IR 05000313/2014009

IR 05000313/2014009; 05000368/2014009; 02/10/2014 - 08/01/2014; Arkansas Nuclear One; Adverse Weather Protection

ML14253A122
Person / Time
Site:	Arkansas Nuclear
Issue date:	09/09/2014
From:	Dapas M NRC Region 4
To:	Jeremy G. Browning Entergy Operations
References
EA-14-088 IR 2014009
Download: ML14253A122 (52)

Text

eptember 09, 2014

SUBJECT:

ARKANSAS NUCLEAR ONE- NRC INSPECTION REPORT 05000313/2014009 AND 05000368/2014009; PRELIMINARY YELLOW FINDING

Dear Mr. Browning:

On August 1, 2014, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at the Arkansas Nuclear One, Unit 1 and Unit 2. The enclosed inspection report presents the results of this inspection. A final exit briefing was conducted with you and other members of your staff on August 1, 2014.

The enclosed inspection report discusses a finding that has preliminarily been determined to be Yellow, meaning a finding of substantial safety significance. As described in Section 1R01 of the enclosed report, the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings could have failed to protect safety-related equipment from flooding due to degraded flood barriers.

The preliminary risk significance was determined using NRC Inspection Manual Chapter 0609, Appendix M, "Significance Determination Process Using Qualitative Criteria." The NRC normally uses probabilistic risk assessment methods and tools to characterize the risk significance of findings via the existing significance determination process (SOP) appendices.

For this issue, due to the uncertainties associated with extreme flooding events and corresponding impacts to the site, we determined that existing probabilistic risk assessment tools do not provide for a reasonable estimate of this complex finding's risk significance in a time frame consistent with the NRC timeliness goals for SOP evaluations. In these instances, Appendix M specifies that a bounding (i.e., worst-case) analysis should be conducted using the best available information, followed by the consideration of appropriate qualitative factors in determining the significance of the associated finding.

Therefore, in conducting an initial bounding analysis, the NRC developed an estimate for the frequency of a significant flooding event that would challenge the Arkansas Nuclear One facility using reference material developed by the U.S. Army Corps of Engineers, predicted flood height information, and actual flood data collected by stream gages over the last 75 years. After reviewing the features of the watershed and the 500-year flood data, the NRC qualitatively determined that the change in core damage frequency was less than 1 x 104 /year. This indicated that the significance of the subject finding is no higher than Yellow.

Once a bounding analysis is completed, Appendix M requires that the risk significance be established using qualitative factors. During this review, we determined that flooding in the Unit 1 and Unit 2 auxiliary and fuel oil storage buildings could result in a complete loss of all risk-significant components necessary for accident mitigation (conditional core damage probability of 1.0). Additionally, alternative mitigating strategies would likely not be available because equipment and connections could be submerged. Based on the evaluation of these and other qualitative factors prescribed by Appendix M and documented in this report, we determined that the preliminary significance of the subject finding was Yellow, a finding of substantial safety significance.

The causes for the degraded flood barriers included inadequate design, construction, and maintenance of those barriers. Examples included over 100 unsealed or degraded penetrations, un-isolable floor drains, and open ventilation ductwork. The inspection team noted that strategies to mitigate a flooding event at the site were deficient and would have required emergency response personnel to identify and implement ways to prevent water intrusion to over 100 unknown sources of in-leakage during a flooding event. Therefore, we did not include credit for mitigation in our risk assessment.

Your staff conducted extensive reviews of these issues in root cause evaluations, documented in Condition Reports CR-ANO-C-2013-01304 and CR-ANO-C-2014-00259. Corrective actions included: sealing penetrations, implementing compensatory measures, and adding appropriate instructions to procedures.

The finding was assessed based on the best available information using the applicable Significance Determination Process. The final resolution of this finding will be conveyed in separate correspondence. This finding also constitutes an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy, which appears on the NRC's Web site at:

http://www.nrc.gov/about-nrc/regulatorv/enforcement/enforce-pol.html.

In accordance with NRC Inspection Manual Chapter 0609, "Significance Determination Process," we intend to complete our evaluation and issue our final determination of safety significance within 90 days from the date of this letter. The NRC's significance determination process is designed to encourage an open dialogue between your staff and the NRC; however, the dialogue should not affect the timeliness of our final determination.

At the exit meeting, you and your staff expressed concerns with the NRC-derived frequency range of 1 x 1o-3/year to 1 x 10-fj/year for the probable maximum precipitation and flood events considered in our qualitative evaluation. Your staff indicated that based on their research, a o-more realistic frequency value was 1 x 1 5/year to 1 x 10-6/year. The NRC risk analysts reviewed the upper confidence limits from your flood frequency curve that ranged from 3. 7 X 10-5/year to 9.1 X 10-5/year, for flooding at Site grade elevation, and determined that the range of uncertainty in your frequency estimate is well within the frequency range used by the NRC. Therefore, no change in the preliminary determination of the safety significance of this finding was made.

