnout lockers" This RNO provides alternative methods to notify the 4.c RNO 2) Repeat Public N/A fire brigade and provides instructions to ensure the N/A N/A N/A N/A Address System off-site fire department is called out ifthe fire brigade Announcement. is delayed or cannot be contacted.

3) IFFire Brigade cannot be contacted, THEN dispatch runners to alert FB members.

4) Request assistance from Coffey County Fire Department.

Telephone number 911

Design Basis Document for Procedure OFN RP-017 Page 25 of 102 E 1F991, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (Note 2) Steps (Note 1)

(min)

Classify the event using 4.d EPP 06-005, N/A The SMs duty at this point is to classify the event and N/A N/A N/A N/A EMERGENCY initiate the emergency plan.

CLASSIFICATION.

4.e Supervise performance N/A After the emergency plan has been initiated, the SM N/A N/A N/A N/A of this procedure. supervises performance of OFN RP-01 7.

SRO proceed to ASP The Senior Reactor Operator (SRO) is responsible for 5 via CAS and direct N/A performing the actions of Attachment A inOFN RP- N/A N/A N/A N/A personnel. 017.

Obtain the following equipment from Control Room emergency locker for personnel entering the RCA:

" Low-Range PIC 0

- 500 mR This step ensures those exiting the CR through CAS

High-Range PIC obtain the proper radiation monitoring and safety gear.

5.a 0-5 R N/A The SRO is required to operate 480 VAC breakers on N/A N/A N/A N/A

" Record Dose his/her way to the ASP so itwill be necessary to don a Dosimeter (RDD) fire resistant suit and leather gloves.

Fire resistant Suit (SRO)

Leather gloves (SRO)

Hard hat

Design Basis Document for Procedure OFN RP-017 Page 26 of 102 E11FOB!6, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (Note 2) Steps (Note 1) (min)

Direct CAS personnel to:

5.b 1. Transfer control to N/A CAS is evacuated to prevent security personnel from N/A N/A N/A N/A SAS being overcome by smoke.

2. Evacuate CAS The SRO proceeds to the ASP through CAS and On NG03C, place the enters room 1512, where NG03C is located.

following breakers to Therefore it is feasible for the SRO to perform these OFF: actions before proceeding to the ASP.

These breakers are placed inthe OFF position to See Section 6.3 for

" NG03CEF4 for AL ensure power is disconnected to the associated Train discussion of timing HV-36, Supply A valves. This will prevent the valves from spuriously basis for aligning From Cond Stor operating prior to and after the valve is manually auxiliary feedwater.

Tk Water operated inanother step.

5.c

NG03CHF3 for EG D,S N/A See Section 6.5 for No N/A HV-15, CCW If,prior to performing this step, the valve spuriously Retun From operates to the undesired position, the valve can still discussion of timing basis for aligning Nuclear Aux be manually operated. Valve damage will not occur Adue Nucmpoents to circuit modifications completed per change compor aling packages 12130 (EG HV-61) and 12170 (AL HV-36 water.

" NG03CKF3 for EG and EG HV-15) inresponse to NRC IN92-18 (PIR HV-61, CCW 2007-003037).

CTMT ISO VLV For additional information on these specific valves see Steps B7, B10 and D6.

Design Basis Document for Procedure OFN RP-017 Page 27 of 102 E 11F991, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP.017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note 1)(min) Complete (Note 2) Steps Operators will generally communicate via radio.

Therefore, the SRO obtains a radio from the Pick up radio from emergency locker.

5.d emergency locker N outside ASP and select /A The radio system is unaffected by a fire inthe control N/A N/A N/A N/A Channel 1. room. Therefore, the radio system is a reliable means of communication. Channel 1is used because it is the Operations channel.

5.e Perform actions of The SRO is responsible for performing the actions of ATTACHMENT 5.e A,SRO N/A Attachment A inOFN RP-017. N/A N/A N/A N/A ACTIONS On-Shift Personnel 6 Perform Designated N/A N/A N/A N/A N/A N/A Actions:

Operator performing Turbine Building actions, proceed to PA01/PA02 and 6.a N/A N/A N/A N/A N/A N/A perform actions of ATTACHMENT B, TURBINE BUILDING ACTIONS Reactor Operator, proceed to NK switchgear rooms and 6.b perform actions of N/A N/A N/A N/A N/A N/A ATTACHMENT C, REACTOR OPERATOR ACTIONS

Design Basis Document for Procedure OFN RP-017 Page 28 of 102 E 1FOB!6, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note 1)(min) Complete (Note 2) Steps Operator performing Aux Building actions, proceed to emergency 6.c locker 2026' level and N/A N/A N/A N/A N/A N/A perform actions of ATTACHMENT D, AUXILIARY BUILDING ACTIONS Offsite Communicator, proceed to Aux The Wolf Creek emergency plan requires an offsite 6.d Shutdown Panel until N/A TheiWore N/A N/A N/A N/A released by Shift I Manager CR 00019239 identified an issue involving the time to close valve BN HV-8812A. The valve requires approximately 600 turns of the handwheel to close.

Operations Standing Order #1 limits the handwheel Operator closing BN speed to 60 revolutions per minute. Therefore, the HV-88112A, RWST TO minimum time to close is 10 minutes, but due to the RHR PUMP A location of the handwheel and potential fatigue of the SUCTION ISOLATION operator, it will likely take longer. Therefore, it was 6.e VALVE proceed to ESF R, M decided to add an extra operator to this procedure to N/A N/A N/A N/A Switchgear Room B perform this action. This operator will also be and perform actions of responsible for opening the breaker to the valve. Due ATTACHMENT E, BN to the length of time necessary to close the valve, this HV-8812A CLOSURE. operator should not be given any other OFN RP-017 duties prior to getting BN HV-8812A closed.

Design Basis Document for Procedure OFN RP-017 Page 29 of 102 E 1FOB!, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1)(min) Complete (Note 2) Steps (Note 1)

These hand switches are used to isolate certain components from the control room. The switches, when placed in ISO. CTRL. ROOM position, energize lockout relays (LORs) and change the position on a number of contacts located inthe control circuit for these components. This ensures a fire inthe control room will not affect the isolated components after the hand switch is actuated. This step Place Following establishes control The LORs are powered from DC batteries (NK). The Switches In ISOLATE: of the isolated batteries are sized to supply power to all emergency components from loads for 200 minutes following loss of ac power per

" RP HIS-1 CTRL the auxiliary E-10NK. Loss of offsite power will not affect the ROOM ISO shutdown panel LORs.

SWITCH - (ASP). The timing ISOLATE RP HIS-1 performs the following functions: basis depends on R, M,D, Al

RP HIS-2 CTRL N/A when the isolated No N/A P, S " Isolates valve FC HV-312 (TDAFP Trip and ROOM ISO components are Throttle Valve) from the control room.

SWITCH - required to be

Isolates main steam to TDAFP supply valves AB ISOLATE operable, which is HV-5 and AB HV-6 from the control room.

RP HIS-3 CTRL discussed inthe

Isolates AB PV-2 indication from the control ROOM ISO steps that follow.

room. AB PV-2 position indication at the ASP is SWITCH - Therefore, there is independent of the control room. RP HIS-1 ISOLATE no timing basis for isolation is not required. ARV position indication this step.

is not credited for PFSSD. ARV position is determined by controlling the ARV using the controller at the ASP and monitoring RCS temperature.

Isolates FC FV-313 (TDAFP Speed Governing Valve) position indication from the control room.

Design Basis Document for Procedure OFN RP-017 Page 30 of 102 rE- 1FA5116, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq

( Complete (Note 2) Steps (Note 1)min)

RP HIS-2 performs the following functions:

Isolates BG HV-8152 (Letdown Isolation Valve) from the control room.

Isolates the trip portion of NB0208 handswitch PG HIS-21. However, NB0208 could trip and the control power fuses could blow before RP HIS-2 is operated. This would prevent operation of pressurizer backup heater group B from the ASP.

Ifthis occurs, operators will need to manually close NB0208 to energize PG22. NB0208 is closed inStep C10.

Isolates valves AL HV-30, AL HV-33 and AL HV-34 from the control room and adds a redundant fuse inthe circuit.

" Isolates AB PV-4 indication from the control room. AB PV-4 position indication at the ASP is independent of the control room. RP HIS-2 isolation is not required. ARV position indication is not credited for PFSSD. ARV position is determined by controlling the ARV using the controller at the ASP and monitoring RCS temperature.

Isolates MDAFP 6 from the control room and adds redundant fuses inthe circuit. However, this method of controlling the Train B motor driven auxiliary feedwater pump is not credited in OFN RP-017. Rather, the B MDAFP is started by closing breaker NB0205 in Step C14.

Design Basis Document for Procedure OFN RP-017 Page 31 of 102 E 1F9915, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) Complete (Note 2) Steps RP HIS-3 performs the following functions:

Isolates PG2201 control circuit from the control room. PG2201 supplies power to pressurizer heater backup group B. Isolation of the PG2201 control circuit using RP HIS-3 allows operation of the heater group using BB HIS-52B at RP1 18B.

The heaters are used inStep A.7 RNO to maintain pressurizer pressure. Isolation of the heaters prevents spurious operation and ensures availability when needed. PG2201 is powered from NB0208 which is closed inStep C10.

Design Basis Document for Procedure OFN RP-017 Page 32 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS ToTIMING BASIS Impact Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min) ______I 2 SA-08-006 assumes this step will be completed within 7 minutes ifa single failure occurs Close S/G AAnd C The control circuit for these valves is not isolated from that does not ARVs: the control room by operation of AB HS-1 and AB HS-involve an ARV

3. Therefore, AB PV-1 and AB PV-3 could remain circuit. Therefore, it

a. AB HS-1 SG A open. Steps D19 and D20 direct operators to isolate is assumed that Yes. A STEAM DUMP CTRL air and nitrogen to the valves then bleed air from the ARVs 1and 3 will control XFR-LOCAL regulator to fail the valves closed. Ifthis method fails, be closed in 7 room fire operators are directed to close AB-V018 and AB-minutes inthis step could

b. AB HS-3 SG C V029. Isolating air and nitrogen provides a faster and that the control prevent STEAM DUMP CTRL method of dosing the valves.

A2 R, M,D 7 room fire will not closure or N/A XFR-LOCAL Control power to AB PIC-1 Boriginates from NN01 16, impact the ability to cause the which is powered from the NK01 1 batteries. close the ARVs re-opening

c. AB PIC-1B SG A Therefore, power will be available to perform this from the ASP. SA- of ABPV1 STEAM DUMP TO action.08-006 also shows and ATMS CTRL- CLOSED that a single failed ABPV3.

Control power to AB PIC-38 originates from NN0303 open ARV can go

d. AB PIC-3B SG C which is powered from the NK013 batteries.

unmitigated for at STEAM DUMP TO Therefore, power will be available to perform this least 1-hour. See ATMS CTRL- CLOSED action.

Section 6.1 for discussion of timing basis for controlling the steam generator ARVs.

Design Basis Document for Procedure OFN RP-017 Page 33 of 102 F- 1FAD!6, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min)

Check RCS Cold Leg The steam generator ARVs, ifunaffected by a fire, Temperatures: control temperature to 561 OF. Temperature A3 STABLE AT OR D instrument BB TI-423X is used to monitor cold leg N/A N/A N/A N/A TRENDING TO 561 OF temperature on loop 2. The circuits for this temperature indicator are independent of the control 3 TI-423X BB room.

Design Basis Document for Procedure OFN RP-017 Page 34 of 102 E 1F9916, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note )(rain) Complete (Note 2) Steps (Note 1)

Perform the following:

a. IFtemperature greater than 561 *F, THEN dump steam using S/G B and S/G D ARV's:

ARVs AB PV-2 and AB PV-4 are isolated from the

1) ABHS-2SGB control room by placing AB HS-2 and AB HS-4 in STEAM DUMP LOCAL position. Auxiliary feedwater is assured to SA-08-006 CTRL XFR -

steam generators B and D using the Train B MDAFP assumes LOCAL and the TDAFP. The Train B MDAFP is started in atmospheric steam Step C14. The TDAFP is started inStep A14. dump control on

2) ABHS-4SGD steam generators B STEAM DUMP Control power for AB PIC-2B originates from NN0203 and Dis CTRL XFR - which is powered from NK02. Therefore, power will A3 RNO LOCAL D remain available from the NK012 batteries.

7 established at the No N/A ASP within 7 Redundant power is available from NG02A which is minutes. See

3) AB PIC-2B - energized inStep Cl 1.

Section 6.1 for THROTTLED Control power for AB PIC-3B originates from NN0404 discussion about OPEN which is powered from NK04. Therefore, power will steam generator remain available from the NK014 batteries. ARVs.

4) AB PIC-4B -

THROTTLED Redundant power is available from NG02A which is energized inStep C11.

OPEN

b. IFtemperature less than 561 *F AND temperature decreasing, THEN stop dumping steam.

Design Basis Document for Procedure OFN RP-017 Page 35 of 102 E !F9915, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note )(rain) Complete (Note 2) Steps (Note 1)

The control circuit for this valve is isolated from the control room by operating RP HIS-2 inStep Al. The 15 minutes See Section 6.3 for Check CST to MD control circuit has been modified to address NRC IN to start the timing basis for A4 AFP B - OPEN 92-18 (PIR 2005-3314). pump and establishing No Al

. AL HIS-34B - MDAFP B is lined up to supply feedwater to steam inject into auxiliary feedwater OPEN generatorlD. Step C13 restores power to AL HV-34 steam using Train B MCC cubicle NG04CNFI. The valve may not open generator D MDAFP.

until Step C13 is completed.

Verify AFW Valve Lineup For MD AFP B: Operation of AL HS-5 to the LOCAL position allows control of valve ALHV0005 from the ASP.

a. SG DAUX FW XFR CTRL VLV Power to valve AL HV-5 is from NG04CCF2. The 15 minutes See Section 6.3 for valve is normally full open and can be throttled to to start the timing basis for A5 o AL HS D control flow into the steam generator. Loss of power pump and establishing No N/A LOCAL will fail the valve as is and will prevent control of the inject into auxiliary feedwater valve from the ASP until power is restored to NG04C. steam using Train B

b. SG D MD AFP AFW Power is restored instep C13. This will have no generator D MDAFP.

REG VLV CTRL adverse impact since the Train B MDAFP is not started until Step C14.

o AL HK-5B -

OPEN Notify Reactor The Reactor Operator, inStep C14, ensures Steps A4 15 minutes See Section 6.3 for Operator That Motor and A5 are complete before starting the Train B motor to start the timing basis for A6 Driven AFW Pump B driven auxiliary feedwater pump. Valve lineups in pump and establishing N/A N/A Valve Lineup Steps Steps A4 and A5 establish a suction source from the inject into auxiliary feedwater A4 Through A5 Are CST and a discharge path to SG Dand need to be steam using Train B Complete complete before Step C14 is complete. generator 0 MDAFP.

Design Basis Document for Procedure OFN RP-017 Page 36 of 102 E 1F9916, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 2) Steps Complete N

(Note 1) C(rin)

Maintain Stable Plant Conditions:

Hot standby is maintained using procedure OFN RP-

a. PZR pressure - 017 by ensuring parameters are within the ranges BETWEEN 2000 PSIG listed. Diagnostic instrumentation is available as AND 2300 PSIG described below.

a. The only pressurizer pressure indicator at the ASP

BB PI-406X is on the Train Aside (BB PI-455B), which is not protected from a control room fire. RCS pressure

b. PZR level -

indicator BB PI-406X is located on the Train B ASP BETWEEN 25% AND and is unaffected by a control room fire. Therefore, 70%

BB PI-406X is used inthis step to verify RCS

pressure.

BB LI-460B R, M,D, A7 N/A N/A No N/A P b. Pressurizer level is indicated by BB LI-460B on the

c. S/G Wide Range Train B ASP and is unaffected by a control room fire.

Levels BETWEEN 60%

c. OFN RP-01 7 uses steam generators B and D for AND 62%

shutdown from outside the control room. Wide range level indicators AE LI-502A (SG B)and AE LI-504A

" AE LI-502A (SG D)are located on the Train B ASP and are

AE LI-504A unaffected by a control room fire.

d. RCS cold leg d. RCS cold leg temperature is monitored at the Train temperatures - B ASP using temperature indicator BB TI-423X (Loop BETWEEN 551'F AND 2 cold leg). This TI is unaffected by a fire inthe 561 *F control room,

BB TI-423X

Design Basis Document for Procedure OFN RP-017 Page 37 of 102

&I1F8_915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS mplete To (Note Prereq STEP (Note 1) (NtC1o mpl)t Complet TIMING BASIS Impact' (Note 2) Steps

a. Per SA-08-006, pressurizer heater backup group B is

a. Cycle PZR HTRS assumed to be B/U GP B as necessary controlled within to restore PZR 11.5 minutes.

pressure b. SA-08-006 shows that the most

BB HIS-52B a. Ifpressurizer pressure is below 2000 psig, the challenging backup group B pressurizer heaters are cycled to scenario for

b. WHEN BIT is restore pressure. Step C10 restores power to the pressurizer level is aligned, THEN direct heaters and will need to be complete before this step a single steam Operator performing a. 11.5 can be completed. generator ARV a. N/A A7 RNO Turbine Building R, M opening coincident No actions to control level b. 10 CFR 50, Appendix R requires pressurizer level b. D4

b. 28 with an immediate locally: to remain on-scale. To maintain pressurizer level on automatic AFAS(T) scale, an operator needs to throttle the BIT outlet and a loss of offsite

Throttle BIT outlet valve to control flow. The valve is throttled inStep power. Pressurizer valve B13.

level does not drop off scale low as o EM HV-8801B long as the CCP is (2000' AUX BLDG started and BIT NORTH PIPE injection is lined up PEN ROOM) in 28 minutes. See Sections 6.1 and 6.2 for discussion about charging.

Design Basis Document for Procedure OFN RP-017 Page 38 of 102 E lF9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq SNFti BS Complete (Note 2) Steps (Note 1) (min)

IfAL HV-6 opens, the TDAFP would supply AFW to steam generator D inaddition to MDAFP B. Flow controller AL FC-5 will limit flow to the steam generator to 300 gpm and will throttle AL HV-5 accordingly. Circuits for this function are not run inthe control room and, therefore, are unaffected by the fire.

However, the controller will not function until power is restored to NG04C inStep C13. Inthis case, Yes. AL operators may have to manually close AL HV-6. The HV-6, AL TDAFP is designed to supply all four steam Closing valves HV-7, AL CAUTION generators so flow diversion to SG Dwill not impact ALHV-6, 7, 8 and HV-8 and PFSSD. 12 is not time AL HV-12 o AL HV-6, AL HV-7, critical as discussed IfAL HV-7 opens, water would be directed to SG Avia are not AL HV-8 and AL HV-12 inthe Basis.

MDAFP B. The MDAFP B is sized to supply both SG isolated are not isolated from Therefore, N/A the control room and D A and SG D,so sufficient flow would be directed to N/A operators can from the N/A SG Dfor safe shutdown. With flow being directed to control may spuriously actuate. mitigate spurious SG Aand with the SG A ARV not being used, the SG room.

It may be necessary to operation of these could fill solid. However, with the SG filled solid, This will manually isolate these valves when all PFSSD is still assured. not valves. time critical actions adversely IfAL HV-8 opens, the same result would occur as with are complete.

impact AL HV-7 opening, except the water would come from PFSSD.

the TDAFP. The TDAFP is designed to supply all four steam generators. Therefore, ifvalve AL HV-8 spuriously opens, PFSSD is still assured.

IfAL HV-1 2 opens, water would be directed to SG C via the TDAFP. However, with flow being directed to SG C and with the SG C ARV not being used, the SG could fill solid, which is not desirable. However, with the SG filled solid, PFSSD is still assured. The

Design Basis Document for Procedure OFN RP-017 Page 39 of 102 E--11FQ9 16, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete (min) (Note 2)

(oe2 ps (Note 1)

TDAFP is designed to supply all four steam generators. Therefore, ifvalve AL HV-1 2 spuriously opens, PFSSD is still assured.

As stated earlier, AL HV-33 is isolated from the control Check ESW To TD room using RP HIS-2. Step C13 energizes valve cubicle NG04CCF4, so the valve may not close until This action is not AFW Pump Step C13 is completed. time critical. As Isolation Valve - stated inthe Basis, A8 CLOSED D Afailed open valve will not impact PFSSD. The N/A No Al ifthe valve opens preferred source of auxiliary feedwater is the CST. PFSSD is still o AL HIS-33B However, ESW is the safety-related source. This assured.

CLOSED action is for commercial concerns to ensure raw untreated ESW water does not enter the SGs.

Contact Operator 35 minutes Performing The SRO ensures a suction supply from the CST is to start the See Section 6.3 for Attachment B To available before starting the TDAFP. Step B7 opens pump and timing basis for the No N/A A9 Verify AL HV-36 Open the valve after ensuring control power is de-energized inject into TDAFP.

inStep 5.c. steam 0 AL HV OPEN generator B

Design Basis Document for Procedure OFN RP-017 Page 40 of 102 E 1F9915, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Note 1)(rain) Complete (Note 2) Steps (Note 1)

Perform the following:

a. Close AFW Pump Turbine Mechanical Trip/Throttle Valve.

0 FC HIS-3128

b. Close Loop 2 and Ifthe TDAFP is running with no Loop 3 Steam to AFP Turb. IfAL HV-36 is not open, this RNO directs the operator suction source, to ensure the steam supply to the TDAFP is isolated damage to the A9 RNO e AB HIS-5B 0 to protect the TDAFP. N/A pump could has Ifthe pump occur.

no No Al

AB HIS-6B Valves AB HV-5, AB HV-6 and FC HIS-312B are suction this RNO

c. WHEN CST Supply isolated from the control room inStep Al. needs to bebefore completed To TD AFW Pump is damage occurs.

open, THEN perform Steps A10 through A14.

d. Observe note prior to Step A15 and continue with step A15.

Design Basis Document for Procedure OFN RP-017 Page 41 of 102 E !F9916, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1)(min) Complete (Note 2) Steps (Note 1)

Place TD AFP FC HS-313 transfers control of the TDAFP speed Governor Control to governing valve to the ASP. After the switch is local: manipulated, controller FC HIS-313B can be used to 35 minutes control the TDAFP. to start the See Section 6.3 for

FC HS-313 - pump and timing basis for A10 LOCAL D Control power originates from NN0203, which is inject into TmAF oNthe No N/A powered from NK02. Therefore, power will remain steam TDAFP.

" Adjust FC HIS- available from the NK012 batteries. Redundant power generator B 313B to Minimum is available from NG02A, which is energized inStep Output Ci1.

Verify AFW Valve Lineup For TD AFP:

AL HS-10 transfers control of AL HV-10 to the ASP,

a. SG B AUX FW XFR where AL HK-10B can be used to control valve CTRL VLV LOCAL position. This valve controls TDAFP flow to SG B, 35 minutes which is one of the credited AFW flowpaths. to start the See Section 6.3 for A AL HS pump and All LOCAL D Control power originates from NN0404 which is inject into timing basis for the No N/A powered from NK04. Therefore, power will remain steam TDAFP.

b. SG B TD AFP AFW available from the NK014 batteries. Redundant power generator B REG VLV CTRL OPEN is available from NG02A which is energized inStep Cll.

ALHK-1OB-OPEN Ensure Loop B Steam Valve AB HV-5 is opened to ensure adequate steam 35 minutes Isolation To AFP supply to the TDAFP. RP HIS-1 isolates the valve to start the See Section 6.3 for Al2 T from the control room and inserts a redundant fuse in pump and timing basis for the No Al AB HIS-5B - the circuit. Therefore, the hand switch can be relied injectsinto TDAFP.

OPEN on to function. generator B

Design Basis Document for Procedure OFN RP-017 Page 42 of 102 E 11FOB! 6, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note1)(rain) Complete (Note 2) Steps Valve AB HV-6 is closed because steam generator C is not credited for a control room fire. Continued Ensure Loop C Steam steaming of this steam generator with no feedwater Isolation To AFP flow could result inthe steam generator going dry.

Turbine Is-CLOSED A Valve AB HV-5 is opened inStep Al2 to provide the A13 required steam flow to the Turbine Driven Auxiliary N/A N/A No Al

AB HIS-6B - Feedwater Pump. RP HIS-1 isolates the valve from the control room and inserts a redundant fuse inthe circuit. The alternate power supply to the valve does not run through the control room. Therefore, the hand switch can be relied on to function.

Ensure AFP Turbine 35 minutes Mechanical to start the TripAhrottle Valve Valve is isolated from the control room and redundant pump and See Section 6.3 for A14 Open D fuses are added using RP HIS-1 inStep Al. inject into timing basis for the No AD,A9 steam

FC HIS-312B-generator B OPEN Contact Operator Calculation SA Performing Auxiliary feedwater valves AL-V032, AL-V056, AL- 006 shows that the 8At A AUX N V061 and AL-V071 are closed to prevent overfilling steam generators A15 FEEDWATER VALVE D the steam generators. This step has the operator 35 could overfill ifthe No N/A CLOSURE To Ensure verify the valves are closed before starting the valves are not AOU ValEsAre TDAFP. closed within 35 AFW Valves Are minutes.

closed.

Design Basis Document for Procedure OFN RP-017 Page 43 of 102 E-IF9916, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note 1)(min) Complete (Note 2) Steps Perform the following:

a. WHEN AFW Calculation SA WHe Va. vs c , 006 shows that the A NEN perform Al 5 Ifthe AFW valves are not closed, The RNO directs the steam generators A15RNO D operator to continue to Step Al 6 until the valves are 35 could overfill ifthe No N/A Observe notes

b. piobsrv closed, valves are not prior tostep to step Al6closed A16 minutes.within 35 and continue with step A16 Establish Turbine Driven AFW Pump Control:

a. Adjust AFP TURB The TDAFP is credited for supplying AFW to SG B. 35 minutes SPEED GOV CTRL FC HIS-313B is used to control TDAFP speed from to start the See Section 6.3 for A16 Output to 60% the ASP. Step Al 0 transfers control of FC FV-313 to pump and timing basis for the No Al, E4 the ASP. Step E4 closes TDAFP to SGs A,C and D inject into the tDafo.

. FC HIS-313B valves AL-V056, AL-V071 and AL-V061, respectively, steam TDAFP.

to prevent overfill of these steam generators. generator

b. Adjust AFW pump speed as necessary to establish desired AFW flow

Design Basis Document for Procedure OFN RP-017 Page 44 of 102 E lF9915, Re%. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete (Note 2) Steps (Note 1) (rain)

Align Alternate AFW Pump Water Source:

a. Check CST below minimum level:

CST level on ASP -

Yes. CST LESS THAN 14%

level indicator

AP LI-4B The CST contains This step aligns the ESW system to the AFW pumps AP LI-4B sufficient inventory inthe event the CST reaches low level. RP HIS-2 is not OR for PFSSD. This isolates both AL HV-30 and AL HV-33 from the control isolated step is entered only

Local CST level - room and adds redundant fuses to the control circuit from the A17 D N/A when the CST Al for each valve. control LESS THAN 6'5" reaches low level.

room.

There is no timing Step C1 3 needs to be complete to restore power to AL Local level

b. Open ESW To MD basis associated HV-30 and AL HV-33 MCC cubicles. instrument AFW Pump B Isolation with this step.

may need Valve to be used.

ALHIS-30B-OPEN

c. Open ESW To TD AFP

AL HIS-33B

Design Basis Document for Procedure OFN RP-017 Page 45 of 102 E- FOB! 5, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min)

a. Perform the The RNO is entered when the CST is above minimum following: level. This is a continuous action step which means

1) WHEN CST level the operator at the ASP will continue to monitor CST decreases to less than level and initiate swapover to ESW when required.

A17 RNO minimum level, THEN D Per TS 3.7.6, the CST isrequired to contain 281,000 N/A N/A No N/A do Steps A15.b and gallons of water, which is sufficient to provide water to A15.c. the steam generators for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months at hot standby

2) Observe notes prior followed by plant cooldown to RHR entry conditions.

to Step A16 and Therefore, it is not expected that ESW will be needed continue with Step Al 6. until several hours into the event.

This step was added inOTSC 10-0093 as a result of condition report 31408. Step C16 has operators fully The timing basis Direct Available open the B ESW pump room supply damper and start depends on the Operator to Check 8 the supply fan. There are no operator actions taken ESW Pumphouse for the recirculation damper. This lineup may not be heat up or cool Temperature adequate during all times of the year. Inthe winter down to a point months, drawing in100% outside air with a closed Prior to room where the ESW A18 a. Check room recirculation damper could cause the room reaching wher the NA/

temperature greater temperature to drop below freezing. Inthe summer undesirable associated than 650F months, with the recirculation damper open, the room temperature components will not

b. Checkroom could heat up to an undesired temperature. The operate. See temperature less than temperature range of 65 to 90 degrees F ensures the Section 6.5 for 90OF room temperature remains within the required range. discussion about These are interim actions until a permanent resolution room cooling.

is determined. Condition Report Action 30350-02-06 is tracking the resolution of this issue.

Design Basis Document for Procedure OFN RP-017 Page 46 of 102 E 1-FOB-,Rev. -

TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note )(rain) Complete (Note 2) Steps (Note 1)

a. Perform the following:

1) Open breaker This RNO performs the necessary steps to ensure the NG06EEF4 to stop B Train B ESW pump room temperature remains within ESW Pumphouse the required range. These steps are performed Supply Fan locally. Opening NG06EEF4 will de-energize the supply fan and allow the room to heat up ifthe

2) WHEN temperature temperature drops below 650F. When the The timing basis reaches 100°F, THEN temperature reaches 100 0 F,the operator will re-start depends on the close breaker the fan. time for the room to NG06EEF4 to start B heat up or cool ESW Pumphouse When the room temperature reaches 110 0 F,the down to a point Supply Fan Prior to room where the ESW operator will open breaker NG06EBF208 to fail the reaching A18 RNO b. Perform the S recirculation damper closed, allowing 100% outside air pump and N/A N/A undesirable following: into the room to cool the room. When the temperature associated temperature drops to 650F, the operator will close breaker components will not

1) WHEN temperature NG06EBF208 to re-energize the recirculation damper operate. See reaches 110°F, THEN to allow it to open. Ifthe recirc damper does not open Section 6.5 for open breaker 8 on due to the fire inthe control room, then the operator discussion about NG06EBF2 to fail can perform the RNO for Step A16.a to increase the room cooling.

Recirc Damper closed. room temperature.

2) )WHEN temperature reaches These are interim actions until a permanent resolution 650F, THEN close is determined. Condition Report Action 30350-02-06 breaker 8 on is tracking the resolution of this issue.

NG06EBF2 to energize Recirc Damper.

Design Basis Document for Procedure OFN RP-017 Page 47 of 102 E 1FOB! , Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (Note 2) Steps (Note 1)(in)

Direct Available Operators To Perform This step is used whenever extra operators are Actions Of available to minimize damage to Train A equipment ATACHENSTO FAttachment F is not required by regulation, so its steps ACTIONS TO PROTECT TRAIN A are not evaluated inthis DBD.

EQUIPMENT The purpose of OFN RP-017 is to maintain hot Check plant standby conditions until the fire is under control and A20 cooldown - NOT N/A operations can be resumed from the control room. If N/A N/A N/A N/A the event duration does not allow the plant to be maintained inhot standby, then OFN RP-017A is entered, per the RNO.

Go to OFN RP-017A, HOT STANDBY TO A20 RNO COLD SHUTDOWN N/A If necessary, OFN RP-017A is entered to bring the N/A N/A N/A N/A FROM OUTSIDE THE plant to safe cold shutdown.

CONTROL ROOM NRC Draft Regulatory Guide DG-1214 dated April 2009, which is a proposed revision to RG 1.189, Section 5.5.2 has guidance for re-entering and re-A21 Check Fire Has Been N/A establishing control from the Control Room. Steps A- N/A N/A N/A N/A Extinguished. 18 through A-22 were added to OFN RP-017 to identify this guidance. CR 00016481 identified the need to add guidance for re-entry into the Control Room.

A21 RNO Do NOT continue until N/A Continuation inthe procedure is not allowed until the N/A N/A N/A N/A fire is extinguished. fire is extinguished.

Design Basis Document for Procedure OFN RP-017 Page 48 of 102 E 1FOS!, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note1)(rain) Complete (Note 2) Steps (Note 1)

A22 Check Control Room N/A See Step A19 Basis N/A N/A N/A N/A Habitable A22 RNO Do NOT continue untilHai Control Room is N/A Habitability must be established prior to allowing N/A N/A N/A N/A habitable. unprotected operators back into the control room.

A23 Assess Control Room N/A See Step Al 9 Basis N/A N/A N/A N/A Damage.

Perform Corrective Actions To Restore A24 Necessary Safety, N/A See Step A19 Basis N/A N/A N/A N/A Control And Information Systems To Functional.

Contact TSC To Develop Procedures To Transfer Control From Aux Shutdown Panel To The Main Control A25 Room And To Restore N/A See Step A19 Basis N/A N/A N/A N/A From Any Local Actions Taken Based On Review Of Actions Taken InThe Procedures Performed.

Proceed As Directed A26 By Station N/A N/A N/A N/A N/A N/A Management.

Design Basis Document for Procedure OFN RP-017 Page 49 of 102 E195,Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note )(rain) Complete (Note 2) Steps The RCPs are tripped to prevent damage to the seals upon loss of all seal cooling. Natural circulation is Locally Trip RCPs used to circulate coolant and to cooldown. Yes. The

PA0107 for RCP A The breakers are tripped by rotating the local hand breakers switch to the STOP position. For this to work, control Based on SA could

- TRIPPED 8 PA0108 for RCP B power needs to be available to each of the breaker 006, the RCPs are spuriously B1 - TRIPPED M control circuits. Control power is removed inSteps B4 7 assumed to be close until N/A

PA0205 for RCP C and B5 after this step is completed. tripped within 7 Steps B4 minutes. and B5

-TRIPPED

" PA0204 for RCP D Afire inthe control room could cause a loss of control are

- TRIPPED power and prevent opening the breakers with the local complete.

hand switch. The fire would have to be located in either panel RL021, SB030A or SB033A for this to occur.

Proceed TurbineeAndTo 2033 Tob3 After the RCPs are tripped, the operator proceeds to B2 Copy Of This N/A the emergency equipment locker and obtains a copy N/A N/A N/A N/A Pocu Of Thisof OFN RP-017.

Procedure.

Design Basis Document for Procedure OFN RP-017 Page 50 of 102 E1 FOB!5, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete (Note 2) Steps (Note 1)

(min)

Perform the following:

a. Obtain the following from emergency locker:

" Radio

" Flashlight A radio is required to ensure communication with the

b. Obtain pocket ion SRO at the ASP. Channel 1is used by Operations for chambers and an RDD communication. A flashlight will supplement fixed B3 from the emergency N/A Appendix R emergency lighting inthe event of a loss N/A N/A N/A N/A locker for personnel of off-site power.

entering the RCA Dosimetry is required for personnel entering the RCA.

Low-Range PIC 0-500 mR

" High-Range PIC 0-5R

RDD

c. Select Channel I on radio On PK41 OPEN Isolating DC control power to PA01 ensures cable breaker for DC damage will not cause the spurious closure of PA0107 See Section 6.2 84 control power to M or PA0108, causing the RCPs to start. Isolating N/A discussion about No N/A PA01 control power before step 81 is complete will prevent stopping the RCPs.

opening the breakers using the local hand switch.

PK4103 - OFF Therefore, Step B4 shall be performed after Step BI.

Design Basis Document for Procedure OFN RP-017 Page 51 of 102 E F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min)

On PK62 Open Isolating DC control power to PA02 ensures cable breaker for DC damage will not cause the spurious closure of PA0204 See Section 6.2 15 control power to M or PA0205, causing the RCPs to start. Isolating N/A discussion about No N/A PA02 control power before step 81 is complete will prevent stopping the RCPs.

opening the breakers using the local hand switch.

PK6204 - OFF Therefore, Step B5 shall be performed after Step BI.

Ensure RCP Breakers Are Tripped:

PA0107 for RCP A- TRIPPED See Section 6.2 B6 0 PA0108 for RCP M This step ensures the RCP breakers remain tripped N/A discussion about No N/A Bafter control power has been removed, stopping the RCPs.

PA0205 for RCP C - TRIPPED

PA0206 for RCP D - TRIPPED Check AL HV-36 CST to Turbine Driven AFP Suction Isolation 35 minutes Valve Open: Valve AL HV-36 is required to be open to ensure suction to the TDAFP from the CST. DCP 12170 to art See Section 6.3 for B7 a. Verify with SRO at D modified the control circuit to ensure a control room inject into timing basis for the No 5.c ASP that Step 5.c is fire will not damage the valve and prevent manual steam TDAFP.

complete. opening. generator B

b. Ensure AL HV-36 -

OPEN

Design Basis Document for Procedure OFN RP-017 Page 52 of 102 E 1F991 6, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) Note 1)(rain) Complete (Note 2) Steps 35 minutes The operator completing step B7 RNO will not to start the See Section 6.3 for B7 RNO a. Do not continue until D manually open AL HV-36 until it is verified that the pump and timing basis for the No 5.c step 5.c is complete. breaker is off. With the breaker on, a spurious signal inject into TDAFP.

can close the valve after it has been opened. steam generator B Descend To 1974'This step provides the operator with the most efficient B8 Elevation Via Ladders N/A path to get to the Auxiliary Building. Dosimetry for N/A N/A N/A N/A And Enter The RCA. entering the RCA is obtained inStep B3.

In NCP Room, Close CCP To Regen Hx Valves

a. Close Charging Header HCV-182 Inlet Isolation Valve See Section 6.2 for This step is required to prevent uncontrolled charging. timing basis for B9

BG-8402B - M Closing the valves ensures charging to the RCS 14 isltng normal No N/A CLOSED through the Regen Hx is isolated. charging.

b. Close Charging Header BG HCV-182 Bypass Valve

BG-V017 -

CLOSED

Design Basis Document for Procedure OFN RP-017 Page 53 of 102 E 1FA9916, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1)(min) Complete (Note 2) Steps (Note 1)

These valves are closed to prevent a steam bubble from migrating to the CCW piping when the CCW pumps are started. The valves are also closed to prevent cold CCW from being injected to the RCP thermal barrier when the CCW pump is started, which In North Mechanical could cause damage to the RCP seals. The CCW Pent Room, close pumps are not started until these valves are closed.

CCW FROM RCS As long as the valves are closed before starting the OUTER CTMT ISO CCW pumps, then there is no possibility of water VLVs to Isolate CCW hammer or seal damage.

From RCP Thermal Barriers a. Step 5.c opens the breaker associated with EG HV-61. After the breaker is open, control power is lost

a. Verify with SRO that and the valve cannot spuriously actuate. Ifthe Prior to the See Section 6.5 for b. 5.c Step 5.c is complete. breaker is confirmed open and the valve is closed, need for BI0 S then it is inthe desired position and will remain there supported discussion about No support systems. d. D9

b. Ensure EG HV throughout the event. Ifthe valve is verified closed systems.

CLOSED prior to ensuring Step 5.c is complete and the operator moves on to the next step, the valve could spuriously

c. Verify with Aux Bldg operate. Also see the discussion for Step 5.c.

that Aft D,Step D9 is complete. c. Step D9 opens the breaker associated with EG HV-133. After the breaker is open, control power is lost

d. Ensure EG HV-133 - and the valve cannot spuriously actuate. Ifthe CLOSED breaker is confirmed open and the valve is closed, then it is inthe desired position and will remain there throughout the event. Ifthe valve is verified closed prior to ensuring Step D9 is complete and the operator moves on, the valve could spuriously operate. Also see the discussion for Step D9.

Design Basis Document for Procedure OFN RP-017 Page 54 of 102 E 1F9916, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1)(m Complete in) (Note 2) Steps (Note 1)

a. Do not continue until Step 5.c is complete. b. 5.c The RNO ensures the operator does not continue until N/A N/A No B10 RNO

c. Do not continue until power is disconnected. d. D9 Att D,Step D9 is complete.

In Aux Bldg Filter Alley, Locally Close Valves To Isolate RCP Manual valves BG-V101 and BG-V105 isolate the seal Seals: injection lines and ensure spurious valve actuation will not restore seal injection. These valves are required 28 minutes

a. Seal Water Injection Filters Inlet Isolations. to be closed before charging is restored to prevent to start the See Section 6.2 for B11 M RCP seal damage and loss of RCS inventory. The charging timing basis for No N/A

BG-V101 PFSSD strategy for a control room fire is to not restore pump and charging.

BG-V105 seal cooling inorder to prevent a seal LOCA ifseal inject to the cooling is not restored promptly. Only one of these RCS.

b. Inform Reactor valves is open at a time but both are included because Operator that Steps either one could be open at the time of the fire.

B10 and Bl are complete.

