Text

IR 05000458-13-007; 04/15/2013 - 12/30/2013; River Bend Station; Triennial Fire Protection Team Inspection
	ML14002A437
Person / Time
Site:	River Bend
Issue date:	01/02/2014
From:	Geoffrey Miller; NRC/RGN-IV/DRS/EB-2
To:	Olson E; Entergy Operations
	Miller G
References
	EA-13-110 IR-13-007
	Download: ML14002A437 (58)
	v • d • e

UNITE D S TATE S

NUC LEAR RE GULATOR Y C OMMI S SI ON

R E G IO N I V

1600 EAST LAMAR BLVD

AR L INGTON , TEXAS 7 60 11 - 4511

January 2, 2014

EA-13-110

Mr. Eric W. Olson

Site Vice President

Entergy Operations, Inc.

River Bend Station

5485 US Highway 61N

St. Francisville, LA 70775

SUBJECT: RIVER BEND STATION - NRC TRIENNIAL FIRE PROTECTION INSPECTION

REPORT 05000458/2013007 AND NOTICE OF VIOLATION

Dear Mr. Olson:

On December 30, 2013, the U.S. Nuclear Regulatory Commission (NRC) completed an

inspection at the River Bend Station and discussed the results of this inspection with

Mr. T. Evans and other members of your staff. The inspectors documented the results of this

inspection in the enclosed inspection report.

NRC inspectors documented five findings of very low safety significance (Green) in this report.

Four of these findings involved violations of NRC requirements. The NRC evaluated these

violations in accordance with Section 2.3.2.a of the NRC Enforcement Policy, which appears on

the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

The NRC determined that three of these violations met the criteria to be treated as non-cited

violations. The NRC determined that one violation did not meet the criteria to be treated as a

non-cited violation because the licensee failed to restore compliance within a reasonable period

of time after the violation was identified. Specifically, the licensee failed to implement all of the

required corrective actions for multiple spurious operations concerns prior to November 2, 2012,

which marked the expiration of enforcement discretion for multiple spurious operations

contained in Enforcement Guidance Memorandum 09-002. The violation is cited in the

enclosed Notice of Violation (Notice) and the circumstances surrounding it are described in

detail in the inspection report.

You are required to respond to this letter and should follow the instructions specified in the

enclosed Notice when preparing your response. If you have additional information that you

believe the NRC should consider, you may provide it in your response to the Notice. The NRCs

review of your response to the Notice will also determine whether further enforcement action is

necessary to ensure your compliance with regulatory requirements.

E. Olson -2-

If you contest the violations or significance of these non-cited violations, you should provide a

response within 30 days of the date of this inspection report, with the basis for your denial, to

the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-

0001; with copies to the Regional Administrator, Region IV; the Director, Office of Enforcement,

United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC

Resident Inspector at the River Bend Station.

If you disagree with a cross-cutting aspect assignment or a finding not associated with a

regulatory requirement in this report, you should provide a response within 30 days of the date

of this inspection report, with the basis for your disagreement, to the Regional Administrator,

Region IV, and the NRC Resident Inspector at the River Bend Station.

In accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding,

of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response (if any)

will be available electronically for public inspection in the NRCs Public Document Room or from

the Publicly Available Records (PARS) component of the NRC's Agencywide Documents

Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at

http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Geoffrey B. Miller, Chief

Engineering Branch 2

Division of Reactor Safety

Docket No.: 50-458

License No.: NPF-47

Enclosures: 1 - Notice of Violation

2 - Inspection Report 05000458/2013007

w/Attachment: Supplemental Information

cc w/Enclosure: Electronic Distribution for River Bend Station

E. Olson -3-

Electronic distribution by RIV:

Regional Administrator (Marc.Dapas@nrc.gov)

Deputy Regional Administrator (Steven.Reynolds@nrc.gov)

DRP Director (Kriss.Kennedy@nrc.gov)

DRP Deputy Director (Troy.Pruett@nrc.gov)

DRS Director (Tom.Blount@nrc.gov)

DRS Deputy Director (Jeff.Clark@nrc.gov)

Senior Resident Inspector (Grant.Larkin@nrc.gov)

Resident Inspector (Andy.Barrett@nrc.gov)

RBS Administrative Assistant (Lisa.Day@nrc.gov)

Branch Chief, DRP/C (Don.Allen@nrc.gov)

Senior Project Engineer (Ray.Azua@nrc.gov)

Public Affairs Officer (Victor.Dricks@nrc.gov)

Public Affairs Officer (Lara.Uselding@nrc.gov)

Project Manager (Alan.Wang@nrc.gov)

Branch Chief, DRS/TSB (Ray.Kellar@nrc.gov)

RITS Coordinator (Marisa.Herrera@nrc.gov)

ACES (R4Enforcement.Resource@nrc.gov)

Regional Counsel (Karla.Fuller@nrc.gov)

Technical Support Assistant (Loretta.Williams@nrc.gov)

BC RES/DRA/FRB (MarkHenry.Salley@nrc.gov)

Congressional Affairs Officer (Jenny.Weil@nrc.gov)

RIV/ETA: OEDO (Brett.Rini@nrc.gov)

Accession Number: ML14002A437

SUNSI Rev Compl. xYes No ADAMS xYes No Reviewer Initials GBM

Publicly Avail xYes No Sensitive Yes x No Sens. Type Initials GBM

DRS\EB2:RI SRI: DRP: RI SRA ACES EB2 BC

S. Alferink J. Mateychick A. Barrett D. Loveless H. Gepford G. Miller

/RA/ /RA/ /RA/E /RA/ /RA/ /RA/

12/03/2013 12/04/2013 12/03/2013 12/04/2013 12/05/2013 01/02/2014

OFFICIAL RECORD COPY

NOTICE OF VIOLATION

Entergy Operations, Inc. Docket No. 50-458

River Bend Station License No. NFP-47

EA-13-110

During an NRC inspection completed on December 30, 2013, a violation of NRC requirements

was identified. In accordance with the NRC Enforcement Policy, the violation is listed below:

Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI,

states that measures shall be established to assure that conditions adverse to quality,

such as failures, malfunctions, deficiencies, deviations, defective material and

equipment, and nonconformances are promptly identified and corrected.

Contrary to the above, from November 2, 2012, to December 30, 2013, the licensee

failed to promptly identify and correct conditions adverse to quality. Specifically, the

licensee failed to implement all of the required corrective actions for multiple spurious

operations concerns prior to November 2, 2012, which marked the expiration of

enforcement discretion for multiple spurious operations contained in Enforcement

Guidance Memorandum 09-002.

This violation is associated with a Green significance determination process finding.

Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Inc. is hereby required to

submit a written statement or explanation to the U.S. Nuclear Regulatory Commission,

ATTN: Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional

Administrator, Region IV, and a copy to the NRC Resident Inspector at River Bend Station

within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply

should be clearly marked as a Reply to a Notice of Violation: EA-13-110 and should include:

(1) the reason for the violation, or, if contested, the basis for disputing the violation or severity

level; (2) the corrective steps that have been taken and the results achieved; (3) the corrective

steps that will be taken; and (4) the date when full compliance will be achieved. Your response

may reference or include previous docketed correspondence, if the correspondence adequately

addresses the required response. If an adequate reply is not received within the time specified

in this Notice, an order or a Demand for Information may be issued as to why the license should

not be modified, suspended, or revoked, or why such other action as may be proper should not

be taken. Where good cause is shown, consideration will be given to extending the response

time.

