Text

IR 05000458-13-007; on 04/15/2013 - 12/30/2013; River Bend Station; Triennial Fire Protection Team Inspection
	ML14132A292
Person / Time
Site:	River Bend
Issue date:	05/12/2014
From:	Clark J; Division of Reactor Safety IV
To:	Olson E; Entergy Operations
	Dixon J
References
	EA-13-110 IR-13-007
	Download: ML14132A292 (45)
	v • d • e

UNITED STATES May 12, 2014

SUBJECT:

RESPONSE TO RIVER BEND STATION DISPUTED VIOLATION AND ERRATA TO NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000458/2013007

Dear Mr. Olson:

On February 3, 2014, Entergy Operations, Inc. (Entergy), River Bend Station, provided a response to the U.S. Nuclear Regulatory Commissions (NRC) Triennial Fire Protection inspection report (ML14002A437) issued on January 2, 2014. Entergys letter is docketed under ML14042A165. (The referenced publicly available documents can be obtained in the NRCs Agencywide Documents Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html by searching for the ADAMS accession number (ML#########) for the document of interest.)

Specifically, the response letter stated that Entergy agrees that a performance deficiency exists; however, it requested that the cited violation, namely violation VIO 05000458/2013007-01, Failure to Resolve Noncompliances Associated with Multiple Spurious Operations in a Timely Manner, be re-characterized based on the following information.

1) Appendix B applies to safety-related structures, systems, and components (SSCs).

Fire protection evaluations do not meet the definition of safety related.

2) The performance deficiency was not a lack of concern for timeliness, but rather an error resulting in an incomplete evaluation.

On February 14, 2014, the NRC acknowledged Entergys letter and indicated that the NRC would review the basis for contesting the violation in accordance with Part I, Section 2.3.7, of the NRC Enforcement Manual.

The NRC staff performed a detailed review of Entergys response and concluded that the previously cited violation of 10 CFR Part 50, Appendix B, Criterion XVI should be recharacterized. The NRC has determined that a more appropriate violation is River Bend Station failed to comply with License Condition 2.C.(10) for failing to correct conditions adverse to fire protection. This violation, cited in the enclosed Notice of Violation (Notice), references the requirements of the Final Safety Analysis Report, Section 9A.3.4.8. Section 9A.3.4.8 requires that measures are established to assure that conditions adverse to fire protection are promptly identified and corrected. In this case, the NRC concluded that the failure to fully identify and correct all of the impacts to the credited safe shutdown pumps in three multiple spurious operations scenarios is of very low safety significance.

Example 1: Plant-Specific Scenario Diverting the Suppression Pool Inventory to the Upper Fuel Pool This scenario involved the spurious opening of the return valve (1E12*MOVF037A or 1E12*MOVF037B) from the residual heat removal system, a safety-related and fire safe shutdown system, to the upper pool in the non-credited train in combination with the spurious operation of the residual heat removal pump in the non-credited train. The multiple spurious operations event involving the residual heat removal system pump and return valve would transfer inventory from the suppression pool to the upper pool. The credited safe shutdown pumps take suction from the suppression pool. The reduced volume of water in the suppression pool negatively impacts the credited safe shutdown pumps (see Section 1R05.01 of Enclosure 2 for further information).

Example 2: NEI 00-01, Revision 2, Scenario 2ab - Spurious Opening of Both Reactor Core Isolation Cooling Test Return to Condensate Storage Tank Valves with Suction from the Suppression Pool Transferring Inventory to the Condensate Storage Tank This scenario involved the spurious operation of the reactor core isolation cooling pump, a safety-related and fire safe shutdown component, in combination with the spurious operation of multiple valves (1E51*MOVF031, 1E51*MOVF022, and 1E51*MOVF059)

required to transfer inventory to the condensate storage tank. The multiple spurious operations event involving the reactor core isolation cooling pump would transfer inventory from the suppression pool to the condensate storage tank. The credited safe shutdown pumps take suction from the suppression pool. The reduced volume of water in the suppression pool negatively impacts the credited safe shutdown pumps (see Section 1R05.01 of Enclosure 2 for further information).

Example 3: NEI 00-01, Revision 2, Scenario 2 - Spurious Residual Heat Removal Minimum Flow Valve Failure to Open with Failure to Establish a Discharge Path This scenario involved the spurious operation of a residual heat removal pump, a safety-related and fire safe shutdown component, in the non-credited train in combination with the spurious closure of the associated minimum flow valve (1E12*MOVF064A, 1E12*MOVF064B, or 1E12*MOVF064C). For this credited safe shutdown event, the failure to establish a discharge path would lead to pump damage and possible seal failure for the residual heat removal pump. The loss of suppression pool inventory through the failed seal could negatively impact the credited safe shutdown pumps that take suction from the suppression pool, thereby reducing the available volume of water for safe shutdown (see Section 1R05.01 of Enclosure 2 for further information).

The licensee initially identified these issues in May 2010, as a result of an expert panel meeting.

River Bend Station hired two separate contractors (August 2010 and July 2011) to perform evaluations to address multiple spurious actuations and both identified scenarios that could not be resolved. These issues were entered into the corrective action program and River Bend Station subsequently formed a supplemental expert panel (August 2011) and identified additional corrective actions, but failed to complete all corrective actions by November 2, 2012, the end of the enforcement discretion per Enforcement Guidance Memorandum 09-002, Enforcement Discretion for Fire Induced Circuit Faults.

Based on the failure to identify and mitigate issues that have the potential to adversely affect safe shutdown capability in a timely manner, and in accordance with the NRC Enforcement Policy, the NRC has concluded the significance of the violation should be characterized as Green or very low safety significance.

In addition, based on our review, we identified two concerns in Attachment 1 of Entergys letter regarding the violation in question. Our comments and conclusions are included below, as discussed on May 12, 2014, with Mr. E. Olson, Site Vice President, and other members of your staff.

Concern 1 Entergy provided the following statements regarding the relationship between multiple spurious operations, regulatory requirements, and the sites current licensing basis:

The vast majority of Multiple Spurious Operations (MSO) scenarios involve malfunction of non-credited trains, and thus were never subject to an explicit regulatory requirement.

Site actions to address MSOs on these systems, structures, and components have always constituted a voluntary industry initiative. Plants placed these items into their corrective action programs to ensure enforcement discretion would be available if needed, however, once thoroughly analyzed, the determination was typically made that these scenarios were beyond the regulation and the current Licensing Basis.

The evaluation of the scenarios cited in this violation did not result in non-compliances and should not be treated as non-compliances using the Enforcement Policy.

A specific regulatory requirement or mandate for licensees to analyze the spurious operation of non-credited trains of equipment has not been issued to date. Appendix R (and its equivalent BTP 9.5-1 language for post 1979 plants), requires that one train of SSCs necessary for hot shutdown be free of fire damage. No criterion is specified regarding how to address malfunctions of non-credited trains of equipment.

NRC Evaluation of Concern 1 For a pre-1979 plant, which is required by 10 CFR 50.48 to meet 10 CFR Part 50, Appendix R, the regulatory requirement is reasonably interpreted as requiring consideration of more than one spurious actuation. The NRC staff notes that 10 CFR Part 50, Appendix R, Section III.G.b.2, refers in the plural to hot shorts, open circuits, and shorts to ground. Specifically, the regulation states, in part, where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, one of the following means of ensuring that one of the redundant trains is free of fire damage shall be provided.

For a post-1979 plant, such as River Bend Station that was licensed November 20, 1985, which is not required by 10 CFR 50.48 to meet 10 CFR Part 50, Appendix R, the more general requirements of 10 CFR 50.48 and General Design Criterion 3 apply. The NRC staff notes that there is no explicit reference in either 10 CFR 50.48 or General Design Criterion 3 to spurious actuations (single or multiple).

The May 1984, Safety Evaluation Report, NUREG-0989, which is listed in River Bend Stations license condition, does not include any discussion regarding exceptions to 10 CFR 50, Appendix R, Section III.G. River Bend Station Supplemental Safety Evaluation Report 3, which is also listed in River Bend Stations license, concludes in Section 9.5.1.6, that, On the basis of its evaluation, the staff finds that the applicants fire protection program with approved deviations is in conformance with . . . Sections III.G, . . . of Appendix R to 10 CFR 50, . . , and is, therefore, acceptable. No exceptions to Section III.G are identified in either the May 1984 Safety Evaluation Report or the August 1985 Supplemental Safety Evaluation Report 3.