During the exit meeting, conducted on August 1, 2014, you requested a regulatory conference to discuss this finding and apparent violation. As such, a regulatory conference to discuss the apparent violation will be conducted at the U.S. Nuclear Regulatory Commission, Region IV office, in Arlington, Texas. The regulatory conference should be held within 30 days of the receipt of this letter and we encourage you to submit supporting documentation, such as your proposed flood frequency and supporting basis, at least one week prior to the conference in an effort to make the conference more efficient and effective. This conference will be open to public observation in accordance with Section 2.4, "Participation in the Enforcement Process,"

of the NRC Enforcement Policy. The NRC will issue a public meeting notice and press release to announce the conference.

Please contact Greg Werner by phone at 817-200-1574 and in writing within 10 days from the issue date of this letter to confirm your intentions to participate in a regulatory conference. If we have not heard from you within 10 days, we will continue with our final significance determination and enforcement decision.

Because the NRC has not made a final determination in this matter, a Notice of Violation will not be issued for this inspection finding at this time. In addition, please be advised that the number and characterization of the apparent violation may change based on further NRC review.

This finding also had a cross-cutting aspect in the area of human performance related to maintaining design margins. Specifically, the licensee did not design, construct, and/or maintain over 100 flood barriers to ensure design margins were sustained.

If you disagree with a cross-cutting aspect assignment in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV; and the NRC resident inspector at the Arkansas Nuclear One facility. In accordance with 10 CFR 2.390, "Public Inspections, Exemptions, Requests for Withholding,"

a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC's Public Document Room or from the Publicly Available Records System (PARS) component of the NRC's Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading -

rm/adams.html (the Public Electronic Reading Room).

Sincerely, Marc L. Dapas Regional Administrator Docket Nos.: 50-313, 50-368 License Nos.: DPR-51, NPF-6

Enclosure:

Inspection Report 05000313/2014009 and 05000368/2014009 Attachment 1: Supplemental Information Attachment 2: Detailed Risk Evaluation

REGION IV==

Docket: 05000313; 05000368 License: DPR-51; NPF-6 EA: EA-14-088 Report: 05000313/2014009; 05000368/2014009 Licensee: Entergy Operations, Inc.

Facility: Arkansas Nuclear One, Unit 1 and Unit 2 Location: Junction of Hwy. 64 West and Hwy. 333 South Russellville, Arkansas Dates: February 10 through August 1, 2014 Inspectors: B. Tindell, Senior Resident Inspector J. Melfi, Project Engineer Risk Analyst: D. Loveless, Senior Reactor Analyst Approved By: G. Werner, Chief Project Branch E Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000313/2014009; 05000368/2014009; 02/10/2014- 08/01/2014; Arkansas Nuclear One;

Adverse Weather Protection.

The inspection activities described in this report were performed between February 10 and August 1, 2014, by the senior resident inspector at Arkansas Nuclear One, along with an inspector and a senior reactor analyst from the NRC's Region IV office. One finding that has preliminarily been determined to be of substantial safety significance (Yellow) for Unit 1 and Unit 2 is documented in this report. The finding is also an apparent violation of NRC requirements and is being considered for escalated enforcement action in accordance with the NRC Enforcement Policy.

The significance of inspection findings is indicated by their color (Green, White, Yellow, or Red),

which is determined using Inspection Manual Chapter 0609, "Significance Determination Process." Their cross-cutting aspects are determined using Inspection Manual Chapter 0310,

"Components Within the Cross-Cutting Areas." Violations of NRC requirements are dispositioned in accordance with the NRC Enforcement Policy. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process."

Cornerstone: Mitigating Systems

• Apparent Violation. The inspectors identified a finding of preliminary substantial safety significance (Yellow) for the failure to design, construct, and maintain the Units 1 and 2 auxiliary and emergency diesel fuel storage buildings in accordance with the safety analysis reports' description of internal and external flood barriers so that they could protect safety-related equipment from flooding. Two apparent violations were associated with this finding:

• Contrary to 10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," the licensee failed to assure that regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions, and that design changes were subjected to design control measures commensurate with those applied to the original design.

• Contrary to 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," the licensee failed to prescribe documented instructions for activities affecting quality and accomplish activities affecting quality in accordance with drawings.

The licensee entered these issues into the corrective action program as Condition Reports CR-ANO-C-2013-01304 and CR-ANO-C-2014-00259. The licensee resolved the safety concern by replacing the degraded seals or parts, installing penetration seals, implementing compensatory measures, and/or incorporating instructions into procedures.

