IR 05000458/2010006

IR 05000458-10-006; Entergy Operations, Inc.,; 04/05/2010 - 06/02/2010; River Bend Station, NRC Triennial Fire Protection Inspection and Notice of Violation

ML101690164
Person / Time
Site:	River Bend
Issue date:	06/17/2010
From:	O'Keefe N F NRC/RGN-IV/DRS/EB-2
To:	Mike Perito Entergy Operations
References
EA-10-095
Preceding documents:	ML102560117 (10 September 2010)
Download: ML101690164 (49)

Text

June 17 2010

EA-10-095 Michael Perito Vice President, Operations Entergy Operations, Inc.

River Bend Station 5485 US Highway 61N St. Francisville, LA 70775

SUBJECT: RIVER BEND STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000458/2010006 AND NOTICE OF VIOLATION

Dear Mr. Perito:

On June 2, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at River Bend Station facility. The enclosed inspection report documents the inspection results, which were discussed on April 23, 2010, with Mr. Eric Olson, General Manager of Plant Operations, and in a telephonic exit meeting on June 2, 2010 with Mr. Jerry Roberts and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commission's rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed personnel.

This report documents four NRC-identified violations. One violation is cited in the enclosed Notice of Violation and the circumstances surrounding it are described in detail in the subject inspection report. The violation is being cited in the Notice because of your failure to correct a significant non-compliance with your License Condition 2.C.(10), "Fire Protection," within a reasonable time as described in the NRC Enforcement Manual. The NRC has also identified three other issues that were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC also determined that violations are associated with these issues. These violations are being treated as Noncited Violations (NCVs), consistent with Section VI.A of the Enforcement Policy. These NCVs are described in the subject inspection report.

You are required to respond to this letter and should follow the instructions specified in the enclosed Notice of Violation when preparing your response. The NRC will use your response, in part, to determine whether further enforcement action is necessary to ensure compliance with regulatory requirements. Entergy Operations, Inc. - 2 - EA-10-095 If you contest the noncited violations or their significance, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with copies to: (1) the Regional Administrator, Region IV, 612 East Lamar Blvd., Arlington, TX 76011-4125; (2) the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and (3) NRC Resident Inspector at River Bend Station facility. The information you provide will be considered in accordance with Inspection Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRC's document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). To the extent possible, your response should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the Public without redaction.

Sincerely,/RA/ Neil O'Keefe, Chief Engineering Branch 2 Division of Reactor Safety

Docket No. 50-458 License No. NPF-47

Enclosure:

Inspection Report No. 05000458/2010006

w/Attachments:

1 - Notice of Violation 2 - Supplemental Information cc w/

Enclosure:

Senior Vice President and COO Entergy Operations, Inc P. O. Box 31995 Jackson, MS 39286-1995 Vice President, Oversight Entergy Operations, Inc. P. O. Box 31995 Jackson, MS 39286-1995 Senior Manager, Nuclear Safety & Licensing Entergy Nuclear Operations P. O. Box 31995 Jackson, MS 39286-1995

Entergy Operations, Inc. - 3 - EA-10-095 Manager, Licensing Entergy Operations, Inc. 5485 US Highway 61N St. Francisville, LA 70775 Attorney General State of Louisiana P. O. Box 94005 Baton Rouge, LA 70804-9005 Ms. H. Anne Plettinger 3456 Villa Rose Drive Baton Rouge, LA 70806 President of West Feliciana Police Jury P. O. Box 1921 St. Francisville, LA 70775 Mr. Brian Almon Public Utility Commission William B. Travis Building P. O. Box 13326 Austin, TX 78701-3326

Mr. Jim Calloway Public Utility Commission of Texas 1701 N. Congress Avenue Austin, TX 78711-3326

Louisiana Department of Environmental Quality Radiological Emergency Planning and Response Division P. O. Box 4312 Baton Rouge, LA 70821-4312 Joseph A. Aluise Associate General Counsel - Nuclear Entergy Services, Inc. 639 Loyola Avenue New Orleans, LA 70113

Chief, Technological Hazards Branch FEMA Region VI 800 N. Loop 288 Denton, TX 76209-3606 Entergy Operations, Inc. - 4 - EA-10-095 Electronic distribution by RIV: Regional Administrator (Elmo.Collins@nrc.gov) Deputy Regional Administrator (Chuck.Casto@nrc.gov)

DRP Director (Dwight.Chamberlain@nrc.gov) DRP Deputy Director (Anton.Vegel@nrc.gov) DRS Director (Roy.Caniano@nrc.gov) DRS Deputy Director (Troy.Pruett@nrc.gov) Senior Resident Inspector (Grant.Larkin@nrc.gov)

Resident Inspector (Charles.Norton@nrc.gov) Branch Chief, DRP/C (Vincent.Gaddy@nrc.gov) RBS Administrative Assistant (Lisa.Day@nrc.gov) Senior Project Engineer, DRP/C (Bob.Hagar@nrc.gov) Project Engineer, DRP/C (Rayomand.Kumana@nrc.gov) Public Affairs Officer (Victor.Dricks@nrc.gov) Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Alan.Wang@nrc.gov) Branch Chief, DRS/TSB (Michael.Hay@nrc.gov) RITS Coordinator (Marisa.Herrera@nrc.gov) Regional Counsel (Karla.Fuller@nrc.gov) Congressional Affairs Officer (Jenny.Weil@nrc.gov) Senior Enforcement Specialist Ray.Kellar@nrc.gov OEMail Resource OEDO RIV Coordinator (Leigh.Trocine@nrc.gov)

File located: S:\DRS\REPORTS\(final) RBS2010006 rpt-STG ADAMS ML SUNSI Rev Compl. Yes No ADAMS Yes No Reviewer Initials NFO Publicly Avail Yes No Sensitive Yes No Sens. Type Initials NFO SRI:DRS/EB2 RI:DRS/EB2 RI:DRS/EB2 RI:DRS/EB2 SRA:DRS SGraves SAlferink BCorrell NOkonkwo MRunyun /RA/ /RA/ /RA/ /RA/ /RA/ 6/9/10 6/9/10 6/9/10 6/9/10 6/9/10 SES:ACES C: DRP/PBC C:DRS/EB2 RKellar VGaddy NFO'Keefe /RA/ /RA/ /RA/ 6/15/10 6/17/10 6/17/10 OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax Enclosure NOTICE OF VIOLATION Entergy Operations, Inc. Docket No. 50-458 River Bend Station License No. NPF-47 EA-10-095

During an NRC inspection completed on June 2, 2010, a violation of NRC requirements was identified. In accordance with the NRC Enforcement Policy, the violation is listed below:

License Condition 2.C.(10), "Fire Protection," requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4, "Fire Protection Program Requirements," states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility. The fire protection program requirements are described in section 9.5.1 and appendices 9A and 9B. Section 9B.4.7 specifies, in part, "Fire protection features shall be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage."

Contrary to this requirement, in May 2007, the licensee determined that they failed to ensure that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) was free of fire damage. Specifically, the Division 1 standby service water support system to the Division 1 emergency diesel generator, which was required to achieve safe shutdown, was not protected such that it remained free from fire damage under all conditions. The non-emergency high temperature trips for the emergency diesel generator would be disabled by design when automatically started in emergency mode due to loss of offsite power. Since standby service water could be lost due to fire damage during a control room fire, the emergency diesel generator would continue to run without cooling, and potentially fail prior to operators restoring standby service water at the remote shutdown panel. The licensee failed to promptly restore compliance in the three years since identifying the non-conforming condition, during which time the licensee has completed two refueling outages, six unplanned outages, and a planned system outage of sufficient duration. This condition was entered into the licensee's corrective action program as CR-RBS-2007-02102.

This violation is associated with Green significance determination process finding 05000458/2010006-01.

Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Inc. is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional Administrator, Region IV, 612 East Lamar Blvd., Arlington, TX 76011-4125, and a copy to the NRC Resident Inspector at River Bend Station within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply should be clearly marked as a "Reply to a Notice of Violation: EA-10-095" and should include for each violation: (1) the reason for the violation, or, if contested, the basis for disputing the violation, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken, and (4) the date when full compliance will be achieved. In your response, please provide a description of the Enclosure process(es) used and your assessment of the appropriateness of the decisions to extend the completion of necessary plant modifications beyond the November 2009 refueling outage. Your response may reference or include previous docketed correspondence, if the correspondence adequately addresses the required response. If an adequate reply is not received within the time specified in this Notice, an order or a Demand for Information may be issued as to why the license should not be modified, suspended, or revoked, or why such other action as may be proper should not be taken. Where good cause is shown, consideration will be given to extending the response time.

If you contest this enforcement action, you should also provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington DC 20555-0001.

Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC's website at www.nrc.gov/reading-rm/pdr.html or www.nrc.gov/reading-rm/adams.html, to the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the public without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated this 17th day of June 2010. Enclosure ENCLOSURE U.S. NUCLEAR REGULATORY COMMISSION REGION IV Docket: 50-458 License: NPF-47 Report No.: 05000458/2010006 Licensee: Entergy Operations, Inc. Facility: River Bend Station Location: 5485 U.S. Highway 61 St. Francisville, LA Dates: April 5 through June 2, 2010 Team Leader: S. Graves, Senior Reactor Inspector Engineering Branch 2 Division of Reactor Safety Inspectors: S. Alferink, Reactor Inspector Engineering Branch 2 Division of Reactor Safety B. Correll, Reactor Inspector Engineering Branch 2 Division of Reactor Safety N. Okonkwo, Reactor Inspector Engineering Branch 2 Division of Reactor Safety Approved By: Neil O'Keefe, Branch Chief Engineering Branch 2 Division of Reactor Safety Enclosure

SUMMARY OF FINDINGS

IR 05000458/2010006; 4/5/10 - 6/2/10; Entergy Operations, Inc.; River Bend Station; Fire Protection (Triennial)

The report covered a two week triennial fire protection team inspection by specialist inspectors from Region IV. Four Green findings were identified and categorized as one cited violation (NOV) and three noncited violations (NCVs). The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, "Significance Determination Process." The crosscutting aspects were determined using Inspection Manual Chapter 0310, "Components within the Cross-Cutting Areas." Findings for which the significance determination process (SDP) does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team identified a cited violation of License Condition 2.C.(10), "Fire Protection," for failing to ensure that the Division 1 standby service water support system to the Division 1 emergency diesel generator, which was required to achieve safe shutdown, was protected such that it remained free from fire damage under all conditions. This condition was identified by the licensee in May 2007, and entered into their corrective action program as a significant non-conforming condition in CR-RBS-2007-02102. The licensee subsequently initiated compensatory measures in the form of manual actions to protect the Division 1 emergency diesel generator. This issue was documented as a licensee-identified noncited violation in Inspection Report 2009002. River Bend has subsequently completed two refueling outages, six forced outages, and one emergency diesel generator work window of sufficient duration since identification of this condition and failed to correct the non-conformance. The team determined that schedule changes resulted in a new completion date of January 2011.