Design Basis Document for Procedure OFN RP-017 Page 55 of 102 E 1FOB!5, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (Note 2) Steps (Note 1)

(min)

SA-08-006 shows all four MSIVs can stay open for at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months as long as there are no At RP209 Across other failures. This From North The action to pull this fuse was part of the original bounds the Mechanical licensing basis strategy for control room fire. The scenario where the B12 Penetration Room R,MD strategy was approved by the NRC inSupplement 5 of 60 bypass valves are No N/A Fail MSIV Bypass the SER. Pulling the fuse removes control power from open because the Valves Closed. the MSIV bypass valve circuit and fails the valves bypass lines are 2-closed. See Section 7.3.1 for more information. inch diameter

Fuse #46 - OFF whereas the main steam lines are 28-inch diameter. See Section 6.1 for discussion about MSIVs.

Verify BIT Isolation Step D4 opens the breaker for valve EM HV-8801 B, Valves open: ensuring the valve will not change position after it has been throttled.

a. Verify with person 28 minutes performing Aux Bldg Step D5 opens the breaker for valve EM HV-8801A, to start the actions that Attachment ensuring the valve will not spuriously open after it has charging See Section 6.2 for B13 D,Steps D4 through M been closed.

D5 recomleecontrol pump and timing basis for charging. No D4, D5 Valve EM HV-8801 B is throttled manually to prevent charging

b. Inthe North Piping overfilling the pressurizer. Ifthe valve were to fully ch ow.

Penetration Room, open with no letdown, the pressurizer would go solid flow.

locally Close "A" BIT and water would be lost to the PRT and eventually the OUTLET VALVE. floor of the reactor building. Therefore, the valve is manually throttled to control pressurizer level. The

Design Basis Document for Procedure OFN RP-017 Page 56 of 102 E 1FG8916, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note1)(mnin) Complete (Note 2) Steps

EM HV-8801A valve control circuit has been modified per DCP 12130 CLOSED to address NRC IN92-18

c. Inthe North Piping Valve EM HV-8801A is closed to prevent overfilling Penetration Room the pressurizer. DCP 13614 modified the valve locally throttle open BIT control circuit to address NRC IN92-18. Closing outlet isolation valve, valve EM HV-8801A or ensuring it is closed will prevent the pressurizer from going water solid.

EM HV-8801B THROTTLED OPEN

d. Notify the SRO that BIT is lined up for injection.

e. Throttle EM HV-8801B as directed by the SRO to control PZR level.

28 minutes a.arDonnoteconctinue6until to start the

a. Do not continue until The RNO ensures the operator does not continue until charging See Section 6.2 for B13 RNO D4 through D5 are M pump and timing basis for No D4 complete. power is disconnected to both valves. control charging.

charging flow.

Contact SRO At ASP B14 For Further Direction N/A N/A N/A N/A N/A N/A

Design Basis Document for Procedure OFN RP-017 Page 57 of 102 E 1F991 5, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note 1)(min) Complete (Note 2) Steps Evacuate Control Room:

a. Exit Control Room using north door

b. Ensure Control The operator exits through the north door and Room outer doors -AT retrieves his/her hard hat and proceeds to the NK LEAST ONE CLOSED: switchgear room.

C1 N/A N/A N/A N/A N/A

Normal outer door Ensuring one of the control room doors is closed prevents the fire from spreading beyond the control OR room.

Missile door

c. Proceed to NK switchgear rooms.

Design Basis Document for Procedure OFN RP-017 Page 58 of 102 E !FOS! 5, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq SNcti BS Complete (Note 2) Steps (Note 1) (amin)

Turn Off The One pressurizer PORV is assumed to fail open. Both Based on SA Following NK PORVs are failed closed by opening NK5108 and 006, the pressurizer Breakers: NK4421 to prevent loss of RCS inventory. PORVs need to be

NK5108 PORV BB closed within 3 PCV-455A Control NK5109 and NK4414 supply power to portions of minutes following Power- OFF RL0211RL022. Panel RL021/RL022 supplies power to reactor trip. This a number of loads including the reactor head solenoid assumes a single

" NK5109 MCB vent valves. Placing these switches inthe OFF PORV opens and CONTROL position will fail the solenoid valves closed, thereby no other spurious PANELS RL021 preventing loss of inventory through the reactor head actuations.

AND RL022 vents. Loss of power to the remaining loads supplied Therefore, NK5108, (Reactor Head Vent by these breakers will have no adverse impact on safe NK5109, NK4414 Valves) - OFF shutdown. Switches NK4414 and NK5109 are also and NK4421 need

" NK5119 MSFIS opened to de-energize other potential Separation to be opened within Cab SA075A - OFF Group 1 and 4 125VDC power sources that could 3 minutes.

C2 M,D cause the pressurizer PORVs to open inthe event of 3 No N/A

" NK4401 BUSNB02 multiple proper polarity hot shorts within The time required BRKR CONTROL RL021/RL022. to open NK5119 is POWER - OFF being analyzed by

" NK4413 MCB NK5119 supplies power to Train A MSFIS cabinet CR 045442-02-04.

CONTROL SA075A. Isolation of power to SA075A will close the PANELS RL019 main steam and main feedwater isolation valves. This The time required AND RL020 - OFF action was added as a compensatory measure for CR to open the 00045442, which identified the potential to overfill the remaining switches

" NK4414 MCB steam generators iffeedwater flow is not stopped ina inthis step is CONTROL timely manner. greater than 3 PANELS RL021 minutes so opening AND RL022 Control power for NB02 needs to be isolated before them within 3 (Reactor Head Vent the NB02 breakers are manipulated inStep C5. minutes will ensure Valves) - OFF Therefore, it makes sense to open the breaker inthis PFSSD.

step.

Design Basis Document for Procedure OFN RP-017 Page 59 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min)

NK441O6 S.S. NK4413 supplies power to the following PFSSD PROTECTION components: 1)Train B diesel generator room SYSTEM OUT 2 exhaust damper actuator GM HZ-1 9; 2) Solenoid CABINET SB032D actuators for radwaste building CCW supply/return (Steam Dumps) - header supply valves EG HV-70A and EG HV-70B; OFF and, 3) Train B CCW temperature control valve EG

" NK4421 BB PCV- TV-30. Loss of power to GM HZ-19 will fail the 456A PORV (PORV damper open, which is the desired position. Loss of Control Power) - power to EG HV-70A/B will fail the valves closed, OFF which is the desired PFSSD position. Loss of power to EG TV-30 will fail the valve closed, allowing maximum cooling inthe CCW system which will not adversely impact PFSSD. Loss of power to other components supplied by NK4413 will not adversely impact PFSSD.

NK4416 supplies power to the steam dumps. Placing NK4416 inOFF isolates the steam dumps and prevents uncontrolled cooldown and return to criticality ifthe MSIVs fail to close.

Proceed to NB02 Prior to performing remaining steps, the Operator C3 Switchgear Room N/A proceeds to the emergency locker and obtains a copy N/A N/A N/A N/A And Obtain A Copy Of of OFN RP-017.

This Procedure.

Design Basis Document for Procedure OFN RP-017 Page 60 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RPo017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS impact? Prereq (Note )(rain) Complete (Note 2) Steps (Note 1)

Perform the following:

a. Obtain the following from the emergency Aradio is required to ensure communication with the C4 locker: N/A SRO at the ASP and other operators. Channel 1 is N/A N/A N/A N/A used by Operations for communication. Aflashlight

" Radio supplements fixed battery powered emergency lights.

Flashlight

b. Select Channel 1 on radio.

Ensure Train B Pump Breakers - OPEN

NB0207 - OPEN This step sheds large loads from the NB02 bus and is The timing for this

" NB0206 - OPEN required prior to starting the Train B diesel generator Prior to the step is based on C5

N00 PNdieselinStep C6. need for the need for the No 02

" NB0204 - OPEN disl supported PFSSD

" NB0203 - OPEN Step C2 isolates control power to the NB02 bus and generator equipment.

" NB0202 - OPEN ensures the breakers do not spuriously close.

" NB0201 - OPEN

Design Basis Document for Procedure OFN RP-017 Page 61 of 102 E 1FOB!5, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note 1)(min) Complete (Note 2) Steps This action isolates off site power to the NB02 bus and The timing for this causes the diesel generator to automatically start on step is based on Ensure Feeder bus under voltage. The emergency generator is the need for the Breakers To NB02 - started to energize PFSSD equipment needed Prior to the supported PFSSD 06 OPEN throughout this procedure. need for equipment. The No 02,05

- OPEN Step C2 isolates control power to the NB02 bus and diesel most limiting time is

, NB0209 NB0212 - OPEN ensures the breakers do not spuriously close, generator restoring SN 1pressurizer backup group B heaters in Step C5 needs to be completed to prevent overloading the diesel generator. Step A7 RNO.

This step energizes relays ESA and ESB on the Train B diesel generator engine control circuit (E-1 3KJ03A).

Ensure ESA And ESB The Wolf Creek licensing basis for control room fires assumes only a single spurious actuation occurs as a Relays - Energized result of the fire. Therefore, itcan be assumed that one of the two relays will energize. The timing for this

a. Remove the break step is based on glass cover from With at least one relay (ESA or ESB) energized, the the need for the the EMERGENCY unit parallel relay (UPR) will be de-energized (E- Prior to the supported PFSSD START SA 13NE13). Therefore, the diesel generator will not be need for equipment. The No C2, C5 07 pushbutton, to indroop mode and will function properly as PFSSD diesel most limiting time is energizethEsA loads are added. generator restoring and ESB relays. pressurizer backup

KJ HS-101D - Also, with one relay (ESA or ESB) energized, relay 90 group B heaters in BEK GS S VEP will be energized which will switch the electronic Step A7 RNO.

COVER voltage adjuster to a pre-determined setpoint and REMOVED ignores signals from the control room auto/manual raise/lower switches. This ensures a fire inthe control room will not affect the output voltage of the EDG during the event.

Design Basis Document for Procedure OFN RP-017 Page 62 of 102 E-1F991 6, Re".

TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1) Complete T BI t?2 Steps (min) (Note 2)

Align EDG B To Bus

a. At panel KJ122, place CR Fire Iso After loads are shed from the NB02 bus, and the Switch inisolate. NB02 feeder breakers are opened, the Train B diesel generator will automatically start and load to the bus

KJ HS-110-ISO when NB0211 is closed. Placing KJ HS-109 in LOC/MAN allows for local voltage regulation and also

b. Check Diesel - Yes. A isolates portions of the control circuit from the control STARTED control room. Local voltage regulation is not credited for room fire PFSSD and is disabled by actuation of the emergency

c. Ensure Master could start switch in Step C7.

Transfer Switch is in prevent an LOC/MAN automatic DCP 12097 was implemented to add another KJ HS-Prior to the See Section 6.5 for start of the

KJ HS-109- 109 contact to the control room stop circuit to ensure a need for timing basis Train B C8 S control room fire will not shut the EDG down during N/A LOC/MAN diesel associated with EDG. The the event. Inaddition, DCP 12097 added KJ HS-110 generator EDG cooling. RNO

d. At Panel NE106 and redundant fuses to ensure power is available to provides a Check Indicator Light the field flashing circuit. However, CR 30350 method to IL LIT identified an issue where certain fuses located in start the NE106 could blow, preventing field flashing. Step engine ifit

e. Close EDG Output C8.d and accompanying RNO was added to address does not Breaker this concern inthe interim until a permanent auto start.

modification is implemented. CR 30350-02-04 is

NB0211 - tracking the implementation of the modification.

CLOSED Closing the EDG output breaker after the EDG is

f. Check NB02 voltage started energizes the NB02 bus.

on breaker NB0201 normal 3.95- 4.32 kv.

.1_________ J _____________ L _______ I ______

Design Basis Document for Procedure OFN RP-017 Page 63 of 102 E-IF9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP.017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note )(rain) Complete (Note 2) Steps (Note 1) b.Perform the following:

1) Obtain handle from emergency locker

2) Place handle on either Air Start Valve: The RNO for Step C8.a provides an assured method for starting the Train B diesel engine if itdoes not

Northeast end automatically start. Another method would be to use between cylinders the emergency start switch, but this method may not and turbocharger work because of possible fire damage. Therefore, the RNO directs operators immediately to the assured OR method to minimize the time to start the engine.

The timing for this Prior to the

Southwest end step is based on The RNO for Step C8.d provides instructions to need for C8 RNO S the need for the No N/A between cylinders restore power to the voltage regulator and excitation diesel supported PFSSD and generator system circuit shown on drawing M-018-00636. generator equipment.

Placing KJHS0109 inLOCAL/MAN inStep C8.c

3) Pull handle down prevents the new fuses from blowing when they are until diesel starts inserted. Manual voltage control switches NEHS0014B and NEHS0016B are not used inOFN

d. Perform the RP-017 and their contacts will remain open. This is following: an interim compensatory measure until a permanent modification is implemented.

1) Obtain new 15 amp fuses (two) from EDG emergency locker.

2) At panel NE106, open bottom cabinet third from left door.

Design Basis Document for Procedure OFN RP-017 Page 64 of 102 E-1 FS915-1

, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact?

(Note 1) Complete (rain) (Note 2) Steps

3) Remove unmarked fuse block directly below Agastat.

4) Replace both 15 amp fuses and reinsert fuse block.

The ESW system supplies cooling water to the This step starts the emergency diesel engine cooler, the component ESW pump. Step cooling water heat exchanger and various room C12 closes the Ensure ESW Pump B coolers. The ESW system is also a backup source of Prior to the service water cross Breaker - CLOSED auxiliary feedwater. need for tie valve to prevent C9 needpfor flow diversion from No C2 NB0215 - NB0215 is normally open. Breaker control power is supported ESW to SW. See CLOSED isolated inStep C2. Ifthe breaker did not close in Section 6.5 for response to the load sequencer signal, Operators can timing basis close the breaker by pushing the manual close push associated with button. EDG cooling.

This step starts the ESW pump. Step C12 closes the Perform Attachment G Attachment G is included to provide instructions to service water cross 09 RNO to charge the closing operators to charge the closing springs ifthe breaker N/A tie valve to prevent springs and manually does not close. See the discussion regarding ESW to SW. See close NB0215. Attachment G basis at the end of this table. Secto 6. for Section 6.5 for timing basis associated with EDG cooling.

Design Basis Document for Procedure OFN RP-017 Page 65 of 102 E -IF9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1)(min) Complete (Note 2) Steps (Note 1)

The Train B 480 VAC load centers and MCC breakers are not shed from the NB02 bus. Therefore, the listed breakers could remain closed. Ifthe breakers open as a result of a control room fire, this step ensures they are closed.

Step C2 disconnects control power from the NB02 bus and ensures the breakers do not spuriously open after they have been closed.

Ensure Load Center and ESW Pumphouse NB0208 powers XPG022. PG2201 is cycled inStep MCC Breakers -

A7 (RNO) to operate the pressurizer heater backup The required time CLOSED:

group B. See Step A7 RNO discussion for more to complete this information. Prior to the step is based on

NB0208-need for the time to place C10 CLOSED S No 02 NB0210 powers XNG04. NG0401 is closed inStep supported the supported

NB0210-C13 to energize NG04. See Step C13 discussion for components systems inservice.

CLOSED more information on NG04. See Steps A7 RNO,

NB0213-C11, C13 and C17.

CLOSED NB0213 powers XNG02. NG0201 is closed inStep

" NB0216 -

Cl to energize NG02. See Step ClI discussion for CLOSED more information on NG02.

NB0216 powers XNG06, which energizes Train B ESW pumphouse MCC NG006E. MCC NG006E powers a number of components required to ensure Train B ESW pump operability. The Train B ESW pump is directly powered from NB0215 and does not require NG006E to be energized.

Design Basis Document for Procedure OFN RP-017 Page 66 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (Note 2) Steps (Note 1) (min)

Perform Attachment G Attachment G is included to provide instructions to C10 RNO to charge the closing S operators to charge the closing springs ifthe breaker N/A N/A N/A N/A springs and manually does not close. See discussion regarding Attachment close the breakers. G basis at the end of this table.

This step is performed to ensure power is available to PFSSD components supplied by NG02. Power is provided to NG02 by NB0213. NB0213 is verified closed inStep C10. NG02 supplies power to a number of PFSSD components, but only a few are Isolate NG0201 Trip needed for OFN RP-017. These include:

Circuit On NG0201 AND Close Breaker::

EF HV-32

EF HV-34 The required time

a. Position NORMAL

EF HV-46 to complete this ISOLATE switch to

EF HV-50 step is based on ISOLATE 0 SGK05B the time to place

NG HIS ** DSGL12B XNN06 Prior needtoforthe the supported thsupre C NGHISO1T S Xsystems inservice. No N/A CISOLATE BN HV-8812B supported See Steps C12,

BG LCV-112C systems C17, C18, C19,

b. On NG02, ensure

EF HV-26 C20, C21, C23, D8, Load Center NG02 0 EF HV-38 D11, D12, D13, Main Breaker-

BG HV-81 11 D14, D21.

CLOSED

BN LCV-112E

DSGN01B

NG0201 - 0 DSGL15B CLOSED Placing NG HIS-15 inisolate position will isolate the trip circuit and prevent a spurious breaker trip after the breaker has been closed. The hand switch needs to be operated first before manually closing the breaker to ensure a trip does not occur.

Design Basis Document for Procedure OFN RP-017 Page 67 of 102 E *FOFS!6, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1)(min) Complete (Note 2) Steps (Note 1)

EF HV-32, EF HV-34, EF HV-46 and EF HV-50 are opened inSteps DlI through D13 to provide a flow path to/from ESW to the Train B containment coolers.

SGK05B is required to provide cooling to Class 1E electrical equipment rooms. The unit is started inStep D21 after all required lineups are made.

DSGL1 2B is the Train BCCP room cooler fan motor.

The pump room cooler provides a suitable ambient air temperature for the CCP motor. The cooler starts automatically when the pump motor starts. Failure of the room cooler to start does not prevent operation of the pump. The CCP is started in Step C23. ESW is lined up inStep C17.

XNN06 is required to energize NN02 to provide long-term power to panels RP147A and RP147B. 125 VDC battery sets NK012 and NK014 provide the short-term power needs for these panels. The batteries are sized to supply power to all emergency loads for 200 minutes following loss of AC power per E-10NK, at which time the alternate power source will need to be lined up.

BN HV-8812B is closed in Step C18 using BN HS-8812B. Step Cl 1 is performed prior to C18, so power will be available when the operator performs Step C18.

BG LCV-l 12C needs to be closed Drior to starting

Design Basis Document for Procedure OFN RP-017 Page 68 of 102 E-IF991-, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS impact? Prereq (Note 1)(min) Complete (Note 2) Steps (Note 1)

Train B CCP to ensure hydrogen is not introduced into the CCP suction. The valve is closed inStep C20 using BG HS-1 12C. Train B CCP is started inStep C23.

EF HV-26 is closed inStep C12 using ISO/CLOSE switch EF HS-26A to prevent ESW flow diversion to the service water piping.

EF HV-38 needs to be open to ensure a full flow return path from ESW to the UHS. EF HV-38 is fully opened inStep C17 by placing EF HS-38A in ISO/OPEN position. Power needs to be restored prior to the need for this valve to be fully open.

BG HV-81 11 is required to be open to prevent Train B CCP damage during low flow conditions. BG HV-8111 is opened inStep C21 by placing BG HS-81 11A inISO/OPEN position.

BN LCV-1 12E is required to be open to provide a suction source from the RWST to the Train B CCP.

BN LCV-1 12E is open inStep C19 by placing BN HS-112E inISO/OPEN position.

DSGN01 Bneeds to be energized for containment cooling. The coolers are started inStep D14.

DSGL15B is the Train Belectrical penetration room cooler and is started in Step D8.

Design Basis Document for Procedure OFN RP-017 Page 69 of 102 E 1IF991, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq SNcti BS Complete (Note 2) Steps (Note 1) (min)

The limiting time is At NGO2AHF2, based on the need Position NORMAL This valve isolates the service water system and to establish EDG ISOICLOSE For ESW prevents flow diversion from ESW to the service water See Section cooling. While Step ISOicLE Foter EWpiping. This valve needs to be closed to ensure 6 5 for timing C8 ensures the C

BlCro nc tC1 Vaver adequate flow to the required ESW loads. Step Cl1 EDG SteoCC6is running, ptetill Toss-OCone aleros Cnec Sassociated restores power to the MCC cubicle for this valve. Step potentially To ISOICLOSE with EDG S cooling, causes an EF HS-26A - DCP 12170 modified the control circuit for EF HV-26 automatic start.

ES-26A to address NRC IN92-18 concems. See Section 6.5 for ISO/CLOSE discussion on ESW and EDG cooling.

This step is performed to ensure power is available to Isolate NG0401 Trip PFSSD components supplied by NG04. NG04 Circuit On NG0401 supplies power to a number of PFSSD components, AND Close Breaker: but only a few are required to be energized for OFN RP-017. These include:

a. Position NORMAL The required time ISOLATE switch to

AL HV-5 to complete this ISOLATE

AL HV-30 stecompleteethis

& AL HV-33 Prior to the step is based on C13 C NG HIS ISOLATE

AL HV-34 DSGF2B need for supported the time the to place supported No N/A ISOLTE DGF2Bsupprted systems inservice.

EM HV-8803B systems See Steps A4, As,

b. On NG04, ensure

DSGL11B A17, C14, C22, Load Center NG04 0 EF HV-52 A28, C44anC22, Main Breaker -

EF HV-60 C28, D4 and D14.

CLOSED

EG HV-16

EG HV-54

NG0401 -

DSGN01D CLOSED 0 DPJE01B

Design Basis Document for Procedure OFN RP-017 Page 70 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1)(min) Complete (Note 2) Steps (Note 1)

Placing NG HIS-16 inisolate position will isolate the trip circuit and prevent a spurious breaker trip after the breaker has been closed. The hand switch needs to be operated first before manually closing the breaker to ensure a trip does not occur.

AL HV-5 needs to be opened to supply auxiliary feedwater to steam generator D. The valve is opened inStep A5 by placing AL HS-5 inLOCAL and AL HK-5B inOPEN. Power needs to be restored before the valve will operate.

AL HV-30 needs to be opened to supply suction to the Train B MDAFP when the CST reaches low level.

This is not a time critical step since the CST has sufficient volume for PFSSD. See Step Al 5 discussion.

AL HV-33 needs to be opened to supply suction to the TDAFP when the CST reaches low level. This is not a time critical step since the CST has sufficient volume for PFSSD. See Step A15 discussion.

AL HV-34 needs to be opened to ensure a suction supply from the CST to the Train B MDAFP. The valve is opened in Step A4 by placing AL HIS-34B in OPEN position. Step C13 needs to be completed before the valve will open.

DSGF2B is the Train B MDAFP room cooler. The room cooler provides a suitable ambient air temoerature for the eauiDment inthe room. The

Design Basis Document for Procedure OFN RP-017 Page 71 of 102 E-1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq SNcti BS Complete (Note 2) Steps (Note 1) (min) cooler starts automatically when the pump starts as long as power is available to the cooler motor. Power is established in Step C13. See Section 6.5 for discussion about room cooling.

EM HV-8803B is opened inStep D4. Step C13 needs to be performed prior to the need for charging.

DSGL1 1B is the Train B CCW pump room cooler.

The room cooler provides a suitable ambient air temperature for the equipment in the room. The cooler starts automatically when either Train B CCW pump starts as long as power is available to the cooler motor. The CCW pumps are started inStep C22.

EF HV-52 is opened inStep D4 by placing EF HS-52 inISO/OPEN position, EF HV-52 needs to be open prior to the need for CCW. The CCW system is needed for CCP oil cooling and provides cooling water to the seal water heat exchanger. The Train B CCP is started inStep C23.

EG HV-16 and EG HV-54 are opened inStep D4 by placing EG HS-16A and EG HS-54 inISO/OPEN position. EG HV-1 6 and EG HS-54 need to be open to ensure CCW to the seal water heat exchanger prior to starting the Train B CCP. The seal water heat exchanger provides cooling for CCP recirc flow and is needed to ensure operability of the CCP. The Train B CCP is started in Step C23.

DSGN01 Dneeds to be enerqized for containment

Design Basis Document for Procedure OFN RP-017 Page 72 of 102 E 1FG95115, Revr. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete TIMIN BS Steps (Note 1)

(min) (Note 2) cooling. The coolers are started in Step D14.

DPJE01B needs to be energized to ensure Train B fuel oil transfer pump operability. The transfer pump is started inStep C28.

Start Motor Driven a. Step A4 is required to be completed to ensure an aadequate suction source to the ADW pump pior to starting the pump. Step A5 is required to be

a. Verify SRO performed to ensure AFW flow from Train B MDAFP performing Attachment to steam generator D. IfStep A5 is not complete A has completed steps before performing this step, there is no adverse thatSA08006 pFSis A4 through A5. impact since water will recirculate back to the CST. assured ifAFW is 01b.Sar.oo Die b. Th DF B isssatdbuhn The MDAFP h manual started by pushing the aul15 established to D steam generator No C2, A4 C14 b. Start Motor Driven D close push button at NB0205. Although control power 15 minutes.

AFW pump B is isolated, the springs are charged and ready to See Section 6.3 for NB0205 - operate, discussion about CLOSED AFW.

Step C2 isolates control power to the NB02 bus and

c. Notify SRO that prevents a fire inthe control room from spuriously Motor Driven AFW opening NB0205 after it has been closed.

Pump B is running

Design Basis Document for Procedure OFN RP-017 Page 73 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete (Note 2) Steps (Note 1)

(min)

a. DO NOT a. This RNO ensures the operator does not continue SA-08-006 shows CONTINUE until steps until AFW Pump B valve alignment is complete in that PFSSD is A4 through A5 are Steps A4 and A5. assured ifAFW is complete, 15 established to 0 steam generator No 02, A4 C14cRNO b. Ifthe breaker re-opens after it has been closed or

b. Perform Attachment the springs are not charged, manual charging will be within 15 minutes.

b. Pfoharge Atachmelint required to get the breaker to close. Attachment G witin 1 .3ifor Gto charge the closing provides the method to manually charge the springs. See Section 6.3 for springs and manually See discussion regarding Attachment G basis at the discussion about close NB0205 end of this table. AFW.

Itis assumed that the Train A containment spray Ensure Containment pump is operating Spray Pump A is and valve stopped: This step ensures the Train Acontainment spray ENHV0006 is open caine pump is not running and depleting the RWST

a. Remove CLOSE inventory. The Train Bcontainment spray pump is containment spray.

control power fuse (UC) isolated inStep C5. E-1F9910 (see Fire Area C-22) shows C15 NB0102/FUSE - M Pulling the fuse isolates control power from the circuit 67 that with 1 No N/A OFF to prevent a control room fire from closing the breaker. containment spray This action was approved by the NRC based on its pump operating and

b. Stop Containment inclusion inSLNRC-84-0109 (See Phase E action 18 flowing water to the Spray Pump A and Note 20 inSLNRC 84-0109) header, operators have 67 minutes to SNB0102 - OPEN stop the pump before the RWST level falls below that required for safe shutdown.

Design Basis Document for Procedure OFN RP-017 Page 74 of 102 E-11FAOBIS, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note 1)(min) Complete (Note 2) Steps East Of NG02A, Align ESW Pump Room Ventilation:

ESW pump room ventilation maintains the ESW pump

a. Position NORMAL room temperature within required limits. Based on the ISO/OPEN switch for Wolf Creek TRM, Table TR 3.7.22-1 the maximum The timing basis ESW Pump Room temperature inthe Train B ESW pump room is 149 F depends on the Supply Damper to before equipment is declared inoperable. Maximum time for the room to ISO/OPEN allowable sustained temperature inthe room is 119 F. Prior to room heat up to a point Step C9 starts the ESW pump. Step C10 energizes reaching where the ESW C16

GD HS-11A - S the Train B ESW pump room MCC. undesirable pump will not No N/A ISO/OPEN temperature operate. See GD HS-1 1A isolates power to the ESW pump room Section 6.5 for

b. Position NORMAL supply damper and fails itopen, which is the desired scuon abou ISO/RUN switch for position. room cooling.

ESW Pump Room Supply Fan to GD HS-1 1 starts the supply fan, isolates the control ISO/RUN room circuits and inserts a redundant fuse.

GDHS ISO/RUN Return flow from the ESW system to the UHS is The timing basis At NG02AHF3, required for diesel generator cooling, class 1E depends on the position NORMAL electrical equipment room cooling, auxiliary feedwater limiting time to ISOIOPEN Switch For pump room cooler, centrifugal charging pump room Prior to the establish full flow in ESW To UHS Isolation cooler, electrical penetration room cooler, containment need for full the ESW system.

C17 Valve To ISO/OPEN. air coolers, component cooling water heat exchanger flow inthe The valve needs to No N/A and component cooling water pump room cooler. EF ESW system be fully open prior EF HS38A - HS-38A isolates the control room, adds a redundant to establishing ISO/OPEN fuse inthe circuit and fully opens valve EF HV-38. CCW heat Valve EF HV-38 is maintained partially open (66%) exchanger and during normal operation and fully opens on SIS or containment air

Design Basis Document for Procedure OFN RP-017 Page 75 of 102 E 1F9916, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note )(rain) Complete (Note 2) Steps (Note 1)

LOSP. A fire inthe control room could cause a short cooler flow, since that bypasses the control room handswitch and the total flow to signals the valve to close. However, based on these systems is drawing E-13EF06A and E-025-00007, Sheet 185, the 11,350 gpm per valve will not fully close because limit switch contact calculation EF-10.

ZS/1 6 prevents the valve from closing past the 66%

setpoint. See Section 6.5 for discussion about The ESW loads that are necessary shortly after the CCW and diesel generator is started inStep C8 are diesel containment generator cooling, class IE electrical equipment room cooling.

cooling, auxiliary feedwater pump room cooler and electrical penetration room cooler. Based on calculation EF-10, the flow rates for each of these components are: diesel generator cooling (1,200 gpm), class 1E electrical equipment room cooling (66 gpm), auxiliary feedwater pump room cooler (128 gpm) and electrical penetration room cooler (100 gpm). The total flow to these loads is 1,494 gpm. As stated above, valve EF HV-38 will be approximately 66% open which is more than adequate to flow 1,494 gpm through this 30 inch valve. Therefore, Step C17 does not have to be performed to establish ESW flow to these loads.

Step C17 will need to be completed before the remaining loads are needed to ensure full flow inthe ESW system is available.

Design Basis Document for Procedure OFN RP-017 Page 76 of 102 E 1FOB!S, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1)(min) Complete (Note 2) Steps (Note 1)

At NG02AFF4, Calculation XX-E-Position NORMAL 013 shows there is ISO/CLOSE Switch This action prevents or mitigates a loss of RWST 28 minutes i For RWST To RHR inventory to the containment sump. The hand switch 28 minutes C18 Pump B ISO Valve To R,M isolates the control room, inserts a redundant fuse in 28 RWST drains to a No N/A ISOICLOSE. the control circuit and closes the valve. Step Cll level below that restores power to the MCC cubicle for this valve, required for cold

BN HS-8812B-shton shutdown.

ISO/CLOSE On NG02AHR3, Open This step aligns the RWST to the Train B CCP. DCP OnT NGo2AR, B12175 Open added a control room isolation switch and See Sections 6.1 RSuction CCP: Bredundant fuse at NG02AHR3 for this valve. This Prior to the and 6.2 for C19 R, M ensures valve BN HV-112E will open (ifclosed) and need for discussion about No N/A

BN HS-112E - remain open throughout the event when BN HS-1 12E charging charging.

ISO/OPEN is placed inthe ISO/OPEN position and power is restored in Step Cl 1.

At NG02AFR2, Close This valve is isolated before starting the charging VCT OUTLET ISO pump to prevent hydrogen gas intrusion into the See Sections 6.1 Valve. pump. DCP 12131 added a redundant fuse inthe Prior to the and 6.2 for C20 R, M control circuit to ensure control power is available need for discussion about No N/A BG HS-112C - when the hand switch is placed inISO/CLOSE. This charging charging.

ISO/CLOSE ensures the valve will close inresponse to hand switch actuation after NG02 is energized inStep C11.

At NG02AHRI, open This valve is required to be open to protect the Train B At NG8111 operging CCP from overheating during low flow conditions.

BG HV.8111 Charging DCP 12175 added a control room isolation switch and See Sections 6.1 C21 Isolation Valve. M redundant fuse at NG02AHR1 for this valve. This need for and 6.2 for ensures valve BG HV-81 11 will open (ifclosed) and charging discussion about

BG HS-81 11A - remain open throughout the event when BG HS- charging.

8111 Ais placed inthe ISO/OPEN position and power is restored inStep C 11.

Design Basis Document for Procedure OFN RP-017 Page 77 of 102 E 1F991 5, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Prereq STEP DESCRIPTION Function (Nt )Complete BASIS To TIMING BASIS Impact?

(Note Steps (Note 1) (rain) (oe2 2) Steps The COW system is required to provide cooling to the Train B CCP oil cooler and the seal water heat exchanger. Both of these components support operation of the Train B CCP.

On NB02, Start One Step B1 0 closes the CCW outlet valves from the CCW Pump. thermal barrier. This protects the CCW piping against water hammer and prevents inventory loss through Prior to the See Section 6,5 for C22 B

a. Ensure Turbine the RCP seals. See Step B10 basis. need for discussion about No B10, C2 Building Aft B, Step supported CCW.

B10 is complete Step C2 isolates control power to NBO2 and ensures components NB0206 does not spuriously open after it has been

b. NB0206 - CLOSED closed.

Step C13 establishes power to the CCW pump room cooler and Step C17 completes lineup of ESW.

Therefore, room cooling will be available prior to starting the pump.

a. Perform the following: a. The RNO ensures the operator does not continue until the prerequisite steps are complete.

1) WHEN Att B, Step B10 is complete, THEN b.1 The RNO has the operator start CCW pump Dif perform Step C22.b. the B pump did not start. This RNO is included as an Prior to the See Section 6.5 for C22 RNO enhancement since the control room fire will not need for discussion about No B10, C2

2) Do not continue until prevent an operator from manually closing NB0206. supported CCW.

Step C22.b is components complete. b.2 This RNO provides instructions for manually charging the springs and closing the breaker ifit failed

b. Perform the to close or did not remain closed. See discussion following: regarding Attachment G basis at the end of this table.

Design Basis Document for Procedure OFN RP-017 Page 78 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP.017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1)(min) Complete (Note 2) Steps (Note 1)

1) IFNB0206 can NOT be closed, THEN close NB0207 to start CCW pump D.

2) IFno CCW pump can be started, THEN perform Attachment G to charge the closing springs and manually close breakers as necessary to establish one CCW pump running.

Design Basis Document for Procedure OFN RP-017 Page 79 of 102 EF99F-15, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP Complete (Note 2)

(Note 1)

(min)

Start CCP B:

a. Check RCP seal Seal cooling is no longer restored inOFN RP-017 due injection isolated and to the uncertainty inthe time before seal failure can CCW service loop occur. Therefore, prior to starting the CCP, operators aligned verify seal injection is isolated. Seal injection is isolated inStep 811.

Ensure B All B,Step The CCP oil cooler and seal water heat exchanger SA-08-006 shows 311, B1olaRCn s require CCW. Therefore, the CCW system needs to be started to C19, C23 complete M aligned prior to starting the CCP. Step C22 starts be started within 28C20, the CCW pumps. Steps D4 and D5 align the CCW 28 minutes. 6.1 Seeand Sections No C21, AND service loop to ensure adequate CCW flow to the CCP 6.2 for discussion C22, components. about charging. 04, D5

" Ensure Steps D4 Other required alignments are made by this operator through D9 CcW prior to performing Step C23. These alignments are service loop made insteps C11, C19, C20 and C21. After all alignment are alignments are made, the CCP breaker is closed to complete start the pump.

b. NB0201 - CLOSED

Design Basis Document for Procedure OFN RP-017 Page 80 of 102 E 1F991 , Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (Note 2) Steps (Note 1) (rain)

a. Perform the following:

1) WHEN RCP seal injection is isolated AND COW alignment is a. The RNO ensures the operator does not continue complete, THEN until the prerequisite steps are complete. theSA-08006p needshto perform Step bbhmiues 28 stree be started ihn228N/A within 23 RNO o23.b. M b. The RNO provides instructions for manually charging the springs and closing the breaker, ifit Sectins. and failed to close or did not remain closed. See 6.2 for discussion

2) Do Not continue abou charin until Step C23.b is discussion regarding Attachment G basis at the end of utlSe 2.isthis table. about charging.

complete.

b. Perform Attachment G to charge the closing springs and manually close NB0201 Inform SRO That This step ensures the SRO is informed that the pumps C24 CCW and CCP Pumps N/A are operating. N/A N/A' N/A N/A Have Been Started

Design Basis Document for Procedure OFN RP-017 Page 81 of 102 E 1-FS-151, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP.017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq Complete (rain) (oe2 2)

(Note ps (Note 1)

Calculation change notice AN-02-010-000-02 documents an analysis of the diesel generator room temperatures Right Of NG04D, without supply fan Align Diesel operation. The This step ensures adequate Train Bdiesel generator Generator Building calculation was room ventilation. The diesel generator room exhaust Ventilation: performed using 3 damper is failed open inStep C2 to ensure adequate different outside air

Position NORMAL diesel engine combustion air. The supply fan and temperatures (97, outside air intake damper are not required for ISO/RUN switch 100 and 105 F)and combustion air but are required for room cooling.

for DG Ventilation assumed the Supply Fan to starting room GM HS-11 Bis an ISO/RUN switch that operates the ISO/RUN temperature equals C25 S Train B diesel generator room supply fan CGM01 B. 155 No N/A the outside room The switch isolates the control room, adds a o GMHS-11B- temperature (very redundant fuse inthe circuit and starts the fan. The ISO/RUN conservative). The fan is powered from NG04DBF6 which is energized in calculation shows

Open feeder Step C13. that even at a breaker to GM TZ- starting room Opening NG04DEF1 11 will cut power to GM TZ-1 1A 11A temperature of 105 and fail the damper open. This damper is on the F,it takes 155 o NG04DEF111- outside air intake for the room supply fan.

minutes to reach OFF the diesel generator design temperature of 122 F.

I

________ L _______________________________________ __________ I _______________ I ________ _______

Design Basis Document for Procedure OFN RP-017 Page 82 of 102 E !FOB! 6, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1)(min) Complete (Note 2) Steps (Note 1)

For the excess letdown flow path to open, it would take spurious operation of at least 3 valves.

Isolate Possible RCS Flow would be Leakage Paths:

limited to the volume that can

a. On NK41, open flow through the 1" NK4119, MCB excess letdown CONTROL PANELS pipe. The RL001 AND RL002 to NK4119 and NK4407 supply power to portions of pressurizer level is close Excess Letdown RL001/RL002. Panel RL001/RL002 supplies power to typically held at 55 Heat Exchanger Valves a number of loads, including the excess letdown heat to 60%. After a trip, 0 exchanger valves. Loss of power to these valves will the volume will NK4119- OFF fail them closed, preventing inventory loss through this shrink due to RCS C26 M 37 No N/A path. cooldown to 561 F.

b. On NK44, open Based on SA NK4407, MCB Loss of power to the remaining loads supplied by 006, initial CONTROL PANELS these breakers inRL001/RL002 will have no adverse shrinkage is RL001 AND RL002 to impact. typically to 30%

close Excess Letdown NR. Per WCRE-03, Heat Exchanger Valves. 30% equates to 4,373 gallons. The

NK4407-OFF volume of water below the lowest level transmitter is 637 gallons.

Therefore, the inventory that can be lost before going off scale low is

Design Basis Document for Procedure OFN RP-017 Page 83 of 102 E 11FOB! 5, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1)(min) Complete (Note 2) Steps (Note 1) 3,736 gallons.

Assuming a maximum of 100 gpm lost through the excess letdown flow path, there is at least 37 minutes available to mitigate a failed open excess letdown flow path.

NK4411 supplies power to Separation Group 4 125 On NK44, Open vdc loads inRL023/RL024. These loads include NK4411, MCB blowdown valves BM HV-1 thru BM HV-4. SA-08-006 shows CONTROL PANELS Disconnecting power to these valves will fail them the blowdown C27 RL023 AND RL024 R, M,D closed, which is the desired position. 60 valves can remain No N/A For S/G Blowdown open for the Isolation Valves. Loss of power to the remaining loads supplied by this modeled duration of breaker will have no adverse impact. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

NK4411 -OFF Also see discussion inSection 7.3.1.a.

Design Basis Document for Procedure OFN RP-017 Page 84 of 102 E1IFOB! 6, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min)

Start EDG Fuel Oil Xfer Pump:

a. At NG04DDF3, The diesel engine At erNenyFO pla.e can run for at least place Emergency EQ 60 minutes using Transfer Pump Change package 12176 added hand switch JE HS- the fuel inthe day Isolation Switch in 21C to isolate the pump control circuit from the tank, given the Control Room. Inaddition, operation of the switch will redce lin NN/

Isolate.