If you contest this enforcement action, you should also provide a copy of your response, with

the basis for your denial, to the Director, Office of Enforcement, United States Nuclear

Regulatory Commission, Washington, DC 20555-0001.

Because your response will be made available electronically for public inspection in the NRC

Public Document Room or from the NRCs document system (ADAMS), accessible from the

NRC Web site at http://www.nrc.gov/reading-rm/adams.html, to the extent possible, it should not

include any personal privacy, proprietary, or safeguards information so that it can be made

available to the public without redaction. If personal privacy or proprietary information is

necessary to provide an acceptable response, then please provide a bracketed copy of your

response that identifies the information that should be protected and a redacted copy of your

response that deletes such information. If you request withholding of such material, you must

-1- Enclosure 1

specifically identify the portions of your response that you seek to have withheld and provide in

detail the bases for your claim of withholding (e.g., explain why the disclosure of information will

create an unwarranted invasion of personal privacy or provide the information required by

10 CFR 2.390(b) to support a request for withholding confidential commercial or financial

information). If safeguards information is necessary to provide an acceptable response, please

provide the level of protection described in 10 CFR 73.21.

Dated this 2nd day of January 2014.

-2- Enclosure 1

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-458

License: NPF-47

Report No.: 05000458/2013007

Licensee: Entergy Operations, Inc.

Facility: River Bend Station

Location: 5485 U.S. Highway 61

St. Francisville, LA

Dates: April 15 through December 30, 2013

Team Leader: S. Alferink, Reactor Inspector, Engineering Branch 2

Inspectors: J. Mateychick, Senior Reactor Inspector, Engineering Branch 2

S. Achen, Reactor Inspector, Engineering Branch 2

A. Barrett, Resident Inspector, Project Branch C

Approved By: Geoffrey B. Miller, Branch Chief

Engineering Branch 2

Division of Reactor Safety

-1- Enclosure 2

SUMMARY OF FINDINGS

IR 05000458/2013007; 04/15/2013 - 12/30/2013; River Bend Station; Triennial Fire Protection

Team Inspection.

The report covered a two-week triennial fire protection team inspection by three specialist

inspectors and one resident inspector from Region IV. The inspectors documented five findings

of very low safety significance (Green) in this report. Four of these findings involved violations

of NRC requirements.

The significance of inspection findings was indicated by their color (i.e., greater than Green,

Green, White, Yellow, or Red) and determined using Inspection Manual Chapter 0609,

Significance Determination Process, dated June 2, 2011. Cross-cutting aspects were

determined using Inspection Manual Chapter 0310, Components Within the Cross Cutting

Areas, dated October 28, 2011. All violations of NRC requirements were dispositioned in

accordance with the NRCs Enforcement Policy dated January 28, 2013. The NRCs program

for overseeing the safe operation of commercial nuclear power reactors is described in

NUREG-1649, Reactor Oversight Process, Revision 4.

A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

Green. The team identified a Green violation of 10 CFR Part 50, Appendix B,

Criterion XVI for the failure to complete corrective actions associated with multiple

spurious operations concerns in a timely manner. Specifically, the licensee failed to

implement all of the required corrective actions for multiple spurious operations concerns

prior to November 2, 2012, which marked the expiration of enforcement discretion for

multiple spurious operations contained in Enforcement Guidance Memorandum 09-002.

The licensee entered this issue into their corrective action program as Condition Report

CR-RBS-2013-03465.

The failure to implement all of the required corrective actions for multiple spurious

operations concerns in a timely manner was a performance deficiency. The

performance deficiency was more than minor because it was associated with the

protection against external events (fire) attribute of the Mitigating Systems Cornerstone

and it adversely affected the cornerstone objective of ensuring the availability, reliability,

and capability of systems that respond to initiating events to prevent undesirable

consequences. The team evaluated this finding using Inspection Manual Chapter 0609,

Appendix F, Fire Protection Significance Determination Process, dated

September 20, 2013, because it affected the ability to reach and maintain safe shutdown

conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to

determine the risk significance of this finding since it involved multiple fire areas. The

senior reactor analyst determined this finding was of very low safety significance

(Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human

Performance area because the licensee failed to ensure supervisory and management

oversight of work activities, including contractors, such that nuclear safety was

supported. H.4(c) (Section 1R05.01.b)

-2- Enclosure 2

Green. The team identified a Green non-cited violation of Technical

Specification 5.4.1.d for the failure to implement and maintain adequate written

procedures covering fire protection program implementation. Specifically, the licensee

failed to maintain an alternative shutdown procedure that ensured operators could safely

shutdown the plant under all postulated control room fire scenarios. The licensee

entered this issue into their corrective action program as Condition Report

CR-RBS-2013-03150.

The failure to maintain adequate written procedures covering fire protection program

implementation was a performance deficiency. The performance deficiency was more

than minor because it was associated with the procedure quality attribute of the

Mitigating Systems Cornerstone and it adversely affected the cornerstone objective of

ensuring the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences. The team evaluated this finding using

Inspection Manual Chapter 0609, Appendix F, Fire Protection Significance

Determination Process, dated September 20, 2013, because it affected the ability to

reach and maintain safe shutdown conditions in case of a fire. A senior reactor analyst

performed a Phase 3 evaluation to determine the risk significance of this finding since it

involved a postulated control room fire that led to control room evacuation. The senior

reactor analyst determined this finding was of very low safety significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present

performance in that the performance deficiency occurred more than three years ago.

(Section 1R05.05.b.1)

Green. The team identified a Green non-cited violation of License Condition 2.C.(10) for

the failure to implement and maintain in effect all provisions of the approved fire

protection program. Specifically, the licensee failed to properly calculate the amount of

time available for operators to perform time critical actions for all control room fire

scenarios. The licensee entered this issue into their corrective action program as

Condition Report CR-RBS-2013-03472.

The failure to properly calculate the amount of time available for operators to perform

time critical actions for all control room fire scenarios was a performance deficiency.

The performance deficiency was more than minor because it was associated with the

protection against external events (fire) attribute of the Mitigating Systems Cornerstone

and it adversely affected the cornerstone objective of ensuring the availability, reliability,

and capability of systems that respond to initiating events to prevent undesirable

consequences. The team evaluated this finding using Inspection Manual Chapter 0609,

Appendix F, Fire Protection Significance Determination Process, dated

September 20, 2013, because it affected the ability to reach and maintain safe shutdown

conditions in case of a fire. A senior reactor analyst performed a Phase 3 evaluation to

determine the risk significance of this finding since it involved a postulated control room

fire that led to control room evacuation. The senior reactor analyst determined this

finding was of very low safety significance (Green).

The finding had a cross-cutting aspect in the Decision Making component of the Human

Performance area because the licensee failed to use conservative assumptions in

decision making when applying the guidance for control room fires contained in the safe

shutdown analysis. H.1(b) (Section 1R05.05.b.2)

-3- Enclosure 2

Green. The team identified a Green non-cited violation of License Condition 2.C.(10) for

the failure to implement and maintain in effect all provisions of the approved fire

protection program. Specifically, the licensee failed to ensure that the communications

systems would work under all postulated control room fire scenarios. The licensee

entered this issue into their corrective action program as Condition Reports

CR-RBS-2013-03243 and CR-RBS-2013-03397.

