IR 05000458/2016007

NRC Triennial Fire Protection Inspection Report 05000458/2016007

ML16153A442
Person / Time
Site:	River Bend
Issue date:	06/01/2016
From:	Greg Werner NRC/RGN-IV/DRS/EB-2
To:	Maguire W Entergy Operations
References
IR 2016007
Download: ML16153A442 (42)

Text

June 1, 2016

SUBJECT:

RIVER BEND STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION REPORT 05000458/2016007

Dear Mr. Maguire:

On April 28, 2016, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at your River Bend Station and discussed the results of this inspection with you and other members of your staff. Inspectors documented the results of this inspection in the enclosed inspection report.

NRC inspectors documented three findings of very low safety significance (Green) in this report.

Two of these findings involved violations of NRC requirements. The NRC is treating these violations as non-cited violations consistent with Section 2.3.2.a of the Enforcement Policy.

NRC inspectors also documented one finding of very low safety significance (Green) in this report that did not involve a violation of NRC requirements.

If you contest the violations or significance of the violations in this report, you should provide a written response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC resident inspector at the River Bend Station.

If you disagree with a finding not associated with a regulatory requirement in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the River Bend Station.

In accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding, of the NRC's Rules of Practice and Procedure, a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRCs Public Document Room or from the Publicly Available Records (PARS)

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION IV

1600 E. LAMAR BLVD.

ARLINGTON, TX 76011-4511 component of the NRC's Agencywide Documents Access and Management System (ADAMS).

ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Gregory E. Werner, Chief Engineering Branch 2 Division of Reactor Safety

Docket No. 50-458 License No. NPF-47

Enclosure:

Inspection Report 05000458/2016007 w/Attachment: Supplemental Information

REGION IV==

Docket:

50-458 License:

NPF-47 Report Nos.:

05000458/2016007 Licensee:

Entergy Operations, Inc.

Facility:

River Bend Station Location:

5485 U.S. Highway 61N St. Francisville, LA 70775 Dates:

April 11 through April 28, 2016 Team Leader:

S. Graves, Senior Reactor Inspector, Engineering Branch 2 Inspectors:

G. Pick, Senior Reactor Inspector, Engineering Branch 2 S. Alferink, Reactor Inspector, Engineering Branch 2 E. Uribe, Project Engineer, Inspection Program and Assessment Team Approved By:

Gregory E. Werner Chief, Engineering Branch 2 Division of Reactor Safety

- 2 -

SUMMARY

IR 05000458/2016007; 04/11/2016 - 04/28/2016; River Bend Station; Fire Protection (Triennial).

This report covers a two-week triennial fire protection team inspection by specialist inspectors from Region IV. Three findings, two of which were non-cited violations, are documented. The significance of inspection findings is indicated by their color (i.e., Green, White, Yellow, or Red)and determined using Inspection Manual Chapter 0609, Significance Determination Process, dated April 29, 2015. Cross-cutting aspects are determined using Inspection Manual Chapter 0310, Aspects within the Cross-Cutting Areas, dated December 4, 2014. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy, dated February 4, 2015. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process,

Revision 5.

Cornerstone: Mitigating Systems

Green.

The team identified a non-cited violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of their approved fire protection program. Specifically, the licensees fire protection program surveillance testing procedure for the fire main yard loop did not include appropriate guidance to properly flow test all portions of the underground fire main yard loop to buildings that contained fire safe shutdown equipment. The licensee entered this deficiency into their corrective action program as Condition Report CR-RBS-2016-03212 and initiated actions to correct the procedure and perform the flow testing.

The failure to ensure that fire protection program Surveillance Test Procedure STP-251-3700, Fire System Yard Water Suppression Loop Flow Test,

Revision 10, included requirements to functionally test all individual underground firewater flow paths to structures that contained fire safe shutdown components was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external factors (fire) attribute of the Mitigating Systems Cornerstone and adversely affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding was screened in accordance with NRC Inspection Manual Chapter 0609,

Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. The team determined that an Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, review was required because the finding affected the fire water supply system. Using Inspection Manual Chapter 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013, the finding was screened as a Green finding of very low safety significance in accordance with Task 1.4.7, Fire Water Supply, Question A. Since the subject fire main yard loops had not been flow tested since initial testing, and nothing caused the licensee to reevaluate the testing procedure, the team determined that this failure did not reflect current performance, and no cross-cutting aspect was assigned. (Section 1R05.03.b)

Green.

The team identified a non-cited violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the team identified two examples where the licensee failed to isolate control circuits for safe shutdown equipment to ensure independence from the effects of a fire in the control room. As immediate compensatory measures the licensee performed visual inspections of the affected cabinets for unacceptable fire hazards and issued Standing Order 323 to reinforce the need for operators to identify and prevent fire hazards while in the control room.

The licensee entered this issue into their corrective action program as Condition Reports CR-RBS-2016-02953 and CR-RBS-2016-03264.

The failure to isolate control circuits for safe shutdown equipment from the effects of a control room fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation and determined the issue was of very low safety significance (Green). This finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago. (Section 1R05.06.b)

Green.

The team identified a finding for the failure to provide an adequate monitoring and testing program to demonstrate that the required Appendix R emergency lights satisfied the licensees maintenance rule performance criteria.

Specifically, the failure to provide an adequate monitoring and testing program could result in a large number of Appendix R emergency lights failing to last the required 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> without being detected. The team determined that, because the licensee had changed their program to a biennial replacement frequency for the 8-hour batteries, reasonable assurance existed that the lights would function long enough for operators to perform the time critical manual actions directed by their fire protection program. The licensee entered this finding into their corrective action program as Condition Report CR-RBS-2016-03177.