The inspectors determined that the finding was more than minor because it was associated with the protection against external factors attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

Specifically, the performance deficiency resulted in the vulnerability to flooding of safety-

related equipment necessary to maintain core cooling in the auxiliary and emergency diesel fuel storage buildings. The inspectors used Inspection Manual Chapter 0609, Attachment 0609.04, "Initial Characterization of Findings," dated June 19, 2012, and Appendix A, "The Significance Determination Process (SOP) for Findings At-Power," dated June 19, 2012, to evaluate the significance of the finding. In accordance with Appendix A, Exhibit 4, the inspectors determined that a detailed risk evaluation was necessary because, if the flood barriers were assumed to be completely failed, two or more trains of a multi-train system would be degraded during an external flood.

The NRC risk analysts determined that the finding should be evaluated in accordance with NRC Inspection Manual Chapter 0609, Appendix M, "Significance Determination Process Using Qualitative Criteria," April 12, 2012. Appropriate quantitative significance determination process tools did not exist to provide a reasonable estimate of the significance because a plant-specific flood hazard analysis did not exist and was not expected to be available until sometime in 2015. The risk analysts used NRC Inspection Manual Chapter 0609, Appendix M, Table 4.1, "Qualitative Decision-Making Attributes for NRC Management Review," to determine the preliminary safety significance of the finding.

The following were the dominant considerations in reaching a preliminary risk determination conclusion:

• With respect to the auxiliary and emergency diesel fuel storage buildings, there were more than 100 unknown ingress pathways for a flooding event, therefore if an external flood above grade level were to occur, the buildings would flood.

• The unexpected rate of flooding would likely be beyond the licensee's capability to prevent or mitigate as equipment and connections associated with alternative mitigating strategies, could be submerged.

• All reactor core cooling and makeup could fail due to significant flooding of the auxiliary and emergency diesel fuel storage buildings.

• The change in core damage frequency was quantitatively bounded below 2 x 1o-3 and qualitatively determined to likely be less than 1 x 1o-4 . The bounding and qualitative results are based on the frequency of the probable maximum flood event and a loss of all equipment needed for core cooling and makeup.

This finding was preliminarily determined to be of substantial safety significance (Yellow) for Unit 1 and Unit 2, as determined by a Significance and Enforcement Review Panel.

This finding had a cross-cutting aspect in the area of human performance related to maintaining design margins. Specifically, the licensee did not design, construct, and/or maintain over 100 flood barriers to ensure design margins were sustained [H.6].

(Section 1R01)

REPORT DETAILS

REACTOR SAFETY

Cornerstones: Initiating Events, Mitigating Systems, and Barrier Integrity

1R01 Adverse Weather Protection

Readiness to Cope with External Flooding

a. Inspection Scope

On August 1, 2014, the inspectors completed an inspection of the station's readiness to cope with external flooding. After reviewing the licensee's flooding analysis, the inspectors chose two plant areas that were susceptible to flooding:

• Unit 1 and Unit 2, auxiliary building

• Unit 1 and Unit 2, emergency diesel fuel storage building The inspectors reviewed plant design features and licensee procedures for coping with flooding. The inspectors walked down the selected areas to inspect the design features, including the material condition of seals, drains, and flood barriers. The inspectors evaluated whether credited operator actions could be successfully accomplished.

These activities constituted one sample of readiness to cope with external flooding, as defined in Inspection Procedure 71111

.01. b.

Findings

Introduction.

The inspectors identified a finding of preliminary substantial safety significance (Yellow) for the failure to design, construct, and maintain the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings in accordance with the safety analysis reports' description of internal and external flood barriers so that they could protect safety-related equipment from flooding. Two apparent violations were associated with this finding:

• Contrary to 10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," the licensee failed to assure that regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions, and that design changes were subjected to design control measures commensurate with those applied to the original design.

• Contrary to 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," the licensee failed to prescribe documented instructions for activities affecting quality and accomplish activities affecting quality in accordance with drawings.

Description.

This finding dispositions the flooding issues revealed by the March 31, 2013, stator drop event, and also addresses additional flooding concerns identified post event. The licensee and NRC inspectors subsequently conducted flooding walkdowns and identified additional flood paths. The stator drop event and the previous follow-up actions are discussed in NRC Augmented Inspection Team Report 05000313; 368/2013011 (ML13158A242) and NRC Augmented Inspection Team Follow-up Report 05000313; 368/2013012 (ML14083A409 and Errata ML14101A219).

Unit 1, Safety Analysis Report, Amendment 26, Section 5.1.6, "Flooding," defined the design basis for external flooding and stated, in part, that the seismic class 1 structures are designed for the maximum probable flood level at elevation 361 feet above mean sea level (MSL). All seismic class 1 systems and equipment are either located on floors above elevation 361 feet MSL or protected. Sections 5.3.2 and 5.3.5.2 identified the auxiliary and emergency diesel fuel storage buildings as seismic class 1 structures.

Unit 2, Safety Analysis Report, Amendment 25, Section 3.4.4, "Flood Protection,"

defined the design basis for external flooding and stated, in part, that seismic category 1 structures were designed for the probable maximum flood . All category 1 systems and equipment were either located on floors above elevation 369 feet MSL, or are protected.