The failure to ensure that the communications systems would work under all postulated

control room fire scenarios was a performance deficiency. The performance deficiency

was more than minor because it was associated with the protection against external

events (fire) attribute of the Mitigating Systems Cornerstone and it adversely affected the

cornerstone objective of ensuring the availability, reliability, and capability of systems

that respond to initiating events to prevent undesirable consequences. The team

evaluated this finding using Inspection Manual Chapter 0609, Appendix F, Fire

Protection Significance Determination Process, dated September 20, 2013, because it

affected the ability to reach and maintain safe shutdown conditions in case of a fire. A

senior reactor analyst performed a Phase 3 evaluation to determine the risk significance

of this finding since it involved a postulated control room fire that led to control room

evacuation. The senior reactor analyst determined this finding was of very low safety

significance (Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human

Performance area because the licensee failed to ensure supervisory and management

oversight of work activities, including contractors, such that nuclear safety was

supported. H.4(c) (Section 1R05.07.b)

Green. The team identified a Green finding for the failure to properly implement the

engineering change process. Specifically, the licensee failed to update the Maintenance

Rule program and perform the required preventive maintenance tasks after the addition

of three 8-hour Appendix R emergency lights. During subsequent discharge testing, two

of the three lights failed. The licensee entered this issue into their corrective action

program as Condition Reports CR-RBS-2013-03118 and CR-RBS-2013-03273.

The failure to properly implement the engineering change process was a performance

deficiency. The performance deficiency was more than minor because it was associated

with the protection against external events (fire) attribute of the Mitigating Systems

Cornerstone and it adversely affected the cornerstone objective of ensuring the

availability, reliability, and capability of systems that respond to initiating events to

prevent undesirable consequences. The team evaluated this finding using Inspection

Manual Chapter 0609, Appendix F, Fire Protection Significance Determination

Process, dated September 20, 2013, because it affected the ability to reach and

maintain safe shutdown conditions in case of a fire. The team assigned the finding a low

degradation rating since the ability to reach and maintain safe shutdown conditions in

the event of a control room fire would be minimally impacted by the failure of the three

emergency lights to function for 8-hours. Specifically, the team determined that the

alternative shutdown procedure provided operators with an alternate method of verifying

that the emergency diesel generator breaker was closed. Because this finding had a low

degradation rating, it screened as having very low safety significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present

-4- Enclosure 2

performance in that the performance deficiency occurred more than three years ago.

(Section 1R05.08.b)

B. Licensee-Identified Violations

None

-5- Enclosure 2

REPORT DETAILS

1. REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R05 Fire Protection (71111.05T)

This report presents the results of a triennial fire protection inspection conducted in

accordance with NRC Inspection Procedure 71111.05T, Fire Protection (Triennial), at

the River Bend Station. The inspection team evaluated the implementation of the

approved fire protection program in selected risk-significant areas with an emphasis on

the procedures, equipment, fire barriers, and systems that ensure the post-fire capability

to safely shutdown the plant.

Inspection Procedure 71111.05T requires the selection of three to five fire areas for

review. The inspection team used the fire hazards analysis section of the River Bend

Station Individual Plant Examination of External Events to select the following four risk-

significant fire areas (inspection samples) for review:

Fire Area AB-7 D-Tunnel

Fire Area C-4 ACU West Room

Fire Area C-16 Remote Shutdown Room

Fire Area C-24 Control Building General Area

The inspection team evaluated the licensees fire protection program using the

applicable requirements, which included plant Technical Specifications, Operating

License Condition 2.C.(10), NRC safety evaluations, 10 CFR 50.48, and Branch

Technical Position 9.5-1. The team also reviewed related documents that included the

Final Safety Analysis Report, Section 9.5; the fire hazards analysis; and the post-fire

safe shutdown analysis.

Specific documents reviewed by the team are listed in the attachment. Four inspection

samples were completed.

.01 Protection of Safe Shutdown Capabilities

a. Inspection Scope

The team reviewed the piping and instrumentation diagrams, safe shutdown equipment

list, safe shutdown design basis documents, and the post-fire safe shutdown analysis to

verify that the licensee properly identified the components and systems necessary to

achieve and maintain safe shutdown conditions for fires in the selected fire areas. The

team observed walkdowns of the procedures used for achieving and maintaining safe

shutdown in the event of a fire to verify that the procedures properly implemented the

safe shutdown analysis provisions.

For each of the selected fire areas, the team reviewed the separation of redundant safe

shutdown cables, equipment, and components located within the same fire area. The

team also reviewed the licensees method for meeting the requirements

-6- Enclosure 2

of 10 CFR 50.48; Branch Technical Position 9.5-1, Appendix A; and 10 CFR Part 50,

Appendix R,Section III.G. Specifically, the team evaluated whether at least one

post-fire safe shutdown success path remained free of fire damage in the event of a fire.

In addition, the team verified that the licensee met all applicable license commitments.

b. Findings

Introduction. The team identified a Green violation of 10 CFR Part 50, Appendix B,

Criterion XVI for the failure to complete corrective actions associated with multiple

spurious operations concerns in a timely manner. Specifically, the licensee failed to

implement all of the required corrective actions for multiple spurious operations concerns

prior to November 2, 2012, which marked the expiration of enforcement discretion for

multiple spurious operations contained in Enforcement Guidance Memorandum 09-002.

Description. The NRC issued Enforcement Guidance Memorandum 09-002,

Enforcement Discretion for Fire Induced Circuit Faults, on May 14, 2009. The purpose

of this enforcement guidance memorandum was to describe the conditions limiting

enforcement discretion during the resolution of fire protection concerns involving multiple

spurious operations. The enforcement guidance memorandum provided enforcement

discretion for three years from the date of issuance of Regulatory Guide 1.189, Fire

Protection for Nuclear Power Plants, Revision 2, for licensees to complete the

corrective actions for noncompliances associated with multiple spurious operations

concerns. Regulatory Guide 1.189, Revision 2, was issued on November 2, 2009.

Regulatory Guide 1.189, Revision 2, endorsed specific portions of NEI 00-01, Guidance

for Post-Fire Safe-Shutdown Circuit Analysis, Revision 2. Specifically, Regulatory

Guide 1.189, Revision 2, Section 5.3.1.1, Protection for the Safe-Shutdown Success

Path, stated:

The approach outlined in Chapter 4 of NEI 00-01, which relies on the Expert

Panel Process and the Generic List of Multiple Spurious Operations contained in

Appendix G to that document, provides an acceptable methodology for the

identification of multiple spurious actuations that may affect safe shutdown

success path SSCs, when applied in conjunction with this regulatory guide.

Spurious actuations, either single or multiple, with the potential to affect safe-

shutdown success path components should be mitigated in accordance with the

features described in this section; tools such as fire modeling and manual actions

should not be used.

Regulatory Guide 1.189, Revision 2, Section 5.3.1.2, Protection for Components

Important to Safe Shutdown, contained a similar statement:

The approach outlined in Chapter 4 of NEI 00-01, which relies on the Expert

Panel Process and the Generic List of Multiple Spurious Operations contained in

Appendix G, provides an acceptable methodology for the analysis of multiple

spurious operations for protection of components important to safe shutdown,

when applied in conjunction with this regulatory guide.