Based on this review of the safety evaluation reports, dated May 4, 1984, and August 1985, there are no reviewed and approved deviations to the licensee condition requirements to meet Supplemental Safety Evaluation Report 3 which documents a commitment to meet Appendix R,Section III.G. Therefore, there is a regulatory requirement for River Bend Station to consider multiple spurious actuations, as supported by the Task Interface Agreement 2013-02, Final Response to Task Interface Agreement 2013-02, Single Spurious Assumption for Braidwood and Byron Stations Safe-Shutdown Methodology, dated March 31, 2014 (ML12194A500), and described below:

A fire protection program for a plant licensed before January 1, 1979, that relies on a single spurious actuation assumption would not be consistent with the regulatory requirements. Plants licensed after January 1, 1979, were reviewed against Appendix R and the SRP, NUREG-0800, Section 9.5.1. There is no basis for distinguishing between pre-1979 plants versus post-1979 plants with respect to their vulnerability to multiple hot shorts and multiple spurious actuations. Therefore, the staff believes that post-1979 plants - no different than pre-1979 plants - must consider multiple cable shorts and multiple spurious actions in order to satisfy the requirements of 10 CFR 50.48(a). The only exception is if the NRC had reviewed and approved the consideration of a single spurious actuation, and there exists a cognizable and technically-defensible NRC safety basis for the NRCs approval.

Concern 2 Entergy provided the following statements:

The performance deficiency was not a lack of concern for timeliness but rather an error resulting in an incomplete evaluation. * The performance deficiency is the error that was made in the evaluation itself (i.e., overlooking the evaluation of the scenario described in example 1). Examples 2 and 3 were evaluated by November 2, 2012, and additional actions taken with these scenarios were found to be prudent and not required for compliance.

NRC Evaluation of Concern 2 The NRC issued Enforcement Guidance Memorandum 09-002, Enforcement Discretion for Fire Induced Circuit Faults, on May 14, 2009. The purpose of this enforcement guidance memorandum was to describe the conditions limiting enforcement discretion during the resolution of fire protection concerns involving multiple spurious actuations. The enforcement guidance memorandum provided enforcement discretion for 3 years from the date of issuance of Regulatory Guide 1.189, Fire Protection for Nuclear Power Plants, Revision 2, for licensees to complete the corrective actions for non-compliances associated with multiple spurious actuations concerns. Regulatory Guide 1.189, Revision 2, was issued on November 2, 2009.

The enforcement guidance memorandum provided a deadline of November 2, 2012, for licensees to restore compliance with its approved fire protection program. As discussed above the NRC concluded that:

Entergy initially failed to take sufficient corrective actions that would resolve River Bend Station susceptibility to these multiple spurious actuations scenarios.

Entergy had several opportunities to identify these corrective actions through the various evaluations performed by contractors and the River Bend Station expert panel.

Entergys evaluations for the three multiple spurious actuations scenarios contained deficiencies, which resulted in a failure to restore compliance within a reasonable period of time.

The NRC determined that there is a regulatory requirement for the River Bend Station to consider multiple spurious actuations, as discussed in Concern 1. Because Entergy failed to promptly identify and correct the multiple spurious actuations concerns prior to the expiration of the enforcement discretion period, the NRC considers the corrective actions to be untimely.

Consequently, the NRC concludes that Entergy failed to restore compliance within a reasonable period of time due to inadequate evaluations and corrective actions.

Actions for Errata Please remove Enclosure 1 and Enclosure 2 from the River Bend Station - NRC Triennial Fire Protection Inspection Report 05000458/2013007 and replace them with Enclosure 1 and Enclosure 2 of this letter. The purpose of this change is to correct the Notice of Violation and associated Green significance determination process write-up, and other administrative errors. In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRCs Rules of Practice and Procedures, a copy of this letter will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs Agencywide Documents Access and Management System (ADAMS), accessible from the NRC web site at http://www.nrc.gov/reading-rm/adams.html.

Sincerely,

/RA/

Jeffrey A. Clark, Deputy Director Division of Reactor Safety Docket No.: 50-458 License No.: NPF-47

Enclosures:

1 - Notice of Violation 2 - Revised Inspection Report 05000458/2013007

REGION IV==

Docket: 50-458 License: NPF-47 Report No.: 05000458/2013007 Licensee: Entergy Operations, Inc.

Facility: River Bend Station Location: 5485 U.S. Highway 61 St. Francisville, LA Dates: April 15 through December 30, 2013 Team Leader: S. Alferink, Reactor Inspector, Engineering Branch 2 Inspectors: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2 S. Achen, Reactor Inspector, Engineering Branch 2 A. Barrett, Resident Inspector, Project Branch C Approved By: Geoffrey B. Miller, Branch Chief Engineering Branch 2 Division of Reactor Safety-1- Enclosure 2

SUMMARY

IR 05000458/2013007; 04/15/2013 - 12/30/2013; River Bend Station; Triennial Fire Protection

Team Inspection.

The report covered a two-week triennial fire protection team inspection by three specialist inspectors and one resident inspector from Region IV. The inspectors documented five findings of very low safety significance (Green) in this report. Four of these findings involved violations of NRC requirements.

The significance of inspection findings was indicated by their color (i.e., greater than Green,

Green, White, Yellow, or Red) and determined using Inspection Manual Chapter 0609,

Significance Determination Process, dated June 2, 2011. Cross-cutting aspects were determined using Inspection Manual Chapter 0310, Components Within the Cross-Cutting Areas, dated October 28, 2011. All violations of NRC requirements were dispositioned in accordance with the NRCs Enforcement Policy, dated January 28, 2013. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4.

NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green.

The team identified a Green violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the approved fire protection program associated with multiple spurious operations concerns. Specifically, the licensee failed to implement all of the required corrective actions for multiple spurious operations concerns prior to November 2, 2012, which marked the expiration of enforcement discretion for multiple spurious operations contained in Enforcement Guidance Memorandum 09-002. The licensee entered this issue into their corrective action program as Condition Report CR-RBS-2013-03465.

The failure to implement all of the required corrective actions for multiple spurious operations concerns in a timely manner was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609,

Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved multiple fire areas. The senior reactor analyst determined this finding was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human Performance area because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c). (Section 1R05.01.b)

Green.

The team identified a Green non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shutdown the plant under all postulated control room fire scenarios. The licensee entered this issue into their corrective action program as Condition Report CR-RBS-2013-03150.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. The senior reactor analyst determined this finding was of very low safety significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

(Section 1R05.05.b.1)

Green.

The team identified a Green non-cited violation of License Condition 2.C.(10)for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to properly calculate the amount of time available for operators to perform time critical actions for all control room fire scenarios. The licensee entered this issue into their corrective action program as Condition Report CR-RBS-2013-03472.

The failure to properly calculate the amount of time available for operators to perform time critical actions for all control room fire scenarios was a performance deficiency.

The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609,

Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. The senior reactor analyst determined this finding was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Decision Making component of the Human Performance area because the licensee failed to use conservative assumptions in decision-making when applying the guidance for control room fires contained in the safe-shutdown analysis H.1(b). (Section 1R05.05.b.2)

Green.

The team identified a Green non-cited violation of License Condition 2.C.(10)for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to ensure that the communications systems would work under all postulated control room fire scenarios.

The licensee entered this issue into their corrective action program as Condition Reports CR-RBS-2013-03243 and CR-RBS-2013-03397.

The failure to ensure that the communications systems would work under all postulated control room fire scenarios was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation. The senior reactor analyst determined this finding was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human Performance area because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c). (Section 1R05.07.b)

Green.

The team identified a Green finding for the failure to properly implement the engineering change process. Specifically, the licensee failed to update the Maintenance Rule program and perform the required preventive maintenance tasks after the addition of three 8-hour Appendix R emergency lights. During subsequent discharge testing, two of the three lights failed. The licensee entered this issue into their corrective action program as Condition Reports CR-RBS-2013-03118 and CR-RBS-2013-03273.