Table 3.2-2, "Seismic Categories of Systems, Components, and Structures," identified the auxiliary and emergency diesel fuel storage buildings as seismic class 1 structures.

At the end of the inspection period, the following deficient flood protection features had been identified:

1. Unsealed Conduits Based on its flooding walkdowns, the licensee identified over 100 unsealed conduits that penetrated flood barriers for the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings between 335 feet MSL and 361 feet MSL. These unsealed conduits could have allowed floodwater to pass through flood barriers. Unit 1 Drawing A-304, "Wall and Floor Penetrations Key Plan,"

Revision 1, and Unit 2 Drawing A-2002, "Architectural Schematic, Fire and Flood Protection Plans and Sections," Revision 10, referenced which walls, ceilings, and floors were flood barriers that required seals. Unit 1 Drawing A-337, "Wall and Floor Penetrations Enclosure Details," Revision 9, and Unit 2 Drawing Series E-2073, "Electrical Penetration Sealing Details," Revision 3, showed seal installation details that met flood protection requirements. The inspectors determined that the licensee failed to install seals in numerous conduits that could be subjected to flooding. The licensee corrected the deficiencies by installing flood seals.

2. Degraded Seals The March 31, 2013, stator drop event revealed degraded hatch seals that allowed fire water in the turbine building to leak into the Unit 1 auxiliary building.

During extent of condition reviews, the licensee identified 13 degraded hatches for Unit 1 and Unit 2 at 354 feet MSL (site grade elevation). The licensee determined that some hatch seals were degraded from age and some hatch seals were rolled out of place upon installation. From its extent of condition review, the licensee also identified that the building expansion joint between the auxiliary building and containment buildings was significantly degraded and could be subjected to external floodwater by backflooding through un-isolable floor drains.

The inspectors determined that the degraded hatch seals failed to protect safety-related systems from flooding, and that the licensee failed to establish instructions that prescribed how to adequately inspect, replace, and test the seals. The licensee corrected the hatch seal deficiencies by establishing adequate instructions, replacing the seals, and smoke testing the hatches or seal welding the hatches shut. The licensee implemented compensatory measures to plug the floor drains upon notification of a flood to prevent external floodwater from impacting the auxiliary building to containment building expansion joint.

3. Ventilation Penetration

During extent of condition reviews for the degraded hatches, the licensee identified ventilation ductwork that penetrated the Unit 1 auxiliary building flood barrier at 354 feet MSL. The ductwork was designed to have isolation capability; however, during construction, the ductwork blind flange was not fabricated and procedural instructions to isolate this flooding pathway were never developed.

Drawing M-2186, "Heating, Ventilating and Air-Conditioning, Hot Material Machine Shop and Drumming Station," Revision 6, specified a blind flange for isolation of the ductwork in case of a flood.

The inspectors determined that the licensee failed to stage the blind flange and translate the design for flange installation into Procedure OP-1203.025, "Natural Emergencies," Revision 37. The licensee corrected the condition by fabricating a flange and revising the procedure.

4. Floor Drains

During extent of condition reviews for the degraded hatches, the licensee identified that floor drains at 354 feet MSL from the turbine building and old radwaste building sump were routed to the Unit 1 auxiliary building and the lines did not contain isolation valves in case of flooding. The inspector determined that the licensee failed to translate the design requirement to have isolation capability into specifications and drawings for the floor drain system. The licensee corrected the condition by installing a blind flange on the old radwaste building sump drain line and implemented compensatory measures to plug the drain line from the turbine building upon notification of a flood.

5. Auxiliary Building Extension

During extent of condition reviews for the degraded hatches, the licensee identified that some Unit 2 auxiliary building extension pipe penetrations between 335 feet MSL and 354 feet MSL were not sealed between the turbine building and auxiliary building extension. Unit 2 Drawing A-2002, "Architectural Schematic, Fire and Flood Protection Plans and Sections," Revision 10, referenced which walls, ceilings, and floors are flood barriers that required seals.

Unit 2 Drawing Series A-2600, "Fire Barrier Penetration Seal Details," Revision 5, showed seal installation details that met flood barrier requirements.

The inspectors determined that the licensee failed to install seals for pipe penetrations that could be subjected to floodwater. The licensee designed the auxiliary building extension to be watertight in order to protect the auxiliary building because the buildings were connected by a non-watertight door below the design flood elevation. The unsealed pipe penetrations combined with the non-watertight door could lead to flooding of the Unit 2 auxiliary building. The licensee corrected the condition by modifying the non-watertight door connecting the auxiliary building and the extension, so that if the Unit 2 auxiliary building extension flooded, the Unit 2 auxiliary building would not flood.