The licensee began their evaluation of multiple spurious operations in accordance with

NEI 00-01, Revision 2. The licensee formed a multiple spurious operations expert panel,

which met on March 23, 2010, to review the generic list of multiple spurious operations

-7- Enclosure 2

contained in NEI 00-01, Revision 2. The multiple spurious operations expert panel

meeting results were documented in Engineering Planning Management, Inc. (EPM)

Report P2083-02-002, MSO Expert Panel Results, Revision 0, dated May 2010. This

report identified several scenarios that required detailed circuit analyses to resolve.

The licensee had a contractor perform the detailed circuit analyses. The contractor

documented the results of the analyses and recommended additional actions for

scenarios that could not be resolved by circuit analysis in EPM Report P2083-07-001,

Regulatory Guide 1.189 Support Project Final Report, Revision 0, dated August 2010.

The licensee had another contractor perform additional detailed circuit analyses. This

contractor documented the results of the additional analyses and recommended

additional actions for scenarios that still could not be resolved by circuit analysis in

ENERCON Report ENTGRB083-PR-01, Multiple Spurious Operations Circuit Analysis

and Scenario Disposition, Revision 0, dated July 14, 2011.

The licensee formed a supplemental multiple spurious operations expert panel, which

met on August 30-31, 2011, to review the generic list of multiple spurious operations

contained in a draft version of NEI 00-01, Revision 3. The supplemental expert panel

revisited several scenarios that were fundamentally unchanged from NEI 00-01,

Revision 2. The licensee identified additional actions for some of these scenarios, but

failed to complete all of these additional actions by the end of the enforcement discretion

period for multiple spurious operations. The supplemental expert panel results were

documented in Engineering Report RBS-FP-11-0000, Expert Panel for Addressing

Multiple Spurious Operations, Revision 0, dated December 13, 2011.

Prior to the inspection, the licensee addressed all multiple spurious operations scenarios

through analysis only. The licensee determined no plant modifications were needed to

resolve the multiple spurious operations scenarios.

For this inspection, the team focused on the multiple spurious operations scenarios that

were identified during the licensees review of NEI 00-01, Revision 2. The team

identified the following three examples of multiple spurious operations concerns where

the licensee did not complete the corrective actions prior to the end of the enforcement

discretion period, November 2, 2012.

Example 1: Plant-Specific Scenario Diverting the Suppression Pool Inventory to the

Upper Fuel Pool

This scenario involved the spurious opening of the return valve from the residual heat

removal system to the upper pool (1E12*MOVF037A or 1E12*MOVF037B) in the non-

credited train in combination with the spurious operation of the residual heat removal

pump in the non-credited train. The concern was that the residual heat removal pump

would transfer inventory from the suppression pool to the upper pool and negatively

impact the safe shutdown pumps that take suction from the suppression pool.

This scenario was evaluated in ENERCON Report ENTGRB083-PR-01. The team

determined that the licensee took no actions to address the potential loss of suppression

pool inventory. The team reviewed the safe shutdown analysis, which evaluated these

valves as a single spurious operation concern and concluded that the valve in the

credited residual heat removal train would be controlled and would not be susceptible to

-8- Enclosure 2

spurious operation. The safe shutdown analysis did not evaluate the potential impact of

the valve in the non-credited train spuriously opening in combination with the residual

heat removal pump in the non-credited train also spuriously operating.

The team determined that the corrective actions for this scenario were inadequate since

the multiple spurious operations expert panel failed to identify the flow diversion path of

a spuriously operating residual heat removal pump combined with a spuriously opening

valve resulting in the transfer of suppression pool inventory to the upper fuel pool. This

resulted in the licensee failing to evaluate this relevant plant-specific scenario.

Example 2: NEI 00-01, Revision 2, Scenario 2ab - Spurious Opening of Both Reactor

Core Isolation Cooling Test Return to Condensate Storage Tank Valves with Suction

from the Suppression Pool Transferring Inventory to the Condensate Storage Tank

This scenario involved the spurious operation of the reactor core isolation cooling pump

in combination with the spurious operation of multiple valves (1E51*MOVF031,

1E51*MOVF022, and 1E51*MOVF059) required to transfer inventory to the condensate

storage tank. The concern was that the reactor core isolation cooling pump would

transfer inventory from the suppression pool to the condensate storage tank and

negatively impact the safe shutdown pumps that take suction from the suppression pool.

This scenario was evaluated in ENERCON Report ENTGRB083-PR-01, which

concluded that this scenario was not a concern at the River Bend Station. For six fire

areas, the report credited operators terminating the flow from the control room by closing

the reactor core isolation cooling system steam isolation valve 1E51*MOVF063. The

team noted that the evaluation did not establish the maximum time available to respond

to the flow diversion before post-fire safe shutdown would be impacted.

For one fire area (Fire Area C-16), operators may not be able to control

valve 1E51*MOVF063 from the control room. For this fire area, the report credited a

rapid depressurization of the reactor pressure vessel to allow low pressure coolant

injection as a means of reducing the steam pressure available to the reactor core

isolation cooling system turbine and terminating the loss of suppression pool inventory.

Prior to the inspection, the post-fire safe shutdown procedure was not updated to

provide procedural guidance to the control room operators for this scenario. The team

identified that the post-fire safe shutdown procedure contained a note which stated, in

part, It is expected that normal, abnormal, and emergency procedures will be followed

for shutdown. This AOP [Abnormal Operating Procedure] should not be misinterpreted to

be the required method of shutdown. The team identified that, absent guidance in the

post-fire safe shutdown procedure, the rapid depressurization of the reactor pressure

vessel might not occur before the loss of suppression pool inventory impacted the post-

fire safe shutdown.

The team concluded that the evaluation for this scenario contained in ENERCON Report

ENTGRB083-PR-01 was inadequate since it failed to identify the amount of time

available for operators to close the steam isolation valve or initiate a rapid

depressurization of the reactor pressure vessel in order to terminate the loss of

suppression pool inventory. The team concluded that the corrective actions were

untimely since they were not completed by the end of the enforcement discretion period.

These actions were still not completed prior to the beginning of the inspection.

-9- Enclosure 2

Example 3: NEI 00-01, Revision 2, Scenario 2l - Spurious Residual Heat Removal

Minimum Flow Valve Failure to Open with Failure to Establish a Discharge Path

This scenario involved the spurious operation of a residual heat removal pump in the

non-credited train in combination with the spurious closure of the associated minimum

flow valve (1E12*MOVF064A, 1E12*MOVF064B, or 1E12*MOVF064C). The concern

was that the failure to establish a discharge path would lead to pump damage and

possible seal failure for the residual heat removal pump. The loss of suppression pool

inventory through the failed seal could negatively impact the safe shutdown pumps that

take suction from the suppression pool.

This scenario was originally evaluated in EPM Report P2083-07-001. This report

recommended the following additional actions:

Perform a more detailed circuit analysis or evaluate fire modeling to eliminate the

concern,

Perform an evaluation to determine whether pump overheating or cavitation

could result in pump/pipe damage, and

Perform a calculation for water inventory control versus loss rate in case of

system piping failure to determine acceptable plant response times.

