Text

IR 05000458-10-006; Entergy Operations, Inc.,; 04/05/2010 - 06/02/2010; River Bend Station, NRC Triennial Fire Protection Inspection and Notice of Violation
	ML101690164
Person / Time
Site:	River Bend
Issue date:	06/17/2010
From:	O'Keefe N; NRC/RGN-IV/DRS/EB-2
To:	Mike Perito; Entergy Operations
References
	EA-10-095
	Download: ML101690164 (49)
	v • d • e

UNITED STATES

NUCLEAR REGULATORY COMMI SSI ON

R E G I ON I V

612 EAST LAMAR BLVD, SUITE 400

ARLINGTON, TEXAS 76011-4125

June 17 2010

EA-10-095

Michael Perito

Vice President, Operations

Entergy Operations, Inc.

River Bend Station

5485 US Highway 61N

St. Francisville, LA 70775

SUBJECT: RIVER BEND STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION

REPORT 05000458/2010006 AND NOTICE OF VIOLATION

Dear Mr. Perito:

On June 2, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at

River Bend Station facility. The enclosed inspection report documents the inspection results,

which were discussed on April 23, 2010, with Mr. Eric Olson, General Manager of Plant

Operations, and in a telephonic exit meeting on June 2, 2010 with Mr. Jerry Roberts and other

members of your staff.

The inspection examined activities conducted under your license as they relate to safety and

compliance with the Commissions rules and regulations and with the conditions of your license.

The team reviewed selected procedures and records, observed activities, and interviewed

personnel.

This report documents four NRC-identified violations. One violation is cited in the enclosed

Notice of Violation and the circumstances surrounding it are described in detail in the subject

inspection report. The violation is being cited in the Notice because of your failure to correct a

significant non-compliance with your License Condition 2.C.(10), Fire Protection, within a

reasonable time as described in the NRC Enforcement Manual. The NRC has also identified

three other issues that were evaluated under the risk significance determination process as

having very low safety significance (Green). The NRC also determined that violations are

associated with these issues. These violations are being treated as Noncited Violations

(NCVs), consistent with Section VI.A of the Enforcement Policy. These NCVs are described in

the subject inspection report.

You are required to respond to this letter and should follow the instructions specified in the

enclosed Notice of Violation when preparing your response. The NRC will use your response,

in part, to determine whether further enforcement action is necessary to ensure compliance with

regulatory requirements.

Entergy Operations, Inc. -2-

EA-10-095

If you contest the noncited violations or their significance, you should provide a response within

30 days of the date of this inspection report, with the basis for your denial, to the Nuclear

Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with

copies to: (1) the Regional Administrator, Region IV, 612 East Lamar Blvd., Arlington, TX

76011-4125; (2) the Director, Office of Enforcement, United States Nuclear Regulatory

Commission, Washington, DC 20555-0001; and (3) NRC Resident Inspector at River Bend

Station facility. The information you provide will be considered in accordance with Inspection

Manual Chapter 0305.

In accordance with 10 CFR 2.390 of the NRCs Rules of Practice, a copy of this letter, its

enclosures, and your response (if any) will be available electronically for public inspection in the

NRC Public Document Room or from the Publicly Available Records (PARS) component of the

NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at

http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room). To the extent

possible, your response should not include any personal privacy, proprietary, or safeguards

information so that it can be made available to the Public without redaction.

Sincerely,

/RA/

Neil OKeefe, Chief

Engineering Branch 2

Division of Reactor Safety

Docket No. 50-458

License No. NPF-47

Enclosure: Inspection Report No. 05000458/2010006

w/Attachments:

1 - Notice of Violation

2 - Supplemental Information

cc w/Enclosure:

Senior Vice President and COO

Entergy Operations, Inc

P. O. Box 31995

Jackson, MS 39286-1995

Vice President, Oversight

Entergy Operations, Inc.

P. O. Box 31995

Jackson, MS 39286-1995

Senior Manager, Nuclear Safety & Licensing

Entergy Nuclear Operations

P. O. Box 31995

Jackson, MS 39286-1995

Entergy Operations, Inc. -3-

EA-10-095

Manager, Licensing

Entergy Operations, Inc.

5485 US Highway 61N

St. Francisville, LA 70775

Attorney General

State of Louisiana

P. O. Box 94005

Baton Rouge, LA 70804-9005

Ms. H. Anne Plettinger

3456 Villa Rose Drive

Baton Rouge, LA 70806

President of West Feliciana

Police Jury

P. O. Box 1921

St. Francisville, LA 70775

Mr. Brian Almon

Public Utility Commission

William B. Travis Building

P. O. Box 13326

Austin, TX 78701-3326

Mr. Jim Calloway

Public Utility

Commission of Texas

1701 N. Congress Avenue

Austin, TX 78711-3326

Louisiana Department of Environmental Quality

Radiological Emergency Planning and

Response Division

P. O. Box 4312

Baton Rouge, LA 70821-4312

Joseph A. Aluise

Associate General Counsel - Nuclear

Entergy Services, Inc.

639 Loyola Avenue

New Orleans, LA 70113

Chief, Technological Hazards

Branch

FEMA Region VI

800 N. Loop 288

Denton, TX 76209-3606

Entergy Operations, Inc. -4-

EA-10-095

Electronic distribution by RIV:

Regional Administrator (Elmo.Collins@nrc.gov)

Deputy Regional Administrator (Chuck.Casto@nrc.gov)

DRP Director (Dwight.Chamberlain@nrc.gov)

DRP Deputy Director (Anton.Vegel@nrc.gov)

DRS Director (Roy.Caniano@nrc.gov)

DRS Deputy Director (Troy.Pruett@nrc.gov)

Senior Resident Inspector (Grant.Larkin@nrc.gov)

Resident Inspector (Charles.Norton@nrc.gov)

Branch Chief, DRP/C (Vincent.Gaddy@nrc.gov)

RBS Administrative Assistant (Lisa.Day@nrc.gov)

Senior Project Engineer, DRP/C (Bob.Hagar@nrc.gov)

Project Engineer, DRP/C (Rayomand.Kumana@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Alan.Wang@nrc.gov)

Branch Chief, DRS/TSB (Michael.Hay@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Congressional Affairs Officer (Jenny.Weil@nrc.gov)

Senior Enforcement Specialist Ray.Kellar@nrc.gov

OEMail Resource

OEDO RIV Coordinator (Leigh.Trocine@nrc.gov)

File located: S:\DRS\REPORTS\(final) RBS2010006 rpt-STG ADAMS ML

SUNSI Rev Compl. ; Yes No ADAMS ; Yes No Reviewer Initials NFO

Publicly Avail ;Yes No Sensitive Yes ; No Sens. Type Initials NFO

SRI:DRS/EB2 RI:DRS/EB2 RI:DRS/EB2 RI:DRS/EB2 SRA:DRS

SGraves SAlferink BCorrell NOkonkwo MRunyun

/RA/ /RA/ /RA/ /RA/ /RA/

6/9/10 6/9/10 6/9/10 6/9/10 6/9/10

SES:ACES C: DRP/PBC C:DRS/EB2

RKellar VGaddy NFOKeefe

/RA/ /RA/ /RA/

6/15/10 6/17/10 6/17/10

OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

NOTICE OF VIOLATION

Entergy Operations, Inc. Docket No. 50-458

River Bend Station License No. NPF-47

EA-10-095

During an NRC inspection completed on June 2, 2010, a violation of NRC requirements was

identified. In accordance with the NRC Enforcement Policy, the violation is listed below:

License Condition 2.C.(10), Fire Protection, requires that the licensee comply with the

requirements of their fire protection program as specified in Attachment 4. Attachment

4, Fire Protection Program Requirements, states, in part, that the licensee shall

implement and maintain in effect all provisions of the approved fire protection program

as described in the Final Safety Analysis Report for the facility. The fire protection

program requirements are described in section 9.5.1 and appendices 9A and 9B.