6. Non-Watertight Door and Hatch

During extent of condition reviews for the degraded hatches, the licensee identified non-watertight Unit 1 Hatch 522 and Unit 2 Door 253 that could be subjected to floodwater at 358 feet MSL. The licensee found that the door and hatch in the area between the Unit 1 and Unit 2 auxiliary building and containments could be subject to external floodwater because the area was below the design flood level, and the area floor drains were connected to Lake Dardanelle without backwater (check) valves. The inspectors determined that the licensee failed to translate design requirements into specifications and drawings for the Hatch 522 and Door 253. The licensee implemented compensatory measures to plug the floor drains upon notification of a flood.

7. Abandoned Equipment

During a flooding walkdown, the inspectors identified unsealed abandoned pipes that penetrated the Unit 1 auxiliary building flood barrier at 354 feet MSL. The inspectors discovered two pipes that penetrated the auxiliary building from the turbine building that were open on both ends. The licensee cut the pipes as part of a modification to abandon the waste solidification system. However, the design change failed to protect the Unit 1 auxiliary building from floodwater, a design requirement. The licensee corrected the condition by installing a blind flange and a pipe cap to seal the pipes.

8. Decay Heat Vault Drain Valves

The March 31, 2013, stator drop event revealed an open decay heat vault drain valve that allowed fire water internal to the auxiliary building to leak into Unit 1 decay heat vault B at 317 feet MSL. Unit 1, Safety Analysis Report, Amendment 26, Section 5.3.2, "Auxiliary Building," stated, in part, that the floor area at elevation 317 feet containing engineered safeguards equipment was partitioned into separate rooms to provide protection in the event of flooding due to a pipe rupture. In addition, the auxiliary building, which contains the decay heat removal vaults, is classified as seismic category 1 and is a safety-related structure; thereby the decay heat removal vaults are also safety-related. Each decay heat vault room contains a decay heat removal pump (low head safety injection) that is needed for accident mitigation.

The licensee determined that the reach rod for the valve was loose, so that the position indication was inaccurate, and that the condition applied to both Unit 1 decay heat vaults' drain valves. The inspectors identified that valve position indicated that the valve was closed for approximately 36 degrees of valve rotation. Consequently, when the valve indicated closed, it could actually be open. As stated above, the Unit 1 Safety Analysis Report indicated that the decay heat vaults were designed to be watertight, and the auxiliary building was designated seismic category 1 (safety-related), which includes the decay heat vaults; however, the inspectors determined that the vault drain valves were classified as non-safety-related components.

The inspectors determined that the licensee failed to identify the loose reach rods during daily operation or surveillance testing, correct the inaccurate position indication, and properly classify the vault drain valves as safety-related. The licensee corrected the deficiencies by replacing the reach rods and ensuring the position indication was accurate. In addition, the licensee initiated Condition Report CR-ANO-C-2014-01477 to document the inspectors concerns with maintenance and classification of the vault drain valves.

9. Startup transformer 2 Buswork The inspectors identified that startup transformer 2 buswork was installed at 360.5 feet MSL. The licensee credited offsite power for Unit 1 and Unit 2 through startup transformer 2 up to the design flood level of 361 feet MSL, as an alternating current power source for vital and non-vital loads. The licensee implemented compensatory actions to seal the buswork upon notification of a flood.

Due to the number and relatively large area of unsealed penetrations affecting both Unit 1 and Unit 2 auxiliary buildings at plant grade or below, an external flood could cause an inflow of approximately 2,000 gallons per minute and overwhelm the total sump pump capacity of 300 gallons per minute. For unsealed penetrations, the inspectors calculated the inflow by creating a matrix of the penetrations, with a static head of water at the penetration given a flood height of 354 feet, 1 inch MSL. The inspectors calculated the potential flow through those unsealed penetrations using the Bernoulli and Darcy Weisbach equations, with the penetration lengths, number of elbows and other restrictions, as indicated on plant drawings, being included in the calculations.

The inspectors estimated the flow through hatches by calculating the flowrate through the hatches during the stator drop event based on water volume and time and applying that potential flowrate to the remainder of hatches and doors. The static head of water on the hatches during the stator drop could approximate a flood height of 354 feet, 1 inch MSL. The Unit 1 and Unit 2 emergency diesel fuel storage building had 14 unsealed conduits that penetrated the flood barrier, and the inflow could overwhelm the sump pump capacity of 15 gallons per minute. The inspectors determined that the auxiliary and emergency diesel fuel storage buildings could flood if water level exceeded site grade elevation.

All core makeup and cooling pumps are below plant grade level inside of the auxiliary building. Some mitigating pumps are inside of watertight rooms internal to the auxiliary building, such as the decay heat removal pumps and the Unit 2 emergency feedwater pumps. The inspectors noted that the rooms were designed and constructed to protect against internal flooding, which is of limited depth and duration. If the auxiliary building flooded from an external flood, the static pressure from the height of water could exceed the design of the watertight rooms and they could also flood, regardless of the position of the decay heat vault drain valves. Therefore, the inspectors concluded that, for Unit 1 and Unit 2, the licensee failed to protect safety-related systems below the design flood level from external floodwater, including equipment inside of vaults. Most importantly, all long-term core makeup and cooling could have failed during an external flood.