The failure to properly implement the engineering change process was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. The team assigned the finding a low degradation rating since the ability to reach and maintain safe-shutdown conditions in the event of a control room fire would be minimally impacted by the failure of the three emergency lights to function for 8-hours. Specifically, the team determined that the alternative shutdown procedure provided operators with an alternate method of verifying that the emergency diesel generator breaker was closed. Because this finding had a low degradation rating, it screened as having very low safety significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

(Section 1R05.08.b)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

Main article: IP 71111.05T

This report presents the results of a triennial fire protection inspection conducted in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at the River Bend Station. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for review. The inspection team used the fire hazards analysis section of the River Bend Station Individual Plant Examination of External Events to select the following four risk-significant fire areas (inspection samples) for review:

Fire Area AB-7 D-Tunnel

Fire Area C-4 ACU West Room

Fire Area C-16 Remote Shutdown Room

Fire Area C-24 Control Building General Area The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(10), NRC safety evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Final Safety Analysis Report, Section 9.5; the fire hazards analysis; and the post-fire safe-shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Four inspection samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe-shutdown equipment list, safe-shutdown design basis documents, and the post-fire safe-shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe-shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe-shutdown in the event of a fire to verify that the procedures properly implemented the safe-shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe-shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50,

Appendix R,Section III.G. Specifically, the team evaluated whether at least one post-fire safe-shutdown success path remained free of fire damage in the event of a fire. In addition, the team verified that the licensee met all applicable license commitments.

b. Findings

Introduction.

The team identified a Green violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the approved fire protection program associated with multiple spurious operations. Specifically, the licensee failed to implement all of the required corrective actions for multiple spurious operations concerns prior to November 2, 2012, which marked the expiration of enforcement discretion for multiple spurious operations contained in Enforcement Guidance Memorandum 09-002.

Description.

The NRC issued Enforcement Guidance Memorandum 09-002, Enforcement Discretion for Fire Induced Circuit Faults, on May 14, 2009. The purpose of this enforcement guidance memorandum was to describe the conditions limiting enforcement discretion during the resolution of fire protection concerns involving multiple spurious operations. The enforcement guidance memorandum provided enforcement discretion for three years from the date of issuance of Regulatory Guide 1.189, Fire Protection for Nuclear Power Plants, Revision 2, for licensees to complete the corrective actions for noncompliances associated with multiple spurious operations concerns. Regulatory Guide 1.189, Revision 2, was issued on November 2, 2009.

Regulatory Guide 1.189, Revision 2, endorsed specific portions of NEI 00-01, Guidance for Post-Fire Safe-Shutdown Circuit Analysis, Revision 2. Specifically, Regulatory Guide 1.189, Revision 2, Section 5.3.1.1, Protection for the Safe-Shutdown Success Path, stated:

The approach outlined in Chapter 4 of NEI 00-01, which relies on the Expert Panel Process and the Generic List of Multiple Spurious Operations contained in Appendix G to that document, provides an acceptable methodology for the identification of multiple spurious actuations that may affect safe-shutdown success path SSCs, when applied in conjunction with this regulatory guide.

Spurious actuations, either single or multiple, with the potential to affect safe-shutdown success path components should be mitigated in accordance with the features described in this section; tools such as fire modeling and manual actions should not be used.

Regulatory Guide 1.189, Revision 2, Section 5.3.1.2, Protection for Components Important to Safe Shutdown, contained a similar statement:

The approach outlined in Chapter 4 of NEI 00-01, which relies on the Expert Panel Process and the Generic List of Multiple Spurious Operations contained in Appendix G, provides an acceptable methodology for the analysis of multiple spurious operations for protection of components important to safe-shutdown, when applied in conjunction with this regulatory guide.

The licensee began their evaluation of multiple spurious operations in accordance with NEI 00-01, Revision 2. The licensee formed a multiple spurious operations expert panel, which met on March 23, 2010, to review the generic list of multiple spurious operations contained in NEI 00-01, Revision 2. The multiple spurious operations expert panel

meeting results were documented in Engineering Planning Management, Inc. (EPM)

Report P2083-02-002, MSO Expert Panel Results, Revision 0, dated May 2010. This report identified several scenarios that required detailed circuit analyses to resolve.

The licensee had a contractor perform the detailed circuit analyses. The contractor documented the results of the analyses and recommended additional actions for scenarios that could not be resolved by circuit analysis in EPM Report P2083-07-001, Regulatory Guide 1.189 Support Project Final Report, Revision 0, dated August 2010.

The licensee had another contractor perform additional detailed circuit analyses. This contractor documented the results of the additional analyses and recommended additional actions for scenarios that still could not be resolved by circuit analysis in ENERCON Report ENTGRB083-PR-01, Multiple Spurious Operations Circuit Analysis and Scenario Disposition, Revision 0, dated July 14, 2011.

The licensee formed a supplemental multiple spurious operations expert panel, which met on August 30-31, 2011, to review the generic list of multiple spurious operations contained in a draft version of NEI 00-01, Revision 3. The supplemental expert panel revisited several scenarios that were fundamentally unchanged from NEI 00-01, Revision 2. The licensee identified additional actions for some of these scenarios, but failed to complete all of these additional actions by the end of the enforcement discretion period for multiple spurious operations. The supplemental expert panel results were documented in Engineering Report RBS-FP-11-0000, Expert Panel for Addressing Multiple Spurious Operations, Revision 0, dated December 13, 2011.

Prior to the inspection, the licensee addressed all multiple spurious operations scenarios through analysis only. The licensee determined no plant modifications were needed to resolve the multiple spurious operations scenarios.

For this inspection, the team focused on the multiple spurious operations scenarios that were identified during the licensees review of NEI 00-01, Revision 2. The team identified the following three examples of multiple spurious operations concerns where the licensee did not complete the corrective actions prior to the end of the enforcement discretion period, November 2, 2012.

Example 1: Plant-Specific Scenario Diverting the Suppression Pool Inventory to the Upper Fuel Pool This scenario involved the spurious opening of the return valve from the residual heat removal system to the upper pool (1E12*MOVF037A or 1E12*MOVF037B) in the non-credited train in combination with the spurious operation of the residual heat removal pump in the non-credited train. The concern was that the residual heat removal pump would transfer inventory from the suppression pool to the upper pool and negatively impact the safe-shutdown pumps that take suction from the suppression pool.

This scenario was evaluated in ENERCON Report ENTGRB083-PR-01. The team determined that the licensee took no actions to address the potential loss of suppression pool inventory. The team reviewed the safe-shutdown analysis, which evaluated these valves as a single spurious operation concern and concluded that the valve in the credited residual heat removal train would be controlled and would not be susceptible to spurious operation. The safe-shutdown analysis did not evaluate the potential impact of

the valve in the non-credited train spuriously opening in combination with the residual heat removal pump in the non-credited train also spuriously operating.

The team determined that the corrective actions for this scenario were inadequate since the multiple spurious operations expert panel failed to identify the flow diversion path of a spuriously operating residual heat removal pump combined with a spuriously opening valve resulting in the transfer of suppression pool inventory to the upper fuel pool. This resulted in the licensee failing to evaluate this relevant plant-specific scenario.

Example 2: NEI 00-01, Revision 2, Scenario 2ab - Spurious Opening of Both Reactor Core Isolation Cooling Test Return to Condensate Storage Tank Valves with Suction from the Suppression Pool Transferring Inventory to the Condensate Storage Tank This scenario involved the spurious operation of the reactor core isolation cooling pump in combination with the spurious operation of multiple valves (1E51*MOVF031, 1E51*MOVF022, and 1E51*MOVF059) required to transfer inventory to the condensate storage tank. The concern was that the reactor core isolation cooling pump would transfer inventory from the suppression pool to the condensate storage tank and negatively impact the safe-shutdown pumps that take suction from the suppression pool.

This scenario was evaluated in ENERCON Report ENTGRB083-PR-01, which concluded that this scenario was not a concern at the River Bend Station. For six fire areas, the report credited operators terminating the flow from the control room by closing the reactor core isolation cooling system steam isolation valve 1E51*MOVF063. The team noted that the evaluation did not establish the maximum time available to respond to the flow diversion before post-fire safe-shutdown would be impacted.

For one fire area (Fire Area C-16), operators may not be able to control valve 1E51*MOVF063 from the control room. For this fire area, the report credited a rapid depressurization of the reactor pressure vessel to allow low pressure coolant injection as a means of reducing the steam pressure available to the reactor core isolation cooling system turbine and terminating the loss of suppression pool inventory.

Prior to the inspection, the post-fire safe-shutdown procedure was not updated to provide procedural guidance to the control room operators for this scenario. The team identified that the post-fire safe-shutdown procedure contained a note which stated, in part, It is expected that normal, abnormal, and emergency procedures will be followed for shutdown. This AOP [Abnormal Operating Procedure] should not be misinterpreted to be the required method of shutdown. The team identified that, absent guidance in the post-fire safe-shutdown procedure, the rapid depressurization of the reactor pressure vessel might not occur before the loss of suppression pool inventory impacted the post-fire safe-shutdown.

The team concluded the evaluation for this scenario contained in ENERCON Report ENTGRB083-PR-01 was inadequate since it failed to identify the amount of time available for operators to close the steam isolation valve or initiate a rapid depressurization of the reactor pressure vessel in order to terminate the loss of suppression pool inventory. The team concluded that the corrective actions were untimely since they were not completed by the end of the enforcement discretion period.