The failure to establish an adequate monitoring and testing program to demonstrate that the required Appendix R emergency lights would satisfy the licensees maintenance rule performance criteria was a performance deficiency. The performance deficiency was more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the failure to provide an adequate monitoring and testing program could result in a large number of Appendix R emergency lights failing to function for the required 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> without being detected through licensee monitoring and testing. The team determined this finding affected the Mitigating Systems Cornerstone. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated February 28, 2005, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. The team assigned the finding to the post-fire safe shutdown category since it impacted the remote shutdown and control room abandonment element. The team assigned the finding a low degradation rating since the ability to reach and maintain safe shutdown conditions in the event of a control room fire would be minimally impacted by the potential failure of the emergency lights to function for 8-hours. Because this finding had a low degradation rating, it screened as having very low safety significance (Green) in Task 1.3.1. The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

Specifically, the licensee began performing the 8-hour discharge test on a small sample of the batteries more than three years ago. (Section 1R05.08.b)

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection

This report presents the results of a triennial fire protection inspection conducted at River Bend Station in accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), dated January 31, 2013. The inspection team evaluated the implementation of the approved fire protection program in selected risk-significant areas with an emphasis on the procedures, equipment, fire barriers, and systems that ensure the post-fire capability to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas and one or more mitigating strategies for review. The inspection team used the fire hazards analysis section of the River Bend Station Individual Plant Examination of External Events to select the following three risk-significant fire areas (inspection samples) for review:

• Fire Area AB-15, Zone 4 Auxiliary Building - East Side Crescent, 141 Level

• Fire Area C-22 Control Building - High Pressure Core Spray Switchgear Room

• Fire Area DG-5 Division III Diesel Generator Room

The inspection team evaluated the licensees fire protection program using the applicable requirements, which included plant Technical Specifications, Operating License Condition 2.C.(10), NRC safety evaluations, 10 CFR 50.48, Fire Protection, and Branch Technical Position 9.5-1. The team also reviewed related documents that included the Updated Safety Analysis Report (USAR), Section 9.5; the fire hazards analysis; and the post-fire safe shutdown analysis. Specific documents reviewed by the team are listed in the attachment.

Three fire area inspection samples and one mitigating strategy sample was completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed piping and instrumentation diagrams, safe shutdown equipment list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to verify that the licensee properly identified the components and systems necessary to achieve and maintain safe shutdown conditions for fires in the selected fire areas. The team observed walkdowns of the procedures used for achieving and maintaining safe shutdown in the event of a fire to verify that the procedures properly implemented the safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe shutdown cables, equipment, and components located within the same fire area. The team also reviewed the licensees method for meeting the requirements of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R, Section III.G. Specifically, the team evaluated whether at least one post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met applicable license commitments.

b. Findings

No findings were identified.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the material condition and configuration of the installed fire area boundaries (including walls, fire doors, and fire dampers) and verify that the electrical raceway fire barriers were appropriate for the fire hazards in the area. The team compared the installed configurations to the approved construction details, supporting fire tests, and applicable license commitments.

The team reviewed installation, repair, and qualification records for a sample of penetration seals to ensure the fill material possessed an appropriate fire rating and that the installation met the engineering design. The team also reviewed similar records for the rated fire wraps to ensure the material possessed an appropriate fire rating and that the installation met the engineering design.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection and suppression systems in the selected fire areas. The team verified the automatic detection systems and the manual and automatic suppression systems were installed, tested, and maintained in accordance with the National Fire Protection Association code of record or approved deviations and that each suppression system was appropriate for the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression systems in the selected fire areas. The team also performed a walkdown of major system support equipment in other areas (e.g., fire pumps, yard loop fire main water piping and valves, and Halon supply systems) to assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify that the pumps met their design requirements. The team also reviewed the halon suppression system functional tests to verify that the system capability met the design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and drill critique records. The team also reviewed pre-fire plans and smoke removal plans for the selected fire areas to determine if appropriate information was provided to fire brigade members and plant operators to identify safe shutdown equipment and instrumentation and to facilitate suppression of a fire that could impact post-fire safe shutdown capability. In addition, the team inspected fire brigade equipment to determine operational readiness for firefighting.

The team observed an unannounced fire drill and subsequent drill critique on April 27, 2016, using the guidance contained in Inspection Procedure 71111.05AQ, Fire Protection Annual/Quarterly, dated September 30, 2010. The team observed fire brigade members fight a simulated fire in Fire Area C-9, Cable Chase III. The team verified that the licensee identified problems, openly discussed them in a self-critical manner at the drill debrief, and identified appropriate corrective actions. Specific attributes evaluated were

(1) proper wearing of turnout gear and self-contained breathing apparatus;

(2) proper use and layout of fire hoses;

(3) employment of appropriate firefighting techniques;

(4) sufficient firefighting equipment was brought to the scene;

(5) effectiveness of fire brigade leader communications, command, and control;

(6) search for victims and propagation of the fire into other areas;

(7) smoke removal operations;

(8) utilization of pre-planned strategies;

(9) adherence to the pre-planned drill scenario; and

(10) drill objectives.

b. Findings

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of their approved fire protection program. Specifically, the licensees fire protection program surveillance testing procedure for the yard water loop did not include appropriate guidance to properly flow test all portions of the underground fire main yard loop to buildings that contained fire safe shutdown equipment.

Description.

The team reviewed the method used by the licensee to test their underground fire main yard loops to ensure that they had flow tested all portions, as required by their licensing basis. Updated Safety Analysis Report, Chapter 9A.3, Degree of Compliance with Appendix A of NRC Branch Technical Position APCSB 9.5-1, Section 9A.3.4.5, Test and Test Control, specified that their test program include procedures and acceptance criteria that demonstrated conformance with design and system readiness requirements.