In addition to the loss of mitigating pumps, other significant mitigating equipment was affected by the deficient flooding barriers. The emergency diesel fuel storage building could have flooded, submerging the Unit 1 and Unit 2 diesel fuel oil transfer pumps, which could have starved the emergency diesel generators of fuel. Unit 1 and Unit 2 spent fuel pool cooling could have been lost because both units' pumps are in the auxiliary building below flood elevation and are not flood protected. Spent fuel pool makeup would be available from fire protection and service water. Unit 2 outside containment isolation valves were affected because breakers for the valves could be submerged, however the valves were accessible for manual operation and the inside containment isolation valves would be available. Unit 1 and Unit 2 containment spray systems could be submerged. Unit 1 and Unit 2 portable recovery equipment, connections, and other recovery strategies, such as gravity feeding tanks, could be unavailable due to submergence from flooding.

The licensee had previous identification opportunities for the performance deficiency, including minor water leakage into the auxiliary building through seals, which was sometimes treated as nuisance groundwater leakage. NRC Information Notice 07-01, "Recent Operating Experience Concerning Hydrostatic Barriers," contained information about vulnerabilities due to unsealed conduits and lack of flood barrier maintenance, but the licensee only addressed flood barriers between manholes in the yard and the auxiliary building . For the auxiliary building hatch seals, the licensee had been performing 10-year inspection on all hatches, but no condition reports were generated prior to the March 31, 2013, stator drop event, despite the degraded seals.

The licensee designated the degraded turbine building hatch seals as a significant condition adverse to quality and performed a root-cause evaluation as part of the condition reporting process (Condition Report CR-ANO-C-2013-01304). The evaluation focused on preventative maintenance for hatch seals. The licensee also initiated flooding extent of condition reviews outside of the root cause evaluation. From its extent of condition reviews, the licensee identified significant flooding barrier issues related to design and construction. In addition, during walkdowns, the licensee discovered unsealed conduits . Independently, during their respective walkdowns, the inspectors identified unsealed abandoned equipment that penetrated the flood barrier. The licensee performed low level causal evaluations and limited extent of condition reviews for the design and construction issues. The inspectors challenged the licensee that the flooding design and construction issues were a separate significant condition adverse to quality. Subsequently, the licensee initiated a second root cause evaluation in February 2014, as documented in Condition Report CR-ANO-C-2014-00259.

The NRC and licensee identified multiple floodwater paths into the auxiliary building after the licensee had performed flooding walkdowns, as directed by the March 12, 2012, 50.54(f) letter, concerning actions to be taken by licensees that resulted from the Fukushima Dai-ichi nuclear power plant event. The licensee failed to properly identify all flood protection features, as specified in NEI 12-07, "Guidelines for Performing Walkdowns of Plant Flood Protection Features," Revision 0. The essential flood protection features that should have been included, as part of its flooding walkdowns, included auxiliary building floors and ceilings, flood drain system routing, the auxiliary building extension, and offsite power buswork. As a result of the partial walkdowns, additional deficient flood protection features were not identified. The licensee entered this issue into their corrective action program as Condition Reports CR-HQN-2014-00059 and CR-ANO-C-2014-00259. Corrective actions included plans to re-perform the reviews of essential flood protection features, identify those features that were initially not identified, complete the missed portions of the walkdown, and submit corrected information to the NRC.

The licensee determined that the failure to properly identify all flood protection features was due, in part, to incomplete information on flooding barriers; some information not being maintained current; and inadequate oversight of the contractor performing the flood protection walkdowns.

Analysis.

The failure to design, construct, and maintain the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings so that they would protect safety-related equipment from flooding was a performance deficiency. This performance deficiency was more than minor because it was associated with the protection against external factors attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences, and was, therefore, a finding. Specifically, the performance deficiency resulted in the vulnerability of risk-significant equipment in the auxiliary and emergency diesel fuel storage buildings to flooding.

The inspectors used Inspection Manual Chapter 0609, Attachment 0609.04, "Initial Characterization of Findings," dated June 19, 2012, and Appendix A, "The Significance Determination Process (SDP) for Findings At-Power," dated June 19, 2012, to evaluate the significance of the finding. In accordance with Appendix A, Exhibit 4, the inspectors determined that a detailed risk evaluation was necessary because, if the flood barriers were assumed to be completely failed, therefore two or more trains of a multi-train system would be degraded during an external flood. The preliminary risk significance was determined using NRC Inspection Manual Chapter 0609, Appendix M, "Significance Determination Process Using Qualitative Criteria," dated April12, 2012. The NRC normally uses probabilistic risk assessment methods and tools to characterize the risk significance of findings via the existing significance determination process appendices.