These actions were still not completed prior to the beginning of the inspection.

Example 3: NEI 00-01, Revision 2, Scenario 2l - Spurious Residual Heat Removal Minimum Flow Valve Failure to Open with Failure to Establish a Discharge Path This scenario involved the spurious operation of a residual heat removal pump in the non-credited train in combination with the spurious closure of the associated minimum flow valve (1E12*MOVF064A, 1E12*MOVF064B, or 1E12*MOVF064C). The concern was that the failure to establish a discharge path would lead to pump damage and possible seal failure for the residual heat removal pump. The loss of suppression pool inventory through the failed seal could negatively impact the safe-shutdown pumps that take suction from the suppression pool.

This scenario was originally evaluated in EPM Report P2083-07-001. This report recommended the following additional actions:

Perform a more detailed circuit analysis or evaluate fire modeling to eliminate the concern,

Perform an evaluation to determine whether pump overheating or cavitation could result in pump/pipe damage, and

Perform a calculation for water inventory control versus loss rate in case of system piping failure to determine acceptable plant response times.

These scenarios were also evaluated in ENERCON Report ENTGRB083-PR-01. This report stated:

As a property protection measure, consider tripping a non-credited residual heat removal pump locally (at the respective switchgear) should it spuriously start with a fire in the areas identified above.

The licensee did not complete the recommended actions by the end of the enforcement discretion period. The licensee identified that the actions were not completed and issued Condition Report CR-RBS-2013-0515 on January 29, 2013.

Although the actions were not complete, the licensee did have a contractor calculation (P2265-0001-1.12) that estimated the time to pump damage after deadheading. This calculation estimated that a residual heat removal pump would reach its maximum design temperature of 360 °F within 21.7 minutes after deadheading.

The post-fire safe-shutdown procedure was not updated with this information prior to the inspection.

The team concluded the evaluation contained in ENERCON Report ENTGRB083-PR-01 was inadequate since it focused on the property protection aspect of the scenario and failed to consider the safe-shutdown aspect of the scenario. Specifically, the team noted that this scenario could result in pump damage within a relatively short amount of time which could result in a seal failure and subsequent loss of suppression pool inventory.

The team concluded that the corrective actions were untimely since they were not completed by the end of the enforcement discretion period. These actions were still not completed prior to the beginning of the inspection.

The licensee entered this issue into their corrective action program for further evaluation and implemented enhanced operator rounds as a compensatory measure for this issue.

Analysis.

The failure to implement all of the required corrective actions for multiple spurious operations concerns in a timely manner was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved multiple fire areas.

Example 1: Plant-Specific Scenario Diverting the Suppression Pool Inventory to the Upper Fuel Pool This scenario involved the spurious opening of the return valve from the residual heat removal system to the upper pool (1E12*MOVF037A or 1E12*MOVF037B) in the non-credited train in combination with the spurious operation of the residual heat removal pump in the non-credited train. The concern was that the residual heat removal pump would transfer inventory from the suppression pool to the upper pool and negatively impact the safe-shutdown pumps that take suction from the suppression pool.

The senior reactor analyst noted that the upper pool could receive a limited amount of suppression pool inventory before overfilling. Once the upper pool was full, then any additional suppression pool inventory would spill back down into the suppression pool.

In response to the senior reactor analysts questions, the licensee performed a calculation to determine the amount of inventory that was required to fill the upper pool and the resulting change in net positive suction head for the safe-shutdown pumps that took suction from the suppression pool. The licensee determined that the residual heat removal pumps could transfer approximately 28,165 gallons of suppression pool inventory before the upper pool overfilled. This corresponded to a change in net positive suction head of approximately 6 inches.

The senior reactor analyst reviewed the available and required net positive suction head for the safe-shutdown pumps that took suction from the suppression pool. The senior reactor analyst noted that the smallest margin between the available and required net positive suction head was approximately 18 inches. Since the reduction of 6 inches of net positive suction head would not prevent the safe-shutdown pumps from operating, the senior reactor analyst concluded that this example would lead to a negligible change in core damage frequency. Therefore, the senior reactor analyst concluded that this example was of very low safety significance (Green).

Example 2: NEI 00-01, Revision 2, Scenario 2ab - Spurious Opening of Both Reactor Core Isolation Cooling Test Return to Condensate Storage Tank Valves with Suction from the Suppression Pool Transferring Inventory to the Condensate Storage Tank This scenario involved the spurious operation of the reactor core isolation cooling pump in combination with the spurious operation of multiple valves (1E51*MOVF031, 1E51*MOVF022, and 1E51*MOVF059) required to transfer inventory to the condensate storage tank. The concern was that the reactor core isolation cooling pump would transfer inventory from the suppression pool to the condensate storage tank and negatively impact the safe-shutdown pumps that take suction from the suppression pool.

The senior reactor analyst noted that the condensate storage tank was located at a higher elevation than the suppression pool. Since the reactor core isolation cooling pump was normally lined up to take a suction from the condensate storage tank, the senior reactor analyst noted that the reactor core isolation cooling pump would preferentially take a suction from the condensate storage tank rather than the suppression pool.

In response to the senior reactor analysts questions, the licensee performed a calculation to determine the fraction of suction flow from the condensate storage tank versus the suppression pool for this scenario. The licensee determined that all of the flow would come from the condensate storage tank. Since this would result in a recirculation loop for the reactor core isolation cooling pump that did not reduce any suppression pool inventory, the senior reactor analyst concluded that this example would lead to a negligible change in core damage frequency. Therefore, the senior reactor analyst concluded that this example was of very low safety significance (Green).

Example 3: NEI 00-01, Revision 2, Scenario2 - Spurious Residual Heat Removal Minimum Flow Valve Failure to Open with Failure to Establish a Discharge Path This scenario involved the spurious operation of a residual heat removal pump in the non-credited train in combination with the spurious closure of the associated minimum flow valve (1E12*MOVF064A, 1E12*MOVF064B, or 1E12*MOVF064C). The concern was that the failure to establish a discharge path would lead to pump damage and possible seal failure for the residual heat removal pump. The loss of suppression pool inventory through the failed seal could negatively impact the safe-shutdown pumps that take suction from the suppression pool.

Since this issue could not be screened out using a qualitative evaluation, the team performed a plant walkdown to identify fire source/target combinations that could lead to these fire scenarios. Using the spreadsheets from NUREG-1805, Fire Dynamics Tools (FDTs) Quantitative Fire Hazard Analysis Methods for the U.S. Nuclear Regulatory Commission Fire Protection Inspection Program, the team identified six different source/target combinations (for a total of nine fire scenarios) that could lead to these multiple spurious operations.

For each scenario, the senior reactor analyst calculated a bounding change in core damage frequency using the following equation:

CDF = FIF x SF x PNS x PMSO x HEP where: FIF denotes the fire ignition frequency adjusted for the number of vertical sections (for electrical panels) or the critical area (for transients),

SF denotes the severity factor, PNS denotes the manual non-suppression probability, PMSO denotes the probability of circuit failures leading to the multiple spurious operations, and HEP denotes the human error probability for operators failing to mitigate the scenario.

The senior reactor analyst used Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, to obtain values for the fire ignition frequency, severity factor, and non-suppression probability. The senior reactor analyst used the best available information contained in the Interim Guidance Pending Publication of Expert Elicitation Results (ML13165A214) to obtain a value for the probability of circuit failures leading to the multiple spurious operations.

The senior reactor analyst used the SPAR-H methodology to obtain a human error probability for these scenarios. In response to the senior reactor analysts questions, the licensee determined a maximum leak rate of approximately 120 gpm due to a seal failure. Using the information provided in the first example, the senior reactor analyst estimated that operators had more than 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months to diagnose the scenario and send an operator to close the upstream suction valve. The analyst assigned a nominal time of 75 minutes for diagnosis and 20 minutes for action and an available time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for diagnosis and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for action. The senior reactor analyst used the SPAR-H methodology and calculated a human error probability of 3.02E-3.

The following table summarizes the Phase 3 evaluation results.