The failure to ensure that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) was free of fire damage and to correct this significant non-conforming condition in a timely manner is a performance deficiency. This performance deficiency was more than minor because it was associated with the protection against external factors (fire) attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events in order to prevent undesirable consequences. The team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems with plant-wide consequences. A Phase 3 SDP risk assessment was performed by a senior reactor analyst. The bounding change in conditional core damage frequency for a 1-year exposure is the Fire Mitigation Frequency (4.30E-08/year) multiplied by the change in conditional core damage probability (0.9) for a value of 3.87E-08/year. This value indicates the finding has very low safety significance (Green). Because the licensee failed to correct this violation, this violation is being treated as a cited violation, consistent with the NRC Enforcement Policy. This finding had a crosscutting aspect in the Work Control component of the Human Performance area because the licensee did not appropriately plan work activities to support long-term equipment reliability by limiting temporary modifications, operator workarounds, safety systems unavailability, and reliance on manual actions H.3(b). (Section 1R05.01)

Green.

The team identified a noncited violation of Technical Specification 5.4.1.d, "Fire Protection Program Implementation." Specifically, Procedure AOP-0031 "Shutdown from Outside the Main Control Room," Revision 307, had steps that could not be implemented as written. Two steps were to be performed before the necessary ac power was available, and two steps required diagnostic assessment without the availability of instrumentation.

The failure to ensure that Procedure AOP-0031, Revision 307 could be implemented as written is a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Using Attachment 2 to Appendix F, "Fire Protection Significance Determination Process," this issue was determined to be a safe shutdown finding, and was assigned a degradation rating of Low because the examples involved procedural deficiencies that could be compensated for by operator experience. Since this finding was assigned a low degradation rating, the safety significance screened as very low (Green). This finding was entered into the licensee's corrective action program as CR-RBS-2010-01592, CR-RBS-2010-01831, CR-RBS-2010-01775, CR-RBS-2010-01821, and CR-RBS-2010-1846. This finding had a crosscutting aspect in the Resources component of the Human Performance area, in that the licensee did not ensure that procedures were complete, accurate, and up to date to assure nuclear safety [H.2.(c)]. (Section 1R05.05.b.1)

Green.

The team identified a noncited violation of License Condition 2.C.(10), "Fire Protection," for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the team identified, during a timed walkdown of the procedure that it took operators over 6 minutes to isolate feedwater, but the simulator showed that the steam lines could be flooded in 2 minutes. Overfilling the reactor pressure vessel and flooding the main steam lines could make reactor core isolation cooling unavailable. Reactor core isolation cooling was credited for decay heat removal and inventory control in the event of a fire. The failure to ensure that feedwater would be isolated prior to overfilling the reactor pressure vessel and flooding the main steam lines making reactor core isolation cooling unavailable is a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems with plant-

wide consequences. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a control room fire that led to control room abandonment. The Phase 3 evaluation determined that the finding had very low safety significance because a fire in only one of 109 electrical cabinets in the control room could result in this overfill event. The finding was entered into the licensee's corrective action program as CR-RBS-2010-01808. The finding did not have a crosscutting aspect since it was not indicative of current performance, in that the licensee had established the incorrect response time more than three years prior to this finding. (Section 1R05.05.b.2)

Green.

The team identified a noncited violation of License Condition 2.C.(10), "Fire Protection," related to the licensee's failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, during testing required by the approved fire protection program the licensee failed to adequately test the remote shutdown emergency transfer switch functions used to assure isolation of safe shutdown equipment from the control room in the event of a control room evacuation due to fire. The switch functions had not been adequately tested since 1997.

The failure to ensure isolation from the control room for safe shutdown equipment controlled from the remote shutdown panel during surveillance testing of emergency transfer switches is a performance deficiency. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone in that it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown. Using Appendix F, Attachment 2, "Degradation Rating Guidance Specific to Various Fire Protection Program Elements," the team determined that the finding constituted a low degradation of the safe shutdown area since the control room isolation feature was expected to display nearly the same level of effectiveness and reliability as it would had the degradation not been present. This finding screened as having very low safety significance (Green). This violation was entered into the licensee's corrective action program as CR-RBS-2010-01783. Because the emergency transfer switch surveillance procedures had been in effect since 1997, there was no crosscutting aspect associated with the violation, in that it is not indicative of current licensee performance. (Section 1R05.05.b.3)

B. Licensee-Identified Violations

None.

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, "Fire Protection (Triennial)," at the River Bend Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk significant areas, with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post fire capability to safely shut down the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for review. The inspection team used the fire hazards analysis section of the River Bend Station Individual Plant Examination of External Events to select the following five risk significant fire areas (inspection samples) for review:

C-15 Division I Standby Switchgear Room C-17 Control Room Ventilation Room (El. 116') C-25 Control Room AB-2/Z-1 and Z-2 High Pressure Core Spray and High Pressure Core Spray Hatch Area PT-1 Piping Tunnel The inspection team evaluated the licensee's fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(10), NRC safety evaluations, NRC supplemental safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Final Safety Analysis Report (FSAR), Section 9.5.1; Technical Requirements Manual; the fire hazards analysis; and the post fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Five inspection samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post fire safe shutdown analysis to verify that the safe shutdown methodology had properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for equipment in the selected fire areas. The team also reviewed and observed walkdowns of the procedures for achieving and maintaining safe shutdown in the event of a fire to verify that the licensee properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensee's method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Sections III.G. Specifically, the team evaluated whether at least one post fire safe shutdown success path remained free of fire damage in the event of a fire. In addition, the team verified that the licensee met applicable license commitments.

b. Findings

Introduction.

The team identified a Green, cited violation of License Condition 2.C.(10) "Fire Protection," for failing to ensure that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage and failing to promptly correct this non-conforming condition.

Description.

On May 21, 2007, during a review of industry operating experience, the licensee determined that the Division 1 emergency diesel generator could be disabled during a main control room fire due to fire damage to a required support system. Specifically, the non-emergency high temperature trips for the emergency diesel generator would be disabled by design when the engine is automatically started in emergency mode due to loss of offsite power. Since standby service water could be lost due to fire damage during a control room fire, the emergency diesel generator would continue to run without cooling and potentially fail prior to operators restoring standby service water at the remote shutdown panel. The Division 1 emergency diesel generator is the credited source of ac power used to safely shut down the reactor in the event of a fire requiring evacuation of the main control room with concurrent loss of offsite power.

The licensee documented this non-conformance in Condition Report CR-RBS-2007-02102 as a significant non-conforming condition and implemented compensatory measures in the form of operator manual actions. The manual actions were added to Procedure AOP-0031, "Shutdown from Outside the Main Control Room," Revision 307, to immediately trip the emergency diesel generator after an emergency mode start and transfer control to the remote shutdown panel prior to control room evacuation. Once transferred, operators would ensure the availability of standby service water and perform a manual normal-mode start of the emergency diesel generator, in which the high temperature trips would remain functional.

This non-conforming condition was reported to the NRC as an unanalyzed condition that significantly degrades plant safety, in accordance with 10 CFR 50.72(b)(3)(ii)(B) and subsequently in July 2007, in Licensee Event Report (LER) 05000458/07-003-00.

The team was concerned that the licensee had not been timely in restoring compliance. In late 2008, the NRC concluded that this non-conforming condition constituted a licensee-identified Green noncited violation. At that time, the licensee had scheduled corrective action for this condition for November 2009. The team learned that this was later rescheduled because the modification package was not completed in time and parts were not available to support the scheduled date. While the licensee had concluded that the work could be done online, the modification was not ready so it was rescheduled for the next refueling outage in January 2011.

The team noted that the licensee had concluded that multiple spurious operations had to occur for the condition to impact safe shutdown in the event of a fire. Further discussions with the licensee resulted in the team concluding that the loss of offsite power also was inappropriately considered as a fire-induced spurious actuation in the control room fire scenario, and because the standby service water system could be subject to maloperation due to fire-damage, The licensee classified this scenario as an event requiring multiple fire induced spurious actuations in order to occur. This incorrect conclusion contributed to licensee decisions to delay completion of corrective actions.

The team pointed out that demonstrating the ability to safely shutdown in the event of a fire in the control room is a deterministic design requirement, not a spurious operation.

Similarly, the postulated loss of standby service water is the result of fire damage, not a spurious operation.

The Onsite Safety Review Committee evaluated the core damage frequency and concluded that the risk of rescheduling the modification was very low. However, the team noted that this condition was classified by the licensee as being operable but a significant non-conforming condition. Regulatory Issue Summary 2005-20 references Inspection Manual Part 9900, "Revision to Guidance Formerly Contained in NRC Generic Letter 91-18, 'Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Non-conforming Conditions and on Operability,'" which states, in part, that degraded or non-conforming conditions must be corrected in a timely manner, commensurate with the safety significance. Also, for technical specification systems, structures, or components, the NRC expects that issues requiring compensatory measures and issues involving manual actions in lieu of automatic system response would indicate conditions that should be fixed expeditiously. While the licensee used this guidance in their decision making process, the team was concerned that the licensee did not appropriately consider this guidance before delaying implementation of the modification. Further, at the time of this inspection, the plant had conducted two refueling outages, six unplanned outages, and a planned system outage of sufficient duration since identifying the condition. The team concluded that the total time to restore compliance did not reflect timely corrective action, and rescheduling to the January 2011 refueling outage rather than adjusting online maintenance schedules did not reflect a work control process that was focused on scheduling work activities so as to minimize reliance on manual actions.