C28 S insert a new fuse inthe circuit incase the main fuse 60 imposed onding No N/A JE HS-21C - opened as a result of the fire. This ensures the imposed on the ISOLATE transfer pump will start when JE HS-21B is placed in engine PFSSD.during Therefore, the RUN position. NG04 is energized inStep C13. this action should

b. At panel KJ-1 22, be completed within 60 minutes.

start Emergency Fuel Oil Transfer Pump.

_ JE HS-21B - RUN

Design Basis Document for Procedure OFN RP-017 Page 85 of 102 E-IF99115, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1) (Note )(rain) Complete (Note 2) Steps This step was added inOTSC 10-0093 as a result of condition report 31408. Step C25 has operators fully open the B EDG pump room supply damper and start The timing basis Check EDG B Room the supply fan. There are no operator actions taken depends on the Temperature for the recirculation adequate during all damper. Thisyear.

times of the lineupInmay not be the winter time for the room to heat up or cool

a. Check room months, drawing in 100% outside air with a closed Prior to room down to a point C29 temperature greater recirculation damper could cause the room reaching where the B EDG N/A N/A than 650F temperature to drop below freezing. In the summer undesirable and associated

b. Checkroom months, with the recirculation damper open, the room temperature components will not temperature less than could heat up to an undesired temperature. The operate. See 110°F temperature range of 65 to 110 degrees F ensures the discussion for Step room temperature remains within the required range. C25 for further These are interim actions until a permanent resolution discussion.

is determined. Condition Report Action 30350-02-07 is tracking the resolution of this issue.

Design Basis Document for Procedure OFN RP-017 Page 86 of 102 E~Re. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1) (Note 1)(min) Complete (Note 2) Steps

a. Perform the following: This RNO performs the necessary steps to ensure the

1) Open breaker Train B EDG room temperature remains within the NG04DBF6 to stop B required range. These steps are performed locally.

EDG Room Supply Fan Opening NG04DBF6 will de-energize the supply fan

2) WHEN temperature and allow the room to heat up ifthe temperature drops The timing basis reaches 900F, THEN below 650F. When the temperature reaches 900F, depends on the close breaker the operator will re-start the fan. time for the room to NG04DBF6 to start B heat up or cool EDG Room Supply Fan When the room temperature reaches 110 0 F, the down to a point operator will open breaker NG04DEF1 12 to fail the Prior to room where the ESW C29RNO following: recirculation damper closed, allowing 100% outside air reaching pump and N/A N/A into the room to cool the room. When the temperature undesirable associated drops to 650 F,the operator will close breaker temperature components will not 1)WHEN temperature operate. See reaches 1100 F,THEN NG04DEF1 12 to re-energize the recirculation damper to allow itto open. Ifthe recirc damper does not open Section 6.5 for open breaker 12 on Sction abor NG04DEF1 to fail due to the fire inthe control room, then the operator can perform the RNO for Step C29.a to increase the discussion about Recirc Damper closed, room temperature. room cooling.

2) )WHEN temperature reaches These are interim actions until a permanent resolution 650F, THEN close is determined. Condition Report Action 30350-02-07 breaker 12 on is tracking the resolution of this issue.

NG04DEF1 to energize Recirc Damper.

C30 Contact SRO at ASP N/A N/A N/A N/A For Further Direction N N/A

Design Basis Document for Procedure OFN RP-017 Page 87 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)(min)

The PFSSD strategy is to use BG LCV-459 and BG In Rod Drive MG LCV-460 to isolate normal letdown. Inorder to isolate sA 006the assumes Room Isolate Normal BG LCV-459 and BG LCV-460, PK5117 is placed in letdown isolation Letdown PK5117, RC the OFF position to disrupt power to these valves and valves are closed 01 &SUPPORT SYS. M fail them closed. This will also disrupt power to 7 within 7 minutes No N/A CONTROL PNL. auxiliary pressurizer spray valve BGHV8145 and fail and the auxiliary RL001 &RL002. the valve closed. This action will also disrupt power to spray valve is a number of other separation group 5 125 vdc loads in closed within 7

PK5117 - OFF RL001/RL002, but this will have no adverse impact on minutes.

PFSSD.

Proceed to Emergency Locker Procedure is required to complete remaining N/A N/A N/A N/A D2 2026' Level And N/A Attachment Dsteps.N/ NANA NA Obtain A Copy Of This Procedure.

Perform The Following:

a. Obtain the following from emergency locker: A radio is required to ensure communication with the SRO at the ASP and other operators. Channel 1 is

Radio used by Operations for communication. Aflashlight 03 " Flashlight N/A supplements fixed battery powered emergency lights. N/A N/A N/A N/A

" FR Jump Suit The FR jump suit is required to operate certain

" Circular soft jawed breakers. The soft-jawed pliers are required to pliers disconnect the amphenal connectors for the main steam isolation valves.

b. Select Channel 1 on radio

Design Basis Document for Procedure OFN RP-017 Page 88 of 102 E--1F9911, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1) (Note 1)(min)

EF HS-60 is placed inISO/CLOSE to close EF HV-60 and prevent flow imbalance inthe Train B ESW system. This valve is required to be closed since manual valve EF V-090 is throttled to provide the On NG04C, Perform correct cooling flow from Train B ESW through the the Following:

Train B CCW heat exchanger. With EF HV-60 open, the flow balance will be affected, possibly drawing

" At NG04CHF2, ESW from other essential components.

place EF HS-60 to ISO/CLOSE EG HS-16A is placed inISO/OPEN to open EG HV-16

" At NG04CJF3, and provide a return flow path from the service loop to place EG HS-16A to the Train B CCW pump suction. The valve is required ISO/OPEN to be open to ensure CCW flow to the seal water heat

" At NG04CKF1, See Sections 6.1 exchanger, which is required to ensure Train B CCP place EG HS-54 to Prior to the and 6.2 for timing operability. The valve will open when power is ISO/OPEN need for basis for charging.

restored to NG04 inStep C13. Placing the switch in D4 " At NG04CKF2, M,S charging and No N/A ISO/OPEN before power is restored will have no place EM HS- supported See Section 6.5 for adverse impact.

8803B to equipment timing basis for ISO/OPEN CCW and ESW.

EG HS-54 is placed inISO/OPEN to open EG HV-54

" Turn off and provide a supply flow path from the Train B CCW NG04CKF3, pump to the service loop. The valve is required to be EMHV8801 B BIT open to ensure CCW flow to the seal water heat DISCHARGE exchanger, which is required to ensure Train B CCP ISOLATION VALVE operability. The valve will not actually open until Bkr power is restored to NG04 inStep C1 3. Placing the

" At NG04CNF3, switch inISO/OPEN before power is restored will have place EF HS-52 to no adverse impact.

ISO/OPEN EM HS-8803B is placed inISO/OPEN to ensure Train B CCP flow to the RCS through the BIT. This is the only boration and inventory control flow path credited.

Design Basis Document for Procedure OFN RP-017 Page 89 of 102 E 1F22115, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1)(min) Complete (Note 2) Steps (Note 1)

The valve will not actually open until power is restored to NG04 inStep C13. Placing the switch in ISO/OPEN before power is restored will have no adverse impact.

NG04CKF3 is placed inOFF to prevent spurious operation of EM HV-8801B. DCP 12130 modified the control circuit for EM HV-8801 B to address NRC IN 92-18 concerns. Step B13 throttles EM HV-8801B.

EF HS-52 is placed inISO/OPEN to ensure a flow path from Train B ESW to the Train B CCW heat exchanger. The Train B CCW heat exchanger is required for CCP B oil cooler and the seal water heat exchanger, which are both required for CCP operability. The valve will not actually open until power is restored to NG04 inStep C13. Placing the switch inISO/OPEN before power is restored will have no adverse impact.

Valve EM HV-8801A is closed inStep B13 to prevent On NG01B, Isolate overfilling the pressurizer. Step D5 needs to be Power To EM HV- completed prior to Step B133 to prevent the valve from The timing basis to 8801A, BIT Outlet re-opening. This step was added as a compensatory close EM HV-D5 Valve M measure per CR 00045442, which identified the N/A 8801A is being No N/A potential to overfill the pressurizer ifthis valve were to determined by CR

NG01BER2 - OFF spuriously open as a result of a safety injection signal. 045442-02-04.

Closing valve EM HV-8801A or ensuring it is closed will prevent the pressurizer from going water solid.

Design Basis Document for Procedure OFN RP-017 Page 90 of 102 E-IF9915, Rev. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP.017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) Note 1)(rain) Complete (Note 2) Steps Locally Ensure CCW Return From Nuclear Auxiliary Components to Train EG HV-15 is closed to ensure flow is not diverted to A CCW Is Closed: the Train A CCW surge tank. The CCW lineup in OFN RP-01 7 maintains water flow from CCW to the excess Pror to the a) Verify with SRO at letdown heat exchanger. Therefore, Train B return need for See Section 6.5 for D6 ASP, that Step 5.c S flow could potentially flow into the Train A CCW piping supported timing basis for No 5.c is complete. if EG HV-1 5 is open. equipment CCW.

b) Ensure EG HV-15 (2026' AUX BLDG, Step 5.c opens the MCC breaker for EG HV-1 5 and ABOUT 30' needs to be completed before Step D5.

SOUTH OF CCW HX "A", BY WEST WALL) is closed.

a. DO NOT Prior to the See Section 6.5 for D6 RNO CONTINUE until Step The RNO ensures the operator does not continue until need for timing basis for No 5.c 5.c is complete p the prerequisite step is complete. supported COW.

equipment CCW.

Design Basis Document for Procedure OFN RP-017 Page 91 of 102 Em1FS151, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note 1)(min) Complete (Note 2) Steps With the SIS flow path open, it would take a considerable amount reduce of timet to This step ensures one of the two SIS test lines is isolated to prevent flow diversion through the test line. volume to below In South Electrical Penetration Room, Step D15 isolates the second line. Both valves are that needed for safe Place Boron Inj normally closed and fail closed on loss of power. shutdown. Per XX-UPstrame s Lirne Switch EM HS-8843 will isolate power to the valve and E-013, 214,260 Upstream Test Line fail it closed.

D7 NORM ISOICLOSE Switch To M 71 hours8.217593e-4 days 0.0197 hours 1.173942e-4 weeks 2.70155e-5 months gallons from can be lost No N/A witOchToS. The SIS test lines discharge into a common %inch fromthe RWST.50 gpm line. Flow would then pass two normally closed 3/4 lost through the 3/4" inch air operated valves before returning to the RWST SIS test line, it

. EM HS-8843 -

ISO/CLOSED or the RHUT. For the failure to occur, there would would take 71 have to be 3 spurious actuations, which is extremely hours to reduce unlikely and is not postulated for a control room fire. Tou tome a RWST volume to a level below that required for safe shutdown.

Design Basis Document for Procedure OFN RP-017 Page 92 of 102 E11FOS!5, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note 1)(min) Complete (Note 2) Steps On NG02B, Start Electrical Penetration Based on the Wolf Creek TRM, Table TR 3.7.22-1, the Room Cooler: allowable temperature inthe Train B electrical The timing of this penetration room is 101 F. The maximum step is based on

a. At NG02BAF2, temperature is 131 F. the time for the place Norm/Iso- Prior to room room to reach Run switch to ISO- Switch GL HS-35, when placed inISO/RUN position, reaching temperatures D8 RUN S will isolate the control room circuit and insert a reahn beyond operability No N/A redundant fuse. However, the unit will not start until unacceptable limits o the o GL HS the start push button is depressed, which will energize temperature equipment. See ISO-RUN the 42 coil, close the seal incontact and start the unit. Section 6.5 for Therefore, both GL HS-35 and the push button need discussion on room

b. At NG02BAF2, to be actuated to start the cooler. Step C13 cooling.

depress start establishes power to the cooler.

pushbutton On NG02B, Isolate Power To EG HV-133, Step B130 verifies EG HV-1 33 is closed after this step Prior to the D9 CCW RETURN HV-61 is complete. This valve is closed for the same reason need for discussion about No N/A BYPASS ISO VLV. that EG HV-61 is closed. See the discussion for Step supported C oW.

5.c. systems

NG02BHF1 - OFF This step provides confirmation to the RO that Step D9 has been completed.

Inform the Reactor See Step C22 for D10 Operator that CCW S Step C22.a requires the RO to confirm Step B10 is 28 timing basis for N/A N/A Alignment is complete. Step B10 cannot be completed until Steps CCW.

Completed 5.c and D9 are complete. When Steps 5.c, D9 and B130 are complete, the RO can start the CCW pump in Step C22.b.

Design Basis Document for Procedure OFN RP-017 Page 93 of 102 E 1F9115, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note1)(rain) Complete (Note 2) Steps (Note 1)

DCP 11086 added a control room isolation switch and redundant fusing at MCC cubicle NG02BHF3 for valve EF HV-34. This ensures the valve will open (ifclosed)

On NGU2BHF3, Open and remain open throughout the event when EF HS-ESW TO CTMT 34 is placed inthe ISO/OPEN position and power is See Section 6.5 for Isolation Valve: restored to NG02B. This valve is required to be open discussion about D11 S to ensure ESW flow to the Train B containment 60 containmentNo N/A

EF HS coolers. cooling.

ISO/OPEN Step Cll establishes power to load center NG02, which supplies power to cubicle NG02BHF3. IfStep D11 is performed prior to Step C11, there will be no adverse impact.

DCP 11086 added a control room isolation switch and redundant fusing at MCC cubicle NG02BHR2 for valve EF HV-46. This ensures the valve will open (if On NG02BHR2, Open closed) and remain open throughout the event when ESW FROM CTMT EF HS-46 is placed inthe ISO/OPEN position and See Section 6.5 for Isolation Valve: power is restored to NG02B. This valve is required to discussion about D12 S be open to ensure ESW flow from the Train B 60 containment No NIA SEFHS containment coolers. cooling.

ISO/OPEN Step COl establishes power to load center NG02, which supplies power to cubicle NG02BHR2. IfStep D12 is performed prior to Step Cl1, there will be no adverse impact.

Design Basis Document for Procedure OFN RP-017 Page 94 of 102 Er- I515, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Complete (Note 2) Steps (Note 1)

(min)

On NG02B, open ESW TolFrom CTMT Air DCP 12131 added control room isolation switches and Cooler Valves. redundant fuses at MCC cubicles NG02BDR1 (EF HV-32) and NG02BDR2 (EF HV-50) for these valves.

a. At NG02BDR1 open This ensures valves EF HV-32 and EF HV-50 will EF HV-32 ESW B To CTMT Air Coolers open (ifclosed) and remain open throughout the event when EF HS-32 and EF HS-50 are placed inthe See Section 6.5 for D13

EF HS ISO/OPEN position and power is restored to NG02B. 60 discussion about No N/A These valves are required to be open to ensure ESW containment flow to/from the Train B containment coolers. cooling.

b. At NG02BDR2 open Step Cll establishes power to load center NG02, EF HV-50 ESW B From which supplies power to cubicles NG02BDR1 and CTMT Air Coolers NG02BDR2. IfStep D13 is performed prior to Step

EF HS C11, there will be no adverse impact.

ISO/OPEN Start Containment DCP 12177 installed a redundant fuse inthe control Cooler Fans B and D: circuit for each fan so that, inthe event of a fire inthe control room, the fans will start when GN HS-9A and

a. At NG02TAF1, start GN HS-1 7A are placed inISO/RUN position and CTMT Cooler Fan B power is restored to NG02T and NG04T.

See SectionaboutN discussion 6.5 for 0 GN HS-9A - Step Cllestablishes power to load center NG02, D14 ISO/RUN S which supplies power to NG02TAF1. If Step D14 is N/A containment No NIA cooling.

performed prior to Step C11, there will be no adverse coig

b. At NG04TAF1, start impact.

CTMT Cooler Fan D Step C13 establishes power to load center NG04,

GN HS-17A - which supplies power to NG04TAF1. IfStep D14 is ISO/RUN performed prior to Step C13, there will be no adverse I impact. I

Design Basis Document for Procedure OFN RP-017 Page 95 of 102 E 1F9915, Rev.. 6 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note 1)(min) Complete (Note 2) Steps This step ensures one of the two SIS test lines is In North Electrical isolated to prevent flow diversion through the test line.

Penetration Room, Step D7 isolates the second line. Both valves are Place Boron Inj normally closed and fail closed on loss of power.

Downstream Test Switch EM HS-8882 will isolate power to the valve and DownsreamTestfail itclosed.

D15 Line NORM Switch to ISO/CLOSE M 71 hours8.217593e-4 days 0.0197 hours 1.173942e-4 weeks 2.70155e-5 months See D7 discussion. No N/A The SIS test lines discharge into a common %inch ISOICLOSE. line. Flow would then pass two normally closed %

EM HS-8882 - inch air operated valves before returning to the RWST ISO/CLOSED or thetoRHUT. failure to occur, For the actuations, there would have be 3 spurious which is extremely unlikely and is not postulated for a control room fire.

Ensure MSIVs Are SA-08-006 shows Closed By all four MSIVs can Unplugging All stay open for at Amphenal least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months as long Connectors At The as there are no Listed Terminal This step ensures the MSIVs are closed ifthey did not other failures. The Boxes: close inStep 3. The MSIVs were replaced per DCPs steam dumps are D16 R, M,D 09952 and 11608 with system medium actuated 60 isolated inStep C2 No N/A 6 AB HV-1I - A valves. Unplugging the Amphenal connectors will and the steam Train TB14540 isolate power to one train of solenoids and fail the generator ARVs will

AB HV A valves closed, control Train TB14533 temperature. See

AB HV A Section 6.1 for Train TB14538 additional

ABHV-20-A discussion Train TB14535 regarding MSIVs.

Design Basis Document for Procedure OFN RP-017 Page 96 of 102 E !F99115, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note 1)(min) Complete (Note 2) Steps This step ensures the SRO knows the Amphenal Notify SRO at the Aux connectors have been pulled. The new MSIVs have See D16 D17 Shutdown Panel, N/A no external position indication so the operator at the 60 discussion. N/A N/A Status of MSIVs ASP will have to rely on available instrumentation to determine position.

Request SRO At ASP To Ensure S/G A And C ARVs -CLOSED AB PV-1 and AB PV-3 are closed by the SRO at the See Section 6.1 for D18 R, M,D ASP. AB PV-2 and AB PV-4 are isolated from the 60 discussion about No N/A C PV AB control room and controlled from the ASP. steam generator CLOSED ARVs.

AB PV CLOSED Isolate air and N2 to AB PV-3, SG C ATMOSPHERIC RELIEF VLV:

a. KAV1445-CLOSED See Section 6.1 for D19 R, M,D This step isolates air and nitrogen and bleeds air from 60 discussion about No NIA

b. KAV1366 - the regulator to prevent the valve from opening. steam generator CLOSED ARVs.

c. Vent air from regulator

d. Verify AB PV-3 closed

Design Basis Document for Procedure OFN RP-017 Page 97 of 102 EmI FA9115, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP.017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION (Note 1) (Note )(rain) Complete (Note 2) Steps See Section abou Scuion 6.1 for

d. Close AB-V029, SG IfAB PV-3 cannot be closed, then manual valve AB-D19 RNO C ATMOSPHERIC R, M,D V029 can be closed to isolate steam generator C 60 steam generator No N/A RELIEF VLV ISO ARV. ARVs. geneato Isolate air and N2 to AB PV-1, SG A ATMOSPHERIC RELIEF VALVE

a. KAV1435-CLOSED See Section 6.1 for D20 R, M,D This step isolates air and nitrogen and bleeds air from 60 discussion about No N/A

b. KAV1364- the regulator to prevent the valve from opening. steam generator CLOSED ARVs.

c. Vent air from regulator

d. Verify AB PV-1 closed See Sectionabou 6.1 for IfAB PV-1 cannot be closed, then manual valve AB- Scuion

d. Close AB-V01 8, SG D20 RNO AATMOSPHERIC R, M,D V018 can be closed to isolate steam generator A 60 steam generator No N/A RELIEF VLV ISO ARV. ARVs. generator

Design Basis Document for Procedure OFN RP-017 Page 98 of 102 E 1F9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Function (Note1)(rain) Complete (Note 2) Steps (Note 1)

Technical Requirement 3.7.23 states that with one In SGK04B Room, This step ensures room cooling to the Class 1E Class 1E A/C Unit Start Class 1E inoperable, establish Electrical Equipment switchgear rooms. The cooler needs to be started A/C Unit: before the rooms reach a temperature beyond esatory operating limits for the equipment. Based on the compensatory TRM, Table 3.7.22-1, the maximum allowable measures within 2

. Position SGK05B D21 NORMAL S temperature inthe rooms supplied by SGK05B is 101 60 hours. or the No C9, C12 ISO/RUN Switch F. Inorder for the unit to operate, there needs to be RP-017, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months will To ISO/RUN power to NG02A and ESW flow to the cooler. Power be used as the is restored in Step C11. ESW lineup is completed by timing requirement step C12. Steps Clland C12 should be completed to restore cooling.

o GK HS-103 -

ISO/RUN well before Step 021. See Section 6.5 for additional discussion about room cooling.

D22 Proceed As Directed N/A Attachment D is complete and the SRO will direct.the N/A N/A N/A N/A By SRO at ASP. operator at this point.

Proceed to NB02 Switchgear Room And Obtain The El Following: N/A Procedure is required to complete remaining N/A N/A N/A N/A Attachment E steps.

Copy of this procedure

Flashlight

Design Basis Document for Procedure OFN RP-017 Page 99 of 102 E !F9916, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note 1) (Note 1)(min) Complete (Note 2) Steps Ensure Motor Driven AFW Pump A Is Stopped: SA-08-006 shows The Train A MDAFP breaker is opened to stop the that ifthe pump is

a. Remove CLOSE pump and prevent uncontrolled AFW flow to steam stopped within 15 control power fuse (UC) generators B and C which could result inoverfilling the minutes and other steam generators. Although ATrain equipment is not mins an the E2

NB0105/FUSE - D credited, spurious actuation of ATrain equipment 15 pronsdurethe No N/A OFF needs to be mitigated ifit could lead to unwanted taken, overfilling of consequences. In this case, overfilling of the steam steam generators B

b. Stop Motor Driven generators is not desired and is,therefore, being and C will not AFW Pump A prevented inOFN RP-017. oCcur.

occur.

NBO105 - OPEN Place BN HV-8812A, Calculation XX-E-RWST TO RHR PUMP 013 shows there is RWST O RHRPUMP28 minutes A SUCTION This Step ensures BN HV-8812A is de-energized and avaiabeb E3 ISOLATION VALVE M will not spuriously operate after it has been manually 28 RWST drains toh No N/A Breaker To Off closed inthe next step. level below that SNG01ACR2 -OFF required for cold shutdown.

Design Basis Document for Procedure OFN RP-017 Page 100 of 102 E lF9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq STEP (Note1)(rain) Complete (Note 2) Steps (Note 1)

Valve BN HV-8812A is normally open and is manually closed inOFN RP-017 to prevent the RWST from In RHR Pump Room draining to the containment sump inthe event EJ HV- Based on XX-E-A,Close RWST To 8811A spuriously opens. Valve BN HV-8812A is a 013, operators have RHR Pump A Train A valve so power may not be available, which is 28 minutes to close E4 Isolation Valve. M why manual operation is required. Step E2 isolates 28 the valve and No E2 power to the control circuit to prevent spurious prevent the RWST BN HV-8812A - operation after the valve is closed. DCP 12173 from draining to the CLOSED modified the control circuit to ensure a control room containment sump.

fire will not damage the valve and prevent manual I closure.

E5 Inform The SRO That This step notifies the SRO and the ASP that BN HV- N/A N/A N/A N/A SBN HV-8812A Is M 8812A is closed.

Closed

Design Basis Document for Procedure OFN RP-017 Page 101 of 102 E !F9916, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire Function BASIS To TIMING BASIS Impact? Prereq STEP DESCRIPTION Note 1)(rain) Complete (Note 2) Steps (Note 1)

Ascend Ladders To 2000 Elevation Aux Feedwater Pump Room Area And Close The Following Valves:

o TD AFWP DISCHARGE TO SG A HV-8 INLET ISO.

o AL-V056 -

CLOSED o TD AFWP DISCHARGE TO SG DHV-6 INLET This step isolates possible AFW flow diversion paths ISO. See Section 6.3 for E6 D to prevent overfilling the steam generators when 35 No N/A o AL-V061 - timing basis.

operating the TDAFP and the B MDAFP.

CLOSED o MDAFWP DISCHARGE TO SG A HV-7 INLET ISO.

o AL-V032 -

CLOSED o TDAFWP DISCHARGE TO SG C HV-12 INLET ISO.

o AL-V071 -

CLOSED I L +/- 4 ________

Design Basis Document for Procedure OFN RP-017 Page 102 of 102 E lF9915, Rev. 5 TABLE 7.1 DETAILED EVALUATION OF EACH ACTION STEP INOFN RP-017 PFSSD Req'd Time CR Fire STEP DESCRIPTION Function BASIS To TIMING BASIS Impact? Prereq (Note 1) (Note1)(rain) Complete (Note 2) Steps Notify HP that a non- This step notifies HP that the operator entered the E7 RCA area was entered N/A auxiliary feedwater area from the RCA and the area N/A N/A N/A N/A into from the RCA. may be contaminated.

Inform The SRO That the Aux Feedwater This step notifies the SRO that the Aux Feedwater N/A N/A N/A N/A 8Valves Are Closed, Go N/A valves are closed.

Back Down The Ladder And Proceed To ASP This attachment was added based on Reference Aft F ain t Protect N/A 3.1.a. See discussion under Reference 3.1.a and N/A N/A N/A N/A Train A Equipment Step A16.

This attachment is included to provide instructions to Manual Charging of operators on how to manually charge the Siemens AUtG Siemens Circuit N/A circuit breakers. This attachment is used for some NA /AN/A N/A Breakers RNO actions throughout the procedure. The springs are charged for one cycle of operation so entering the attachment will not normally be necessary.

Table Notes:

1. PFSSD Functions are as follows: R - Reactivity Control; M - Reactor Coolant Makeup and Inventory Control; D - Decay Heat Removal; P -

Process Monitoring; S - Support; N/A - Not Applicable

2. The column labeled "CR Fire Impact?" identifies if a fire in the control could potentially cause the component to mis-position after the step has been completed. Yes means the component can mis-position and No means the component cannot mis-position. N/A means the question is not applicable to the step.

Design Basis Document for Procedure OFN RP-017 Appendix I EI1F ON15, Rev. 55 Page 1 of 30 Appendix 1 OFN RP-017 Credited Component Evaluation

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1F99145, Rev.. Page 2 of 30 Table Al documents whether the components credited for hot standby following a control room fire are properly protected against hot shorts, open circuits or shorts to ground that could occur due to a fire in the control room. Also, the evaluation documents whether adequate isolation capability is provided to ensure the credited components remain functional and unaffected by the fire after control room isolation is completed.

This evaluation was performed to satisfy an NRC commitment made in Licensee Event Report 2010-003-00. This evaluation was originally performed as a corrective action for CR 00023410-02-01 and is being added to E-1F9915 per CR 00044460-02-01 to ensure the information is maintained in a controlled document. The evaluation has been updated since the original evaluation in CR 00023410-02-01 to reflect the current configuration in OFN RP-017.

Table Al OFN RP-017 Credited Component Evaluation Component Evaluation ABHS0079 and The main steam isolation valves (MSIVs) are closed in OFN RP-017 to prevent rapid cooldown and return to criticality.

ABHS0080 Operators, upon exiting the control room, actuate All Close hand switches ABHS0079 and ABHS0080 to close the MSIVs.

The Wolf Creek fire protection licensing basis does not allow us to credit that this actually works. Therefore, later steps have operators remove power from the MSIV solenoids to fail them closed. The circuit is shown on drawings E-1 3AB26, E-1 3AB27, E-13AB28 and E-13AB29.

Power is removed from the A Train solenoids by placing NK5119 in the OFF position. This isolates separation group 1 power from MSFIS cabinet SA075A and fails the MSIVs closed. This also fails the main feedwater isolation valves closed, which is the desired PFSSD position.

Power is also removed from the A Train solenoids by removing the Amphenol connectors at the associated terminal box. Loss of power to either train of solenoids will fail the MSIVs closed. A Train was chosen for convenience. Based on review of the drawings, a fire in the control room will not cause the MSIVs to re-open after the Amphenol connectors are dis-connected.

Based on the above discussion, the MSIVs are protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E,-F995, -Rev. 6 Page 3 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation ABHV0005 Valve ABHV0005 controls steam to the turbine driven auxiliary feedwater pump (TDAFP) from Steam Generator B and opens upon loss of 125 VDC power to the solenoid valve. Redundant control power originates from NK4201 through relay panel RP334 (Dwg E-13RP14) which does not run in the control room. Placing ABHIS0005B in the open position drops power to the solenoid and opens the valve. Upon arrival at the ASP, Operators place hand switch RPHIS0001 in the ISOLATE position per OFN RP-01 7. This energizes lockout relay 86XRP3 (Dwgs E-1 3RP1 1 and E-1 3RP1 5), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. Hand switch ABHIS0005B is placed in the open position at the ASP to open the valve and allow a steam supply to the TDAFP. The control circuit is isolated from the control room when RPHIS0001 is placed in the isolate position. Drawing E-13AB01A shows the control circuit. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ABHV0005 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0001 will isolate the control room and insert redundant fuses into the circuit so that hand switch ABHIS0005B will function. Therefore, ABHV0005 is protected.

ABHV0006 Valve ABHV0006 controls steam to the turbine driven auxiliary feedwater pump (TDAFP) from Steam Generator C and opens upon loss of 125 VDC power to the solenoid valve. Hand switch ABHIS0006B is placed in the closed position at the ASP to close the valve and prevent steaming steam generator C, which is not being provided with feedwater flow in procedure OFN RP-017. Upon arrival at the ASP, Operators place hand switch RPHIS0001 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP2 (Dwgs E-1 3RP1 1 and E-1 3RP1 5), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. Drawing E-1 3AB01 shows the control circuit.

The valve opens upon loss of 125 VDC power to the solenoid valve and closes when the solenoid valve is energized.

Redundant control power originates from NK4201 through relay panel RP334 (Dwg E-13RP14), which does not run in the control room. Placing RPHIS0001 in the ISOLATE position maintains power to the ABHV0006 control circuit and allows operators to maintain the valve in the closed position from the ASP. A fire in the control room will not affect operation of the valve after RPHIS0001 is placed in the isolate position. In the unlikely event valve ABHV0006 opens, PFSSD is assured because steam flow to the TDAFP remains available.

Based on the above discussion, hand switch RPHIS0001 will isolate the control room and insert redundant fuses into the circuit so that hand switch ABHIS0006B will function. Therefore, valve ABHV0006 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E IFOBIS6, Rov. 6 Page 4 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation ABHV0012, MSIV Bypass valves ABHV0012, ABHV0015, ABHV0018 and ABHV0021 are failed closed in OFN RP-017 by removing 125 ABHV001 5, VDC control power from the control circuit. Control power is removed by pulling fuse #46 in panel RP209. This de-energizes ABHV001 8 and auxiliary relay 94XAB05 and subsequently de-energizes solenoid valves associated with the MSIV bypass valves and causes ABHV0021 them to close. The valve circuit is shown on drawing E-1 3AB23A. Panel RP209 wiring for fuse block 46 is shown on drawing E-093-00048. Based on drawing E-093-00048 fuse block 46 does supply power to auxiliary relay 94XAB05. Therefore, removal of fuse block 46 will cause the MSIV bypass valves to close. The MSIV bypass valves are not considered high/low pressure interfaces so consideration of multiple proper polarity hot shorts is not required. The negative side of the circuit shown on drawing E-1 3AB23A does not run in the control room. Therefore, after the fuse is pulled there is no possibility that the bypass valves can spuriously open as a result of a fire in the control room.

Based on the above discussion, the MSIV bypass valves are adequately protected in the event of a control room fire.

ABPV0001 and Steam generator ARVs ABPV0001 and ABPV0003 are closed in OFN RP-017 by isolating air and nitrogen to the valves and ABPV0003 venting air from the regulators. The ARVs are not isolated from the control room. The Train A ASP has hand switches (ABHS0001 and ABHS0003) that transfer control of ABPV0001 and ABPV0003 to the ASP but the circuits run in the control room. Drawings J-1 10-00216 and J-1 10-00220 show the loop diagram for these circuits.

For PFSSD, only two steam generators are needed to maintain hot standby. The control room fire strategy uses steam generator B and D ARVs (ABPV0002 and ABPV0004) for temperature control and closes steam generators A and C ARVs (ABPV0001 and ABPV0003) to prevent uncontrolled cooldown.

Loss of air and nitrogen to the ARVs will fail the valves closed. A fire in the control room will not cause the valves to open in the absence of air and nitrogen. Therefore, ARVs ABPV0001 and ABPV0003 are protected.

ABPV0002 and Steam generator ARVs ABPV0002 and ABPV0004 are controlled in OFN RP-01 7 at the ASP to control RCS temperature.

ABPV0004 Hand switches ABHS0002 and ABHS0004 at the ASP are placed in the LOCAL position to transfer control from the control room to the controller at the Train B ASP. The LOOP diagrams for ABPV0002 are shown on drawings J-1 10-00218, J-1 10-00219 and J-110-00933. The LOOP diagrams for ABPV0004 are shown on drawings J-1 10-00222, J-1 10-00223 and J-1 10-00934.

Based on a review of these drawings and discussion with the Instrumentation and Control group, ABHS0002 and ABHS0004 will transfer control to the ASP and the control room circuit is isolated after these switches are placed in local position.

Therefore, ABPV0002 and ABPV0004 are protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E !FOB! 6, Rov. 5 Page 5 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation AEL10502A This level indicator is used to verify steam generator B level. Drawings E-1 3AE08 and M-761-02303 show the circuit arrangement. Level transmitter AELT0502 sends a signal to SB148A in the Train B ESF switchgear room. From SB148A the signal is split and sent to the main control room indicator AEL10502 and ASP indicator AELI0502A. A fire in the control room that affects AELI0502 and associated cable will not affect AELI0502A because the signal converter will isolate any effects from a short occurring in the control room. Therefore, AELI0502A is protected.

AELI0504A This level indicator is used to verify steam generator D level. Drawings E-13AE08 and M-761-02310 show the circuit arrangement. Level transmitter AELT0504 sends a signal to SB148B in the Train B ESF switchgear room. From SB148B the signal is split and sent to the main control room indicator AELI0504 and ASP indicator AELI0504A. A fire in the control room that affects AELI0504 and associated cable will not affect AELI0504A because the signal converter will isolate any effects from a short occurring in the control room. Therefore, AELI0504A is protected.

ALHV0005 Valve ALHV0005 is controlled at the ASP by placing hand switch ALHS0005 in the local position and controlling the valve using ALHK0005B. The AL HV-5 circuit is shown on drawings J-1 10-00349, J-1 10-00871 and J-1 10-00939. Technical data sheets for the Foxboro 200 system are provided in vendor manual J-1 10-00388. These drawings and data sheets were reviewed to determine the circuit configuration and operation of the local hand switch and local valve controller.

When the local hand switch (ALHS0005) is placed in the LOCAL position, relay coils on a relay logic card are energized and the contacts change state. The change of state selects the output from the controller at the ASP and de-selects the control room controller. A fire in the control room could affect the control room controller but any spurious signal would not affect the valve controller. This is because spurious signals or hot shorts originating in the control room are isolated in RP147B by either contact output isolators or isolated current to voltage converters. Based on vendor manual J-1 10-00388, these devices will prevent spurious signals or hot shorts originating in the control room from affecting the ability to control ALHV0005 from the ASP.

The physical makeup of the relay contacts allows only one possible state for each set of contacts. Therefore, the contact pair cannot be both open or both closed. One contact will be open and the other will be closed. Since the test procedure provides positive confirmation that the controller at the ASP does work, this provides reasonable assurance that the controller in the control room is completely isolated from the circuit when the local hand switch is placed in the LOCAL position.

Based on the above discussion, there is reasonable assurance that AL HV-5 is isolated from the control room by demonstration that the controller at the ASP operates the valve. Therefore, ALHV0005 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E !F9916, Rev. 6 Page 6 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation ALHV0010 Valve ALHV001 0 is controlled at the ASP by placing hand switch ALHS001 0 in the local position and controlling the valve using ALHKO01 OB. The AL HV-1 0 circuit is shown on drawings J-1 10-00354, J-1 10-00940 and J-1 10-00941. Technical data sheets for the Foxboro 200 system are provided in vendor manual J-1 10-00388. These drawings and data sheets were reviewed to determine the circuit configuration and operation of the local hand switch and local valve controller.

When the local hand switch (ALHS0010) is placed in the LOCAL position, relay coils on a relay logic card are energized and the contacts change state. The change of state selects the output from the controller at the ASP and de-selects the control room controller. A fire in the control room could affect the control room controller but any spurious signal would not affect the valve controller. This is because spurious signals or hot shorts originating in the control room are isolated in RP147B by either contact output isolators or isolated current to voltage converters. Based on vendor manual J-1 10-00388, these devices will prevent spurious signals or hot shorts originating in the control room from affecting the ability to control ALHV001 0 from the ASP.

The physical makeup of the relay contacts allows only one possible state for each set of contacts. Therefore, the contact pair cannot be both open or both closed. One contact will be open and the other will be closed. Test procedure STS RP-004 provides positive confirmation that the controller at the ASP does work, so this provides reasonable assurance that the controller in the control room is completely isolated from the circuit when the local hand switch is placed in the LOCAL position.

Based on the above discussion, there is reasonable assurance that ALHV001 0 is isolated from the control room. Therefore, ALHV0010 is protected.

ALHV0030 Valve ALHV0030 is opened when necessary using ALHIS0030B to supply the Train B MDAFP with ESW. Upon arrival at the ASP, Operators place hand switch RPHIS0002 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP5 (Dwgs E-1 3RP1 2 and E-1 3RP1 5), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. Drawing E-13AL04B shows the control circuit for this valve. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ALHV0030 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0002 will isolate the control room and insert redundant fuses into the circuit so that hand switch ALHIS0030B will function. Therefore, valve ALHV0030 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-119915, Rev. 5 Page 7 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation ALHV0033 OFN RP-01 7 places ALHISOO33B in the close position to ensure valve ALHV0033 is closed. Step Al 5 opens the valve when it is necessary to swap to ESW to supply the TDAFW pump. Upon arrival at the ASP, Operators place hand switch RPHIS0002 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP6 (Dwgs E-13RP12 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. The control circuit is shown on drawing E-13AL04B. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ALHV0033 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0002 will isolate the control room and insert redundant fuses into the circuit so that hand switch ALHIS0033B will function. Therefore, ALHV0033 is protected.

ALHV0034 OFN RP-017 places ALHIS0034B in the open position to open valve ALHV0034. The ALHV0034 circuit is isolated from the control room when RPHIS0002 is placed in the isolate position. Upon arrival at the ASP, Operators place hand switch RPHIS0002 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP5 (Dwgs E-13RP12 and E-13RP15), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. The control circuit is shown on drawing E-13AL02B. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve ALHV0034 after the isolation switch is operated. The valve may not readily open when ALHIS0034B is placed in the open position because power is not restored to the MCC until Step C1 3. This is acceptable because AFW is not needed until 15 minutes into the event. Step C13 is completed prior to 15 minutes.

Based on the above discussion, hand switch RPHIS0002 will isolate the control room and insert redundant fuses into the circuit so that hand switch ALHIS0034B will function. Therefore, ALHV0034 is protected.

ALHV0036 Valve ALHV0036 is manually operated in OFN RP-017 because this valve is powered from Train A MCC cubicle NG03CEF4.

Power is disconnected from the valve by opening Train A MCC cubicle breaker NG03CEF4. Train A components are not protected against faults occurring as a result of a control room fire. The control circuit for valve ALHV0036 is shown on drawing E-13AL02C. Change package 12170 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures a control room fire will not damage the valve and prevent it from being opened manually. Therefore, ALHV0036 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1F991 6, Rev. 6 Page 8 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation APLI0004B Condensate Storage Tank (CST) Level Indicator APLI0004B is used by operators in OFN RP-01 7 to verify level in the CST.

When level drops to 14%, the procedure directs operators to swap to the ESW source. OFN RP-017 also directs operators to use the local indicator. Level indicator APLI0004B circuit is shown on drawing J-1 10-00098. Based on a review of this drawing, the level indicator is not isolated from the effects of a control room fire and could provide erroneous readings. The Note above the Step in OFN RP-01 7 where APLI0004B is used states that level indicator APLI0004B could be affected by the fire. Therefore, Operators will be aware that they should not rely on this level indicator. Isolation of this level indicator is not required because level in the CST is not a concern initially since sufficient volume exists to supply the steam generators for at least 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . At that time, sufficient personnel will be available to locally monitor CST level. Therefore, the configuration is acceptable.