The licensee performed flow testing of their fire main yard loop every three years to demonstrate that the flow remained within the conditions to consider the system functional using Procedure STP-251-3700, Fire System Yard Water Suppression Loop Flow Test, Revision 10. The team determined that the licensee used this test to meet the requirements specified in Technical Requirements Manual, Surveillance Requirement TSR 3.7.9.1.18, which required the licensee to perform a flow test of the fire suppression water system in accordance with Chapter 5, Section 11, of the Fire Protection Handbook, 14th Edition, published by the National Fire Protection Association. The team determined that Chapter 5, Section 11, specified, in part, that tests be conducted in a way such that the available flow and pressure at high value or hazardous areas can be determined readily. Procedure STP-251-3700 also established acceptance criteria for what constituted acceptable performance. Specifically, the licensee would establish two different flow conditions and confirm that the appropriate corresponding pressure resulted through individual sections of their outer fire main yard loop.

The team compared the test configurations in the procedure to the underground fire main yard loops detailed in their drawings. The team identified that several of the fire main yard loop flow paths had not been individually flow tested, even though they included underground piping to structures' housing fire safe shutdown components.

Based on the licensing basis description and the specified test requirements, the team determined that the licensee had not properly flow tested all the underground fire main yard loops that provided flow to the primary and backup suppression systems that protected fire safe shutdown components. Although the subject piping sections had not been tested, the team determined that the system remained functional and did not adversely impact plant safety systems because the licensee regularly flushed several feeder main sections of the yard loop and identified no blockages, regularly performed a combination of valve testing and fire pump functional testing, and had experienced spurious actuations of tunnel deluge systems that demonstrated no flow blockage; thus, reasonable assurance existed that the system remained capable of performing its design function until the licensee could perform the revised loop flow testing. The licensee initiated Condition Report CR-RBS-2016-03212 to document this deficiency and initiated actions to revise their flow testing process and procedure, and perform the flow testing.

Analysis.

The failure to ensure that fire protection program Surveillance Test Procedure STP-251-3700, Fire System Yard Water Suppression Loop Flow Test, Revision 10, included requirements to functionally test all individual underground firewater flow paths to structures that contain fire safe shutdown components was a performance deficiency. Specifically, the licensees fire protection program surveillance testing procedure for the fire main yard loop did not include appropriate guidance to properly flow test all portions of the underground fire main yard loop to buildings that contained fire safe shutdown equipment. This performance deficiency was more than minor because it was associated with the protection against external factors attribute (fire) and adversely affected the Mitigating Systems Cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to test all portions of the underground fire main yard loops affected the ability to demonstrate the continued capability to deliver adequate flow and pressure to the fire suppression systems serving post fire safe shutdown equipment.

The finding was screened in accordance with NRC Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, dated June 19, 2012. The team determined that an Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, review was required as the finding affected the fire water supply system. Using Inspection Manual Chapter 0609, Appendix F, Attachment 1, Fire Protection Significance Determination Process Worksheet, dated September 20, 2013, the finding was screened as a Green finding of very low safety significance in accordance with Task 1.4.7, Fire Water Supply, Question A. The team determined that although the licensee failed to test all portions of the yard main loop in accordance with code requirements, at least 50 percent of required fire water capacity would be available because the flow testing was done with only one fire pump in service and two additional pumps were available. Since all fire main yard loops had not been flow tested since initial testing and nothing caused the licensee to reevaluate the test, the team determined that this failure did not reflect current performance and no cross-cutting aspect was assigned.

Enforcement.

License Condition 2.C.(10) specifies, EOI shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility through Amendment 22 and as approved in the SER dated May 1984 and Supplement 3 dated August 1985. Updated Safety Analysis Report, Chapter 9A.3, Degree of Compliance with Appendix A of NRC Branch Technical Position APCSB 9.5-1, Section 9A.3.4.5, Test and Test Control, specified that their test program include procedures and acceptance criteria that demonstrates conformance with design and system readiness requirements. Technical Requirements Manual Surveillance Requirement TSR 3.7.9.1.18 required the licensee to perform a flow test of the fire suppression water system in accordance with Chapter 5, Section 11, of the Fire Protection Handbook, 14th Edition, published by the National Fire Protection Association every 3 years. Chapter 5, Section 11, specified, in part, that tests should be conducted in such a way that the available flow and pressure at high value or hazardous areas can be determined readily. Procedure STP-251-3700, Fire System Yard Water Suppression Loop Flow Test, Revision 10, specified that the test demonstrate that the flow remained above the conditions to consider the system operable.

Contrary to the above, prior to April 28, 2016, the licensee failed to meet the requirements related to testing their fire main yard loops. Specifically, the test did not demonstrate that flow remained above specified flow and pressure conditions to all the underground fire main flow paths to structures that contained post-fire safe shutdown components (i.e., high value areas).