For this issue, due to the uncertainties associated with extreme flooding events and corresponding impacts to the site, we determined that existing probabilistic risk assessment tools do not provide for a reasonable estimate of this complex finding's risk significance in a time frame consistent with the NRC timeliness goals for significance determination process evaluations. Appendix M specifies that a bounding (i.e., worst-case) analysis should be conducted using the best available information, followed by the consideration of appropriate qualitative factors in determining the significance of the associated finding. The risk analysts used NRC Inspection Manual Chapter 0609, Appendix M, Table 4.1, "Qualitative Decision-Making Attributes for NRC Management Review," to evaluate these qualitative factors. Based on the evaluation of the qualitative factors prescribed by Appendix M and documented in this report, we determined that the preliminary significance of the subject finding was Yellow, a finding of substantial safety significance. The detailed risk evaluation, including assumptions, is documented in 2 of this report.

This finding had a cross-cutting aspect in the area of human performance related to maintaining design margins. Specifically, the licensee did not design, construct, and/or maintain over 100 flood barriers to ensure design margins were sustained [H

.6 ].

Enforcement.

The inspectors identified two apparent violations associated with the performance deficiency. As a result of these apparent violations, the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings could allow floodwater to submerge safety-related equipment.

Design Title 10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," states, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in § 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies, are correctly translated into specifications, drawings, procedures, and instructions.

Design changes shall be subject to design control measures commensurate with those applied to the original design.

Unit 1, Safety Analysis Report, Amendment 26, Section 5.1.6, "Flooding," defined the design basis and stated, in part, that the seismic class 1 structures are designed for the maximum probable flood level at elevation 361 feet MSL. All seismic class 1 systems and equipment are either located on floors above elevation 361 feet or protected. Sections 5.3.2 and 5.3.5.2 identified the auxiliary building and emergency diesel fuel storage vault, both quality-related, as seismic class 1 structures.

Unit 2, Safety Analysis Report, Amendment 25, Section 3.4.4, "Flood Protection,"

defined the design basis and stated, in part, that seismic category 1 structures were designed for the probable maximum flood. All category 1 systems and equipment were either located on floors above elevation 369 feet, or are protected. Table 3.2-2, "Seismic Categories of Systems, Components, and Structures," identified the auxiliary building and emergency diesel fuel storage vault, both quality-related, as seismic class 1 structures.

Unit 1, Safety Analysis Report, Amendment 26, Section 5.3.2, "Auxiliary Building,"

stated, in part, that the floor area at elevation 317 feet containing engineered safeguards equipment was partitioned into separate rooms to provide protection in the event of flooding due to a pipe rupture.

Contrary to the above, as of March 31, 2013, the licensee failed to assure that applicable regulatory requirements and the design basis were correctly translated into specifications, drawings, procedures, and instructions and that design changes were subject to design control measures commensurate with those applied to the original design. Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:

a. The licensee failed to include a flooding procedural step to install a blind flange in a ventilation duct that penetrated the Unit 1 auxiliary building below the design flood level.

b. The licensee failed to design the floor drain system with isolation capability so that drains from the turbine building and radwaste storage building, which are non-flood protected structures, would not drain into the Unit 1 auxiliary building in a flood.

c. The licensee failed to design the Unit 1 Hatch 522 and Unit 2 Door 253, which allow access to the area between the auxiliary buildings and containment buildings, to withstand the design flood level.

d. The licensee failed to seal open penetrations into the Unit 1 auxiliary building below the design flood level that were created when the licensee abandoned portions of the waste solidification system.

e. The licensee failed to assure that the Unit 1 decay heat vault drain valves were specified as safety-related, as required to maintain the vaults watertight.

Construction and Maintenance Title 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," states, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings of a type appropriate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings.

Unit 1 Quality Drawing A-304, Sheet 1, "Wall and Floor Penetrations Key Plan,"

Revision 1, and Unit 2, Quality Drawings A-2002, "Architectural Schematic, Fire and Flood Protection Plans and Sections," Revision 10, prescribed walls, ceilings, and floors as flood barriers that required seals.

Unit 1, Quality Drawing A-337, "Wall and Floor Penetrations Enclosure Details,"

Revision 9, and Unit 2 Quality Drawing Series E-2073, "Electrical Penetration Sealing Details," Revision 3, prescribed conduit seal installation details that would act as a barrier to floodwater. Unit 2 Quality Drawing Series A-2600, "Fire Barrier Penetration Seal Details," Revision 5, prescribed pipe penetration seal details that would act as a barrier to floodwater.