Section 7.2 of Inspection Manual Part 9900 states, in part, that "In determining whether the licensee is making reasonable efforts to complete corrective actions promptly, the NRC will consider safety significance, the effects on operability, the significance of the degradation, and what is necessary to implement the corrective action. The NRC may also consider the time needed for design, review, approval, or procurement of the repair or modification; the availability of specialized equipment to perform the repair or modification; and whether the plant must be in hot or cold shutdown to implement the actions. If the licensee does not resolve the degraded or nonconforming condition at the first available opportunity or does not appropriately justify a longer completion schedule, the staff would conclude that corrective action has not been timely and would consider taking enforcement action."

In applying this guidance to this issue, the staff concluded that:

• The systems affected by the non-conforming condition and the compensatory measures are systems required to be operable by technical specifications. These systems are also required to be operable to meet License Condition 2.C.(10) and the safe shutdown requirements of the approved fire protection program.

• The non-conforming condition was more significant based on the reliance upon manual actions in lieu of automatic functioning, and because compensatory actions were necessary to ensure the operability of the affected systems.

• Scheduling the modification for completion in the second refueling outage following identification of the issue was justified based on the proximity of the first outage to the date of identification and the time needed for design and procurement activities.

• Delay of the modification to the third refueling outage, rather than scheduling a work window sooner, did not appear to have adequately considered the factors described in Part 9900. Further, delays in design and procurement appeared to be the result of factors within the control of the licensee, given proper priority.

Based on the above, the staff has concluded that corrective action for this non-conforming condition was not timely commensurate with the safety significance of the condition.

Analysis.

The failure to ensure that at least one train of equipment necessary to achieve hot shutdown from either the control room or emergency control station(s) is maintained free of fire damage as required by the licensee's fire protection program, and to correct this significant non-conforming condition in a timely manner is a performance deficiency. This performance deficiency was more than minor because it was associated with the protection against external factors (fire) attribute of the Mitigating Systems Cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events in order to prevent undesirable consequences. The team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems with plant-wide consequences. A Phase 3 SDP risk assessment was performed by a senior reactor analyst.

Because the River Bend control room included the plant instrumentation and relay cabinets, the senior reactor analyst added a generic fire ignition frequency for a relay room to the control room fire ignition frequency listed in the Individual Plant Examination for External Events. The analyst multiplied an appropriate severity factor (SF) by the sum of the control room fire initiation frequency (CRFIF) and the instrument room fire initiation frequency (IRFIF) and multiplied this result by a nonsuppression probability (NPCRE) to account for the likelihood that operators failed to extinguish the fire within 20 minutes, assuming that it would take operators 2 minutes to detect the fire. The resulting fire would require a control room evacuation with a control room evacuation frequency determined as follows:

Control Room Evacuation Frequency = (CRFIF + IRFIF)

• SF

• NPCRE

= (9.5E-03/year + 1.42E-03/year)

• 0.2

• 1.30E-02

= 2.84E-05/year

As described in the Individual Plant Examination for External Events, the control room had 109 panels. Because multiple failure combinations could result in a start of the Division 1 diesel generator without service water supplied, the senior reactor analyst determined the combined partial fraction for all possible scenarios. The analyst determined partial fraction for each loss of electrical scenario by dividing the number of affected cabinets by the total number of cabinets:

Scenario NumberFraction (number/109)Cabinets with Diesel Generator 1 controls 4 FDG1 = 3.67E-02Cabinets with Division 1 power 1 FDiv1 = 9.17E-03Cabinets with power from both divisions 1 FBDIV = 9.17E-03Cabinets with service water 3 FSW = 2.75E-02 A fire could result in the inadvertent start of a diesel generator either directly, by affecting the diesel control circuits, or indirectly, by affecting the power to the associated vital bus. Therefore, the probability that a fire could result in the start of the Division 1 emergency diesel generator (PDGStart) was calculated as follows:

PDGStart = FDG1 + FDiv1 + FBDiv

= 3.67E-02 + 9.17E-03 + 9.17E-03

= 5.50E-02 To determine the probability that a main control room fire would fail the service water system at the same time as starting the Division 1 emergency diesel generator (PFailure), the analyst performed the following calculation:

PFailure = PDGStart

• FSW = 5.50E-02

• 2.75E-02

= 1.52E-03 The resulting Fire Mitigation Frequency is the Control Room Evacuation Frequency (2.84E-05/year) multiplied by the combined failure probabilities (1.52E-03) for a value of 4.30E-08/year.

The analyst determined the change in conditional core damage probability by subtracting the base case conditional core damage probability given abandonment of the control room (0.1) from the assumed conditional core damage probability given the performance deficiency (1.0) for a value of (0.9). The bounding change in conditional core damage frequency for a 1-year exposure is the Fire Mitigation Frequency (4.30E-08/year)multiplied by the change in conditional core damage probability (0.9) for a value of 3.87E-08/year. This value indicates the finding has very low safety significance (Green).

This finding had a crosscutting aspect in the Work Control component of the Human Performance area because the licensee did not appropriately coordinate work activities to support long-term equipment reliability by limiting temporary modifications, operator workarounds, safety systems unavailability, and reliance on manual actions H.3(b).

Enforcement.

License Condition 2.C.(10) "Fire Protection," requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4, "Fire Protection Program Requirements," states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility. The fire protection program requirements are described in section 9.5.1 and appendices 9A and 9B of the Final Safety Analysis Report. Section 9B.4.7, specifies, in part, "Fire protection features shall be capable of limiting fire damage so that one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) is free of fire damage."

Contrary to this requirement, in May 2007 the licensee determined that they failed to ensure that the one train of systems necessary to achieve and maintain hot shutdown conditions from either the control room or emergency control station(s) would be free of fire damage. Specifically, the Division 1 standby service water support system to the Division 1 emergency diesel generator, which was required to achieve safe shutdown, was not protected such that it remained free from fire damage under all conditions.

Because the licensee failed to correct this violation, this violation is being treated as a cited violation, consistent with the NRC Enforcement Policy,Section VI.A.1, which states, in part, that a cited violation requiring a formal written response from a licensee will be considered if the licensee failed to restore compliance within a reasonable time after a violation was identified. The NRC Enforcement Manual further explains that the purpose of this criterion is to emphasize the need to take appropriate action to restore compliance in a reasonable period of time once a licensee becomes aware of the violation, and take compensatory measures until compliance is restored when compliance cannot be reasonably restored within a reasonable period of time.

The licensee had compensatory measures in place; however compliance had not been restored. This violation is identified as VIO 05000458/2010006-01, Failure to Ensure at Least One Train of Equipment Necessary to Achieve Hot Shutdown Conditions is Free of Fire Damage.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the manual and automatic detection and suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations, and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps, and Halon supply systems) to assess the material condition of these systems and components. The team reviewed the electric and diesel fire pump flow and pressure tests to verify that the pumps met their design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation, and to facilitate suppression of a fire that could impact post fire safe shutdown capability. The team inspected fire brigade equipment to determine operational readiness for fire fighting.

The team observed an unannounced fire drill on April 13, 2010, and the subsequent drill critique using the guidance contained in Inspection Procedure 71111.05AQ, "Fire Protection Annual/Quarterly." The team observed fire brigade members fight a simulated fire in Fire Area C-14, "Standby Switchgear 1B Room," located in the Control Building. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate fire fighting techniques;

(4) sufficient firefighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

No findings.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified that:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains.

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train).

• Adequate drainage is provided in areas protected by water suppression systems.

The team reviewed the separation of safe shutdown cables, equipment, and components within the same fire areas, and reviewed the methodology for meeting the requirements of 10 CFR 50.48, Appendix A to Branch Technical Position 9.5-1 and 10 CFR Part 50, Appendix R, Section III.G. Specifically, this was to determine whether at least one post fire safe shutdown success path was free of fire damage in the event of a fire in the selected areas.

b. Findings

No findings.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe shutdown analysis, fire hazards analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained for fires in areas where the licensee's post fire safe shutdown strategy relied on manipulating shutdown equipment from outside the control room. The team verified that hot and cold shutdown could be achieved and maintained with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for safe shutdown would remain free from fire damage, with the exceptions discussed in this report. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits), with the exceptions discussed below.

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that a sufficient number of personnel, exclusive of those assigned as fire brigade members, were trained and available onsite at all times to perform an alternative shutdown.

The team reviewed the adequacy of the procedures utilized for alternative shutdown and performed an independent walkthrough of the procedure to ensure their implementation and human factors adequacy. The team also verified that the operators could be reasonably expected to perform specific time critical actions within the time required to maintain plant parameters within specified limits, with the exceptions discussed below. Some of the time critical actions verified included the restoration of alternating current electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team reviewed periodic surveillance testing of the alternative shutdown transfer capability, including transfer and isolation of instrumentation and control functions, to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability. The team also reviewed a sample of wiring diagrams, vendor manuals, connection drawings, and circuit diagrams for the remote transfer circuits, control circuits, and the remote shutdown panel to verify the field configurations matched the design documents.

b. Findings

b.1

Introduction.

The team identified a Green noncited violation of Technical Specification 5.4.1.d, "Fire Protection Program Implementation," for failing to ensure that the alternative shutdown procedure, AOP-0031 "Shutdown from Outside the Main Control Room," Revision 307, could be implemented as written, with three examples.

Description.

Procedure AOP-0031 "Shutdown from Outside the Main Control Room," Revision 307, was used in the event of a fire in the control room which required control room evacuation. This procedure contained the necessary steps to safely shut down the reactor with or without offsite power available. During a walkdown of the procedure, the team identified three examples where this procedure could not be performed as written.

Example 1: Step 5.10.5 required the operators to verify at least one of three breakers (ACB04, ACB06, or ACB07) was closed to supply power to the Division I vital switchgear. The team determined that operators would not able to perform the step as written during a control room fire scenario with a loss of offsite power since these three breakers would be open and locked out. Breakers ACB04 and ACB06 would open by design upon the loss of offsite power. The Division I diesel generator output breaker, ACB07, would be open because the operators performed an emergency stop of the diesel generator in the control room as a manual action to prevent damage to the diesel generator. Further, a caution note before step 5.10.5 informed the operator not to close these breakers without specific instruction from the Control Room Supervisor. The team also noted that Procedure AOP-0031 did not require the diesel generator to be started again until step 5.14.2.