Section 9B.4.7 specifies, in part, Fire protection features shall be capable of limiting fire

damage so that one train of systems necessary to achieve and maintain hot shutdown

conditions from either the control room or emergency control station(s) is free of fire

damage.

Contrary to this requirement, in May 2007, the licensee determined that they failed to

ensure that one train of systems necessary to achieve and maintain hot shutdown

conditions from either the control room or emergency control station(s) was free of fire

damage. Specifically, the Division 1 standby service water support system to the

Division 1 emergency diesel generator, which was required to achieve safe shutdown,

was not protected such that it remained free from fire damage under all conditions.

The non-emergency high temperature trips for the emergency diesel generator would be

disabled by design when automatically started in emergency mode due to loss of offsite

power. Since standby service water could be lost due to fire damage during a control

room fire, the emergency diesel generator would continue to run without cooling, and

potentially fail prior to operators restoring standby service water at the remote shutdown

panel. The licensee failed to promptly restore compliance in the three years since

identifying the non-conforming condition, during which time the licensee has completed

two refueling outages, six unplanned outages, and a planned system outage of sufficient

duration. This condition was entered into the licensees corrective action program as CR-

RBS-2007-02102.

This violation is associated with Green significance determination process finding 05000458/2010006-01.

Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Inc. is hereby required to

submit a written statement or explanation to the U.S. Nuclear Regulatory Commission,

ATTN: Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional

Administrator, Region IV, 612 East Lamar Blvd., Arlington, TX 76011-4125, and a copy to the

NRC Resident Inspector at River Bend Station within 30 days of the date of the letter

transmitting this Notice of Violation (Notice). This reply should be clearly marked as a Reply to

a Notice of Violation: EA-10-095 and should include for each violation: (1) the reason for the

violation, or, if contested, the basis for disputing the violation, (2) the corrective steps that have

been taken and the results achieved, (3) the corrective steps that will be taken, and (4) the date

when full compliance will be achieved. In your response, please provide a description of the

-1- Enclosure

process(es) used and your assessment of the appropriateness of the decisions to extend the

completion of necessary plant modifications beyond the November 2009 refueling outage. Your

response may reference or include previous docketed correspondence, if the correspondence

adequately addresses the required response. If an adequate reply is not received within the

time specified in this Notice, an order or a Demand for Information may be issued as to why the

license should not be modified, suspended, or revoked, or why such other action as may be

proper should not be taken. Where good cause is shown, consideration will be given to

extending the response time.

If you contest this enforcement action, you should also provide a copy of your response, with

the basis for your denial, to the Director, Office of Enforcement, United States Nuclear

Regulatory Commission, Washington DC 20555-0001.

Because your response will be made available electronically for public inspection in the NRC

Public Document Room or from the NRCs document system (ADAMS), accessible from the

NRCs website at www.nrc.gov/reading-rm/pdr.html or www.nrc.gov/reading-rm/adams.html, to

the extent possible, it should not include any personal privacy, proprietary, or safeguards

information so that it can be made available to the public without redaction. If personal privacy

or proprietary information is necessary to provide an acceptable response, then please provide

a bracketed copy of your response that identifies the information that should be protected and a

redacted copy of your response that deletes such information. If you request withholding of

such material, you must specifically identify the portions of your response that you seek to have

withheld and provide in detail the bases for your claim of withholding (e.g., explain why the

disclosure of information will create an unwarranted invasion of personal privacy or provide the

information required by 10 CFR 2.390(b) to support a request for withholding confidential

commercial or financial information). If safeguards information is necessary to provide an

acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated this 17th day of June 2010.

-2- Enclosure

ENCLOSURE

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-458

License: NPF-47

Report No.: 05000458/2010006

Licensee: Entergy Operations, Inc.

Facility: River Bend Station

Location: 5485 U.S. Highway 61

St. Francisville, LA

Dates: April 5 through June 2, 2010

Team S. Graves, Senior Reactor Inspector

Leader: Engineering Branch 2

Division of Reactor Safety

Inspectors: S. Alferink, Reactor Inspector

Engineering Branch 2

Division of Reactor Safety

B. Correll, Reactor Inspector

Engineering Branch 2

Division of Reactor Safety

N. Okonkwo, Reactor Inspector

Engineering Branch 2

Division of Reactor Safety

Approved Neil OKeefe, Branch Chief

By: Engineering Branch 2

Division of Reactor Safety

-3- Enclosure

SUMMARY OF FINDINGS

IR 05000458/2010006; 4/5/10 - 6/2/10; Entergy Operations, Inc.; River Bend Station; Fire

Protection (Triennial)

The report covered a two week triennial fire protection team inspection by specialist inspectors

from Region IV. Four Green findings were identified and categorized as one cited violation

(NOV) and three noncited violations (NCVs). The significance of most findings is indicated by

their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609, Significance

Determination Process. The crosscutting aspects were determined using Inspection Manual

Chapter 0310, Components within the Cross-Cutting Areas. Findings for which the

significance determination process (SDP) does not apply may be Green or be assigned a

severity level after NRC management review. The NRCs program for overseeing the safe

operation of commercial nuclear power reactors is described in NUREG-1649, Reactor

Oversight Process, Revision 4, dated December 2006.

A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green. The team identified a cited violation of License Condition 2.C.(10), Fire

Protection, for failing to ensure that the Division 1 standby service water support

system to the Division 1 emergency diesel generator, which was required to achieve

safe shutdown, was protected such that it remained free from fire damage under all

conditions. This condition was identified by the licensee in May 2007, and entered

into their corrective action program as a significant non-conforming condition in CR-

RBS-2007-02102. The licensee subsequently initiated compensatory measures in

the form of manual actions to protect the Division 1 emergency diesel generator.

This issue was documented as a licensee-identified noncited violation in Inspection

Report 2009002. River Bend has subsequently completed two refueling outages, six

forced outages, and one emergency diesel generator work window of sufficient

duration since identification of this condition and failed to correct the non-

conformance. The team determined that schedule changes resulted in a new

completion date of January 2011.

The failure to ensure that one train of systems necessary to achieve and maintain

hot shutdown conditions from either the control room or emergency control station(s)

was free of fire damage and to correct this significant non-conforming condition in a

timely manner is a performance deficiency. This performance deficiency was more

than minor because it was associated with the protection against external factors

(fire) attribute of the Mitigating Systems Cornerstone and adversely affected the

cornerstone objective of ensuring the availability, reliability, and capability of systems

that respond to initiating events in order to prevent undesirable consequences. The

team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, because it affected fire

protection defense-in-depth strategies involving post fire safe shutdown systems with

plant-wide consequences. A Phase 3 SDP risk assessment was performed by a

senior reactor analyst. The bounding change in conditional core damage frequency

for a 1-year exposure is the Fire Mitigation Frequency (4.30E-08/year) multiplied by

the change in conditional core damage probability (0.9) for a value of 3.87E-08/year.