Heat Ignition Fire Release FIF SF PNS PMSO HEP CDF Source Target Rate 1RSS* 1RSS*

200 kW 6.00E-05 0.9 1.00 0.81 3.02E-3 1.32E-07 PNL102 PNL102 1RSS* 1RSS*

650 kW 6.00E-05 0.1 1.00 0.81 3.02E-3 1.46E-08 PNL102 PNL102 1ENB-1TC085R 200 kW 1.20E-04 0.1 1.00 0.56 3.02E-3 2.03E-08 SWG01A 1ENB-1TC087R 200 kW 2.40E-04 0.1 0.35 0.56 3.02E-3 1.42E-08 INV01A1 1EHS- 200 kW 1TC087R 5.17E-05 1 1.00 0.56 3.02E-3 8.74E-08 MCC8A/14A (HEAF)

Transients 1TC088R 200 kW 3.02E-07 0.1 0.58 0.56 3.02E-3 2.97E-11 Transients 1TC089R 200 kW 3.02E-07 0.1 1.00 0.56 3.02E-3 5.11E-11 1C61* 1C61*

200 kW 1.20E-04 0.9 1.00 0.56 3.02E-3 1.83E-07 PNLP001 PNLP001 1C61* 1C61*

650 kW 1.20E-04 0.1 1.00 0.56 3.02E-3 2.03E-08 PNLP001 PNLP001 Total 4.71E-07 In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, the senior reactor analyst screened the finding for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because the finding influenced the likelihood of accidents leading to core damage. As documented in Appendix H, Table 5.1, accident sequences that lead to large early release frequency for boiling water reactors with Mark III containment include high pressure transient events.

The analyst utilized the plant-specific standardized plant analysis risk model and determined that most of the sequences involving control room evacuation with a lack of communications devices to assist operators in stabilizing the plant resulted in the reactor coolant system being at high pressure at the time of vessel breach. Using Table 5.2, Phase 2 Assessment Factors - Type A Findings at Full Power, the analyst selected a large early release frequency factor of 0.2 for these sequences.

The sum of the large early release frequency score as stated in Step 3.2, LERF Significance Evaluation, was then quantified. The change in large early release frequency was estimated to be 9.42E-08. This value agrees with the result of the change in core damage frequency evaluation that this example was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human Performance area because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c).

Enforcement.

License Condition 2.C.(10) specifies, in part, that Entergy Operations, Inc., shall comply with the requirements of the fire protection program as specified in Attachment 4 to NPF-47. License NPF-47, Attachment 4, Fire Protection Program Requirements specifies, in part, that the Entergy Operations, Inc., shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility through Amendment 22 and as approved in the Safety Evaluation Report, dated May 1984, and Supplement 3, dated August 1985. Final Safety Analysis Report, Section 9A.3.4.8, Corrective Action, specifies, in part, that Measures are established to assure that conditions adverse to fire protection, such as failures, malfunctions, deficiencies, deviations, defective components, uncontrolled combustible material, and nonconformances, are promptly identified, reported, and corrected.

Contrary to the above, as of December 30, 2013, the licensee failed to promptly identify and correct conditions adverse to fire protection. Specifically, the licensee failed to promptly identify and implement all of the required corrective actions for multiple spurious operations events prior to November 2, 2012. Three scenarios were identified that negatively impacted the credited safe-shutdown pumps.

The licensee entered this issue into their corrective action program as Condition Report CR-RBS-2013-03465. Because the licensee failed to restore compliance within a reasonable period of time after this violation was initially identified, this violation is being treated as a cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy. This is a violation of License Condition 2.C.(10). A Notice of Violation is included with this report: VIO 05000458/2013007-01, Failure to Resolve Noncompliances Associated with Multiple Spurious Operations in a Timely Manner.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation and qualification records for a sample of rated fire wraps protecting circuits required for post-fire safe-shutdown to ensure the material possessed an appropriate fire rating and that the installation met the engineering design to achieve the required 1-hour fire rating.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps and Halon supply systems) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe-shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe-shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for firefighting.

The team observed an unannounced fire drill and subsequent drill critique on April 30, 2013, using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly. The team observed fire brigade members fight a simulated pump motor fire in a control building equipment room. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were:

Proper wearing of turnout gear and self-contained breathing apparatus;

Proper use and layout of fire hoses;

Employment of appropriate firefighting techniques;

Sufficient firefighting equipment was brought to the scene;

Effectiveness of fire brigade leader communications, command, and control;

Search for victims and propagation of the fire into other areas;

Smoke removal operations;

Utilization of pre-planned strategies;

Adherence to the pre-planned drill scenario; and

Drill objectives.

b. Findings

No findings were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified:

A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe-shutdown trains,

A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train), and

Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology The team reviewed the safe-shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the safe-shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe-shutdown were trained and available onsite at all times, exclusive of those assigned as fire brigade members.

The team performed a walkdown of the post-fire safe-shutdown procedure with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified that the operators could be reasonably expected to perform specific actions within the time required to maintain plant parameters within specified limits. Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

.1 Inadequate Alternative Shutdown Procedure

Introduction.

The team identified a Green non-cited violation of Technical Specification 5.4.1.d for the failure to implement and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to maintain an alternative shutdown procedure that ensured operators could safely shutdown the plant under all postulated control room fire scenarios.

Description.

The licensee developed Procedure AOP-0031, Shutdown from Outside the Main Control Room, Revision 320, to shutdown the reactor in the event a fire required evacuation of the control room. The team performed a walkdown of this procedure and identified a control room fire scenario where the procedure did not provide adequate steps for operators to mitigate the scenario. Specifically, this procedure did not provide steps for operators to mitigate a spurious injection from the high pressure core spray system. This scenario could be caused by a control room fire that directly caused the injection through a spurious high pressure core spray system actuation or indirectly caused the injection through a spurious emergency core cooling system actuation signal.

The alternative shutdown procedure provided a caution for the operators which noted that some injection systems could not be controlled from the remote shutdown panel and could result in overfilling or overpressuring the reactor pressure vessel. The caution, first added to the procedure in 2003, provided the high pressure and low pressure core spray systems as examples.

Although the procedure provided a caution for the operators, the procedure failed to provide steps for operators to mitigate the spurious injection of the high pressure core spray system. In response to the teams concerns, the licensee indicated that operators would be able to mitigate the scenario by opening the breakers associated with the high pressure core spray pump. This action was documented and promulgated to operators in Standing Order 270 during the inspection.

The licensee did not have a calculation to determine the amount of time available for operators to isolate the high pressure core spray system prior to overfilling the reactor pressure vessel. In order to obtain an estimate of the amount of time available, the licensee performed a preliminary evaluation on the simulator. The licensee ran a simulator scenario with the high reactor level (level 8) trip disabled due to fire damage with the spurious injection of the high pressure core spray system. In this scenario, the licensee observed that it took approximately 9 minutes for the reactor water level to reach the bottom of the main steam lines. The team determined that this was an insufficient amount of time to ensure operators would identify the spurious operation, determine the appropriate mitigating action, determine the appropriate operator to perform the mitigating action, and complete the action prior to overfilling the reactor pressure vessel.

The licensee entered this issue into their corrective action program. The licensee implemented a corrective action for this issue by revising the alternative shutdown procedure on June 18, 2013.

Analysis.

The failure to maintain adequate written procedures covering fire protection program implementation was a performance deficiency. The performance deficiency was more than minor because it was associated with the procedure quality attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

Because the River Bend Station control room included the plant instrumentation and relay cabinets for Divisions I and II, the senior reactor analyst added a generic fire ignition frequency for the relay room (FIFIR) to the control room fire ignition frequency (FIFCR) listed in the Individual Plant Examination for External Events. The analyst multiplied the combined fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming a 2 minute detection that required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = (FIFCR + FIFIR)

SF

NPCRE

= (9.50E-3/yr + 1.42E-3/yr)

0.2

1.30E-2

= 2.84E-5/yr The control room had a total of 109 electrical and control cabinets. The analyst determined that a fire in one of these cabinets could lead to the spurious operation and loss of control function for the high pressure core spray system which could result in

overfilling the reactor vessel to the main steam lines or above. The analyst calculated a bounding change in core damage frequency for the finding (CDFFIRE-HPCS) by multiplying the control room evacuation frequency by the fraction of panels containing the affected circuits.

CDFFIRE-HPCS = FCR-EVAC

1 / 109

= 2.84E-5/yr

0.0092

= 2.61E-7/yr This frequency was considered to be bounding since it assumed:

Fire damage in the applicable cabinet would create circuit faults such that the high pressure core spray system spuriously injected and the level 8 trip was disabled, resulting in overfilling the reactor vessel above the main steam lines;

The conditional core damage probability given a control room fire with evacuation and the spurious injection of the high pressure core spray system was equal to one; and

The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero)

In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, the senior reactor analyst screened the finding for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because the finding influenced the likelihood of accidents leading to core damage. As documented in Appendix H, Table 5.1, accident sequences that lead to large early release frequency for boiling water reactors with Mark III containment include high pressure transient events.