Example 2: Step 5.13 required the Reactor Building Operator to start 1LSV*C3A, "Penetration Valve Leakage Control Air Compressor." This compressor provides air pressure to maintain the safety relief valves open during sustained operation of the residual heat removal system in the alternate shutdown cooling mode, if required. During a loss of offsite power, this compressor would not have ac power available until after the Division 1 emergency diesel generator was started. As noted above, Procedure AOP-0031 did not require the diesel generator to be started until step 5.14.2. Step 5.14.1 directed the Control Room Supervisor to verify that steps 5.10.5 and 5.13 were completed. This step occurred before establishing electrical power in step 5.14.2. During interviews with the operators, the team concluded that the Control Room Supervisor would direct an operator to start the diesel generator upon realization that ac power was required to perform steps 5.10.5 and 5.13.

Example 3: Steps 5.14.5.3 and 5.15.3 required the operators to perform a diagnostic evaluation for fire damage to cables and motor-operated valves in the form of "IF fire-induced cable [valve] damage has occurred to the following-, THEN perform the following-" The procedure did not provide guidance or identify protected instrumentation for assessing whether this fire damage occurred. The post fire safe shutdown analysis credited the actions specified in steps 5.14.5.3 and 5.15.3 for the plant to reach and maintain hot shutdown. The team was concerned that it might not be practical to identify specific cable damage within the time constraints.

Analysis.

The failure to ensure that Procedure AOP-0031, Revision 307, could be implemented as written is a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems with plant-wide consequences. Using Appendix F, Attachment 2, "Degradation Rating Guidance Specific to Various Fire Protection Program Elements," the team determined that the finding constituted a low degradation of the safe shutdown area since the procedural deficiencies could be compensated by operator experience and familiarity. This finding screened as having very low safety significance (Green).

This finding had a crosscutting aspect in the Resources component of the Human Performance area because the licensee did not ensure that procedures used to assure nuclear safety could be implemented [H.2.(c)].

Enforcement.

Technical Specification 5.4.1.d states, in part, that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to this requirement, prior to June 2, 2010, the licensee failed to implement and maintain a required fire protection program procedure. Specifically, the licensee failed to ensure that Procedure AOP-0031, "Shutdown from Outside the Main Control Room," Revision 307, could be implemented as written.

Because this violation was of very low safety significance and it was entered into the licensee's corrective action program as CR-RBS-2010-01592, CR-RBS-2010-01831, CR-RBS-2010-01775, CR-RBS-2010-01821, and CR-RBS-2010-1846, this violation is being treated as an NCV, consistent with the Enforcement Policy and is identified as NCV 05000458/2010006-02, Failure to Ensure Alternative Shutdown Procedure could be Implemented as Written. b.2

Introduction.

The team identified a Green noncited violation of License Condition 2.C.(10), "Fire Protection," for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, during a timed walkdown of the procedure the team identified that it took operators over 6 minutes to isolate feedwater, but the simulator showed that the steam lines could be flooded in 2 minutes. Overfilling the reactor pressure vessel and flooding the main steam lines could make reactor core isolation cooling unavailable. Reactor core isolation cooling was credited for decay heat removal and inventory control in the event of a fire.

Description.

Design Criterion 240.201A, "Post-Fire Safe Shutdown Analysis," Revision 4, contained a listing of the equipment and their function relied upon for post fire safe shutdown in the approved fire protection program. This analysis credited the use of the reactor core isolation cooling system and safety relief valves during a control room fire scenario which forces evacuation. Procedure AOP-0031, "Shutdown from Outside the Main Control Room," Revision 307, was used to shut down the reactor in the event of a fire that required evacuation of the control room. This procedure contained the steps to safely shut down the reactor with or without offsite power available. Step 5.10.1 of 13 to AOP-0031 provided instructions for opening the circuit breakers for the motor-driven feedwater pumps and removing the control power fuses within 5 minutes of evacuating the main control room. Without prompt isolation of the feedwater system, feedwater could continue to inject and overfill the reactor vessel up to the steam lines. Flooding the reactor vessel up to the level of the steam lines could disable the reactor core isolation cooling system and damage the steam lines. The reactor core isolation cooling system was relied upon in this scenario to restore and maintain reactor vessel level and control pressure. Overfilling the reactor vessel could also damage the safety relief valves since they were not analyzed to pass high pressure water. The safety relief valves are located on the main steam lines upstream of the inboard main steam isolation valves and are required to open to vent steam to the suppression pool and prevent reactor vessel overpressure. Calculation G13.18.12.2-27, "10 CFR 50 Appendix R Manual Action Time Frame," Revision 1, provided best estimate times for the performance of manual actions to prevent placing the reactor in an unrecoverable condition. This calculation identified that operators must isolate feedwater with a "high priority" upon leaving the control room. The post fire safe shutdown analysis concluded that a time limit of 5 minutes met the intent of "high priority" as stated in the calculation.

During a timed walkdown of Procedure AOP-0031, Revision 307, the team noted that it took 6 minutes 45 seconds for the operators to isolate feedwater injection outside of the main control room. During subsequent discussions, licensee staff was unable to provide a technical basis to support why the 5-minute time limit to isolate feedwater was acceptable. To improve understanding of the issue and to obtain an estimate of the time available to isolate feedwater, the team observed a simulator scenario with the high reactor level (Level 8) feedwater trip disabled due to fire damage, and the feedwater pumps continuing to inject. The level 8 trip is an automatic initiation, which during a fire scenario was not verified to be free of fire damage and functional. In this scenario, the inspectors observed that it took approximately 2 minutes for the reactor water level to reach the level of the main steam lines. From this scenario, the inspectors determined that the 5-minute time limit appeared nonconservative, in that the licensee could not demonstrate that it would be sufficient to ensure the availability of all equipment relied upon for post fire safe shutdown, specifically the reactor core isolation cooling system would not be available if operators were not able to prevent filling the steam lines with water.

Analysis.

The failure to ensure that feedwater would be isolated prior to overfilling the reactor pressure vessel and flooding the main steam lines making reactor core isolation cooling unavailable was a performance deficiency.

The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown systems with plant-wide consequences. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a control room fire that led to control room evacuation.

Since the River Bend Station control room included the plant instrumentation and relay cabinets, the senior reactor analyst added a generic fire ignition frequency for the relay room (FIF IR) to the control room fire ignition frequency (FIF CR) listed in the Individual Plant Examination for External Events. The analyst multiplied the combined fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes assuming a 2 minute detection that required a control room evacuation (NP CRE). The resulting control room evacuation frequency (FCR-EVAC) was: FCR-EVAC = (FIF CR+FIF IR)

• SF

• NP CRE = (9.50E-3/yr + 1.42E-3/yr)

• 0.2

• 1.30E-2

= 2.84E-5/yr The control room had a total of 109 cabinets. The analyst determined that a single fire in only one of these cabinets could lead to the spurious operation and loss of control function for the feedwater system which could result in overfilling the reactor vessel to the main steam lines or above. The analyst calculated a bounding change in core damage frequency for the finding (CDFFIRE-MFW) by multiplying the combined fire ignition frequency by the fraction of panels containing the affected circuits.

CDFFIRE-MFW = FCR-EVAC

• 1 / 109

= 2.84E-5/yr

• 0.0092

= 2.61E-7/yr This frequency was considered to be bounding since it assumed:

1) Fire damage in the applicable cabinet would create circuit faults such that the feedwater pumps continued to operate and the level 8 trip would be disabled, resulting in overfilling the reactor vessel above the main steam lines and, 2) The conditional core damage probability given a control room fire with evacuation and the spurious operation of the feedwater system was equal to one, and 3) The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Manual Chapter 0609, Appendix H, "Containment Integrity Significance Determination Process," the senior risk analyst screened the finding for its potential risk contribution to large early release frequency (LERF) since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because the finding influenced the likelihood of accidents leading to core damage. As documented in Appendix H, Table 5.1, accident sequences that lead to large early release frequency for boiling water reactors with Mark III containment include high pressure transient events.

The analyst determined that most of the sequences involving control room evacuation with spurious operation of the feedwater system resulted in the reactor coolant system being at high pressure at the time of vessel breach. Using Table 5.2, "Phase 2 Assessment Factors - Type A Findings at Full Power," the analyst selected a large early release frequency factor of 0.2 for these sequences. The sum of the large early release frequency score as stated in Step 3.2, "LERF Significance Evaluation," was then quantified. The change in large early release frequency was estimated to be 5.22E-08. This value agrees with the result of the change in core damage frequency evaluation that the finding was of very low safety significance (Green). The finding did not have a crosscutting aspect since it was not indicative of current performance, in that the licensee had established the incorrect response time more than three years prior to this finding.

Enforcement.

License Condition 2.C.(10), "Fire Protection," requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4, "Fire Protection Program Requirements," states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility. The fire protection program requirements are described in section 9.5.1 and appendices 9A and 9B. Appendix 9A references Design Criterion 240.201A.

Design Criterion 240.201A, "Post-Fire Safe Shutdown Analysis," Revision 4, contained a listing of the equipment and their function relied upon for post fire safe shutdown in the approved fire protection program. This analysis credited the use of the reactor core isolation cooling system during a control room fire scenario.

Contrary to this requirement, prior to June 2, 2010, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to ensure that the reactor core isolation cooling system would be available for post fire safe shutdown during a control room fire scenario. Because this violation was of very low safety significance and it was entered into the licensee's corrective action program as CR-RBS-2010-01808, this violation is being treated as an NCV, consistent with the Enforcement Policy and is identified as NCV 05000458/2010006-03 , Failure to Implement and Maintain in Effect all Provisions of the Approved Fire Protection Program.

b.3

Introduction.

The team identified a Green noncited violation of License Condition 2.C.(10), "Fire Protection," related to the licensee's failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to adequately test the remote shutdown emergency transfer switch functions used to assure isolation of safe shutdown equipment from the control room in the event of a control room evacuation due to fire.

Description.

License Condition 2.C.(10), "Fire Protection," requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4, "Fire Protection Program Requirements," states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility. The fire protection program requirements are described in section 9.5.1 and appendices 9A and 9B. Section 9A.3.4.5, "Test and Test Control," requires in part, that a test program be established and implemented to assure that testing is performed and verified by inspection to demonstrate conformance with the design and system readiness requirements. For a fire in the control room requiring control room evacuation, the functions of the emergency transfer switches are: 1) transfer control of selected equipment to the remote shutdown panel and other local control stations, and 2) isolate the applicable fire area circuits to prevent fire damage from disabling or causing maloperation of equipment. The remote shutdown panel emergency transfer switches are required to be operated during control room evacuation events per procedure AOP-0031, "Shutdown from Outside the Main Control Room," Revision 307.