This value indicates the finding has very low safety significance (Green). Because

-4- Enclosure

the licensee failed to correct this violation, this violation is being treated as a cited

violation, consistent with the NRC Enforcement Policy. This finding had a

crosscutting aspect in the Work Control component of the Human Performance area

because the licensee did not appropriately plan work activities to support long-term

equipment reliability by limiting temporary modifications, operator workarounds,

safety systems unavailability, and reliance on manual actions H.3(b). (Section

1R05.01)

Green. The team identified a noncited violation of Technical Specification 5.4.1.d,

Fire Protection Program Implementation. Specifically, Procedure AOP-0031

Shutdown from Outside the Main Control Room, Revision 307, had steps that could

not be implemented as written. Two steps were to be performed before the

necessary ac power was available, and two steps required diagnostic assessment

without the availability of instrumentation.

The failure to ensure that Procedure AOP-0031, Revision 307 could be implemented

as written is a performance deficiency. The performance deficiency was more than

minor because it was associated with the procedure quality attribute of the Mitigating

Systems Cornerstone and it adversely affected the cornerstone objective of ensuring

the availability, reliability, and capability of systems that respond to initiating events

to prevent undesirable consequences. Using Attachment 2 to Appendix F, Fire

Protection Significance Determination Process, this issue was determined to be a

safe shutdown finding, and was assigned a degradation rating of Low because the

examples involved procedural deficiencies that could be compensated for by

operator experience. Since this finding was assigned a low degradation rating, the

safety significance screened as very low (Green). This finding was entered into the

licensees corrective action program as CR-RBS-2010-01592, CR-RBS-2010-01831,

CR-RBS-2010-01775, CR-RBS-2010-01821, and CR-RBS-2010-1846. This finding

had a crosscutting aspect in the Resources component of the Human Performance

area, in that the licensee did not ensure that procedures were complete, accurate,

and up to date to assure nuclear safety [H.2.(c)]. (Section 1R05.05.b.1)

Green. The team identified a noncited violation of License Condition 2.C.(10), Fire

Protection, for the failure to implement and maintain in effect all provisions of the

approved fire protection program. Specifically, the team identified, during a timed

walkdown of the procedure that it took operators over 6 minutes to isolate feedwater,

but the simulator showed that the steam lines could be flooded in 2 minutes.

Overfilling the reactor pressure vessel and flooding the main steam lines could make

reactor core isolation cooling unavailable. Reactor core isolation cooling was

credited for decay heat removal and inventory control in the event of a fire.

The failure to ensure that feedwater would be isolated prior to overfilling the reactor

pressure vessel and flooding the main steam lines making reactor core isolation

cooling unavailable is a performance deficiency. The performance deficiency was

more than minor because it was associated with the protection against external

events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected

the cornerstone objective of ensuring the availability, reliability, and capability of

systems that respond to initiating events to prevent undesirable consequences. The

team evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire

Protection Significance Determination Process, because it affected fire protection

defense-in-depth strategies involving post fire safe shutdown systems with plant-

-5- Enclosure

wide consequences. A senior reactor analyst performed a Phase 3 evaluation to

determine the risk significance of this finding since it involved a control room fire that

led to control room abandonment. The Phase 3 evaluation determined that the

finding had very low safety significance because a fire in only one of 109 electrical

cabinets in the control room could result in this overfill event. The finding was

entered into the licensees corrective action program as CR-RBS-2010-01808. The

finding did not have a crosscutting aspect since it was not indicative of current

performance, in that the licensee had established the incorrect response time more

than three years prior to this finding. (Section 1R05.05.b.2)

Green. The team identified a noncited violation of License Condition 2.C.(10), Fire

Protection, related to the licensee's failure to implement and maintain in effect all

provisions of the approved fire protection program. Specifically, during testing

required by the approved fire protection program the licensee failed to adequately

test the remote shutdown emergency transfer switch functions used to assure

isolation of safe shutdown equipment from the control room in the event of a control

room evacuation due to fire. The switch functions had not been adequately tested

since 1997.

The failure to ensure isolation from the control room for safe shutdown equipment

controlled from the remote shutdown panel during surveillance testing of emergency

transfer switches is a performance deficiency. The finding was more than minor

because it was associated with the procedure quality attribute of the Mitigating

Systems Cornerstone in that it adversely affected the cornerstone objective of

ensuring the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences. The team evaluated the finding using

Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance

Determination Process, because it affected fire protection defense-in-depth

strategies involving post fire safe shutdown. Using Appendix F, Attachment 2,

Degradation Rating Guidance Specific to Various Fire Protection Program

Elements, the team determined that the finding constituted a low degradation of the

safe shutdown area since the control room isolation feature was expected to display

nearly the same level of effectiveness and reliability as it would had the degradation

not been present. This finding screened as having very low safety significance

(Green). This violation was entered into the licensees corrective action program as

CR-RBS-2010-01783. Because the emergency transfer switch surveillance

procedures had been in effect since 1997, there was no crosscutting aspect

associated with the violation, in that it is not indicative of current licensee

performance. (Section 1R05.05.b.3)

B. Licensee-Identified Violations

None.

-6- Enclosure

REPORT DETAILS

1. REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection (71111.05T)

This report presents the results of a triennial fire protection inspection conducted in

accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at

the River Bend Station. The inspection team evaluated the implementation of the

approved fire protection program in selected risk significant areas, with an emphasis on

the procedures, equipment, fire barriers, and systems that ensure the post fire capability

to safely shut down the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for

review. The inspection team used the fire hazards analysis section of the River Bend

Station Individual Plant Examination of External Events to select the following five risk

significant fire areas (inspection samples) for review:

C-15 Division I Standby Switchgear Room

C-17 Control Room Ventilation Room (El. 116)

C-25 Control Room

AB-2/Z-1 and Z-2 High Pressure Core Spray and High Pressure Core Spray

Hatch Area

PT-1 Piping Tunnel

The inspection team evaluated the licensees fire protection program using the

applicable requirements, which included plant Technical Specifications, Operating

License Condition 2.C.(10), NRC safety evaluations, NRC supplemental safety

evaluations, 10 CFR 50.48, and Branch Technical Position 9.5-1. The team also

reviewed related documents that included the Final Safety Analysis Report (FSAR),

Section 9.5.1; Technical Requirements Manual; the fire hazards analysis; and the post

fire safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Five inspection

samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed piping and instrumentation diagrams, safe shutdown equipment list,

safe shutdown design basis documents, and the post fire safe shutdown analysis to

verify that the safe shutdown methodology had properly identified the components and

systems necessary to achieve and maintain safe shutdown conditions for equipment in

the selected fire areas. The team also reviewed and observed walkdowns of the

procedures for achieving and maintaining safe shutdown in the event of a fire to verify

that the licensee properly implemented the safe shutdown analysis provisions.