The analyst determined that most of the sequences involving control room evacuation with spurious operation of the high pressure core spray system resulted in the reactor coolant system being at high pressure at the time of vessel breach. Using Table 5.2, Phase 2 Assessment Factors - Type A Findings at Full Power, the analyst selected a large early release frequency factor of 0.2 for these sequences.

The sum of the large early release frequency score as stated in Step 3.2, LERF Significance Evaluation, was then quantified. The change in large early release frequency was estimated to be 5.22E-08. This value agrees with the result of the change in core damage frequency evaluation that the finding was of very low safety significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

Enforcement.

Technical Specification 5.4.1.d states that written procedures shall be established, implemented, and maintained covering fire protection program implementation. Contrary to the above, from 2003 to December 30, 2013, the licensee failed to establish, implement, and maintain adequate written procedures covering fire protection program implementation. Specifically, the licensee failed to maintain an alternative shutdown procedure that provided steps for operators to mitigate a spurious injection from the high pressure core spray system.

Because this violation was of very low safety significance and has been entered into the corrective action program (Condition Report CR-RBS-2013-03150), this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2013007-02, Inadequate Alternative Shutdown Procedure.

.2 Failure to Properly Calculate the Time Available for Operator Actions

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to properly calculate the amount of time available for operators to perform time critical actions for all control room fire scenarios.

Description.

Following the 2010 triennial fire protection inspection, the licensee reviewed the design basis for determining the amount of time available for operators to perform select time critical actions in the alternative shutdown procedure. The licensee determined that several different calculations formed the design basis for determining the amount of time available.

These calculations were performed in accordance with the safe-shutdown analysis and determined the amount of time available for operators to perform specific actions under various alternative shutdown scenarios. The safe-shutdown analysis incorporated NRC staff guidance related to control room fire scenarios. Specifically, the safe-shutdown analysis made the following two assumptions:

(1) offsite power was lost as well as the automatic starting of the emergency diesel generators and

(2) the automatic function of valves and pumps whose control circuits could be affected by a control room fire was lost. The safe-shutdown analysis also noted that the only manual action in the control room prior to evacuation given credit was the reactor trip. Finally, the safe-shutdown analysis noted that the safe-shutdown capability should not be adversely affected by any one spurious action or signal resulting from a fire.

The team reviewed the assumptions, methods, and results of these calculations. The team identified one alternative shutdown scenario where the licensee failed to properly calculate the amount of time available for operators to perform time critical actions. This scenario involved the amount of time available to terminate feedwater injection prior to overfilling the reactor vessel.

For this scenario, the team noted that overfilling the reactor vessel could disable the reactor core isolation cooling system and damage the steam lines. The reactor core

isolation cooling system was relied upon in this scenario to restore and maintain reactor vessel level and control pressure. Overfilling the reactor vessel could also damage the safety relief valves since they were not analyzed to pass high pressure water.

This issue was first identified during the 2010 triennial fire protection inspection as non-cited violation 05000458/2010006-03. In response to this violation, the licensee revised the alternative shutdown procedure to direct the auxiliary control room operators to immediately terminate feedwater injection by closing the condensate demineralizer service inlet and outlet isolation valves. The nominal stroke time for these motor-operated valves was 48 seconds.

In addition, the licensee performed Calculation G13.18.12.2-139, Estimated Time to Overfill the RPV Due to Continued Feedwater Operation During a Fire in the Main Control Room, Revision 0, to determine the amount of time available for operators to terminate feedwater injection prior to overfilling the reactor pressure vessel. This calculation concluded that operators would have less than 45 seconds available to terminate feedwater injection if all three of the normally running feedwater pumps continued to inject. Based on this calculation, the licensee concluded that the overfill condition happens so quickly that manual action outside of the control room to mitigate the concern has a low probability of success. Further, the licensee concluded that directing the Auxiliary Control Room to close the condensate demin filter valves and the actual closing of the valves would require more than one minute.

The licensee then generated a corrective action item to perform an evaluation that could be used as a basis for a deviation request to justify the manual actions to be taken in the auxiliary control room of closing the condensate demineralizer filter valves for preventing reactor vessel overfill during a control room fire scenario with the continued injection of feedwater.

The licensee subsequently revised Calculation G13.18.12.2-139 to examine scenarios where one or two feedwater pumps continued to inject and the remaining feedwater pumps stopped. The revised calculation concluded that operators would have approximately 2 minutes available to terminate feedwater injection if only one of the normally running feedwater pumps continued to inject. The licensee performed a timed walkdown of these steps and concluded that operators could perform the required actions within a range of 1 minute 53 seconds to 2 minutes 15 seconds. The licensee concluded that no deviation request was necessary since operators could reasonably perform the actions within the required time and the actions could not be undone by a control room fire. Further, the licensee noted that this control room fire scenario involved multiple spurious actuations.

The team reviewed the licensees evaluation and concluded that the licensee incorrectly implemented the guidance for control room fires contained in the safe-shutdown analysis. Specifically, the team noted that the continued injection of the feedwater pumps and the loss of automatic actuation/trip signals were part of the design assumptions for a control room fire and were not considered to be spurious actuations.

The team concluded that the bounding control room fire scenario involved the continued injection of all three normally running feedwater pumps and operators had less than 45 seconds to terminate feedwater injection.

Based on the timed walkdown of the alternative shutdown procedure, the team determined that the auxiliary control room operators would complete the immediate action of terminating feedwater injection in approximately 2 minutes 5 seconds.

The licensee entered this issue into their corrective action program for further evaluation and implemented enhanced operator rounds as a compensatory measure for this issue.

Analysis.

The failure to properly calculate the amount of time available for operators to perform time critical actions for all control room fire scenarios was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

Because the River Bend Station control room included the plant instrumentation and relay cabinets for Divisions I and II, the senior reactor analyst added a generic fire ignition frequency for the relay room (FIFIR) to the control room fire ignition frequency (FIFCR) listed in the Individual Plant Examination for External Events. The analyst multiplied the combined fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming a 2-minute detection that required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = (FIFCR + FIFIR)

SF

NPCRE

= (9.50E-3/yr + 1.42E-3/yr)

0.2

1.30E-2

= 2.84E-5/yr The control room had a total of 109 electrical and control cabinets. The analyst determined that a fire in one of these cabinets could lead to the spurious operation and loss of control function for the feedwater system which could result in overfilling the reactor vessel to the main steam lines or above. The analyst calculated a bounding change in core damage frequency for this example (CDFCR-FW) by multiplying the control room evacuation frequency by the fraction of panels containing the affected circuits.

CDFCR-FW = FCR-EVAC

1 / 109

= 2.84E-5/yr

0.0092

= 2.61E-7/yr

This frequency was considered to be bounding since it assumed:

Fire damage in the applicable cabinet would create circuit faults such that the feedwater pumps continued to operate and the level 8 trip was disabled, resulting in overfilling the reactor vessel above the main steam lines;

The conditional core damage probability given a control room fire with evacuation and the spurious injection of the feedwater system was equal to one; and

The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, the senior reactor analyst screened the finding for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because the finding influenced the likelihood of accidents leading to core damage. As documented in Appendix H, Table 5.1, accident sequences that lead to large early release frequency for boiling water reactors with Mark III containment include high pressure transient events.

The analyst determined that most of the sequences involving control room evacuation with spurious operation of the feedwater system resulted in the reactor coolant system being at high pressure at the time of vessel breach. Using Table 5.2, Phase 2 Assessment Factors - Type A Findings at Full Power, the analyst selected a large early release frequency factor of 0.2 for these sequences.

The sum of the large early release frequency score as stated in Step 3.2, LERF Significance Evaluation, was then quantified. The change in large early release frequency was estimated to be 5.22E-08. This value agrees with the result of the change in core damage frequency evaluation that this example was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Decision Making component of the Human Performance area because the licensee failed to use conservative assumptions in decision-making when applying the guidance for control room fires contained in the safe-shutdown analysis H.1(b).

Enforcement.

License Condition 2.C.(10) requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4 states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility through Amendment 22 and as approved in the Safety Evaluation Report, dated May 1984, and Supplement 3, dated August 1985.

The fire protection program requirements are described in the Final Safety Analysis Report, Section 9.5.1 and Appendices 9A and 9B. Appendix 9A references Design Criterion 240.201A. Design Criterion 240.201A, Post-Fire Safe Shutdown Analysis, Revision 4, contains the assumptions that need to be made for control room fire scenarios. These assumptions include the statement that the safe-shutdown capability should not be adversely affected by any one spurious actuation or signal resulting from a fire in any plant area.