These scenarios were also evaluated in ENERCON Report ENTGRB083-PR-01. This

report stated:

As a property protection measure, consider tripping a non-credited residual heat

removal pump locally (at the respective switchgear) should it spuriously start with

a fire in the areas in the areas identified above.

The licensee did not complete the recommended actions by the end of the enforcement

discretion period. The licensee identified that the actions were not completed and

issued Condition Report CR-RBS-2013-0515 on January 29, 2013.

Although the actions were not complete, the licensee did have a contractor calculation

(P2265-0001-1.12) that estimated the time to pump damage after deadheading. This

calculation estimated that a residual heat removal pump would reach its maximum

design temperature of 360 °F within 21.7 minutes after deadheading. The post-fire safe

shutdown procedure was not updated with this information prior to the inspection.

The team concluded that the evaluation contained in ENERCON Report ENTGRB083-

PR-01 was inadequate since it focused on the property protection aspect of the scenario

and failed to consider the safe shutdown aspect of the scenario. Specifically, the team

noted that this scenario could result in pump damage within a relatively short amount of

time which could result in a seal failure and subsequent loss of suppression pool

inventory. The team concluded that the corrective actions were untimely since they

were not completed by the end of the enforcement discretion period. These actions

were still not completed prior to the beginning of the inspection.

- 10 - Enclosure 2

The licensee entered this issue into their corrective action program for further evaluation

and implemented enhanced operator rounds as a compensatory measure for this issue.

Analysis. The failure to implement all of the required corrective actions for multiple

spurious operations concerns in a timely manner was a performance deficiency. The

performance deficiency was more than minor because it was associated with the

protection against external events (fire) attribute of the Mitigating Systems Cornerstone

and it adversely affected the cornerstone objective of ensuring the availability, reliability,

and capability of systems that respond to initiating events to prevent undesirable

consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, dated September 20, 2013,

because it affected the ability to reach and maintain safe shutdown conditions in case of

a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk

significance of this finding since it involved multiple fire areas.

Example 1: Plant-Specific Scenario Diverting the Suppression Pool Inventory to the

Upper Fuel Pool

This scenario involved the spurious opening of the return valve from the residual heat

removal system to the upper pool (1E12*MOVF037A or 1E12*MOVF037B) in the non-

credited train in combination with the spurious operation of the residual heat removal

pump in the non-credited train. The concern was that the residual heat removal pump

would transfer inventory from the suppression pool to the upper pool and negatively

impact the safe shutdown pumps that take suction from the suppression pool.

The senior reactor analyst noted that the upper pool could receive a limited amount of

suppression pool inventory before overfilling. Once the upper pool was full, then any

additional suppression pool inventory would spill back down into the suppression pool.

In response to the senior reactor analysts questions, the licensee performed a

calculation to determine the amount of inventory that was required to fill the upper pool

and the resulting change in net positive suction head for the safe shutdown pumps that

took suction from the suppression pool. The licensee determined that the residual heat

removal pumps could transfer approximately 28,165 gallons of suppression pool

inventory before the upper pool overfilled. This corresponded to a change in net positive

suction head of approximately 6 inches.

The senior reactor analyst reviewed the available and required net positive suction head

for the safe shutdown pumps that took suction from the suppression pool. The senior

reactor analyst noted that the smallest margin between the available and required net

positive suction head was approximately 18 inches. Since the reduction of 6 inches of

net positive suction head would not prevent the safe shutdown pumps from operating,

the senior reactor analyst concluded that this example would lead to a negligible change

in core damage frequency. Therefore, the senior reactor analyst concluded that this

example was of very low safety significance (Green).

- 11 - Enclosure 2

Example 2: NEI 00-01, Revision 2, Scenario 2ab - Spurious Opening of Both Reactor

Core Isolation Cooling Test Return to Condensate Storage Tank Valves with Suction

from the Suppression Pool Transferring Inventory to the Condensate Storage Tank

This scenario involved the spurious operation of the reactor core isolation cooling pump

in combination with the spurious operation of multiple valves (1E51*MOVF031,

1E51*MOVF022, and 1E51*MOVF059) required to transfer inventory to the condensate

storage tank. The concern was that the reactor core isolation cooling pump would

transfer inventory from the suppression pool to the condensate storage tank and

negatively impact the safe shutdown pumps that take suction from the suppression pool.

The senior reactor analyst noted that the condensate storage tank was located at a

higher elevation than the suppression pool. Since the reactor core isolation cooling

pump was normally lined up to take a suction from the condensate storage tank, the

senior reactor analyst noted that the reactor core isolation cooling pump would

preferentially take a suction from the condensate storage tank rather than the

suppression pool.

In response to the senior reactor analysts questions, the licensee performed a

calculation to determine the fraction of suction flow from the condensate storage tank

versus the suppression pool for this scenario. The licensee determined that all of the

flow would come from the condensate storage tank. Since this would result in a

recirculation loop for the reactor core isolation cooling pump that did not reduce any

suppression pool inventory, the senior reactor analyst concluded that this example would

lead to a negligible change in core damage frequency. Therefore, the senior reactor

analyst concluded that this example was of very low safety significance (Green).

Example 3: NEI 00-01, Revision 2, Scenario2) - Spurious Residual Heat Removal

Minimum Flow Valve Failure to Open with Failure to Establish a Discharge Path

This scenario involved the spurious operation of a residual heat removal pump in the

non-credited train in combination with the spurious closure of the associated minimum

flow valve (1E12*MOVF064A, 1E12*MOVF064B, or 1E12*MOVF064C). The concern

was that the failure to establish a discharge path would lead to pump damage and

possible seal failure for the residual heat removal pump. The loss of suppression pool

inventory through the failed seal could negatively impact the safe shutdown pumps that

take suction from the suppression pool.

Since this issue could not be screened out using a qualitative evaluation, the team

performed a plant walkdown to identify fire source/target combinations that could lead to

these fire scenarios. Using the spreadsheets from NUREG-1805, Fire Dynamics Tools

(FDTs) Quantitative Fire Hazard Analysis Methods for the U.S. Nuclear Regulatory

Commission Fire Protection Inspection Program, the team identified six different

source/target combinations (for a total of nine fire scenarios) that could lead to these

multiple spurious operations.

For each scenario, the senior reactor analyst calculated a bounding change in core

damage frequency using the following equation:

CDF = FIF x SF x PNS x PMSO x HEP

- 12 - Enclosure 2

where: FIF denotes the fire ignition frequency adjusted for the number of vertical

sections (for electrical panels) or the critical area (for transients),

SF denotes the severity factor,

PNS denotes the manual non-suppression probability,

PMSO denotes the probability of circuit failures leading to the multiple spurious

operations, and

HEP denotes the human error probability for operators failing to mitigate the

scenario.

The senior reactor analyst used Manual Chapter 0609, Appendix F, Fire Protection

Significance Determination Process, dated September 20, 2013, to obtain values for the

fire ignition frequency, severity factor, and non-suppression probability. The senior

reactor analyst used the best available information contained in the Interim Guidance

Pending Publication of Expert Elicitation Results (ML13165A214) to obtain a value for

the probability of circuit failures leading to the multiple spurious operations.