Alignment for remote operation is accomplished via a series of transfer switches and multiplying relays. The River Bend Station design uses General Electric type SB-9 and Electro Switch type 20KB switches, in conjunction with General Electric model CR120BC and Gould model J11A relays. During review, the team identified that the testing methodology in the surveillance procedures did not appear adequate to ensure isolation of power, control and instrumentation circuits from the control room, in that the licensee's surveillance procedures did not ensure that all contacts on the transfer switches used for isolation of the associated fire area performed their intended function as required. If a contact used for control room isolation failed to reposition when the emergency transfer switch was taken to the Emergency position, the surveillance procedures, as written, would not identify the failed contact. The licensee's surveillance test procedures verified that the control function was transferred from the main control room to the remote shutdown panel by operating the equipment from the remote panel. For the isolation function however, the procedures only checked that control room indicating lights extinguished on the main control panels as the method of verifying control room circuit paths were isolated. Using electrical schematic and wiring diagrams, the team was able to identify examples where control room indicating lights might be extinguished without ensuring that the control room portion of the circuit was isolated from the emergency control circuit. The surveillance procedures did not verify that all other parallel control circuit paths in the associated fire area were isolated. In the event that one or more contacts used for control room isolation failed to reposition, a fire induced circuit failure could cause the control power fuses to open or cause maloperation, and result in a loss of equipment or system required to function to achieve and maintain safe shutdown conditions in the event of a control room fire. A review of licensee documents indicated that the isolation function of the emergency transfer switches had not been adequately tested since 1997.

The licensee performed internal reviews of maintenance and corrective action documents searching for failures of the emergency transfer switches and multiplying relays. The licensee also performed reviews of past operability and surveillance tests for equipment operated by the transfer switch circuitry, and reviewed industry operating experience for documented failures of the switch and relay types used at River Bend Station. The industry operating experience review revealed one documented failure of the SB-9 type switch, but was determined to be due to a switch configuration not applicable to River Bend Station. The licensee documented their basis for having reasonable assurance of operability of the emergency transfer switches and relays, which justified continued operation until their next refueling outage scheduled for January 2011, at which time validation testing and analysis of the transfer and isolation circuitry will be performed.

The team reviewed a licensee document detailing remote shutdown panel transfer switch reliability, "Corrective Action 1 to LO-LAR-2010-00120," and held internal discussions with a regional senior reactor analyst to review the licensee's continued operability conclusions and agreed that reasonable assurance of operability existed.

Analysis.

The failure to ensure isolation from the control room during surveillance testing of emergency transfer switches for safe shutdown equipment controlled from the remote shutdown panel is a performance deficiency. The performance deficiency was reviewed against Inspection Manual Chapter 0612, Appendix B "Issue Screening" to determine whether the performance deficiency was of minor or more-than-minor significance. The performance deficiency was determined to be sufficiently similar to Example 4.L of Inspection Manual Chapter 0612, Appendix E, "Examples of Minor Issues" to reasonably conclude that it satisfied at least one of the minor screening questions. The finding was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone in that it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F, "Fire Protection Significance Determination Process," because it affected fire protection defense-in-depth strategies involving post fire safe shutdown. Using Appendix F, 2, "Degradation Rating Guidance Specific to Various Fire Protection Program Elements," the team determined that the finding constituted a low degradation of the safe shutdown area since the control room isolation feature is expected to display nearly the same level of effectiveness and reliability as it would had the degradation not been present. This finding screened as having very low safety significance (Green).

Because the emergency transfer switch surveillance procedures had been in effect since 1997, there was no crosscutting aspect associated with the violation, in that it is not indicative of current licensee performance.

Enforcement.

License Condition 2.C.(10), "Fire Protection," requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4, "Fire Protection Program Requirements," states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility. The fire protection program requirements are described in section 9.5.1 and appendices 9A and 9B. Section 9A.3.4.5, "Test and Test Control," requires in part, that a test program be established and implemented to assure that testing is performed and verified by inspection to demonstrate conformance with the design and system readiness requirements. Contrary to these requirements, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility, in that the transfer switch testing program did not verify that each required emergency transfer switch was capable of performing the required isolation function in accordance with their approved fire protection program.

Because this violation was of very low safety significance and it was entered into the licensee's corrective action program as CR-RBS-2010-01783, this violation is being treated as an NCV, consistent with the Enforcement Policy and is identified as NCV 05000458/2010006-04 , Failure to Implement and Maintain in Effect all Provisions of the Approved Fire Protection Program.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post fire safe shutdown analysis to verify that the licensee identified circuits that could impact the ability to achieve and maintain safe shutdown. The team verified, on a sample basis, that the licensee properly identified cables and equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that cables associated with safe shutdown-related equipment were protected from the adverse effects of fire damage or were analyzed to show that fire induced cable faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The team evaluated cables for selected components from the reactor core isolation cooling and residual heat removal systems. For the sample of components selected, the team reviewed process and instrumentation diagrams, electrical schematics, and wiring diagrams to identify power, control, and instrumentation cables necessary to support safe shutdown equipment operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place to satisfy the separation requirements specified in the fire protection license basis.

Since the licensee utilized thermoset cables for most applications, the team reviewed the following cable failure modes for selected required and associated circuits:

$ Spurious actuations resulting from any combination of conductors within a single multiconductor cable;

$ A maximum of two cables considered where multiple individual cables may be damaged by the same fire;

$ The vulnerability of three phase power cables resulting from three phase proper polarity hot shorts for decay heat removal system isolation valves at high-pressure to low-pressure interfaces.

In addition, on a sample basis, the adequacy of circuit protective coordination for safe shutdown power sources was evaluated. Also, on a sample basis, the adequacy of electrical protection provided for non-essential cables that share a common enclosure with cables for required safe shutdown equipment was reviewed to ensure that the non-essential cables are adequately protected to preclude common enclosure concerns.

Specific components reviewed by the team are listed in the attachment.

b. Findings

No findings.

.07 Communications

a. Inspection Scope

The team reviewed the adequacy of the communication systems to support plant personnel in the performance of alternative post fire safe shutdown functions and fire brigade duties. The review verified that the licensee established and maintained in working order the credited primary and backup communication systems. The review also verified that problems with communication equipment necessary for alternative safe shutdown support were properly categorized in the corrective action program and received the appropriate priority. The team evaluated the environmental impacts such as ambient noise levels, coverage patterns, and clarity of reception. The team verified that the design and location of communications equipment such as repeaters, private branch exchanges, and transmitters would not cause a loss of communications during a fire. The team verified the contents of designated storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities.

b. Findings

No findings.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain safe shutdown conditions, and to illuminate access and egress routes to the areas where manual actions would be required. The locations and positioning of emergency lights were observed during a walkthrough of Procedure AOP-0031, "Shutdown from Outside the Main Control Room," Revision 307, and during review of manual actions implemented for the fire areas other than the control room.

The team verified the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in both fixed and portable configurations in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

No findings.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. The only repair credited by the licensee was the use of electrical jumpers for temporary Division I 480 Vac power to Residual Heat Removal (RHR) shutdown cooling inboard isolation valve E12-MOV-F009, in the event of a main control room fire and the loss of Division II 480 Vac electrical power.

Using Attachment 6, "Jumper Procedure for E12-F009" to Procedure AOP-0031, Revision 307, the team evaluated whether these repairs could be accomplished as written to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site. For equipment that was not pre-staged, the team verified that the equipment could be procured and installed within the time frames specified in their design and licensing

basis.

b. Findings

No findings.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded or inoperable fire protection and post fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; and pumps, valves, or electrical devices providing safe shutdown functions or capabilities). The team verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken, and that the licensee was effective in returning the equipment to service in a reasonable period of time, with the exception described in section 0.1 of this report.

The team reviewed licensee manual actions used to mitigate the effects of fire in order to assess their feasibility and reliability. The team reviewed the manual actions against the items listed in NUREG-1852, "Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire," dated October 2007. The manual actions were found to be in accordance with the guidance.

b. Findings

No findings.

.11 B.5.b Inspection Activities

a. Inspection Scope

The team reviewed the licensee's implementation of guidance and strategies intended to maintain or restore core cooling, containment, and spent fuel pool cooling capabilities under the circumstances associated with loss of large areas of the plant due to explosions or fire as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026, dated February 25, 2002 and 10 CFR 50.54(hh)(2).

The team reviewed licensee's strategies to verify that they continued to maintain and implement procedures, maintain and test equipment necessary to properly implement the strategies, and ensure station personnel are knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the off-site ability to obtain fuel for the portable pump, and foam used for firefighting efforts. The strategies and procedures selected for this inspection sample included:

• Spent Fuel Pool Makeup/Spray Strategies, OSP-0066, "Extensive Damage Mitigation Procedure," Revision 003, Attachment 13, "Spent Fuel Pool Emergency Makeup/Spray Strategies."

• Manual Operation of RCIC Turbine, OSP-0066, "Extensive Damage Mitigation Procedure," Revision 003, Attachment 8, "RCIC Operation with a Loss of AC and DC Power."

b. Findings

No findings.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

No findings.

4OA6 Meetings, Including Exit

Exit Meeting Summary

On April 23, 2010, a preliminary exit meeting was held in which the team presented the preliminary inspection results to Mr. Eric Olson and other members of the licensee staff.

On June 2, 2010, an additional exit meeting was held telephonically, and the inspection results were presented to Mr. Jerry Roberts and other members of the licensee staff.

The licensee acknowledged the findings presented. The team asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.