BBLI0460B This level indicator is used to verify pressurizer level. Drawings E-13BB16 and M-761-02304 show the circuit arrangement.

Level transmitter BBLT0460 sends a signal to SB148A in the Train B ESF switchgear room. From SB148A the signal is split and sent to the main control room indicator BBLI0460A and ASP indicator BBLI0460B. A fire in the control room that affects BBLI0460A and associated cable will not affect BBLI0460B because the signal converter will isolate any effects from a short occurring in the control room. Therefore, BBLI0460B is protected.

BBPI0406X This pressure indicator is used to verify RCS pressure is being maintained between 2000 and 2300 psig. The circuit arrangement is shown on drawings E-13BB16 and M-761-02311. Pressure transmitter BBPT0406 sends a signal to SB148B in the Train B ESF switchgear room. From SB148B the signal is split and sent to the main control room indicator BBP10406 and ASP indicator BBPI0406X. A fire in the control room that affects BBP10406 and associated cable will not affect BBTPI0406X because the signal converter will isolate any effects from a short occurring in the control room. Therefore, BBP10406X is protected.

BBTI0423X This temperature indicator is used to verify RCS Loop 2 cold leg temperature. Drawings E-13BB15 and M-761-02301 show the circuit arrangement. Loop 2 cold leg temperature element BBTE0423B sends a signal to Cabinet 2A which is SB148A located in the Train B ESF switchgear room (Fire Area C-10). From SB148A the signal is split and sent to the main control room indicator BBTI0423B and ASP indicator BBTI0423X. A fire in the control room that affects BBTI0423B and associated cable will not affect BBTI0423X because the signal converter will isolate any effects from a short occurring in the control room.

Therefore, BBTI0423X is protected.

BG8402B Valve BG8402B is a manual valve. A control room fire will not affect operation of the valve. Therefore, BG8402B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1FOR915, Rev. 6 Page 9 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation BGHV81 11 Valve BGHV81 11 is opened in OFN RP-017 to ensure adequate minimum flow through the Train B charging pump. This prevents heatup and damage to the pump. Hand switch BGHS8111A, located at MCC cubicle NG02AHR1, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13BG11C. The circuit was modified in DCP 12175 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02AHR1. A previous step restores power to the MCC so that when the switch is actuated, the valve will open.

Based on the above discussion, valve BGHV81 11 is protected.

BGLCV01 12C Valve BGLCV0112C is closed in OFN RP-017 to isolate the VCT from the charging header. Hand switch BGHS0112C is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-13BG12A. The circuit was modified in DCP 12131 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG02AFR2. A previous step restores power to the MCC so that when the switch is actuated, the valve will close.

Based on the above discussion, valve BGLCV01 12C is protected.

BGV0017 Valve BGV0017 is a manual valve. A control room fire will not affect operation of the valve. Therefore, BGV0017 is protected.

BGV0101 Valve BGV01 01 is a manual valve. A control room fire will not affect operation of the valve. Therefore, BGV01 01 is protected.

BGV0105 Valve BGV0105 is a manual valve. A control room fire will not affect operation of the valve. Therefore, BGV0105 is protected.

BNHV8812A Valve BNHV8812A is manually closed in OFN RP-017 to prevent draindown of the RWST to the containment sump. This valve is powered from Train A MCC cubicle NG01ACR2. The operator removes power from the valve by opening NG01ACR2 before manually closing the valve. The control circuit is shown on drawing E-13BN03. The circuit is not isolated from the control room. Removal of power will prevent spurious operation of the valve in the event of a control room fire. DCP 12173 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve can be manually closed when needed. Therefore, valve BNHV8812A is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1F9915, Rev. 5 Page 10 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation BNHV8812B Valve BNHV8812B is closed in OFN RP-017 to prevent flow diversion from the RWST to the containment sump. Hand switch BNHS8812B is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-13BN03A. The circuit was modified in DCP 12173 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG02AFF4. A previous step restores power to the MCC so that when the switch is actuated, the valve will close.

Based on the above discussion, valve BNHV8812B is protected.

BNLCV01 12E Valve BNLCV01 12E is opened in OFN RP-01 7 to establish a suction source from the RWST to the Train B CCP. Hand switch BNHS01 12E, located at MCC cubicle NG02AHR3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3BNO1A. The circuit was modified in DCP 12175 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02AHR3. A previous step restores power to the MCC so that when the switch is actuated, the valve will open.

Based on the above discussion, valve BNLCV01 12E is protected.

EFHV0026 Valve EFHV0026 is closed in OFN RP-01 7 to prevent flow diversion from ESW to the service water piping. Hand switch EFHS0026A is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and close the valve. The circuit is shown on drawing E-1 3EF02A. The circuit was modified in DCP 12170 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will close when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and close the valve. Power to the valve is from MCC cubicle NG02AHF2. A previous step restores power to the MCC so that when the switch is actuated, the valve will close.

Based on the above discussion, valve EFHV0026 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1FOS!6, Rov. 5 Page 11 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation EFHV0032 Valve EFHV0032 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0032, located at MCC cubicle NG02BDR1, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EF07A. The circuit was modified in DCP 12131 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position.

The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BDR1. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0032 is protected.

EFHV0034 Valve EFHV0034 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0034, located at MCC cubicle NG02BHF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EF09A. The circuit was modified in DCP 11086 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position.

The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BHF3. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0034 is protected.

EFHV0038 Valve EFHV0038 is opened in OFN RP-017 to establish Train B ESW flow to the UHS. Hand switch EFHS0038A, located at MCC cubicle NG02AHF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-13EF06A. The circuit was modified in DCP 12170 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02AHF3. A previous step restores power to the MCC so that when the switch is actuated, the valve will open.

Based on the above discussion, valve EFHV0038 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E-IF9916, Rev. 5 Page 12 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation EFHV0046 Valve EFHV0046 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0046, located at MCC cubicle NG02BHR2, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EF09A. The circuit was modified in DCP 11086 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position.

The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BHR2. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0046 is protected.

EFHV0050 Valve EFHV0050 is opened in OFN RP-017 to establish Train B ESW flow to the Train B containment coolers. Hand switch EFHS0050, located at MCC cubicle NG02BDR2, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EF08A. The circuit was modified in DCP 12131 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position.

The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG02BDR2. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0050 is protected.

EFHV0052 Valve EFHV0052 is opened in OFN RP-017 to establish Train B ESW flow to the Train B CCW heat exchanger. Hand switch EFHS0052, located at MCC cubicle NG04CNF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EF05A. The circuit was modified in DCP 12172 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position.

The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CNF3. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EFHV0052 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E 11FI9156, Rev. 6 Page 13 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation EFHV0060 / Valve EFHV0060 is de-energized and closed in OFN RP-017 to prevent a flow imbalance in the essential service water (ESW)

NG04CHF2 system. The valve is normally closed with manual bypass valve EFV0090 throttled to maintain proper flow for normal and emergency conditions. Condition report 00041746 identified that valve EFHV0060 is not operated in procedure OFN RP-017 and that ifthe valve spuriously opens as a result of the fire, a flow imbalance would occur and ESW flow to credited components may not be adequate. Therefore, a compensatory measure was added to OFN RP-017 to open breaker NG04CHF2 and close EFHV0060. Valve EFHV0060 has not been modified to address NRC IN 92-18. Change package 13898 is being prepared to modify the valve.

A fire in the control room could cause valve EFHV0060 to open and be damaged in the open position. The condition is being addressed by change package 13898.

EGHV0015 Valve EGHV001 5 is manually closed in OFN RP-01 7 to prevent flow diversion from Train B CCW to Train A CCW. Breaker NG03CHF3 is opened in an earlier step to remove power from the circuit. The circuit is shown on drawing E-1 3EG05C. The circuit was modified in DCP 12170 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve can be manually closed when necessary.

A fire in the control room could damage the control circuit for the valve but the damage will not cause the valve to spuriously operate after the breaker is opened. Therefore, valve EGHV0015 is protected.

EGHV0016 Valve EGHV0016 is opened in OFN RP-017 to establish Train B CCW flow from the service loop. Hand switch EGHS0016A, located at MCC cubicle NG04CJF3, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EG05A. The circuit was modified in DCP 12172 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CJF3. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EGHV0016 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix I EARIF991 5, Rev. 6 Page 14 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation EGHV0054 Valve EGHV0054 is opened in OFN RP-01 7 to establish Train B CCW flow to the service loop. Hand switch EGHS0054, located at MCC cubicle NG04CKF1, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EG05D. The circuit was modified in DCP 12172 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CKF1. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EGHV0054 is protected.

EGHV0061 Valve EGHV0061 is manually closed in OFN RP-017 because this valve is powered from Train A MCC cubicle NG03CKF3.

Train A components are not protected against faults occurring as a result of a control room fire. An operator removes 480 VAC power from the valve by opening NG03CKF3 before another operator manually closes the valve in another step. The control circuit is shown on drawing E-1 3EG09A. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves power circuit. DCP 12130 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures this does not occur so the valve can be manually operated when needed. Therefore, valve EGHV0061 is protected.

EGHV0133 Valve EGHV0133 is manually closed in OFN RP-017. This valve is powered from Train B MCC cubicle NG02BHF1. An operator removes 480 VAC power from the valve by opening NG02BHF1 before another operator manually closes the valve in another step. The control circuit is shown on drawing E-13EG18A. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves' power circuit. DCP 12130 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures this does not occur so the valve can be manually operated when needed. Therefore, valve EGHV01 33 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E IFOOS11, Rev. 5 Page 15 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation EMHV8801A / Valve EMHV8801A is closed in OFN RP-01 7 to prevent overfill of the pressurizer. This valve is powered from Train A MCC NG01BER2 cubicle NG01 BER2. An operator removes 480 VAC power from the valve by opening NG01 BER2 before another operator manually closes the valve in another step. The control circuit is shown on drawing E-13EM02. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves' power circuit. Change package 13898 will be modifying the valve control circuit to address NRC IN 92-18 to ensure the valve can be manually closed. The pressurizer overfill concern was identified in CR 00045442.

EMHV8801 B I Valve EMHV8801 B is throttled in OFN RP-01 7 to control charging injection flow. This valve is powered from Train B MCC NG04CKF3 cubicle NG04CKF3. An operator removes 480 VAC power from the valve by opening NG04CKF3 before another operator manually throttles the valve in another step. The control circuit is shown on drawing E-1 3EM02A. The circuit is not isolated from the control room, nor is it required to be isolated. Removal of power will prevent spurious operation of the valve in the event of a control room fire. A 120 VAC hot short on the control room portion of the circuit will not cause the valve to spuriously operate because 480 VAC power has been removed from the valves' power circuit. DCP 12130 modified the control circuit to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve can be manually throttled when needed. Therefore, valve EMHV8801aB is protected.

EMHV8803B Valve EMHV8803B is opened in OFN RP-017 to establish Train B CCP flow to the boron injection tank (BIT). Hand switch EMHS8803B, located at MCC cubicle NG04CKF2, is used to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and open the valve. The circuit is shown on drawing E-1 3EM02B. The circuit was modified in DCP 12175 to address NRC IN 92-18 concerns. The concern in NRC IN 92-18 was that a hot short on the motor operator valve circuit could bypass the valves torque and limit devices and drive the valve to damage in the undesired position. The modification ensures the valve will open when the hand switch is actuated. Based on a review of the drawing, the hand switch will isolate all portions of the control room and open the valve. Power to the valve is from MCC cubicle NG04CKF2. If the hand switch is actuated before power is restored to the MCC, there will be no adverse impact. The valve will move to the open position when power is restored.

Based on the above discussion, valve EMHV8803B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E !FOS! 6, Rev. 5 Page 16 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation EMHV8843 Valve EMHV8843 is closed in OFN RP-017 to prevent flow diversion from charging through the SIS test line which discharges to the RWST or the RHUT. Hand switch EMHS8843 is used to close the valve but does not completely isolate the control room. The circuit is shown on drawing E-13EM04A.

The valve is a solenoid operated valve that requires 125 VDC to open. Actuation of hand switch EMHS8843 to the ISO/CLOSE position will open contacts on the positive side of the circuit and de-energize the solenoid. The negative side of the circuit is not isolated. Based on a review of the drawing, a positive hot short in the control room affecting this circuit will not cause the valve to open because the isolation contacts on the hand switch will be open, preventing the re-energization of the solenoid.

Based on the above discussion, valve EMHV8843 is protected.

EMHV8882 Valve EMHV8882 is closed in OFN RP-017 to prevent flow diversion from charging through the SIS test line which discharges to the RWST or the RHUT. Hand switch EMHS8882 is used to close the valve but does not completely isolate the control room. The circuit is shown on drawing E-1 3EM05A.

The valve is a solenoid operated valve that requires 125 VDC to open. Actuation of hand switch EMHS8882 to the ISO/CLOSE position will open a contact on the positive side of the circuit and de-energize the solenoid. The negative side of the circuit is not isolated. Based on a review of the drawing, a positive hot short in the control room affecting this circuit will not cause the valve to open because the isolation contacts on the hand switch will be open, preventing the re-energization of the solenoid.

Based on the above discussion, valve EMHV8882 is protected.

FCHV0312 Valve FCHV0312 is opened using FCHIS0312B at the ASP. This allows steam to flow to the turbine driven auxiliary feedwater pump. Upon arrival at the ASP, Operators place hand switch RPHIS0001 in the ISOLATE position per OFN RP-017. This energizes lockout relay 86XRP1 (Dwgs E-1 3RP1 1 and E-1 3RP1 5), isolates the control room portions of the circuit and inserts redundant fuses to ensure the remaining portions of the circuit are energized. The control circuit for FCHV0312 is shown on drawing E-1 3FC23. Based on a review of this drawing, the lockout relay contacts will isolate all portions of the circuit that run to the control room. A fire in the control room will not adversely impact valve FCHV0312 after the isolation switch is operated.

Based on the above discussion, hand switch RPHIS0001 will isolate the control room and insert redundant fuses into the circuit so that hand switch FCHIS0312B will function. Therefore, valve FCHV0312 is protected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E VF9915, Rev. 5 Page 17 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation FCHV0313 Hand switch FCHS0313 is placed in LOCAL position at the ASP to transfer control of FCHV0313 to the ASP and controlling the valve using FCHIK0313B. Drawings J-1 10-00642, J-1 10-00647 and J-1 10-00942 show the loop diagram for valve FCFV0313. Technical data sheets for the Foxboro 200 system are provided in vendor manual J-1 10-00388. These drawings and data sheets were reviewed to determine the circuit configuration and operation of the local hand switch and local valve controller.

When the local hand switch (FCHS0313) is placed in the LOCAL position, relay coils on a relay logic card are energized and the contacts change state. The change of state selects the output from the controller at the ASP and de-selects the control room controller. A fire in the control room could affect the control room controller but any spurious signal would not affect the valve controller. This is because spurious signals or hot shorts originating in the control room are isolated in RP147B by either isolated voltage to current converters, contact output isolators or isolated current to voltage converters. Based on vendor manual J-1 10-00388, these devices will prevent spurious signals or hot shorts originating in the control room from affecting the ability to control FCHV0313 from the ASP.

Based on the above discussion, there is reasonable assurance that the control room is isolated when FCHS0313 is placed in LOCAL position. Therefore, valve FCHV0313 is protected.

GDHS001 1 Hand switch GDHS001 1 isolates the Train B ESW pump room supply fan from the control room, inserts a redundant fuse on the secondary side of the control power transformer, and starts the fan. The circuit is shown on drawing E-K3GD01A. Based on a review of the schematic, the hand switch will isolate all portions of the control room and start the fan. Therefore, the fan will operate during the event.

Exhaust damper GDTZ001 lC opens when supply fan CGDO1 B starts. The exhaust damper circuit is shown on drawing E-K3GDO3. When hand switch GDHS001 1 is placed in the ISO/RUN position, auxiliary relay 3XGD2 is energized, which closes a contact and energizes the contactor relay 42 and starts the fan. Relay 42, when energized, opens a contact in the exhaust damper circuit, which de-energizes the exhaust damper and fails it in the full open position. None of the circuits associated with the exhaust damper are run in the control room. Therefore, the control room fire will not affect the exhaust damper.

Hand switch GDHS0011A isolates the Train B ESW pump room outside air supply damper (GDTZ0011A) from the control room and opens the damper. The circuit is shown on drawings E-K3GD04A and J-1 10-00569.

Based on drawing J-1 10-00569, the outside air supply damper closes on increasing current from a 4 - 20 mA Foxboro control circuit. Loss of signal current would fail the damper open. When hand switch GDHS001 1A is placed in the ISO/OPEN position, the signal current is isolated and the damper fully opens due to the decrease in current to 0 mA. The hand switch is located in room 3302 (Train B ESF switchgear room). Therefore, a fire in the control room cannot bypass the switch and cause the damper to close.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1FOB!5, Rev. 6 Page 18 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation The recirculation damper (GDTZ001 1B) for the Train B ESW pump room is not included in the PFSSD design. A control room fire could cause the damper to fail in the full open, full closed or partially open position due to a smart hot short on the positive polarity of the 4 - 20 mA circuit (Dwg. J-1 10-00569). A restriction plate installed in the recirculation duct will limit airflow in the recirculation line to about 57% per Calculation GD-331.

During normal operation, the outside air intake damper and recirculation damper operate as necessary to maintain the ESW pump room within design limits. In the winter months, most of the air flow is recirculated with minimal outside air makeup. In the summer months, most of the air flow is exhausted with minimal or no recirculation. For PFSSD following a control room fire regardless of time of year, the supply fan is started, the outside air intake damper and exhaust damper are fully opened and the recirculation damper is not controlled and could fail open, closed or somewhere in between. Consideration was not given for ensuring the room temperature is maintained within design limits. CR 00031408 has been written to address this issue.

Based on the above discussion, the Train B ESW pump room supply fan, exhaust damper and outside air supply damper are protected. However, the OFN RP-017 configuration may not be acceptable for all times during the year.

GKHS0103 Class 1E electrical equipment A/C unit SGK05B is started in OFN RP-01 7 to provide cooling to the Train B Class 1E electrical equipment rooms. Hand switch GKHS0103 is placed in the ISO/RUN position to isolate the control room, insert a redundant fuse on the secondary side of the control power transformer, and start the unit. The circuit is shown on drawings E-1 3GK1 3A, M-622.1A-00002 and M-622.1A-00003.

Based on a review of these drawings, hand switch GKHS01 03 will isolate all portions of the control room and start the unit.

After the switch is placed in the ISO/RUN position, a fire in the control room will not affect the unit. Therefore, SGK05B is protected.

GLHS0035 Train B electrical penetration room cooler SGL1 5B is started in OFN RP-01 7 to ensure adequate cooling to the equipment in the room. The circuit is shown on drawing E-13GL12A. Hand switch GLHS0035 is placed in the ISO/RUN position to isolate the control room and insert a redundant fuse in the control circuit. Then the operator depresses the start pushbutton on the MCC cubicle to start the unit. The unit is powered from MCC cubicle NG02BAF2.

Based on a review of the drawing, hand switch GLHS0035 will isolate all portions of the control room. The pushbutton will energize the 42 relay, close the seal-in contact and start the unit. Therefore, SGL15B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E-117911, Rev. 5 Page 19 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation GMHS0011B Train B diesel generator room supply fan CGM01B is started in OFN RP-017 using hand switch GMHS001 1B. The hand switch isolates the control room, inserts a redundant fuse on the secondary side of the control power transformer, and starts the fan. The circuit is shown on drawing E-13GM01A. Based on a review of the drawing, the hand switch will isolate all portions of the control room and start the fan. Power to the fan is from MCC cubicle NG04DBF6. A previous step restores power to the MCC so that when the switch is actuated, the fan will start.

Exhaust damper GMHZ001 9 fails open when NK4413 is opened in an earlier step in OFN RP-01 7. The control circuit for GMHZ0019 is shown on drawing E-13GM04A. Hand switch GMHS0019B is no longer used in OFN RP-017 since disconnecting control power will open the damper. Therefore, exhaust damper GMHZ001 9 is protected.

Train B diesel generator room supply damper actuator GMTZ001 1A is opened in OFN RP-017 to ensure a sufficient supply of outside air to the supply fan. The damper fails open on loss of power. OFN RP-01 7 has an operator remove power from the damper actuator by opening breaker NG04DEF1 11. The circuit is shown on drawing E-1 3GM02. After power is removed, a fire in the control room cannot cause the damper to close.

The recirculation damper (GMTZ001 1B) for the Train B diesel generator room is not included in the PFSSD design. A control room fire could cause the damper to fail in the full open, full closed or partially open position due to a smart hot short on the positive polarity of the 4 - 20 mA circuit (Dwg. J-1 10-00565). A restriction plate installed in the recirculation duct will limit airflow in the recirculation line to about 69% per Calculation GM-336.

During normal operation, the outside air intake damper and recirculation damper operate as necessary to maintain the Train B EDG room within design limits. In the winter months, most of the air flow is recirculated with minimal outside air makeup. In the summer months, most of the air flow is exhausted with minimal or no recirculation. For PFSSD following a control room fire regardless of time of year, the supply fan is started, the outside air intake damper and exhaust damper are fully opened and the recirculation damper is not controlled and could fail open, closed or somewhere inbetween. Consideration was not given for ensuring the room temperature is maintained within design limits. CR 00031408 has been written to address this issue.

Based on the above discussion, the Train B diesel generator building supply fan, supply damper and exhaust damper are protected. Therefore, there will be sufficient combustion air for the diesel engine. However, this configuration may not be adeauate for maintaininQ room temDerature at all times durina the vear.

Design Basis Document for Procedure OFN RP-017 Appendix I E11FOB!5, Rev. 5 Page 20 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation GNHS0009A Containment cooler SGN01 B is started in OFN RP-01 7 to maintain the containment temperature within acceptable limits.

Hand switch GNHS0009A is placed in ISO/RUN position to start the cooler from MCC NG02TAF1. The circuit is shown on drawing E-1 3GN02A. Based on a review of the drawing, the hand switch will isolate all portions of the control room, insert a redundant fuse on the secondary side of the control power transformer, and start the cooler. Therefore, a fire in the control room will not affect the cooler after the hand switch is placed in the ISO/RUN position.

Based on the above discussion, containment cooler SGN01 B is protected.

GNHS0017A Containment cooler SGN01D is started in OFN RP-017 to maintain the containment temperature within acceptable limits.

Hand switch GNHS0017A is placed in ISO/RUN position to start the cooler from MCC NG04TAF1. The circuit is shown on drawing E-1 3GN02A. Based on a review of the drawing, the hand switch will isolate all portions of the control room, insert a redundant fuse on the secondary side of the control power transformer, and start the cooler. Therefore, a fire in the control room will not affect the cooler after the hand switch is placed in the ISO/RUN position.

Based on the above discussion, containment cooler SGN01 D is protected.

JEHS0021C Pump PJE01B is the Train B emergency diesel generator fuel oil transfer pump. The pump is started in OFN RP-017 by first placing hand switch JEHS0021C in the ISOLATE position then placing hand switch JEHS0021B in the RUN position. The circuit is shown on drawing E-1 3JE01A.

Based on a review of the drawing, hand switch JEHS0021C will isolate all portions of the control room from the circuit and insert a redundant fuse in the secondary side of the control power transformer. Hand switch JEHS0021 B will start the pump and maintain it running until the hand switch is placed in the STOP position.

Based on the above discussion, pump PJE01B is protected.

Design Basis Document for Procedure OFN RP-017 Appendix I EARAF9916, Rev. 5 Page 21 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation KJHS01 01D Procedure OFN RP-017 has operators remove the break glass from switch KJHS0101D to actuate the switch. This step energizes relays ESA and ESB on the Train B diesel generator engine control circuit (Dwg E-13KJ03A). Multiple hot shorts could cause the control power fuses that provide power to both ESA and ESB relays to open, causing a loss of power to the relays. However, the Wolf Creek licensing basis for control room fires assumes only a single spurious signal occurs as a result of the fire. Therefore, it can be assumed that one of the two relays will energize.

With at least one relay (ESA or ESB) energized, the unit parallel relay (UPR) will be de-energized (Dwg E-1 3NE1 3).

Therefore, the diesel generator will not be in droop mode and will function properly as PFSSD loads are added.

Also, with one relay (ESA or ESB) energized, relay 90 VEP will be energized which will switch the electronic voltage adjuster to a pre-determined setpoint and the voltage adjuster will ignore signals from the control room auto/manual raise/lower switches. This ensures a fire in the control room will not affect the output voltage of the EDG during the event.

Based on the above discussion, actuation of KJHS01 01 D will achieve the desired outcome.

KJHS0109 Hand switch KJHS01 09 is placed in the LOC/MAN position to isolate portions of the Train B diesel generator start/stop circuit from the control room. The switch also transfers control of the Train B diesel generator to the local panel in the diesel generator room.

Based on drawing E-13KJ03A, KJHS0109 will isolate the control room stop portion of the circuit. This will ensure a fire in the control room will not inadvertently cause the diesel engine to shut down.

KJHS0110 Hand switch KJHS01 10 is placed in the ISO position to isolate the Train B diesel generator control circuit from the control room and insert redundant fuses in a portion of the circuit.

DCP 12097 added KJHS0110 and redundant fuses to ensure power is available to the field flashing circuit. However, CR 30350 identified an issue where certain fuses located in NE106 could blow, preventing field flashing. Steps were added to address this concern in the interim until a permanent modification is implemented.

Based on a review of drawing E-1 3KJ03A, KJHS01 10 will isolate the control room so that the speed relays will be energized when the diesel engine reaches a designated speed. However, as stated above, a portion of the field flashing circuit could be affected such that the field may not flash. This would prevent the generator from generating voltage. CR 30350 is tracking this issue.

Design Basis Document for Procedure OFN RP-017 Appendix I E 1P9915, Rev. 5 Page 22 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NBO102 Breaker NBO1 02 is opened to prevent operation of the Train A containment spray pump. The close control power fuse is first removed to ensure the breaker does not close as a result of the control room fire. The circuit is shown on drawing E-1 3EN01.

The fuses that are removed are the two 15 amp fuses that protect the close circuit. The remainder of the circuit stays energized. A hot short from a fire in the control room could re-energize the positive polarity of the close circuit. However, the negative polarity will remain de-energized because the negative side of the close circuit does not run to the control room.

Therefore, a fire in the control room will not cause a hot short that closes the breaker.

Based on the above discussion, breaker NBQ102 is protected.

NB0201 through OFN RP-017 opens breakers NB0201 through NB0207, NB0209 and NB0212 to shed most of the major loads from NB02.

NB0207, NB0209 and NB0212 are opened to fail off-site power to NB02 and cause an automatic start of the Train B emergency diesel NB0209 and generator. Some of the loads are added by OFN RP-01 7 after the Train B emergency diesel generator is started. Control NB0212 power to the breakers is de-energized in a previous step. The breakers are opened by pushing the manual trip push button on the breakers. The breakers are closed when needed by pushing the manual close push button. The charging springs allow 1 cycle of operation without control power. The discussion for NK4401 / NB02 shows that the breakers are protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, the breakers are protected.

NB0208, These breakers are closed to energize various load centers and motor control centers. The discussion for NK4401 / NB02 NB0210, shows that the breakers are protected from the effects of a control room fire and will not spuriously operate after control power NB0213 and is removed. Therefore, the breakers will remain closed for the duration of the event.

NB0216 NB0211 NB0211 is closed to energize the NB02 bus from the Train B diesel generator. A previous step removes control power from the breaker, so spurious opening of the breaker caused by the control room fire will not occur. The control circuit for NB0211 is shown on drawing E-1 3NE1 1. The discussion for NK4401 / NB02 shows that the breaker is protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, NB021 1 is protected.

NB0215 NB0215 is closed to energize the Train B ESW pump. A previous step removed control power from the breaker, so spurious opening of the breaker caused by the control room fire will not occur. The control circuit for NB0215 is shown on drawing E-K3EF01A. The discussion for NK4401 / NB02 shows that the breaker is protected from the effects of a control room fire and will not spuriously operate after control power is removed. Therefore, NB0215 will remain closed for the duration of the event.

Design Basis Document for Procedure OFN RP-017 Appendix I E V9916, Rev. 6 Page 23 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NGHIS001 5 I Breaker NG0201 is verified to be closed (or manually closed if not) in OFN RP-01 7 to ensure power is available to required NG0201 loads fed from bus NG02. All PFSSD loads that are powered from NG02 are shown on drawing E-1 F9424B. Not all of these loads are required after a control room fire. The control circuit for NG0201 is shown on drawing E-1 3NG1 1B. Prior to closing (or verifying closed) NG0201, hand switch NGHIS001 5 is placed in the ISOLATE position to isolate the trip portion of the NG0201 control circuit from the control room. Based on a review of drawing E-1 3NG1 1B, placing NGHIS001 5 in the ISOLATE position will isolate the trip circuit and prevent NG0201 from tripping. If the breaker has tripped prior to placing NGHIS0015 in the ISOLATE position, and the close control power fuse has blown as a result of the fire, the breaker can be re-closed because the close springs will be charged. Therefore, the configuration is acceptable.

NGHIS0016 / Breaker NG0401 is verified to be closed (or manually closed if not) in OFN RP-017 to ensure power is available to required NG0401 loads fed from bus NG04. All PFSSD loads that are powered from NG02 are shown on drawing E-1 F9424D. Not all of these loads are required after a control room fire. The control circuit for NG0401 is shown on drawing E-1 3NG1 1A. Prior to closing (or verifying closed) NG0201, hand switch NGHIS001 6 is placed in the ISOLATE position to isolate the trip portion of the NG0201 control circuit from the control room. Based on a review of drawing E-1 3NG1 1A, placing NGHIS0016 in the ISOLATE position will isolate the trip circuit and prevent NG0401 from tripping. If the breaker has tripped prior to placing NGHIS0016 in the ISOLATE position, and the close control power fuse has blown as a result of the fire, the breaker can be re-closed because the close springs will be charged. Therefore, the configuration is acceptable.

NK4119 and The excess letdown isolation valves are failed closed in OFN RP-017 by placing 125 VDC disconnect switches NK4119 and NK4407 NK4407 in the OFF position. This de-energizes power to the valves and fails them closed. The circuit is shown on drawing E-13BG48. The power distribution arrangement is shown on drawing E-1 3RL02. The excess letdown valves are considered high/low pressure interfaces so consideration of multiple spurious actuations is required.

Based on a review of drawing E-1 3BG48, loss of power to the circuit will fail the valves closed. In order for both series valves to re-open, it would take four independent proper polarity hot shorts. Opening NK4119 and NK4407 will de-energize any potential separation group 4, 125 VDC sources in RL001/RL002. Switch PK5117 is opened in an earlier step, which removes 125 VDC from the separation group 5 source to RL001/RL002. Switch PK521 1, which provides separation group 6 125 VDC power to RLI001/RL002, is not opened in OFN RP-017. However, separation group 6 cables cannot come in contact with separation group 4 cables because of the physical separation requirements of IEEE 384, which are discussed in drawing E-11013 (5.8.1 .B). Therefore, the excess letdown isolation valves will not spuriously open after power has been removed using NK4119 and NK4407.

Based on the above discussion, the excess letdown isolation valves are protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E 1IF2215, Rev. 5 Page 24 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NK4401 Disconnect switch NK4401 is placed in the OFF position to de-energize breaker control power for bus NB02. There are no control room circuits that would prevent operation or cause spurious operation of this switch, Therefore, NK4401 is protected.

Removing breaker control power from the NB02 bus in this manner prevents spurious operation of equipment supplied by NB02. The schematic diagram for each NB02 breaker is identified in the following table.

Breaker Schematic NB0201 E-13BG01A NB0202 E-13EM01 NB0203 E-13EN01 NB0204 E-13EJ01 NB0205 E-13AL01 B NB0206 E-13EG01C NB0207 E-13EGO1D NB0208 E-13PG12A NB0209 E-13NB14 NB0210 E-13NG10A NB0211 E-13NE11 NB0212 E-13NB15 NB0213 E-13NG10A NB0214 Spare NB0215 E-K3EF01A NB0216 E-K3NG10A NB0217 Spare A review of each schematic diagram shows that a single hot short from an energized source conductor in the control room will not cause the control circuit on any of the equipment to become re-energized after control power has been removed. Two simultaneous hot shorts would be needed to re-energize the control circuit. Two or more proper polarity hot shorts are not assumed except for high/low pressure interface components. The equipment fed from NB02 is not considered high/low pressure interface so the Dotential to re-eneraize the control circuit is not credible. Therefore, the NB02 bus is Drotected.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1179915, Rev. 5 Page 25 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NK4411 The steam generator blowdown valves are failed closed in OFN RP-017 by placing 125 VDC disconnect switch NK4411 in the OFF position. The blowdown valves are not high/low pressure interfaces so consideration of multiple spurious actuations is not required. Switch NK441 1 will not spuriously actuate in the event of a control room fire. Therefore, switch NK441 1 is protected. The circuit for the blowdown valves is shown on drawings E-1 3BM06A through E-1 3BM06D. The power distribution is shown on drawing E-13RL07.

When NK4411 is placed in the OFF position, the blowdown valves will fail closed. It would take multiple proper polarity hot shorts to re-energize the valves, which is not postulated in the case of non-high/low pressure interfaces. Therefore, opening NK4411 will effectively close the blowdown valves and maintain them closed for the duration of the event.

Based on the above discussion, the steam generator blowdown valves are protected.

NK4413 Disconnect switch NK4413 is placed in the OFF position to remove 125 VDC control power from certain components fed from control room panel RL019 and RL020. There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK4413 is protected. The power distribution circuit for NK4413 is shown on drawing E-13RL05. The PFSSD equipment supplied by NK4413 includes GMHZ0019, EGHV0070A, EGHV0070B and EGTV0030. Loss of 125 VDC control power to these components will fail the components in their desired position. None of these components are high/low pressure interfaces so multiple proper polarity hot shorts do not need to be considered. The control circuit for these components is shown on drawings E-13GM04A, E-13EG08 and E-13EG16. Based on a review of these drawings it would take two proper polarity hot shorts to re-energize the control circuit for these components to fail them in an undesired position after switch NK4413 is placed in the OFF position. A single hot short will not cause the control circuit to re-energize.

Therefore, these components are protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E-1*F9U215, Rev. 5 Page 26 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NK4414 and The reactor head vent valves are failed closed in OFN RP-017 by placing 125 VDC disconnect switches NK4414 and NK5109 NK5109 in the OFF position. This de-energizes power to the head vent valves and closes the valves. The circuit is shown on drawing E-1 3BB30. The power distribution arrangement is shown on drawing E-1 3RL06. The head vent valves are considered high/low pressure interfaces so consideration of multiple spurious actuations is required.

Based on a review of drawing E-1 3BB30, loss of power to the circuit will fail the valves closed. In order for both series valves to re-open, it would take four independent proper polarity hot shorts. Opening NK4414 and NK5109 as well as NK5108 and NK4419 in earlier steps will de-energize any potential 125 VDC sources in RL021/RL022 and make this failure mode non-credible. Switch PK6117, which provides separation group 5 125 VDC power to RL021/RL022 and switch PK5205, which provides separation group 6 125 VDC power to RL021/RL022, is not opened in OFN RP-017. However, separation group 5 and 6 cables cannot come in contact with separation group 1 and 4 cables because of the physical separation requirements of IEEE 384, which are discussed in drawing E-11013 (5.8.1 .B). Therefore, the reactor head vent valves will not spuriously open after power has been removed using NK4414 and NK5109.

Based on the above discussion, the reactor head vent valves are protected.

NK4416 Disconnect switch NK4416 is placed in the OFF position to remove 125 VDC control power from SB032D. This action is taken to fail the steam dumps and cooldown valves closed. The steam dumps are not high/low pressure interfaces so multiple proper polarity hot shorts do not need to be considered. The control circuits for the steam dumps and cooldown valves are shown on schematic diagrams E-13AB08, E-13AB09, E-13AB11A, E-13AB11 B, E-13AB11 C, E-13AB12 and E-13AB31.

Based on a review of these drawings it would take two proper polarity hot shorts to re-energize the control circuit for the steam dumps and cooldown valves to fail them in an undesired position after switch NK4416 is placed in the OFF position. A single hot short will not cause the control circuit to re-energize. Therefore, the steam dumps and cooldown valves are protected.

Design Basis Document for Procedure OFN RP-017 Appendix I E 1F9915, Rev. 5 Page 27 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NK4421 Disconnect switch NK4421 is placed in the OFF position to de-energize pressurizer PORV BBPCV0456A and fail it closed.

There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK4421 is protected. De-energizing the PORV circuit in this manner prevents spurious opening of the PORV. The PORV circuit is shown on drawing E-1 3BB40. Based on a review of this drawing, a single hot short from an energized source conductor in the control room will not cause the PORV to open. It would take multiple simultaneous negative and positive hot shorts to re-energize the PORV circuit. Two or more proper polarity hot shorts are not assumed except for high/low pressure interface components. The following paragraph discusses the combination of circuit failures necessary to cause the PORVs to open.

Based on a review of drawing E-1 3BB40, in order for the PORV to open, the hot shorts would have to occur in control room panel RL021. A minimum of three 'smart' hot shorts would have to occur to open a PORV. These hot shorts include one external positive hot short, one external negative hot short and a conductor-to-conductor hot short. The external 125 VDC power source would have to be from the same separation group because IEEE-384 and E-11013 (5.8.1) do not allow cables of different separation groups to touch. Setroute was reviewed for all the separation group 4 cables with a 125 VDC potential (designated by a letter K after the system designation in the cable scheme) running to panel RL021. Based on this review the only other 125 VDC source that could energize the PORV is NK4414, which is a Separation Group 4 power supply. This switch is opened in Step C2 of OFN RP-017.

Based on the above discussion, pressurizer PORV BBPCV0456A will not spuriously open after switches NK4421 and NK4414 are opened.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E4lFOB! , Rev. 6 Page 28 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation NK5108 Disconnect switch NK5108 is placed in the OFF position to de-energize pressurizer PORV BBPCV0455A and fail it closed.

There are no control room circuits that would prevent operation or cause spurious operation of this switch. Therefore, NK5108 is protected. De-energizing the PORV circuit in this manner prevents spurious opening of the PORV. The PORV circuit is shown on drawing E-1 3BB40. Based on a review of this drawing, a single hot short from an energized source conductor in the control room will not cause the PORV to open. It would take multiple simultaneous negative and positive hot shorts to re-energize the PORV circuit. Two or more proper polarity hot shorts are not assumed except for high/low pressure interface components. The pressurizer PORVs are not considered high/low pressure interfaces per License Amendment 193. The following paragraph discusses the combination of circuit failures necessary to cause the PORVs to open.

Based on a review of drawing E-1 3BB40, in order for the PORV to open, the hot shorts would have to occur in control room panel RL021. A minimum of three 'smart' hot shorts would have to occur to open a PORV. These hot shorts include one external positive hot short, one external negative hot short and a conductor-to-conductor hot short. The external 125 VDC power source would have to be from the same separation group because IEEE-384 and E-1 1013 (5.8.1) do not allow cables of different separation groups to touch. Setroute was reviewed for all the separation group 1 cables with a 125 VDC potential (designated by a letter K after the system designation in the cable scheme) running to panel RL021. Based on this review the only other 125 VDC source that could energize the PORV is NK5109, which is a Separation Group 1 power supply. This switch is opened in Step C2 of OFN RP-017.

Based on the above discussion, pressurizer PORV BBPCV0455A will not spuriously open after switches NK4421 and NK4414 are opened.

NK5119 Disconnect switch NK5119 supplies power to main steam and feedwater isolation cabinet SA075A. Opening this disconnect switch removes power from the Train A solenoids on the Main Steam Isolation Valves and Main Feedwater Isolation Valves.

This will fail the valves in the closed position, which is the desired position for PFSSD.

PAO107, These breakers are manually tripped to stop the RCPs. The control circuit is not isolated from the control room, nor is it PA0108, required to be isolated. Per OFN RP-01 7, operators first trip the breaker, remove control power, then verify that the breaker is PA0204 and still tripped. Control power is removed by opening disconnect switches PK4103 and PK6204. Removal of control power PA0205 ensures control room fire damage will not inadvertently re-start the pump. Verification ensures the pump did not re-start prior to control power being removed. The circuit for all four RCPs is shown on drawing E-1 3BB01. The procedure adequately addresses tripping the RCP breakers and includes necessary steps to ensure the pumps do not re-start. Therefore, the configuration is acceptable.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E 1FOB! , Rev. 5 Page 29 of 30 Table Al OFN RP-01 7 Credited Component Evaluation Component Evaluation PK4103 Disconnect switch PK4103 is placed in the OFF position to remove control power from PAO1. For a control room fire, this is required to remove control power from breakers PA0107 and PA0108 for RCPs PBB01A and PBB01B, respectively, to ensure the RCPs do not re-start after they have been stopped. Other breakers on PA01 are not required for PFSSD following a control room fire. There are no control room circuits that would prevent operation or cause spurious operation of this switch.