Because this violation was of very low safety significance and has been entered into the corrective action program as Condition Report CR-RBS-2016-03212, and the licensee initiated actions to correct the procedure and perform the flow test, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2016007-01, Inadequate Loop Flow Test Procedure.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant trains of systems required for hot shutdown, which are located in the same fire area, would not be subject to damage from fire suppression activities or from the rupture or inadvertent operation of fire suppression systems. Specifically, the team verified:

• A fire in one of the selected fire areas would not directly, through production of smoke, heat, or hot gases, cause activation of suppression systems that could potentially damage all redundant safe shutdown trains

• A fire in one of the selected fire areas or the inadvertent actuation or rupture of a fire suppression system would not directly cause damage to all redundant trains (e.g., sprinkler-caused flooding of other than the locally affected train)

• Adequate drainage was provided in areas protected by water suppression systems

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology

The team reviewed the safe shutdown analysis, operating procedures, piping and instrumentation drawings, electrical drawings, the Updated Safety Analysis Report, and other supporting documents to verify that hot and cold shutdown could be achieved and maintained from outside the control room for fires that require evacuation of the control room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was consistent with the description contained in the safe shutdown and fire hazards analyses. The team focused on ensuring the adequacy of systems selected for reactivity control, reactor coolant makeup, reactor decay heat removal, process monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would remain free from fire damage. Finally, the team verified that the transfer of control from the control room to the alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for alternative shutdown control circuits).

Review of Operational Implementation

The team verified that licensed and non-licensed operators received training on alternative shutdown procedures. The team also verified that sufficient personnel to perform a safe shutdown were trained and available on-site at all times, exclusive of those assigned as fire brigade members.

The team performed a timed walk down of the alternative shutdown procedure with licensed and non-licensed operators to determine the adequacy of the procedure. The team verified that the operators could reasonably be expected to perform specific actions within the time required to maintain plant parameters within specified limits.

Time critical actions that were verified included restoring electrical power, establishing control at the remote shutdown and local shutdown panels, establishing reactor coolant makeup, and establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer capability and instrumentation and control functions to verify that the tests were adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

No findings were identified.

.06 Circuit Analysis

a. Inspection Scope

The team reviewed the post-fire safe shutdown analysis to verify that the licensee identified the circuits that may impact the ability to achieve and maintain safe shutdown.

The team verified, on a sample basis, that the licensee properly identified the cables for equipment required to achieve and maintain hot shutdown conditions in the event of a fire in the selected fire areas. The team verified that these cables were either adequately protected from the potentially adverse effects of fire damage or were analyzed to show that fire-induced circuit faults (e.g., hot shorts, open circuits, and shorts to ground) would not prevent safe shutdown.

The teams evaluation focused on the cables of selected components from the safety relief valve system, main steam isolation valve system, high pressure core spray system, standby service water system, control building chilled water system, and the condensate storage tank bypass valves. For the sample of components selected, the team reviewed electrical elementary and block diagrams and identified power, control, and instrument cables necessary to support their operation. In addition, the team reviewed cable routing information to verify that fire protection features were in place as needed to satisfy the separation requirements specified in the fire protection license basis. Specific components reviewed by the team are listed in the attachment.

b. Findings

On January 2, 2014, the triennial fire protection inspection team identified a concern with the isolation of post-fire safe shutdown circuits during control room fire scenarios and identified this issues as Unresolved Item 2013007-04 (ML14142A184). Specifically, the team was concerned that the licensee may not isolate control circuits for the safety relief valves and the main steam isolation valves from the effects of a control room fire. The team reviewed this unresolved item during this inspection and identified that a violation of NRC requirements had occurred.

Introduction.

The team identified a Green non-cited violation of License Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the team identified two examples where the licensee failed to isolate control circuits for safe shutdown equipment to ensure independence from the effects of a fire in the control room.

Description.

River Bend Station received its operating license on August 29, 1985.

Since the license was issued after January 1, 1979, the license application was reviewed by the NRC staff using the applicable technical guidance contained in the Standard Review Plan (NUREG-0800), Section 9.5.1, dated July 1981. This guidance contained Regulatory Positions C.5.c.3 and C.5.c.6, which provided the following criteria for alternative or dedicated shutdown capability:

• The shutdown capability for specific fire areas may be unique for each such area, or it may be one unique combination of systems for all such areas. In either case, the alternative shutdown capability shall be independent of the specific fire area(s) and shall accommodate post-fire conditions where offsite power is available and where offsite power is not available for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Procedures shall be in effect to implement this capability.

• The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown.

These criteria are identical to the requirements of 10 CFR Part 50, Appendix R, Sections III.L.3 and III.L.7, which are applicable to plants licensed prior to January 1, 1979. The team noted that these criteria use plural language for describing circuit failures (i.e., hot shorts, open circuits, or shorts to ground).

The plants safe shutdown requirements were provided through License Condition 2.C.(10) of the operating license. This condition states that the licensee shall comply with the requirements of the fire protection program as specified in Attachment 4 of the operating license. Attachment 4 of the operating license states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility through Amendment 22 and as approved in the Safety Evaluation Report, dated May 1984 and Supplement 3, dated August 1985.

On October 20, 1981, the NRC requested a comparison of the licensees fire protection program to the requirements in 10 CFR Part 50, Appendix R. The licensee provided this comparison in Appendix B of the Final Safety Analysis Report. The licensee provided a list of deviations from the safe shutdown requirements in 10 CFR Part 50, Appendix R, Section III.G in Appendix A of the Final Safety Analysis Report (Section 9A.2.3.4). The licensee identified six deviations, but none were associated with the control room (Fire Area C-25) or the safe shutdown requirements for an alternative shutdown.

The NRC approved the licensees fire protection program in the Safety Evaluation Report (NUREG-0989), dated May 1984, and Supplement 3 of the Safety Evaluation Report, dated August 1985. In Supplement 3, the staff concluded that the licensees fire protection program, with approved deviations, was in conformance with the guidelines of Branch Technical Position CMEB 9.5-1; Sections III.G, III.J, and III.O of 10 CFR Part 50, Appendix R; and General Design Criterion 3, and was therefore acceptable.