4OA7 Licensee-Identified Violations

None ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

C. Forpahl Manager, Programs and Components

D. LaBorde Ops Procedures D. Lorfing Manager, Licensing

E. Olson General Manager, Plant Operations G. Krause Assistant Ops Manager H. Goodman Engineering Director

J. Roberts Director, Nuclear Safety Assurance

K. Huffstatler Senior Licensing Specialist L. Woods Manager, Quality Assurance

M. Chase Manager, Training R. Kerar Senior Engineer - Fire Protection

NRC Personnel

G. Larkin, Senior Resident Inspector

C. Norton, Resident Inspector

M. Runyun, Senior Reactor Analyst

K. Bucholtz, Technical Specifications Branch, Office of Nuclear Reactor Regulation

R. Elliott, Technical Specifications Branch, Office of Nuclear Reactor Regulation

C. Schulten, Technical Specifications Branch, Office of Nuclear Reactor Regulation

R. Telson, Reactor Inspection Branch, Office of Nuclear Reactor Regulation

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000458/2010006-01

VIO Failure to Ensure at Least One Train of Equipment Necessary to Achieve Hot Shutdown Conditions is

Free of Fire Damage (Section 1R05.01)

Opened and Closed

05000458/2010006-02

NCV Failure to Ensure Alternative Shutdown Procedure could be Implemented as Written (Section 1R05.05.b.1)

05000458/2010006-03

NCV Failure to Implement and Maintain in Effect all Provisions of the Approved Fire Protection Program (Section 1R05.05.b.2)

05000458/2010006-04 NCV Failure to Implement and Maintain in Effect all Provisions of the Approved Fire Protection Program (Section 1R05.05.b.3)

Discussed

None

Updated None

LIST OF DOCUMENTS REVIEWED

CALCULATIONS

Number Title Revision 12210-E-137 Electrical 480 Volts Continuous Load Cable Ampacity Calculation

12210-E-169 Electrical Cable Sizing 0 E-200, Att.

3 4160 VAC Protective Device Coordination 1 G13.18.12.2-027 10

CFR 50 Appendix R Manual Action Time Frame 1

G13.18.12.2-106 Evaluation of Ability to Secure Reactor Feedwater During a Main Control Room Fire

G13.18.12.4 RCIC Room Heatup Analysis 26 G13.18.12.4 RCIC Room Heatup with the Room Door Held Open 29 G13.18.13.2*84 Condenser Pressure During Loss of Circulating Water 0

G13.18.14.0*016 Number of SRV Cycles Expected for Isolation Event 1

G13.18.14.0*029 Reactor Level Response to a Fire in the Control Room 1

G13.18.2.6*034 Number of SRV Actuations from LSV Air Receiver Tanks 2

G13.18.3.6.07 Coordination Study of Appendix R and Class 1E Low Voltage Protection Devices

G13.18.3.6.07 Safe Shutdown Common Enclosure Associated Circuit Analysis 1 G13.18.3.6.12 10

CFR 50 Appendix R Analysis of Fire Area

PT-1 0

DRAWINGS

Number Title Revision 0214.200-034-047 Schematic Diagram of Series DCF & DCM Controller For Cummings Engine, Sht 1 of 2

0214.200-034-047 Schematic Diagram Of Series DCF & DCM Controller For Cummings Engine, Sht 2 of 2

0242.562-082-319 Schematic and Wiring Diagram for FVR Starter G 0242.562-082-341 Composite Diagram for 1EHS-MCC2L F

244.514-552-009 Schematic 40KVA Manual Transfer Switch 120VAC 1 phase 60HZ

A

Number Title Revision 12210-EB-45N-9 Ventilation & Cooling, Sections

SH-13, Auxiliary Building 9

210-EB-48A-7

Fire Protection & Plumbing Auxiliary Building

EL 70'-0"

SH-1 7 12210-EB-82A-7 Fire Protection & Plumbing Control Building 7 12210-EE-18G-4 Wiring Diagram Fire and Smoke Detection Control Building EL.

115'-0" &116'-0"

12210-EE-34B Cable Tray Arrangement

SH-6 6 12210-EE-34CJ Cable Tray Identification

SH-4 4

210-EE-34CL Cable Tray Identification

SH-1 5

210-EE-34DD-3 Cable Tray Identification, Turbine Bldg 3

210-EE-34DD-4 Cable Tray Identification, Turbine Bldg 4

210-EE-34EB-5 Cable Tray Identification Reactor Building 5 12210-EE-34FC Cable Tray Identification

SH-1 5 12210-EE-34FF-4 Cable Tray Identification Reactor Building 4

210-EE-34JG-4 Cable Tray Identification, Elect Tunnels & Norm SWGR BLDG 4 12210-EE-34JK Cable Tray Identification

SH-3 3 12210-EE-36BT-5 Wiring Diagram Elect.

Pen.

Terminal Cab., 1RCP*TCR 14A and 1RCP*TCA14

12210-EE-420M Seismic Conduit Inst.

Plan El.

115'-0" - 116'-0" 11 12210-EE-490J Seismic Conduit Inst.

Plan El.

95'-9" 3

210-EE-490Q Seismic Conduit Inst.

Plan El.

95'-9" 6 12210-EE-80W-8 Communications Plan Standby Switchgear Area Control Building 8 12210-EE-9BZ-5 Wiring Diagram Engine Driven Fire Pumps, Fire Pump House 5 12210-ESK 6FPW02 Elementary Diagram, 480 V Control CKT Fire Protection System Auxiliaries, RBS - Unit 1

12210-ESK 7FPW02 Elementary Diagram, 120 V Control CKT Engine Driven Fire Pump Control , RBS - Unit 1

12210-ESK-3X Control Switch Contact Diagram 2

Number Title Revision 12210-ESK-7FPW03 Elementary Diagram, 120 V Control CKT Engine Driven Fire Pump Control, RBS - Unit 1

828E239AA, Sht.

1 Elementary Diagram, Remote Shutdown System 20 84-51380-23 Sht.

3 Composite Diagram For 1EHS-MCC-2K A

84-51380-23 Sht.

6 Composite Diagram For 1EHS-MCC-2K A

84-51380-23-C97 Schematic and Wiring Diagram for FVR Starter O

851E225AA, Sh.

13 G.E.

Elementary Diagram, Automatic Depressurization System

944E115

SH-32 Connection Diagram Remote Shutdown VB

2 944E115

SH-34 Connection Diagram Remote Shutdown VB

2

944E115

SH-36 Connection Diagram Remote Shutdown VB

2

944E115

SH-37 Connection Diagram Remote Shutdown VB

8 944E115

SH-38 Connection Diagram Remote Shutdown VB

2 944E115

SH-39 Connection Diagram Remote Shutdown VB

2

944E115

SH-45 Connection Diagram Remote Shutdown VB

13

944E115

SH-46 Connection Diagram Remote Shutdown VB

10

CDB-VBN01A1, SH. 1 Power Distribution Panel Board Schedule Control Room 11

CE-001A, Sheet 1 Appendix R Safe Shutdown Analysis Emergency Lighting, Control Building El.

98'-0"

CE-001B Appendix R Safe Shutdown Analysis Emergency Lighting, Control Building El.

116'-0"

CE-001C Appendix R Safe Shutdown Analysis Emergency Lighting, Control Building El.

136'-0"

CE-001F Appendix R Safe Shutdown Analysis Emergency Lighting, Diesel Generator Building El.

98'-0"

CE-001H, Sheet 1 Appendix R Safe Shutdown Analysis Emergency Lighting, Auxiliary Building El.

95'-0"

CE-001J Appendix R Safe Shutdown Analysis Emergency Lighting, Auxiliary Building El.

114'-0"

CE-001K, Sheet 1 Appendix R Safe Shutdown Analysis Emergency Lighting, Auxiliary Building El.

141'-0"

CE-001Q Appendix R Safe Shutdown Analysis Emergency Lighting, Standby Cooling Tower El.

118'-0"

Number Title Revision

CE-001U Appendix R Safe Shutdown Analysis Emergency Lighting, Turbine Building El.

67'-6"

CE-001V Appendix R Safe Shutdown Analysis Emergency Lighting, T-Tunnel El.

123'-6"

CE-001W Appendix R Safe Shutdown Analysis Emergency Lighting, Switchgear Building El.

98'-0"

DD-5617-I Fire Damper Schedule U

DD-5617-J Fire Damper, Vertical Mound and Horizontal Mount (CAT I) V

EB-003AB Fire Area Boundaries Plant Plan View - Elevations 65'-0" to 90'-0"

EB-003AC Fire Area Boundaries Plant Plan View - Elevations 83'-0" to 106'-0"

EB-003AD Fire Area Boundaries Plant Plan View - Elevations 109'-0" to 148'-0"

EB-003AE Fire Area Boundaries Plant Plan View - Elevations 113'-0" to 186'-3"

EB-003BB Fire Protection Features Plant Plan View - Elevations 65'-0" to 90'-0"

EB-003BC Fire Protection Features Plant Plan View - Elevations 83'-0" to 106'-0"

EB-003BD Fire Protection Features Plant Plan View - Elevations 109'-9" to 148'-0"

EB-003BE Fire Protection Features Plant Plan View - Elevations 113'-0" to 186'-3"

EB-003M Fire Protection Arrangement

SH-12 6

EB-003N Fire Protection Arrangement

SH-13 9

EB-003P Fire Protection Arrangement

SH-14 7

EB-045D Ventilation and Cooling, Plan El 95'-9" SH 4, Auxiliary Building 10

EB-082B Fire Protection & Plumbing Control Building 7

EB-048B Fire Protection & Plumbing Aux.

Bldg El 95'-9" & 114'-0"

SH-2 7

EE-001AA 480 V One Line Diagram, Standby Bus 1EJS*LDC 1A &

2A 16

Number Title Revision

EE-001AB 480 V One Line Diagram, Standby Bus 1EJS*LDC 1B &

2B 17

EE-001AC Start Up Electrical Distribution Chart 43

EE-001TA 480 V One Line Diagram,

EHS-MCC2A & 2L, Auxiliary Building 19

EE-001TE 480 V One Line Diagram,

EHS-MCC2JA & 2K, Auxiliary Building 20

EE-001ZD 125 VDC One Line Diagram

ENB-MCC1 Auxiliary BLDG 6

EE-003KW Wiring Diagram, 1C61*PNLP001 Bay D, Control Building 7

EE-003LX Wiring Diagram, 1C61*PNLP001 Bay C, Control Building 7

EE-003LY Wiring Diagram, 1C61*PNLP001 Bay A and B, Control Building 14

EE-007AT External Connection Diag.

PGCC Termination Cabinet 1H13*P745 Bay B

EE-007D External Connection Diag.