Contrary to the above, as of March 31, 2013, the licensee did not prescribe activities affecting quality by documented instructions or procedures and accomplish activities affecting quality in accordance with drawings. Specifically, the licensee failed to assure that safety-related equipment below the design flood level was protected in the following examples:

a. The licensee failed to install seals in conduits that penetrated flood barriers for the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings.

b. The licensee failed to install seals in pipe penetrations that penetrated flood barriers for the Unit 2 auxiliary building extension.

c. The licensee failed to, for the Unit 1 and Unit 2 auxiliary building hatches and building expansion joints between the building and containment: ( 1) provide appropriate seal inspection criteria;

(2) establish a replacement frequency for the seals; and

(3) develop post-maintenance test procedures to verify the effectiveness of the seals after they were reinstalled .

The licensee entered these issues into the corrective action program as Condition Reports CR-ANO-C-2013-01304 and CR-ANO-C-2014-00259. For the identified conditions in both violations, the licensee has replaced the degraded seals or parts, installed penetration seals, implemented compensatory measures, or added appropriate instructions to procedures. Because this finding has been preliminarily determined to be of substantial safety significance (Yellow) for Unit 1 and Unit 2, it is being treated as an apparent violation in accordance with the NRC's Enforcement Policy, and its final significance will be dispositioned in future correspondence:

AV 05000313/2014009-01; 05000368/2014009-01, "Inadequate Flood Protection for Auxiliary and Emergency Diesel Fuel Storage Buildings."

1R04 Equipment Alignment

Partial Walkdown

a. Inspection Scope

The inspectors performed a partial system walk-down of the following risk-significant system :

• May 14, 2014, Unit 1, decay heat vault floor drains The inspectors reviewed the licensee's procedures and system design information to determine the correct lineup for the system. They visually verified that critical portions of the system were correctly aligned for the existing plant configuration.

These activities constituted one partial system walk-down sample as defined in Inspection Procedure 71111

===.04.

=

No findings were identified.

OTHER ACTIVITIES

Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity, Emergency Preparedness, Public Radiation Safety, Occupational Radiation Safety, and Security 40A2 Problem Identification and Resolution (71152)

Annual Follow-up of Selected Issues

a. Inspection Scope

The inspectors selected one issue for an in-depth follow-up:

• On April 24, 2014, the inspectors reviewed Condition Report CR-HQN-2014-00059 related to deficiencies with the licensee's flooding walkdowns.

The inspectors assessed the licensee's problem identification threshold, cause analyses, extent of condition reviews and compensatory actions. The inspectors verified that the licensee appropriately prioritized the planned corrective actions.

These activities constitute completion of one annual follow-up sample as defined in Inspection Procedure 71152.

b. Findings

No findings were identified.

40A3 Follow-up of Events and Notices of Enforcement Discretion (71153)

(Closed) Licensee Event Report 05000313/2014-01-00. Inadequate External Flood Protection for Safety-Related Equipment Located Below the Design Basis Flood Elevation The NRC and licensee identified numerous deficient design features and procedures for protection against flooding. Examples included missing conduit seals, degraded or missing gaskets, roof leaks, groundwater intrusion, cross-connected floor drains, and a segment of an offsite power bus that was below the design external flood level. The potential existed for floodwater to migrate into the auxiliary building where pumps and equipment required for safe shutdown were located. The licensee identified root causes involving a lack of configuration control and a lack of robust design for flood barriers.

The inspectors documented a finding in Section 1R01 of this inspection report that covered the deficient conditions discussed in the event report.

These activities constitute completion of one event follow-up sample, as defined in Inspection Procedure 71153.

40A5 Other Activities (Closed) Unresolved Item 05000313/2013011-005. "Flood Barrier Effectiveness" As documented in NRC Augmented Inspection Team Report 05000313; 368/2013011 ,

additional inspection was required to determine the causes and impact of the degraded flood hatch seals and the partially open decay heat vault B drain isolation valve that were revealed by the March 31, 2013, stator drop event. NRC Augmented Inspection Team Follow-up Report 05000313; 368/2013012 discussed that the inspectors had not completed their evaluation of the licensee's extent of condition for the degraded flood barriers. This report documents numerous deficient flood protection barriers that made the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings susceptible to flooding. Refer to Section 1R01 of this report for a detailed description of the findings and apparent violations.

40A6 Meetings, Including Exit

Exit Meeting Summary

On August 1, 2014, the inspectors presented the inspection results to Mr. J. Kowalewski ,

Senior Vice President and Chief Operating Officer, Entergy Southern Regional Operations, and other members of the licensee staff. The licensee acknowledged the issues presented. The licensee confirmed that any proprietary information reviewed by the inspectors had been returned or destroyed.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

J. Browning, Site Vice President

D. James, Director, Regulatory and Performance Department

S. Pyle, Manager, Regulatory Assurance

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000313/2014009-01; AV Inadequate Flood Protection for Auxiliary and Emergency Diesel

05000368/2014009-01 Fuel Storage Buildings (Section 1R01)

Closed

05000313/2013011-05 URI Flood Barrier Effectiveness (Section 40A5)

05000313/2014-01-00 LER Inadequate External Flood Protection for Safety-Related Equipment Located Below the Design Basis Flood Elevation (Section 40A3)