Therefore, PK4103 is protected.

The control circuit for PAO107 and PA0108 is shown on drawing E-13BB01. Based on a review of this drawing it would take two proper polarity hot shorts to re-energize the control circuit for these breakers to start the pumps after switch PK4103 is placed in the OFF position. A single hot short will not cause the control circuit to re-energize. The RCPs are not considered high low pressure interfaces so consideration of two proper polarity hot shorts is not required. Therefore, there is reasonable assurance that the RCPs will not spuriously start after they have been stopped.

Based on the above discussion, removal of control power from PA01 in this manner will prevent spurious operation of RCPs PBB01A and PBB01 B. Therefore, the configuration is acceptable.

PK5117 Disconnect switch PK5117 is opened in OFN RP-01 7 to fail normal letdown valves BGLCV0459 and BGLCV0460 closed and fail auxiliary pressurizer spray valve BGHV8145 closed. The letdown valve circuit is shown on drawing E-13BG10. The auxiliary spray circuit is shown on drawing E-1 3BG1 9. The power distribution arrangement for PK5117 is shown on drawing E-13RL02. The letdown isolation valves are considered high/low pressure interfaces so consideration of multiple spurious actuations is required. The spray valve is not considered a high/low pressure interface so multiple proper polarity hot shorts do not need to be considered.

Letdown Valves Based on a review of drawing E-13BGI0, loss of power to the circuit will fail the letdown valves closed. In order for both series valves to re-open, it would take four independent proper polarity hot shorts. Opening PK5117 as well as NK4119 and NK4407 in another step will de-energize these potential 125 VDC sources in RLO01/RLOO2. The separation group 6 source of 125 VDC power remains available from switch PK521 1. Based on E-1 1013 (5.8.3) separation groups 5 and 6 cables could be bundled together within the control room cabinets. Therefore, a source of 125 VDC power is available in RL0O1/RLOO2 to re-energize and open the valves.

When PK5117 is opened, the two series letdown isolation valves (BGLCV0459 and BGLCV0460) fail closed and all three parallel letdown orifice isolation valves (BGHV8149A, BGHV8149B and BGHV8149C) fail closed. To re-establish a letdown flow path, three valves would need to re-open (both letdown isolation valves and one letdown orifice isolation valve). This would require six independent proper polarity hot shorts (3 negative and 3 positive) which is not credible.

Design Basis Document for Procedure OFN RP-017 Appendix 1 E-1FOB!5, Rev. 5 Page 30 of 30 Table Al OFN RP-017 Credited Component Evaluation Component Evaluation Based on the above discussion, there is reasonable assurance that the letdown isolation valves will not re-open after PK5117 is placed in the OFF position.

Auxiliary Pressurizer Spray Valve Based on a review of drawing E-13BG19, loss of power to the circuit will fail the spray valve closed. In order for the valve to re-open, it would two independent proper polarity hot shorts which is not postulated for non-high/low pressure interfaces.

Based on the above discussion, there is reasonable assurance that the auxiliary pressurizer spray valve will not re-open after PK5117 is placed in the OFF position.

PK6204 Disconnect switch PK6204 is placed in the OFF position to remove control power from PA02. For a control room fire, this is required to remove control power from breakers PA0204 and PA0205 for RCPs PBB01 D and PBB01 C, respectively, to ensure the RCPs do not re-start after they have been stopped. Other breakers on PA02 are not required for PFSSD following a control room fire. There are no control room circuits that would prevent operation or cause spurious operation of this switch.

Therefore, PK6204 is protected.

The control circuit for PA0204 and PA0205 is shown on drawing E-13BB01. Based on a review of this drawing it would take two proper polarity hot shorts to re-energize the control circuit for these breakers to start the pumps after switch PK6204 is placed in the OFF position. A single hot short will not cause the control circuit to re-energize. The RCPs are not considered high low pressure interfaces so consideration of two proper polarity hot shorts is not required. Therefore, there is reasonable assurance that the RCPs will not spuriously start after they have been stopped.

Based on the above discussion, removal of control power from PA02 in this manner will prevent spurious operation of RCPs PBB01C and PBB01D. Therefore, the configuration is acceptable.

Design Basis Document for Procedure OFN RP-017 Appendix 2 95, Rev.5 E I FOQl Page 1 of 37 Appendix 2 Control Room Fire Consequence Evaluation for Motor Operated Valves

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FOB!5, Rev. 5 Page 2 of 37 Table A2 documents an evaluation of the impact on post-fire safe shutdown if a fire occurs in the control room and affects motor operated valve circuits. The evaluation was originally performed per a corrective action for CR 041746-02-02. The evaluation has been added to E-1F9915 to ensure the information is maintained in a controlled document.

Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumen P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BGHIS8109 RL001 M-12BG03 (E-6) BGHV8109 Normal Charging Valve could open The NCP is not used for PFSSD. Ifloss of flow occurs Pmp Recirc or remain closed, in the charging header and this valve fails closed, the NCP could be damaged. This will have no adverse impact on PFSSD since the Train B CCP is available in the event of a control room fire.

BGHIS0112C RL001 M-12BG03 (E-7) BGLCV0112C VCT Outlet Valve Valve can fail Valve is closed in OFN RP-017 by placing BGHS0112C closed or remain in the ISO/CLOSE position. Valve has been modified to open until address NRC IN 92-18. Ifthe valve fails closed before ISO/CLOSE switch lining up the RWST, the operating charging pump will is actuated. lose suction and will be damaged. If RCP seal cooling flowpath remains available, then the pumps would have 12 gpm on the suction side, which is not sufficient to protect the running pump. If the seal flowpath is affected, which is possible for a fire in this cabinet, there will be no flow in the system. Prior to restoring power to the valve and operating ISO/CLOSE switch BGHS01 12C there is a possibility of H2 intrusion into the charging pump suction. Since the NCP is the normally operating pump and is not credited for PFSSD, damage to it will not adversely affect PFSSD.

A SIS would provide a permissive for the valve to close but the valve would not close until the RWST to charging valve is open. Therefore, a SIS would not cause a loss of suction to the pump.

BGHIS0112B RL001 M-12BG03 (F-7) BGLCV0112B VCT Outlet Valve Valve could close Valve is not relied upon for PFSSD following a control or remain open. room fire. Valve BGLCV01 12C is credited in OFN RP-017. See discussion for BGHIS0112C for PFSSD impact if the valve spuriously closes.

BGHIS8112 RL001 M-12BG01 (E-3) BGHV8112 Seal Water Ret Cont Valve could close See discussion for BGHIS8100.

Iso Valve or remain open.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E lF9915, Rev. 5 Page 3 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BGHIS8100 RL001 M-12BG01 (E-2) BGHV8100 Seal Water Ret Cont Valve could close If the valve closes, seal leakoff flow would be directed to Iso Valve or remain open. the reactor coolant drain tank rather than the seal water heat exchanger. There is no adverse impact on PFSSD if this occurs. RCP seal damage will not occur because OFN RP-017 stops the RCPs and isolates seal injection.

BGHIS8104 RL001 M-12BG05 (B-4) BGHV8104 Immediate Borate to Valve could open The valve can fail in any position with no impact on CCP Suction or remain closed. PFSSD. If the valve fails open with the boric acid transfer pumps running, boron will be added to the RCS, causing a reduction in reactivity. If the valve fails closed, it is in the correct PFSSD position.

BGHIS8110 RL001 M-12BG03 (E-3) BGHV8110 CCP A Recirc Valve could close Ifthe A CCP is running at the time of the fire and this or remain open. valve closes with little or no flow in the system, the pump could be damaged. The NCP is normally operating, so this is not a concern under normal operating conditions. The B CCP is credited for a control room fire so damage to the A CCP due to a control room fire will not adversely impact PFSSD.

BNHIS0112D RL001 M-12BNO1 (B-5) BNLCV0112D RWST to CCP Valve could open If the valve opens, there is no adverse impact on or remain closed. PFSSD since it would provide a suction source to the charging pump header. If the valve remains closed, CCP suction would be available from the VCT unless the VCT outlet valves close. OFN RP-017 lines up the RWST up to the charging header by opening BNLCV0112E before starting the B CCP. Therefore, failure of this valve to open will not affect PFSSD in the event of a control room fire.

BNHIS0112E RL001 M-12BN01 (F-3) BNLCV0112E RWST to CCP Valve could open If the valve opens, there is no adverse impact on or remain closed. PFSSD since it would provide a suction source to the charging pump header. If the valve remains closed, CCP suction would be available from the VCT unless the VCT outlet valves close. OFN RP-017 lines up the RWST up to the charging header before starting the B CCP. The valve is opened by placing BNHS0112E in the ISO/OPEN position.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E I1F9-11, Rev. 5 Page 4 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumen' P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BGHIS8111 RL001 M-12BG03 (E-4) BGHV8111 COP B Recirc Valve could close, Ifthe B CCP is running at the time of the fire and this causing a loss of valve closes with little or no flow in the system, the CCP B mini flow. pump could be damaged. The NCP is normally operating, so this is not a concern under normal operating conditions. Procedure OFN RP-017 opens this valve by placing BGHS81 11 A in the ISO/OPEN position.

BGHIS8106 RL001 M-12BG03 (E-3) BGHV8106 CCP to Regen Hx Valve could open If this valve closes, it is in the desired PFSSD position.

Iso or close If it remains open, charging flow would continue until manual valve BG8402B is closed.

BGHIS8105 RL001 M-12BG03 (E-3) BGHV8105 CCP to Regen Hx Valve could open If this valve closes, it is in the desired PFSSD position.

Iso or close If it remains open, charging flow would continue until manual valve BG8402B is closed.

BGHS8110 RL001 M-12BG03 (E-3) BGHV8110 CCP A Recirc Iso Could cause a Switch is used to reset a safety injection signal. Based Reset spurious reset or on a review of drawing E-1 3BG1 1B, fire damage to the prevent a reset, switch will not cause the valve to open or close.

Furthermore, the valve is not credited for PFSSD following a control room fire so the position of the valve will not affect PFSSD.

BGHS81 11 RL001 M-12BG03 (E-5) BGHV8111 CCP B Recirc Iso Could cause a Switch is used to reset a safety injection signal. Based Reset purious reset or on a review of drawing E-1 3BG1 1C, fire damage to the prevent a reset, switch will not cause the valve to open or close.

Therefore, there is no adverse impact on PFSSD.

Procedure OFN RP-01 7 opens this valve by placing BGHS81 11A in the ISO/OPEN position. Damage to the switch and associated cables will not prevent BGHS81 11A from performing this function.

BGHIS8357A RL001 M-12BG03 (C-4) BGHV8357A CCP A to RCP Seals alve could open None. Seal injection is isolated by closing BGV0101 or remain closed, and BGV0105 in procedure OFN RP-017. With the valve open or closed, there is no adverse impact on PFSSD.

BGHIS8357B RL001 M-12BG03 (B-4) BGHV8357B CCP B to RCP SealsValve could open None. Seal injection is isolated by closing BGV0101 or remain closed, and BGV0105 in procedure OFN RP-017. With the valve open or closed, there is no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9916, Rev. 6 Page 5 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BBHIS8157A RL001 M-12BB02 (E-1) BBHV8157A Excess Letdown to Could allow excess Could potentially lose -50 gpm to the PRT if one excess PRT letdown flow to the letdown heat exchanger inlet flowpath (2 valves) also PRT if 2 other open. The excess letdown heat exchanger inlet valves valves to the are also controlled from RL001, so this condition could excess letdown occur but it would require multiple spurious operations.

heat exchanger Wolf Creek is not required to consider multiple spurious also open. operations in the event of a control room fire.

Furthermore, excess letdown is isolated in OFN RP-017 by opening breakers NK4119 and NK4407 to fail the excess letdown valves closed. Based on E-1F9915, operators have 37 minutes to mitigate a failed open excess letdown flowpath assuming 100 gpm loss. OFN RP-017A opens BBHV8157A to re-establish a letdown flowpath for cold shutdown. Valve BBHV8157A has been modified to address IN 92-18 concerns and is therefore available.

BBHIS8157B RL001 M-12BB02 (D-1) BBHV8157B Excess Letdown to Could allowexcess Could potentially lose -50 gpm to the PRT if one excess PRT letdown flow to the letdown heat exchanger inlet flowpath (2 valves) also PRT if 2 other opens. The excess letdown heat exchanger inlet valves valves to the are also controlled from RL001, so this condition could excess letdown occur but it would require multiple spurious operations.

heat exchanger Wolf Creek is not required to consider multiple spurious also open. operations in the event of a control room fire.

Furthermore, excess letdown is isolated in OFN RP-01 7 by opening breakers NK4119 and NK4407 to fail the excess letdown valves closed. Based on E-1F9915, operators have 37 minutes to mitigate a failed open excess letdown flowpath assuming 100 gpm loss. OFN RP-017A opens BBHV8157B to re-establish a letdown flowpath for cold shutdown. Valve BBHV8157B has been modified to address IN 92-18 concerns and is therefore available.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F991, Rev. 5 Page 6 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire AEHIS0016 RL005 M-12AE01 (E-5) AEHV0016 SG Feed Pump A Could cause the The main feedwater pumps are not used for PFSSD. If FW Disch Valve valve to close or the valve closes, PFSSD is achieved using auxiliary remain open. feedwater. Ifthe valve stays open, backflow through the pump is prevented by check valve AEV0023.

Steam generator overfill is prevented by opening switch NK5119 to fail close the MFIVs. Therefore, damage to this switch will not adversely impact PFSSD.

AEHIS0015 RL005 M-12AE01 (C-5) AEHV0015 SG Feed Pump B Could cause the The main feedwater pumps are not used for PFSSD. If FW Disch Valve valve to close or the valve closes, PFSSD is achieved using auxiliary remain open. feedwater. Ifthe valve stays open, backflow through the pump is prevented by check valve AEV0022.

Steam generator overfill is prevented by opening switch NK5119 to fail close the MFIVs. Therefore, damage to this switch will not adversely impact PFSSD.

ALHIS0036A RL005 M-12AL01 (B-4) ALHV0036 CST to TDAFP Valve could This valve is required to be open in OFN RP-017 to Suction spuriously close, provide a suction source from the CST to the TDAFP.

The valve is verified open in Step 87 and opened if it is not. This is a Train A valve so it is not isolated from the control room. Rather, the power is de-energized in Step 5.c to prevent spurious operation. If the valve spuriously closes before opening the breaker, an operator can locally open the valve. The valve was modified in DCP 12170 to address IN 92-18. Therefore, damage to this switch will not adversely impact PFSSD.

ALHIS0032A RL005 M-12AL01 (D-3) ALHV0032 ESW A to TDAFP Valve could This valve is normally closed and is not used in OFN Suction spuriously open or RP-017. Train A ESW is not used in OFN RP-017. The remain closed, valve can fail in any position with no adverse impact on PFSSD.

ALHIS0035A RL005 M-12AL01 (D-3) ALHV0035 CST to MDAFP A Valve could Valve is normally open to provide a suction source from puriously close, the CST to the Train A MDAFP. The Train A MDAFP is not used in OFN RP-017 and therefore this valve can fail closed with no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FA99115, Rev. 6 Page 7 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumenr P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire ALHIS0031A RL005 M-12AL01 (E-3) ALHV0031 ESWto MDAFP A Valve could Valve is normally closed and opens on LSP signal to spuriously open or provide a suction source from Train A ESW to the Train remain closed. A MDAFP. The Train A MDAFP is not used in OFN RP-017. This valve can fail in any position with no adverse impact on PFSSD.

LHIS0033A RL005 M-12AL01 (C-3) ALHV0033 ESW to TDAFP Valve could This valve is opened in OFN RP-017 when aligning the spuriously open or alternate AFW source. The valve is isolated from the remain closed, control room using RP HIS-2 in Step A-1. If the valve fails open it is possible that ESW would enter the TDAFP suction, which would allow raw water to enter the steam generators. This will not adversely affect PFSSD. Ifthe valve fails closed, it can be lined up to the TDAFP after it is isolated in Step Al. The valve was modified to address IN 92-18 in DCP 12170. In either case, there is no adverse impact on PFSSD.

ALHIS0034A RL005 M-12AL01 (H-4) ALHV0034 CST to MDAFP B Valve could Valve is required to be open to provide the primary spuriously close, source of AFW from the CST to the Train B MDAFP.

The valve is isolated from the control room in Step Al using RP HIS-2 and opened using AL HIS-34B at the ASP. The valve was modified in DCP 12170 to address IN 92-18. Therefore, spurious operation of the valve will not adversely impact PFSSD.

ALHIS0030A RL005 M-12AL01 (G-3) LHV0030 ESW to MDAFP B Valve could This valve is opened in OFN RP-017 when aligning the spuriously open or alternate AFW source. The valve is isolated from the remain closed, control room using RP HIS-2 in Step A-1. Ifthe valve fails open it is possible that ESW would enter the MDAFP B suction, which would allow raw water to enter the steam generators. This will not adversely affect PFSSD. If the valve fails closed, it can be lined up to the B MDAFP after it is isolated in Step Al. In either case, there is no adverse impact on PFSSD. The valve was modified in DCP 12170 to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-IF9915, Rev. 5 Page 8 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumen P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire FCHIS0312A RL005 M-12FC02 (G-3) FCHV0312 TDAFP Trip and Could prevent This valve is required in OFN RP-017 to provide steam Throttle Valve operation of the to the TDAFP. The valve is isolated from the control valve. room in Step Al and opened in Step A13. If the valve goes full open, steam would flow only if either valve ABHV0005 or ABHV0006 and valve FCFV0313 also open. Valve FCFV0313 is normally open with the controller in manual and set to 3850 RPM. Therefore, with the proper valve lineup there could be steam release through the TDAFP. Excessive steam flow would likely result in FCHV0312 tripping on high speed.

The valve was not modified to address NRC IN 92-18 because control relays in the circuit prevent the concern identified in NRC IN 92-18.

ALHKO007A RL006 M-12AL01 (F-8) ALHV0007 SG A MD Aux FW B Could prevent flow Damage to this switch could cause a loss of auxiliary Control Valve control from feedwater flow control from the Train B MDAFP to SG MDAFP B to SG A. A. The Train B MDAFP is used in OFN RP-01 7 to supply SG D only. SG A is not credited in OFN RP-017 since the dump valve is on Train A. Ifthis valve were to open while running the Train B MDAFP, auxiliary feedwater would flow to SG A but with possibly no steam dump capability the SG would overfill. Manual valve ALVO032 is closed in OFN RP-017 to prevent overfilling SG A.

kLHK0009A RL006 M-12AL01 (E-8) ALHV0009 SG B MD Aux FW A Could prevent flow Damage to this switch could cause a loss of auxiliary Control Valve control from feedwater flow control from the Train A MDAFP to SG MDAFP A to SG B. B. The Train A MDAFP is not used in OFN RP-017.

The pump is secured in OFN RP-017 to prevent overfilling SGs B and C.

6-LHK0011A RL006 M-12AL01 (C-8) ALHV0011 SG C MD Aux FW A Could prevent flow Damage to this switch could cause a loss of auxiliary Control Valve control from feedwater flow control from the Train A MDAFP to SG MDAFP A to SG C. C. The Train A MDAFP is not used in OFN RP-017.

The pump is secured in OFN RP-017 to prevent I_ I I overfilling SGs B and C.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9915, Rev. 6 Page 9 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire ALHKO005A RL006 M-12AL01 (H-8) ALHV0005 SG D MD Aux FW B Could prevent flow Damage to this switch could cause a loss of auxiliary Control Valve control from feedwater flow control from the Train B MDAFP to SG MDAFP B to SG D. D. This valve is credited in OFN RP-017 to ensure a flow path from MDAFP B to SG D. The valve is controlled in Step A5. Prior to Step A5 the valve could either fail open, fail closed or fail somewhere in-between. There is no adverse impact on PFSSD prior to controlling the valve. The design of the valve would not allow it to be damaged per IN 92-18 so the valve was not modified to address this concern. This is because the valve is a positionable MOV using hand controller ALHKO005A. Fire damage to the controller or circuits will not bypass the limit switches at the valve.

Also, the thermal overloads for the valve are not bypassed, so they would open to protect the valve.

Therefore, the valve cannot be damaged in a manner described in IN 92-18.

OHS-WL025A RL013 M-0024, Sh. 2 OWL0014 Low Level Iso Vlv Could prevent The makeup water system is not required for PFSSD.

(H-6) Ctrl Sw operation of the Spurious operation of the valve will not adversely impact valve. safe shutdown.

OHS-WL026A RL013 M-0024, Sh. 2 OWL0015 Dewater Iso VIv Ctrl Could prevent The makeup water system is not required for PFSSD.

(H-5) Sw operation of the Spurious operation of the valve will not adversely impact valve. safe shutdown.

OHS-WL028A RL013 M-0024, Sh. 2 OWLOO17 Dewater Disch Vlv Could prevent The makeup water system is not required for PFSSD.

(H-3) Ctrl Sw operation of the Spurious operation of the valve will not adversely impact valve. safe shutdown.

OHS-WL027A RL013 M-0024, Sh. 2 OWL0016 Blowdown Iso Vlv Could prevent The makeup water system is not required for PFSSD.

(D-6) Ctrl Sw operation of the Spurious operation of the valve will not adversely impact valve. safe shutdown.

0HS-WL029AA, RL013 M-0024, Sh. 2 (F- WL0018 Blowdown Disch VIv Could prevent The makeup water system is not required for PFSSD.

DHS-WL029AB ) Ctrl Sw operation of the Spurious operation of the valve will not adversely impact 1C valve. safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F92915, Rev. 5 Page 10 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BNHIS0003 RL017 M-12BNO1 (C-3) BNHV0003 RWST to Could close or If the valve remains in its normally open position with no Containment Spray remain open. other spurious actuations, there would be no adverse Pump B impact on PFSSD. However, if the CS B pump starts and the containment spray isolation valve opens then Train B containment spray would occur and RWST inventory will be depleted until containment spray is stopped. The flow in the containment spray system with one pump operating is approximately 3,000 gpm.

Based on calculation XX-E-013, Appendix 1, a maximum of 214,260 gallons of water can be lost from the RWST to maintain sufficient volume to achieve cold shutdown. Therefore, operators have approximately 71 minutes to stop the containment spray pump. The Train B pump is stopped in OFN RP-017 prior to 71 minutes.

Therefore, the pump will be stopped within the required Ctime period to prevent unacceptable RWST draindown.

ENHIS0007 RL017 M-12ENOI (B-7) ENHV0007 ontainment Recirc Could spuriously This valve is not credited for PFSSD. If it spuriously Sump to open. opens or remains closed there is no adverse impact on Containment Spray PFSSD. Check valve ENVO008 will prevent the RWST Pump B from draining to the containment sump if the valve opens.

ENHIS0016 RL017 M-12EN01 (D-4) ENHV0016 Spray Additive Tank Could open or This valve is not credited for PFSSD. If it spuriously Isolation Valve remain closed, opens or remains closed there is no adverse impact on PFSSD.

ENHIS0012 RL017 M-12EN01 (C-4) ENHV0012 Containment Spray Could spuriously If this valve opens with no other spurious actuations, Isolation Valve open. there would be no adverse impact on PFSSD.

However, if the CS B pump starts then containment spray would occur, taking suction from the RWST. 71 minutes are available to mitigate this condition before the RWST reaches a level below that required for cold shutdown. Operators stop the CS B pump in OFN RP-017 prior to 71 minutes. Therefore, the pump would be stopped within the required time period to prevent unacceptable RWST draindown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9915, Rev. 5 Page 11 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumenl P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BNHIS8806B RL017 M-12BNO1 (E-3) BNHV8806B RWST to SI Pumps Could close or If this valve remains in its normally open position, then Suction remain open. there would be no adverse impact on PFSSD. If a spurious SIS occurs, there is no adverse impact because the SI pumps will not inject if RCS pressure is above 1565 psi. The SI pumps are not credited for PFSSD so if the valve closes, there would be no adverse impact.

EMHIS8923B RL017 M-12EMOI (D-7) EMHV8923B SI Pump B Suction Could close or Ifthis valve remains in its normally open position, then Isolation Valve remain open. there would be no adverse impact on PFSSD. If a spurious SIS occurs, there is no adverse impact because the SI pumps will not inject if RCS pressure is above 1565 psi. If the valve spuriously closes, there is no adverse impact since the Train B SI pump is not credited for PFSSD.

EMHIS8924 RL017 M-12EM01 (G-8) EMHV8924 CVCS to SI pump Could close or This normally open valve, along with normally closed Suction remain open. parallel valves EMHV8807A and EMHV8807B provide an alternate SI pump suction path from the CVCS suction header. The SI system is not used for PFSSD.

This valve can fail in any position with no adverse impact on PFSSD.

EMHIS8807B RL017 M-12EM01 (F-7) EMHV8807B CVCS to SI pump Could open or If this normally closed valve opens with the SI pumps Suction remain closed, off, there is no adverse impact on PFSSD. If the pumps start there will be no flow in the system and RWST inventory will be maintained.

BNHIS8813 RL017 M-12BNO1 (C-7) BNHV8813 SI Return to RWST Could close or This normally open valve provides a return flowpath remain open. from the Sl pumps to the RWST. If the valve closes with SI pumps running, damage could occur to the pumps if there is no flow in the system. The SI pumps are not credited for PFSSD so there would be no adverse impact.

BNHIS8813A RL017 M-12BNO1 (C-7) BNHV8813 alve BNHV8813 Could close or This switch is a power lockout for valve BNHV8813 and Power Lockout remain open. is normally in the ISO position, which maintains the valve in the open position. There is no adverse impact on PFSSD if this switch is affected.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E !F99O.5, Rev. 5 Page 12 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumen P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EJHIS8804B RL017 M-12EJ01 (B-4) EJHV8804B RHR HX B to SI Could open or The valve is required to remain closed for PFSSD when Pump B remain closed, operating Train B RHR for cold shutdown. Ifthe valve opens prior to reaching RHR entry conditions there would be no adverse impact on PFSSD. Valve was modified to address IN 92-18 and is closed in OFN RP-017A to support cold shutdown.

EMHIS8814B RL017 M-12EM01 (B-5) EMHV8814B SI Pump B Return to Could close or This normally open valve provides a return flowpath RWST remain open. from the Train B SI pump to the RWST. If the valve closes with Train B SI pump running, damage could occur to the pump if there is no flow in the system. The Train B SI pump is not credited for PFSSD so there would be no adverse impact.

EMHIS8821B RL017 M-12EM01 (D-4) EMHV8821B SI Pump B to RCS Could close or The position of this valve (open or closed) has no Cold Leg Injection remain open. adverse impact on PFSSD. Ifthe SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8802B RL017 M-12EM01 (D-4) EMHV8802B SI Pump B Could open or The position of this valve (open or closed) has no Discharge Valve remain closed, adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8802BA RL017 M-12EM01 (D-4) EMHV8802B Valve EMHV8802B Could open or The position of this valve (open or closed) has no Power Lockout remain closed, adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8835 RL017 M-12EM01 (C-4) EMHV8835 SI Cold Leg Injection Could close or The position of this valve (open or closed) has no Valve remain open. adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8835A RL017 M-12EM01 (C-4) EMHV8835 Valve EMHV8835 Could close or The position of this valve (open or closed) has no Power Lockout remain open. adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8821A RL017 M-12EM01 (E-4) EMHV8821A SI Pump A to RCS Could close or The position of this valve (open or closed) has no Cold Leg Injection remain open. adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FS 9! , Rev. 5 Page 13 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EMHIS8802A RL017 M-12EM01 (F-4) EMHV8802A SI Pump A Could open or The position of this valve (open or closed) has no Discharge Valve remain closed, adverse impact on PFSSD. Ifthe SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

EMHIS8802AA RL017 M-12EM01 (F-4) EMHV8802A Valve EMHV8802A Could open or The position of this valve (open or closed) has no Power Lockout remain closed, adverse impact on PFSSD. If the SI pumps are running, injection will not occur until the RCS pressure drops below 1565 psig.

-MHIS8923A RL017 M-12EM01 (F-7) EMHV8923A SI Pump A Suction Could close or Ifthis valve remains in its normally open position with no Isolation Valve remain open. other spurious actuations, then there would be no adverse impact on PFSSD. If the valve spuriously closes, there is no adverse impact since the Train A SI pump is not credited for PFSSD.

EMHIS8814A RL017 M-12EM01 (B-6) EMHV8814A SI Pump A Return to Could close or This normally open valve provides a return flowpath RWST remain open. from the Train A SI pump to the RWST. If the valve closes with Train A SI pump running, damage could occur to the pump if there is no flow in the system. The Train A SI pump is not credited for PFSSD so there would be no adverse impact.

ENHIS0006 RL017 M-12ENO1 (H-4) ENHV0006 Train A Containment Could spuriously If this valve opens with no other spurious actuations, Spray Isolation open. there would be no adverse impact on PFSSD.

Valve However, if the A CS pump starts then containment spray would occur, taking suction from the RWST. 71 minutes are available to mitigate this condition before the RWST reaches a level below that required for cold shutdown. The CS A pump is stopped in OFN RP-017 prior to 71 minutes. Therefore, the pump will be stopped within the required 71 minutes.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FA-9! 6, Rev. 5 Page 14 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumenl P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BNHIS0004 RL017 M-12BN01 (B-3) BNHV0004 RWST to Could close or Ifthe valve remains in its normally open position with no Containment Spray remain open. other spurious actuations, there would be no adverse Pump A impact on PFSSD. However, if the A CS pump starts and the containment spray isolation valve opens, Train A containment spray would occur and RWST inventory will be depleted until containment spray is stopped. The flow in the containment spray system with one pump operating is approximately 3,000 gpm. Based on calculation XX-E-013, Appendix 1, a maximum of 214,260 gallons of water can be lost from the RWST to maintain sufficient volume to achieve cold shutdown.

Therefore, operators have approximately 71 minutes to stop the containment spray pump. The A CS pump is stopped in OFN RP-017 prior to 71 minutes. Therefore, RWST inventory will be maintained.

ENHIS0015 RL017 M-12EN01 (D-6) ENHV0015 Spray Additive Tank Could open or This valve is not credited for PFSSD. If it spuriously Isolation Valve remain closed, opens or remains closed there is no adverse impact on PFSSD.

ENHIS0001 RL017 M-12EN01 (G-7) ENHV0001 Containment Recirc Could spuriously This valve is not credited for PFSSD. If it spuriously Sump to open. opens or remains closed there is no adverse impact on Containment Spray PFSSD. Check valve ENVO002 will prevent the RWST Pump A from draining to the containment sump if the valve opens.

BBHIS8702A RL017 M-12BB01 (F-4) BBPV8702A RCS Hot Leg to None This valve is normally deenergized and is maintained RHR Pump A closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A.

EJHIS8701A RL017 M-12EJOI (G-8) EJHV8701A RCS Hot Leg to None This valve is normally deenergized and is maintained RHR Pump A closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-IF99-15, Rov. 5 Page 15 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumenl P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire BNHIS8812A RL017 M-12BNO1 (B-3) BNHV8812A RWST to RHR alve could close Ifthe valve closes there is no adverse impact on Pump A Suction or remain open. PFSSD. Ifthe valve remains open and valve EJHV881 1A opens, then the RWST would drain to the containment sump. OFN RP-017 closes BNHV8812A to prevent draindown via this path. BNHV8812A has been modified to address IN 92-18 per DCP 12173.

Calculation XX-E-013, Appendix 1 has determined there is 28 minutes to mitigate RWST draindown to the sump if one RWST to sump flowpath fails open. This condition will be mitigated before the RWST drops below minimum level needed for cold shutdown.

EJHIS881 1A RL017 M-12EJ01 (F-7) EJHV8811A Ctmt Recirc Sump to Valve could Damage to this switch could cause the valve to open.

RHR A Suction spuriously open. In addition, valve BNHV8812A may not automatically close as designed, causing the RWST to drain to the sump. This condition is mitigated in OFN RP-017 by manually closing BNHV8812A within the required time period of 28 minutes. The valve was modified to address NRC IN 92-18.

EJHIS0610 RL017 M-12EJ01 (H-6) EJFCV0610 RHR Pump A Valve could close. Damage to this switch has no adverse impact on Miniflow Valve PFSSD since the Train A RHR system is not credited for a control room fire. The position of this valve (open or closed) will have no adverse impact on hot standby.

EJHIS8804A RL017 M-12EJ01 (H-4) EJHV8804A RHR A to CVCS Iso Valve could open Valve is required to remain closed when operating Train Valve or remain closed. A RHR to prevent flow diversion to the charging header.

The position of this valve (open or closed) will have no adverse impact on hot standby. The Train A RHR system is not credited for a control room fire so spurious operation of this valve will have no adverse impact on PFSSD.

EJHIS8716A RL017 M-12EJ01 (E-3) EJHV8716A RHR Pump A Hot Valve could close Damage to this switch could cause the valve to close or Leg Recirc or remain open. prevent it from closing. The Train A RHR system is not credited for PFSSD following a control room fire so damage to this switch will have no adverse impact on the ability to achieve cold shutdown. The position of this valve (open or closed) will have no adverse impact on hot standby. OFN RP-017A closes EJHV8840 to prevent hot leg recirculation when lining up RHR for cold shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9916, Rev. 5 Page 16 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EJHIS8809A RL017 M-12EJO1 (G-3) EJHV8809A RHR A to Cold Leg Valve could close The Train A RHR system is not credited for a fire in the Injection Loops 1 or remain open. control room. The position of this valve (open or closed) and 2. will have no adverse impact on safe shutdown.

EJHIS8809AA RL017 M-12EJ01 (G-3) EJHV8809A Valve EJHV8809A Valve could close The Train A RHR system is not credited for a fire in the power lockout. or remain open. control room. The position of this valve (open or closed) will have no adverse impact on safe shutdown.

EMHIS8807A RL017 M-12EM01 (G-7) EMHV8807A CVCS to SI pump Valve could open If this normally closed valve opens with no other Suction or remain closed, spurious actuations, there is no adverse impact on PFSSD. If the pumps start there will be no flow in the system and RWST inventory will be maintained.

EJHIS8809B RL017 M-12EJ01 (C-3) EJHV8809B RHR B to Cold Leg Valve could close This valve is credited for a fire in the control room when Inj Loops 3 and 4 or remain open. lining up Train B RHR in OFN RP-017A for cold shutdown. Spurious operation of the valve during hot standby will not impact PFSSD. The valve was modified to address IN 92-18.

EJHIS8809BA RL017 M-12EJ01 (C-3) EJHV8809B RHR B to Cold Leg Valve could close This valve is credited for a fire in the control room when Inj Loops 3 and 4 or remain open. lining up Train B RHR in OFN RP-017A for cold shutdown. Spurious operation of the valve during hot standby will not impact PFSSD. The valve was modified to address IN 92-18.

EJHIS8840 RL017 M-12EJ01 (E-3) EJHV8840 RHR Hot Leg Recirc Valve could open This valve is closed in OFN RP-017A to prevent hot leg Valve or remain closed. recirculation. The position of this valve (open or closed) will have no adverse impact on hot standby. The valve was modified to address IN 92-18.

EJHIS8840A RL017 M-12EJ01 (E-3) EJHV8840 RHR Hot Leg Recirc Valve could open This valve is closed in OFN RP-017A to prevent hot leg Valve or remain closed. recirculation. The position of this valve (open or closed) will have no adverse impact on hot standby. The valve was modified to address IN 92-18.

EJHIS8716B RL017 M-12EJOI (C-3) EJHV8716B RHR Pump B Hot Valve could close Damage to this switch could cause the valve to close or Leg Recirc or remain open. prevent it from closing. The position of this valve (open or closed) will have no adverse impact on hot standby.

OFN RP-01 7A closes EJHV8840 to prevent hot leg recirculation when lining up RHR for cold shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 11FA9911, Rev. 6 Page 17 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EJHIS0611 RL017 M-12EJ01 (B-6) EJFCV0611 RHR B Miniflow Valve could close. If the valve closes there will be no adverse impact Valve unless the Train B RHR pump starts in which case the pump would have no recirc flow. The pump is stopped (or prevented from starting) in OFN RP-017. Valve EJFCV0611 is lined up in OFN RP-017A when placing RHR in service. The valve was modified to address IN 92-18.

EJHIS8701B RL017 M-12EJ01 (C-8) EJHV8701B RCS Hot Leg to None This valve is normally deenergized and is maintained RHR Pump B closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A.

3BH1S8702B RL017 M-12BB01 (H-5) BBPV8702B RCS Hot Leg to None This valve is normally deenergized and is maintained RHR Pump B closed. Damage to the hand switch will have no adverse impact on PFSSD since the valve cannot move from the closed position. Prior to lining up RHR for shutdown cooling, the valve is lined up in OFN RP-017A.

3NHIS8812B RL017 M-12BNO1 (D-3) BNHV8812B RWST to RHR B Valve could close If the valve closes there is no adverse impact on Suction or remain open. PFSSD. Ifthe valve remains open and valve EJHV881 1B opens, then the RWST would drain to the containment sump. OFN RP-017 closes BNHV8812B using BNHS8812B. Calculation XX-E-013, Appendix 1 has determined there is 28 minutes to mitigate RWST draindown to the sump if one RWST to sump flowpath fails open. This condition will be mitigated before the RWST drops below minimum level needed for cold shutdown. The valve has been modified to address NRC IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-IF9915, Rev. 5 Page 18 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumeni P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EJHIS881 1B RL017 M-12EJ01 (D-7) EJHV8811B Ctmt Recirc Sump to Valve could Valve EJHV881 1B is required to be closed for hot RHR B Suction spuriously open. standby (OFN RP-0 17) and cold shutdown (OFN RP-017A). Damage to this switch could cause the valve to open. In addition, valve BNHV8812B may not automatically close as designed, causing the RWST to drain to the sump. This condition is mitigated in OFN RP-017 using switch BNHS8812B. Procedure OFN RP-017A provides guidance to locally close this valve prior to lining up RHR for shutdown cooling. The valve has been modified to address NRC IN 92-18.

BNHIS8806A RL017 M-12BN01 (B-5) BNHV8806A RWST to SI Pumps Could close or If this valve remains in its normally open position, then Suction remain open. there would be no adverse impact on PFSSD. If a spurious SIS occurs, there is no adverse impact because the SI pumps will not inject if RCS pressure is above 1,565 psi. The SI pumps are not credited for PFSSD so if the valve closes, there would be no adverse impact.

EGHIS0101 RL017 M-12EG02 (G-4) EGHV0101 CCWto RHR HX A Valve could open If the valve opens, there is no adverse impact. If the or close valve closes, CCW flow to the Train A RHR heat exchanger would be prevented. The Train A RHR system is not credited for safe shutdown following a fire in the control room. The valve can fail in any position with no adverse impact on PFSSD.

EGHIS0102 RL017 M-12EG02 (C-4) EGHV0102 CCWto RHR HX B Valve could open If the valve opens, there is no adverse impact. If the or close valve closes, CCW flow to the Train B RHR heat exchanger would be prevented. The Train B RHR system is credited for safe shutdown following a fire in the control room. The system is lined up in OFN RP-017A. The valve has been modified to address NRC IN 92-18.

BNHIS8812AA RL017 M-12BNO1 (B-3) BNHV8812A RWST to RHR Valve could close See discussion for BNHIS8812A.

Pump A Suction or remain open.

BNHIS8812BA RL017 M-12BN01 (D-3) BNHV8812B RWSTto RHR B Valve could close See discussion for BNHIS8812B.

Suction or remain open.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E- 1 FOB! 5, Rev. 5 Page 19 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EMHIS8803B RL018 M-12EM02 (B-7) EMHV8803B CCP B to BIT Valve could remain Valve is required to be open in OFN RP-017. The valve closed or open. is manually opened in OFN RP-017 Step B12. If the valve spuriously opens, it is in the desired position and PFSSD is unaffected. The valve has been modified to address NRC IN 92-18.

EMHIS8803A RL018 M-12EM02 (C-7) EMHV8803A CCP A to BIT Valve could remain Valve is not used in OFN RP-017. If it spuriously opens closed or open. or fails in the closed position there is no impact on PFSSD.

EPHIS8808B RL018 M-12EP01 (F-5) EPHV8808B ,ccum Tank B Could cause the The position of this valve (open or closed) has no Outlet Iso Valve valve to close or impact on PFSSD. The valve is used to control lineup remain open. of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD.

During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

EPHIS8808A RL018 M-12EPOI (G-5) EPHV8808A ccum Tank A ould cause the The position of this valve (open or closed) has no Outlet Iso Valve valve to close or impact on PFSSD. The valve is used to control lineup remain open. of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD.