-7- Enclosure

For each of the selected fire areas, the team reviewed the separation of redundant safe

shutdown cables, equipment, and components located within the same fire area. The

team also reviewed the licensees method for meeting the requirements of 10 CFR

50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50, Appendix R,

Sections III.G. Specifically, the team evaluated whether at least one post fire safe

shutdown success path remained free of fire damage in the event of a fire. In addition,

the team verified that the licensee met applicable license commitments.

b. Findings

Introduction. The team identified a Green, cited violation of License Condition 2.C.(10)

Fire Protection, for failing to ensure that one train of systems necessary to achieve and

maintain hot shutdown conditions from either the control room or emergency control

station(s) is free of fire damage and failing to promptly correct this non-conforming

condition.

Description. On May 21, 2007, during a review of industry operating experience, the

licensee determined that the Division 1 emergency diesel generator could be disabled

during a main control room fire due to fire damage to a required support system.

Specifically, the non-emergency high temperature trips for the emergency diesel

generator would be disabled by design when the engine is automatically started in

emergency mode due to loss of offsite power. Since standby service water could be lost

due to fire damage during a control room fire, the emergency diesel generator would

continue to run without cooling and potentially fail prior to operators restoring standby

service water at the remote shutdown panel. The Division 1 emergency diesel generator

is the credited source of ac power used to safely shut down the reactor in the event of a

fire requiring evacuation of the main control room with concurrent loss of offsite power.

The licensee documented this non-conformance in Condition Report

CR-RBS-2007-02102 as a significant non-conforming condition and implemented

compensatory measures in the form of operator manual actions. The manual actions

were added to Procedure AOP-0031, Shutdown from Outside the Main Control Room,

Revision 307, to immediately trip the emergency diesel generator after an emergency

mode start and transfer control to the remote shutdown panel prior to control room

evacuation. Once transferred, operators would ensure the availability of standby service

water and perform a manual normal-mode start of the emergency diesel generator, in

which the high temperature trips would remain functional.

This non-conforming condition was reported to the NRC as an unanalyzed condition that

significantly degrades plant safety, in accordance with 10 CFR 50.72(b)(3)(ii)(B) and

subsequently in July 2007, in Licensee Event Report (LER) 05000458/07-003-00.

The team was concerned that the licensee had not been timely in restoring compliance.

In late 2008, the NRC concluded that this non-conforming condition constituted a

licensee-identified Green noncited violation. At that time, the licensee had scheduled

corrective action for this condition for November 2009. The team learned that this was

later rescheduled because the modification package was not completed in time and

parts were not available to support the scheduled date. While the licensee had

concluded that the work could be done online, the modification was not ready so it was

rescheduled for the next refueling outage in January 2011.

-8- Enclosure

The team noted that the licensee had concluded that multiple spurious operations had to

occur for the condition to impact safe shutdown in the event of a fire. Further

discussions with the licensee resulted in the team concluding that the loss of offsite

power also was inappropriately considered as a fire-induced spurious actuation in the

control room fire scenario, and because the standby service water system could be

subject to maloperation due to fire-damage, The licensee classified this scenario as an

event requiring multiple fire induced spurious actuations in order to occur. This incorrect

conclusion contributed to licensee decisions to delay completion of corrective actions.

The team pointed out that demonstrating the ability to safely shutdown in the event of a

fire in the control room is a deterministic design requirement, not a spurious operation.

Similarly, the postulated loss of standby service water is the result of fire damage, not a

spurious operation.

The Onsite Safety Review Committee evaluated the core damage frequency and

concluded that the risk of rescheduling the modification was very low. However, the

team noted that this condition was classified by the licensee as being operable but a

significant non-conforming condition. Regulatory Issue Summary 2005-20 references

Inspection Manual Part 9900, Revision to Guidance Formerly Contained in NRC Generic Letter 91-18, Information to Licensees Regarding Two NRC Inspection Manual

Sections on Resolution of Degraded and Non-conforming Conditions and on

Operability, which states, in part, that degraded or non-conforming conditions must be

corrected in a timely manner, commensurate with the safety significance. Also, for

technical specification systems, structures, or components, the NRC expects that issues

requiring compensatory measures and issues involving manual actions in lieu of

automatic system response would indicate conditions that should be fixed expeditiously.

While the licensee used this guidance in their decision making process, the team was

concerned that the licensee did not appropriately consider this guidance before delaying

implementation of the modification. Further, at the time of this inspection, the plant had

conducted two refueling outages, six unplanned outages, and a planned system outage

of sufficient duration since identifying the condition. The team concluded that the total

time to restore compliance did not reflect timely corrective action, and rescheduling to

the January 2011 refueling outage rather than adjusting online maintenance schedules

did not reflect a work control process that was focused on scheduling work activities so

as to minimize reliance on manual actions.

Section 7.2 of Inspection Manual Part 9900 states, in part, that "In determining whether

the licensee is making reasonable efforts to complete corrective actions promptly, the

NRC will consider safety significance, the effects on operability, the significance of the

degradation, and what is necessary to implement the corrective action. The NRC may

also consider the time needed for design, review, approval, or procurement of the repair

or modification; the availability of specialized equipment to perform the repair or

modification; and whether the plant must be in hot or cold shutdown to implement the

actions. If the licensee does not resolve the degraded or nonconforming condition at the

first available opportunity or does not appropriately justify a longer completion schedule,

the staff would conclude that corrective action has not been timely and would consider

taking enforcement action."

-9- Enclosure

In applying this guidance to this issue, the staff concluded that:

The systems affected by the non-conforming condition and the compensatory

measures are systems required to be operable by technical specifications. These

systems are also required to be operable to meet License Condition 2.C.(10) and the

safe shutdown requirements of the approved fire protection program.

The non-conforming condition was more significant based on the reliance upon

manual actions in lieu of automatic functioning, and because compensatory actions

were necessary to ensure the operability of the affected systems.

Scheduling the modification for completion in the second refueling outage following

identification of the issue was justified based on the proximity of the first outage to

the date of identification and the time needed for design and procurement activities.

Delay of the modification to the third refueling outage, rather than scheduling a work

window sooner, did not appear to have adequately considered the factors described

in Part 9900. Further, delays in design and procurement appeared to be the result of

factors within the control of the licensee, given proper priority.

Based on the above, the staff has concluded that corrective action for this non-

conforming condition was not timely commensurate with the safety significance of the

condition.

Analysis. The failure to ensure that at least one train of equipment necessary to achieve

hot shutdown from either the control room or emergency control station(s) is maintained

free of fire damage as required by the licensees fire protection program, and to correct

this significant non-conforming condition in a timely manner is a performance deficiency.

This performance deficiency was more than minor because it was associated with the

protection against external factors (fire) attribute of the Mitigating Systems Cornerstone

and adversely affected the cornerstone objective of ensuring the availability, reliability,

and capability of systems that respond to initiating events in order to prevent undesirable

consequences. The team evaluated this deficiency using Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance Determination Process, because it

affected fire protection defense-in-depth strategies involving post fire safe shutdown

systems with plant-wide consequences. A Phase 3 SDP risk assessment was

performed by a senior reactor analyst.