Contrary to the above, prior to November 21, 2013, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to properly calculate the amount of time available for operators to perform time critical actions. This resulted in the failure to ensure that the safe-shutdown capability would not be adversely affected by any one spurious actuation or signal resulting from a fire in the control room.

Because this violation was of very low safety significance and has been entered into the corrective action program (Condition Report CR-RBS-2013-03472), this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2013007-03, Failure to Properly Calculate the Time Available for Operator Actions.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe-shutdown analysis to verify the licensee identified the circuits that may impact the ability to achieve and maintain safe-shutdown. The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe-shutdown. The team reviewed the circuits associated with the following components:

Main Steam Isolation Valves (1B21*AOVF028A and 1B21*AOVF022A)

Shutdown Cooling Isolation High-Low Pressure Interface Valves (E12-MOVF008 and E12-MOVF009)

Residual Heat Removal Valves (RHR-6-B, 16-B, 49, 74-B, and 115-B)

Flow Transmitter Contact Control Switch Modification (1KVK*CHL1B and 1HVK*CHL1D)

Demineralization Valves associated with Post-Fire Safe-Shutdown to Isolate Feedwater (CND-MOV10A-K and CND-MOV11A-K)

Automatic Depressurization System

Safety Relief Valves

Main Steam Isolation Valves

Normal Service Water System

Control Power for Over Current Trip Protection Capability of 4kV Breakers For this sample, the team reviewed electrical elementary and block diagrams and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis.

b. Findings

Introduction.

The team identified an unresolved item associated with the isolation of post-fire safe-shutdown circuitry for control room fire scenarios. Specifically, the team identified that the licensee may not adequately isolate circuitry for the safety relief valves and the main steam isolation valves from the effects of a control room fire.

Description.

In the event of a fire in the control room, the licensee must ensure control circuitry for equipment credited for post-fire safe-shutdown is electrically isolated from the control room so that fire damage could not prevent the ability to achieve and maintain safe-shutdown conditions. For valves that are required to close or remain closed for post-fire safe-shutdown, the licensee must ensure that control room fires do not prevent the closure of the valves and do not spuriously open the valves once the control room has been isolated and control transferred from the control room to the remote shutdown panel.

Example 1: Spurious Opening of the Safety Relief Valves The alternative shutdown procedure provided steps for operators to mitigate the effects of any single spurious actuation or signal resulting from a control room fire that occurred prior to transferring control from the control room to the remote shutdown panel. For the safety relief valves, the procedure directed operators to de-energize two 125 Vdc panels (ENB-PNL02A and ENB-PNL02B) in order to ensure that the 13 non-credited safety relief valves were closed. The three credited safety relief valves were isolated from the control room via the use of transfer switches.

The team identified a concern that hot shorts in the control room could cause a spurious actuation that threatened the ability to achieve and maintain safe-shutdown conditions.

The team noted that the control room cabinets containing the safety relief valves also contained other 125 Vdc circuits that remained energized during an alternative shutdown. The team was concerned that hot shorts from one of these circuits could prevent the closure of a safety relief valve (if spuriously open) or could spuriously open the safety relief valve once the control room was isolated and control transferred from the control room to the remote shutdown panel. The team was also concerned that the safe-shutdown analysis did not analyze for one or more safety relief valves remaining open during the plant shutdown. This concern applied to the 13 safety relief valves that did not have control transferred to the remote shutdown panel.

In addition, the team noted that circuit failures could spuriously open multiple safety relief valves through the spurious actuation of the automatic depressurization system. The team was concerned that the spurious actuation of the automatic depressurization system could be considered a single spurious actuation or signal that fell within the bounds of the safe-shutdown analysis. A similar concern was first identified during the 1997 fire protection functional inspection and documented in Inspection Reports97-201 and 98-16.

Example 2: Spurious Opening of the Main Steam Isolation Valves As noted in the previous example, the alternative shutdown procedure provided steps for operators to mitigate the effects of any single spurious actuation or signal resulting from a control room fire that occurred prior to transferring control from the control room to the remote shutdown panel. For the main steam isolation valves, the procedure directed operators to attempt to close the main steam isolation valves inside the control room and then de-energize the reactor protection system motor generator sets outside the control room. The reactor protection system provides power to the circuitry for the main steam isolation valve solenoids. When the solenoids are de-energized, the main steam isolation valves fail closed.

The team identified a concern that hot shorts in the control room could cause spurious actuations that threatened the ability to achieve and maintain safe-shutdown conditions.

Specifically, the team identified that a portion of the trip logic circuitry was connected in the control room to the portion of the circuitry that energizes the solenoid valve for each main steam isolation valve. The trip logic circuitry was located downstream of where the reactor protection system bus was de-energized, and it did not contain a protective circuit device such as fusing or open contacts that would isolate the trip logic portion of the circuitry from the solenoid valve. The control room cabinet containing the trip logic circuitry also contained other 125 Vdc circuits that remained energized during an alternative shutdown.

The team was concerned that hot shorts from these circuits could prevent the closure of the main steam isolation valves or could spuriously open the main steam isolation valves after the reactor protection system motor generator sets were de-energized. The team noted that one main steam isolation valve, either inboard or outboard, must close and remain closed in order to maintain inventory.

The licensee entered these issues into the corrective action program as Condition Report CR-RBS-2013-03473. The team determined that additional inspection is required to determine if a performance deficiency exists. This issue of concern is being treated as an Unresolved Item URI 05000458/2013007-04, Unresolved Item Associated with the Isolation of the Alternative Shutdown System.

.07 Communications

a. Inspection Scope

The team inspected the contents of designated emergency storage lockers and reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified

the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with the system engineer.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to ensure that the communications systems would work under all postulated control room fire scenarios.

Description.

The safe-shutdown analysis described the four permanent communications systems installed in the plant that operators could use when responding to a fire in the plant. These systems included the plant paging system, radios, telephones, and a portable intercom jack system.

For a fire in the control room, the safe-shutdown analysis assumed the plant paging system would be lost because system power originated from the control room. The analysis credited the remote shutdown panel room telephone as the primary communication method and the portable intercom jack system as the backup communication method. The analysis stated that the intercom jack system required the use of switching equipment located in the auxiliary control room. The analysis also stated that the distributed antenna system was not routed through the main control room and would be unaffected by a control room fire. In particular, the analysis stated that portable radios could still be used for communication between the remote shutdown panel room and any plant location (except the control room or inside containment) in this event.

During a control room walkdown, the team identified that a breaker for the radio system shared the same cabinet as the breaker for the plant paging system. Based on discussions with site communications personnel, the team concluded that a fire in this cabinet could result in a loss of both the plant paging system and the radio system in the control building. The team also noted that the portable intercom jack system required additional equipment to use that was not staged at the remote shutdown panel and operators did not obtain the equipment required for the intercom system during the timed alternative shutdown walkdowns.

The team questioned whether a control room fire could affect the licensees telephone system. In response to the teams question, the licensee discovered that the telephones in the remote shutdown panel rooms did not work. The licensee returned the telephones to service on April 24, 2013.

The licensee subsequently determined that the phones were disconnected by Entergy Telecom on May 10, 2012, prior to an upgrade of the site telephone system. The team determined that the licensee failed to verify that emergency phone lines (including the phones in the remote shutdown panel rooms) were not included on the list of phones to be disabled. Further, the licensee did not have an onsite oversight process for Entergy Telecom.

The licensee entered this issue into their corrective action program. The licensee implemented a corrective action for this issue by returning the telephones to service on April 24, 2013.

Analysis.

The failure to ensure that the communications systems would work under all postulated control room fire scenarios was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

Because the River Bend Station control room included the plant instrumentation and relay cabinets for Divisions I and II, the senior reactor analyst added a generic fire ignition frequency for the relay room (FIFIR) to the control room fire ignition frequency (FIFCR) listed in the Individual Plant Examination for External Events. The analyst multiplied the combined fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming a 2-minute detection that required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = (FIFCR + FIFIR)

SF

NPCRE

= (9.50E-3/yr + 1.42E-3/yr)

0.2

1.30E-2

= 2.84E-5/yr The control room had a total of 109 electrical and control cabinets. The analyst determined that a fire in one of these cabinets could disable the plant paging system and the radio system in the control building. The analyst calculated a bounding change in core damage frequency for the finding (CDFFIRE-COM) by multiplying the control room evacuation frequency by the fraction of panels containing the affected circuits.