Based on the plants licensing basis, the licensee was required to meet the technical requirements of 10 CFR Part 50, Section III.G and Section III.L, for an alternative shutdown with no deviations. Therefore, the licensee was required to ensure that control circuits for safe shutdown equipment were independent of and electrically isolated from the control room so that fire damage would not prevent the ability to achieve and maintain safe shutdown conditions during an alternative shutdown. For any valves that were required to close or remain closed for post-fire safe shutdown, the licensee was required to ensure that control room fires could not prevent the closure of the valves and could not spuriously open the valves once the control room had been isolated and control transferred to the remote shutdown panel. If any valves that were required to close or remain closed for post-fire safe shutdown may not close or may spuriously open due to a control room fire, this would not constitute isolation and independence from the control room.

The team identified two examples where control circuits for safe shutdown equipment were not isolated from the effects of a control room fire. The first example was associated with the spurious actuation of safety relief valves. The second example was associated with the spurious actuation of multiple main steam isolation valves.

The team reviewed the safe shutdown equipment list contained in Table C-1 of Criterion 240.201A, Appendix C, 10 CFR 50 Appendix R Post-Fire Safe Shutdown Equipment List and Logic Diagrams, and verified that all of the safety relief valves and main steam isolation valves were listed as safe shutdown equipment.

Example 1: Spurious Actuation of Safety Relief Valves

The alternative shutdown procedure was written to provide steps for operators to mitigate the effects of any single spurious actuation or signal resulting from a control room fire that occurred prior to transferring control from the control room to the remote shutdown panel. For a control room fire, the licensee transferred control to the remote shutdown panel for three credited safety relief valves and isolated the remaining 13 non-credited safety relief valves. The 13 non-credited safety relief valves were required to remain closed in order to achieve safe shutdown. To ensure the 13 non-credited safety relief valves were closed and remained closed, the alternative shutdown Procedure directed operators to de-energize two 125 Vdc panels (ENB-PNL02A and ENB-PNL02B). The three credited safety relief valves were isolated from the control room via the use of transfer switches.

In this example, the team noted that the control room cabinets containing the safety relief valve control circuits also contained other 125 Vdc circuits that remained energized during an alternative shutdown. The team determined that a fire in one of these cabinets could lead to hot shorts from one or more of these circuits, preventing the closure of a safety relief valve (if spuriously opened) or spuriously opening a safety relief valve once the control room was isolated and control transferred to the remote shutdown panel.

Example 2: Spurious Actuation of Multiple Main Steam Isolation Valves

As noted above, the alternative shutdown procedure was written to provide steps for operators to mitigate the effects of any single spurious actuation or signal resulting from a control room fire that occurred prior to transferring control to the remote shutdown panel. For the main steam isolation valves, the alternative shutdown procedure directed operators to attempt to close the main steam isolation valves inside the control room and then de-energize the reactor protection system motor generator sets outside the control room. The reactor protection system provides power to the circuits for the main steam isolation valve solenoids. When the solenoids are de-energized, the main steam isolation valves fail closed. The main steam isolation valves were required to remain closed in order to achieve safe shutdown.

In this example, the team identified that a portion of the trip logic circuit was connected in the control room to the portion of the circuit that energizes the solenoid valve for each main steam isolation valve. The trip logic circuit was located electrically downstream of where the reactor protection system bus was de-energized and it did not contain a protective circuit device, such as fusing or open contacts, that would isolate the trip logic portion of the circuit from the solenoid valve. The control room cabinet containing the trip logic circuit also contained other 120 Vac circuits that remained energized during an alternative shutdown.

The team determined that a fire could cause hot shorts from these circuits that could prevent the closure of the main steam isolation valves or could spuriously open the main steam isolation valves after the reactor protection system motor generator sets were de-energized. The team noted that one main steam isolation valve, either inboard or outboard, in each steam line must close and remain closed in order to maintain inventory for alternative shutdown.

This issue was originally documented as Unresolved Item 2013007-04 (ML14142A184).

Analysis.

The failure to isolate control circuits for safe shutdown equipment from the effects of a control room fire was a performance deficiency. The performance deficiency was more than minor because it was associated with the protection against external events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the spurious actuation of safety relief valves or the spurious actuation of multiple main steam isolation valves would adversely affect the safe shutdown equipment relied upon to achieve and maintain safe shutdown conditions.

The team determined this finding affected the Mitigating Systems Cornerstone. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk significance of this finding since it involved a postulated control room fire that led to control room evacuation.

Example 1: Spurious Actuation of Safety Relief Valves

Because the River Bend Station control room included the plant instrumentation and relay cabinets for Divisions I and II, the senior reactor analyst added a generic fire ignition frequency for the relay room (FIFIR) to the control room fire ignition frequency (FIFCR) listed in the Individual Plant Examination for External Events. The analyst multiplied the combined fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming 2 minutes for detection, and the fire required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC

=

(FIFCR + FIFIR)

• SF

• NPCRE

=

(9.50E-3/yr + 1.42E-3/yr)

• 0.2

• 1.30E-2

=

2.84E-5/yr

The control room had a total of 109 electrical and control cabinets. The analyst determined that a fire in three of these cabinets could lead to the spurious opening of the safety relief valves. The analyst calculated a bounding change in core damage frequency for the finding (CDFFIRE-SRV) by multiplying the control room evacuation frequency by the fraction of panels containing the affected circuits.

CDFFIRE-SRV =

FCR-EVAC

• 3 / 109

=

2.84E-5/yr

• 0.028

=

7.81E-7/yr This change in core damage frequency was considered to be bounding since it assumed:

• Fire damage in the applicable cabinets would create circuit faults such that at least one safety relief valve spuriously opened.

• The conditional core damage probability given a control room fire with evacuation and the spurious actuation of a safety relief valve was equal to one.