Because the River Bend control room included the plant instrumentation and relay

cabinets, the senior reactor analyst added a generic fire ignition frequency for a relay

room to the control room fire ignition frequency listed in the Individual Plant Examination

for External Events. The analyst multiplied an appropriate severity factor (SF) by the

sum of the control room fire initiation frequency (CRFIF) and the instrument room fire

initiation frequency (IRFIF) and multiplied this result by a nonsuppression probability

(NPCRE) to account for the likelihood that operators failed to extinguish the fire within 20

minutes, assuming that it would take operators 2 minutes to detect the fire. The

resulting fire would require a control room evacuation with a control room evacuation

frequency determined as follows:

- 10 - Enclosure

Control Room Evacuation Frequency = (CRFIF + IRFIF) * SF * NPCRE

= (9.5E-03/year + 1.42E-03/year) * 0.2 * 1.30E-02

= 2.84E-05/year

As described in the Individual Plant Examination for External Events, the control room

had 109 panels. Because multiple failure combinations could result in a start of the

Division 1 diesel generator without service water supplied, the senior reactor analyst

determined the combined partial fraction for all possible scenarios. The analyst

determined partial fraction for each loss of electrical scenario by dividing the number of

affected cabinets by the total number of cabinets:

Scenario Number Fraction (number/109)

Cabinets with Diesel Generator 1 controls 4 FDG1 = 3.67E-02

Cabinets with Division 1 power 1 FDiv1 = 9.17E-03

Cabinets with power from both divisions 1 FBDIV = 9.17E-03

Cabinets with service water 3 FSW = 2.75E-02

A fire could result in the inadvertent start of a diesel generator either directly, by affecting

the diesel control circuits, or indirectly, by affecting the power to the associated vital bus.

Therefore, the probability that a fire could result in the start of the Division 1 emergency

diesel generator (PDGStart) was calculated as follows:

PDGStart = FDG1 + FDiv1 + FBDiv

= 3.67E-02 + 9.17E-03 + 9.17E-03

= 5.50E-02

To determine the probability that a main control room fire would fail the service water

system at the same time as starting the Division 1 emergency diesel generator (PFailure),

the analyst performed the following calculation:

PFailure = PDGStart * FSW

= 5.50E-02 * 2.75E-02

= 1.52E-03

The resulting Fire Mitigation Frequency is the Control Room Evacuation Frequency

(2.84E-05/year) multiplied by the combined failure probabilities (1.52E-03) for a value of

4.30E-08/year.

The analyst determined the change in conditional core damage probability by subtracting

the base case conditional core damage probability given abandonment of the control

room (0.1) from the assumed conditional core damage probability given the performance

deficiency (1.0) for a value of (0.9). The bounding change in conditional core damage

frequency for a 1-year exposure is the Fire Mitigation Frequency (4.30E-08/year)

- 11 - Enclosure

multiplied by the change in conditional core damage probability (0.9) for a value of

3.87E-08/year. This value indicates the finding has very low safety significance (Green).

This finding had a crosscutting aspect in the Work Control component of the Human

Performance area because the licensee did not appropriately coordinate work activities

to support long-term equipment reliability by limiting temporary modifications, operator

workarounds, safety systems unavailability, and reliance on manual actions H.3(b).

Enforcement. License Condition 2.C.(10) Fire Protection, requires that the licensee

comply with the requirements of their fire protection program as specified in Attachment

4. Attachment 4, Fire Protection Program Requirements, states, in part, that the

licensee shall implement and maintain in effect all provisions of the approved fire

protection program as described in the Final Safety Analysis Report for the facility. The

fire protection program requirements are described in section 9.5.1 and appendices 9A

and 9B of the Final Safety Analysis Report. Section 9B.4.7, specifies, in part, Fire

protection features shall be capable of limiting fire damage so that one train of systems

necessary to achieve and maintain hot shutdown conditions from either the control room

or emergency control station(s) is free of fire damage.

Contrary to this requirement, in May 2007 the licensee determined that they failed to

ensure that the one train of systems necessary to achieve and maintain hot shutdown

conditions from either the control room or emergency control station(s) would be free of

fire damage. Specifically, the Division 1 standby service water support system to the

Division 1 emergency diesel generator, which was required to achieve safe shutdown,

was not protected such that it remained free from fire damage under all conditions.

Because the licensee failed to correct this violation, this violation is being treated as a

cited violation, consistent with the NRC Enforcement Policy,Section VI.A.1, which

states, in part, that a cited violation requiring a formal written response from a licensee

will be considered if the licensee failed to restore compliance within a reasonable time

after a violation was identified. The NRC Enforcement Manual further explains that the

purpose of this criterion is to emphasize the need to take appropriate action to restore

compliance in a reasonable period of time once a licensee becomes aware of the

violation, and take compensatory measures until compliance is restored when

compliance cannot be reasonably restored within a reasonable period of time.

The licensee had compensatory measures in place; however compliance had not been

restored.

This violation is identified as VIO 05000458/2010006-01, Failure to Ensure at Least One

Train of Equipment Necessary to Achieve Hot Shutdown Conditions is Free of Fire

Damage.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the

material condition and configuration of the installed fire area boundaries (including walls,

fire doors, and fire dampers) and verify that the electrical raceway fire barriers were

appropriate for the fire hazards in the area. The team compared the installed

- 12 - Enclosure

configurations to the approved construction details, supporting fire tests, and applicable

license commitments.

The team reviewed installation, repair, and qualification records for a sample of

penetration seals to ensure the fill material possessed an appropriate fire rating and that

the installation met the engineering design.

b. Findings

No findings.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection

and suppression systems in the selected fire areas. The team verified the manual and

automatic detection and suppression systems were installed, tested, and maintained in

accordance with the National Fire Protection Association code of record or approved

deviations, and that each suppression system was appropriate for the hazards in the

selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression

systems in the selected fire areas. The team also performed a walkdown of major

system support equipment in other areas (e.g., fire pumps, and Halon supply systems)

to assess the material condition of these systems and components. The team reviewed

the electric and diesel fire pump flow and pressure tests to verify that the pumps met

their design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and

drill critique records. The team also reviewed pre-fire plans and smoke removal plans

for the selected fire areas to determine if appropriate information was provided to fire

brigade members and plant operators to identify safe shutdown equipment and

instrumentation, and to facilitate suppression of a fire that could impact post fire safe

shutdown capability. The team inspected fire brigade equipment to determine

operational readiness for fire fighting.

The team observed an unannounced fire drill on April 13, 2010, and the subsequent drill

critique using the guidance contained in Inspection Procedure 71111.05AQ, Fire

Protection Annual/Quarterly. The team observed fire brigade members fight a

simulated fire in Fire Area C-14, Standby Switchgear 1B Room, located in the Control

Building. The team verified that the licensee identified problems, openly discussed them

in a self-critical manner at the drill debrief, and identified appropriate corrective actions.

Specific attributes evaluated were: (1) proper wearing of turnout gear and self-contained

breathing apparatus; (2) proper use and layout of fire hoses; (3) employment of

appropriate fire fighting techniques; (4) sufficient firefighting equipment was brought to

the scene; (5) effectiveness of fire brigade leader communications, command, and

control; (6) search for victims and propagation of the fire into other areas; (7) smoke

removal operations; (8) utilization of pre-planned strategies; (9) adherence to the pre-

planned drill scenario; and (10) drill objectives.