During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

EPHIS8808C RL018 M-12EP01 (D-5) EPHV8808C ccum Tank C Could cause the The position of this valve (open or closed) has no Outlet Iso Valve valve to close or impact on PFSSD. The valve is used to control lineup remain open. of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD.

During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

EPHIS8808D RL018 M-12EP01 (B-5) EPHV8808D Accum Tank D Could cause the The position of this valve (open or closed) has no Outlet Iso Valve valve to close or impact on PFSSD. The valve is used to control lineup remain open. of the accumulator to the RCS. The accumulator tanks are not used for PFSSD and therefore spurious operation of the valve will not adversely impact PFSSD.

During shutdown, the accumulators are prevented from injecting in OFN RP-017A by isolating the outlet valves.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 11FA99115, Rev. 5 Page 20 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire EMHIS8801B RL018 M-12EM02 (D-4) EMHV8801B BIT Discharge Iso Could cause the This valve is required to be open in OFN RP-017 to Valve valve to open or provide a charging path to the RCS. Step B18 opens remain closed the valve locally manually. Ifthe valve opens as a result of the fire, it is in the desired PFSSD position. The valve has been modified to address NRC IN 92-18.

EMHIS8801A RL018 M-12EM02 (E-4) EMHV8801A BIT Discharge Iso Could cause the This valve is not used in OFN RP-017. Ifthe valve Valve valve to open or opens as a result of the fire, then a flow path from remain closed charging to the RCS will be established as required. If the valve fails to open, valve EMHV8801 B is opened in Step B18. Therefore, spurious operation of the valve will not affect PFSSD.

KCHIS0253B RL018 M-12KC02 (B-6) KCHV0253 Fire Protection Could prevent A fire in the control room does not require operation of Header Outer Ctmt operation of the the containment fire suppression system. Damage to iso Valve valve this switch has no adverse impact on PFSSD.

Valve is normally closed. If the valve opens, valve EGHV0012 will prevent ESW water from entering the

-SW to CCW Train Could cause the CCW system. If both valves open, the CCW surge tank EGHIS0014 RL019 M-12EGO1 (C-7) EGHV0014 talve B Makeup to open. would fill solid, however this would not impact the ability of the CCW system to perform its intended function. If necessary, manual valve EGV0185 could be closed to isolate the makeup.

Valve is normally closed. Ifthe valve opens, valve EGHV0014 will prevent ESW water from entering the ESWtoCCWTrain Could cause the CCW system. If both valves open, the CCW surge tank EGHIS0012 RL019 V-12EG01 (C-8) EGHV0012 B Makeup valve to open. would fill solid, however this would not impact the ability of the CCW system to perform its intended function. If necessary, manual valve EGV0185 could be closed to isolate the makeup.

Valves are closed when operating the Train A CCW system and opened when operating the Train B CCW

)GHV0016, CCWCTrain B to/from Could cause the system. If the valves spuriously open, they are in the EGHS0016 RL019 M-12EGO1 (C-7) EGHV04 Ceraine BLo/rom alves to close or desired PFSSD position for OFN RP-017. If the valves EGHV0054 Servie Loop open. are closed, OFN RP-017 opens them using switches EGHS0016A and EGHS0054. The valves were modified to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F991 6, Rev. 5 Page 21 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0126, Could cause the needs to be open for cold shutdown when using the EGHIS0071 RL019 M-12EG3 (H-6) EGHV0071 CCW to RCS Iso alve to close or excess letdown heat exchanger. If the valve fails Valve remain open closed, it will be manually open in OFN RP-01 7A. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017. Valve was modified to address IN 92-18.

Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0127, Could cause the needs to be open for cold shutdown when using the EGHIS0058 RL019 M-12EG03 (H-6) EGHV0058 CCW to RCS Iso alve to close or excess letdown heat exchanger. Ifthe valve fails Valve remain open. closed, it will be manually open in OFN RP-017A. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017. Valve was modified to address IN 92-18.

Valve is normally open and can be in any position for OFN RP-01 7. This valve is not required for cold CCW Return from Could causeth shutdown. Ifthe valve fails closed, it is in the desired RCS Iso Valve remain open. PFSSD position. If the valve fails open, the CCW system is protected from a steam bubble by closing EGHV0061 and EGHV0133 in OFN RP-017.

Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0130, needs to be open for cold shutdown when using the excess letdown heat exchanger. Ifthe valve fails CCW Return RCS Iso Valvefrom Could temain cause open. th closed, it will valve fails be manually open, there is noopen in OFN adverse RP-017A.

impact Ifthe with CCW continuing to flow through the RCP bearing coolers, motor air coolers, excess letdown heat exchanger and RCDT heat exchanger. Valve was modified to address IN 92-18.

Valve is normally open and is required to be closed in CCW Return from Could cause the OFN RP-017 to prevent a postulated steam bubble from EGHIS0061 RL019 M-12EG3 (1-5) EGHV061 R alve to close or forming in the CCW piping, potentially causing a water remain open. hammer. The valve is manually closed in OFN RP-017.

Valve was modified to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9915, Rev.5 Page 22 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire Valve is normally open and can be in any position for OFN RP-017. This valve, or bypass valve EGHV0131, needs to be open for cold shutdown when using the Could cause the excess letdown heat exchanger. If the valve fails EGHIS0059 RL019 M-12EG3 (B3-5) EGHV0059 CCW Return from alve to close or closed, it will be manually open in OFN RP-017A. If the RCS Iso Valve rvalve fails open, there is no adverse impact with CCW eremain open. continuing to flow through the RCP bearing coolers, motor air coolers, excess letdown heat exchanger and RCDT heat exchanger. Valve was modified to address IN 92-18.

Valve is normally open and can be in any position for PFSSD. Ifthe valve closes, ESW return to the UHS is Bould cause the controlled by EFHV0038 in OFN RP-017. Ifthis valve EFHIS0042 RL019 M-12EF02 (D-2)ESW Ealve B to Servie to close or and EFHV0040 remains open, there is no adverse remain open. impact because proper ESW flow is ensured.

Therefore, spurious operation of this valve will not affect PFSSD.

Valve is normally throttled and is required to be fully Could cause the open in OFN RP-01 7. If the valve fails open, it is in the EFHIS0038 RL019 M-12EF02 (D-2) EFHV0038 ESW B to UHS valve to close or desired PFSSD position. If it fails closed, it will be remain open. opened in OFN RP-017 using the isolation handswitch at the MCC. Valve has been modified to address IN 92-18.

Ceould cause the Valve is normally open and can be in any position for rESW not A ESW isimpact credited for PFSSD in WVaterA to Servie remain tocen.

Wateaie open. PFSSD.

valve will Train OFN RP-017. Therefore, not adversely spurious operation PFSSD. of this This valve is normally closed with manual valve EFV0090 throttled to provide the proper flow for SIS or mCould cause the LOSP. If the valve opens, flow balance in the ESW EFHIS0060 RL019 M-12EF02ESW B Return from to open or system will be affected. Ifthe valve closes, ESW flow COW Hx B remain closed. through the CCW heat exchanger is ensured via normally throttled manual valve EFV0090. DCP 13898 is being prepared to modify the valve to address IN 92-18.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E !F99115, Rev. 5 Page 23 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire Valve is required to be open in OFN RP-017 to ensure Could cause the proper operation of the containment air coolers. The EFHIS46 RL019 M-12EF02 (C-6) EFHV046 ESW B from Ctmt valve to close or valve is opened in OFN RP-017 when lining up the remain open. containment coolers. Valve has been modified to address IN 92-18.

Valve is required to be open in OFN RP-017 to ensure Could cause the proper operation of the containment air coolers. The EFHIS0050 RL019 M-12EF02 (C-6) EFHV0050 ESW B from Ctmt valve to close or valve is opened in OFN RP-017 when lining up the remain open. containment coolers. Valve has been modified to address IN 92-18.

This flowpath is required to be isolated in OFN RP-017 to prevent flow diversion from ESW to the service water ESW B from Service Could cause the system. Valve EFHV0026, which is installed in series EFHIS0024 RL019 M-12EF01 (E-6) EFHV0024 Water Cross valve to close or with this valve, is isolated in OFN RP-017. If EFHV0024 Connect remain open. closes, then it is in the desired PFSSD position. If EFHV0024 remains open, valve EFHV0026 is closed to isolate this flowpath.

Valve is normally open and is required to be open for EFHIS0052 RL019 M-12EF02 (D-5) EFHV0052 ESW B to CCW Hx Could cause t OFN RP-017. Ifthe valve spuriously closes, it is B aemain open. opened in OFN RP-017 using EFHS0052. Valve has been modified to address IN 92-18.

Could cause the Valve is required to be open in OFN RP-017 to ensure EFHIS0032 RL019 M-12EF02 (C-8) EFHV0032 ESW B to Ctmt Air valve to close or proper operation of the containment air coolers. The Coolers valve is opened in OFN RP-017 using EFHS0032.

remain open. Valve has been modified to address IN 92-18.

Could cause t Valve is required to be open in OFN RP-017 to ensure EFHIS0034 RL019 M-12EF02 (C-7) EFHV0034 ESW B to Ctmt Air alve to close or proper operation of the containment air coolers. The Coolers rvalve is opened in OFN RP-017 using EFHS0034.

r"emain open. Valve has been modified to address IN 92-18.

ESWA from Service Could cause the Train A ESW is not used in OFN RP-017. Spurious EFHIS0023 RL019 M-12EFO1 (F-6) EFHV0023 Water Cross valve to close or Train A this valve in OFN impact puriou Connect remain open. operation of this valve will not adversely impact PFSSD.

EFHIS0051 RL019 M-12EF02 (H-5) EFHV0051 ESWA to CCW Hx C3ould oued cause cause the th Train A ESW is not credited in OFN RP-017. Spurious A aemain open. operation will not adversely impact PFSSD.

ESW A to Could cause the Train A ESW is not credited in OFN RP-017. Spurious EFHIS0031 RL019 M-12EF02 (G-8) EFHV0031 Containment Air valve to close or operation will not adversely impact PESSO.

Coolers remain open.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1F9915, Rev. 5 Page 24 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumenl P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire ESW A to Could cause the Train A ESW is not credited in OFN RP-017. Spurious EFHIS0033 RL019 M-12EF02 (G-7) EFHV0033 Containment Air valve to close or Train wisnot credt inpacN P-017.

Coolers remain open. operation will not adversely impact PFSSD.

ESW A from Service Could cause the Train A ESW is not used in OFN RP-017. Spurious EFHIS0025 RL019 M-12EF01 (F-7) EFHV0025 Water Cross valve to close or operation of this valve will not adversely impact PFSSD.

Connect remain open.

Valve is normally open and can be in any position for PFSSD. If the valve closes, ESW return to the UHS is Could cause the controlled by EFHV0038 in OFN RP-017. If this valve EFHIS0040 RL019 M-12EF02 (D-2) EFHV0040 Water valve to close or and EFHV0042 remains open, there is no adverse remain open. impact because proper ESW flow is ensured.

Therefore, spurious operation of this valve will not affect PFSSD.

ESW 0CW A Return from HxBalve Could to cause closethe or Train A ESW operation is not of this used valve willinnot OFN RP-017.impact adversely Spurious PFSSD.

ESFW H Brom open.

oudremain ESW A from Could cause the Train A ESW is not credited in OFN RP-017. Spurious EFHIS0045 RL019 M-12EF02 (G-6) EFHV0045 Containment Air valve to close or operation will not adversely impact PFSSD.

Coolers remain open.

This flowpath is required to be isolated in OFN RP-017 ESW B from Service Could cause the to prevent flow diversion from ESW to the service water ESH00266 Wa froms Sevice Coul case te system. The valve is isolated in OFN RP-017 using FHIS0026 RL019 -12EF01 (E-7) EFHV0026 Water Cross ralve to close or EFHS0026A. If it spuriously closes, it is in the desired Connect remain open. PFSSD position. Valve has been modified to address IN 92-18.

ESWA from Could cause the Train A ESW is not credited in OFN RP-017. Spurious EFHIS0049 RL019 M-12EF02 (G-6) EFHV0049 Containment Air valve to close or operation will not adversely impact PFSSD.

Coolers remain open.

Could cause the Train A ESW is not credited in OFN RP-017. Spurious EFHIS0037 RL019 M-12EF02 (G-3) EFHV0037 ESW A to UHS valve to close o[ operation will not adversely impact PrSSD.

remain open.

Valve is normally open and can be in any position for EFHIS0039 RL019 M-12EF02 (F-2) EFHV0039 ESWA to Service Could cause th PFSSD. Train A ESW is not credited for PFSSD in ater raie tlosen. o OFN RP-017. Therefore, spurious operation of this Iemain open. valve will not adversely impact PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FQ-9! 5, Rev. 5 Page 25 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire These valves are open when operating the Train A CCW system. Valve EGHV001 5 is manually closed in cause the OFN RP-017 to prevent flow diversion from Train B EGHS0015 RL019 M-12EG01 (D-6) EGHV0015, CCW Train A to/from Could valves to close or CCW to Train A CCW system. Valve EGHV0015 has EGHV0053 Service Loop aes ose been modified to address IN 92-18. Valve EGHV0053 remain open. is not used in OFN RP-017 because check valve EGV0036 will prevent flow from the train B CCW system to the train A CCW system.

SWtoCould cause the Train A CCW is not credited in OFN RP-017. Spurious EGHIS001 1 RL019 M-12EGO1 (F-8) EGHV001 1 A valve to open or operation will not adversely impact PFSSD.

______"__________ remain closed. operationwillnotadverselyimpactPFSSD.

SWtoCould cause the Train A CCW is not credited in OFN RP-017. Spurious EGHIS0013 RL019 M-12EGO1 (F-7) EGHV0013 talve to open or remain closed, operation will not adversely impact PFSSD.

Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0059, needs to be open for cold shutdown when using the excess Could prevent letdown heat exchanger. Damage to the switch could EGHIS0131 RL2 M-12EG3 (C-5) EGHV031 C Return Ctmt operation of the prevent opening the valve but will not cause the valve to salve. spuriously open since switch EGHIS0131A is normally in the ISO position. Ifthe valve fails dosed there is no PFSSD impact because valve EGHV0059 will be manually opened in OFN RP-017A.

Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0058, needs to be open for cold shutdown when using the excess Could l prevent letdown heat exchanger. Damage to the switch could EGHIS0127 RL020 -12EG03(G-4) EGHV0127 Iso Valve operation of the prevent opening the valve but will not cause the valve to Is Valve. spuriously open since switch EGHIS0127A is normally in the ISO position. If the valve fails closed there is no PFSSD impact because valve EGHV0058 will be I_ manually opened in OFN RP-017A.

Could prevent Valve is normally closed with this hand switch in the ISO operation of the position, preventing accidental opening of the valve.

EGHIS0131A RL020 M-12EG03(0-5) EGHV0131 CCW Return Ctmt power lockout This valve, or valve EGHV0059, needs to be open for Iso Valve feature and could cold shutdown when using the excess letdown heat cause spurious exchanger. If the valve fails closed, valve EGHV0059 operation of valve. will be manually opened in OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-1FS-15-5, Rev. 5 Page 26 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumen! P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire Valve is normally open and is required to be closed in OFN RP-017 to prevent a postulated steam bubble from forming in the CCW piping, potentially causing a water EGHIS133 RL2 M-12EG03(D-5) EGHV133 CW Return Ctmt operation of the hammer. Damage to the switch could prevent operation

[so Valve valve. of the valve but will not cause the valve to spuriously open since switch EGHIS0133A is normally in the ISO position. The valve is manually closed in OFN RP-017.

Valve has been modified to address IN 92-18.

Could prevent Valve is normally open and is required to be closed in operation of the OFN RP-017 to prevent a postulated steam bubble from EGHIS0I33A RL020 M-12EG03 (D-5) EGHV0133 CCW Return Ctmt power lockout forming in the CCW piping, potentially causing a water iso Valve feature and could hammer. Ifthe valve spuriously opens it will be cause spurious manually closed in OFN RP-017. Valve has been operation of valve, modified to address IN 92-18.

If the valve opens, there is no adverse impact on PFSSD. Valve GSHV0020 will remain closed or, if GSHIS0021 RL020 M-12GS01 (G-4) GSHV0021 Hyd Purge Outer ralvecould open GSHV0020 also opens, the Aux Building ESF filters will prevent release of radioactivity. In either case, PFSSD is assured.

Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0060, needs to be open for cold shutdown when using the excess CCW Return Ctmt Could prevent letdown heat exchanger. Damage to the switch could EGHIS0130 RL020 M-12EG03 (B-5) EGHV0130 Iso Valve operation of the prevent opening the valve but will not cause the valve to Valve. spuriously open since switch EGHIS0130A is normally in the ISO position. If the valve fails closed there is no PFSSD impact because valve EGHV0060 will be manually opened in OFN RP-017A.

Valve is normally closed and can be in any position for OFN RP-017. This valve, or valve EGHV0071, needs to be open for cold shutdown when using the excess CCW Supply Ctmt Could prevent letdown heat exchanger. Damage to the switch could EGHIS0126 RL020 M-12EG03 (G-5) EGHV0126 Iso Valve operation of the prevent opening the valve but will not cause the valve to valve. spuriously open since switch EGHIS0126A is normally in the ISO position. Ifthe valve fails closed there is no PFSSD impact because valve EGHV0071 will be I__ Imanually opened in OFN RP-017A.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FP9915, Rev. 5 Page 27 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire Valve is normally closed with this hand switch in the ISO Could prevent position, preventing accidental opening of the valve.

operation of the This valve, or valve EGHV0071, needs to be open for HCOW Supply Ctmt power lockout cold shutdown when using the excess letdown heat Iso Valve feature and could exchanger. Ifthe valve fails closed, valve EGHV0071 cause spurious will be manually opened in OFN RP-017A. If the valve operspuion ofval fails open, the CCW system is protected from a steam operation of valve. bubble by closing EGHV0061 and EGHV0133 in OFN RP-017.

Could prevent Valve is normally closed with this hand switch in the ISO operation of the position, preventing accidental opening of the valve.

EGHIS0130A RL020 M-12EG03 (B-5) EGHV0130 COW Return Ctmt power lockout This valve, or valve EGHV0060, needs to be open for Iso Valve feature and could cold shutdown when using the excess letdown heat cause spurious exchanger. If the valve fails closed, valve EGHV0060 operation of valve. will be manually opened in OFN RP-017A.

Valve is normally closed and can be in any position for OFN RP-017. This valve is not required for cold Could prevent shutdown. Damage to the switch could prevent opening EGHIS132 RL2 M-12EG03(B-4) EGHV132 CW Return Ctmt operation of the the valve but will not cause the valve to spuriously open Vso Valve alve. since switch EGHIS0132A is normally in the ISO position. Ifthe valve fails closed there is no PFSSD impact.

Could prevent Valve is normally closed and can be in any position for operation of the OFN RP-017. This valve is not required for cold EGHIS0132A RL020 M-12EG03(B-4) EGHV0132 CCW Return Ctmt power lockout shutdown. If the valve fails closed, it is in the desired Iso Valve feature and could PFSSD position. If the valve fails open, the CCW cause spurious system is protected from a steam bubble by closing operation of valve. EGHV0061 and EGHV0133 in OFN RP-017.

If the valve opens, there is no adverse impact on PFSSD. Valve GSHV0021 will remain closed or, if GSHIS0020 RL020 M-12GS01 (G-5) SHV0020 Hyd Purge Inner ralve could open GSHV0021 also opens, the Aux Building ESF filters will prevent release of radioactivity. In either case, PFSSD is assured.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E-IF9915, Rev. 6 Page 28 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire The Post-Accident Sampling System is not used for Could prevent PFSSD. If the valve opens, CCW will flow to the PASS EGHIS0072 RL020 M-12EG02 (H-2) EGHV0072 CCW Iso to PASS operation of the coolers only if three other valves also open. Ifthis valve. occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

The Post-Accident Sampling System is not used for Could prevent PFSSD. If the valve opens, CCW will flow to the PASS EGHIS0074 RL020 M-12EG02 (H-i) EGHV0074 CCW Iso to PASS operation of the coolers only if three other valves also open. If this valve. occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

Valve is normally closed with this hand switch in the ISO Could prevent position, preventing accidental opening of the valve.

Couperaonofthe This valve, or valve EGHV0058, needs to be open for operation of the cold shutdown when using the excess letdown heat EGHIS0127A RL020 M-12EG03 (G-4) EGHV0127 isoCW Supply Ctmt Valve ower lockout feature and could exchanger. If the valve fails closed, valve EGHV0058 ecevavfaldodaveGVO8 will be manually open in OFN RP-017A. If the valve cause spurious fails open, the CCW system is protected from a steam operation of valve. bubble by closing EGHV0061 and EGHV0133 in OFN RP-017.

The Post-Accident Sampling System is not used for Could prevent PFSSD. Ifthe valve opens, CCW will flow to the PASS coolronyftheotevavsaoop.Ifhi EGHIS0073 RL020 M-12EG02 (H-2) EGHV0073 CCW Iso to PASS operation of the lers only if three other valves also open. If this valve. occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with all PFSSD loads.

The Post-Accident Sampling System is not used for Could prevent PFSSD. If the valve opens, CCW will flow to the PASS EGHIS0075 RL020 M-1 2EG2 (H-I) EGHV0075 CCW iso to PASS operation of the coolers only if three other valves also open. Ifthis valve. occurs, there is no adverse impact on PFSSD since the CCW system is sized to supply this load concurrent with I I_ all PFSSD loads.

RL021 Could cause the Spurious opening of the valve will not cause a loss of PRT Drain to Ctmt valve to spuriously inventory in the RCS. The valve is used to drain the BBHIS8037A M-12BB02 (D-3) BBHV8037A Norm Sump open. contents of the PRT to the sump.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FG9153,Rev. 5 Page 29 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire RL021 Could cause the Spurious opening of the valve will not cause a loss of PRT Drain to Ctmt valve to spuriously inventory in the RCS. The valve is used to drain the BBHIS8037B M-12BB02 (D-3) BBHV8037B _Norm Sump open. contents of the PRT to the sump.

RL021 The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the Could prevent valves closed. Therefore, failure of this valve to close BBHS8000A M-12BB02 (E-7) BBHV8000A Cold O/P Arm Sw closing the valve, will have no adverse impact on PFSSD.

RL021 The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the Could prevent valves closed. Therefore, failure of this valve to close BBHS8000B M-12BB02 (F-8) BBHV8000B Cold 0/P Arm Sw closing the valve, will have no adverse impact on PFSSD.

RL021 RCP thermal barrier cooling is not credited in OFN RP-Could cause 017. The CCW service loop is isolated in OFN RP-017 spurious operation so there will be no flow to the thermal barrier. Spurious BBHIS0013 M-12BB03 (C-3) BBHV0013 CCW from RCP A of the valve, operation of this valve will have no adverse impact.

RL021 RCP thermal barrier cooling is not credited in OFN RP-Could cause 017. The CCW service loop is isolated in OFN RP-017 spurious operation so there will be no flow to the thermal barrier. Spurious BBHIS0014 M-12BB03 (C-3) BBHV0014 CCW from RCP B of the valve, operation of this valve will have no adverse impact.

RL021 RCP thermal barrier cooling is not credited in OFN RP-Could cause 017. The CCW service loop is isolated in OFN RP-017 spurious operation so there will be no flow to the thermal barrier. Spurious BBHIS0015 M-12BB03 (C-3) BBHV0015 CCW from RCP C f the valve, operation of this valve will have no adverse impact.

RL021 RCP thermal barrier cooling is not credited in OFN RP-Could cause 017. The CCW service loop is isolated in OFN RP-01 7 spurious operation so there will be no flow to the thermal barrier. Spurious BBHIS0016 M-12BB03 (C-3) BBHV0016 CCW from RCP D f the valve, operation of this valve will have no adverse impact.

RL021 Seal injection is not required for OFN RP-01 7. Seal injection is isolated in OFN RP-017 using valves Seal Wtr Supply to Could cause the BGV0101 and BGV0105. Spurious closure of this valve BBHIS8351A M-12BB03 (D-5) BBHV8351A RCP A valve to close, will have no adverse impact on PFSSD.

RL021 Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves Seal Wtr Supply to Could cause the BGV0101 and BGV0105. Spurious closure of this valve BBHIS8351B M-12BB03 (D-5) BBHV8351B RCP B valve to close, will have no adverse impact on PFSSD.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9915, Rev.. 5 Page 30 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumeni P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire RL021 Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves Seal Wtr Supply to Could cause the BGV0101 and BGV0105. Spurious closure of this valve BBHIS8351C _ M-12BB03 (D-5) BBHV8351C RCP C valve to close, will have no adverse impact on PFSSD.

RL021 Seal injection is not required for OFN RP-017. Seal injection is isolated in OFN RP-017 using valves Seal Wtr Supply to Could cause the BGV0101 and BGV0105. Spurious closure of this valve BBHIS8351D M-12BB03 (D-5) BBHV8351D RCP D valve to close, will have no adverse impact on PFSSD.

RL021 The pressurizer PORVs are closed in OFN RP-017 by disconnecting power to the circuit. This will fail the Could prevent valves closed. Therefore, failure of this valve to close BBHIS8000A M-12BB02 (E-7) BBHV8000A Cold O/P Arm Sw closing the valve, will have no adverse impact on PFSSD.

RL021 The pressurizer PORVs are closed in OFN RP-01 7 by disconnecting power to the circuit. This will fail the Could prevent valves closed. Therefore, failure of this valve to close BBHIS8000B M-12BB02 (F-7) BBHV8000B Cold O/P Arm Sw closing the valve, will have no adverse impact on PFSSD.

RL021 Valve controls CCW flow to the Fuel Pool Hx. The fuel Could cause pool cooling system is not required for PFSSD.

Fuel Pool Hx CCW spurious operation Spurious operation of the valve will not adversely impact ECHIS0011 M-12ECO1 (H-5) ECHV0011 Disch Iso A of the valve. safe shutdown.

RL021 Valve controls CCW flow to the Fuel Pool Hx. The fuel Could cause pool cooling system is not required for PFSSD.

Fuel Pool Hx CCW spurious operation Spurious operation of the valve will not adversely impact ECHIS0012 M-12ECO1 (E-5) ECHV0012 Disch Iso B of the valve, safe shutdown.

LFHIS0105 RL023 M-12LF03 (C-5) LFHV0105 Control/Aux Bldg Could cause the The auxiliary building drainage system is not relied on Sump Iso VIv valve to close or for PFSSD. Spurious operation of this valve will not open. adversely impact PFSSD.

LFHIS0106 RL023 M-12LF03 (C-4) LFHV0106 Control/Aux Bldg Could cause the The auxiliary building drainage system is not relied on Sump Iso VIv valve to close or for PFSSD. Spurious operation of this valve will not open. adversely impact PFSSD.

AFHIS01 13 RL023 M-12AF02 (C-7) AFLVO113C Feed Wtr Htr 4A Iso Could cause the The feed water heaters are not required for PFSSD.

Vlv valve to close or Spurious operation of the valve will not adversely impact

_open. safe shutdown.

,FHS0106 RL023 M-12AF02 (E-7) AFLVO106C Feed Wtr Htr 3A Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F99115, Rev. 6 Page 31 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumeni P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire AFHIS0144 RL023 M-12AF02 (C-5) AFLVO144C Feed Wtr Htr 4B Iso Could cause the The feed water heaters are not required for PFSSD.

VIv valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

,FHS0136 RL023 M-12AF02 (E-5) AFLVO136C Feed Wtr Htr 38 Could cause the The feed water heaters are not required for PFSSD.

Drain iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHIS0173 RL023 M-12AF02 (C-3) AFLV0173C Feed Wtr Htr 4C Iso Could cause the The feed water heaters are not required for PFSSD.

VIv valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0165 RL023 M-12AF02 (E-3) AFLVO165C Feed Wtr Htr 3C Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0007 RL023 M-12AF01 (G-8) AFLVO007C Feed Wtr Htr 7A Could cause the The feed water heaters are not required for PFSSD.

AFLVO007D Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact AFLVO007E open. safe shutdown.

PFHS0012 RL023 M-12AF01 (E-7) AFLVO012C Feed Wtr Htr 6A Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0012 RL023 M-12AF01 (E-7) ,FLVO012D MSR C Scavenging Could cause the The feed water heaters are not required for PFSSD.

Steam to HP Htr 6A valve to close or Spurious operation of the valve will not adversely impact

)pen. safe shutdown.

AFHS0012 RL023 M-12AF01 (E-7) PFLVO012E MSR A Scavenging 3ould cause the The feed water heaters are not required for PFSSD.

Steam to HP Htr 6A ialve to close or Spurious operation of the valve will not adversely impact

)pen. safe shutdown.

AFHIS0024 RL023 M-12AF01 (D-7) AFLVO024C Feed Wtr Htr 5A Iso Could cause the The feed water heaters are not required for PFSSD.

Vlv /alve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0058 RL023 M-12AF01 (F-2) AFLVO058C Feed Wtr Htr 78 Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0058 RL023 M-12AF01 (F-2) AFLVO058D Feed Wtr Htr 78 Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0058 RL023 M-12AFOI (F-2) AFLVO058E Feed Wtr Htr 7B Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vivs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1 Fool, Rev. 5 Page 32 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire AFHS0044 RL023 M-12AF01 (E-3) AFLV0044C Feed Wtr Htr 6B Could cause the The feed water heaters are not required for PFSSD.

Drain Iso Vlvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

PFHS0044 RL023 M-12AFO1 (E-3) PFLVO044D Feed Wtr Htr 6B Could cause the The feed water heaters are not required for PFSSD.

Drain Iso VIvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHS0044 RL023 M-12AF01 (E-3) PFLVO044E Feed Wtr Htr 6B Could cause the The feed water heaters are not required for PFSSD.

Drain Iso VIvs valve to close or Spurious operation of the valve will not adversely impact open. safe shutdown.

AFHIS0064 RL023 M-12AFO1 (D-3) AFLVO064B Feed Wtr Htr 5B Iso Could cause the The feed water heaters are not required for PFSSD.

Vlv valve to close or Spurious operation of the valve will not adversely impact

-open. safe shutdown.

AFHIS0210 RL023 M-12AF01 (C-3) AFHV0210 Htr Dm Tk Start Up Could cause the The heater drain tank is not required for PFSSD.

Drn to Cond valve to close or Spurious operation will not impact safe shutdown.

)pen.

ADHIS0008 RL023 M-12AD02 (C-3) ADHV0008 Cond Pump A Disch Could prevent The condensate pumps are not required for PFSSD.

Iso operation of the Spurious operation of the valve will not adversely impact

/alve. safe shutdown.

ADHIS0017 RL023 M-12AD02 (C-5) ADHV0017 Cond Pump B Disch 3ould prevent The condensate pumps are not required for PFSSD.

Iso operation of the Spurious operation of the valve will not adversely impact valve. safe shutdown.

ADHIS0024 RL023 M-12AD02 (C-7) ADHV0024 Cond Pump C Disch Could prevent The condensate pumps are not required for PFSSD.

Iso operation of the Spurious operation of the valve will not adversely impact valve. safe shutdown.

ADHIS0028 RL023 M-12AD02 (C-2) ADHV0028 Cond Demin Bypass Could prevent The valve is not required for PFSSD. Spurious operation of the operation of the valve will not adversely impact safe ialve. shutdown.

LFHIS0095 RL023 M-12LF09 (F-2) LFFV0095 Cont Sump Iso VIv Could cause the The reactor building drainage system is not relied on for ialve to close or PFSSD. Spurious operation of this valve will not

)pen. adversely impact PFSSD.

FCHIS0004 RL023 M-12FC03 (H-3) FCHV0004 SGFP Turb A Above Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain talve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS0104 RL023 M-12FC04 (H-3) FCHV0104 SGFP Turb B Above ould cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

__open.

Design Basis Document for Procedure OFN RP-017 Appendix 2 EAFSF1915, Rev. 6 Page 33 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire FCHIS0007 RL023 M-12FC03 (H-3) FCHV0007 SGFP Turb A Below Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS0107 RL023 M-12FC04 (H-3) FCHV0107 SGFP Turb B Below Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS0012 RL023 M-12FC03 (F-3) FCHV0012 SGFP Turb A Above Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS01 12 RL023 M-12FC04 (F-3) FCHV0112 SGFP Turb B Above Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS001 3 RL023 M-12FC03 (F-3) FCHV0013 SGFP Turb A Below Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS0113 RL023 M-12FC04 (F-3) FCHV0113 -GFP Turb B Below Could cause the The SGFP is not required for PFSSD. Damage to the Seat Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS0071 RL023 M-12FC03 (A-4) FCHV0071 SGFP Turb A Could cause the The SGFP is not required for PFSSD. Damage to the Startup Drain valve to close or switch will have no adverse impact on PFSSD.

open.

FCHIS0171 RL023 M-12FC04 (A-4) FCHV0171 SGFP Turb B Could cause the The SGFP is not required for PFSSD. Damage to the Startup Drain valve to close or switch will have no adverse impact on PFSSD.

open.

ADHIS01 13 RL023 M-12AD01 (F-4) ADHV01 13A, Vacuum Breaker Could cause the The condenser vacuum breaker valves are not required ADHV01 13B, Valves valve to close or for PFSSD. Spurious operation will not adversely ADHV0113C, open. impact PFSSD.

ADHV0113D KAHIS0030 RL024 M-12KA01 (C-1) KAHV0030 Inst Air Supply to H2 Could cause the The H2 control system is not credited for PFSSD.

Ctrl System valve to close or Damage to this switch will not adversely impact safe remain open. shutdown.

ACHIS0251 RL024 M-12AC02 (G-6) ACHV0251, 2nd Stage Reheater Could cause the The moisture separator reheater is not required for ACHV0252, Steam Drains valves to close or PFSSD. Spurious operation of the valves will have no ACHV0261, open. adverse impact on safe shutdown.

ACHV0263

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1FOB! , Rev. 5 Page 34 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrument P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire ACHIS0189 RL024 M-12AC02 (G-7) ,CHV0189A, 1st Stage Reheater Could cause the The moisture separator reheater is not required for ACHV0189B, Steam Supply valve to close or PFSSD. Spurious operation of the valve will have no ACHV0189C, open. adverse impact on safe shutdown.

ACHV0189D I ABHIS0032 RL024 M-12AB03 (H-5) ABHV0031, 2nd Stage Reheater Could cause the Valve is required to be closed if the MSIVs cannot be ABHV0032 Steam Supply valve to close or closed to prevent uncontrolled steam release. OFN RP-open. 017 closes the MSIVs so spurious operation of this valve will not adversely impact PFSSD.

ACHIS0131 RL024 M-12AC02 (F-2) ACHV01 18, Cold Reheat Line Could cause the The MSR drains are not required for PFSSD. Damage CHV0120, Drains alves to close or to the switch will have no adverse impact on safe

,CHV0121, open. shutdown.

,CHV0122, ACHV01 23, ACHV0124, ACHV0125, AC HVO126,

,CHV0144,

,CHV0145,

,CHV0152, ACHV01 53, ACHV0255 ACHIS0253 RL024 M-12AC02 (F-6) ,CHV0253, 1st Stage Reheater Could cause the The MSR drains are not required for PFSSD. Damage ACHV0254, Steam Drains valves to close or to the switch will have no adverse impact on safe

,CHV0262, open. shutdown.

ACHV0264 ADHS0055 RL024 M-12AD02 (G-6) ADHV0055, LP Htr 1A to 4A Isol Could cause the The low pressure heaters are not required for PFSSD.

ADHV0066 Valves valves to close or Damage to the switch will have no adverse impact on open. safe shutdown.

ADHS0043 RL024 M-12AD02 (G-4) ADHV0043, LP Htr 1B to 4B Isol Could cause the The low pressure heaters are not required for PFSSD.

ADHV0054 Valves valves to close or Damage to the switch will have no adverse impact on open. safe shutdown.

ADHS0030 RL024 M-12AD02 (G-2) ADHV0030, LP Htr 1C to 4C Isol Could cause the The low pressure heaters are not required for PFSSD.

ADHV0041 Valves valves to close or Damage to the switch will have no adverse impact on open. safe shutdown.

kDHIS0042 RL024 M-12AD02 (G-3) ADHV0042 LP Htr Bypass Could cause the The low pressure heaters are not required for PFSSD.

Valves valve to close or Damage to the switch will have no adverse impact on open. safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E -IF991, Rev. 5 Page 35 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumeni P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire AEHIS0017 RL024 M-12AE01 (E-5) ,EHV0017, HP Htr 5B, 6B and Could cause the The heaters are not required for PFSSD. Spurious AEHV0034 7B Isol Vlvs valves to close or operation of the valves will have no adverse impact on open. safe shutdown.

AEHIS0018 RL024 M-12AE01 (E-4) AEHV0018, HP Htr 5A, 6A and Could cause the The heaters are not required for PFSSD. Spurious AEHV0033 7A Isol VIvs valves to close or operation of the valves will have no adverse impact on open. safe shutdown.

AEHIS0038 RL024 M-12AE01 (G-4) AEHV0038 HP Htrs Bypass Could cause the The heaters are not required for PFSSD. Spurious Valves valve to close or operation of the valves will have no adverse impact on open. safe shutdown.

EAHIS0005 RL024 M-12EA02 (G-3) EAHV0005 Serv Wtr Return to Could cause the The service water system is not credited for PFSSD.

OW System valve to close or The ESW system is the credited service water supply.

open. Spurious operation of this valve will not adversely impact safe shutdown.

EAHIS0006 RL024 M-12EA02 (H-3) EAHV0006 Serv Wtr Return to Could cause the The service water system is not credited for PFSSD.

CW System valve to close or The ESW system is the credited service water supply.

open. Spurious operation of this valve will not adversely impact safe shutdown.

ACHIS01 19 RL024 M-12AC02 (F-2) ACHV01 19, MSR Shell Drain Jog Could cause the The MSR drains are not required for PFSSD. Damage

,CHV0127, Control alves to close or to the switch will have no adverse impact on safe

,CHV0129, open. shutdown.

ACHV0148,

,CHV0149,

,CHV0150, OCHV0151, ACHV0225 ACHIS0072 RL024 M-12AC01 (C-6) ACHV0071, Startup Drain Valve Could cause the The startup drains are not required for PFSSD.

ACHV0072 valves to close or Damage to the switch will have no adverse impact on open. safe shutdown.

ACHS0181A RL024 M-12AC02 (H-7) ACPV0181A, Reheater Steam Could cause the The MSR's are not required for PFSSD. Damage to the ACPV0181B, High Load Valves valves to close or switch will have no adverse impact on safe shutdown.

ACPV0181C, open.

ACPV0181D _

Design Basis Document for Procedure OFN RP-017 Appendix 2 E !Fool5, Rev. 5 Page 36 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumenl P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire ACHIS0134 RL024 M-12AC01 (H-7) ACHV0130, Main Stop and Could cause the The drains are not required for PFSSD. Damage to the ACHV0134, Control Vlv Startup valves to close or switch will have no adverse impact on safe shutdown.

ACHV0135, Drains open.

ACHV0136, ACHV01 37, ACHV0256, ACHV0260, ACHV0261, ACHV0263 ACHS0181B RL024 M-12AC02 (H-7) ACPV0181A Main Steam Supply Could cause the The MSR's are not required for PFSSD. Damage to the to 2nd Stage valve to close or switch will have no adverse impact on safe shutdown.

Reheater open.

The main steam seal system is not required for PFSSD.

CAHIS0001 RL026 M-12CAOI (G-8) AHV 1 Main Steam Seal Valve could fail Steam flow is isolated when the MSIVs are closed.

Feed Valve open or closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

The main steam seal system is not required for PFSSD.

Main Steam Seal Valve could fail Steam flow is isolated when the MSIVs are closed.

Feed Valve open or closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

The auxiliary steam seal system is not required for ux Steam Seal Valve could fail PFSSD. Steam flow through this line originates from CAHIS0004 RL026 M-12CA01 (H-8) CAHV0004 Feed Valve open or closed, the auxiliary boiler, not the main steam system.

Therefore, spurious operation of this valve will not adversely impact safe shutdown.

The steam seal system is not required for PFSSD.

AHIS0003 RL026 M-12CA01 (G-7) CAHV003 Steam Seal Man Valve could fail Steam flow is isolated when the MSIVs are closed.

Unloading Vlv open or closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

The main steam seal system is not required for PFSSD.

BHIS0046 RL026 M-12AB03 (13-8) ABHV0046 Main Stm Hdr to Stm Valve could fail Steam flow is isolated when the MSIVs are closed.

Seal System open or closed. Therefore, spurious operation of this valve will not adversely impact safe shutdown.

Could prevent The auxiliary steam system is not required for PFSSD.