• The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004, the senior reactor analyst screened the performance deficiency for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/yr.

Given that River Bend Station has a Mark III containment, the control room evacuation scenarios of concern do not include intersystem loss of coolant accidents or station blackouts, and the control room evacuation scenarios of concern do not result in a high reactor coolant system pressure, the analyst determined that this example was not significant with respect to large early release frequency. The analyst determined this example was of very low risk significance (Green).

Example 2: Spurious Actuation of Multiple Main Steam Isolation Valves

Because the River Bend Station control room included the plant instrumentation and relay cabinets for Divisions I and II, the senior reactor analyst added a generic fire ignition frequency for the relay room (FIFIR) to the control room fire ignition frequency (FIFCR) listed in the Individual Plant Examination for External Events. The analyst multiplied the combined fire ignition frequency by a severity factor (SF) and a non-suppression probability indicating that operators failed to extinguish the fire within 20 minutes, assuming 2 minutes for detection, and the fire required a control room evacuation (NPCRE). The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC

=

(FIFCR + FIFIR)

• SF

• NPCRE

=

(9.50E-3/yr + 1.42E-3/yr)

• 0.2

• 1.30E-2

=

2.84E-5/yr

The control room had a total of 109 electrical and control cabinets. The analyst determined that a fire in two of these cabinets could lead to the spurious opening of an inboard main steam isolation valve and a fire in two other cabinets could lead to the spurious opening of an outboard main steam isolation valve. Based on the distance between the cabinets, the analyst determined that a single fire was unlikely to propagate from one set of cabinets to the other set of cabinets. The analyst calculated a bounding change in core damage frequency for the finding (CDFFIRE-MSIV) by multiplying the control room evacuation frequency by the fraction of panels containing the affected circuits and the probability that a second fire occurred within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

CDFFIRE-MSIV =

(FCR-EVAC

• 2 / 109) * (FIFCR + FIFIR)

• 1 day

=

(2.84E-5/yr

• 0.018) * (9.50E-3/yr + 1.42E-3/yr) * (1 yr / 365)

=

1.56E-11/yr

This change in core damage frequency was considered to be bounding since it assumed:

• Two independent fires occurred within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of each other. One fire caused the spurious actuation of an inboard main steam isolation valve and the other fire caused the spurious actuation of the outboard main steam isolation valve in the same steam line.

• Fire damage in any of the applicable cabinets would create circuit faults such that a main steam isolation valve spuriously opened.

• The conditional core damage probability given two independent fires within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that resulted in a control room evacuation and the spurious actuation of the inboard and outboard main steam isolation valves in the same steam line was equal to one.

• The performance deficiency accounted for the entire change in core damage frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Inspection Manual Chapter 0609, Appendix H, Containment Integrity Significance Determination Process, dated May 6, 2004, the senior reactor analyst screened the performance deficiency for its potential risk contribution to large early release frequency since the bounding change in core damage frequency provided a risk significance estimate greater than 1E-7/yr.

Given that River Bend Station has a Mark III containment, the control room evacuation scenarios of concern do not include intersystem loss of coolant accidents or station blackouts, and the control room evacuation scenarios of concern do not result in a high reactor coolant system pressure, the analyst determined that this example was not significant with respect to large early release frequency. The analyst determined this example was of very low risk significance (Green).

The analyst calculated an overall change in core damage frequency for the finding by adding the change in core damage frequency for each example. The overall change in core damage frequency for the finding was determined to be 7.81E-7/yr. Therefore, the analyst determined this finding was of very low risk significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

Enforcement.

License Condition 2.C.(10) requires the licensee to comply with the requirements of the fire protection program as specified in Attachment 4 of the operating license. Attachment 4 of the operating license states, in part, that the licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility through Amendment 22 and as approved in the Safety Evaluation Report, dated May 1984, and Supplement 3, dated August 1985.

Supplement 3 of the Safety Evaluation Report states, in part, that the licensees fire protection program with approved deviations was in conformance with the guidelines of Branch Technical Position CMEB 9.5-1; Sections III.G, III.J, and III.O, of Appendix R to 10 CFR 50; and General Design Criterion 3, and was, therefore, acceptable.

Branch Technical Position CMEB 9.5-1 and 10 CFR Part 50, Appendix R, Section III.L.7, state:

The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown.

Contrary to the above, prior to April 28, 2016, the licensee failed to implement and maintain in effect all provisions of the approved fire protection program. Specifically, the licensee failed to ensure that the safety relief valves and main steam isolation valves, which are considered safe shutdown equipment, were isolated from associated non-safety circuits in the control room fire area so that hot shorts, open circuits, or shorts to ground caused by a postulated fire in the associated circuits would not prevent safe shutdown.

The licensee entered this issue into the corrective action program as Condition Reports CR-RBS-2016-02953 and CR-RBS-2016-03264. As immediate compensatory measures to ensure that no immediate safety concern existed, the licensee performed a visual inspection of the affected cabinets for unacceptable fire hazards and issued Standing Order 323 to reinforce the need for operators to identify and prevent fire hazards while in the control room. Because this violation was of very low safety significance and has been entered into the licensees corrective action, this violation is being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC Enforcement Policy: NCV 05000458/2016007-02, Failure to Isolate Control Circuits for Safe Shutdown Equipment from the Effects of a Control Room Fire.

.07 Communications

a. Inspection Scope

The team reviewed the alternative shutdown procedure to verify that portable radio communications and fixed emergency communications systems were available, operable, and adequate for the performance of designated activities. The team verified the capability of the communication systems to support the operators in the conduct and coordination of their required actions. The team also verified that the design and location of communications equipment such as repeaters and transmitters would not cause a loss of communications during a fire. The team discussed system design, testing, and maintenance with engineering.

b. Findings

No findings were identified.