- 13 - Enclosure

b. Findings

No findings.

.04 Protection from Damage from Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant

trains of systems required for hot shutdown, which are located in the same fire area,

would not be subject to damage from fire suppression activities or from the rupture or

inadvertent operation of fire suppression systems. Specifically, the team verified that:

A fire in one of the selected fire areas would not directly, through production of

smoke, heat, or hot gases, cause activation of suppression systems that could

potentially damage all redundant safe shutdown trains.

A fire in one of the selected fire areas or the inadvertent actuation or rupture of a

fire suppression system would not directly cause damage to all redundant trains

(e.g., sprinkler-caused flooding of other than the locally affected train).

Adequate drainage is provided in areas protected by water suppression systems.

The team reviewed the separation of safe shutdown cables, equipment, and

components within the same fire areas, and reviewed the methodology for meeting the

requirements of 10 CFR 50.48, Appendix A to Branch Technical Position 9.5-1 and

10 CFR Part 50, Appendix R, Section III.G. Specifically, this was to determine whether

at least one post fire safe shutdown success path was free of fire damage in the event of

a fire in the selected areas.

b. Findings

No findings.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology

The team reviewed the safe shutdown analysis, fire hazards analysis, operating

procedures, piping and instrumentation drawings, electrical drawings, the Final Safety

Analysis Report, and other supporting documents to verify that hot and cold shutdown

could be achieved and maintained for fires in areas where the licensees post fire safe

shutdown strategy relied on manipulating shutdown equipment from outside the control

room. The team verified that hot and cold shutdown could be achieved and maintained

with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was

consistent with the description contained in the safe shutdown and fire hazards

analyses. The team focused on ensuring the adequacy of systems selected for

- 14 - Enclosure

reactivity control, reactor coolant makeup, reactor decay heat removal, process

monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for safe shutdown

would remain free from fire damage, with the exceptions discussed in this report.

Finally, the team verified that the transfer of control from the control room to the

alternative shutdown location would not be affected by fire-induced circuit faults (e.g., by

the provision of separate fuses and power supplies for alternative shutdown control

circuits), with the exceptions discussed below.

Review of Operational Implementation

The team verified that licensed and non-licensed operators received training on

alternative shutdown procedures. The team also verified that a sufficient number of

personnel, exclusive of those assigned as fire brigade members, were trained and

available onsite at all times to perform an alternative shutdown.

The team reviewed the adequacy of the procedures utilized for alternative shutdown and

performed an independent walkthrough of the procedure to ensure their implementation

and human factors adequacy. The team also verified that the operators could be

reasonably expected to perform specific time critical actions within the time required to

maintain plant parameters within specified limits, with the exceptions discussed below.

Some of the time critical actions verified included the restoration of alternating current

electrical power, establishing control at the remote shutdown and local shutdown panels,

establishing reactor coolant makeup, and establishing decay heat removal.

The team reviewed periodic surveillance testing of the alternative shutdown transfer

capability, including transfer and isolation of instrumentation and control functions, to

verify that the tests were adequate to demonstrate the functionality of the alternative

shutdown capability. The team also reviewed a sample of wiring diagrams, vendor

manuals, connection drawings, and circuit diagrams for the remote transfer circuits,

control circuits, and the remote shutdown panel to verify the field configurations matched

the design documents.

b. Findings

b.1 Introduction. The team identified a Green noncited violation of Technical Specification 5.4.1.d, Fire Protection Program Implementation, for failing to ensure that the

alternative shutdown procedure, AOP-0031 Shutdown from Outside the Main Control

Room, Revision 307, could be implemented as written, with three examples.

Description. Procedure AOP-0031 Shutdown from Outside the Main Control Room,

Revision 307, was used in the event of a fire in the control room which required control

room evacuation. This procedure contained the necessary steps to safely shut down the

reactor with or without offsite power available. During a walkdown of the procedure, the

team identified three examples where this procedure could not be performed as written.

Example 1: Step 5.10.5 required the operators to verify at least one of three breakers

(ACB04, ACB06, or ACB07) was closed to supply power to the Division I

vital switchgear. The team determined that operators would not able to

perform the step as written during a control room fire scenario with a loss of

- 15 - Enclosure

offsite power since these three breakers would be open and locked out.

Breakers ACB04 and ACB06 would open by design upon the loss of offsite

power. The Division I diesel generator output breaker, ACB07, would be

open because the operators performed an emergency stop of the diesel

generator in the control room as a manual action to prevent damage to the

diesel generator. Further, a caution note before step 5.10.5 informed the

operator not to close these breakers without specific instruction from the

Control Room Supervisor. The team also noted that Procedure AOP-0031

did not require the diesel generator to be started again until step 5.14.2.

Example 2: Step 5.13 required the Reactor Building Operator to start 1LSV*C3A,

Penetration Valve Leakage Control Air Compressor. This compressor

provides air pressure to maintain the safety relief valves open during

sustained operation of the residual heat removal system in the alternate

shutdown cooling mode, if required. During a loss of offsite power, this

compressor would not have ac power available until after the Division 1

emergency diesel generator was started. As noted above, Procedure

AOP-0031 did not require the diesel generator to be started until step

5.14.2. Step 5.14.1 directed the Control Room Supervisor to verify that

steps 5.10.5 and 5.13 were completed. This step occurred before

establishing electrical power in step 5.14.2. During interviews with the

operators, the team concluded that the Control Room Supervisor would

direct an operator to start the diesel generator upon realization that ac

power was required to perform steps 5.10.5 and 5.13.

Example 3: Steps 5.14.5.3 and 5.15.3 required the operators to perform a diagnostic

evaluation for fire damage to cables and motor-operated valves in the form

of IF fire-induced cable [valve] damage has occurred to the following,

THEN perform the following The procedure did not provide guidance or

identify protected instrumentation for assessing whether this fire damage

occurred. The post fire safe shutdown analysis credited the actions

specified in steps 5.14.5.3 and 5.15.3 for the plant to reach and maintain

hot shutdown. The team was concerned that it might not be practical to

identify specific cable damage within the time constraints.

Analysis. The failure to ensure that Procedure AOP-0031, Revision 307, could be

implemented as written is a performance deficiency. The performance deficiency was

more than minor because it was associated with the procedure quality attribute of the

Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of

ensuring the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences. The team evaluated the finding using

Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance

Determination Process, because it affected fire protection defense-in-depth strategies

involving post fire safe shutdown systems with plant-wide consequences. Using

Appendix F, Attachment 2, Degradation Rating Guidance Specific to Various Fire

Protection Program Elements, the team determined that the finding constituted a low

degradation of the safe shutdown area since the procedural deficiencies could be

compensated by operator experience and familiarity. This finding screened as having

very low safety significance (Green).

- 16 - Enclosure

This finding had a crosscutting aspect in the Resources component of the Human

Performance area because the licensee did not ensure that procedures used to assure

nuclear safety could be implemented [H.2.(c)].

Enforcement. Technical Specification 5.4.1.d states, in part, that written procedures

shall be established, implemented, and maintained covering fire protection program

implementation. Contrary to this requirement, prior to June 2, 2010, the licensee failed

to implement and maintain a required fire protection program procedure. Specifically,

the licensee failed to ensure that Procedure AOP-0031, Shutdown from Outside the

Main Control Room, Revision 307, could be implemented as written.