The senior reactor analyst used the SPAR-H methodology to obtain a human error

probability for these scenarios. In response to the senior reactor analysts questions, the

licensee determined a maximum leak rate of approximately 120 gpm due to a seal

failure. Using the information provided in the first example, the senior reactor analyst

estimated that operators had more than 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months to diagnose the scenario and send an

operator to close the upstream suction valve. The analyst assigned a nominal time of 75

minutes for diagnosis and 20 minutes for action and an available time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for

diagnosis and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for action. The senior reactor analyst used the SPAR-H

methodology and calculated a human error probability of 3.02E-3.

The following table summarizes the Phase 3 evaluation results.

- 13 - Enclosure 2

Heat

Ignition Fire

Release FIF SF PNS PMSO HEP CDF

Source Target

Rate

1RSS* 1RSS*

200 kW 6.00E-05 0.9 1.00 0.81 3.02E-3 1.32E-07

PNL102 PNL102

1RSS* 1RSS*

650 kW 6.00E-05 0.1 1.00 0.81 3.02E-3 1.46E-08

PNL102 PNL102

1ENB-

1TC085R 200 kW 1.20E-04 0.1 1.00 0.56 3.02E-3 2.03E-08

SWG01A

1ENB-

1TC087R 200 kW 2.40E-04 0.1 0.35 0.56 3.02E-3 1.42E-08

INV01A1

1EHS-

200 kW

MCC8A/ 1TC087R 5.17E-05 1 1.00 0.56 3.02E-3 8.74E-08

(HEAF)

14A

Transients 1TC088R 200 kW 3.02E-07 0.1 0.58 0.56 3.02E-3 2.97E-11

Transients 1TC089R 200 kW 3.02E-07 0.1 1.00 0.56 3.02E-3 5.11E-11

1C61* 1C61*

200 kW 1.20E-04 0.9 1.00 0.56 3.02E-3 1.83E-07

PNLP001 PNLP001

1C61* 1C61*

650 kW 1.20E-04 0.1 1.00 0.56 3.02E-3 2.03E-08

PNLP001 PNLP001

Total 4.71E-07

In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment

Integrity Significance Determination Process, the senior reactor analyst screened the

finding for its potential risk contribution to large early release frequency since the

bounding change in core damage frequency provided a risk significance estimate

greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because

the finding influenced the likelihood of accidents leading to core damage. As

documented in Appendix H, Table 5.1, accident sequences that lead to large early

release frequency for boiling water reactors with Mark III containment include high

pressure transient events.

The analyst utilized the plant-specific standardized plant analysis risk model and

determined that most of the sequences involving control room evacuation with a lack of

communications devices to assist operators in stabilizing the plant resulted in the reactor

coolant system being at high pressure at the time of vessel breach. Using Table 5.2,

Phase 2 Assessment Factors - Type A Findings at Full Power, the analyst selected a

large early release frequency factor of 0.2 for these sequences.

The sum of the large early release frequency score as stated in Step 3.2, LERF

Significance Evaluation, was then quantified. The change in large early release

frequency was estimated to be 9.42E-08. This value agrees with the result of the

change in core damage frequency evaluation that this example was of very low safety

significance (Green).

The finding had a cross-cutting aspect in the Work Practices component of the Human

Performance area because the licensee failed to ensure supervisory and management

- 14 - Enclosure 2

oversight of work activities, including contractors, such that nuclear safety was

supported. H.4(c)

Enforcement. Title 10 of the Code of Federal Regulations (10 CFR) Part 50,

Appendix B, Criterion XVI states that measures shall be established to assure that

conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations,

defective material and equipment, and nonconformances are promptly identified and

corrected. Contrary to the above, from November 2, 2012, to November 21, 2013, the

licensee failed to promptly identify and correct conditions adverse to quality.

Specifically, the licensee failed to implement all of the required corrective actions for

multiple spurious operations concerns prior to November 2, 2012, which marked the

expiration of enforcement discretion contained in Enforcement Guidance

Memorandum 09-002.

The licensee entered this issue into their corrective action program as Condition Report

CR-RBS-2013-03465. Because the licensee failed to restore compliance within a

reasonable period of time after this violation was initially identified, this violation is being

treated as a cited violation, consistent with Section 2.3.2.a of the NRC Enforcement

Policy. This is a violation of 10 CFR Part 50, Appendix B, Criterion XVI. A Notice of

Violation is included with this report: VIO 05000458/2013007-01, Failure to Resolve

Noncompliances Associated with Multiple Spurious Operations in a Timely Manner.

.02 Passive Fire Protection

a. Inspection Scope

The team walked down accessible portions of the selected fire areas to observe the

material condition and configuration of the installed fire area boundaries (including walls,

fire doors, and fire dampers) and verify that the electrical raceway fire barriers were

appropriate for the fire hazards in the area. The team compared the installed

configurations to the approved construction details, supporting fire tests, and applicable

license commitments.

The team reviewed installation and qualification records for a sample of rated fire wraps

protecting circuits required for post-fire safe shutdown to ensure the material possessed

an appropriate fire rating and that the installation met the engineering design to achieve

the required 1-hour fire rating.

b. Findings

No findings were identified.

.03 Active Fire Protection

a. Inspection Scope

The team reviewed the design, maintenance, testing, and operation of the fire detection

and suppression systems in the selected fire areas. The team verified the automatic

detection systems and the manual and automatic suppression systems were installed,

tested, and maintained in accordance with the National Fire Protection Association code

- 15 - Enclosure 2

of record or approved deviations and that each suppression system was appropriate for

the hazards in the selected fire areas.

The team performed a walkdown of accessible portions of the detection and suppression

systems in the selected fire areas. The team also performed a walkdown of major

system support equipment in other areas (e.g., fire pumps and Halon supply systems) to

assess the material condition of these systems and components.

The team reviewed the electric and diesel fire pumps flow and pressure tests to verify

that the pumps met their design requirements.

The team assessed the fire brigade capabilities by reviewing training, qualification, and

drill critique records. The team also reviewed pre-fire plans and smoke removal plans

for the selected fire areas to determine if appropriate information was provided to fire

brigade members and plant operators to identify safe shutdown equipment and

instrumentation and to facilitate suppression of a fire that could impact post-fire safe

shutdown capability. In addition, the team inspected fire brigade equipment to determine

operational readiness for firefighting.

The team observed an unannounced fire drill and subsequent drill critique on

April 30, 2013, using the guidance contained in Inspection Procedure 71111.05AQ, Fire

Protection Annual/Quarterly. The team observed fire brigade members fight a

simulated pump motor fire in a control building equipment room. The team verified that

the licensee identified problems, openly discussed them in a self-critical manner at the

drill debrief, and identified appropriate corrective actions. Specific attributes evaluated

were:

Proper wearing of turnout gear and self-contained breathing apparatus;

Proper use and layout of fire hoses;

Employment of appropriate firefighting techniques;

Sufficient firefighting equipment was brought to the scene;

Effectiveness of fire brigade leader communications, command, and control;

Search for victims and propagation of the fire into other areas;

Smoke removal operations;

Utilization of pre-planned strategies;

Adherence to the pre-planned drill scenario; and

Drill objectives.

b. Findings

No findings were identified.