CDFFIRE-COM = FCR-EVAC

1 / 109

= 2.84E-5/yr

0.0092

= 2.61E-7/yr This frequency was considered to be bounding since it assumed:

Fire damage in the applicable cabinet would create circuit faults such that the plant paging system and the radio system in the control building were disabled,

The conditional core damage probability given a control room fire with evacuation and the loss of the plant paging system and radio system in the control building was equal to one, and

The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004, the senior reactor analyst screened the finding for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7.

Based on the guidance in Appendix H, the issue represented a Type A finding because the finding influenced the likelihood of accidents leading to core damage. As documented in Appendix H, Table 5.1, accident sequences that lead to large early release frequency for boiling water reactors with Mark III containment include high pressure transient events.

The analyst utilized the plant-specific standardized plant analysis risk model and determined that most of the sequences involving control room evacuation with a lack of communications devices to assist operators in stabilizing the plant resulted in the reactor coolant system being at high pressure at the time of vessel breach. Using Table 5.2, Phase 2 Assessment Factors - Type A Findings at Full Power, the analyst selected a large early release frequency factor of 0.2 for these sequences.

The sum of the large early release frequency score as stated in Step 3.2, LERF Significance Evaluation, was then quantified. The change in large early release frequency was estimated to be 5.22E-08. This value agrees with the result of the change in core damage frequency evaluation that the finding was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human Performance area because the licensee failed to ensure supervisory and management oversight of work activities, including contractors, such that nuclear safety was supported H.4(c).

Enforcement.

License Condition 2.C.(10) requires that the licensee comply with the requirements of their fire protection program as specified in Attachment 4. Attachment 4 states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility through Amendment 22 and as approved in the Safety Evaluation Report, dated May 1984, and Supplement 3, dated August 1985.

The fire protection program requirements are described in the Final Safety Analysis Report, Section 9.5.1 and Appendices 9A and 9B. Appendix 9A references Design Criterion 240.201A. Design Criterion 240.201A, Post-Fire Safe-Shutdown Analysis, Revision 4, describes the permanent communications systems installed in the plant.

These systems include the plant paging system, radios, telephones, and a portable intercom jack system.

The safe-shutdown analysis credits the remote shutdown panel room telephone as the primary communication method and the portable intercom jack system as the backup communication method. Contrary to the above, from May 10, 2012, to April 24, 2013, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to ensure that the communications systems would work under all postulated control room fire scenarios.

Because this violation was of very low safety significance and has been entered into the corrective action program (Condition Reports CR-RBS-2013-03243 and CR-RBS-2013-03397), this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2013007-05, Failure to Maintain Communication Systems Required for Alternative Shutdown Scenarios.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walkdown of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

Introduction.

The team identified a Green finding for the failure to properly implement the engineering change process. Specifically, the licensee failed to update the Maintenance Rule program and perform the required preventive maintenance tasks after the addition of three 8-hour Appendix R emergency lights. During subsequent discharge testing, two of the three lights failed.

Description.

On June 30, 2008, the licensee approved Engineering Change 4026, which was developed to add three emergency lights to the population of 8-hour Appendix R emergency lights. On July 2, 2008, the three emergency lights were added to the list of Appendix R emergency lights in the safe-shutdown analysis and the emergency light drawings. Procedure EN-DC-115, Engineering Change Process, Revision 5, 9.4, Detailed Impact Screening Criteria, required the responsible engineer to review the engineering change for impacts to the Maintenance Rule and preventative maintenance programs.

The team identified that the licensee failed to include the three emergency lights in the Maintenance Rule program, even though the Appendix R emergency lighting system was within the scope of the licensees Maintenance Rule program. The team reviewed Engineering Change 4026 and noted that the responsible engineer considered the

Maintenance Rule aspects of the change, but concluded that the Maintenance Rule program was not impacted. A reviewer commented on this issue to ensure the Maintenance Rule program included the three emergency lights. This comment was resolved with a similar statement that the Maintenance Rule program was not impacted.

The team concluded that the Maintenance Rule program was impacted, and the licensee should have included the three additional lights into the program.

The team also identified that the licensee failed to implement the required preventive maintenance tasks for the three emergency lights. The team noted that the licensee identified an impact to the preventive maintenance program during the screening for Engineering Change 4026. The licensee issued Action Request 34967 to add the three emergency lights to the Appendix R lighting preventive maintenance tasks for monthly functional testing, annual inspection, and battery replacement. This action request was approved and marked as completed on November 23, 2009.

On August 2, 2011, an engineering contractor, who had previously been a program engineer at the station, discovered that the emergency lights were added to the preventive maintenance task for battery replacement, but not to the monthly functional testing or annual inspection tasks. The action request had been in the engineers task inbox when he retired and had not been transferred to another owner following his departure. The contractor corrected the condition by issuing a second action request, Action Request 126683, but failed to write a condition report for the deficiency. Action Request 126683 was not completed prior to the inspection.

The three emergency lights were added to the battery replacement preventive maintenance task, but their batteries were not replaced as the preventive maintenance task change occurred after the last performance of the task. The licensee last tested the three lights on January 4, 2012, via the non-Appendix R emergency light preventive maintenance task. This functional test ensured that the lights worked for a short duration, but did not ensure the lights worked for the required 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In response to the teams concerns, the licensee tested the three emergency lights and discovered that one light did not work, one light worked for approximately 5 minutes, and one light met the 8-hour lighting requirement.

The licensee entered this issue into their corrective action program. The licensee implemented corrective actions for this issue by including the emergency lights in the monthly functional testing and annual inspection tasks and including the emergency lights in the Maintenance Rule program.

Analysis.

The failure to properly implement the engineering change process was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe-shutdown conditions in case of a fire. The team assigned the finding to the post-fire safe-shutdown category since it impacted the remote shutdown and control room abandonment element.

The team assigned the finding a low degradation rating since the ability to reach and maintain safe-shutdown conditions in the event of a control room fire would be minimally impacted by the failure of the three emergency lights to function for 8-hours.

Specifically, the team determined that the alternative shutdown procedure provided operators with an alternate method of verifying that the emergency diesel generator breaker was closed. Because this finding had a low degradation rating, it screened as having very low safety significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

Enforcement.

This finding does not involve enforcement action because no violation of a regulatory requirement was identified. The licensee entered this finding into the corrective action program as Condition Reports CR-RBS-2013-03118 and CR-RBS-2013-03273. Because this finding did not involve a violation and was of very low safety significance, it is identified as FIN 05000458/2013007-06, Failure to Implement the Engineering Change Process for Appendix R Lighting.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe-shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, and electrical devices providing safe-shutdown functions).

The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

The team reviewed operator manual actions credited for achieving hot shutdown for fires that do not require an alternative shutdown. The team verified that operators could reasonably be expected to perform the actions within the applicable shutdown time requirements. The team reviewed these operator manual actions using the guidance

contained in NUREG-1852, Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire, dated October 2007.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed changes to the approved fire protection program. The team verified that the changes did not constitute an adverse effect on the ability to safely shutdown.

The team also reviewed a modification the licensee made to the reactor recirculation pumps oil system for impact on the approved fire protection program.

b. Findings

No findings were identified.

.12 B.5.b Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by Section B.5.b of the Interim Compensatory Measures Order, EA-02-026, dated February 25, 2002, and 10 CFR 50.54(hh)(2).

The team verified that the licensee maintained and implemented adequate procedures, maintained and tested the equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the off-site ability to obtain fuel for the portable pump and foam used for firefighting efforts. The strategies and procedures selected for this inspection sample included:

OSP-0066, Extensive Damage Mitigation Procedure, Revision 21, 12, Electrical Power Restoration Methods to Support Mitigation Strategies

OSP-0066, Extensive Damage Mitigation Procedure, Revision 21, 19, Miscellaneous Strategies, Step 1.4, Emergency Makeup Water Addition to Emergency Diesel Generator Jacket Water Two B.5.b mitigating strategy samples were completed.

b. Findings

No findings were identified.

OTHER ACTIVITIES

[OA]

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

No findings were identified.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the preliminary inspection results to Mr. E. Olson and other members of the licensee staff at a debrief meeting on May 3, 2013. The team presented updated inspection results to Mr. T. Evans and other members of the licensee staff during a telephonic meeting on November 21, 2013. The team presented the final inspection results to Mr. T. Evans and other members of the licensee staff during a telephonic exit meeting on December 30, 2013. The licensee acknowledged the findings presented.

The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

4OA7 Licensee-Identified Violations

None ATTACHMENT:

SUPPLEMENTAL INFORMATION

- 35 - Enclosure 2