Because this violation was of very low safety significance and it was entered into the

licensees corrective action program as CR-RBS-2010-01592, CR-RBS-2010-01831,

CR-RBS-2010-01775, CR-RBS-2010-01821, and CR-RBS-2010-1846, this violation is

being treated as an NCV, consistent with the Enforcement Policy and is identified as

NCV 05000458/2010006-02, Failure to Ensure Alternative Shutdown Procedure could

be Implemented as Written.

b.2 Introduction. The team identified a Green noncited violation of License

Condition 2.C.(10), Fire Protection, for the failure to implement and maintain in effect

all provisions of the approved fire protection program. Specifically, during a timed

walkdown of the procedure the team identified that it took operators over 6 minutes to

isolate feedwater, but the simulator showed that the steam lines could be flooded in 2

minutes. Overfilling the reactor pressure vessel and flooding the main steam lines could

make reactor core isolation cooling unavailable. Reactor core isolation cooling was

credited for decay heat removal and inventory control in the event of a fire.

Description. Design Criterion 240.201A, Post-Fire Safe Shutdown Analysis, Revision

4, contained a listing of the equipment and their function relied upon for post fire safe

shutdown in the approved fire protection program. This analysis credited the use of the

reactor core isolation cooling system and safety relief valves during a control room fire

scenario which forces evacuation. Procedure AOP-0031, Shutdown from Outside the

Main Control Room, Revision 307, was used to shut down the reactor in the event of a

fire that required evacuation of the control room. This procedure contained the steps to

safely shut down the reactor with or without offsite power available. Step 5.10.1 of

Attachment 13 to AOP-0031 provided instructions for opening the circuit breakers for the

motor-driven feedwater pumps and removing the control power fuses within 5 minutes of

evacuating the main control room. Without prompt isolation of the feedwater system,

feedwater could continue to inject and overfill the reactor vessel up to the steam lines.

Flooding the reactor vessel up to the level of the steam lines could disable the reactor

core isolation cooling system and damage the steam lines. The reactor core isolation

cooling system was relied upon in this scenario to restore and maintain reactor vessel

level and control pressure. Overfilling the reactor vessel could also damage the safety

relief valves since they were not analyzed to pass high pressure water. The safety relief

valves are located on the main steam lines upstream of the inboard main steam isolation

valves and are required to open to vent steam to the suppression pool and prevent

reactor vessel overpressure.

Calculation G13.18.12.2-27, 10 CFR 50 Appendix R Manual Action Time Frame,

Revision 1, provided best estimate times for the performance of manual actions to

prevent placing the reactor in an unrecoverable condition. This calculation identified that

- 17 - Enclosure

operators must isolate feedwater with a high priority upon leaving the control room.

The post fire safe shutdown analysis concluded that a time limit of 5 minutes met the

intent of high priority as stated in the calculation.

During a timed walkdown of Procedure AOP-0031, Revision 307, the team noted that it

took 6 minutes 45 seconds for the operators to isolate feedwater injection outside of the

main control room. During subsequent discussions, licensee staff was unable to provide

a technical basis to support why the 5-minute time limit to isolate feedwater was

acceptable. To improve understanding of the issue and to obtain an estimate of the time

available to isolate feedwater, the team observed a simulator scenario with the high

reactor level (Level 8) feedwater trip disabled due to fire damage, and the feedwater

pumps continuing to inject. The level 8 trip is an automatic initiation, which during a fire

scenario was not verified to be free of fire damage and functional. In this scenario, the

inspectors observed that it took approximately 2 minutes for the reactor water level to

reach the level of the main steam lines. From this scenario, the inspectors determined

that the 5-minute time limit appeared nonconservative, in that the licensee could not

demonstrate that it would be sufficient to ensure the availability of all equipment relied

upon for post fire safe shutdown, specifically the reactor core isolation cooling system

would not be available if operators were not able to prevent filling the steam lines with

water.

Analysis. The failure to ensure that feedwater would be isolated prior to overfilling the

reactor pressure vessel and flooding the main steam lines making reactor core isolation

cooling unavailable was a performance deficiency.

The performance deficiency was more than minor because it was associated with the

protection against external events (fire) attribute of the Mitigating Systems Cornerstone

and it adversely affected the cornerstone objective of ensuring the availability, reliability,

and capability of systems that respond to initiating events to prevent undesirable

consequences. The team evaluated this finding using Inspection Manual Chapter 0609,

Appendix F, Fire Protection Significance Determination Process, because it affected

fire protection defense-in-depth strategies involving post fire safe shutdown systems with

plant-wide consequences. A senior reactor analyst performed a Phase 3 evaluation to

determine the risk significance of this finding since it involved a control room fire that led

to control room evacuation.

Since the River Bend Station control room included the plant instrumentation and relay

cabinets, the senior reactor analyst added a generic fire ignition frequency for the relay

room (FIFIR) to the control room fire ignition frequency (FIFCR) listed in the Individual

Plant Examination for External Events. The analyst multiplied the combined fire ignition

frequency by a severity factor (SF) and a non-suppression probability indicating that

operators failed to extinguish the fire within 20 minutes assuming a 2 minute detection

that required a control room evacuation (NPCRE). The resulting control room evacuation

frequency (FCR-EVAC) was:

FCR-EVAC = (FIFCR+FIFIR) * SF * NPCRE

= (9.50E-3/yr + 1.42E-3/yr) * 0.2 * 1.30E-2

= 2.84E-5/yr

- 18 - Enclosure

The control room had a total of 109 cabinets. The analyst determined that a single fire in

only one of these cabinets could lead to the spurious operation and loss of control

function for the feedwater system which could result in overfilling the reactor vessel to

the main steam lines or above. The analyst calculated a bounding change in core

damage frequency for the finding (CDFFIRE-MFW) by multiplying the combined fire ignition

frequency by the fraction of panels containing the affected circuits.

CDFFIRE-MFW = FCR-EVAC * 1 / 109

= 2.84E-5/yr * 0.0092

= 2.61E-7/yr

This frequency was considered to be bounding since it assumed:

1) Fire damage in the applicable cabinet would create circuit faults such that the

feedwater pumps continued to operate and the level 8 trip would be disabled,

resulting in overfilling the reactor vessel above the main steam lines and,

2) The conditional core damage probability given a control room fire with evacuation

and the spurious operation of the feedwater system was equal to one, and

3) The performance deficiency accounted for the entire change in core damage

frequency (i.e., the baseline core damage frequency for this event was zero).

In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment

Integrity Significance Determination Process, the senior risk analyst screened the

finding for its potential risk contribution to large early release frequency (LERF) since the

bounding change in core damage frequency provided a risk significance estimate

greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because

the finding influenced the likelihood of accidents leading to core damage. As

documented in Appendix H, Table 5.1, accident sequences that lead to large early

release frequency for boiling water reactors with Mark III containment include high

pressure transient events.