.08 Emergency Lighting

a. Inspection Scope

The team reviewed the portion of the emergency lighting system required for alternative shutdown to verify that it was adequate to support the performance of manual actions required to achieve and maintain hot shutdown conditions and to illuminate access and egress routes to the areas where manual actions would be required. The team evaluated the locations and positioning of the emergency lights during a walk down of the alternative shutdown procedure.

The team verified that the licensee installed emergency lights with an 8-hour capacity, maintained the emergency light batteries in accordance with manufacturer recommendations, and tested and performed maintenance in accordance with plant procedures and industry practices.

b. Findings

Introduction.

The team identified a Green finding for the failure to provide an adequate monitoring and testing program to demonstrate that the Appendix R emergency lights satisfied the licensees maintenance rule performance criteria.

Description.

On December 17, 2014, the licensee changed their maintenance program for the Appendix R emergency lights to replace all of the batteries on a biennial frequency. The licensee maintained the existing monitoring and testing program for the Appendix R emergency lights, which included a quarterly functional test and an 8-hour discharge test of a small sample of the batteries that were removed at the end of their life. For the 8-hour discharge test, the licensee tested batteries that were removed from 18 predetermined locations.

Since the maintenance program was changed, the licensee performed an 8-hour discharge test on nine batteries. Four of these batteries failed the discharge test, corresponding to a failure rate over 40 percent.

The team reviewed the licensees maintenance rule program and noted that it included the 8-hour capacity of the Appendix R emergency lights into the system performance criteria. Specifically, the licensee specified that the failure rate for the system should be no more than 10 percent of the total Appendix R emergency light population over a rolling 12 month period.

The team determined that the quarterly functional tests for the Appendix R emergency lights were sufficient to detect gross failures of the lights (i.e., lamp failures or charging card failures), but were insufficient to detect failures of the batteries to last 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Specifically, the team concluded the monitoring and testing program was inadequate to detect if greater than 10 percent of the total population of Appendix R emergency lights could provide initial illumination but could not provide illumination for the full 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

The monitoring and testing program was insufficient because it only examined a sample of batteries that were replaced and there was a high probability that the tests would fail to detect a failure rate greater than 10 percent. The total population of Appendix R emergency lights was 124 lights. By testing 18 batteries, the licensee tested approximately 15 percent of the total population over a two-year period. Using simplifying assumptions that 13 batteries could provide initial illumination but could not last the required 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (slightly more than 10 percent of the total population),18 batteries were randomly selected from the total battery population, and all 18 batteries were tested within a single year, the team determined the probability that the licensee would detect the failure rate (i.e., the probability that the licensee would observe all 13 failures) was 6.2E-14.

Analysis.

The failure to provide an adequate monitoring and testing program to demonstrate that the Appendix R emergency lights satisfied their maintenance rule performance criteria was a performance deficiency. The performance deficiency was more than minor because if left uncorrected, the performance deficiency would have the potential to lead to a more significant safety concern. Specifically, the failure to provide an adequate monitoring and testing program could result in a large number of Appendix R emergency lights failing to last the required 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> without being detected.

The team determined this finding affected the Mitigating Systems Cornerstone. The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, dated September 20, 2013, because it affected the ability to reach and maintain safe shutdown conditions in case of a fire. The team assigned the finding to the post-fire safe shutdown category since it impacted the remote shutdown and control room abandonment element.

Using Inspection Manual Chapter 0609, Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection Program Elements, dated February 28, 2005, the team assigned the finding a low degradation rating since the ability to reach and maintain safe shutdown conditions in the event of a control room fire would be minimally impacted by the potential failure of the emergency lights to function for 8-hours. Specifically, the team determined that the change to a biennial replacement frequency for the batteries was a minor deficiency and there was reasonable assurance that the lights would function long enough for operators to perform the time critical manual actions. In addition, the team determined that operators routinely carried flashlights, which would help in the performance of the time critical manual actions in the event that the Appendix R emergency lights did not function. Because this finding had a low degradation rating, it screened as having very low safety significance (Green) in Task 1.3.1.

The finding did not have a cross-cutting aspect since it was not indicative of present performance in that the performance deficiency occurred more than three years ago.

Specifically, the licensee began performing the 8-hour discharge test on a small sample of the batteries more than three years ago.

Enforcement.

The team did not identify a violation of a regulatory requirement associated with this finding. The licensee entered this finding into the corrective action program as Condition Report CR-RBS-2016-03177. Because this finding did not involve a violation of regulatory requirements and was of very low safety significance, it is identified as FIN 05000458/2016007-03, Failure to Demonstrate that Appendix R Emergency Lights Satisfied their Maintenance Rule Performance Criteria.

.09 Cold Shutdown Repairs

a. Inspection Scope

The team verified that the licensee identified repairs needed to reach and maintain cold shutdown and had dedicated repair procedures, equipment, and materials to accomplish these repairs. Using these procedures, the team evaluated whether these components could be repaired in time to bring the plant to cold shutdown within the time frames specified in their design and licensing bases. The team verified that the repair equipment, components, tools, and materials needed for the repairs were available and accessible on site.

b. Findings

No findings were identified.

.10 Compensatory Measures

a. Inspection Scope

The team verified that compensatory measures were implemented for out-of-service, degraded, or inoperable fire protection and post-fire safe shutdown equipment, systems, or features (e.g., detection and suppression systems and equipment; passive fire barriers; or pumps, valves, or electrical devices providing safe shutdown functions). The team also verified that the short-term compensatory measures compensated for the degraded function or feature until appropriate corrective action could be taken and that the licensee was effective in returning the equipment to service in a reasonable period of time.