PGCC Termination Cabinet 1H13*P730 Bay E

EE-007DE External Connection Diagram PGCC Terminal Cabinet H13*P710 Bay B

EE-007DQ External Connection Diagram PGCC Terminal Cabinet H13*P713 Bay B

EE-007EB External Connection Diagram PGCC Terminal Cabinet H13-P715 Bay B

EE-008BJ 4160V Wiring Diagram, Bus

NNS-SWG2A 9

EE-009NB 480 V Wiring Diagram, 1EHS-MCC2B, Auxiliary Building 7

EE-009PA 480 V Wiring Diagram, 1EHS-MCC2J, Auxiliary Building 5

EE-009PE 480 V Wiring Diagram, 1EHS*MCC2KL, Auxiliary Building 7

EE-009PG 480 V Wiring Diagram 1EHS*MCC2K Auxiliary Building 9

EE-009PU 480 V Wiring Diagram 1EHS*MCC14A Standby Switchgear ROOM 1A

EE-009PUC Wiring Diagram Uninterrupted Power Supply

ENB 302

EE-009SY 480 V Wiring Diagram, 1EHS*MCC2L, Auxiliary Building 11

EE-009SZ 480V Misc Wiring Diagram, 1EHS*MCC2L Auxiliary Building 17

Number Title Revision

EE-009W 480 V Wiring Diagram, MISC Wiring Details Fire Pump House 14

EE-018AE Wiring Diagram Fire and Smoke Detection Sys.

Auxiliary Building

EE-018F Wiring Diagram Fire and Smoke Detection Control Building EL. 98'-0"

EE-018H Wiring Diagram Fire and Smoke Detection Control Building EL. 136'-1 5/8"

EE-018Z Wiring Diagram Fire and Smoke Detection Control Building EL. 136'-1 5/8"

EE-027A Arrangement Main Control Room 15

EE-80 Communication Plan Normal Switchgear Area & General Notes 9

EE-80B-3 Communication Plan Normal Switchgear Building, Elev 123'-6" 3

EE-10C-5 125 VDC Wiring Diagram STBY 1ENB*MCC1 5

EE-27C-7 Arrangement Control BLDG Standby Switchgear Area 7

EE-32A Arrangement Duct line Plan & Details 10

EE-34FD Cable Tray Identification Auxiliary Building

EE-34KC Cable Tray identification, Aux Boiler & Water Treatment Building 3

EE-36BD-5 Wiring Diagram Elect Pen. Termin CAB.

1RCP*TCR12A * 1RCP*TCA12

EE-36BW Wiring Diagram Elect.

Pen. Terminal

Cabinet, 1RCP*TCR 15A and 1RCP*TCA15

EE-37 T-9 Arrangement, Sleeves, Inserts & Openings, Aux.

Building

EL 114'-0" & 141'-0"

EE-460AF Seismic Conduit Installation, Drywell Plan

EL 141'-0" Reactor Building

EE-460F Seismic Conduit Installation, Drywell Plan

EL 95'-9" Reactor Building

EE-490X Seismic Conduit Installation, Drywell Plan

EL 114'-0" Auxiliary Building

EE-55C Conduit Plan & Details, Fire Protection Pump House 7

Number Title Revision

EE-80AJ-5 Communication Plan Normal Switchgear Building & Elect Tunnel Elev.

67'-6"

EE-80AK Communications Plan Tunnels Sh. 1 3

EE-80AL Communications Plan Tunnels Sh. 2 4

EE-80D Communications Plan Aux.

BLDG Elev 70'-0" & 95'-9" 5

EE-80U Communications Plan Main Control Room

6

EE-80V Communications Plan HVAC & Battery Rooms Control Building 5

EE-8AZ 4160V Wiring Diagram, Standby Bus 1ENS-SWG1B 10

EE-9BJ 480 V Wiring Diagram, 1EJS-LDC2B, Auxiliary Building 8

EE-9MX 480 V Wiring Diagram, 1EHS-MCC2C, Auxiliary Building 9

EE-9RV 480V Misc Wiring Diagram, 1EHS*MCC16A &16B Standby Cooling Tower Area

ESK-05SWP04 Elementary Diagram 4.16 kV SWGR Standby Service Water Pump P2A,

SH-1

ESK-06CCP09 Elementary Diagram, 480 V CONT CKT Reac.

Plant CMPNT.

CLG WTR ISOL VALVE

ESK-06DTM25 Elementary Diagram, 480 V CONT CKT MNST LINE DR ISOL MOV'S

ESK-06EJS02 Elementary Diagram, 480V DC Switchgear Standby Bus 1B & 2B Supply ACB

ESK-06FPW01 Elementary Diagram, 480 V Control CKT Motor Driven Fire Pump Control

ESK-06RHS06, Sh.

1 Elementary Diagram, 480 V Control CKT Residual Heat Removal System

ESK-06RHS22 Elementary Diagram, 480V Control CKT, Residual Heat Removal System

ESK-06RHS22, Sh.

1 Elementary Diagram, 480 V Control CKT Residual Heat Removal System

ESK-07HVC25 Elementary Diagram, 120 V Control Circuit Remote Shutdown Transfer Relays

ESK-11EJS02, Sh.

1 Elementary Diagram, 480V SWGR Standby Bus UNDV TRIP RELAYS

- 10 - Attachment Number Title Revision

ESK-11ICS06 Sh.

1 Elementary Diagram 125 VDC Control Circuit RCIC Turbine Exhaust to Suppr Pool V

ESK-7HVN07, Sh.

1 Elementary Diagram, 120 V Control Circuit Remote Shutdown Transfer Relays

GE-828E445AA, Sheet 13 Elementary Diagram, Nuclear Steam Supply Shutoff System 28

GE-828E445AA, Sheet 14 Elementary Diagram, Nuclear Steam Supply Shutoff System 28

GE-828E445AA, Sheet 7 Elementary Diagram, Nuclear Steam Supply Shutoff System 34

GE-944E981, Sheet 1 Elementary Diagram, Reactor Protection System Motor Generator Control System

PID-15-01A Engineering P&I Diagram, System 251, Fire Protection-Water & Engine Pumps

PID-15-01B Engineering P&I Diagram, System 251, Fire Protection-Water & Engine Pumps

PID-15-01C Engineering P&I Diagram, System 251, Fire Protection-Water & Engine Pumps

PID-15-01D Engineering P&I Diagram, System 251, Fire Protection- Water & Engine Pump

PID-15-01E Engineering P&I Diagram, System 251, Fire Protection- Water & Engine Pump

PID-22-01E Engineering P&I Diagram, System 409, HVAC - Auxiliary Building

PID-27-06A System 209 Reactor Core Isolation Cooling 43

PID-27-07A Engineering P&I Diagram, System 204, Residual Heat Removal - LPCI

PID-27-07B Engineering P&I Diagram, System 204, Residual Heat Removal - LPCI

PID-27-07C Engineering P&I Diagram, System 204, Residual Heat Removal - LPCI

TLD-FWP-015 Test Loop Diagram, Motor Fire Water Pump Discharge

FWP-PS115

- 11 - Attachment ENGINEERING REPORTS (ER)

Number Title Revision

98-0296 Determine the Appropriate Battery Replacement Frequency for the Appendix R Emergency Lights

RB-2001-0136-000 Document the Basis for the Scope and Frequency of Fire Protection Testing

RB-2003-0711-001 Revising Post fire Safe Shutdown Operator Manual Action Evaluations Following Release of

RIS 2006-10

RB-2004-0140-000 Evaluate the Impact on the Post Fire Safe Shutdown Analysis if Automatic Functions are NOT Lost Due to a Fire 0

RB-2004-0275-000 Summarize all RBS NFPA Code Deviations 0

FIRE IMPAIRMENTS

SD171 SD112 SD97 SD82 SD86

WORK ORDERS

Number Title Revision/Date

51642307

FPW-Batt1A Replace Bank 6/2/2008

00192017

FPW-Batt1B Replace Bank 6/25/2009

51522151 Diesel Fire Pump Battery 18 month Surveillance

1/26/2009

226058 Diesel Fire Pump Battery Quarterly Surveillance

3/09/2010

249598 Diesel Fire Pump Battery Quarterly Surveillance

3/31/2010

218207 RBS EP Remote Radio: Perform Annual Maintenance

2/01/2010

00130765

EHS-MCC2J Breaker 1CB

AOP-0031 Attachment 6 Needs To Be Verified

160308

FPW-P4 Annual Maintenance [3 Year] 0

- 12 - Attachment ENGINEERING CHANGES

Number Title Revision/Date

EC12206 Child to

EC-8684 Modify Div 1DG Controls, Not Bypass Trips,

LOP-Only Start Ref.

CR-RBS-2007-2102

LT-ACE, Reportable Regulatory Issue Non Control Room Work 12/1/2009 EC1933 Install Transfer Switches that Allow Division I to Supply Motive Power and Control Power to Valve E51-MOVF063 following evacuation of the Main Control Room due to a fire 10/16/2009 EC21964 Restore Breaker

EHS-MCC2J-1CB to Original Configuration

EC2570 Engineering Change Provide An Alternate Power Source for E51-MOVF063 During a main Control Room Fire Div 1 & Non-Safety Pre Outage Phase

1/5/2010 EC2571 Provide An Alternate Power Source for E51-MOVF063 During a main Control Room Fire Div II Outage Phase 10/15/2009 EC8684 Modify Div 1-2 DG Controls, Not Bypass Trips,

LOP-Only Start; Ref.

CR-RBS-2007-2102

LT-ACE, Reportable Regulatory Issue 12/10/2009 ECR1784 Engineering Change Request - Revise Division 1-2 DG Controls to Leave Overheat Trips Active After

LOP-Only Auto-Start 8/1/2007 ECR6274 Engineering Change Request - Revise Division 1-2 DG Controls to Leave Overheat Trips Active After

LOP-Only Auto-Start 11/18/2008

- 13 - Attachment CONDITION REPORTS (CR)

RBS-2001-00613

RBS-2010-01410

RBS-2010-01578*

RBS-2010-01825*

RBS-2006-03776

RBS-2010-01529*

RBS-2010-01589*

RBS-2010-01828*

RBS-2008-03475

RBS-2010-01537*

RBS-2010-01592*

RBS-2010-01831*

RBS-2009-05823

RBS-2010-01538*

RBS-2010-01594*

RBS-2010-01846*

RBS-2009-05843

RBS-2010-01540*

RBS-2010-01599*

RBS-2010-01851*

RBS-2009-05882

RBS-2010-01546*

RBS-2010-01750*

RBS-2010-01955

RBS-2010-00697

RBS-2010-01552*

RBS-2010-01766*

LAR-2010-00022*

RBS-2010-01087

RBS-2010-01557*

RBS-2010-01775*

LO-NOE-2009-00516

RBS-2010-01192*

RBS-2010-01559*

RBS-2010-01783*

LO-LAR-2010-00120

RBS-2010-01234*

RBS-2010-01566*

RBS-2010-01808*

RBS-2010-01405

RBS-2010-01567*

RBS-2010-01821* *Issued as a result of inspection activities.