The analyst determined that most of the sequences involving control room evacuation

with spurious operation of the feedwater system resulted in the reactor coolant system

being at high pressure at the time of vessel breach. Using Table 5.2, Phase 2

Assessment Factors - Type A Findings at Full Power, the analyst selected a large early

release frequency factor of 0.2 for these sequences. The sum of the large early release

frequency score as stated in Step 3.2, LERF Significance Evaluation, was then

quantified. The change in large early release frequency was estimated to be 5.22E-08.

This value agrees with the result of the change in core damage frequency evaluation

that the finding was of very low safety significance (Green).

The finding did not have a crosscutting aspect since it was not indicative of current

performance, in that the licensee had established the incorrect response time more than

three years prior to this finding.

- 19 - Enclosure

Enforcement. License Condition 2.C.(10), Fire Protection, requires that the licensee

comply with the requirements of their fire protection program as specified in Attachment

4. Attachment 4, Fire Protection Program Requirements, states, in part, that the

licensee shall implement and maintain in effect all provisions of the approved fire

protection program as described in the Final Safety Analysis Report for the facility. The

fire protection program requirements are described in section 9.5.1 and appendices 9A

and 9B. Appendix 9A references Design Criterion 240.201A.

Design Criterion 240.201A, Post-Fire Safe Shutdown Analysis, Revision 4, contained a

listing of the equipment and their function relied upon for post fire safe shutdown in the

approved fire protection program. This analysis credited the use of the reactor core

isolation cooling system during a control room fire scenario.

Contrary to this requirement, prior to June 2, 2010, the licensee failed to implement and

maintain in effect all provisions of the approved fire protection program. Specifically, the

licensee failed to ensure that the reactor core isolation cooling system would be

available for post fire safe shutdown during a control room fire scenario. Because this

violation was of very low safety significance and it was entered into the licensees

corrective action program as CR-RBS-2010-01808, this violation is being treated as an

NCV, consistent with the Enforcement Policy and is identified as NCV 05000458/2010006-03, Failure to Implement and Maintain in Effect all Provisions of the

Approved Fire Protection Program.

b.3 Introduction. The team identified a Green noncited violation of License Condition

2.C.(10), Fire Protection, related to the licensee's failure to implement and maintain in

effect all provisions of the approved fire protection program. Specifically, the licensee

failed to adequately test the remote shutdown emergency transfer switch functions used

to assure isolation of safe shutdown equipment from the control room in the event of a

control room evacuation due to fire.

Description. License Condition 2.C.(10), Fire Protection, requires that the licensee

comply with the requirements of their fire protection program as specified in Attachment

4. Attachment 4, Fire Protection Program Requirements, states, in part, that the

licensee shall implement and maintain in effect all provisions of the approved fire

protection program as described in the Final Safety Analysis Report for the facility. The

fire protection program requirements are described in section 9.5.1 and appendices 9A

and 9B. Section 9A.3.4.5, Test and Test Control, requires in part, that a test program

be established and implemented to assure that testing is performed and verified by

inspection to demonstrate conformance with the design and system readiness

requirements. For a fire in the control room requiring control room evacuation, the

functions of the emergency transfer switches are: 1) transfer control of selected

equipment to the remote shutdown panel and other local control stations, and 2) isolate

the applicable fire area circuits to prevent fire damage from disabling or causing

maloperation of equipment. The remote shutdown panel emergency transfer switches

are required to be operated during control room evacuation events per procedure

AOP-0031, Shutdown from Outside the Main Control Room, Revision 307.

Alignment for remote operation is accomplished via a series of transfer switches and

multiplying relays. The River Bend Station design uses General Electric type SB-9 and

Electro Switch type 20KB switches, in conjunction with General Electric model CR120BC

and Gould model J11A relays. During review, the team identified that the testing

- 20 - Enclosure

methodology in the surveillance procedures did not appear adequate to ensure isolation

of power, control and instrumentation circuits from the control room, in that the licensees

surveillance procedures did not ensure that all contacts on the transfer switches used for

isolation of the associated fire area performed their intended function as required. If a

contact used for control room isolation failed to reposition when the emergency transfer

switch was taken to the Emergency position, the surveillance procedures, as written,

would not identify the failed contact. The licensee's surveillance test procedures verified

that the control function was transferred from the main control room to the remote

shutdown panel by operating the equipment from the remote panel. For the isolation

function however, the procedures only checked that control room indicating lights

extinguished on the main control panels as the method of verifying control room circuit

paths were isolated. Using electrical schematic and wiring diagrams, the team was able

to identify examples where control room indicating lights might be extinguished without

ensuring that the control room portion of the circuit was isolated from the emergency

control circuit. The surveillance procedures did not verify that all other parallel control

circuit paths in the associated fire area were isolated. In the event that one or more

contacts used for control room isolation failed to reposition, a fire induced circuit failure

could cause the control power fuses to open or cause maloperation, and result in a loss

of equipment or system required to function to achieve and maintain safe shutdown

conditions in the event of a control room fire. A review of licensee documents indicated

that the isolation function of the emergency transfer switches had not been adequately

tested since 1997.

The licensee performed internal reviews of maintenance and corrective action

documents searching for failures of the emergency transfer switches and multiplying

relays. The licensee also performed reviews of past operability and surveillance tests for

equipment operated by the transfer switch circuitry, and reviewed industry operating

experience for documented failures of the switch and relay types used at River Bend

Station. The industry operating experience review revealed one documented failure of

the SB-9 type switch, but was determined to be due to a switch configuration not

applicable to River Bend Station. The licensee documented their basis for having

reasonable assurance of operability of the emergency transfer switches and relays,

which justified continued operation until their next refueling outage scheduled for

January 2011, at which time validation testing and analysis of the transfer and isolation

circuitry will be performed. The team reviewed a licensee document detailing remote

shutdown panel transfer switch reliability, Corrective Action 1 to LO-LAR-2010-00120,

and held internal discussions with a regional senior reactor analyst to review the

licensees continued operability conclusions and agreed that reasonable assurance of

operability existed.

Analysis. The failure to ensure isolation from the control room during surveillance

testing of emergency transfer switches for safe shutdown equipment controlled from the

remote shutdown panel is a performance deficiency. The performance deficiency was

reviewed against Inspection Manual Chapter 0612, Appendix B "Issue Screening" to

determine whether the performance deficiency was of minor or more-than-minor

significance. The performance deficiency was determined to be sufficiently similar to

Example 4.L of Inspection Manual Chapter 0612, Appendix E, "Examples of Minor

Issues" to reasonably conclude that it satisfied at least one of the minor screening

questions. The finding was more than minor because it was associated with the

procedure quality attribute of the Mitigating Systems Cornerstone in that it adversely

- 21 - Enclosure

affected the cornerstone objective of ensuring the availability, reliability, and capability of

systems that respond to initiating events to prevent undesirable consequences.

The team evaluated the finding using Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, because it affected fire protection

defense-in-depth strategies involving post fire safe shutdown. Using Appendix F,

Attachment 2, Degradation Rating Guidance Specific to Various Fire Protection

Program Elements, the team determined that the finding constituted a low degradation

of the safe shutdown area since the control room isolation feature is expected to display

nearly the same level of effectiveness and reliability as it would had the degradation not

been present. This finding screened as having very low safety significance (Green).

Because the emergency transfer switch surveillance procedures had been in effect since

1997, there was no crosscutting aspect associated with the violation, in that it is not

indicative of current licensee performance.