FBHS0082 RL027 M-12FBOl (F-7) FBHV0081 ts 6Alandment operation of the Damage to the switch will not adversely impact safe BHV0081 Stm Alignment alves. shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 2 E 1F9916, Rev. 6 Page 37 of 37 Table A2 Control Room Fire Consequence Evaluation for Motor Operated Valves Control Room Instrumeni P&ID Drawing Associated Description Consequence if Impact on PFSSD in the Event of a Control Room Instrument Location MOV(s) Damaged Fire Valves are not used for PFSSD. Damage to the switch BMHS0100 RL027 M-12BM01 (G-2) BMHV0100, Htrs 5A and 5B Could cause the will have no adverse impact on PFSSD. Steam BMHV0101 St close. generator blowdown is isolated in OFN RP-017 by lignment close, opening breaker NK4411.

1AEHV0102, FWP PAE02 Inlet ould prevent The motor driven feedwater pump is not required for AEHS0103 RL027 M-12AE01 (G-2 *EHV0103 and Outlet Iso peration of the PFSSD. Damage to the switch will have no adverse Halves valves. impact on safe shutdown.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1F9915, Rev. 5 Page 1 of 58 Appendix 3 Control Room Multiple Spurious Operation (MSO) Review

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1FS9916, Rev. 5 Page 2 of 58 This evaluation addresses multiple spurious operations in the event of a control room fire. For control room fires, it is not required to consider MSOs as an initial consequence of the fire. However, per RG 1.189, MSOs should be considered after control is transferred to the alternate shutdown capability. (See RG 1.189, Section 5.4.1)

Table A3 identifies the NEI 00-01, Rev. 3 MSO list and provides a comparison of how Wolf Creek addresses each scenario for control room fires.

Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG Loss of all Spurious isolation of Scenario causes BBHV8351A, OFN RP-017 has operators stop the RCPs and isolate seal 1 RCP Seal seal injection header loss of all RCP seal BBHV8351 B, injection and thermal barrier cooling. Therefore, this scenario is Cooling flow cooling and BBHV8351C not applicable to a control room fire because the procedure subsequent RCP and/or actually causes the scenario.

AND seal LOCA, BBHV8351D challenging the Based on Revision 2 of a White Paper prepared by Spurious isolation of RCS Inventory AND Westinghouse dated October 15, 2012, maximum leakage CCW flow to thermal Control Function. through each seal is 21 gpm with the RCPs stopped and no seal barrier heat exchanger BBHV0013 cooling. Therefore, the maximum leakage is 84 gpm, which is (BBFT0017), well within the makeup capability of the charging pump.

BBHV0014 (BBFT0018), Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 BBHV0015 gpm total) for 10 minutes then increases to 21 gpm per pump (84 (BBFT0019), gpm total) for the duration of the event. This is consistent with and/or NRC IN 2005-14, which indicates modeling 21 gpm per pump BBHV0016 after 13 minutes is appropriate. The value of 3 gpm per pump is (BBFT0020) normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

OR Based on the above discussion, this MSO scenario is adequately EGHVO058, addressed.

EGHV0061, EGHV0062 (EGFT0062) or EGHV0071

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1F9916, Rev. 5 Page 3 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID Equipment RCS Inventory Control PWROG Loss of all Spurious opening of Scenario causes EMHV8801A OFN RP-017 has operators stop the RCPs and isolate seal 2 RCP Seal charging injection loss of all RCP seal or injection and thermal barrier cooling. OFN RP-017 also lines up Cooling valve(s) causing cooling and EMHV8801 B the B Train BIT flowpath for injection. Therefore, this scenario is diversion flow away subsequent RCP not applicable to a control room fire because the procedure from seals, seal LOCA, AND actually causes this scenario.

challenging the AND RCS Inventory EMHV8803A Based on Revision 2 of a White Paper prepared by Control Function. or Westinghouse dated October 15, 2012, maximum leakage Spurious isolation of EMHV8803B through each seal is 21 gpm with the RCPs stopped and no seal CCW flow to thermal cooling. Therefore, the maximum leakage is 84 gpm, which is barrier heat exchanger AND well within the makeup capability of the charging pump.

BBHV0013 Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 (BBFT0017), gpm total) for 10 minutes then increases to 21 gpm per pump (84 BBHV0014 gpm total) for the duration of the event. This is consistent with (BBFT0018), NRC IN 2005-14, which indicates modeling 21 gpm per pump BBHV0015 after 13 minutes is appropriate. The value of 3 gpm per pump is (BBFT0019), normal seal leakage. SA-08-006 uses 10 minutes instead of 13 and/or minutes for increasing the seal leakage for conservatism.

BBHV0016 (BBFT0020) Based on the above discussion, this MSO scenario is adequately addressed.

OR EGHV0058, EGHV0061, EGHV0062 (EGFT0062) or EGHV0071

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 11FOS! , Rev. 5 Page 4 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Seai Scenario Description ScnroDsrpinNtsEquipment Notes Includ e d Control Room Fire Discussion RCS Inventory Control PWROG Thermal Loss of all Seal Cooling Thermal shock of Same as OFN RP-017 has operators stop the RCPs and isolate seal 3 Shock of to any RCP(s). See seals causes PWROG 1 or 2 injection and thermal barrier cooling. Spurious re-initiation of RCP Scenarios 1 & 2, catastrophic RCP seal injection is prevented by closing manual valves BGV0101 Seals seal failure and AND and BGV0105. Spurious re-initiation of thermal barrier cooling is AND subsequent RCP prevented by de-energizing and closing valves EGHV0061 and seal LOCA, EGHV0058 EGHV0133. Therefore, this scenario is not applicable to a Spurious re-initiation of challenging the AND control room fire because the procedure prevents this scenario seal cooling (i.e., seal RCS Inventory EGHV0071 or from occurring.

injection or CCW to Control Function. EGHV0126 TBHX) AND Based on Revision 2 of a White Paper prepared by EGHV0127 Westinghouse dated October 15, 2012, maximum leakage through each seal is 21 gpm with the RCPs stopped and no seal AND cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

EGHV0062 or EGHV0132 Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 AND gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump EGHV0061 or after 13 minutes is appropriate. The value of 3 gpm per pump is EGHV0133 normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately I addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E !FOS! 6, Rev. 5 Page 5 of 58 Table A3 Control Room Fire MVSO Evaluation Scenario ID 1Scenario Scenario Description Notes Included Equipment I Control Room Fire Discussion RCS Inventory Control PWROG Catastrop Loss of all Seal Cooling Scenario causes Same as OFN RP-017 has operators stop the RCPs and isolate seal 4 hic RCP to any RCP(s). See catastrophic RCP PWROG 1 or 2 injection and thermal barrier cooling. Therefore, this scenario is Seal Scenarios 1 &2, seal failure and not applicable to a control room fire because the procedure Failure subsequent RCP AND prevents spurious re-start of the RCPs.

AND seal LOCA, challenging the PBB01A, Based on Revision 2 of a White Paper prepared by Fire prevents tripping, RCS Inventory PBB01B, Westinghouse dated October 15, 2012, maximum leakage or spuriously starts, Control Function. PBB01C or through each seal is 21 gpm with the RCPs stopped and no seal RCP(s) PBB01D cooling. Therefore, the maximum leakage is 84 gpm, which is well within the makeup capability of the charging pump.

Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with NRC IN 2005-14, which indicates modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1FOB! , Rev. 5 Page 6 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID Equipment RCS Inventory Control PWROG RCP Seal Loss of all Seal Cooling Isolation of the No. Same as OFN RP-017 has operators stop the RCPs and isolate seal 5 No. 2 to any RCP(s). See 1 seal leakoff line PWROG 1 or 2 injection and thermal barrier cooling. OFN RP-017 does not Failure Scenarios 1 & 2, during a loss of all ensure the No. 1 seal leakoff valves remain open. These valves seal cooling event AND are normally open and fail open.

AND would force the No.

2 RCP seal into a BBHV8141A, Based on Revision 2 of a White Paper prepared by Spurious isolation of high pressure BBHV8141B, Westinghouse dated October 15, 2012, with the No. 1 seal return No. 1 seal leakoff mode of operation BBHV8141C line spuriously closed the maximum leakage through each seal is valve(s) at high or 21 gpm with the RCPs stopped and no seal cooling. Therefore, temperature, which BBHV8141 D the maximum leakage is 84 gpm, which is well within the is beyond the makeup capability of the charging pump.

design basis of the No. 2 seal. This Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 could cause gpm total) for 10 minutes then increases to 21 gpm per pump (84 catastrophic failure gpm total) for the duration of the event. This is consistent with of the No. 2 seal NRC IN 2005-14, which indicates modeling 21 gpm per pump and increase RCS after 13 minutes is appropriate. The value of 3 gpm per pump is leakage. normal seal leakage. SA-08-006 uses 10 minutes instead of 13 minutes for increasing the seal leakage for conservatism.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG Letdown Spurious opening of (or Letdown Fails to BGLCV0459 OFN RP-017 fails the letdown valves and letdown orifice valves 6 Fails to failure to close) letdown Isolate and and closed by opening switch PK5117. Calculation SA-08-006 uses Isolate isolation valve(s), AND Inventory Lost to BGLCV0460 a value of 120 gpm or 195 gpm, depending on the scenario, for 7 and CVCS causes loss minutes. Based on drawing E-13RL02, the two letdown valves Inventory Spurious opening of (or of RCS inventory, AND and three letdown orifice valves are powered from PK5117.

Lost to failure to close) letdown challenging the Based on drawings E-13BG10 and E-13BG35, de-energizing the CVCS orifice valve(s) RCS Inventory BGHV0149A, control circuit will close the valves.

Control Function. BGHV0149B or To spuriously re-energize the circuit and re-open the valves, it BGHV0149C would take two proper polarity inter-cable hot shorts on at least three valves. Therefore, six proper polarity inter-cable hot shorts would have to occur, which is extremely unlikely.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E IFS915, Rev. 5 Page 7 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID 111[

Scenario Scenario Description Notes Included Equipment I Control Room Fire Discussion RCS Inventory Control De-energizing PK5117 will de-energize all other sources of separation group 5 - 125 VDC power from RLOO1/RL002 that could re-energize the letdown valves. Cable 15RLK01AA is the power cable from PK5117 to distribution bus DB1 in RL001/RL002. The cable enters RLOO1/RL002 from the lower cable spreading room in cable tray 135C8B45. All 125 VDC cables in tray 135C8B45 are fed from PK5117, so opening PK5117 will de-energize these cables.

Separation group 1 (Train A) 125 VDC power source to RLOO1/RL002 from NK4119 and separation group 4 (Train B) power source from NK4407 to RLOO1/RL002 are de-energized in OFN RP-01 7. By design, these sources should never come into contact with separation group 5 circuits. However, in the unlikely event they do, the sources are eliminated in the procedure.

Separation group 6 125 VDC power source from PK5211 is not de-energized inOFN RP-017. The separation group 6 cables could come incontact with the separation group 5 cables because there are no design restrictions to keep them separated within the control panels. The cables are separated in raceway.

As stated above, it would take a minimum of six proper polarity inter-cable hot shorts to cause the two letdown isolation valves and one letdown orifice valve to spuriously open. Since the letdown valves are considered high/low pressure interfaces, consideration of two or more proper polarity hot shorts is required. However, based on testing of DC circuits documented in NUREG/CR-7100 and NUREG-2128, multiple proper polarity inter-cable hot shorts causing multiple spurious operations is not credible.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 Em-Ff9915, Rev. 5 Page 8 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID Equipment RCS Inventory Control PWROG Letdown Letdown fails to isolate Scenario causes Same as See response to PWROG 6.

7 Fails to (see Scenario 6), AND letdown flow to PWROG 6 Isolate PRT through relief Based on the above discussion, this MSO scenario is adequately and Spurious closure of valve. This letdown AND addressed.

Inventory downstream flow is assumed Lost to containment isolation unavailable for BGHV8152, PRT valve RCS makeup. BGHV8160, or BGPCV0131 PWROG Excess Spurious opening of (or Scenario causes BGHV8153A Excess letdown is isolated in OFN RP-017 by opening switches 8 Letdown failure to close) multiple loss of RCS and NK4119 and NK4407. These actions de-energize all separation Fails to series excess letdown inventory to the BGHV8154A group 1 and 4 sources of 125 VDC power within panel Isolate isolation valves CVCS system, RL001/RL002 and ensures the excess letdown valves do not challenging the OR spuriously open as a result of a control room fire.

RCS Inventory Control Function. BGHV8153B In the unlikely event a 125 VDC source comes into contact with The RCS inventory and the control circuit for the excess letdown valves, it would take at (letdown) is BGHV8154B least 4 proper polarity hot shorts to cause two series valves to assumed lost and open. Then it would take additional hot shorts to open valve unavailable for AND BBHV8157A or BBHV8157B to cause excess letdown to flow to makeup. In reality, the PRT or valve BGHCV0123 to cause excess letdown to flow additional failures BBHV8157A, to the reactor coolant drain tank. Based on industry testing of downstream of the BBHV8157B or DC circuits documented in NUREG/CR-7100 and NUREG-2128, excess letdown BGHCV0123 this combination of smart hot shorts is not credible. Therefore, isolation valves the actions taken in OFN RP-017 to close the excess letdown would have to flowpath are acceptable.

occur for this RCS inventory to be Based on the above discussion, this MSO scenario is adequately unavailable for addressed.

makeup.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1FQ9915, Revr. 5 Page 9 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario ScenarioDescription Notes Equipment Control Room Fire Discussion RCS Inventory Control PWROG RCS Spurious isolation of Scenario isolates BGFCV0462, OFN RP-017 isolates seal injection and normal charging by 9 Makeup seal injection flow path, all high head RCS BGHCV0182, closing valves BGV0101, BGV0105 and BG8402B. Charging is Isolation AND/OR makeup flow paths, BGHV8105 or lined up through the BIT by lining up the Train B charging pump challenging the BGHV8106 and valves EMHV8803B and EMHV8801B. Valve EMHV8801B Spurious isolation of RCS Inventory is throttled, by procedure, to achieve the correct charging flow.

normal charging flow Control Function. AND path, AND/OR Calculation SA-08-006 assumes 28 minutes to line up charging BGFCV0121 through the BIT. Due to the isolation and redundant fusing Spurious isolation of or provided for the Train B equipment, this flowpath provides a charging injection flow reliable means of charging following a control room fire.

path BBHV8351A, BBHV8351 B, Based on the above discussion, this MSO scenario is adequately BBHV8351C addressed.

and/or BBHV8351 D AND BGHV8357A or BGHV8357B

Design Basis Document for Procedure OFN RP-017 Appendix 3 rE1F2915, Rev. 5 Page 10 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Equipment Control Room Fire Discussion RCS Inventory Control PWROG Charging Initial condition is Scenario causes BGLCV1 12B The normal charging pump (NCP) is normally operating. If this 10 Pump charging pump running charging pump (BGLTO112) or pump is damaged due to a spuriously closed VCT outlet valve, Failure with normal lineup inoperability, BGLCV1 12C there is no adverse impact on PFSSD because the Train B taking suction from challenging the (BGLT0185) centrifugal charging pump (CCP) is the credited charging pump VCT. RCS Inventory for a control room fire.

Control Function. AND Spurious isolation of This is especially If the Train B CCP is operating at the time of the fire, and one of suction from VCT to challenging ifthe BNLCV112D the VCT outlet valves closes, the Train B CCP would be running charging pump, credited charging (BGLT01 12) damaged. This scenario would only require a single spurious AND pump is running at and operation because it would only take spurious closure of one the time of the fire. BNLCV1 12E valve to cause it to happen. The RWST to charging pump Spurious isolation of (or (BGLT01 85) suction valve does not automatically open when the VCT valve failure to open) suction closes. The RWST valve opens on a low-low VCT level or SIS, from RWST to running neither of which would occur per this scenario.

charging pump Procedure OFN RP-01 7 lines up the RWST to the Train B CCP.

Valve BNLCV01 12E is opened using BNHS01 12E. This switch isolates the control room and inserts a redundant fuse in the circuit, ensuring the valve opens and remains open.

This MSO scenario represents a vulnerability of low likelihood because the B CCP is not normally operated. Also, a control room fire that is severe enough to cause evacuation is not likely because the control room is constantly attended and smoke detectors are provided in the control room cabinets.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F82Q-15, Rev. 6 Page 11 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID Ser j Decito Notes _ Equipment RCS Inventory Control PWROG Charging Initial condition is Scenario causes BNLCV1 12D Procedure OFN RP-017 lines up the RWST to the Train B CCP.

11 Pump charging pump running loss of charging and Valve BNLCV01 12E is opened using BNHSO1 12E. This switch Failure and drawing suction pump suction, BNLCV1 12E isolates the control room, inserts a redundant fuse in the circuit from RWST. causing and opens the valve, ensuring the valve remains open for the subsequent pump duration of the event.

Spurious isolation of cavitation and two parallel RWST inoperability. This Based on the above discussion, this MSO scenario is adequately outlet valves, challenges the addressed.

RCS Inventory Control Function.

PWROG Charging Spurious opening (or Scenario causes BGLCV1 12B Procedure OFN RP-017 isolates valve BGLCVOI 12C using 12 Pump failure to close) of VCT drain down and BGHS01 12C. This switch isolates the control room, inserts a Failure multiple series VCT and hydrogen BGLCV1 12C redundant fuse in the circuit and closes the valve, ensuring the outlet valves cover gas valve remains closed for the duration of the event.

entrainment into charging pump Based on the above discussion, this MSO scenario is adequately suction, ultimately addressed.

causing charging pump inoperability and challenging the RCS Inventory Control Function.

This is especially challenging if the credited charging pump is running at the time of the fire.

Note this scenario assumes that VCT makeup has been isolated (i.e.,

letdown isolated).

Design Basis Document for Procedure OFN RP-017 Appendix 3 E1IFOB! 6, Rev. 6 Page 12 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario Seai Scenario Description ScnroDsrpinNtsEquipment Notes Included Control Room Fire Discussion RCS Inventory Control PWROG Charging Letdown fails to isolate Scenario causes PWROG 6 See scenario PWROG 6 for discussion about letdown.

13 Pump (see Scenario 6), AND elevated charging Failure pump suction AND The VCT is isolated as discussed in scenario PWROG 12.

Spurious isolation of temperature and CCW cooling to the subsequent pump BGTV01 30 Since letdown and the VCT is isolated per procedure OFN RP-letdown heat exchanger inoperability. 017, spurious isolation of CCW cooling to the letdown heat Charging pump exchanger is not a concern.

inoperability challenges the Based on the above discussion, this MSO scenario is adequately RCS Inventory addressed.

Control Function.

This is especially challenging if the credited charging pump is running at the time of the fire.

PWROG Charging Charging pump runout Scenario causes PBG05A Procedure OFN RP-017 lines up the Train B CCP to inject 14 Pump when RCS is charging pump PBG05B through the BIT. The BIT outlet valve is throttled by operator Failure depressurized runout and failure, action to maintain inventory. Therefore, pump runout is Pump(s) must be AND prevented in OFN RP-017 by an operator throttling the discharge running when RCS valve to control pressurizer level.

is at a BBPCV0455A depressurized And/or Based on the above discussion, this MSO scenario is adequately condition. RCS BBPCV0456A addressed.

depressurization could occur due to spurious opening of pressurizer PORV(s), for example.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1F9915, Rev. 5 Page 13 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID 1111 Scenario Scenario Description Notes Included Equipment I Control Room Fire Discussion RCS Inventory Control PWROG RWST Spurious opening of Scenario causes BNHV8812A OFN RP-017 isolates BNHV8812A and BNHV8812B prior to the 15 Drain multiple series RWST drain down and RWST draining to an insufficient level. Containment sump Down via containment sump to the containment EJHV8811A valves EJHV8811A and EJHV881 1B are not operated in OFN Containm valves sump. Since RP-017. As long as valves BNHV8812A and BNHV8812B are ent Sump typical PFSS OR closed, spurious operation of EJHV881 1A and EJHV88I B will analyses do not have no adverse impact on RWST inventory.

credit alignment of BNHV8812B containment sump, and Valve BNHV8812A is de-energized and manually closed per the RWST EJHV8811B procedure. The valve has been modified to address NRC IN92-inventory becomes 18, so the valve can be manually closed when needed.

unavailable for RCS makeup, Valve BNHV8812B is closed using hand switch BNHS8812B.

challenging the The hand switch isolates the control room and inserts a RCS Inventory redundant fuse in the control circuit. The valve was modified to Control Function. address NRC IN 92-18. Therefore, the valve will close when hand switch BNHS8812B is actuated and the valve will not re-open because the control circuit is isolated from the control room.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E11FOS!5, Rev. 6 Page 14 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID j__________j_________[Equipment CnrlRo ieDsuso RCS Inventory Control PWROG RWST Spurious opening of Scenario causes a ENHV0006 Containment spray pumps PEN01A and PEN01B are stopped or 16 Drain containment spray pumped RWST prevented from starting in OFN RP-017 by opening the pump Down via header valve(s), draindown via the AND motor breakers. Control power is removed from PEN01A by Containm containment spray removing the close control power fuse in NBO102. Control ent Spray AND ring. The RWST PEN01A power is removed from PEN01B by opening switch NK4401, inventory ultimately which removes control power from the entire NB02 bus.

Spurious starting of settles to the OR Removal of control power prevents a control room fire from containment spray containment sump. closing the breakers and spuriously starting the pumps.

pump(s) and/or RHR Since typical PFSS ENHV0012 pump(s). analyses do not Based on the above discussion, this MSO scenario is adequately credit alignment of AND addressed.

the containment sump, the RWST PEN01B inventory is assumed unavailable for RCS makeup, challenging the RCS Inventory Control Function.

PWROG Interfacing Spurious opening of Scenario causes BBPV8702A During normal operation, these valves are de-energized and 17 System multiple series RHR interfacing system and locked in the closed position. A fire in the control room cannot LOCA suction valves from LOCA, challenging EJHV8701A open these valves because it would take multiple proper phase RCS the RCS Inventory hot shorts to re-energize the valves. Power circuits for these Control Function. OR valves do not run through the control room so this circuit failure cannot occur due to a fire in the control room.

BBPV8702B and Based on the above discussion, this MSO scenario is adequately EJHV8701B addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1 F991 6, Rev. 5 Page 15 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Equipment Control Room Fire Discussion RCS Inventory Control PWROG Multiple Spurious opening of Scenario causes BBPCV0455A Spurious opening of both pressurizer PORVs would result in 18 Pressurize multiple (two or three) loss of RCS and conditions that do not meet the performance criteria of 10 CFR r PORVs Pressurizer PORVs with inventory through BBHV8000A 50, Appendix R,Section III.L. Calculation SA-08-006 assumes a corresponding block the pressurizer single PORV is open for no more than 3 minutes. Procedure valves in normal, open PORVs, AND OFN RP-017 closes or ensures the pressurizer PORVs do not position challenging the open by removing 125 VDC control power. This is done by RCS Inventory BBPCV0456A opening switches NK5108 for BBPCV0455A and NK4421 for Control Function. and BBPCV0456A. Timing has shown that these switches are Scenario also BBHV8000B opened in less than 3 minutes.

causes pressurizer depressurization, Isolation of control power ensures a single proper polarity hot challenging the short will not energize the PORVs. License Amendment 193 RCS Pressure approved the re-classification of the PORVs and block valves as Control Function. non-high/low pressure interface, which allows Wolf Creek to consider only a single proper polarity hot short when performing circuit analysis on the PORVs and associated block valves.

Calculation SA-08-006, Scenario 1 was run with two pressurizer PORVs open for 3 minutes. The results show that, although significant voiding occurs in the upper core and steam generators, there is sufficient natural circulation to maintain core inlet and outlet temperature between 560 and 570 *F.

Pressurizer level momentarily goes off scale high but then stabilizes at about 55% and pressurizer pressure stabilizes at about 1200 psi. The core remains covered and no fuel damage is indicated.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-117911, Rev. 5 Page 16 of 58 Table A3 Control Room Fire MSO Evaluation Scenario ID Scenario 111 Scenario Description Notes Included Equipment Control Room Fire Discussion RCS Inventory Control PWROG Pressurize Spurious opening of Scenario causes BBPCV0455A See scenario PWROG 18 for discussion about the pressurizer 19 r PORV Pressurizer PORV(s), loss of RCS AND PORVs.

and Block AND inventory through BBHV8000A Valve the pressurizer Based on the above discussion, this MSO scenario is adequately Spurious opening of PORV(s), OR addressed.

block valve(s) after it challenging the has been closed. RCS Inventory BBPCV0456A Control Function. AND Scenario also BBHV8000B causes pressurizer depressurization, challenging the RCS Pressure Control Function.

PWROG Reactor Spurious opening of Scenario causes BBHV8001A The reactor head vent valves are closed in OFN RP-017 by 20 Head Vent multiple series reactor loss of RCS and opening switches NK5109 and NK4414. This de-energizes the Valves head vent valves inventory through BBHV8002A valves and fails them closed. In order for two valves in the same open reactor head flowpath to re-open, it would take at least four proper polarity hot vent flowpath(s), OR shorts, which is not credible based on testing of DC circuits challenging the documented in NUREG/CR-7100 and NUREG-2128 RCS Inventory BBHV8001B Control Function. and Based on the above discussion, this MSO scenario is adequately BBHV8002B addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1FQ9915, Rev. 5 Page 17 of 58 Table A3 Control Room Fire MSO Evaluation Scenario]

ID Scenario Included Scenario Description Notes Equipment Control Room Fire Discussion RCS Inventory Control PWROG Excess Spurious starting of Scenario causes PBG04, Procedure OFN RP-01 7 lines up Train B CCP to inject through 21 RCS additional high head increasing RCS PBG05A or the BIT using valves EMHV8801 B and EMHV8803B. Normal Makeup charging pump(s), AND inventory, leading PBG05B charging is isolated by procedure by closing valve BG8402B.

to a water solid Seal injection is isolated by closing BGV0101 and BGV0105.

Spurious opening of pressurizer and AND additional RCS makeup PORV or safety The Train A CCP is not secured in OFN RP-017. The BIT flow paths (i.e., valve opening. EMHV8801A flowpath is controlled in OFN RP-017, so spurious operation of charging injection) This scenario or the Train A CCP is not a concern because the flow is controlled.

challenges both EMHV8801B RCS Inventory and BIT outlet valve EMHV8801A is closed in OFN RP-017 to RCS Pressure AND prevent excess flow to the RCS. However, the valve has not Control Functions. been modified to address NRC IN 92-18. CR 045442 was EMHV8803A written to address this issue and change package 13614, Rev. 1 or is being prepared to modify the valve.

EMHV8803B Based on the above discussion, this MSO scenario is adequately addressed following implementation of DCP 13614.

PWROG Primary Spurious opening of Scenario causes SJHV0003 Procedure OFN RP-017 does not isolate the primary sample 22 Sample RCS sample valve(s) loss of reactor SJHV0004 system. Normally closed manual valves downstream of the System (i.e., hot leg, PZR liquid coolant through the SJHV0005 sample coolers prevents loss of inventory through this flowpath.

space, PZR steam primary sample SJHV0006 See drawing M-12SJ01.

space, etc.), AND system, challenging SJHV0012 the RCS Inventory SJHV0013 Based on the above discussion, this MSO scenario is adequately Spurious opening of Control Function. SJHV0020 addressed.

inside containment SJHV0127 isolation valve, AND SJHV0128 SJHV0129 Spurious opening of SJHV0130 outside containment SJHV0133 isolation valve, AND Spurious opening of downstream sample valve(s)

Design Basis Document for Procedure OFN RP-01 7 Appendix 3 E 11FOB! , Rev. 5 Page 18 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID I___________________ Equipment RCS Inventory Control Expert Letdown Letdown fails to isolate Scenario causes Same as See scenario PWROG 6 for discussion of letdown.

Panel 1 Fails to (see Scenario 6), AND letdown flow to PWROG 6 Isolate RHT through divert Based on the above discussion, this MSO scenario is adequately and Spurious diversion of valve. This letdown AND addressed.

Inventory letdown flow to recycle flow is assumed Lost to hold-up tank unavailable for BGLCV01 12A RHT RCS makeup. (BGLT0149)

Expert Injection Scenario assumes high Scenario causes EMHV8843 or Procedure OFN RP-017 closes test line EMHV8843 using hand Panel 2 Flow head injection is in diversion of high EMHV8882 switch EMHS8843. The hand switch isolates the control room Diverted operation. head injection and and inserts a redundant fuse inthe circuit. The valve has been to RWST loss of RCS AND modified to address NRC IN 92-18. This ensures the valve will or RHT BIT test line opens to makeup. close when the hand switch is placed inthe ISO/CLOSED divert injection flow to EMHV8871 position. It also ensures the valve will not spuriously open in the the RWST or RHT event of cable damage.

AND Based on the above discussion, this MSO scenario is adequately EMHV8964 addressed.

Expert Isolation Spurious closure of Scenario causes BGFCV0462 Procedure OFN RP-017 lines up the Train B CCP and opens Panel 3 of normal charging overheating and and miniflow valve BGHV8111 using hand switch BGHS81 11A.

Charging isolation valve eventual failure of BGHV8109 Hand switch BGHS811 1A isolates the control room, inserts a Pump affected pump. redundant fuse in the control circuit and opens the valve. Valve Miniflow AND OR BGHS81 11 has been modified to address NRC IN 92-18.

Therefore, placing BGHS8I 111A in ISO/OPEN will open the valve Spurious closure of BGFCV0121 and prevent it from closing due to a control room fire.

pump miniflow valve and BGHV81 10 or Based on the above discussion, this MSO scenario is adequately BGHV81 11 addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1FG9915, Rev. 6 Page 19 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Equipment Control Room Fire Discussion RCS Inventory Control Expert Loss of Spurious RWST Low Scenario causes 2/4 Low-Low Procedure OFN RP-01 7 lines up the RWST to the Train B CCP.

Panel 4 Low Head Level indication failure of low head on Valve BNLCV01 12E is opened using BNHS01 12E. This switch SI Pump resulting in: SI pumps when BNLT0930, isolates the control room, inserts a redundant fuse in the circuit Suction required for BNLT0931, and opens the valve, ensuring the valve remains open for the Closure of RWST to recirculation. BNLT0932, duration of the event.

high head pumps and BNLT0933 Spurious signals on the level transmitters will not adversely AND affect PFSSD after a control room fire because all required valves are manually aligned. The Train B intermediate head Sl Containment Sump pump and low head RHR pump is prevented from starting in Suction valves open OFN RP-017 by opening the breaker and removing control with insufficient water power. Therefore, these pumps are protected from damage due level in sump to a control room fire and remain available ifneeded.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E 1F9915, Rev. 5 Page 20 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID ,Equipment RCS Inventory Control Expert Failure of Spurious RWST High Scenario causes SIAS Procedure OFN RP-01 7 lines up the RWST to the Train B CCP.

Panel 5 ECCS Level indication damage to CCPs Valve BNLCV01 12E is opened using BNHS01 12E. This switch Sump resulting in: and/or low head SI AND isolates the control room, inserts a redundant fuse inthe circuit Alignment pumps due to loss and opens the valve, ensuring the valve remains open for the Exhaustion of RWST of suction source. BNLT0930, duration of the event.

inventory BNLT0931, BNLT0932, Spurious signals on the level transmitters will not adversely AND and BNLT0933 affect PFSSD after a control room fire because all required valves are manually aligned. The Train B intermediate head SI Failure of automatic pump and low head RHR pump is prevented from starting in transfer to ECCS Sump OFN RP-017 by opening the breaker and removing control suction source. power. Therefore, these pumps are protected from damage due to a control room fire and remain available ifneeded.

Following a control room fire, all lineups are performed manually.

If necessary to line up the containment sump to the RHR pump, valve EJHV881 1B can be opened. This valve has been modified to address NRC IN92-18.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert RCP Seal Spurious closure of Scenario causes BGHV8100 RCP seal injection is isolated in OFN RP-017 by closing valves Panel 6 Return RCP seal return line loss of RCS BGV01 01 and BGV01 05. Therefore, with no seal injection there Diverted isolation valve, inventory to the OR will be no seal return to divert to the PRT.

to PRT PRT challenging the RCS Inventory BGHV8112 Based on the above discussion, this MSO scenario is adequately Control function, addressed.

Expert Loss of all Loss of Letdown Flow to Scenario causes BGLCV0459, OFN RP-017 has operators stop the RCPs and isolate seal Panel 7 RCP Seal VCT AND loss of all charging BGLCV0460, injection and thermal barrier cooling. OFN RP-017 also lines up Cooling pumps due to loss BGHV8152, the B Train BIT flowpath for injection. Therefore, this scenario is Failure of RWST supply of suction sources, BGHV8160, not applicable to a control room fire because the procedure to high head pumps loss of RCP BGPCV0131, actually causes this scenario.

AND Thermal Barrier or cooling and BGLCV01 12A Based on Revision 2 of a White Paper prepared by I Spurious isolation of subsequent RCP I Westinghouse dated October 15, 2012, maximum leakage

Design Basis Document for Procedure OFN RP-017 Appendix 3 FEIF99-15, Rev. 6 Page 21 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Description Notes Included Control Room Fire Discussion ID Equipment RCS Inventory Control CCW flow to thermal seal LOCA, OR through each seal is 21 gpm with the RCPs stopped and no seal barrier heat exchanger challenging the cooling. Therefore, the maximum leakage is 84 gpm, which is RCS Inventory BGHV0149A, well within the makeup capability of the charging pump.

Control Function. BGHV0149B and Calculation SA-08-006 uses a leakage of 3 gpm per pump (12 BGHV0149C gpm total) for 10 minutes then increases to 21 gpm per pump (84 gpm total) for the duration of the event. This is consistent with AND NRC IN 2005-14, which states that modeling 21 gpm per pump after 13 minutes is appropriate. The value of 3 gpm per pump is BNLCV0112D normal seal leakage. SA-08-006 uses 10 minutes instead of 13 and minutes for increasing the seal leakage for conservatism.

BNLCV01 12E Based on the above discussion, this MSO scenario is adequately AND addressed.

BBHV0013 (BBFT0017),

BBHV0014 (BBFT0018),

BBHV0015 (BBFT0019),

and/or BBHV0016 (BBFT0020)

OR EGHV0058, EGHV0O61, EGHV0062 (EGFT0062) or EGHV0071

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1 F991 5, Rev. 5 Page 22 of 58 Table A3 Control Room Fire MSO Evaluation Scenario cenario Scenario Notes Included Control Room Fire Discussion ID I Description Equipment Decay Heat Removal PWROG Inadvertent Spurious opening of Scenario causes ABPV0001 OFN RP-017 controls all four atmospheric relief valves (ARVs).

23 Steam multiple atmospheric RCS over-cooling. (ABPT0001) Two of the valves are controlled from the auxiliary shutdown Dumping steam dump valves Also, the ABPV0002 panel (ASP) using hand controllers and two are failed closed upstream of MSIV overcooling can (ABPT0002) locally by isolating air and nitrogen. Calculation SA-08-006 cause RCS ABPV0003 shows that a single ARV can be failed open for 60 minutes with shrinkage, causing (ABPT0003) no adverse consequences. All four ARVs are controlled or low pressurizer ABPV0004 closed well within 60 minutes.

level, and (ABPT0004) challenging the Based on the above discussion, this MSO scenario is adequately RCS Inventory addressed.

Control Function.

PWROG Inadvertent MSIV(s) spurious Scenario causes ABHV001 1, OFN RP-017 closes the MSIVs by removing power from cabinet 24 Steam opening, or failure to RCS over-cooling. ABHV0014, SA075A. This removes 125 VDC power from the Train A Dumping close, AND Also, the ABHV0017 or solenoids for all four MSIVs and fails them closed. This action is overcooling can ABHV0020 taken within 3 minutes into the incident. Calculation SA-08-006 Spurious opening, or cause RCS shows that if the MSIVs are closed in 3 minutes, PFSSD is not failure to close, of shrinkage, causing AND adversely affected.

downstream steam low pressurizer loads (e.g., level, and ABUV0034, Based on the above discussion, this MSO scenario is adequately condenser steam challenging the ABUVO035, addressed.

dumps, turbine inlet RCS Inventory ABUV0036, valves, etc.) Control Function. ABUVO037, ABUV0038, ABUV0039, ABUVO040, ABUVO041, ABUVO042, ABUVO043, ABUVO044 or ABUVO045 OR ACFCV0043 and

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 23 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal ACFCV0047 or ACFCV0044 and ACFCV0049 or ACFCV0045 and ACFCV0048 or ACFCV0046 and ACFCV0050 PWROG Inadvertent MSIV bypass valve(s) Scenario causes ABHV0012, See PWROG 24 for discussion about the MSIVs.

25 Steam spurious opening, or RCS over-cooling. ABHV0015, Dumping failure to close, AND Also, the ABHV0018 or OFN RP-017 isolates the MSIV bypass valves by removing the overcooling can ABHV0021 control power fuse. Removing the control power fuse ensures Spurious opening, or cause RCS the bypass valves remain closed. Calculation SA-08-006 failure to close, of shrinkage, causing AND assumes the bypass valves remain open for the duration of the down stream steam low pressurizer event. Therefore, failure of the bypass valves to close will not loads (e.g., level, and ABUVO034, prevent PFSSD.

condenser steam challenging the ABUVO035, dumps, turbine inlet RCS Inventory ABUVO036, Based on the above discussion, this MSO scenario is adequately valves, etc.) Control Function. ABUVO037, addressed.

ABUVO038, ABUVO039, ABUVO040, ABUVO041, ABUVO042, ABUVO043, ABUVO044 or ABUVO045 OR ACFCV0043

Design Basis Document for Procedure OFN RP-01 7 Appendix 3 E-1F9915, Rev. 5 Page 24 of 58 Table A3 Control Room Fire MVSO Evaluation Scenario cenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal and ACFCV0047 or ACFCV0044 and ACFCV0049 or ACFCV0045 and ACFCV0048 or ACFCV0046 and ACFCV0050 PWROG Inadvertent Spurious operation of Scenario may ABLVO007, See PWROG 24 for discussion about the MSIVs.

26 Steam main steam header cause RCS over- ABLVO008, Dumping drain valve(s) cooling. Also, the ABLVO009 Based on the above discussion, this MSO scenario is adequately overcooling can ABLVO010, addressed.

cause RCS ABLV0050, shrinkage, causing ABLV0051, low pressurizer ABLVO052 or level, and ABLVO053 challenging the RCS Inventory Control Function. I

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 25 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal PWROG Turbine Spurious isolation of Scenario causes ABHV0005 Steam generator C (loop 3) supplies steam to the TDAFP 27 Driven AFW redundant steam turbine driven AFW and through valve ABHV0006. However, steam generator C is not Pump supply valves to pump inoperability, ABHV0006 provided with feedwater flow in OFN RP-017. Therefore, valve Inoperability turbine driven AFW which challenges ABHV0006 is closed in OFN RP-017 to prevent steam generator pump the Decay Heat C from boiling dry. Hand switch RPHIS0001 is operated in an Removal Function. earlier step to isolate ABHV0006 from the control room and insert redundant fuses in the control circuit. This action ensures ABHIS0006B will work to control the position of ABHV0006.

Steam generator B (loop 2) supplies steam to the TDAFP through valve ABHV0005. Procedure OFN RP-017 controls the position of ABHV0005 (open or closed) from the ASP using ABHIS0005B. Hand switch RPHIS0001 is operated in an earlier step to isolate ABHV0005 from the control room and insert redundant fuses in the control circuit. This action ensures ABHIS0005B will work to control the position of ABHV0005.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 26 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion m t ID Description Equip en Decay Heat Removal PWROG AFW Flow Spurious closure of Scenario isolates ALHV0005 OFN RP-017 lines up auxiliary feedwater to two steam 28 Isolation multiple valves in AFW flow to the (ALFT0001), generators. The TDAFP is lined up to supply steam generator B AFW pump discharge steam generator(s), ALHV0007 and the Train B MDAFP is lined up to supply steam generator D.

flow path(s) challenging the (ALFT0007), The remaining two steam generators are not required for Decay Heat ALHV0009 PFSSD.

Removal Function. (ALFTOO09) and/or Valve ALHV0005 is opened to supply AFW from the B MDAFP ALHVOO 11 to steam generator D. This valve is controlled at the ASP by (ALFTOO11) hand controller ALHKOO05B. Hand switch ALHS0005 is placed in the LOCAL position to transfer control from the control room to OR the ASP. This also isolates the control room so that fire will not affect the operation of ALHK0005B.

ALHV0006, ALHVO008, Valve ALHV0010 is opened to supply AFW from the TDAFP to ALHV0010 steam generator B. This valve is controlled at the ASP by hand and/or controller ALHKOO1OB. Hand switch ALHS0010 is placed in the ALHV0012 LOCAL position to transfer control from the control room to the ASP. This also isolates the control room so that fire will not affect the operation of ALHKOO10B.