.04 Protection From Damage From Fire Suppression Activities

a. Inspection Scope

The team performed plant walkdowns and document reviews to verify that redundant

trains of systems required for hot shutdown, which are located in the same fire area,

would not be subject to damage from fire suppression activities or from the rupture or

inadvertent operation of fire suppression systems. Specifically, the team verified:

- 16 - Enclosure 2

A fire in one of the selected fire areas would not directly, through production of

smoke, heat, or hot gases, cause activation of suppression systems that could

potentially damage all redundant safe shutdown trains,

A fire in one of the selected fire areas or the inadvertent actuation or rupture of a

fire suppression system would not directly cause damage to all redundant trains

(e.g., sprinkler-caused flooding of other than the locally affected train), and

Adequate drainage is provided in areas protected by water suppression systems.

b. Findings

No findings were identified.

.05 Alternative Shutdown Capability

a. Inspection Scope

Review of Methodology

The team reviewed the safe shutdown analysis, operating procedures, piping and

instrumentation drawings, electrical drawings, the Final Safety Analysis Report, and

other supporting documents to verify that hot and cold shutdown could be achieved and

maintained from outside the control room for fires that require evacuation of the control

room, with or without offsite power available.

The team conducted plant walkdowns to verify that the plant configuration was

consistent with the description contained in the safe shutdown and fire hazards

analyses. The team focused on ensuring the adequacy of systems selected for

reactivity control, reactor coolant makeup, reactor decay heat removal, process

monitoring instrumentation, and support systems functions.

The team also verified that the systems and components credited for shutdown would

remain free from fire damage. Finally, the team verified that the transfer of control from

the control room to the alternative shutdown location would not be affected by

fire-induced circuit faults (e.g., by the provision of separate fuses and power supplies for

alternative shutdown control circuits).

Review of Operational Implementation

The team verified that licensed and non-licensed operators received training on

alternative shutdown procedures. The team also verified that sufficient personnel to

perform a safe shutdown were trained and available onsite at all times, exclusive of

those assigned as fire brigade members.

The team performed a walkdown of the post-fire safe shutdown procedure with licensed

and non-licensed operators to determine the adequacy of the procedure. The team

verified that the operators could be reasonably expected to perform specific actions

within the time required to maintain plant parameters within specified limits. Time critical

actions that were verified included restoring electrical power, establishing control at the

- 17 - Enclosure 2

remote shutdown and local shutdown panels, establishing reactor coolant makeup, and

establishing decay heat removal.

The team also reviewed the periodic testing of the alternative shutdown transfer

capability and instrumentation and control functions to verify that the tests were

adequate to demonstrate the functionality of the alternative shutdown capability.

b. Findings

.1 Inadequate Alternative Shutdown Procedure

Introduction. The team identified a Green non-cited violation of Technical

Specification 5.4.1.d for the failure to implement and maintain adequate written

procedures covering fire protection program implementation. Specifically, the licensee

failed to maintain an alternative shutdown procedure that ensured operators could safely

shutdown the plant under all postulated control room fire scenarios.

Description. The licensee developed Procedure AOP-0031, Shutdown from Outside the

Main Control Room, Revision 320, to shutdown the reactor in the event a fire required

evacuation of the control room. The team performed a walkdown of this procedure and

identified a control room fire scenario where the procedure did not provide adequate

steps for operators to mitigate the scenario. Specifically, this procedure did not provide

steps for operators to mitigate a spurious injection from the high pressure core spray

system. This scenario could be caused by a control room fire that directly caused the

injection through a spurious high pressure core spray system actuation or indirectly

caused the injection through a spurious emergency core cooling system actuation signal.

The alternative shutdown procedure provided a caution for the operators which noted

that some injection systems could not be controlled from the remote shutdown panel and

could result in overfilling or overpressuring the reactor pressure vessel. The caution,

first added to the procedure in 2003, provided the high pressure and low pressure core

spray systems as examples.

Although the procedure provided a caution for the operators, the procedure failed to

provide steps for operators to mitigate the spurious injection of the high pressure core

spray system. In response to the teams concerns, the licensee indicated that operators

would be able to mitigate the scenario by opening the breakers associated with the high

pressure core spray pump. This action was documented and promulgated to operators

in Standing Order 270 during the inspection.

The licensee did not have a calculation to determine the amount of time available for

operators to isolate the high pressure core spray system prior to overfilling the reactor

pressure vessel. In order to obtain an estimate of the amount of time available, the

licensee performed a preliminary evaluation on the simulator. The licensee ran a

simulator scenario with the high reactor level (level 8) trip disabled due to fire damage

with the spurious injection of the high pressure core spray system. In this scenario, the

licensee observed that it took approximately 9 minutes for the reactor water level to

reach the bottom of the main steam lines. The team determined that this was an

insufficient amount of time to ensure operators would identify the spurious operation,

determine the appropriate mitigating action, determine the appropriate operator to

- 18 - Enclosure 2

perform the mitigating action, and complete the action prior to overfilling the reactor

pressure vessel.

The licensee entered this issue into their corrective action program. The licensee

implemented a corrective action for this issue by revising the alternative shutdown

procedure on June 18, 2013.

Analysis. The failure to maintain adequate written procedures covering fire protection

program implementation was a performance deficiency. The performance deficiency

was more than minor because it was associated with the procedure quality attribute of

the Mitigating Systems Cornerstone and it adversely affected the cornerstone objective

of ensuring the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, dated September 20, 2013,

because it affected the ability to reach and maintain safe shutdown conditions in case of

a fire. A senior reactor analyst performed a Phase 3 evaluation to determine the risk

significance of this finding since it involved a postulated control room fire that led to

control room evacuation.

Because the River Bend Station control room included the plant instrumentation and

relay cabinets for Divisions I and II, the senior reactor analyst added a generic fire

ignition frequency for the relay room (FIFIR) to the control room fire ignition frequency

(FIFCR) listed in the Individual Plant Examination for External Events. The analyst

multiplied the combined fire ignition frequency by a severity factor (SF) and a non-

suppression probability indicating that operators failed to extinguish the fire within 20

minutes, assuming a 2 minute detection that required a control room evacuation (NPCRE).

The resulting control room evacuation frequency (FCR-EVAC) was:

FCR-EVAC = (FIFCR + FIFIR) * SF * NPCRE

= (9.50E-3/yr + 1.42E-3/yr) * 0.2 * 1.30E-2

= 2.84E-5/yr

The control room had a total of 109 electrical and control cabinets. The analyst

determined that a fire in one of these cabinets could lead to the spurious operation and

loss of control function for the high pressure core spray system which could result in

overfilling the reactor vessel to the main steam lines or above. The analyst calculated a

bounding change in core damage frequency for the finding (CDFFIRE-HPCS) by multiplying

the control room evacuation frequency by the fraction of panels containing the affected

circuits.

CDFFIRE-HPCS = FCR-EVAC * 1 / 109

= 2.84E-5/yr * 0.0092

= 2.61E-7/yr

This frequency was considered to be bounding since it assumed:

- 19 - Enclosure 2

Fire damage in the applicable cabinet would create circuit faults such that the

high pressure core spray system spuriously injected and the level 8 trip was

disabled, resulting in overfilling the reactor vessel above the main steam lines;

The conditional core damage probability given a control room fire with evacuation

and the spurious injection of the high pressure core spray system was equal to

one; and

The performance deficiency accounted for the entire change in core damage

frequency (i.e., the baseline core damage frequency for this event was zero)

In accordance with the guidance in Manual Chapter 0609, Appendix H, Containment

Integrity Significance Determination Process, the senior reactor analyst screened the

finding for its potential risk contribution to large early release frequency since the

bounding change in core damage frequency provided a risk significance estimate

greater than 1E-7.