PREVENTIVE MAINTENANCE TASKS

WM-105-00 PMRQ 19005-01 PMRQ 19005-04WM-105-04 PMRQ 19005-03 PMRQ 19005-05

- 14 - Attachment PROCEDURES

Number Title Revision/Date

AB-095-506 Pre-Fire Strategies - HPCS Pump Room, Fire Area

AB-2/Z-1 4

AB-095-517 Pre-Fire Strategies - HPCS Piping Area, Fire Area

AB-2/Z-2 4

AOP-0031 Shutdown From Outside the Main Control Room 307

AOP-0052 Fire Outside the Main Control Room in Areas Containing Safety Related Equipment

CB-116-127

Pre-Fire Strategies - HVAC Room Fire Area C-17

3

CB-136-138 Pre-Fire Strategies - Control Room Fire Area C-25 4

CB-98-117 Pre-Fire Strategies - Standby Switchgear 1B Room Fire Area C-14

CB-98-118 Pre-Fire Strategies - Standby Switchgear 1A Room Fire Area C-15

EN-DC-179 Preparation of Fire Protection Engineering Evaluations

EN-DC-330 Fire Protection Program 0

EN-LI-102 Corrective Action Process 14

EN-OP-104 Operability Determination Process

EN-TQ-125, Attachment 9.1 Fire Brigade Drills Scenario 0

FPP-0010 Fire Fighting Procedure 12

FPP-0015 Post Fire Ventilation/Smoke Management 0

FPP-0070 Duties of Fire Watch 11

FPP-0100 Fire Protection System Impairment 10

FPP-0101 Fire Suppression System Inspection 11

OSP-0601 Remote Shutdown System Control Circuit Operability Test (Switches 43-1EGAN05, 43-1EJSA01,

43-1ENSC04, 43A-1ENSA01, 43B-1ENSA03, 43C-1ENSA09, 43D-1ENSC04, 43E-1ENSC01, 43F-1ENSA01, and 43G-1ENSA03)

OSP-0602 Remote Shutdown System Control Circuit Operability Test (Switches 43-1HVCN30, 43-1HVCN31, 43-1HVCN32, 43-1HVKA01)

- 15 - Attachment Number Title Revision/Date

PT-070-427 Pre-Fire Strategies- E-Tunnel West and F-Tunnel Fire Area

PT-1

PT-070-428 Pre-Fire Strategies- F-Tunnel Electrical Fire Area

PT-1 3

PT-070-429 Pre-Fire Strategies- G-Tunnel Fire Area

PT-1 3

RBNP-038 Site Fire Protection Program 6B

SOP-0027 Remote Shutdown System (#200) 302

SOP-0027, Attachment 2 Control Board Lineup - Remote Shutdown (Standby) 302

STP-200-0605 Remote Shutdown System Control Circuit Operability Test (Switches S1, S6,

S7, S8, S9, and S12)

303

STP-200-0606 Remote Shutdown System Control Circuit Operability Test (Switches S1, S2,

S3, S4, S5, and S11)

303

STP-200-0607 Division I remote Shutdown System Control Circuit Operability Test (Switch S10)

2

STP-200-0613 Remote Shutdown System Control Circuit Operability Test (Switches 43-1SWPA45, 43-1SWPA46)

STP-251-3201 Fire Hose Station Visual Inspection 11

STP-251-3300 Surveillance Test Procedure for Diesel Fire Pump Battery Quarterly Surveillance

TPP-7-021 Fire Protection Training and Qualifications 11

B.5.b COMMITMENTS

P-16812 P-16818 P-16820 P-16821 A-16837 P-16881

COMPONENTS REVIEWED DURING CIRCUIT ANALYSIS

Component ID Description

1CCP*MOV15B Containment Return Inboard Isolation Valve 1B21*F0501D Safety Relief Valve

1B21*MOVF016 Main Steam Line DR Inboard Isolation Valve 1B21*MOVF019 Main Steam Line DR Inboard Isolation Valve

- 16 - Attachment Component ID Description

1B21*PTN068A Reactor Vessel Pressure Transmitter 1B21*PTN068B Reactor Vessel Pressure Transmitter 1B21*PTN068E Reactor Vessel Pressure Transmitter

1B21*PTN068F Reactor Vessel Pressure Transmitter

1E12*FTN052B RHR B Discharge Flow Transmitter

1E12*MOVF004B RHR Pump B Suppression Pool Suction Valve

1E12*MOVF006B RHR B Shutdown Cooling Suction 1E12*MOVF006A RHR A Shutdown Cooling Suction 1E12*MOVF009 RHR Shutdown Cooling Inboard Isolation Valve

1E12*MOVF008 RHR Shutdown Cooling Outboard Isolation Valve

1E12*MOVF011B RHR B Discharge to Suppression Pool

1E12*MOVF024B RHR B Test Return/HX Discharge to Suppression Pool

1E12*MOVF040 RHR Discharge to Radwaste Inboard Isolation valve

1E12*MOVF042B RHR B Injection Valve 1E12*MOVF064B RHR B Min Flow Line Isolation Valve 1E12*VF082 RHR B/C Discharge Line Fill Pump Suction

1E12*PC003 RHR B/C Line Fill Pump

1SWP*P2B Standby Service Water Pump

1SWP*MOV40B Standby Service Water Pump 2b Discharge

1SWP*MOV505A Standby Service Water Division I / Division II Crossover Valve 1SWP*MOV027A Control Building Chilled Water pump SWP*P3A 1SWP*P2D Standby Service Water Pump motor

1EHS*MCC2J 480 Volts Auxiliary Building Motor Control Center

1EHS*MCC2K 480 Volts Auxiliary Building Motor Control Center

1SWP*MOV73B 1HVR*UC5 Service Water Supply Valve

- 17 - Attachment MISCELLANEOUS DOCUMENTS

Number

Title Revision/Date Fire Area C-15 Summary Table, Division I Standby Switchgear Room (EL.

98')

Fire Area C-17 Summary Table, Control Room Ventilation Fire Area

AB-2 Summary Table, HPCS & HPCS & HPCS Hatch Area Fire Area

PT-1 Summary Table, Piping Tunnel

Snapshot Assessment on B.5.b Strategy Implementation 3/31/2010

PDMS Cable Routing Sheets for: 1E51*MOVF068 1ICSNRC016 1ICSNRC017 1ICSNRC022 1ICSNCK618 1ICSNCK619

1ICSNRK620

Addendum 2 to 229.180 Specification for Floor and Wall Sleeve Seals 2 Branch Technical Position (BTP) APCSB 9.5-1 & Appendix A "Guidelines for Fire Protection for Nuclear Power Plants," docketed prior to July 1, 1976 8/23/1976 Design Change Notice 95-1100 Change Cable Designation from 1RHSNRC517 to 1RHSNRC527. 12/1/1995 Design Criterion No.

228.412 Specification for Procurement and Storage of Thermo-Lag Fire Barrier Materials Design Criterion No.

229.180 Specification for Floor and Wall Sleeve Seals 2 Design Criterion No.

240.201 Post Fire Safe Shutdown Analysis 4 Design Criterion No.

240.201A, Appendix C 10CFR50 APPENDIX R, Post fire Safe Shutdown Equipment List and Logic Diagram 4 Design Criterion No.

240.201A, Appendix E Circuit Analysis for

RBS 10CFR50 Appendix R Safe Shutdown Equipment List Components

- 18 - Attachment Number

Title Revision/Date

EDCR

C-24501 Engineering Design and Coordination Report

Communication Equipment Hold Down

EDS-EE-006 Installation, Modification and Maintenance of Thermo-Lag Fire Barrier Systems

EEAR-93-E0059 Communication Cat.

I, II & III Engineering Evaluation and Assistance Request

11/11/1993 Final Safety Analysis Report, Appendix 9A Fire Hazards Analysis

10 Final Safety Analysis Report, Appendix 9B Fire Protection Program Comparison With Appendix R to 10

CFR 50

Letter

Response Providing Information Regarding Implementation Details for the Phase 2 and 3 Mitigation Strategies 1/11/2007 Letter

Supplementary Response Regarding Implementation Details for the Phase 2 and 3 Mitigation Strategies 5/14/2007

LER 07-003-00 Licensee Event Report - Unanalyzed Condition of Emergency Diesel Generator in Post-Fire Safe Shutdown Scenario 7/19/2007

NUREG-0800 Standard Review Plan, Section 9.5.1, "Fire Protection Program"

1981 Procedure Action Request

AOP-0031R305PR-306

Procedure

Action Request

AOP-00301R307CN-A

Regulatory Guide 1.68.2 Initial Startup Test Program to Demonstrate Remote Shutdown Capability for Water-Cooled Nuclear Power Plants Specification No.

244.700 Specification for Standby Diesel Generator Systems 3 System Training Manual R-STM-0200.04 Remote Shutdown System 2/2/2009 System Training Manual R-STM-0250

Fire Protection & Detection

6 System Training Manual R-STM-209 Reactor Core Isolation Cooling (RCIC) System 6

- 19 - Attachment Number

Title Revision/Date System Training Manual R-STM-309S Standby Diesel Generators 8 Technical Requirements Manual Section 3.3.7.4 Fire Detection Instrumentation 5 Technical Requirements Manual Section 3.7.9.1 Fire Suppression Systems 122 Technical Requirements Manual Section 3.7.9.2 Spray and/or Sprinkler Systems 5 Technical Requirements Manual Section 3.7.9.3 Halon Systems 5 Technical Requirements Manual Section 3.7.9.4 Hose Stations 5 Technical Requirements Manual Section 3.7.9.6 Fire-Rated Assemblies 5

VTD-C742-0112 Cummins Service Bulletin For Battery and Cable Specification (Pub. #3379024-011)

VTD-G080-1264 General Electric Control and Instrument Switches 0

VTD-G080-1476 General Electric Type

SB-9 Control Switches Renewal Parts

VTM-E355-0002 Vendor Technical Manual for Exide Emergency Lighting 07/09/1997 Corrective Action 1 to

LO-LAR-2010-00120 White Paper - Remote Shutdown Panel Transfer Switch Reliability