The configuration ensures valves ALHV0005 and ALHVOO1O will remain available when needed.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 27 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Equien Control Room Fire Discussion ID I Description Equipment Decay Heat Removal PWROG AFW Flow Spurious closure of Scenario isolates ABHV0005 See PWROG 27 for discussion about the steam supply to the 29 Isolation steam supply valve(s) AFW flow to the and TDAFP.

to turbine driven AFW steam generator(s) ABHV0006 pump, AND and causes turbine See PWROG 28 for discussion about AFW pump discharge flow driven AFW pump AND paths.

Spurious isolation of inoperability, AFW pump discharge challenging the ALHV0005 Based on the above discussion, this MSO scenario is adequately flow path(s) Decay Heat (ALFT0001), addressed.

Removal Function. ALHV0007 (ALFT0007),

ALHV0009 (ALFT0009) and/or ALHV001 1 (ALFT0011)

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 28 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal PWROG AFW Flow Combination of Scenario causes ALHV0005 Procedure OFN RP-01 7 lines up the Train B motor driven 30 Diversion spurious valve AFW flow diversion (ALFT0001), auxiliary feedwater pump to steam generator D and the turbine operations in the to a non-credited ALHV0007 driven auxiliary feedwater pump (TDAFP) to steam generator B.

AFW pump discharge steam generator(s), (ALFT0007), The two motor driven AFW pumps are designed to feed only two flowpaths to the challenging the ALHV0009 steam generators. The TDAFP is designed to feed all four steam generators Decay Heat (ALFT0009) steam generators.

Removal Function. and/or A steam generator ALHV0011 Spurious opening of multiple discharge valves in the AFW may be "non- (ALFT0011) system could cause flow diversion to non-credited steam credited" by the generators. However, check valves are installed in the main SSA for a number OR feedwater line upstream of the auxiliary feedwater tap. The of reasons check valves ensure AFW flows to only the intended steam including ALHV0006, generator.

unavailability of ALHV0008, instrumentation, ALHV0010 Although AFW could be diverted to a non-credited steam inoperability of and/or generator, the credited steam generator will receive adequate steam dumps on ALHV0012 flow. Furthermore, OFN RP-017 has steps to close several that loop, etc. manual valves in the AFW discharge flowpath to stop flow to non-credited steam generators to prevent overfill.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 29 of 58 Table A3 Control Room Fire MSO Evaluation Scenario cenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal PWROG AFW Pump Spurious full opening Scenario may ALHV0005 Each AFW discharge flowpath has a flow orifice installed. Based 31 Run Out of multiple AFW flow cause AFW pump (ALFT0001), on the Auxiliary Feedwater system description (M-01AL), each control and/or runout and ALHV0007 flow orifice is designed to limit flow to any single steam generator isolation valves inoperability, (ALFT0007), in the event of a main feedwater line break to ensure adequate challenging the ALHV0009 auxiliary feedwater flow to the intact steam generator. Similarly, Decay Heat (ALFT0009) the flow orifices would prevent pump runout in the event of Removal Function. and/or multiple failed open discharge control valves.

ALHVOO 11 Note that this (ALFT0011) Based on the above discussion, this MSO scenario is adequately scenario may occur addressed.

even without OR spurious operations if the fail-safe ALHV0006, position of relevant ALHV0008, valves is full open. ALHV0010 and/or ALHV0012 PWROG CST Spurious opening of Scenario causes ADLVO079BA Based on drawing M-109-00010, the CST tap for the condenser 32 Diversion to valves between the inadvertent draining or makeup is 20'-6" above the bottom of the tank and the tap for Condenser Condensate Storage of CST inventory to ADLVO079BB the AFW supply is 12 inches above the bottom of the tank.

Tank (CST) and the condenser. Therefore, if ADLVO079BA and/or ADLVO079BB were to condenser hotwell This CST inventory spuriously open, there would be approximately 216,720 gallons becomes remaining in the CST for AFW based on tank document WCRE-unavailable as an 03. Therefore, spurious opening of these valves will not affect AFW source, PFSSD.

challenging the Decay Heat In addition, procedure OFN RP-017 has steps to line up ESW to Removal Function. the auxiliary feedwater pumps if the CST level is less than 14%.

CST level indicator APLI0004B on the ASP is protected.

Other CST Therefore, in the unlikely event the CST drains by other drain draindown paths paths as a result of a fire in the control room, the auxiliary may exist. P&ID feedwater system will remain available.

review required.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 30 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal PWROG Excess Feed Scenario can occur Scenario causes Same as Evaluation SA-08-006, Rev. 3 investigates various scenarios that 33 Flow to due to various RCS over-cooling PWROG 27 could result in steam generator overfilling. One of the Steam combinations of and/or steam and 30 assumptions used in developing some of the scenarios in SA Generator spurious AFW pump generator overfill, 006, Rev. 2 was that the MSIVs close in response to a control starts, spurious both challenging Plus room action. This assumption was determined to be wrong opening (or failure to the Decay Heat during the 2011 NRC Triennial Fire Protection Inspection.

close) of valves in Removal Function. PAL01A, Therefore, all scenarios in SA-08-006 assume the MSIVs remain AFW pump discharge RCS over-cooling PAL01B or open until action is taken outside the control room to close them.

flowpaths, and can cause RCS PAL02 With the MSIVs open, the main feedwater pumps continue to spurious opening of shrinkage and low operate and pump water into the steam generators after the MFW isolation valves PZR level. Steam OR reactor is tripped from the control room. This causes the steam with MFW pump(s) generator overfill generators to overfill in some scenarios prior to operators closing running. can affect PAEO1A or the MSIVs and MFIVs from outside the control room.

operability of PAEO1B fail to turbine-driven AFW trip An evaluation was performed to determine if the feedwater pump. isolation signal (FWIS) would be unaffected by a control room OR fire. It was determined that a credible fire in the control room Note that the would not affect both trains of FWIS and that a FWIS would spurious pump PAE02 occur on a reactor trip with low Tavg. Since automatic functions starting can occur spuriously are not allowed to be credited for control room fires, a license for several reasons, starts and amendment request is being prepared to have this deviation including fire AEHV0102 approved.

damage to control and circuitry or a AEHV0103 Based on the results of this evaluation and the actions taken by spurious ESFAS spuriously operators, the steam generators will not overfill. Refer to signal. open Evaluation SA-08-006 for a detailed discussion of the scenarios and results.

AND Based on the above discussion, this MSO scenario is adequately AEFCV0510 or addressed.

AEFCV0550 and AEFV0039 or AEFCV0520 or AEFCV0560

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1 F991 5, Rev. 5 Page 31 of 58 Table A3 Control Room Fire MSO Evaluation Scenario cenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal and AEFV0040 or AEFCV0530 or AEFCV0570 and AEFV0041 or AEFCV0540 or AEFCV0580 and AEFV0042 PWROG Steam Spurious opening of, Scenario causes BMHV0001, Calculation SA-08-006 evaluates the thermal hydraulic impact of 34 Generator or failure to close, drain down of BMHV0002, all four steam generator blowdown valves failing open and Blowdown multiple series steam steam generator BMHV0003 or remaining open. The calculation shows that the blowdown generator blowdown inventory through BMHV0004 valves can fail open for 60 minutes with no adverse valves the blowdown consequences. OFN RP-017 removes power from the system, challenging blowdown valves to fail them closed within 60 minutes.

the Decay Heat Removal Function. Based on the above discussion, this MSO scenario is adequately addressed.

Scenario may screen if available AFW mass flow rate exceeds steam generator inventory mass loss rate through blowdown. I

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 32 of 58 Table A3 Control Room Fire MSO Evaluation Scenario cenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Decay Heat Removal PWROG Secondary Spurious opening of Scenario causes N/A The sample lines are isolated by a normally closed manual 35 Sample steam generator drain down of isolation valve downstream of the sample coolers. Therefore, System sample valve(s) steam generator this scenario is not applicable.

inside containment, inventory through AND the sample system, Based on the above discussion, this MSO scenario is adequately challenging the addressed.

Spurious opening of Decay Heat isolation valve(s) Removal Function.

outside containment, AND Spurious opening of downstream sample valve(s)

Expert AFW Flow 1/2 MDAFW Pumps Scenario results in PAL01A or The feedwater check valves were moved to a location upstream Panel 8 Diversion Fails to Start loss of decay heat PAL01 B of the AFW tap in DCP 12792. Therefore, AFW flow cannot removal capability divert to another steam generator.

AND due to flow AND imbalances created Based on the above discussion, this MSO scenario is adequately MFW Isolation Fails by attempting to AEFV0039, addressed.

feed all 4 SGs with AEFV0040, a single MDAFW AEFV0042 or Pump. AEFV0042 AND AEFCV0510 or AEFCV550, AEFCV0520 or AEFCV0560, AEFCV0530 or AEFCV0570, AEFCV0540 or AEFCV0580

Design Basis Document for Procedure OFN RP-01 7 Appendix 3 E-1 F99156, Rev. 5 Page 33 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment RCS Pressure Control PWROG RCS Spurious opening of Scenario causes a PBB01A AND Auxiliary pressurizer spray is prevented in OFN RP-017 by 36 Pressure pressurizer spray RCS pressure BBPCV0455B opening switch PK5117. This action is performed within 7 Decrease valve(s), AND transient, minutes after the reactor is tripped.

challenging the OR Inability to trip, or RCS Pressure Normal pressurizer spray is stopped when operators trip the spurious operation of, Control Function. PBB01 B AND RCPs within 7 minutes after the reactor trip. The RCPs are RCP, AND Typical PFSS BBPCV0455C stopped by locally tripping the breaker, so inability to trip is not a analyses address concern for a control room fire. Control power is removed from Inoperability of PZR this issue; PRAs OR the RCP switchgear to prevent spurious re-start.

Heater(s) often consider scenario negligible PBG04, Backup group B heaters are protected from a control room fire since there is no PBG05A, or and can be operated by an operator at the ASP. The remaining real threat of core PBG05B AND heater groups could be affected.

uncovery. BGHV8145 Evaluation SA-08-006 and Calculation WCNOC-CP-002 model AND various combinations of pressurizer heaters and pressurizer spray spurious operation/mal-operation. The results show that Pressurizer PFSSD is assured with any combination of spray/heater spurious Heater Backup operation/maloperation. Therefore, the various potential Groups A and scenarios discussed in this MSO are bounded.

8 and Variable Group C Off Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 34 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Notes Included Control Room Fire Discussion ID Scenario Description Equipment RCS Pressure Control PWROG RCS Spurious operation of Scenario causes a Same as Procedure OFN RP-017 fails the pressurizer PORVs closed and 37 Pressure multiple PZR heaters, RCS pressure PWROG 36 isolates auxiliary pressurizer spray. The procedure also trips the Increase AND transient, RCPs, causing a loss of pressurizer spray. Pressure is challenging the Plus controlled by reducing temperature using two steam generator Inoperability of RCS Pressure ARVs and auxiliary feedwater. Evaluation SA-08-006 shows that pressurizer spray or Control Function. BBPCV0455A a pressure transient will not occur if procedure OFN RP-017 is auxiliary spray, AND RCS pressure and/or followed.

increase could BBPCV0456A Failure to open cause PORV(s) fail to open Backup group B heaters are protected from a control room fire pressurizer PORVs and/or safety and can be operated by an operator at the ASP. The remaining valve(s) to open. heater groups could be affected. Calculation WCNOC-CP-002 evaluates the impact of multiple heaters spuriously operating and shows there is no adverse impact on PFSSD if this occurs. At worse, the pressurizer safeties will lift to relieve pressure.

Based on the above discussion, this MSO scenario is adequately addressed.

Expert RCS Spurious operation of Scenario causes an BBPC0455A A spurious SI actuation could occur in the event of a control Panel 9 Pressure pressurizer pressure RCS pressure (BBPT0455) room fire. Evaluation SA-08-006 models the effects of a Decrease master controller transient resulting spurious SI signal. Procedure OFN RP-017 has necessary steps in spurious SI to maintain RCS pressure and temperature within required limits.

actuation.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 35 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description jeEquipment Reactivity Control PWROG Inadvertent Unborated water Scenario BGFCV01 11A The reactor makeup pumps supply unborated water to the 38 Boron Dilution supply to the RCS decreases RCS and VCT upstream of the VCT outlet valves. Procedure OFN can occur due to boron BGFCVO110B or RP-017 closes one of the two VCT outlet valves combinations of the concentration, BGFCV01 11 B (BGLCV01 12C). Therefore, unborated water will not reach following: potentially causing the RCS per this scenario when OFN RP-017 is reactivity increase, WITH implemented.

-Spurious start of and challenging the reactor makeup Reactivity Control PBL01A or Based on the above discussion, this MSO scenario is pump(s) Function. PBL01B adequately addressed.

(supplies unborated water to OR the VCT),

BGFCV01 1OA

-Spurious opening fails closed during of valves between auto makeup reactor makeup pump(s) and VCT,

-Spurious full opening of the reactor makeup flow control valve,

-Spurious closure of the boric acid flow control valve I

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 36 of 58 Table A3 Control Room Fire MSO Evaluation Scenario cenari Scenario Notes Included Control Room Fire Discussion ID S Description Equipment Reactivity Control PWROG Fire Prevents Fire damage to RPS Scenario results in SB102A and Document E-1F9915, Table 7.1, Step 2 provides an 39 Reactor Trip may prevent reactor insufficient SB102B evaluation that shows the reactor will trip when operators trip. For example, shutdown margin depress the reactor trip push buttons in the control room in hot shorts may and potential need AND the event of a fire in the control room. The presence of prevent tripping of for emergency physical separation, smoke detection and constant RPS MG sets. boration. PGO1902 OR attendance in the control room provides reasonable PG02002 and assurance that one of the reactor trip buttons will effectively Note that this PA0207 Fail to trip the reactor.

review may have Open already been Based on the above discussion, this MSO scenario is performed for the AND adequately addressed.

disposition of Information Notice Failure of Manual 2007-07. Rod Insertion (SFHS0002)

AND Failure of Emergency Boration (PBG04, PBG05A, PBG05B, PBG02A, PBG02B, and BGHV8104)

Expert Malfunction of Spurious operation Scenario could AEFC0510 For a control room fire, automatic functions are assumed to Panel 10 SGLCS of SG Water Level cause reactor trip (AELC0519), be defeated. Therefore, credit cannot be given to the steam control resulting in due to positive AEFC0520 generator level control system. See the response to overfeed of SG reactivity insertion. (AELCO529), scenario PWROG 33 for discussion about overfilling the AEFC0530 steam generators.

(AELC0539), and AEFC0540 Based on the above discussion, this MSO scenario is (AELC0549) adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 37 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID I I Description Equipment Support Functions PWROG CCW Header CCW flow can be Scenarios cause EGHV0053 and OFN RP-017 lines up Train B CCW by opening EGHV0016 40 Isolation isolated via several failure of CCW EGHV0054 and EGHV0054 and closing EGHV0015. All three valves combinations of function to provide were modified to address NRC IN 92-18 concerns. Valves spurious valve cooling to safe OR EGHV0016 and EGHV0054 are opened using a hand switch closures, shutdown loads, at the MCC. Valve EGHV001 5 is manually closed by local EGHV001 5 and operator action.

Pertinent valves EGHV0016 include: Other valves are manually operated and are maintained in

-pump discharge the correct position. Therefore, these valves can not valves, spuriously operate.

-pump crosstie valves, Based on the above discussion, this MSO scenario is

-CCW heat adequately addressed.

exchanger inlet valves,

-CCW heat exchanger outlet valves,

-CCW heat exchanger crosstie valves,

-Etc. I

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 38 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID I Description Equipment Support Functions PWROG CCW to Spurious isolation of Scenario isolates Loss of CCW to For PFSSD following a control room fire, Train B CCW is 41 Redundant CCW cooling to CCW cooling to redundant RHR required to provide cooling for the B RHR heat exchanger, B Loads redundant loads redundant loads Heat Exchangers: CCP oil cooler, B RHR pump seal cooler and seal water heat (including lube oil causing safe exchanger. Valve EGHV0102 is manually opened in OFN coolers, RHR heat shutdown EGHV0101 AND RP-017A to provide a flow path from the B CCW heat exchangers, etc.) equipment EGHV0102 exchanger to the B RHR heat exchanger when entering inoperability of shutdown cooling mode. The valve was modified to address redundant Trains. NRC IN 92-18 so it will be available when needed. Valve EGHV0054 is opened in OFN RP-017 to provide B CCW All credited CCW flow to the seal water heat exchanger as discussed in loads should be scenario PWROG 40. The remaining flow paths have reviewed. normally open manual valves that are not subject to spurious operation due to a control room fire.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 39 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID I Description Equipment Support Functions PWROG CCW Flow Flow diversion can Scenario causes Potential failure to CCW flow to the non-safety loop is isolated to prevent flow 42 Diversion to occur via several CCW flow to be close of non- diversion from required CCW loads. OFN RP-017 closes Non-Credited combinations of diverted to the non- safety loop EGHV0070A and EGHV0070B by opening switch NK4413.

Loop spurious valve credited loop. This isolation operations in the ultimately prevents Under normal operation, the CCW system supplies CCW pump CCW cooling of EGHV0069A, approximately 4,000 gpm to the SFP heat exchanger. The discharge and CCW credited safe EGHV0069B, RHR heat exchanger is not normally supplied with CCW loop crosstie shutdown loads. EGHV0070A during normal operation. The accident flow to the RHR heat

flowpaths. Review and/or exchanger is approximately 7,600 gpm per M-1 IEGO1. For P&IDs to identify EGHV0070B hot standby following a control room fire, the B RHR system relevant is not used. The B RHR system is placed in service for combinations. Spurious opening shutdown cooling, at which time the SFP heat exchanger of SFP HX supply can be isolated, if necessary, using a manual valve.

Therefore, the 4,000 gpm flow through the SFP heat ECHVOOI 1 or exchanger will not adversely affect CCW flow to the credited ECHV0012 PFSSD components when RHR is not in service. If valve EGHV0102 spuriously opens and allows CCW flow to the RHR heat exchanger, it can be manually closed if necessary.

The valve has been modified to address NRC IN 92-18.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 40 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Support Functions PWROG ESW Header ESW flow to Scenario causes EFHV0037, The Train B ESW system is credited for a control room fire.

43 Isolation credited loads can isolation of ESW, EFHV0039 and Valve EFHV0038 is opened in OFN RP-017 by placing hand be isolated via which can fail EFHV0041 switch EFHS0038A in the ISO/OPEN position. The valve several cooling to the CCW was modified to address NRC IN 92-18 concerns.

combinations of system and other OR Therefore, valve EFHV0038 is protected from a control room spurious valve safe shutdown fire.

closures. components EFHV0038, directly cooled by EFHV0040 and Valves EFHV0040 and EFHV0042 are service water return Pertinent valves ESW (e.g., EDG EFHV0042 valves from Train B ESW. The valves close on SIS or LOSP include: cooling). to ensure 100% of the ESW flow returns to the UHS during

-pump discharge accident conditions. For PFSSD these valves can fail in any valves, position with no adverse impact because flow will be

-pump crosstie maintained through EFHV0038.

valves,

-ESW heat Based on the above discussion, this MSO scenario is exchanger inlet adequately addressed.

valves,

-ESW heat exchanger outlet valves,

-ESW heat exchanger crosstie valves,

-Etc.

Review P&IDs to identify relevant combinations.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 41 of 58 Table A3.

Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Support Functions PWROG ESW to Spurious isolation of Scenario isolates Component Procedure OFN RP-017 lines up Train B ESW to all required 44 Redundant ESW cooling to ESW cooling to Cooling Water: PFSSD loads. Most of the Train B motor operated valves Loads redundant loads redundant loads have been modified to address NRC IN 92-18 concerns.

(including CCW heat causing safe EFHV0051 or Also, the valves are opened or closed using an isolation exchangers, EDG shutdown EFHV0059 switch at the MCC.

cooling, etc.) equipment inoperability of AND Train B valves included in these modifications are:

redundant Trains.

EFHV0052 or EFHV0032 All credited ESW EFHV0060 EFHV0034 loads should be EFHV0046 reviewed. Instrument Air: EFHV0050 EFHV0052 EFHV0043 AND EFHV0044 Valve EFHV0060 is being modified in change package 13898 to address NRC IN 92-18 and to add an ISO/CLOSE Containment switch at the MCC. This valve needs to be closed to prevent Coolers: flow imbalance in the ESW system. Manual valve EFV0090 is maintained in a throttled position to ensure the proper flow EFHV0031, in the system. A compensatory measure procedure step in EFHV0032, OFN RP-017 is in place to de-energize and close valve EFHV0033, EFHV0060 in the event of a fire in the control room.

EFHV0034, EFHV0045, Instrument air is not credited for PFSSD. Therefore, valves EFHV0046, EFHV0043 and EFHV0044 are not included in OFN RP-017.

EFHV0049 and/or See PWROG 45 for discussion of flow diversion if these EFHV0050 valves fail open.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 42 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID S Description Equipment Support Functions PWROG ESW Flow Flow diversion can Scenario causes SW Isolation Train B ESW is credited for a control room fire. Valve 45 Diversion to occur via several ESW flow to be Failure: EFHV0026 is isolated in OFN RP-017 by placing Non-Credited combinations of diverted to a non- EFHS0026A in the ISO/CLOSE position. The hand switch Loops/System spurious valve credited loop or EFHV0023 and isolates the control room, inserts a redundant fuse in the s operations in the system. This EFHV0025 secondary side of the CPT and closes the valve. Also, this ESW pump ultimately prevents valve has been modified to address NRC IN 92-18. These discharge and loop ESW cooling of OR modifications ensure the valve will close and remain closed crosstie flowpaths. credited loads. for the duration of the event.

Review P&IDs to EFHV0024 and identify relevant EFHV0026 See PWROG 44 for discussion about EFHV0052 and combinations. EFHV0060.

CCW HX Supply Full Open: Instrument air is not credited for a control room fire, so valves EFHV0043 and EFHV0044 are not included in OFN EFHV0051, RP-017. Ifthese valves remain in the open position, flow will EFHV0052, be diverted to the air compressor and after cooler. Since EFHV0059 or Train A is not used for control room fire, opening of EFHV0060 EFHV0043 will have no adverse impact on PFSSD. If valve EFHV0044 remains open, there is no adverse impact Instrument Air: because the ESW system is designed to supply the required PFSSD loads concurrent with the air compressor and after EFHV0043 AND cooler. Valve EFHV0044 does not automatically close on a EFHV0044 SIS or LOSP, which indicates that ESW flow to the air compressor and after cooler will not affect safe shutdown.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 43 of 58 Table A3 Control Room Fire MSO Evaluation Scenario SealScenario Icue Notes I Equded dptio Control Room Fire Discussion ID 0 Descriptionmen Support Functions PWROG Emergency Additional Scenario causes All large loads The B EDG is credited for a control room fire. Procedure 46 Power components load diesel generator OFN RP-017 identifies the steps to start the EDG in the onto credited diesel overloading and event of a fire in the control room. The procedure first sheds generator inoperability. Note: all large electrical loads from the NB02 bus before starting Scenario very site the EDG. Then, each required load is added in sequence specific. Interlocks with sufficient time between starts to allow the EDG to come may prevent this up to speed prior to adding the next load. Control power is from occurring, removed from the NB02 bus to prevent inadvertent loading of the bus.

Based on the above discussion, this MSO scenario is adequately addressed.

PWROG Emergency Diesel generator Scenario causes NF039A and Ifa fire occurs in the NF039 cabinets and load sequencing is 47 Power overloading diesel generator NF039B bypassed such that multiple components are loaded overloading and simultaneously, the EDG would continue to operate. There inoperability. Note: are no trip signals that would cause the EDG to trip if this Scenario very site occurs. If the EDG started in emergency mode, the output specific. Interlocks breaker would remain closed because the trip circuits are may prevent this bypassed in emergency mode. Overloading would drop the from occurring, output voltage of the EDG and the current to the individual loads would increase, which could trip the breakers for the In addition to individual loads. However, the EDG and output breaker Scenario 46, would be unaffected.

overloading may also occur if proper OFN RP-017 opens most of the NB02 breakers and load sequencing is manually sequences the loads to the bus after the EDG is bypassed via hot started. The B EDG would remain available to support shorts, causing PFSSD.

simultaneous loading of multiple Based on the above discussion, this MSO scenario is components onto adequately addressed.

the EDG. I

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 44 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID Description Equipment Support Functions PWROG Emergency Diesel generator The fire causes the KKJ01A and Essential Service Water (ESW) is lined up in OFN RP-017 48 Power spuriously starts startup of the PEF01A as soon as possible after the EDG is started to prevent a without service Emergency Diesel high temperature trip. If the EDG starts prior to operators water cooling. Generator and OR leaving the control room and ESW is affected by the fire, the spurious isolation EDG could trip on high temperature. In the event this of ESW cooling KKJ01B and occurs, OFN RP-017 provides instructions on how to start (See Scenarios 42 PEF01 B the EDG.

&44). Running the Emergency Diesel Based on the above discussion, this MSO scenario is Generator with a adequately addressed.

loss of cooling water could trip and/or damage the diesel on high temperature.

PWROG Emergency Non-synchronous Scenario causes NB01 09, NB01 11 Breaker NB0211 is the Train B EDG output breaker. Under 49 Power paralleling of EDG damage to diesel and NB01 12 normal conditions, interlocks prevent this breaker from with on-site and off- generator by closing when NB0209 or NB0212 are closed. This prevents site sources through closing into a live Or non-synchronous paralleling of the EDG to the grid.

spurious breaker bus out-of-phase.

operations Note: Scenario NB0209, NB0211 Non-synchronous paralleling could occur if the EDG very site specific. and NB0212 spuriously starts and a hot short occurs between conductor Interlocks may 21 in cable 14NEB1 1AA and conductor 1 in cable prevent this from 14NEB1 1AD. This will bypass the synch check relay contact occurring, and control room hand switches and close breaker NB021 1.

An external 125 VDC hot short on conductor 21 in cable 14NEB1 1AA would also close breaker NB021 1.

Based on the above discussion, this MSO scenario needs to be addressed for a control room fire. Condition Report 59117 was written to evaluate and correct the condition.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 45 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Scenario Notes Included Control Room Fire Discussion ID I I Description Equipment Support Functions Expert Loss of CCW Spurious operation Scenario could EGTV0029 AND Procedure OFN RP-01 7 lines up Train B CCW to provide Panel 11 Cooling of CCW result in loss of EGTV0030 cooling for credited Train B components. Valve EGTV0030 Temperature Control RCP Thermal is the temperature control valve for Train B CCW heat Valve could divert Barrier Cooling, exchanger. Power to EGTV0030 is disconnected in OFN flow around HX loss of RHR RP-017 by opening switch NK4421. This fails EGTV0030 resulting in loss of cooling capability, closed and prevents CCW from bypassing the heat cooling, and loss of exchanger, which would prevent adequate cooling of additional credited PFSSD loads.

equipment dependent on Based on the above discussion, this MSO scenario is CCW. adequately addressed.

Expert Loss of Control Spurious trip of both Scenario could SGK04A AND A fire in the control room would result in evacuation.

Panel 12 Room HVAC Trains or isolation of result in spurious SGK04B Therefore, control room ventilation is not required for a cooling to both operation of control room fire. Loss of SGK04A and SGK04B would not Trains. various instrument adversely affect the ability to achieve safe shutdown from loops due to outside the control room.

overheating of instrument Based on the above discussion, this MSO scenario is cabinets. adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-AF9915, Rev. 5 Page 46 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other PWROG Generic - Loss Spurious isolation of Suction flow paths SI Pumps: All suction flow paths to credited pumps have been analyzed 50 of Pump various valves in for all credited and measures have been taken to protect these flow paths Suction pump suction flow pumps should be EMHV8923A, and from spurious operation in the event of a control room fire.

path reviewed for MSO EMHV8807A and These measures include providing control room isolation, scenarios causing EMHV8807B, or redundant fusing and circuit modifications to address NRC IN loss of suction and EMHV8924, or 92-18 where applicable.

pump inoperability. EJHV8804A An example of a Procedure OFN RP-017 lines up the suction flow paths to pump suction MSO AND ensure adequate suction is available to all the pumps credited was previously for PFSSD following a control room fire. One of the first steps identified in which EMHV8923B and in OFN RP-01 7 is to open the breakers associated with these both the VCT EJHV8804B pumps. Then, steps are taken to establish suction and outlets valve(s) discharge flow paths prior to energizing the pump motors.

and RWST outlet Charging Pumps: These steps provide reasonable assurance that the pumps will valve(s) spuriously not operate without suction and discharge flow paths.

close. See PWROG 10 Based on the above discussion, this MSO scenario is Another example AFW Pumps: adequately addressed.

involves pump suction cross- LSP, and connect valves.

Three pumps may ALHV0030, be supplied from a ALHV0031, common suction ALHV0032, header that and/or includes several ALHV0033 cross-connect valves. If two OR valves spuriously isolate, the pump LSP, and drawing suction from the common ESW Unavailable header between the two isolated

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 47 of 58 Table A3 Control Room Fire MSO Evaluation suction and become inoperable.

The spurious operation of idle pumps after suction has been spuriously isolated should also be considered.

Spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 48 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other PWROG Generic - Spurious isolation of Scenario causes RHR Pumps: All discharge flow paths from credited pumps have been 51 Pump Shutoff pump discharge pump operation at analyzed and measures have been taken to protect these flow Head flow, AND shutoff head and Spurious SIS or paths from spurious operation in the event of a control room subsequent Spurious start of fire. These measures include providing control room isolation, Spurious isolation of inoperability. All pumps redundant fusing and circuit modifications to address NRC IN recirculation credited pumps 92-18 where applicable.

valve(s) should be AND reviewed for this Procedure OFN RP-01 7 lines up the discharge flow paths to scenario. EJFCV0610 or ensure adequate flow is available from all the pumps credited EJFCV0611 for PFSSD following a control room fire. One of the first steps Note that spurious in OFN RP-01 7 is to open the breakers associated with these starting of idle pumps. Then, steps are taken to establish suction and pump(s), in discharge flow paths prior to energizing the pump motors.

combination with These steps provide reasonable assurance that the pumps will isolation of not operate without suction and discharge flow paths.

discharge flow and recirculation, may Based on the above discussion, this MSO scenario is cause inoperability adequately addressed.

of additional pumps. Spurious pump starting can occur for several reasons, including fire damage to control circuitry or a spurious ESAFAS sianal.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 49 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario L Description Notes Equipment Control Room Fire Discussion Other PWROG Generic - Pump damage from Scenario causes All credited Procedure OFN RP-017 lines up each credited pump to 52 Pump Outside operation outside pump failure. pumps. ensure the pumps are not run dead headed or at run-out Design Flow design flow either at conditions. This is done by first de-energizing all credited shutoff head or Operation at pumps then making the required valve lineups. Once this is pump run-out shutoff head can done, the pumps are started. In some cases, dedicated conditions. occur, for example, operators are staged at valves to throttle the flow as directed if pump discharge by the operator at the ASP. These steps prevent operation of flow spuriously the pumps outside of their design conditions.

isolates with the recirculation valves Based on the above discussion, this MSO scenario is closed. Run-out adequately addressed.

can occur, for example, if the discharge header is at reduced pressure conditions.

Note that spurious starting of idle pump(s), in combination with isolation of discharge flow and recirculation, may cause failure of additional pumps.

Spurious pump starting can occur for several reasons, including fire damage to control circuitry or an inadvertent ESFAS sianal.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 50 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other PWROG Generic- Spurious operation All credited flow Various Procedure OFN RP-017 lines up Train B valves to prevent flow 53 Flow Diversion of various valves paths should be diversion. All potential flow diversion paths were reviewed to causing flow reviewed for MSO ensure appropriate actions are taken to prevent flow diversion.

diversion, scenarios that can Valves in the paths are either manually closed or closed by divert flow away use of a hand switch. All valves that are closed electrically from desired have been modified to ensure a control room fire will not affect location, the ability to close the valve.

Based on the above discussion, this MSO scenario is adequately addressed.

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1 F991 5, Rev. 5 Page 51 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other Expert Generic - Spurious isolation of Discharge flow SI Pumps: See PWROG 51 for discussion of pump discharge flow path Panel 13 Pump various valves in paths for all isolation.

Discharge pump discharge credited pumps EMHV8821A and Flow Path flow path should be EMHV8802A fails Based on the above discussion, this MSO scenario is Isolation reviewed for MSO to open adequately addressed.

scenarios that isolate those flow AND paths. One example is EMHV8821B and spurious isolation EMHV8802B fails of two parallel to open charging injection valves.

Another example involves pump discharge cross-connect valves.

For example, three pumps may feed a common discharge header that includes several cross-connect valves. If two valves spuriously isolate, pump flow feeding the common header between the two isolated valves will I___ _ I __ Iisolate.

PWROG Loss of HVAC Spurious isolation of Perform review to ESW: Procedure OFN RP-017 lines up HVAC to Train B rooms 54 HVAC to credited identify spurious containing credited PFSSD equipment. This includes Class I I loads failures that could GDTZ0001A AND 1 E electrical equipment rooms, electrical penetration rooms,

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1 F9915, Rev. 5 Page 52 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other cause isolation of GDTZ0001C pump rooms, containment and Train B diesel generator room.

HVAC to credited Modifications have been made to ensure a control room fire loads. Credited OR will not affect the ability to provide HVAC to these rooms.

loads may include pump rooms, GDTZ0011A AND Based on the above discussion, this MSO scenario is switchgear rooms, GDTZ0011C adequately addressed.

and rooms containing solid Diesels:

state control systems. GMTZ0001A Examples of AND GMHZ0009 spurious failures include spurious OR damper isolation and spurious GMTZO011A isolation of cooling AND GMHZ0019 flow to chillers.

PWROG Valve Spurious motor- General scenario All credited motor All credited motor operated valves (MOVs) used to shut down 55 Inoperability operated valve is that fire damage operated valves following a control room fire have been or will be modified to operation, AND to motor-operated address NRC IN 92-18. Valve EFHV0060 is being modified valve circuitry per DCP 13898 and valve EMHV8801A is being modified per Wire-to-wire causes spurious DCP 13614, Rev. 1. Therefore, the MOVs are or will be short(s) bypass operation. If the protected against these failures.

torque and limit same fire causes switches wire-to-wire Based on the above discussion, this MSO scenario is short(s) such that adequately addressed.

the valve torque and limit switches are bypassed, then the valve motor may stall at the end of the valve cycle. This can cause excess current in the valve I

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 53 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other motor windings as well as valve mechanical damage. This mechanical damage may be sufficient to prevent manual operation of the valve.

Scenario only applies to motor-operated valves.

Note that this generic issue may have already been addressed during disposition of NRC Information Notice 92-18. This disposition should be reviewed inthe context of multiple spurious operations and multiple hot shorts.

.5. _______________ 5

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1 F991 5, Rev. 5 Page 54 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other PWROG Fire-Induced Fire-induced spurious ESFAS signals 2/4 Low Spurious ESFAS requires at least two spurious signals, which 56 Spurious (e.g., safety injection, containment Pressurizer is not required to be postulated as an initial condition for ESFAS isolation, etc), combined with other fire- Pressure: control room fires. A spurious ESFAS occurring after control induced failures, can adversely affect safe room isolation is achieved will not affect the ability to maintain shutdown capability. An example of a fire- BBPT0455, the reactor in a safe shutdown condition because all required induced ESFAS signal is a fire causing BBPT0456, Train B equipment is manually aligned per OFN RP-017.

open circuits on 2/3 main steam pressure BBPT0457, and Certain Train A equipment that could cause adverse effects is instruments on one loop resulting in a BBPT0458 also secured in OFN RP-017 to prevent inadvertent operation.

spurious safety injection signal. ESFAS Therefore, a spurious ESFAS will not affect the ability to signals can result from open circuits, Low Steamline achieve and maintain safe shutdown.

shorts to ground, and/or hot shorts. Fire- Pressure (2/3 of induced failure of instrument inverters any of the Based on the above discussion, this MSO scenario is may also cause spurious ESFAS signals. following): adequately addressed.

The plant should perform a systematic review to asses the potential for fire- ABPT0514, induced spurious ESFAS to adversely ABPT0515, affect safe shutdown capability. Below ABPT0516 are some examples.

OR ABPT0524, ABPT0525, ABPT0526 OR ABPT0534, ABPT0535, ABPT0536 OR ABPT0544, ABPT0545, ABPT0546

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 55 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other High Containment Pressure (2/3)

SiS:

GNPT0934, GNPT0935, GNPT0936 High Containment Pressure (2/4)

CSAS:

GNPT0934, GNPT0935, GNPT0936, GNPT0937 PWROG RCS Makeup Spurious safety Safety injection RHR Pumps: See PWROG 56 for discussion about spurious ESFAS.

56a Pump injection signal, signal starts Inoperability AND multiple RCS PWROG 56 Based on the above discussion, this MSO scenario is makeup pumps. adequately addressed.

Spurious isolation of Fire causes AND makeup pump makeup pump suction suction valves to BNHV8812A or fail closed. BNHV8812B Scenario results in cavitation / Charging Pumps:

inoperability of multiple RCS PWROG 56 makeup pumps.

AND L_ _BGLCV01 12B or

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-1F9915, Rev. 5 Page 56 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other BGLCV01 12C AND BGLCV01 12D and BGLCV01 12E PWROG Loss of All Spurious Scenario causes 2/4 Containment See PWROG 56 for discussion about spurious ESFAS.

56b Seal Cooling containment loss of all RCP Pressure HI-3 isolation signal seal cooling and from GNPT0934, Based on the above discussion, this MSO scenario is isolates CCW to the subsequent RCP GNPT0935, adequately addressed.

thermal barrier heat Seal LOCA. GNPT0936, and exchangers for all GNPT0937 RCPs, AND AND Spurious isolation of seal injection BGFCV0462 and header flow BGFCV0121 OR BBHV8351A, BBHV8351 B, BBHV8351 C and/or BBHV8351 D

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 57 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other PWROG Loss of All Spurious Scenario causes 2/4 Containment See PWROG 56 for discussion about spurious ESFAS.

56c Seal Cooling containment loss of all RCP Pressure HI-3 isolation signal seal cooling and (CISB) from Based on the above discussion, this MSO scenario is isolates CCW to the subsequent RCP GNPT0934, adequately addressed.

thermal barrier heat Seal LOCA. GNPT0935, exchangers for all GNPT0936, and RCPs, AND GNPT0937 Spurious opening of AND charging injection valve(s) causing EMHV8801A or insufficient flow to EMHV8801 B seals AND EMHV8803A or EMHV8803B PWROG RWST Drain Spurious high Scenario causes a 2/4 Containment See PWROG 56 for discussion about spurious ESFAS.

56d Down containment pumped RWST Pressure HI-3 pressure on multiple drain down via the from GNPT0934, Based on the above discussion, this MSO scenario is channels causing containment spray GNPT0935, adequately addressed.

spurious pumps and GNPT0936, and containment spray containment spray GNPT0937 signal ring.

PWROG PORV(s) Spurious high Spurious high BBPT0455 AND See PWROG 56 for discussion about spurious ESFAS.

56e Open pressurizer pressurizer BBPT0456 pressure on multiple pressure signal Based on the above discussion, this MSO scenario is channels causes causes PORV(s) to adequately addressed.

high pressurizer open and pressure signal challenges the RCS Inventory and Pressure Control I Functions

Design Basis Document for Procedure OFN RP-017 Appendix 3 E-IF9915, Rev. 5 Page 58 of 58 Table A3 Control Room Fire MSO Evaluation Scenario Scenario Included ID Scenario Description Notes Equipment Control Room Fire Discussion Other PWROG RCS Makeup Spurious Spurious RHR Pumps See PWROG 56 for discussion about spurious ESFAS.

56f Pump Failure Recirculation Recirculation Actuation Signal Actuation Signal Containment Based on the above discussion, this MSO scenario is (RAS) causes (RAS) starting and Sump Valves adequately addressed.

pumps to start and aligning pumps to align to dry a dry containment containment sump sump.

Expert Loss of Various Scenario could Penetration 32: Procedure OFN RP-017 ensures no core damage will occur Panel 14 Containment combinations of cause uncontrolled following a fire in the control room. This is demonstrated in Isolation spurious operation release of fission LFFV0095 AND evaluation SA-08-006. Therefore, containment isolation is not of valves credited products following LFFV0096 required for PFSSD following a control room fire.

for containment core damage.

isolation. Penetration 65: Based on the above discussion, this MSO scenario is adequately addressed.

GSHV0020 AND GSHV0021 Penetration 160:

GTHZ0011 AND GTHZ0012 Penetration 161:

GTHZ0004 AND GTHZ0005

ET 13-0035, Fire Protection Program Re Alternative Shutdown Capability

Contents

Text

Subject:

Subject:

SUMMARY

SUMMARY

Subject:

Navigation menu

ET 13-0035, Fire Protection Program Re Alternative Shutdown Capability

Text

Subject:

Subject:

SUMMARY

SUMMARY

Subject:

Navigation menu

Search