The issue represented a Type A finding, based on the guidance in Appendix H, because

the finding influenced the likelihood of accidents leading to core damage. As

documented in Appendix H, Table 5.1, accident sequences that lead to large early

release frequency for boiling water reactors with Mark III containment include high

pressure transient events.

The analyst determined that most of the sequences involving control room evacuation

with spurious operation of the high pressure core spray system resulted in the reactor

coolant system being at high pressure at the time of vessel breach. Using Table 5.2,

Phase 2 Assessment Factors - Type A Findings at Full Power, the analyst selected a

large early release frequency factor of 0.2 for these sequences.

The sum of the large early release frequency score as stated in Step 3.2, LERF

Significance Evaluation, was then quantified. The change in large early release

frequency was estimated to be 5.22E-08. This value agrees with the result of the

change in core damage frequency evaluation that the finding was of very low safety

significance (Green).

The finding did not have a cross-cutting aspect since it was not indicative of present

performance in that the performance deficiency occurred more than three years ago.

Enforcement. Technical Specification 5.4.1.d states that written procedures shall be

established, implemented, and maintained covering fire protection program

implementation. Contrary to the above, from 2003 to November 21, 2013, the licensee

failed to establish, implement, and maintain adequate written procedures covering fire

protection program implementation. Specifically, the licensee failed to maintain an

alternative shutdown procedure that provided steps for operators to mitigate a spurious

injection from the high pressure core spray system.

Because this violation was of very low safety significance and has been entered into the

corrective action program (Condition Report CR-RBS-2013-03150), this violation is

being treated as a non-cited violation, consistent with Section 2.3.2.a of the NRC

Enforcement Policy: NCV 05000458/2013007-02, Inadequate Alternative Shutdown

Procedure.

- 20 - Enclosure 2

.2 Failure to Properly Calculate the Time Available for Operator Actions

Introduction. The team identified a Green non-cited violation of License

Condition 2.C.(10) for the failure to implement and maintain in effect all provisions of the

approved fire protection program. Specifically, the licensee failed to properly calculate

the amount of time available for operators to perform time critical actions for all control

room fire scenarios.

Description. Following the 2010 triennial fire protection inspection, the licensee

reviewed the design basis for determining the amount of time available for operators to

perform select time critical actions in the alternative shutdown procedure. The licensee

determined that several different calculations formed the design basis for determining

the amount of time available.

These calculations were performed in accordance with the safe shutdown analysis and

determined the amount of time available for operators to perform specific actions under

various alternative shutdown scenarios. The safe shutdown analysis incorporated NRC

staff guidance related to control room fire scenarios. Specifically, the safe shutdown

analysis made the following two assumptions: (1) offsite power was lost as well as the

automatic starting of the emergency diesel generators and (2) the automatic function of

valves and pumps whose control circuits could be affected by a control room fire was

lost. The safe shutdown analysis also noted that the only manual action in the control

room prior to evacuation given credit was the reactor trip. Finally, the safe shutdown

analysis noted that the safe shutdown capability should not be adversely affected by any

one spurious action or signal resulting from a fire.

The team reviewed the assumptions, methods, and results of these calculations. The

team identified one alternative shutdown scenario where the licensee failed to properly

calculate the amount of time available for operators to perform time critical actions. This

scenario involved the amount of time available to terminate feedwater injection prior to

overfilling the reactor vessel.

For this scenario, the team noted that overfilling the reactor vessel could disable the

reactor core isolation cooling system and damage the steam lines. The reactor core

isolation cooling system was relied upon in this scenario to restore and maintain reactor

vessel level and control pressure. Overfilling the reactor vessel could also damage the

safety relief valves since they were not analyzed to pass high pressure water.

This issue was first identified during the 2010 triennial fire protection inspection as non-

cited violation 05000458/2010006-03. In response to this violation, the licensee revised

the alternative shutdown procedure to direct the auxiliary control room operators to

immediately terminate feedwater injection by closing the condensate demineralizer

service inlet and outlet isolation valves. The nominal stroke time for these motor-

operated valves was 48 seconds.

In addition, the licensee performed Calculation G13.18.12.2-139, Estimated Time to

Overfill the RPV Due to Continued Feedwater Operation During a Fire in the Main

Control Room, Revision 0, to determine the amount of time available for operators to

terminate feedwater injection prior to overfilling the reactor pressure vessel. This

calculation concluded that operators would have less than 45 seconds available to

terminate feedwater injection if all three of the normally running feedwater pumps

- 21 - Enclosure 2

continued to inject. Based on this calculation, the licensee concluded that the overfill

condition happens so quickly that manual action outside of the control room to mitigate

the concern has a low probability of success. Further, the licensee concluded that

directing the Auxiliary Control Room to close the condensate demin filter valves and the

actual closing of the valves would require more than one minute.

The licensee then generated a corrective action item to perform an evaluation that could

be used as a basis for a deviation request to justify the manual actions to be taken in the

auxiliary control room of closing the condensate demineralizer filter valves for preventing

reactor vessel overfill during a control room fire scenario with the continued injection of

feedwater.

The licensee subsequently revised Calculation G13.18.12.2-139 to examine scenarios

where one or two feedwater pumps continued to inject and the remaining feedwater

pumps stopped. The revised calculation concluded that operators would have

approximately 2 minutes available to terminate feedwater injection if only one of the

normally running feedwater pumps continued to inject. The licensee performed a timed

walkdown of these steps and concluded that operators could perform the required

actions within a range of 1 minute 53 seconds to 2 minutes 15 seconds. The licensee

concluded that no deviation request was necessary since operators could reasonably

perform the actions within the required time and the actions could not be undone by a

control room fire. Further, the licensee noted that this control room fire scenario involved

multiple spurious actuations.

The team reviewed the licensees evaluation and concluded that the licensee incorrectly

implemented the guidance for control room fires contained in the safe shutdown

analysis. Specifically, the team noted that the continued injection of the feedwater

pumps and the loss of automatic actuation/trip signals were part of the design

assumptions for a control room fire and were not considered to be spurious actuations.

The team concluded that the bounding control room fire scenario involved the continued

injection of all three normally running feedwater pumps and operators had less than 45

seconds to terminate feedwater injection.

Based on the timed walkdown of the alternative shutdown procedure, the team

determined that the auxiliary control room operators would complete the immediate

action of terminating feedwater injection in approximately 2 minutes 5 seconds.

The licensee entered this issue into their corrective action program for further evaluation

and implemented enhanced operator rounds as a compensatory measure for this issue.

Analysis. The failure to properly calculate the amount of time available for operators to

perform time critical actions for all control room fire scenarios was a performance

deficiency. The performance deficiency was more than minor because it was associated

with the protection against external events (fire) attribute of the Mitigating Systems

Cornerstone and it adversely affected the cornerstone objective of ensuring the

availability, reliability, and capability of systems that respond to initiating events to

prevent undesirable consequences.

The team evaluated this finding using Inspection Manual Chapter 0609, Appendix F,

Fire Protection Significance Determination Process, dated September 20, 2013,

because it affected the ability to reach and maintain safe shutdown conditions in case of

- 22 - Enclosure 2