The team reviewed operator manual actions credited for achieving hot shutdown for fires that do not require an alternative shutdown. The team verified that operators could reasonably be expected to perform the actions within the applicable shutdown time requirements. The team reviewed these operator manual actions using the guidance contained in NUREG-1852, Demonstrating the Feasibility and Reliability of Operator Manual Actions in Response to Fire, dated October 2007.

For the train of systems necessary to achieve and maintain hot shutdown conditions, the team verified that the licensee treated these manual actions as compensatory measures while appropriate corrective actions are implemented or while preparations are made by the licensee to submit exemptions or deviations. For components important to safe shutdown that could adversely affect the safe shutdown capability, the team verified that operators could reasonably be expected to perform the actions within the applicable shutdown time requirements.

b. Findings

No findings were identified.

.11 Review and Documentation of Fire Protection Program Changes

a. Inspection Scope

The team reviewed changes to the approved fire protection program made since the last inspection in January 2014. The team verified that the changes did not constitute an adverse effect on the ability to safely shutdown.

b. Findings

No findings were identified.

.12 Control of Transient Combustibles and Ignition Sources

a. Inspection Scope

The team reviewed the licensees approved fire protection program, implementing procedures, and programs for the control of ignition sources and transient combustibles.

The team assessed the licensees effectiveness in preventing fires and in controlling combustible loading within limits established in the fire hazards analysis. The team performed plant walkdowns to independently verify that transient combustibles and ignition sources were being properly controlled in accordance with the administrative controls.

b. Findings

No findings were identified.

.13 Alternative Mitigation Strategy Inspection Activities

a. Inspection Scope

The team reviewed the licensees implementation of guidance and strategies intended to maintain or restore core, containment, and spent fuel pool cooling capabilities under the circumstances associated with the potential loss of large areas of the plant due to explosions or fire as required by 10 CFR 50.54(hh)(2).

The team verified that the licensee maintained and implemented adequate procedures, maintained and tested equipment necessary to properly implement the strategies, and ensured station personnel were knowledgeable and capable of implementing the procedures. The team performed a visual inspection of portable equipment used to implement the strategy to ensure the availability and material readiness of the equipment, including the adequacy of portable pump trailer hitch attachments, and verify the availability of on-site vehicles capable of towing the portable pump. The team assessed the off-site ability to obtain fuel for the portable pump and foam used for firefighting efforts. The strategy and procedure selected for this inspection sample included:

• OSP-0066, Extensive Damage Mitigation Procedure, Revision 27, Attachment 18, Alternate Power to Hydrogen Ignitors.

One mitigating strategy sample was completed.

b. Findings

No findings were identified.

4OA2 Identification and Resolution of Problems

Corrective Actions for Fire Protection Deficiencies

a. Inspection Scope

The team selected a sample of condition reports associated with the licensee's fire protection program to verify that the licensee had an appropriate threshold for identifying deficiencies. The team reviewed the corrective actions proposed and implemented to verify that they were effective in correcting identified deficiencies. The team evaluated the quality of recent engineering evaluations through a review of condition reports, calculations, and other documents during the inspection.

b. Findings

No findings were identified.

4OA5 Other Activities

(Closed) Unresolved Item 05000458/2013007-04, Unresolved Item Associated with the Isolation of the Alternative Shutdown System

On January 2, 2014, the triennial fire protection inspection team identified a concern with the isolation of post-fire safe shutdown circuits during control room fire scenarios, and identified this issue as Unresolved Item 2013007-04 (ML14142A184). The team determined that this issue was a violation of NRC requirements, and it is discussed in Section 1R05.06.b of this report. This unresolved item is closed.

4OA6 Meetings, Including Exit

Exit Meeting Summary

The team presented the inspection results to Mr. W. Maguire, Site Vice President, and other members of the licensee staff at an exit meeting on April 28, 2016. The licensee acknowledged the findings presented.

The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.

ATTACHMENT:

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

A. Johnson, Fire Marshal (Acting)

W. Maguire, Site Vice President

D. Sandlin, Manager, Design and Program Engineering

E. Roan, Fire Protection Engineer

G. Huston, Shift Manager, Operations

G. Svestka, Design Engineering

J. Fortenberry, Reactor Operator, Operations

J. Gutierrez, Nuclear Equipment Operator, Operations

J. Henderson, Manager, Systems and Components Engineering

J. Reynolds, Senior Manager, Operations

K. Crissman, Senior Manager, Maintenance

K. Huffstatler, Manager (Acting), Regulatory Assurance

M. Chase, Director, Regulatory and Performance Improvement

P. Lucky, Manager, Performance Improvement

P. Sicard, Design Engineering

R. Cook, Manager, Security

S. Peterkin, Manager, Radiation Protection

S. Vazquez, Director, Engineering

T. Bolke, Senior Licensing Engineer

T. Gates, Manager, Operations Support

NRC Personnel

B. Parks, Resident Inspector

J. Sowa, Senior Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000458/2016007-01 NCV Inadequate Loop Flow Test Procedure (Section 1R05.03.b)

05000458/2016007-02 NCV Failure to Isolate Control Circuits for Safe Shutdown Equipment From the Effects of a Control Room Fire (Section 1R05.06.b)

05000458/2016007-03 FIN Failure to Demonstrate that Appendix R Emergency Lights Satisfied their Maintenance Rule Performance Criteria (Section 1R05.08.b)

Closed

05000458/2013007-04 URI Unresolved Item Associated with the Isolation of the Alternative Shutdown System (Section 4OA5)